?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
s4:torture/rpc/netlogon.c - "LogonGetDomainInfo" test - make it compatible against...
[Samba/nascimento.git] / source4 / torture / rpc / netlogon.c
blobc2ff86d877a37a144d34b01c182071912d6dc7e7
1 /*
2 Unix SMB/CIFS implementation.
3
4 test suite for netlogon rpc operations
5
6 Copyright (C) Andrew Tridgell 2003
7 Copyright (C) Andrew Bartlett <abartlet@samba.org> 2003-2004
8 Copyright (C) Tim Potter 2003
9 Copyright (C) Matthias Dieter Wallnöfer 2009-2010
10
11 This program is free software; you can redistribute it and/or modify
12 it under the terms of the GNU General Public License as published by
13 the Free Software Foundation; either version 3 of the License, or
14 (at your option) any later version.
15
16 This program is distributed in the hope that it will be useful,
17 but WITHOUT ANY WARRANTY; without even the implied warranty of
18 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
19 GNU General Public License for more details.
20
21 You should have received a copy of the GNU General Public License
22 along with this program. If not, see <http://www.gnu.org/licenses/>.
23 */
24
25 #include "includes.h"
26 #include "lib/events/events.h"
27 #include "lib/cmdline/popt_common.h"
28 #include "torture/rpc/rpc.h"
29 #include "../lib/crypto/crypto.h"
30 #include "libcli/auth/libcli_auth.h"
31 #include "librpc/gen_ndr/ndr_netlogon_c.h"
32 #include "librpc/gen_ndr/ndr_lsa_c.h"
33 #include "param/param.h"
34 #include "libcli/security/security.h"
35 #include "lib/ldb/include/ldb.h"
36 #include "lib/util/util_ldb.h"
37 #include "lib/ldb_wrap.h"
38
39 #define TEST_MACHINE_NAME "torturetest"
40
41 static bool test_LogonUasLogon(struct torture_context *tctx,
42 struct dcerpc_pipe *p)
43 {
44 NTSTATUS status;
45 struct netr_LogonUasLogon r;
46 struct netr_UasInfo *info = NULL;
47
48 r.in.server_name = NULL;
49 r.in.account_name = cli_credentials_get_username(cmdline_credentials);
50 r.in.workstation = TEST_MACHINE_NAME;
51 r.out.info = &info;
52
53 status = dcerpc_netr_LogonUasLogon(p, tctx, &r);
54 torture_assert_ntstatus_ok(tctx, status, "LogonUasLogon");
55
56 return true;
57 }
58
59 static bool test_LogonUasLogoff(struct torture_context *tctx,
60 struct dcerpc_pipe *p)
61 {
62 NTSTATUS status;
63 struct netr_LogonUasLogoff r;
64 struct netr_UasLogoffInfo info;
65
66 r.in.server_name = NULL;
67 r.in.account_name = cli_credentials_get_username(cmdline_credentials);
68 r.in.workstation = TEST_MACHINE_NAME;
69 r.out.info = &info;
70
71 status = dcerpc_netr_LogonUasLogoff(p, tctx, &r);
72 torture_assert_ntstatus_ok(tctx, status, "LogonUasLogoff");
73
74 return true;
75 }
76
77 bool test_SetupCredentials(struct dcerpc_pipe *p, struct torture_context *tctx,
78 struct cli_credentials *credentials,
79 struct netlogon_creds_CredentialState **creds_out)
80 {
81 NTSTATUS status;
82 struct netr_ServerReqChallenge r;
83 struct netr_ServerAuthenticate a;
84 struct netr_Credential credentials1, credentials2, credentials3;
85 struct netlogon_creds_CredentialState *creds;
86 const struct samr_Password *mach_password;
87 const char *machine_name;
88
89 mach_password = cli_credentials_get_nt_hash(credentials, tctx);
90 machine_name = cli_credentials_get_workstation(credentials);
91
92 torture_comment(tctx, "Testing ServerReqChallenge\n");
93
94 r.in.server_name = NULL;
95 r.in.computer_name = machine_name;
96 r.in.credentials = &credentials1;
97 r.out.return_credentials = &credentials2;
98
99 generate_random_buffer(credentials1.data, sizeof(credentials1.data));
100
101 status = dcerpc_netr_ServerReqChallenge(p, tctx, &r);
102 torture_assert_ntstatus_ok(tctx, status, "ServerReqChallenge");
103
104 a.in.server_name = NULL;
105 a.in.account_name = talloc_asprintf(tctx, "%s$", machine_name);
106 a.in.secure_channel_type = cli_credentials_get_secure_channel_type(credentials);
107 a.in.computer_name = machine_name;
108 a.in.credentials = &credentials3;
109 a.out.return_credentials = &credentials3;
110
111 creds = netlogon_creds_client_init(tctx, a.in.account_name,
112 a.in.computer_name,
113 &credentials1, &credentials2,
114 mach_password, &credentials3,
115 0);
116 torture_assert(tctx, creds != NULL, "memory allocation");
117
118
119 torture_comment(tctx, "Testing ServerAuthenticate\n");
120
121 status = dcerpc_netr_ServerAuthenticate(p, tctx, &a);
122
123 /* This allows the tests to continue against the more fussy windows 2008 */
124 if (NT_STATUS_EQUAL(status, NT_STATUS_DOWNGRADE_DETECTED)) {
125 return test_SetupCredentials2(p, tctx, NETLOGON_NEG_AUTH2_ADS_FLAGS,
126 credentials,
127 cli_credentials_get_secure_channel_type(credentials),
128 creds_out);
129 }
130
131 torture_assert_ntstatus_ok(tctx, status, "ServerAuthenticate");
132
133 torture_assert(tctx, netlogon_creds_client_check(creds, &credentials3),
134 "Credential chaining failed");
135
136 *creds_out = creds;
137 return true;
138 }
139
140 bool test_SetupCredentials2(struct dcerpc_pipe *p, struct torture_context *tctx,
141 uint32_t negotiate_flags,
142 struct cli_credentials *machine_credentials,
143 int sec_chan_type,
144 struct netlogon_creds_CredentialState **creds_out)
145 {
146 NTSTATUS status;
147 struct netr_ServerReqChallenge r;
148 struct netr_ServerAuthenticate2 a;
149 struct netr_Credential credentials1, credentials2, credentials3;
150 struct netlogon_creds_CredentialState *creds;
151 const struct samr_Password *mach_password;
152 const char *machine_name;
153
154 mach_password = cli_credentials_get_nt_hash(machine_credentials, tctx);
155 machine_name = cli_credentials_get_workstation(machine_credentials);
156
157 torture_comment(tctx, "Testing ServerReqChallenge\n");
158
159
160 r.in.server_name = NULL;
161 r.in.computer_name = machine_name;
162 r.in.credentials = &credentials1;
163 r.out.return_credentials = &credentials2;
164
165 generate_random_buffer(credentials1.data, sizeof(credentials1.data));
166
167 status = dcerpc_netr_ServerReqChallenge(p, tctx, &r);
168 torture_assert_ntstatus_ok(tctx, status, "ServerReqChallenge");
169
170 a.in.server_name = NULL;
171 a.in.account_name = talloc_asprintf(tctx, "%s$", machine_name);
172 a.in.secure_channel_type = sec_chan_type;
173 a.in.computer_name = machine_name;
174 a.in.negotiate_flags = &negotiate_flags;
175 a.out.negotiate_flags = &negotiate_flags;
176 a.in.credentials = &credentials3;
177 a.out.return_credentials = &credentials3;
178
179 creds = netlogon_creds_client_init(tctx, a.in.account_name,
180 a.in.computer_name,
181 &credentials1, &credentials2,
182 mach_password, &credentials3,
183 negotiate_flags);
184
185 torture_assert(tctx, creds != NULL, "memory allocation");
186
187 torture_comment(tctx, "Testing ServerAuthenticate2\n");
188
189 status = dcerpc_netr_ServerAuthenticate2(p, tctx, &a);
190 torture_assert_ntstatus_ok(tctx, status, "ServerAuthenticate2");
191
192 torture_assert(tctx, netlogon_creds_client_check(creds, &credentials3),
193 "Credential chaining failed");
194
195 torture_comment(tctx, "negotiate_flags=0x%08x\n", negotiate_flags);
196
197 *creds_out = creds;
198 return true;
199 }
200
201
202 static bool test_SetupCredentials3(struct dcerpc_pipe *p, struct torture_context *tctx,
203 uint32_t negotiate_flags,
204 struct cli_credentials *machine_credentials,
205 struct netlogon_creds_CredentialState **creds_out)
206 {
207 NTSTATUS status;
208 struct netr_ServerReqChallenge r;
209 struct netr_ServerAuthenticate3 a;
210 struct netr_Credential credentials1, credentials2, credentials3;
211 struct netlogon_creds_CredentialState *creds;
212 struct samr_Password mach_password;
213 uint32_t rid;
214 const char *machine_name;
215 const char *plain_pass;
216
217 machine_name = cli_credentials_get_workstation(machine_credentials);
218 plain_pass = cli_credentials_get_password(machine_credentials);
219
220 torture_comment(tctx, "Testing ServerReqChallenge\n");
221
222 r.in.server_name = NULL;
223 r.in.computer_name = machine_name;
224 r.in.credentials = &credentials1;
225 r.out.return_credentials = &credentials2;
226
227 generate_random_buffer(credentials1.data, sizeof(credentials1.data));
228
229 status = dcerpc_netr_ServerReqChallenge(p, tctx, &r);
230 torture_assert_ntstatus_ok(tctx, status, "ServerReqChallenge");
231
232 E_md4hash(plain_pass, mach_password.hash);
233
234 a.in.server_name = NULL;
235 a.in.account_name = talloc_asprintf(tctx, "%s$", machine_name);
236 a.in.secure_channel_type = cli_credentials_get_secure_channel_type(machine_credentials);
237 a.in.computer_name = machine_name;
238 a.in.negotiate_flags = &negotiate_flags;
239 a.in.credentials = &credentials3;
240 a.out.return_credentials = &credentials3;
241 a.out.negotiate_flags = &negotiate_flags;
242 a.out.rid = &rid;
243
244 creds = netlogon_creds_client_init(tctx, a.in.account_name,
245 a.in.computer_name,
246 &credentials1, &credentials2,
247 &mach_password, &credentials3,
248 negotiate_flags);
249
250 torture_assert(tctx, creds != NULL, "memory allocation");
251
252 torture_comment(tctx, "Testing ServerAuthenticate3\n");
253
254 status = dcerpc_netr_ServerAuthenticate3(p, tctx, &a);
255 torture_assert_ntstatus_ok(tctx, status, "ServerAuthenticate3");
256 torture_assert(tctx, netlogon_creds_client_check(creds, &credentials3), "Credential chaining failed");
257
258 torture_comment(tctx, "negotiate_flags=0x%08x\n", negotiate_flags);
259
260 /* Prove that requesting a challenge again won't break it */
261 status = dcerpc_netr_ServerReqChallenge(p, tctx, &r);
262 torture_assert_ntstatus_ok(tctx, status, "ServerReqChallenge");
263
264 *creds_out = creds;
265 return true;
266 }
267
268 /*
269 try a change password for our machine account
270 */
271 static bool test_SetPassword(struct torture_context *tctx,
272 struct dcerpc_pipe *p,
273 struct cli_credentials *machine_credentials)
274 {
275 NTSTATUS status;
276 struct netr_ServerPasswordSet r;
277 const char *password;
278 struct netlogon_creds_CredentialState *creds;
279 struct netr_Authenticator credential, return_authenticator;
280 struct samr_Password new_password;
281
282 if (!test_SetupCredentials(p, tctx, machine_credentials, &creds)) {
283 return false;
284 }
285
286 r.in.server_name = talloc_asprintf(tctx, "\\\\%s", dcerpc_server_name(p));
287 r.in.account_name = talloc_asprintf(tctx, "%s$", TEST_MACHINE_NAME);
288 r.in.secure_channel_type = cli_credentials_get_secure_channel_type(machine_credentials);
289 r.in.computer_name = TEST_MACHINE_NAME;
290 r.in.credential = &credential;
291 r.in.new_password = &new_password;
292 r.out.return_authenticator = &return_authenticator;
293
294 password = generate_random_password(tctx, 8, 255);
295 E_md4hash(password, new_password.hash);
296
297 netlogon_creds_des_encrypt(creds, &new_password);
298
299 torture_comment(tctx, "Testing ServerPasswordSet on machine account\n");
300 torture_comment(tctx, "Changing machine account password to '%s'\n",
301 password);
302
303 netlogon_creds_client_authenticator(creds, &credential);
304
305 status = dcerpc_netr_ServerPasswordSet(p, tctx, &r);
306 torture_assert_ntstatus_ok(tctx, status, "ServerPasswordSet");
307
308 if (!netlogon_creds_client_check(creds, &r.out.return_authenticator->cred)) {
309 torture_comment(tctx, "Credential chaining failed\n");
310 }
311
312 /* by changing the machine password twice we test the
313 credentials chaining fully, and we verify that the server
314 allows the password to be set to the same value twice in a
315 row (match win2k3) */
316 torture_comment(tctx,
317 "Testing a second ServerPasswordSet on machine account\n");
318 torture_comment(tctx,
319 "Changing machine account password to '%s' (same as previous run)\n", password);
320
321 netlogon_creds_client_authenticator(creds, &credential);
322
323 status = dcerpc_netr_ServerPasswordSet(p, tctx, &r);
324 torture_assert_ntstatus_ok(tctx, status, "ServerPasswordSet (2)");
325
326 if (!netlogon_creds_client_check(creds, &r.out.return_authenticator->cred)) {
327 torture_comment(tctx, "Credential chaining failed\n");
328 }
329
330 cli_credentials_set_password(machine_credentials, password, CRED_SPECIFIED);
331
332 torture_assert(tctx,
333 test_SetupCredentials(p, tctx, machine_credentials, &creds),
334 "ServerPasswordSet failed to actually change the password");
335
336 return true;
337 }
338
339 /*
340 try a change password for our machine account
341 */
342 static bool test_SetPassword_flags(struct torture_context *tctx,
343 struct dcerpc_pipe *p,
344 struct cli_credentials *machine_credentials,
345 uint32_t negotiate_flags)
346 {
347 NTSTATUS status;
348 struct netr_ServerPasswordSet r;
349 const char *password;
350 struct netlogon_creds_CredentialState *creds;
351 struct netr_Authenticator credential, return_authenticator;
352 struct samr_Password new_password;
353
354 if (!test_SetupCredentials2(p, tctx, negotiate_flags,
355 machine_credentials,
356 cli_credentials_get_secure_channel_type(machine_credentials),
357 &creds)) {
358 return false;
359 }
360
361 r.in.server_name = talloc_asprintf(tctx, "\\\\%s", dcerpc_server_name(p));
362 r.in.account_name = talloc_asprintf(tctx, "%s$", TEST_MACHINE_NAME);
363 r.in.secure_channel_type = cli_credentials_get_secure_channel_type(machine_credentials);
364 r.in.computer_name = TEST_MACHINE_NAME;
365 r.in.credential = &credential;
366 r.in.new_password = &new_password;
367 r.out.return_authenticator = &return_authenticator;
368
369 password = generate_random_password(tctx, 8, 255);
370 E_md4hash(password, new_password.hash);
371
372 netlogon_creds_des_encrypt(creds, &new_password);
373
374 torture_comment(tctx, "Testing ServerPasswordSet on machine account\n");
375 torture_comment(tctx, "Changing machine account password to '%s'\n",
376 password);
377
378 netlogon_creds_client_authenticator(creds, &credential);
379
380 status = dcerpc_netr_ServerPasswordSet(p, tctx, &r);
381 torture_assert_ntstatus_ok(tctx, status, "ServerPasswordSet");
382
383 if (!netlogon_creds_client_check(creds, &r.out.return_authenticator->cred)) {
384 torture_comment(tctx, "Credential chaining failed\n");
385 }
386
387 /* by changing the machine password twice we test the
388 credentials chaining fully, and we verify that the server
389 allows the password to be set to the same value twice in a
390 row (match win2k3) */
391 torture_comment(tctx,
392 "Testing a second ServerPasswordSet on machine account\n");
393 torture_comment(tctx,
394 "Changing machine account password to '%s' (same as previous run)\n", password);
395
396 netlogon_creds_client_authenticator(creds, &credential);
397
398 status = dcerpc_netr_ServerPasswordSet(p, tctx, &r);
399 torture_assert_ntstatus_ok(tctx, status, "ServerPasswordSet (2)");
400
401 if (!netlogon_creds_client_check(creds, &r.out.return_authenticator->cred)) {
402 torture_comment(tctx, "Credential chaining failed\n");
403 }
404
405 cli_credentials_set_password(machine_credentials, password, CRED_SPECIFIED);
406
407 torture_assert(tctx,
408 test_SetupCredentials(p, tctx, machine_credentials, &creds),
409 "ServerPasswordSet failed to actually change the password");
410
411 return true;
412 }
413
414
415 /*
416 generate a random password for password change tests
417 */
418 static DATA_BLOB netlogon_very_rand_pass(TALLOC_CTX *mem_ctx, int len)
419 {
420 int i;
421 DATA_BLOB password = data_blob_talloc(mem_ctx, NULL, len * 2 /* number of unicode chars */);
422 generate_random_buffer(password.data, password.length);
423
424 for (i=0; i < len; i++) {
425 if (((uint16_t *)password.data)[i] == 0) {
426 ((uint16_t *)password.data)[i] = 1;
427 }
428 }
429
430 return password;
431 }
432
433 /*
434 try a change password for our machine account
435 */
436 static bool test_SetPassword2(struct torture_context *tctx,
437 struct dcerpc_pipe *p,
438 struct cli_credentials *machine_credentials)
439 {
440 NTSTATUS status;
441 struct netr_ServerPasswordSet2 r;
442 const char *password;
443 DATA_BLOB new_random_pass;
444 struct netlogon_creds_CredentialState *creds;
445 struct samr_CryptPassword password_buf;
446 struct samr_Password nt_hash;
447 struct netr_Authenticator credential, return_authenticator;
448 struct netr_CryptPassword new_password;
449
450 if (!test_SetupCredentials(p, tctx, machine_credentials, &creds)) {
451 return false;
452 }
453
454 r.in.server_name = talloc_asprintf(tctx, "\\\\%s", dcerpc_server_name(p));
455 r.in.account_name = talloc_asprintf(tctx, "%s$", TEST_MACHINE_NAME);
456 r.in.secure_channel_type = cli_credentials_get_secure_channel_type(machine_credentials);
457 r.in.computer_name = TEST_MACHINE_NAME;
458 r.in.credential = &credential;
459 r.in.new_password = &new_password;
460 r.out.return_authenticator = &return_authenticator;
461
462 password = generate_random_password(tctx, 8, 255);
463 encode_pw_buffer(password_buf.data, password, STR_UNICODE);
464 netlogon_creds_arcfour_crypt(creds, password_buf.data, 516);
465
466 memcpy(new_password.data, password_buf.data, 512);
467 new_password.length = IVAL(password_buf.data, 512);
468
469 torture_comment(tctx, "Testing ServerPasswordSet2 on machine account\n");
470 torture_comment(tctx, "Changing machine account password to '%s'\n", password);
471
472 netlogon_creds_client_authenticator(creds, &credential);
473
474 status = dcerpc_netr_ServerPasswordSet2(p, tctx, &r);
475 torture_assert_ntstatus_ok(tctx, status, "ServerPasswordSet2");
476
477 if (!netlogon_creds_client_check(creds, &r.out.return_authenticator->cred)) {
478 torture_comment(tctx, "Credential chaining failed\n");
479 }
480
481 cli_credentials_set_password(machine_credentials, password, CRED_SPECIFIED);
482
483 if (!torture_setting_bool(tctx, "dangerous", false)) {
484 torture_comment(tctx,
485 "Not testing ability to set password to '', enable dangerous tests to perform this test\n");
486 } else {
487 /* by changing the machine password to ""
488 * we check if the server uses password restrictions
489 * for ServerPasswordSet2
490 * (win2k3 accepts "")
491 */
492 password = "";
493 encode_pw_buffer(password_buf.data, password, STR_UNICODE);
494 netlogon_creds_arcfour_crypt(creds, password_buf.data, 516);
495
496 memcpy(new_password.data, password_buf.data, 512);
497 new_password.length = IVAL(password_buf.data, 512);
498
499 torture_comment(tctx,
500 "Testing ServerPasswordSet2 on machine account\n");
501 torture_comment(tctx,
502 "Changing machine account password to '%s'\n", password);
503
504 netlogon_creds_client_authenticator(creds, &credential);
505
506 status = dcerpc_netr_ServerPasswordSet2(p, tctx, &r);
507 torture_assert_ntstatus_ok(tctx, status, "ServerPasswordSet2");
508
509 if (!netlogon_creds_client_check(creds, &r.out.return_authenticator->cred)) {
510 torture_comment(tctx, "Credential chaining failed\n");
511 }
512
513 cli_credentials_set_password(machine_credentials, password, CRED_SPECIFIED);
514 }
515
516 torture_assert(tctx, test_SetupCredentials(p, tctx, machine_credentials, &creds),
517 "ServerPasswordSet failed to actually change the password");
518
519 /* now try a random password */
520 password = generate_random_password(tctx, 8, 255);
521 encode_pw_buffer(password_buf.data, password, STR_UNICODE);
522 netlogon_creds_arcfour_crypt(creds, password_buf.data, 516);
523
524 memcpy(new_password.data, password_buf.data, 512);
525 new_password.length = IVAL(password_buf.data, 512);
526
527 torture_comment(tctx, "Testing second ServerPasswordSet2 on machine account\n");
528 torture_comment(tctx, "Changing machine account password to '%s'\n", password);
529
530 netlogon_creds_client_authenticator(creds, &credential);
531
532 status = dcerpc_netr_ServerPasswordSet2(p, tctx, &r);
533 torture_assert_ntstatus_ok(tctx, status, "ServerPasswordSet2 (2)");
534
535 if (!netlogon_creds_client_check(creds, &r.out.return_authenticator->cred)) {
536 torture_comment(tctx, "Credential chaining failed\n");
537 }
538
539 /* by changing the machine password twice we test the
540 credentials chaining fully, and we verify that the server
541 allows the password to be set to the same value twice in a
542 row (match win2k3) */
543 torture_comment(tctx,
544 "Testing a second ServerPasswordSet2 on machine account\n");
545 torture_comment(tctx,
546 "Changing machine account password to '%s' (same as previous run)\n", password);
547
548 netlogon_creds_client_authenticator(creds, &credential);
549
550 status = dcerpc_netr_ServerPasswordSet2(p, tctx, &r);
551 torture_assert_ntstatus_ok(tctx, status, "ServerPasswordSet (3)");
552
553 if (!netlogon_creds_client_check(creds, &r.out.return_authenticator->cred)) {
554 torture_comment(tctx, "Credential chaining failed\n");
555 }
556
557 cli_credentials_set_password(machine_credentials, password, CRED_SPECIFIED);
558
559 torture_assert (tctx,
560 test_SetupCredentials(p, tctx, machine_credentials, &creds),
561 "ServerPasswordSet failed to actually change the password");
562
563 new_random_pass = netlogon_very_rand_pass(tctx, 128);
564
565 /* now try a random stream of bytes for a password */
566 set_pw_in_buffer(password_buf.data, &new_random_pass);
567
568 netlogon_creds_arcfour_crypt(creds, password_buf.data, 516);
569
570 memcpy(new_password.data, password_buf.data, 512);
571 new_password.length = IVAL(password_buf.data, 512);
572
573 torture_comment(tctx,
574 "Testing a third ServerPasswordSet2 on machine account, with a compleatly random password\n");
575
576 netlogon_creds_client_authenticator(creds, &credential);
577
578 status = dcerpc_netr_ServerPasswordSet2(p, tctx, &r);
579 torture_assert_ntstatus_ok(tctx, status, "ServerPasswordSet (3)");
580
581 if (!netlogon_creds_client_check(creds, &r.out.return_authenticator->cred)) {
582 torture_comment(tctx, "Credential chaining failed\n");
583 }
584
585 mdfour(nt_hash.hash, new_random_pass.data, new_random_pass.length);
586
587 cli_credentials_set_password(machine_credentials, NULL, CRED_UNINITIALISED);
588 cli_credentials_set_nt_hash(machine_credentials, &nt_hash, CRED_SPECIFIED);
589
590 torture_assert (tctx,
591 test_SetupCredentials(p, tctx, machine_credentials, &creds),
592 "ServerPasswordSet failed to actually change the password");
593
594 return true;
595 }
596
597 static bool test_GetPassword(struct torture_context *tctx,
598 struct dcerpc_pipe *p,
599 struct cli_credentials *machine_credentials)
600 {
601 struct netr_ServerPasswordGet r;
602 struct netlogon_creds_CredentialState *creds;
603 struct netr_Authenticator credential;
604 NTSTATUS status;
605 struct netr_Authenticator return_authenticator;
606 struct samr_Password password;
607
608 if (!test_SetupCredentials(p, tctx, machine_credentials, &creds)) {
609 return false;
610 }
611
612 netlogon_creds_client_authenticator(creds, &credential);
613
614 r.in.server_name = talloc_asprintf(tctx, "\\\\%s", dcerpc_server_name(p));
615 r.in.account_name = talloc_asprintf(tctx, "%s$", TEST_MACHINE_NAME);
616 r.in.secure_channel_type = cli_credentials_get_secure_channel_type(machine_credentials);
617 r.in.computer_name = TEST_MACHINE_NAME;
618 r.in.credential = &credential;
619 r.out.return_authenticator = &return_authenticator;
620 r.out.password = &password;
621
622 status = dcerpc_netr_ServerPasswordGet(p, tctx, &r);
623 torture_assert_ntstatus_ok(tctx, status, "ServerPasswordGet");
624
625 return true;
626 }
627
628 static bool test_GetTrustPasswords(struct torture_context *tctx,
629 struct dcerpc_pipe *p,
630 struct cli_credentials *machine_credentials)
631 {
632 struct netr_ServerTrustPasswordsGet r;
633 struct netlogon_creds_CredentialState *creds;
634 struct netr_Authenticator credential;
635 NTSTATUS status;
636 struct netr_Authenticator return_authenticator;
637 struct samr_Password password, password2;
638
639 if (!test_SetupCredentials(p, tctx, machine_credentials, &creds)) {
640 return false;
641 }
642
643 netlogon_creds_client_authenticator(creds, &credential);
644
645 r.in.server_name = talloc_asprintf(tctx, "\\\\%s", dcerpc_server_name(p));
646 r.in.account_name = talloc_asprintf(tctx, "%s$", TEST_MACHINE_NAME);
647 r.in.secure_channel_type = cli_credentials_get_secure_channel_type(machine_credentials);
648 r.in.computer_name = TEST_MACHINE_NAME;
649 r.in.credential = &credential;
650 r.out.return_authenticator = &return_authenticator;
651 r.out.password = &password;
652 r.out.password2 = &password2;
653
654 status = dcerpc_netr_ServerTrustPasswordsGet(p, tctx, &r);
655 torture_assert_ntstatus_ok(tctx, status, "ServerTrustPasswordsGet");
656
657 return true;
658 }
659
660 /*
661 try a netlogon SamLogon
662 */
663 bool test_netlogon_ops(struct dcerpc_pipe *p, struct torture_context *tctx,
664 struct cli_credentials *credentials,
665 struct netlogon_creds_CredentialState *creds)
666 {
667 NTSTATUS status;
668 struct netr_LogonSamLogon r;
669 struct netr_Authenticator auth, auth2;
670 union netr_LogonLevel logon;
671 union netr_Validation validation;
672 uint8_t authoritative;
673 struct netr_NetworkInfo ninfo;
674 DATA_BLOB names_blob, chal, lm_resp, nt_resp;
675 int i;
676 int flags = CLI_CRED_NTLM_AUTH;
677 if (lp_client_lanman_auth(tctx->lp_ctx)) {
678 flags |= CLI_CRED_LANMAN_AUTH;
679 }
680
681 if (lp_client_ntlmv2_auth(tctx->lp_ctx)) {
682 flags |= CLI_CRED_NTLMv2_AUTH;
683 }
684
685 cli_credentials_get_ntlm_username_domain(cmdline_credentials, tctx,
686 &ninfo.identity_info.account_name.string,
687 &ninfo.identity_info.domain_name.string);
688
689 generate_random_buffer(ninfo.challenge,
690 sizeof(ninfo.challenge));
691 chal = data_blob_const(ninfo.challenge,
692 sizeof(ninfo.challenge));
693
694 names_blob = NTLMv2_generate_names_blob(tctx, cli_credentials_get_workstation(credentials),
695 cli_credentials_get_domain(credentials));
696
697 status = cli_credentials_get_ntlm_response(cmdline_credentials, tctx,
698 &flags,
699 chal,
700 names_blob,
701 &lm_resp, &nt_resp,
702 NULL, NULL);
703 torture_assert_ntstatus_ok(tctx, status, "cli_credentials_get_ntlm_response failed");
704
705 ninfo.lm.data = lm_resp.data;
706 ninfo.lm.length = lm_resp.length;
707
708 ninfo.nt.data = nt_resp.data;
709 ninfo.nt.length = nt_resp.length;
710
711 ninfo.identity_info.parameter_control = 0;
712 ninfo.identity_info.logon_id_low = 0;
713 ninfo.identity_info.logon_id_high = 0;
714 ninfo.identity_info.workstation.string = cli_credentials_get_workstation(credentials);
715
716 logon.network = &ninfo;
717
718 r.in.server_name = talloc_asprintf(tctx, "\\\\%s", dcerpc_server_name(p));
719 r.in.computer_name = cli_credentials_get_workstation(credentials);
720 r.in.credential = &auth;
721 r.in.return_authenticator = &auth2;
722 r.in.logon_level = 2;
723 r.in.logon = &logon;
724 r.out.validation = &validation;
725 r.out.authoritative = &authoritative;
726
727 d_printf("Testing LogonSamLogon with name %s\n", ninfo.identity_info.account_name.string);
728
729 for (i=2;i<3;i++) {
730 ZERO_STRUCT(auth2);
731 netlogon_creds_client_authenticator(creds, &auth);
732
733 r.in.validation_level = i;
734
735 status = dcerpc_netr_LogonSamLogon(p, tctx, &r);
736 torture_assert_ntstatus_ok(tctx, status, "LogonSamLogon failed");
737
738 torture_assert(tctx, netlogon_creds_client_check(creds,
739 &r.out.return_authenticator->cred),
740 "Credential chaining failed");
741 }
742
743 r.in.credential = NULL;
744
745 for (i=2;i<=3;i++) {
746
747 r.in.validation_level = i;
748
749 torture_comment(tctx, "Testing SamLogon with validation level %d and a NULL credential\n", i);
750
751 status = dcerpc_netr_LogonSamLogon(p, tctx, &r);
752 torture_assert_ntstatus_equal(tctx, status, NT_STATUS_INVALID_PARAMETER,
753 "LogonSamLogon expected INVALID_PARAMETER");
754
755 }
756
757 return true;
758 }
759
760 /*
761 try a netlogon SamLogon
762 */
763 static bool test_SamLogon(struct torture_context *tctx,
764 struct dcerpc_pipe *p,
765 struct cli_credentials *credentials)
766 {
767 struct netlogon_creds_CredentialState *creds;
768
769 if (!test_SetupCredentials(p, tctx, credentials, &creds)) {
770 return false;
771 }
772
773 return test_netlogon_ops(p, tctx, credentials, creds);
774 }
775
776 /* we remember the sequence numbers so we can easily do a DatabaseDelta */
777 static uint64_t sequence_nums[3];
778
779 /*
780 try a netlogon DatabaseSync
781 */
782 static bool test_DatabaseSync(struct torture_context *tctx,
783 struct dcerpc_pipe *p,
784 struct cli_credentials *machine_credentials)
785 {
786 NTSTATUS status;
787 struct netr_DatabaseSync r;
788 struct netlogon_creds_CredentialState *creds;
789 const uint32_t database_ids[] = {SAM_DATABASE_DOMAIN, SAM_DATABASE_BUILTIN, SAM_DATABASE_PRIVS};
790 int i;
791 struct netr_DELTA_ENUM_ARRAY *delta_enum_array = NULL;
792 struct netr_Authenticator credential, return_authenticator;
793
794 if (!test_SetupCredentials(p, tctx, machine_credentials, &creds)) {
795 return false;
796 }
797
798 ZERO_STRUCT(return_authenticator);
799
800 r.in.logon_server = talloc_asprintf(tctx, "\\\\%s", dcerpc_server_name(p));
801 r.in.computername = TEST_MACHINE_NAME;
802 r.in.preferredmaximumlength = (uint32_t)-1;
803 r.in.return_authenticator = &return_authenticator;
804 r.out.delta_enum_array = &delta_enum_array;
805 r.out.return_authenticator = &return_authenticator;
806
807 for (i=0;i<ARRAY_SIZE(database_ids);i++) {
808
809 uint32_t sync_context = 0;
810
811 r.in.database_id = database_ids[i];
812 r.in.sync_context = &sync_context;
813 r.out.sync_context = &sync_context;
814
815 torture_comment(tctx, "Testing DatabaseSync of id %d\n", r.in.database_id);
816
817 do {
818 netlogon_creds_client_authenticator(creds, &credential);
819
820 r.in.credential = &credential;
821
822 status = dcerpc_netr_DatabaseSync(p, tctx, &r);
823 if (NT_STATUS_EQUAL(status, STATUS_MORE_ENTRIES))
824 break;
825
826 /* Native mode servers don't do this */
827 if (NT_STATUS_EQUAL(status, NT_STATUS_NOT_SUPPORTED)) {
828 return true;
829 }
830 torture_assert_ntstatus_ok(tctx, status, "DatabaseSync");
831
832 if (!netlogon_creds_client_check(creds, &r.out.return_authenticator->cred)) {
833 torture_comment(tctx, "Credential chaining failed\n");
834 }
835
836 if (delta_enum_array &&
837 delta_enum_array->num_deltas > 0 &&
838 delta_enum_array->delta_enum[0].delta_type == NETR_DELTA_DOMAIN &&
839 delta_enum_array->delta_enum[0].delta_union.domain) {
840 sequence_nums[r.in.database_id] =
841 delta_enum_array->delta_enum[0].delta_union.domain->sequence_num;
842 torture_comment(tctx, "\tsequence_nums[%d]=%llu\n",
843 r.in.database_id,
844 (unsigned long long)sequence_nums[r.in.database_id]);
845 }
846 } while (NT_STATUS_EQUAL(status, STATUS_MORE_ENTRIES));
847 }
848
849 return true;
850 }
851
852
853 /*
854 try a netlogon DatabaseDeltas
855 */
856 static bool test_DatabaseDeltas(struct torture_context *tctx,
857 struct dcerpc_pipe *p,
858 struct cli_credentials *machine_credentials)
859 {
860 NTSTATUS status;
861 struct netr_DatabaseDeltas r;
862 struct netlogon_creds_CredentialState *creds;
863 struct netr_Authenticator credential;
864 struct netr_Authenticator return_authenticator;
865 struct netr_DELTA_ENUM_ARRAY *delta_enum_array = NULL;
866 const uint32_t database_ids[] = {0, 1, 2};
867 int i;
868
869 if (!test_SetupCredentials(p, tctx, machine_credentials, &creds)) {
870 return false;
871 }
872
873 r.in.logon_server = talloc_asprintf(tctx, "\\\\%s", dcerpc_server_name(p));
874 r.in.computername = TEST_MACHINE_NAME;
875 r.in.preferredmaximumlength = (uint32_t)-1;
876 ZERO_STRUCT(r.in.return_authenticator);
877 r.out.return_authenticator = &return_authenticator;
878 r.out.delta_enum_array = &delta_enum_array;
879
880 for (i=0;i<ARRAY_SIZE(database_ids);i++) {
881 r.in.database_id = database_ids[i];
882 r.in.sequence_num = &sequence_nums[r.in.database_id];
883
884 if (*r.in.sequence_num == 0) continue;
885
886 *r.in.sequence_num -= 1;
887
888 torture_comment(tctx, "Testing DatabaseDeltas of id %d at %llu\n",
889 r.in.database_id, (unsigned long long)*r.in.sequence_num);
890
891 do {
892 netlogon_creds_client_authenticator(creds, &credential);
893
894 status = dcerpc_netr_DatabaseDeltas(p, tctx, &r);
895 if (NT_STATUS_EQUAL(status,
896 NT_STATUS_SYNCHRONIZATION_REQUIRED)) {
897 torture_comment(tctx, "not considering %s to be an error\n",
898 nt_errstr(status));
899 return true;
900 }
901 if (NT_STATUS_EQUAL(status, STATUS_MORE_ENTRIES))
902 break;
903
904 torture_assert_ntstatus_ok(tctx, status, "DatabaseDeltas");
905
906 if (!netlogon_creds_client_check(creds, &return_authenticator.cred)) {
907 torture_comment(tctx, "Credential chaining failed\n");
908 }
909
910 (*r.in.sequence_num)++;
911 } while (NT_STATUS_EQUAL(status, STATUS_MORE_ENTRIES));
912 }
913
914 return true;
915 }
916
917 static bool test_DatabaseRedo(struct torture_context *tctx,
918 struct dcerpc_pipe *p,
919 struct cli_credentials *machine_credentials)
920 {
921 NTSTATUS status;
922 struct netr_DatabaseRedo r;
923 struct netlogon_creds_CredentialState *creds;
924 struct netr_Authenticator credential;
925 struct netr_Authenticator return_authenticator;
926 struct netr_DELTA_ENUM_ARRAY *delta_enum_array = NULL;
927 struct netr_ChangeLogEntry e;
928 struct dom_sid null_sid, *sid;
929 int i,d;
930
931 ZERO_STRUCT(null_sid);
932
933 sid = dom_sid_parse_talloc(tctx, "S-1-5-21-1111111111-2222222222-333333333-500");
934
935 {
936
937 struct {
938 uint32_t rid;
939 uint16_t flags;
940 uint8_t db_index;
941 uint8_t delta_type;
942 struct dom_sid sid;
943 const char *name;
944 NTSTATUS expected_error;
945 uint32_t expected_num_results;
946 uint8_t expected_delta_type_1;
947 uint8_t expected_delta_type_2;
948 const char *comment;
949 } changes[] = {
950
951 /* SAM_DATABASE_DOMAIN */
952
953 {
954 .rid = 0,
955 .flags = 0,
956 .db_index = SAM_DATABASE_DOMAIN,
957 .delta_type = NETR_DELTA_MODIFY_COUNT,
958 .sid = null_sid,
959 .name = NULL,
960 .expected_error = NT_STATUS_SYNCHRONIZATION_REQUIRED,
961 .expected_num_results = 0,
962 .comment = "NETR_DELTA_MODIFY_COUNT"
963 },
964 {
965 .rid = 0,
966 .flags = 0,
967 .db_index = SAM_DATABASE_DOMAIN,
968 .delta_type = 0,
969 .sid = null_sid,
970 .name = NULL,
971 .expected_error = NT_STATUS_OK,
972 .expected_num_results = 1,
973 .expected_delta_type_1 = NETR_DELTA_DOMAIN,
974 .comment = "NULL DELTA"
975 },
976 {
977 .rid = 0,
978 .flags = 0,
979 .db_index = SAM_DATABASE_DOMAIN,
980 .delta_type = NETR_DELTA_DOMAIN,
981 .sid = null_sid,
982 .name = NULL,
983 .expected_error = NT_STATUS_OK,
984 .expected_num_results = 1,
985 .expected_delta_type_1 = NETR_DELTA_DOMAIN,
986 .comment = "NETR_DELTA_DOMAIN"
987 },
988 {
989 .rid = DOMAIN_RID_ADMINISTRATOR,
990 .flags = 0,
991 .db_index = SAM_DATABASE_DOMAIN,
992 .delta_type = NETR_DELTA_USER,
993 .sid = null_sid,
994 .name = NULL,
995 .expected_error = NT_STATUS_OK,
996 .expected_num_results = 1,
997 .expected_delta_type_1 = NETR_DELTA_USER,
998 .comment = "NETR_DELTA_USER by rid 500"
999 },
1000 {
1001 .rid = DOMAIN_RID_GUEST,
1002 .flags = 0,
1003 .db_index = SAM_DATABASE_DOMAIN,
1004 .delta_type = NETR_DELTA_USER,
1005 .sid = null_sid,
1006 .name = NULL,
1007 .expected_error = NT_STATUS_OK,
1008 .expected_num_results = 1,
1009 .expected_delta_type_1 = NETR_DELTA_USER,
1010 .comment = "NETR_DELTA_USER by rid 501"
1011 },
1012 {
1013 .rid = 0,
1014 .flags = NETR_CHANGELOG_SID_INCLUDED,
1015 .db_index = SAM_DATABASE_DOMAIN,
1016 .delta_type = NETR_DELTA_USER,
1017 .sid = *sid,
1018 .name = NULL,
1019 .expected_error = NT_STATUS_OK,
1020 .expected_num_results = 1,
1021 .expected_delta_type_1 = NETR_DELTA_DELETE_USER,
1022 .comment = "NETR_DELTA_USER by sid and flags"
1023 },
1024 {
1025 .rid = 0,
1026 .flags = NETR_CHANGELOG_SID_INCLUDED,
1027 .db_index = SAM_DATABASE_DOMAIN,
1028 .delta_type = NETR_DELTA_USER,
1029 .sid = null_sid,
1030 .name = NULL,
1031 .expected_error = NT_STATUS_OK,
1032 .expected_num_results = 1,
1033 .expected_delta_type_1 = NETR_DELTA_DELETE_USER,
1034 .comment = "NETR_DELTA_USER by null_sid and flags"
1035 },
1036 {
1037 .rid = 0,
1038 .flags = NETR_CHANGELOG_NAME_INCLUDED,
1039 .db_index = SAM_DATABASE_DOMAIN,
1040 .delta_type = NETR_DELTA_USER,
1041 .sid = null_sid,
1042 .name = "administrator",
1043 .expected_error = NT_STATUS_OK,
1044 .expected_num_results = 1,
1045 .expected_delta_type_1 = NETR_DELTA_DELETE_USER,
1046 .comment = "NETR_DELTA_USER by name 'administrator'"
1047 },
1048 {
1049 .rid = DOMAIN_RID_ADMINS,
1050 .flags = 0,
1051 .db_index = SAM_DATABASE_DOMAIN,
1052 .delta_type = NETR_DELTA_GROUP,
1053 .sid = null_sid,
1054 .name = NULL,
1055 .expected_error = NT_STATUS_OK,
1056 .expected_num_results = 2,
1057 .expected_delta_type_1 = NETR_DELTA_GROUP,
1058 .expected_delta_type_2 = NETR_DELTA_GROUP_MEMBER,
1059 .comment = "NETR_DELTA_GROUP by rid 512"
1060 },
1061 {
1062 .rid = DOMAIN_RID_ADMINS,
1063 .flags = 0,
1064 .db_index = SAM_DATABASE_DOMAIN,
1065 .delta_type = NETR_DELTA_GROUP_MEMBER,
1066 .sid = null_sid,
1067 .name = NULL,
1068 .expected_error = NT_STATUS_OK,
1069 .expected_num_results = 2,
1070 .expected_delta_type_1 = NETR_DELTA_GROUP,
1071 .expected_delta_type_2 = NETR_DELTA_GROUP_MEMBER,
1072 .comment = "NETR_DELTA_GROUP_MEMBER by rid 512"
1073 },
1074
1075
1076 /* SAM_DATABASE_BUILTIN */
1077
1078 {
1079 .rid = 0,
1080 .flags = 0,
1081 .db_index = SAM_DATABASE_BUILTIN,
1082 .delta_type = NETR_DELTA_MODIFY_COUNT,
1083 .sid = null_sid,
1084 .name = NULL,
1085 .expected_error = NT_STATUS_SYNCHRONIZATION_REQUIRED,
1086 .expected_num_results = 0,
1087 .comment = "NETR_DELTA_MODIFY_COUNT"
1088 },
1089 {
1090 .rid = 0,
1091 .flags = 0,
1092 .db_index = SAM_DATABASE_BUILTIN,
1093 .delta_type = NETR_DELTA_DOMAIN,
1094 .sid = null_sid,
1095 .name = NULL,
1096 .expected_error = NT_STATUS_OK,
1097 .expected_num_results = 1,
1098 .expected_delta_type_1 = NETR_DELTA_DOMAIN,
1099 .comment = "NETR_DELTA_DOMAIN"
1100 },
1101 {
1102 .rid = DOMAIN_RID_ADMINISTRATOR,
1103 .flags = 0,
1104 .db_index = SAM_DATABASE_BUILTIN,
1105 .delta_type = NETR_DELTA_USER,
1106 .sid = null_sid,
1107 .name = NULL,
1108 .expected_error = NT_STATUS_OK,
1109 .expected_num_results = 1,
1110 .expected_delta_type_1 = NETR_DELTA_DELETE_USER,
1111 .comment = "NETR_DELTA_USER by rid 500"
1112 },
1113 {
1114 .rid = 0,
1115 .flags = 0,
1116 .db_index = SAM_DATABASE_BUILTIN,
1117 .delta_type = NETR_DELTA_USER,
1118 .sid = null_sid,
1119 .name = NULL,
1120 .expected_error = NT_STATUS_OK,
1121 .expected_num_results = 1,
1122 .expected_delta_type_1 = NETR_DELTA_DELETE_USER,
1123 .comment = "NETR_DELTA_USER"
1124 },
1125 {
1126 .rid = 544,
1127 .flags = 0,
1128 .db_index = SAM_DATABASE_BUILTIN,
1129 .delta_type = NETR_DELTA_ALIAS,
1130 .sid = null_sid,
1131 .name = NULL,
1132 .expected_error = NT_STATUS_OK,
1133 .expected_num_results = 2,
1134 .expected_delta_type_1 = NETR_DELTA_ALIAS,
1135 .expected_delta_type_2 = NETR_DELTA_ALIAS_MEMBER,
1136 .comment = "NETR_DELTA_ALIAS by rid 544"
1137 },
1138 {
1139 .rid = 544,
1140 .flags = 0,
1141 .db_index = SAM_DATABASE_BUILTIN,
1142 .delta_type = NETR_DELTA_ALIAS_MEMBER,
1143 .sid = null_sid,
1144 .name = NULL,
1145 .expected_error = NT_STATUS_OK,
1146 .expected_num_results = 2,
1147 .expected_delta_type_1 = NETR_DELTA_ALIAS,
1148 .expected_delta_type_2 = NETR_DELTA_ALIAS_MEMBER,
1149 .comment = "NETR_DELTA_ALIAS_MEMBER by rid 544"
1150 },
1151 {
1152 .rid = 544,
1153 .flags = 0,
1154 .db_index = SAM_DATABASE_BUILTIN,
1155 .delta_type = 0,
1156 .sid = null_sid,
1157 .name = NULL,
1158 .expected_error = NT_STATUS_OK,
1159 .expected_num_results = 1,
1160 .expected_delta_type_1 = NETR_DELTA_DOMAIN,
1161 .comment = "NULL DELTA by rid 544"
1162 },
1163 {
1164 .rid = 544,
1165 .flags = NETR_CHANGELOG_SID_INCLUDED,
1166 .db_index = SAM_DATABASE_BUILTIN,
1167 .delta_type = 0,
1168 .sid = *dom_sid_parse_talloc(tctx, "S-1-5-32-544"),
1169 .name = NULL,
1170 .expected_error = NT_STATUS_OK,
1171 .expected_num_results = 1,
1172 .expected_delta_type_1 = NETR_DELTA_DOMAIN,
1173 .comment = "NULL DELTA by rid 544 sid S-1-5-32-544 and flags"
1174 },
1175 {
1176 .rid = 544,
1177 .flags = NETR_CHANGELOG_SID_INCLUDED,
1178 .db_index = SAM_DATABASE_BUILTIN,
1179 .delta_type = NETR_DELTA_ALIAS,
1180 .sid = *dom_sid_parse_talloc(tctx, "S-1-5-32-544"),
1181 .name = NULL,
1182 .expected_error = NT_STATUS_OK,
1183 .expected_num_results = 2,
1184 .expected_delta_type_1 = NETR_DELTA_ALIAS,
1185 .expected_delta_type_2 = NETR_DELTA_ALIAS_MEMBER,
1186 .comment = "NETR_DELTA_ALIAS by rid 544 and sid S-1-5-32-544 and flags"
1187 },
1188 {
1189 .rid = 0,
1190 .flags = NETR_CHANGELOG_SID_INCLUDED,
1191 .db_index = SAM_DATABASE_BUILTIN,
1192 .delta_type = NETR_DELTA_ALIAS,
1193 .sid = *dom_sid_parse_talloc(tctx, "S-1-5-32-544"),
1194 .name = NULL,
1195 .expected_error = NT_STATUS_OK,
1196 .expected_num_results = 1,
1197 .expected_delta_type_1 = NETR_DELTA_DELETE_ALIAS,
1198 .comment = "NETR_DELTA_ALIAS by sid S-1-5-32-544 and flags"
1199 },
1200
1201 /* SAM_DATABASE_PRIVS */
1202
1203 {
1204 .rid = 0,
1205 .flags = 0,
1206 .db_index = SAM_DATABASE_PRIVS,
1207 .delta_type = 0,
1208 .sid = null_sid,
1209 .name = NULL,
1210 .expected_error = NT_STATUS_ACCESS_DENIED,
1211 .expected_num_results = 0,
1212 .comment = "NULL DELTA"
1213 },
1214 {
1215 .rid = 0,
1216 .flags = 0,
1217 .db_index = SAM_DATABASE_PRIVS,
1218 .delta_type = NETR_DELTA_MODIFY_COUNT,
1219 .sid = null_sid,
1220 .name = NULL,
1221 .expected_error = NT_STATUS_SYNCHRONIZATION_REQUIRED,
1222 .expected_num_results = 0,
1223 .comment = "NETR_DELTA_MODIFY_COUNT"
1224 },
1225 {
1226 .rid = 0,
1227 .flags = 0,
1228 .db_index = SAM_DATABASE_PRIVS,
1229 .delta_type = NETR_DELTA_POLICY,
1230 .sid = null_sid,
1231 .name = NULL,
1232 .expected_error = NT_STATUS_OK,
1233 .expected_num_results = 1,
1234 .expected_delta_type_1 = NETR_DELTA_POLICY,
1235 .comment = "NETR_DELTA_POLICY"
1236 },
1237 {
1238 .rid = 0,
1239 .flags = NETR_CHANGELOG_SID_INCLUDED,
1240 .db_index = SAM_DATABASE_PRIVS,
1241 .delta_type = NETR_DELTA_POLICY,
1242 .sid = null_sid,
1243 .name = NULL,
1244 .expected_error = NT_STATUS_OK,
1245 .expected_num_results = 1,
1246 .expected_delta_type_1 = NETR_DELTA_POLICY,
1247 .comment = "NETR_DELTA_POLICY by null sid and flags"
1248 },
1249 {
1250 .rid = 0,
1251 .flags = NETR_CHANGELOG_SID_INCLUDED,
1252 .db_index = SAM_DATABASE_PRIVS,
1253 .delta_type = NETR_DELTA_POLICY,
1254 .sid = *dom_sid_parse_talloc(tctx, "S-1-5-32"),
1255 .name = NULL,
1256 .expected_error = NT_STATUS_OK,
1257 .expected_num_results = 1,
1258 .expected_delta_type_1 = NETR_DELTA_POLICY,
1259 .comment = "NETR_DELTA_POLICY by sid S-1-5-32 and flags"
1260 },
1261 {
1262 .rid = DOMAIN_RID_ADMINISTRATOR,
1263 .flags = 0,
1264 .db_index = SAM_DATABASE_PRIVS,
1265 .delta_type = NETR_DELTA_ACCOUNT,
1266 .sid = null_sid,
1267 .name = NULL,
1268 .expected_error = NT_STATUS_SYNCHRONIZATION_REQUIRED, /* strange */
1269 .expected_num_results = 0,
1270 .comment = "NETR_DELTA_ACCOUNT by rid 500"
1271 },
1272 {
1273 .rid = 0,
1274 .flags = NETR_CHANGELOG_SID_INCLUDED,
1275 .db_index = SAM_DATABASE_PRIVS,
1276 .delta_type = NETR_DELTA_ACCOUNT,
1277 .sid = *dom_sid_parse_talloc(tctx, "S-1-1-0"),
1278 .name = NULL,
1279 .expected_error = NT_STATUS_OK,
1280 .expected_num_results = 1,
1281 .expected_delta_type_1 = NETR_DELTA_ACCOUNT,
1282 .comment = "NETR_DELTA_ACCOUNT by sid S-1-1-0 and flags"
1283 },
1284 {
1285 .rid = 0,
1286 .flags = NETR_CHANGELOG_SID_INCLUDED |
1287 NETR_CHANGELOG_IMMEDIATE_REPL_REQUIRED,
1288 .db_index = SAM_DATABASE_PRIVS,
1289 .delta_type = NETR_DELTA_ACCOUNT,
1290 .sid = *dom_sid_parse_talloc(tctx, "S-1-1-0"),
1291 .name = NULL,
1292 .expected_error = NT_STATUS_OK,
1293 .expected_num_results = 1,
1294 .expected_delta_type_1 = NETR_DELTA_ACCOUNT,
1295 .comment = "NETR_DELTA_ACCOUNT by sid S-1-1-0 and 2 flags"
1296 },
1297 {
1298 .rid = 0,
1299 .flags = NETR_CHANGELOG_SID_INCLUDED |
1300 NETR_CHANGELOG_NAME_INCLUDED,
1301 .db_index = SAM_DATABASE_PRIVS,
1302 .delta_type = NETR_DELTA_ACCOUNT,
1303 .sid = *dom_sid_parse_talloc(tctx, "S-1-1-0"),
1304 .name = NULL,
1305 .expected_error = NT_STATUS_INVALID_PARAMETER,
1306 .expected_num_results = 0,
1307 .comment = "NETR_DELTA_ACCOUNT by sid S-1-1-0 and invalid flags"
1308 },
1309 {
1310 .rid = DOMAIN_RID_ADMINISTRATOR,
1311 .flags = NETR_CHANGELOG_SID_INCLUDED,
1312 .db_index = SAM_DATABASE_PRIVS,
1313 .delta_type = NETR_DELTA_ACCOUNT,
1314 .sid = *sid,
1315 .name = NULL,
1316 .expected_error = NT_STATUS_OK,
1317 .expected_num_results = 1,
1318 .expected_delta_type_1 = NETR_DELTA_DELETE_ACCOUNT,
1319 .comment = "NETR_DELTA_ACCOUNT by rid 500, sid and flags"
1320 },
1321 {
1322 .rid = 0,
1323 .flags = NETR_CHANGELOG_NAME_INCLUDED,
1324 .db_index = SAM_DATABASE_PRIVS,
1325 .delta_type = NETR_DELTA_SECRET,
1326 .sid = null_sid,
1327 .name = "IsurelydontexistIhope",
1328 .expected_error = NT_STATUS_OK,
1329 .expected_num_results = 1,
1330 .expected_delta_type_1 = NETR_DELTA_DELETE_SECRET,
1331 .comment = "NETR_DELTA_SECRET by name 'IsurelydontexistIhope' and flags"
1332 },
1333 {
1334 .rid = 0,
1335 .flags = NETR_CHANGELOG_NAME_INCLUDED,
1336 .db_index = SAM_DATABASE_PRIVS,
1337 .delta_type = NETR_DELTA_SECRET,
1338 .sid = null_sid,
1339 .name = "G$BCKUPKEY_P",
1340 .expected_error = NT_STATUS_OK,
1341 .expected_num_results = 1,
1342 .expected_delta_type_1 = NETR_DELTA_SECRET,
1343 .comment = "NETR_DELTA_SECRET by name 'G$BCKUPKEY_P' and flags"
1344 }
1345 };
1346
1347 ZERO_STRUCT(return_authenticator);
1348
1349 r.in.logon_server = talloc_asprintf(tctx, "\\\\%s", dcerpc_server_name(p));
1350 r.in.computername = TEST_MACHINE_NAME;
1351 r.in.return_authenticator = &return_authenticator;
1352 r.out.return_authenticator = &return_authenticator;
1353 r.out.delta_enum_array = &delta_enum_array;
1354
1355 for (d=0; d<3; d++) {
1356 const char *database = NULL;
1357
1358 switch (d) {
1359 case 0:
1360 database = "SAM";
1361 break;
1362 case 1:
1363 database = "BUILTIN";
1364 break;
1365 case 2:
1366 database = "LSA";
1367 break;
1368 default:
1369 break;
1370 }
1371
1372 torture_comment(tctx, "Testing DatabaseRedo\n");
1373
1374 if (!test_SetupCredentials(p, tctx, machine_credentials, &creds)) {
1375 return false;
1376 }
1377
1378 for (i=0;i<ARRAY_SIZE(changes);i++) {
1379
1380 if (d != changes[i].db_index) {
1381 continue;
1382 }
1383
1384 netlogon_creds_client_authenticator(creds, &credential);
1385
1386 r.in.credential = &credential;
1387
1388 e.serial_number1 = 0;
1389 e.serial_number2 = 0;
1390 e.object_rid = changes[i].rid;
1391 e.flags = changes[i].flags;
1392 e.db_index = changes[i].db_index;
1393 e.delta_type = changes[i].delta_type;
1394
1395 switch (changes[i].flags & (NETR_CHANGELOG_NAME_INCLUDED | NETR_CHANGELOG_SID_INCLUDED)) {
1396 case NETR_CHANGELOG_SID_INCLUDED:
1397 e.object.object_sid = changes[i].sid;
1398 break;
1399 case NETR_CHANGELOG_NAME_INCLUDED:
1400 e.object.object_name = changes[i].name;
1401 break;
1402 default:
1403 break;
1404 }
1405
1406 r.in.change_log_entry = e;
1407
1408 torture_comment(tctx, "Testing DatabaseRedo with database %s and %s\n",
1409 database, changes[i].comment);
1410
1411 status = dcerpc_netr_DatabaseRedo(p, tctx, &r);
1412 if (NT_STATUS_EQUAL(status, NT_STATUS_NOT_SUPPORTED)) {
1413 return true;
1414 }
1415
1416 torture_assert_ntstatus_equal(tctx, status, changes[i].expected_error, changes[i].comment);
1417 if (delta_enum_array) {
1418 torture_assert_int_equal(tctx,
1419 delta_enum_array->num_deltas,
1420 changes[i].expected_num_results,
1421 changes[i].comment);
1422 if (delta_enum_array->num_deltas > 0) {
1423 torture_assert_int_equal(tctx,
1424 delta_enum_array->delta_enum[0].delta_type,
1425 changes[i].expected_delta_type_1,
1426 changes[i].comment);
1427 }
1428 if (delta_enum_array->num_deltas > 1) {
1429 torture_assert_int_equal(tctx,
1430 delta_enum_array->delta_enum[1].delta_type,
1431 changes[i].expected_delta_type_2,
1432 changes[i].comment);
1433 }
1434 }
1435
1436 if (!netlogon_creds_client_check(creds, &return_authenticator.cred)) {
1437 torture_comment(tctx, "Credential chaining failed\n");
1438 if (!test_SetupCredentials(p, tctx, machine_credentials, &creds)) {
1439 return false;
1440 }
1441 }
1442 }
1443 }
1444 }
1445
1446 return true;
1447 }
1448
1449 /*
1450 try a netlogon AccountDeltas
1451 */
1452 static bool test_AccountDeltas(struct torture_context *tctx,
1453 struct dcerpc_pipe *p,
1454 struct cli_credentials *machine_credentials)
1455 {
1456 NTSTATUS status;
1457 struct netr_AccountDeltas r;
1458 struct netlogon_creds_CredentialState *creds;
1459
1460 struct netr_AccountBuffer buffer;
1461 uint32_t count_returned = 0;
1462 uint32_t total_entries = 0;
1463 struct netr_UAS_INFO_0 recordid;
1464 struct netr_Authenticator return_authenticator;
1465
1466 if (!test_SetupCredentials(p, tctx, machine_credentials, &creds)) {
1467 return false;
1468 }
1469
1470 ZERO_STRUCT(return_authenticator);
1471
1472 r.in.logon_server = talloc_asprintf(tctx, "\\\\%s", dcerpc_server_name(p));
1473 r.in.computername = TEST_MACHINE_NAME;
1474 r.in.return_authenticator = &return_authenticator;
1475 netlogon_creds_client_authenticator(creds, &r.in.credential);
1476 ZERO_STRUCT(r.in.uas);
1477 r.in.count=10;
1478 r.in.level=0;
1479 r.in.buffersize=100;
1480 r.out.buffer = &buffer;
1481 r.out.count_returned = &count_returned;
1482 r.out.total_entries = &total_entries;
1483 r.out.recordid = &recordid;
1484 r.out.return_authenticator = &return_authenticator;
1485
1486 /* w2k3 returns "NOT IMPLEMENTED" for this call */
1487 status = dcerpc_netr_AccountDeltas(p, tctx, &r);
1488 torture_assert_ntstatus_equal(tctx, status, NT_STATUS_NOT_IMPLEMENTED, "AccountDeltas");
1489
1490 return true;
1491 }
1492
1493 /*
1494 try a netlogon AccountSync
1495 */
1496 static bool test_AccountSync(struct torture_context *tctx, struct dcerpc_pipe *p,
1497 struct cli_credentials *machine_credentials)
1498 {
1499 NTSTATUS status;
1500 struct netr_AccountSync r;
1501 struct netlogon_creds_CredentialState *creds;
1502
1503 struct netr_AccountBuffer buffer;
1504 uint32_t count_returned = 0;
1505 uint32_t total_entries = 0;
1506 uint32_t next_reference = 0;
1507 struct netr_UAS_INFO_0 recordid;
1508 struct netr_Authenticator return_authenticator;
1509
1510 ZERO_STRUCT(recordid);
1511 ZERO_STRUCT(return_authenticator);
1512
1513 if (!test_SetupCredentials(p, tctx, machine_credentials, &creds)) {
1514 return false;
1515 }
1516
1517 r.in.logon_server = talloc_asprintf(tctx, "\\\\%s", dcerpc_server_name(p));
1518 r.in.computername = TEST_MACHINE_NAME;
1519 r.in.return_authenticator = &return_authenticator;
1520 netlogon_creds_client_authenticator(creds, &r.in.credential);
1521 r.in.recordid = &recordid;
1522 r.in.reference=0;
1523 r.in.level=0;
1524 r.in.buffersize=100;
1525 r.out.buffer = &buffer;
1526 r.out.count_returned = &count_returned;
1527 r.out.total_entries = &total_entries;
1528 r.out.next_reference = &next_reference;
1529 r.out.recordid = &recordid;
1530 r.out.return_authenticator = &return_authenticator;
1531
1532 /* w2k3 returns "NOT IMPLEMENTED" for this call */
1533 status = dcerpc_netr_AccountSync(p, tctx, &r);
1534 torture_assert_ntstatus_equal(tctx, status, NT_STATUS_NOT_IMPLEMENTED, "AccountSync");
1535
1536 return true;
1537 }
1538
1539 /*
1540 try a netlogon GetDcName
1541 */
1542 static bool test_GetDcName(struct torture_context *tctx,
1543 struct dcerpc_pipe *p)
1544 {
1545 NTSTATUS status;
1546 struct netr_GetDcName r;
1547 const char *dcname = NULL;
1548
1549 r.in.logon_server = talloc_asprintf(tctx, "\\\\%s", dcerpc_server_name(p));
1550 r.in.domainname = lp_workgroup(tctx->lp_ctx);
1551 r.out.dcname = &dcname;
1552
1553 status = dcerpc_netr_GetDcName(p, tctx, &r);
1554 torture_assert_ntstatus_ok(tctx, status, "GetDcName");
1555 torture_assert_werr_ok(tctx, r.out.result, "GetDcName");
1556
1557 torture_comment(tctx, "\tDC is at '%s'\n", dcname);
1558
1559 return true;
1560 }
1561
1562 static const char *function_code_str(TALLOC_CTX *mem_ctx,
1563 enum netr_LogonControlCode function_code)
1564 {
1565 switch (function_code) {
1566 case NETLOGON_CONTROL_QUERY:
1567 return "NETLOGON_CONTROL_QUERY";
1568 case NETLOGON_CONTROL_REPLICATE:
1569 return "NETLOGON_CONTROL_REPLICATE";
1570 case NETLOGON_CONTROL_SYNCHRONIZE:
1571 return "NETLOGON_CONTROL_SYNCHRONIZE";
1572 case NETLOGON_CONTROL_PDC_REPLICATE:
1573 return "NETLOGON_CONTROL_PDC_REPLICATE";
1574 case NETLOGON_CONTROL_REDISCOVER:
1575 return "NETLOGON_CONTROL_REDISCOVER";
1576 case NETLOGON_CONTROL_TC_QUERY:
1577 return "NETLOGON_CONTROL_TC_QUERY";
1578 case NETLOGON_CONTROL_TRANSPORT_NOTIFY:
1579 return "NETLOGON_CONTROL_TRANSPORT_NOTIFY";
1580 case NETLOGON_CONTROL_FIND_USER:
1581 return "NETLOGON_CONTROL_FIND_USER";
1582 case NETLOGON_CONTROL_CHANGE_PASSWORD:
1583 return "NETLOGON_CONTROL_CHANGE_PASSWORD";
1584 case NETLOGON_CONTROL_TC_VERIFY:
1585 return "NETLOGON_CONTROL_TC_VERIFY";
1586 case NETLOGON_CONTROL_FORCE_DNS_REG:
1587 return "NETLOGON_CONTROL_FORCE_DNS_REG";
1588 case NETLOGON_CONTROL_QUERY_DNS_REG:
1589 return "NETLOGON_CONTROL_QUERY_DNS_REG";
1590 case NETLOGON_CONTROL_BACKUP_CHANGE_LOG:
1591 return "NETLOGON_CONTROL_BACKUP_CHANGE_LOG";
1592 case NETLOGON_CONTROL_TRUNCATE_LOG:
1593 return "NETLOGON_CONTROL_TRUNCATE_LOG";
1594 case NETLOGON_CONTROL_SET_DBFLAG:
1595 return "NETLOGON_CONTROL_SET_DBFLAG";
1596 case NETLOGON_CONTROL_BREAKPOINT:
1597 return "NETLOGON_CONTROL_BREAKPOINT";
1598 default:
1599 return talloc_asprintf(mem_ctx, "unknown function code: %d",
1600 function_code);
1601 }
1602 }
1603
1604
1605 /*
1606 try a netlogon LogonControl
1607 */
1608 static bool test_LogonControl(struct torture_context *tctx,
1609 struct dcerpc_pipe *p,
1610 struct cli_credentials *machine_credentials)
1611
1612 {
1613 NTSTATUS status;
1614 struct netr_LogonControl r;
1615 union netr_CONTROL_QUERY_INFORMATION query;
1616 int i,f;
1617 enum netr_SchannelType secure_channel_type = SEC_CHAN_NULL;
1618
1619 uint32_t function_codes[] = {
1620 NETLOGON_CONTROL_QUERY,
1621 NETLOGON_CONTROL_REPLICATE,
1622 NETLOGON_CONTROL_SYNCHRONIZE,
1623 NETLOGON_CONTROL_PDC_REPLICATE,
1624 NETLOGON_CONTROL_REDISCOVER,
1625 NETLOGON_CONTROL_TC_QUERY,
1626 NETLOGON_CONTROL_TRANSPORT_NOTIFY,
1627 NETLOGON_CONTROL_FIND_USER,
1628 NETLOGON_CONTROL_CHANGE_PASSWORD,
1629 NETLOGON_CONTROL_TC_VERIFY,
1630 NETLOGON_CONTROL_FORCE_DNS_REG,
1631 NETLOGON_CONTROL_QUERY_DNS_REG,
1632 NETLOGON_CONTROL_BACKUP_CHANGE_LOG,
1633 NETLOGON_CONTROL_TRUNCATE_LOG,
1634 NETLOGON_CONTROL_SET_DBFLAG,
1635 NETLOGON_CONTROL_BREAKPOINT
1636 };
1637
1638 if (machine_credentials) {
1639 secure_channel_type = cli_credentials_get_secure_channel_type(machine_credentials);
1640 }
1641
1642 torture_comment(tctx, "testing LogonControl with secure channel type: %d\n",
1643 secure_channel_type);
1644
1645 r.in.logon_server = talloc_asprintf(tctx, "\\\\%s", dcerpc_server_name(p));
1646 r.in.function_code = 1;
1647 r.out.query = &query;
1648
1649 for (f=0;f<ARRAY_SIZE(function_codes); f++) {
1650 for (i=1;i<5;i++) {
1651
1652 r.in.function_code = function_codes[f];
1653 r.in.level = i;
1654
1655 torture_comment(tctx, "Testing LogonControl function code %s (%d) level %d\n",
1656 function_code_str(tctx, r.in.function_code), r.in.function_code, r.in.level);
1657
1658 status = dcerpc_netr_LogonControl(p, tctx, &r);
1659 torture_assert_ntstatus_ok(tctx, status, "LogonControl");
1660
1661 switch (r.in.level) {
1662 case 1:
1663 switch (r.in.function_code) {
1664 case NETLOGON_CONTROL_REPLICATE:
1665 case NETLOGON_CONTROL_SYNCHRONIZE:
1666 case NETLOGON_CONTROL_PDC_REPLICATE:
1667 case NETLOGON_CONTROL_BREAKPOINT:
1668 case NETLOGON_CONTROL_BACKUP_CHANGE_LOG:
1669 if ((secure_channel_type == SEC_CHAN_BDC) ||
1670 (secure_channel_type == SEC_CHAN_WKSTA)) {
1671 torture_assert_werr_equal(tctx, r.out.result, WERR_ACCESS_DENIED,
1672 "LogonControl returned unexpected error code");
1673 } else {
1674 torture_assert_werr_equal(tctx, r.out.result, WERR_NOT_SUPPORTED,
1675 "LogonControl returned unexpected error code");
1676 }
1677 break;
1678
1679 case NETLOGON_CONTROL_REDISCOVER:
1680 case NETLOGON_CONTROL_TC_QUERY:
1681 case NETLOGON_CONTROL_TRANSPORT_NOTIFY:
1682 case NETLOGON_CONTROL_FIND_USER:
1683 case NETLOGON_CONTROL_CHANGE_PASSWORD:
1684 case NETLOGON_CONTROL_TC_VERIFY:
1685 case NETLOGON_CONTROL_FORCE_DNS_REG:
1686 case NETLOGON_CONTROL_QUERY_DNS_REG:
1687 case NETLOGON_CONTROL_SET_DBFLAG:
1688 torture_assert_werr_equal(tctx, r.out.result, WERR_NOT_SUPPORTED,
1689 "LogonControl returned unexpected error code");
1690 break;
1691 case NETLOGON_CONTROL_TRUNCATE_LOG:
1692 if ((secure_channel_type == SEC_CHAN_BDC) ||
1693 (secure_channel_type == SEC_CHAN_WKSTA)) {
1694 torture_assert_werr_equal(tctx, r.out.result, WERR_ACCESS_DENIED,
1695 "LogonControl returned unexpected error code");
1696 } else {
1697 torture_assert_werr_ok(tctx, r.out.result,
1698 "LogonControl returned unexpected result");
1699 }
1700 break;
1701 default:
1702 torture_assert_werr_ok(tctx, r.out.result,
1703 "LogonControl returned unexpected result");
1704 break;
1705 }
1706 break;
1707 case 2:
1708 torture_assert_werr_equal(tctx, r.out.result, WERR_NOT_SUPPORTED,
1709 "LogonControl returned unexpected error code");
1710 break;
1711 default:
1712 torture_assert_werr_equal(tctx, r.out.result, WERR_UNKNOWN_LEVEL,
1713 "LogonControl returned unexpected error code");
1714 break;
1715 }
1716 }
1717 }
1718
1719 return true;
1720 }
1721
1722
1723 /*
1724 try a netlogon GetAnyDCName
1725 */
1726 static bool test_GetAnyDCName(struct torture_context *tctx,
1727 struct dcerpc_pipe *p)
1728 {
1729 NTSTATUS status;
1730 struct netr_GetAnyDCName r;
1731 const char *dcname = NULL;
1732
1733 r.in.logon_server = talloc_asprintf(tctx, "\\\\%s", dcerpc_server_name(p));
1734 r.in.domainname = lp_workgroup(tctx->lp_ctx);
1735 r.out.dcname = &dcname;
1736
1737 status = dcerpc_netr_GetAnyDCName(p, tctx, &r);
1738 torture_assert_ntstatus_ok(tctx, status, "GetAnyDCName");
1739 torture_assert_werr_ok(tctx, r.out.result, "GetAnyDCName");
1740
1741 if (dcname) {
1742 torture_comment(tctx, "\tDC is at '%s'\n", dcname);
1743 }
1744
1745 return true;
1746 }
1747
1748
1749 /*
1750 try a netlogon LogonControl2
1751 */
1752 static bool test_LogonControl2(struct torture_context *tctx,
1753 struct dcerpc_pipe *p,
1754 struct cli_credentials *machine_credentials)
1755
1756 {
1757 NTSTATUS status;
1758 struct netr_LogonControl2 r;
1759 union netr_CONTROL_DATA_INFORMATION data;
1760 union netr_CONTROL_QUERY_INFORMATION query;
1761 int i;
1762
1763 data.domain = lp_workgroup(tctx->lp_ctx);
1764
1765 r.in.logon_server = talloc_asprintf(tctx, "\\\\%s", dcerpc_server_name(p));
1766
1767 r.in.function_code = NETLOGON_CONTROL_REDISCOVER;
1768 r.in.data = &data;
1769 r.out.query = &query;
1770
1771 for (i=1;i<4;i++) {
1772 r.in.level = i;
1773
1774 torture_comment(tctx, "Testing LogonControl2 level %d function %d\n",
1775 i, r.in.function_code);
1776
1777 status = dcerpc_netr_LogonControl2(p, tctx, &r);
1778 torture_assert_ntstatus_ok(tctx, status, "LogonControl");
1779 }
1780
1781 data.domain = lp_workgroup(tctx->lp_ctx);
1782
1783 r.in.function_code = NETLOGON_CONTROL_TC_QUERY;
1784 r.in.data = &data;
1785
1786 for (i=1;i<4;i++) {
1787 r.in.level = i;
1788
1789 torture_comment(tctx, "Testing LogonControl2 level %d function %d\n",
1790 i, r.in.function_code);
1791
1792 status = dcerpc_netr_LogonControl2(p, tctx, &r);
1793 torture_assert_ntstatus_ok(tctx, status, "LogonControl");
1794 }
1795
1796 data.domain = lp_workgroup(tctx->lp_ctx);
1797
1798 r.in.function_code = NETLOGON_CONTROL_TRANSPORT_NOTIFY;
1799 r.in.data = &data;
1800
1801 for (i=1;i<4;i++) {
1802 r.in.level = i;
1803
1804 torture_comment(tctx, "Testing LogonControl2 level %d function %d\n",
1805 i, r.in.function_code);
1806
1807 status = dcerpc_netr_LogonControl2(p, tctx, &r);
1808 torture_assert_ntstatus_ok(tctx, status, "LogonControl");
1809 }
1810
1811 data.debug_level = ~0;
1812
1813 r.in.function_code = NETLOGON_CONTROL_SET_DBFLAG;
1814 r.in.data = &data;
1815
1816 for (i=1;i<4;i++) {
1817 r.in.level = i;
1818
1819 torture_comment(tctx, "Testing LogonControl2 level %d function %d\n",
1820 i, r.in.function_code);
1821
1822 status = dcerpc_netr_LogonControl2(p, tctx, &r);
1823 torture_assert_ntstatus_ok(tctx, status, "LogonControl");
1824 }
1825
1826 return true;
1827 }
1828
1829 /*
1830 try a netlogon DatabaseSync2
1831 */
1832 static bool test_DatabaseSync2(struct torture_context *tctx,
1833 struct dcerpc_pipe *p,
1834 struct cli_credentials *machine_credentials)
1835 {
1836 NTSTATUS status;
1837 struct netr_DatabaseSync2 r;
1838 struct netr_DELTA_ENUM_ARRAY *delta_enum_array = NULL;
1839 struct netr_Authenticator return_authenticator, credential;
1840
1841 struct netlogon_creds_CredentialState *creds;
1842 const uint32_t database_ids[] = {0, 1, 2};
1843 int i;
1844
1845 if (!test_SetupCredentials2(p, tctx, NETLOGON_NEG_AUTH2_FLAGS,
1846 machine_credentials,
1847 cli_credentials_get_secure_channel_type(machine_credentials),
1848 &creds)) {
1849 return false;
1850 }
1851
1852 ZERO_STRUCT(return_authenticator);
1853
1854 r.in.logon_server = talloc_asprintf(tctx, "\\\\%s", dcerpc_server_name(p));
1855 r.in.computername = TEST_MACHINE_NAME;
1856 r.in.preferredmaximumlength = (uint32_t)-1;
1857 r.in.return_authenticator = &return_authenticator;
1858 r.out.return_authenticator = &return_authenticator;
1859 r.out.delta_enum_array = &delta_enum_array;
1860
1861 for (i=0;i<ARRAY_SIZE(database_ids);i++) {
1862
1863 uint32_t sync_context = 0;
1864
1865 r.in.database_id = database_ids[i];
1866 r.in.sync_context = &sync_context;
1867 r.out.sync_context = &sync_context;
1868 r.in.restart_state = 0;
1869
1870 torture_comment(tctx, "Testing DatabaseSync2 of id %d\n", r.in.database_id);
1871
1872 do {
1873 netlogon_creds_client_authenticator(creds, &credential);
1874
1875 r.in.credential = &credential;
1876
1877 status = dcerpc_netr_DatabaseSync2(p, tctx, &r);
1878 if (NT_STATUS_EQUAL(status, STATUS_MORE_ENTRIES))
1879 break;
1880
1881 /* Native mode servers don't do this */
1882 if (NT_STATUS_EQUAL(status, NT_STATUS_NOT_SUPPORTED)) {
1883 return true;
1884 }
1885
1886 torture_assert_ntstatus_ok(tctx, status, "DatabaseSync2");
1887
1888 if (!netlogon_creds_client_check(creds, &r.out.return_authenticator->cred)) {
1889 torture_comment(tctx, "Credential chaining failed\n");
1890 }
1891
1892 } while (NT_STATUS_EQUAL(status, STATUS_MORE_ENTRIES));
1893 }
1894
1895 return true;
1896 }
1897
1898
1899 /*
1900 try a netlogon LogonControl2Ex
1901 */
1902 static bool test_LogonControl2Ex(struct torture_context *tctx,
1903 struct dcerpc_pipe *p,
1904 struct cli_credentials *machine_credentials)
1905
1906 {
1907 NTSTATUS status;
1908 struct netr_LogonControl2Ex r;
1909 union netr_CONTROL_DATA_INFORMATION data;
1910 union netr_CONTROL_QUERY_INFORMATION query;
1911 int i;
1912
1913 data.domain = lp_workgroup(tctx->lp_ctx);
1914
1915 r.in.logon_server = talloc_asprintf(tctx, "\\\\%s", dcerpc_server_name(p));
1916
1917 r.in.function_code = NETLOGON_CONTROL_REDISCOVER;
1918 r.in.data = &data;
1919 r.out.query = &query;
1920
1921 for (i=1;i<4;i++) {
1922 r.in.level = i;
1923
1924 torture_comment(tctx, "Testing LogonControl2Ex level %d function %d\n",
1925 i, r.in.function_code);
1926
1927 status = dcerpc_netr_LogonControl2Ex(p, tctx, &r);
1928 torture_assert_ntstatus_ok(tctx, status, "LogonControl");
1929 }
1930
1931 data.domain = lp_workgroup(tctx->lp_ctx);
1932
1933 r.in.function_code = NETLOGON_CONTROL_TC_QUERY;
1934 r.in.data = &data;
1935
1936 for (i=1;i<4;i++) {
1937 r.in.level = i;
1938
1939 torture_comment(tctx, "Testing LogonControl2Ex level %d function %d\n",
1940 i, r.in.function_code);
1941
1942 status = dcerpc_netr_LogonControl2Ex(p, tctx, &r);
1943 torture_assert_ntstatus_ok(tctx, status, "LogonControl");
1944 }
1945
1946 data.domain = lp_workgroup(tctx->lp_ctx);
1947
1948 r.in.function_code = NETLOGON_CONTROL_TRANSPORT_NOTIFY;
1949 r.in.data = &data;
1950
1951 for (i=1;i<4;i++) {
1952 r.in.level = i;
1953
1954 torture_comment(tctx, "Testing LogonControl2Ex level %d function %d\n",
1955 i, r.in.function_code);
1956
1957 status = dcerpc_netr_LogonControl2Ex(p, tctx, &r);
1958 torture_assert_ntstatus_ok(tctx, status, "LogonControl");
1959 }
1960
1961 data.debug_level = ~0;
1962
1963 r.in.function_code = NETLOGON_CONTROL_SET_DBFLAG;
1964 r.in.data = &data;
1965
1966 for (i=1;i<4;i++) {
1967 r.in.level = i;
1968
1969 torture_comment(tctx, "Testing LogonControl2Ex level %d function %d\n",
1970 i, r.in.function_code);
1971
1972 status = dcerpc_netr_LogonControl2Ex(p, tctx, &r);
1973 torture_assert_ntstatus_ok(tctx, status, "LogonControl");
1974 }
1975
1976 return true;
1977 }
1978
1979 static bool test_netr_DsRGetForestTrustInformation(struct torture_context *tctx,
1980 struct dcerpc_pipe *p, const char *trusted_domain_name)
1981 {
1982 NTSTATUS status;
1983 struct netr_DsRGetForestTrustInformation r;
1984 struct lsa_ForestTrustInformation info, *info_ptr;
1985
1986 info_ptr = &info;
1987
1988 r.in.server_name = talloc_asprintf(tctx, "\\\\%s", dcerpc_server_name(p));
1989 r.in.trusted_domain_name = trusted_domain_name;
1990 r.in.flags = 0;
1991 r.out.forest_trust_info = &info_ptr;
1992
1993 torture_comment(tctx ,"Testing netr_DsRGetForestTrustInformation\n");
1994
1995 status = dcerpc_netr_DsRGetForestTrustInformation(p, tctx, &r);
1996 torture_assert_ntstatus_ok(tctx, status, "DsRGetForestTrustInformation");
1997 torture_assert_werr_ok(tctx, r.out.result, "DsRGetForestTrustInformation");
1998
1999 return true;
2000 }
2001
2002 /*
2003 try a netlogon netr_DsrEnumerateDomainTrusts
2004 */
2005 static bool test_DsrEnumerateDomainTrusts(struct torture_context *tctx,
2006 struct dcerpc_pipe *p)
2007 {
2008 NTSTATUS status;
2009 struct netr_DsrEnumerateDomainTrusts r;
2010 struct netr_DomainTrustList trusts;
2011 int i;
2012
2013 r.in.server_name = talloc_asprintf(tctx, "\\\\%s", dcerpc_server_name(p));
2014 r.in.trust_flags = 0x3f;
2015 r.out.trusts = &trusts;
2016
2017 status = dcerpc_netr_DsrEnumerateDomainTrusts(p, tctx, &r);
2018 torture_assert_ntstatus_ok(tctx, status, "DsrEnumerateDomaintrusts");
2019 torture_assert_werr_ok(tctx, r.out.result, "DsrEnumerateDomaintrusts");
2020
2021 /* when trusted_domain_name is NULL, netr_DsRGetForestTrustInformation
2022 * will show non-forest trusts and all UPN suffixes of the own forest
2023 * as LSA_FOREST_TRUST_TOP_LEVEL_NAME types */
2024
2025 if (r.out.trusts->count) {
2026 if (!test_netr_DsRGetForestTrustInformation(tctx, p, NULL)) {
2027 return false;
2028 }
2029 }
2030
2031 for (i=0; i<r.out.trusts->count; i++) {
2032
2033 /* get info for transitive forest trusts */
2034
2035 if (r.out.trusts->array[i].trust_attributes & NETR_TRUST_ATTRIBUTE_FOREST_TRANSITIVE) {
2036 if (!test_netr_DsRGetForestTrustInformation(tctx, p,
2037 r.out.trusts->array[i].dns_name)) {
2038 return false;
2039 }
2040 }
2041 }
2042
2043 return true;
2044 }
2045
2046 static bool test_netr_NetrEnumerateTrustedDomains(struct torture_context *tctx,
2047 struct dcerpc_pipe *p)
2048 {
2049 NTSTATUS status;
2050 struct netr_NetrEnumerateTrustedDomains r;
2051 struct netr_Blob trusted_domains_blob;
2052
2053 r.in.server_name = talloc_asprintf(tctx, "\\\\%s", dcerpc_server_name(p));
2054 r.out.trusted_domains_blob = &trusted_domains_blob;
2055
2056 status = dcerpc_netr_NetrEnumerateTrustedDomains(p, tctx, &r);
2057 torture_assert_ntstatus_ok(tctx, status, "netr_NetrEnumerateTrustedDomains");
2058 torture_assert_werr_ok(tctx, r.out.result, "NetrEnumerateTrustedDomains");
2059
2060 return true;
2061 }
2062
2063 static bool test_netr_NetrEnumerateTrustedDomainsEx(struct torture_context *tctx,
2064 struct dcerpc_pipe *p)
2065 {
2066 NTSTATUS status;
2067 struct netr_NetrEnumerateTrustedDomainsEx r;
2068 struct netr_DomainTrustList dom_trust_list;
2069
2070 r.in.server_name = talloc_asprintf(tctx, "\\\\%s", dcerpc_server_name(p));
2071 r.out.dom_trust_list = &dom_trust_list;
2072
2073 status = dcerpc_netr_NetrEnumerateTrustedDomainsEx(p, tctx, &r);
2074 torture_assert_ntstatus_ok(tctx, status, "netr_NetrEnumerateTrustedDomainsEx");
2075 torture_assert_werr_ok(tctx, r.out.result, "NetrEnumerateTrustedDomainsEx");
2076
2077 return true;
2078 }
2079
2080
2081 static bool test_netr_DsRGetSiteName(struct dcerpc_pipe *p, struct torture_context *tctx,
2082 const char *computer_name,
2083 const char *expected_site)
2084 {
2085 NTSTATUS status;
2086 struct netr_DsRGetSiteName r;
2087 const char *site = NULL;
2088
2089 if (torture_setting_bool(tctx, "samba4", false))
2090 torture_skip(tctx, "skipping DsRGetSiteName test against Samba4");
2091
2092 r.in.computer_name = computer_name;
2093 r.out.site = &site;
2094 torture_comment(tctx, "Testing netr_DsRGetSiteName\n");
2095
2096 status = dcerpc_netr_DsRGetSiteName(p, tctx, &r);
2097 torture_assert_ntstatus_ok(tctx, status, "DsRGetSiteName");
2098 torture_assert_werr_ok(tctx, r.out.result, "DsRGetSiteName");
2099 torture_assert_str_equal(tctx, expected_site, site, "netr_DsRGetSiteName");
2100
2101 r.in.computer_name = talloc_asprintf(tctx, "\\\\%s", computer_name);
2102 torture_comment(tctx,
2103 "Testing netr_DsRGetSiteName with broken computer name: %s\n", r.in.computer_name);
2104
2105 status = dcerpc_netr_DsRGetSiteName(p, tctx, &r);
2106 torture_assert_ntstatus_ok(tctx, status, "DsRGetSiteName");
2107 torture_assert_werr_equal(tctx, r.out.result, WERR_INVALID_COMPUTERNAME, "netr_DsRGetSiteName");
2108
2109 return true;
2110 }
2111
2112 /*
2113 try a netlogon netr_DsRGetDCName
2114 */
2115 static bool test_netr_DsRGetDCName(struct torture_context *tctx,
2116 struct dcerpc_pipe *p)
2117 {
2118 NTSTATUS status;
2119 struct netr_DsRGetDCName r;
2120 struct netr_DsRGetDCNameInfo *info = NULL;
2121
2122 r.in.server_unc = talloc_asprintf(tctx, "\\\\%s", dcerpc_server_name(p));
2123 r.in.domain_name = lp_dnsdomain(tctx->lp_ctx);
2124 r.in.domain_guid = NULL;
2125 r.in.site_guid = NULL;
2126 r.in.flags = DS_RETURN_DNS_NAME;
2127 r.out.info = &info;
2128
2129 status = dcerpc_netr_DsRGetDCName(p, tctx, &r);
2130 torture_assert_ntstatus_ok(tctx, status, "DsRGetDCName");
2131 torture_assert_werr_ok(tctx, r.out.result, "DsRGetDCName");
2132 return test_netr_DsRGetSiteName(p, tctx,
2133 info->dc_unc,
2134 info->dc_site_name);
2135 }
2136
2137 /*
2138 try a netlogon netr_DsRGetDCNameEx
2139 */
2140 static bool test_netr_DsRGetDCNameEx(struct torture_context *tctx,
2141 struct dcerpc_pipe *p)
2142 {
2143 NTSTATUS status;
2144 struct netr_DsRGetDCNameEx r;
2145 struct netr_DsRGetDCNameInfo *info = NULL;
2146
2147 r.in.server_unc = talloc_asprintf(tctx, "\\\\%s", dcerpc_server_name(p));
2148 r.in.domain_name = lp_dnsdomain(tctx->lp_ctx);
2149 r.in.domain_guid = NULL;
2150 r.in.site_name = NULL;
2151 r.in.flags = DS_RETURN_DNS_NAME;
2152 r.out.info = &info;
2153
2154 status = dcerpc_netr_DsRGetDCNameEx(p, tctx, &r);
2155 torture_assert_ntstatus_ok(tctx, status, "netr_DsRGetDCNameEx");
2156 torture_assert_werr_ok(tctx, r.out.result, "netr_DsRGetDCNameEx");
2157
2158 return test_netr_DsRGetSiteName(p, tctx, info->dc_unc,
2159 info->dc_site_name);
2160 }
2161
2162 /*
2163 try a netlogon netr_DsRGetDCNameEx2
2164 */
2165 static bool test_netr_DsRGetDCNameEx2(struct torture_context *tctx,
2166 struct dcerpc_pipe *p)
2167 {
2168 NTSTATUS status;
2169 struct netr_DsRGetDCNameEx2 r;
2170 struct netr_DsRGetDCNameInfo *info = NULL;
2171
2172 r.in.server_unc = talloc_asprintf(tctx, "\\\\%s", dcerpc_server_name(p));
2173 r.in.client_account = NULL;
2174 r.in.mask = 0x00000000;
2175 r.in.domain_name = lp_dnsdomain(tctx->lp_ctx);
2176 r.in.domain_guid = NULL;
2177 r.in.site_name = NULL;
2178 r.in.flags = DS_RETURN_DNS_NAME;
2179 r.out.info = &info;
2180
2181 torture_comment(tctx, "Testing netr_DsRGetDCNameEx2 without client account\n");
2182
2183 status = dcerpc_netr_DsRGetDCNameEx2(p, tctx, &r);
2184 torture_assert_ntstatus_ok(tctx, status, "netr_DsRGetDCNameEx2");
2185 torture_assert_werr_ok(tctx, r.out.result, "netr_DsRGetDCNameEx2");
2186
2187 torture_comment(tctx, "Testing netr_DsRGetDCNameEx2 with client acount\n");
2188 r.in.client_account = TEST_MACHINE_NAME"$";
2189 r.in.mask = ACB_SVRTRUST;
2190 r.in.flags = DS_RETURN_FLAT_NAME;
2191 r.out.info = &info;
2192
2193 status = dcerpc_netr_DsRGetDCNameEx2(p, tctx, &r);
2194 torture_assert_ntstatus_ok(tctx, status, "netr_DsRGetDCNameEx2");
2195 torture_assert_werr_ok(tctx, r.out.result, "netr_DsRGetDCNameEx2");
2196 return test_netr_DsRGetSiteName(p, tctx, info->dc_unc,
2197 info->dc_site_name);
2198 }
2199
2200 static bool test_netr_DsrGetDcSiteCoverageW(struct torture_context *tctx,
2201 struct dcerpc_pipe *p)
2202 {
2203 NTSTATUS status;
2204 struct netr_DsrGetDcSiteCoverageW r;
2205 struct DcSitesCtr *ctr = NULL;
2206
2207 r.in.server_name = talloc_asprintf(tctx, "\\\\%s", dcerpc_server_name(p));
2208 r.out.ctr = &ctr;
2209
2210 status = dcerpc_netr_DsrGetDcSiteCoverageW(p, tctx, &r);
2211 torture_assert_ntstatus_ok(tctx, status, "failed");
2212 torture_assert_werr_ok(tctx, r.out.result, "failed");
2213
2214 return true;
2215 }
2216
2217 static bool test_netr_DsRAddressToSitenamesW(struct torture_context *tctx,
2218 struct dcerpc_pipe *p)
2219 {
2220 NTSTATUS status;
2221 struct netr_DsRAddressToSitenamesW r;
2222 struct netr_DsRAddress addr;
2223 struct netr_DsRAddressToSitenamesWCtr *ctr;
2224
2225 ctr = talloc(tctx, struct netr_DsRAddressToSitenamesWCtr);
2226
2227 addr.size = 16;
2228 addr.buffer = talloc_zero_array(tctx, uint8_t, addr.size);
2229
2230 addr.buffer[0] = 2; /* AF_INET */
2231 addr.buffer[4] = 127;
2232 addr.buffer[5] = 0;
2233 addr.buffer[6] = 0;
2234 addr.buffer[7] = 1;
2235
2236 r.in.server_name = talloc_asprintf(tctx, "\\\\%s", dcerpc_server_name(p));
2237 r.in.count = 1;
2238 r.in.addresses = talloc_zero_array(tctx, struct netr_DsRAddress, r.in.count);
2239 r.in.addresses[0] = addr;
2240 r.out.ctr = &ctr;
2241
2242 status = dcerpc_netr_DsRAddressToSitenamesW(p, tctx, &r);
2243 torture_assert_ntstatus_ok(tctx, status, "failed");
2244 torture_assert_werr_ok(tctx, r.out.result, "failed");
2245
2246 return true;
2247 }
2248
2249 static bool test_netr_DsRAddressToSitenamesExW(struct torture_context *tctx,
2250 struct dcerpc_pipe *p)
2251 {
2252 NTSTATUS status;
2253 struct netr_DsRAddressToSitenamesExW r;
2254 struct netr_DsRAddress addr;
2255 struct netr_DsRAddressToSitenamesExWCtr *ctr;
2256
2257 ctr = talloc(tctx, struct netr_DsRAddressToSitenamesExWCtr);
2258
2259 addr.size = 16;
2260 addr.buffer = talloc_zero_array(tctx, uint8_t, addr.size);
2261
2262 addr.buffer[0] = 2; /* AF_INET */
2263 addr.buffer[4] = 127;
2264 addr.buffer[5] = 0;
2265 addr.buffer[6] = 0;
2266 addr.buffer[7] = 1;
2267
2268 r.in.server_name = talloc_asprintf(tctx, "\\\\%s", dcerpc_server_name(p));
2269 r.in.count = 1;
2270 r.in.addresses = talloc_zero_array(tctx, struct netr_DsRAddress, r.in.count);
2271 r.in.addresses[0] = addr;
2272 r.out.ctr = &ctr;
2273
2274 status = dcerpc_netr_DsRAddressToSitenamesExW(p, tctx, &r);
2275 torture_assert_ntstatus_ok(tctx, status, "failed");
2276 torture_assert_werr_ok(tctx, r.out.result, "failed");
2277
2278 return true;
2279 }
2280
2281 static bool test_netr_ServerGetTrustInfo(struct torture_context *tctx,
2282 struct dcerpc_pipe *p,
2283 struct cli_credentials *machine_credentials)
2284 {
2285 NTSTATUS status;
2286 struct netr_ServerGetTrustInfo r;
2287
2288 struct netr_Authenticator a;
2289 struct netr_Authenticator return_authenticator;
2290 struct samr_Password new_owf_password;
2291 struct samr_Password old_owf_password;
2292 struct netr_TrustInfo *trust_info;
2293
2294 struct netlogon_creds_CredentialState *creds;
2295
2296 if (!test_SetupCredentials3(p, tctx, NETLOGON_NEG_AUTH2_ADS_FLAGS,
2297 machine_credentials, &creds)) {
2298 return false;
2299 }
2300
2301 netlogon_creds_client_authenticator(creds, &a);
2302
2303 r.in.server_name = talloc_asprintf(tctx, "\\\\%s", dcerpc_server_name(p));
2304 r.in.account_name = talloc_asprintf(tctx, "%s$", TEST_MACHINE_NAME);
2305 r.in.secure_channel_type = cli_credentials_get_secure_channel_type(machine_credentials);
2306 r.in.computer_name = TEST_MACHINE_NAME;
2307 r.in.credential = &a;
2308
2309 r.out.return_authenticator = &return_authenticator;
2310 r.out.new_owf_password = &new_owf_password;
2311 r.out.old_owf_password = &old_owf_password;
2312 r.out.trust_info = &trust_info;
2313
2314 status = dcerpc_netr_ServerGetTrustInfo(p, tctx, &r);
2315 torture_assert_ntstatus_ok(tctx, status, "failed");
2316 torture_assert(tctx, netlogon_creds_client_check(creds, &return_authenticator.cred), "Credential chaining failed");
2317
2318 return true;
2319 }
2320
2321
2322 static bool test_GetDomainInfo(struct torture_context *tctx,
2323 struct dcerpc_pipe *p,
2324 struct cli_credentials *machine_credentials)
2325 {
2326 NTSTATUS status;
2327 struct netr_LogonGetDomainInfo r;
2328 struct netr_WorkstationInformation q1;
2329 struct netr_Authenticator a;
2330 struct netlogon_creds_CredentialState *creds;
2331 struct netr_OsVersion os;
2332 union netr_WorkstationInfo query;
2333 union netr_DomainInfo info;
2334 const char* const attrs[] = { "dNSHostName", "operatingSystem",
2335 "operatingSystemServicePack", "operatingSystemVersion",
2336 "servicePrincipalName", NULL };
2337 char *url;
2338 struct ldb_context *sam_ctx = NULL;
2339 struct ldb_message **res;
2340 struct ldb_message_element *spn_el;
2341 int ret, i;
2342 char *version_str;
2343 const char *old_dnsname = NULL;
2344 char **spns = NULL;
2345 int num_spns = 0;
2346 char *temp_str;
2347
2348 torture_comment(tctx, "Testing netr_LogonGetDomainInfo\n");
2349
2350 if (!test_SetupCredentials3(p, tctx, NETLOGON_NEG_AUTH2_ADS_FLAGS,
2351 machine_credentials, &creds)) {
2352 return false;
2353 }
2354
2355 /* We won't double-check this when we are over 'local' transports */
2356 if (dcerpc_server_name(p)) {
2357 /* Set up connection to SAMDB on DC */
2358 url = talloc_asprintf(tctx, "ldap://%s", dcerpc_server_name(p));
2359 sam_ctx = ldb_wrap_connect(tctx, tctx->ev, tctx->lp_ctx, url,
2360 NULL,
2361 cmdline_credentials,
2362 0);
2363
2364 torture_assert(tctx, sam_ctx, "Connection to the SAMDB on DC failed!");
2365 }
2366
2367 torture_comment(tctx, "Testing netr_LogonGetDomainInfo 1st call (no variation of DNS hostname)\n");
2368 netlogon_creds_client_authenticator(creds, &a);
2369
2370 ZERO_STRUCT(r);
2371 r.in.server_name = talloc_asprintf(tctx, "\\\\%s", dcerpc_server_name(p));
2372 r.in.computer_name = TEST_MACHINE_NAME;
2373 r.in.credential = &a;
2374 r.in.level = 1;
2375 r.in.return_authenticator = &a;
2376 r.in.query = &query;
2377 r.out.return_authenticator = &a;
2378 r.out.info = &info;
2379
2380 ZERO_STRUCT(os);
2381 os.os.MajorVersion = 123;
2382 os.os.MinorVersion = 456;
2383 os.os.BuildNumber = 789;
2384 os.os.CSDVersion = "Service Pack 10";
2385 os.os.ServicePackMajor = 10;
2386 os.os.ServicePackMinor = 1;
2387 os.os.SuiteMask = NETR_VER_SUITE_SINGLEUSERTS;
2388 os.os.ProductType = NETR_VER_NT_SERVER;
2389 os.os.Reserved = 0;
2390
2391 version_str = talloc_asprintf(tctx, "%d.%d (%d)", os.os.MajorVersion,
2392 os.os.MinorVersion, os.os.BuildNumber);
2393
2394 ZERO_STRUCT(q1);
2395 q1.dns_hostname = talloc_asprintf(tctx, "%s.%s", TEST_MACHINE_NAME,
2396 lp_dnsdomain(tctx->lp_ctx));
2397 q1.sitename = "Default-First-Site-Name";
2398 q1.os_version.os = &os;
2399 q1.os_name.string = talloc_asprintf(tctx,
2400 "Tortured by Samba4 RPC-NETLOGON: %s",
2401 timestring(tctx, time(NULL)));
2402
2403 /* The workstation handles the "servicePrincipalName" and DNS hostname
2404 updates */
2405 q1.workstation_flags = NETR_WS_FLAG_HANDLES_SPN_UPDATE;
2406
2407 query.workstation_info = &q1;
2408
2409 if (sam_ctx) {
2410 /* Gets back the old DNS hostname in AD */
2411 ret = gendb_search(sam_ctx, tctx, NULL, &res, attrs,
2412 "(sAMAccountName=%s$)", TEST_MACHINE_NAME);
2413 old_dnsname =
2414 ldb_msg_find_attr_as_string(res[0], "dNSHostName", NULL);
2415
2416 /* Gets back the "servicePrincipalName"s in AD */
2417 spn_el = ldb_msg_find_element(res[0], "servicePrincipalName");
2418 if (spn_el != NULL) {
2419 for (i=0; i < spn_el->num_values; i++) {
2420 spns = talloc_realloc(tctx, spns, char *, i + 1);
2421 spns[i] = (char *) spn_el->values[i].data;
2422 }
2423 num_spns = i;
2424 }
2425 }
2426
2427 status = dcerpc_netr_LogonGetDomainInfo(p, tctx, &r);
2428 torture_assert_ntstatus_ok(tctx, status, "netr_LogonGetDomainInfo");
2429 torture_assert(tctx, netlogon_creds_client_check(creds, &a.cred), "Credential chaining failed");
2430
2431 msleep(250);
2432
2433 if (sam_ctx) {
2434 /* AD workstation infos entry check */
2435 ret = gendb_search(sam_ctx, tctx, NULL, &res, attrs,
2436 "(sAMAccountName=%s$)", TEST_MACHINE_NAME);
2437 torture_assert(tctx, ret == 1, "Test machine account not found in SAMDB on DC! Has the workstation been joined?");
2438 torture_assert_str_equal(tctx,
2439 ldb_msg_find_attr_as_string(res[0], "operatingSystem", NULL),
2440 q1.os_name.string, "'operatingSystem' wrong!");
2441 torture_assert_str_equal(tctx,
2442 ldb_msg_find_attr_as_string(res[0], "operatingSystemServicePack", NULL),
2443 os.os.CSDVersion, "'operatingSystemServicePack' wrong!");
2444 torture_assert_str_equal(tctx,
2445 ldb_msg_find_attr_as_string(res[0], "operatingSystemVersion", NULL),
2446 version_str, "'operatingSystemVersion' wrong!");
2447
2448 if (old_dnsname != NULL) {
2449 /* If before a DNS hostname was set then it should remain
2450 the same in combination with the "servicePrincipalName"s.
2451 The DNS hostname should also be returned by our
2452 "LogonGetDomainInfo" call (in the domain info structure). */
2453
2454 torture_assert_str_equal(tctx,
2455 ldb_msg_find_attr_as_string(res[0], "dNSHostName", NULL),
2456 old_dnsname, "'DNS hostname' was not set!");
2457
2458 spn_el = ldb_msg_find_element(res[0], "servicePrincipalName");
2459 torture_assert(tctx, ((spns != NULL) && (spn_el != NULL)),
2460 "'servicePrincipalName's not set!");
2461 torture_assert(tctx, spn_el->num_values == num_spns,
2462 "'servicePrincipalName's incorrect!");
2463 for (i=0; (i < spn_el->num_values) && (i < num_spns); i++)
2464 torture_assert_str_equal(tctx,
2465 (char *) spn_el->values[i].data,
2466 spns[i], "'servicePrincipalName's incorrect!");
2467
2468 torture_assert_str_equal(tctx,
2469 info.domain_info->dns_hostname.string,
2470 old_dnsname,
2471 "Out 'DNS hostname' doesn't match the old one!");
2472 } else {
2473 /* If no DNS hostname was set then also now none should be set,
2474 the "servicePrincipalName"s should remain empty and no DNS
2475 hostname should be returned by our "LogonGetDomainInfo"
2476 call (in the domain info structure). */
2477
2478 torture_assert(tctx,
2479 ldb_msg_find_attr_as_string(res[0], "dNSHostName", NULL) == NULL,
2480 "'DNS hostname' was set!");
2481
2482 spn_el = ldb_msg_find_element(res[0], "servicePrincipalName");
2483 torture_assert(tctx, ((spns == NULL) && (spn_el == NULL)),
2484 "'servicePrincipalName's were set!");
2485
2486 torture_assert(tctx,
2487 info.domain_info->dns_hostname.string == NULL,
2488 "Out 'DNS host name' was set!");
2489 }
2490 }
2491
2492 /* Checks "workstation flags" */
2493 torture_assert(tctx,
2494 info.domain_info->workstation_flags
2495 == NETR_WS_FLAG_HANDLES_SPN_UPDATE,
2496 "Out 'workstation flags' don't match!");
2497
2498
2499 torture_comment(tctx, "Testing netr_LogonGetDomainInfo 2nd call (variation of DNS hostname doesn't work)\n");
2500 netlogon_creds_client_authenticator(creds, &a);
2501
2502 /* Wipe out the osVersion, and prove which values still 'stick' */
2503 q1.os_version.os = NULL;
2504
2505 /* Change also the DNS hostname to test differences in behaviour */
2506 talloc_free(discard_const_p(char, q1.dns_hostname));
2507 q1.dns_hostname = talloc_asprintf(tctx, "%s2.%s", TEST_MACHINE_NAME,
2508 lp_dnsdomain(tctx->lp_ctx));
2509
2510 /* The workstation handles the "servicePrincipalName" and DNS hostname
2511 updates */
2512 q1.workstation_flags = NETR_WS_FLAG_HANDLES_SPN_UPDATE;
2513
2514 status = dcerpc_netr_LogonGetDomainInfo(p, tctx, &r);
2515 torture_assert_ntstatus_ok(tctx, status, "netr_LogonGetDomainInfo");
2516 torture_assert(tctx, netlogon_creds_client_check(creds, &a.cred), "Credential chaining failed");
2517
2518 msleep(250);
2519
2520 if (sam_ctx) {
2521 /* AD workstation infos entry check */
2522 ret = gendb_search(sam_ctx, tctx, NULL, &res, attrs,
2523 "(sAMAccountName=%s$)", TEST_MACHINE_NAME);
2524 torture_assert(tctx, ret == 1, "Test machine account not found in SAMDB on DC! Has the workstation been joined?");
2525
2526 torture_assert_str_equal(tctx,
2527 ldb_msg_find_attr_as_string(res[0], "operatingSystem", NULL),
2528 q1.os_name.string, "'operatingSystem' should stick!");
2529 torture_assert(tctx,
2530 ldb_msg_find_attr_as_string(res[0], "operatingSystemServicePack", NULL) == NULL,
2531 "'operatingSystemServicePack' shouldn't stick!");
2532 torture_assert(tctx,
2533 ldb_msg_find_attr_as_string(res[0], "operatingSystemVersion", NULL) == NULL,
2534 "'operatingSystemVersion' shouldn't stick!");
2535
2536 /* The DNS host name shouldn't have been updated by the server */
2537
2538 torture_assert_str_equal(tctx,
2539 ldb_msg_find_attr_as_string(res[0], "dNSHostName", NULL),
2540 old_dnsname, "'DNS host name' did change!");
2541
2542 /* Find the two "servicePrincipalName"s which the DC shouldn't have been
2543 updated (HOST/<Netbios name> and HOST/<FQDN name>) - see MS-NRPC
2544 3.5.4.3.9 */
2545 spn_el = ldb_msg_find_element(res[0], "servicePrincipalName");
2546 torture_assert(tctx, spn_el != NULL,
2547 "There should exist 'servicePrincipalName's in AD!");
2548 temp_str = talloc_asprintf(tctx, "HOST/%s", TEST_MACHINE_NAME);
2549 for (i=0; i < spn_el->num_values; i++)
2550 if (strcasecmp((char *) spn_el->values[i].data, temp_str) == 0)
2551 break;
2552 torture_assert(tctx, i != spn_el->num_values,
2553 "'servicePrincipalName' HOST/<Netbios name> not found!");
2554 temp_str = talloc_asprintf(tctx, "HOST/%s", old_dnsname);
2555 for (i=0; i < spn_el->num_values; i++)
2556 if (strcasecmp((char *) spn_el->values[i].data, temp_str) == 0)
2557 break;
2558 torture_assert(tctx, i != spn_el->num_values,
2559 "'servicePrincipalName' HOST/<FQDN name> not found!");
2560
2561 /* Check that the out DNS hostname was set properly */
2562 torture_assert_str_equal(tctx, info.domain_info->dns_hostname.string,
2563 old_dnsname, "Out 'DNS hostname' doesn't match the old one!");
2564 }
2565
2566 /* Checks "workstation flags" */
2567 torture_assert(tctx,
2568 info.domain_info->workstation_flags == NETR_WS_FLAG_HANDLES_SPN_UPDATE,
2569 "Out 'workstation flags' don't match!");
2570
2571
2572 /* Now try the same but the workstation flags set to 0 */
2573
2574 torture_comment(tctx, "Testing netr_LogonGetDomainInfo 3rd call (variation of DNS hostname doesn't work)\n");
2575 netlogon_creds_client_authenticator(creds, &a);
2576
2577 /* Change also the DNS hostname to test differences in behaviour */
2578 talloc_free(discard_const_p(char, q1.dns_hostname));
2579 q1.dns_hostname = talloc_asprintf(tctx, "%s2.%s", TEST_MACHINE_NAME,
2580 lp_dnsdomain(tctx->lp_ctx));
2581
2582 /* Wipe out the osVersion, and prove which values still 'stick' */
2583 q1.os_version.os = NULL;
2584
2585 /* Let the DC handle the "servicePrincipalName" and DNS hostname
2586 updates */
2587 q1.workstation_flags = 0;
2588
2589 status = dcerpc_netr_LogonGetDomainInfo(p, tctx, &r);
2590 torture_assert_ntstatus_ok(tctx, status, "netr_LogonGetDomainInfo");
2591 torture_assert(tctx, netlogon_creds_client_check(creds, &a.cred), "Credential chaining failed");
2592
2593 msleep(250);
2594
2595 if (sam_ctx) {
2596 /* AD workstation infos entry check */
2597 ret = gendb_search(sam_ctx, tctx, NULL, &res, attrs,
2598 "(sAMAccountName=%s$)", TEST_MACHINE_NAME);
2599 torture_assert(tctx, ret == 1, "Test machine account not found in SAMDB on DC! Has the workstation been joined?");
2600
2601 torture_assert_str_equal(tctx,
2602 ldb_msg_find_attr_as_string(res[0], "operatingSystem", NULL),
2603 q1.os_name.string, "'operatingSystem' should stick!");
2604 torture_assert(tctx,
2605 ldb_msg_find_attr_as_string(res[0], "operatingSystemServicePack", NULL) == NULL,
2606 "'operatingSystemServicePack' shouldn't stick!");
2607 torture_assert(tctx,
2608 ldb_msg_find_attr_as_string(res[0], "operatingSystemVersion", NULL) == NULL,
2609 "'operatingSystemVersion' shouldn't stick!");
2610
2611 /* The DNS host name shouldn't have been updated by the server */
2612
2613 torture_assert_str_equal(tctx,
2614 ldb_msg_find_attr_as_string(res[0], "dNSHostName", NULL),
2615 old_dnsname, "'DNS host name' did change!");
2616
2617 /* Find the two "servicePrincipalName"s which the DC shouldn't have been
2618 updated (HOST/<Netbios name> and HOST/<FQDN name>) - see MS-NRPC
2619 3.5.4.3.9 */
2620 spn_el = ldb_msg_find_element(res[0], "servicePrincipalName");
2621 torture_assert(tctx, spn_el != NULL,
2622 "There should exist 'servicePrincipalName's in AD!");
2623 temp_str = talloc_asprintf(tctx, "HOST/%s", TEST_MACHINE_NAME);
2624 for (i=0; i < spn_el->num_values; i++)
2625 if (strcasecmp((char *) spn_el->values[i].data, temp_str) == 0)
2626 break;
2627 torture_assert(tctx, i != spn_el->num_values,
2628 "'servicePrincipalName' HOST/<Netbios name> not found!");
2629 temp_str = talloc_asprintf(tctx, "HOST/%s", old_dnsname);
2630 for (i=0; i < spn_el->num_values; i++)
2631 if (strcasecmp((char *) spn_el->values[i].data, temp_str) == 0)
2632 break;
2633 torture_assert(tctx, i != spn_el->num_values,
2634 "'servicePrincipalName' HOST/<FQDN name> not found!");
2635
2636 /* Here the server gives us NULL as the out DNS hostname */
2637 torture_assert(tctx, info.domain_info->dns_hostname.string == NULL,
2638 "Out 'DNS hostname' should be NULL!");
2639 }
2640
2641 /* Checks "workstation flags" */
2642 torture_assert(tctx,
2643 info.domain_info->workstation_flags == 0,
2644 "Out 'workstation flags' don't match!");
2645
2646
2647 torture_comment(tctx, "Testing netr_LogonGetDomainInfo 4th call (verification of DNS hostname and check for trusted domains)\n");
2648 netlogon_creds_client_authenticator(creds, &a);
2649
2650 /* Put the DNS hostname back */
2651 talloc_free(discard_const_p(char, q1.dns_hostname));
2652 q1.dns_hostname = talloc_asprintf(tctx, "%s.%s", TEST_MACHINE_NAME,
2653 lp_dnsdomain(tctx->lp_ctx));
2654
2655 /* The workstation handles the "servicePrincipalName" and DNS hostname
2656 updates */
2657 q1.workstation_flags = NETR_WS_FLAG_HANDLES_SPN_UPDATE;
2658
2659 status = dcerpc_netr_LogonGetDomainInfo(p, tctx, &r);
2660 torture_assert_ntstatus_ok(tctx, status, "netr_LogonGetDomainInfo");
2661 torture_assert(tctx, netlogon_creds_client_check(creds, &a.cred), "Credential chaining failed");
2662
2663 msleep(250);
2664
2665 /* Now the in/out DNS hostnames should be the same */
2666 torture_assert_str_equal(tctx,
2667 info.domain_info->dns_hostname.string,
2668 query.workstation_info->dns_hostname,
2669 "In/Out 'DNS hostnames' don't match!");
2670
2671 /* Checks "workstation flags" */
2672 torture_assert(tctx,
2673 info.domain_info->workstation_flags
2674 == NETR_WS_FLAG_HANDLES_SPN_UPDATE,
2675 "Out 'workstation flags' don't match!");
2676
2677 /* Checks for trusted domains */
2678 torture_assert(tctx,
2679 (info.domain_info->trusted_domain_count != 0)
2680 && (info.domain_info->trusted_domains != NULL),
2681 "Trusted domains have been requested!");
2682
2683
2684 torture_comment(tctx, "Testing netr_LogonGetDomainInfo 5th call (check for trusted domains)\n");
2685 netlogon_creds_client_authenticator(creds, &a);
2686
2687 /* The workstation handles the "servicePrincipalName" and DNS hostname
2688 updates and requests inbound trusts */
2689 q1.workstation_flags = NETR_WS_FLAG_HANDLES_SPN_UPDATE
2690 | NETR_WS_FLAG_HANDLES_INBOUND_TRUSTS;
2691
2692 status = dcerpc_netr_LogonGetDomainInfo(p, tctx, &r);
2693 torture_assert_ntstatus_ok(tctx, status, "netr_LogonGetDomainInfo");
2694 torture_assert(tctx, netlogon_creds_client_check(creds, &a.cred), "Credential chaining failed");
2695
2696 msleep(250);
2697
2698 /* Checks "workstation flags" */
2699 torture_assert(tctx,
2700 info.domain_info->workstation_flags
2701 == (NETR_WS_FLAG_HANDLES_SPN_UPDATE
2702 | NETR_WS_FLAG_HANDLES_INBOUND_TRUSTS),
2703 "Out 'workstation flags' don't match!");
2704
2705 /* Checks for trusted domains */
2706 torture_assert(tctx,
2707 (info.domain_info->trusted_domain_count != 0)
2708 && (info.domain_info->trusted_domains != NULL),
2709 "Trusted domains have been requested!");
2710
2711 return true;
2712 }
2713
2714 static bool test_GetDomainInfo_async(struct torture_context *tctx,
2715 struct dcerpc_pipe *p,
2716 struct cli_credentials *machine_credentials)
2717 {
2718 NTSTATUS status;
2719 struct netr_LogonGetDomainInfo r;
2720 struct netr_WorkstationInformation q1;
2721 struct netr_Authenticator a;
2722 #define ASYNC_COUNT 100
2723 struct netlogon_creds_CredentialState *creds;
2724 struct netlogon_creds_CredentialState *creds_async[ASYNC_COUNT];
2725 struct rpc_request *req[ASYNC_COUNT];
2726 int i;
2727 union netr_WorkstationInfo query;
2728 union netr_DomainInfo info;
2729
2730 torture_comment(tctx, "Testing netr_LogonGetDomainInfo - async count %d\n", ASYNC_COUNT);
2731
2732 if (!test_SetupCredentials3(p, tctx, NETLOGON_NEG_AUTH2_ADS_FLAGS,
2733 machine_credentials, &creds)) {
2734 return false;
2735 }
2736
2737 ZERO_STRUCT(r);
2738 r.in.server_name = talloc_asprintf(tctx, "\\\\%s", dcerpc_server_name(p));
2739 r.in.computer_name = TEST_MACHINE_NAME;
2740 r.in.credential = &a;
2741 r.in.level = 1;
2742 r.in.return_authenticator = &a;
2743 r.in.query = &query;
2744 r.out.return_authenticator = &a;
2745 r.out.info = &info;
2746
2747 ZERO_STRUCT(q1);
2748 q1.dns_hostname = talloc_asprintf(tctx, "%s.%s", TEST_MACHINE_NAME,
2749 lp_dnsdomain(tctx->lp_ctx));
2750 q1.sitename = "Default-First-Site-Name";
2751 q1.os_name.string = "UNIX/Linux or similar";
2752
2753 query.workstation_info = &q1;
2754
2755 for (i=0;i<ASYNC_COUNT;i++) {
2756 netlogon_creds_client_authenticator(creds, &a);
2757
2758 creds_async[i] = (struct netlogon_creds_CredentialState *)talloc_memdup(creds, creds, sizeof(*creds));
2759 req[i] = dcerpc_netr_LogonGetDomainInfo_send(p, tctx, &r);
2760
2761 /* even with this flush per request a w2k3 server seems to
2762 clag with multiple outstanding requests. bleergh. */
2763 torture_assert_int_equal(tctx, event_loop_once(dcerpc_event_context(p)), 0,
2764 "event_loop_once failed");
2765 }
2766
2767 for (i=0;i<ASYNC_COUNT;i++) {
2768 status = dcerpc_netr_LogonGetDomainInfo_recv(req[i]);
2769
2770 torture_assert_ntstatus_ok(tctx, status, "netr_LogonGetDomainInfo_async");
2771 torture_assert_ntstatus_ok(tctx, r.out.result, "netr_LogonGetDomainInfo_async");
2772
2773 torture_assert(tctx, netlogon_creds_client_check(creds_async[i], &a.cred),
2774 "Credential chaining failed at async");
2775 }
2776
2777 torture_comment(tctx,
2778 "Testing netr_LogonGetDomainInfo - async count %d OK\n", ASYNC_COUNT);
2779
2780 return true;
2781 }
2782
2783 static bool test_ManyGetDCName(struct torture_context *tctx,
2784 struct dcerpc_pipe *p)
2785 {
2786 NTSTATUS status;
2787 struct dcerpc_pipe *p2;
2788 struct lsa_ObjectAttribute attr;
2789 struct lsa_QosInfo qos;
2790 struct lsa_OpenPolicy2 o;
2791 struct policy_handle lsa_handle;
2792 struct lsa_DomainList domains;
2793
2794 struct lsa_EnumTrustDom t;
2795 uint32_t resume_handle = 0;
2796 struct netr_GetAnyDCName d;
2797 const char *dcname = NULL;
2798
2799 int i;
2800
2801 if (p->conn->transport.transport != NCACN_NP) {
2802 return true;
2803 }
2804
2805 torture_comment(tctx, "Torturing GetDCName\n");
2806
2807 status = dcerpc_secondary_connection(p, &p2, p->binding);
2808 torture_assert_ntstatus_ok(tctx, status, "Failed to create secondary connection");
2809
2810 status = dcerpc_bind_auth_none(p2, &ndr_table_lsarpc);
2811 torture_assert_ntstatus_ok(tctx, status, "Failed to create bind on secondary connection");
2812
2813 qos.len = 0;
2814 qos.impersonation_level = 2;
2815 qos.context_mode = 1;
2816 qos.effective_only = 0;
2817
2818 attr.len = 0;
2819 attr.root_dir = NULL;
2820 attr.object_name = NULL;
2821 attr.attributes = 0;
2822 attr.sec_desc = NULL;
2823 attr.sec_qos = &qos;
2824
2825 o.in.system_name = "\\";
2826 o.in.attr = &attr;
2827 o.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
2828 o.out.handle = &lsa_handle;
2829
2830 status = dcerpc_lsa_OpenPolicy2(p2, tctx, &o);
2831 torture_assert_ntstatus_ok(tctx, status, "OpenPolicy2 failed");
2832
2833 t.in.handle = &lsa_handle;
2834 t.in.resume_handle = &resume_handle;
2835 t.in.max_size = 1000;
2836 t.out.domains = &domains;
2837 t.out.resume_handle = &resume_handle;
2838
2839 status = dcerpc_lsa_EnumTrustDom(p2, tctx, &t);
2840
2841 if ((!NT_STATUS_IS_OK(status) &&
2842 (!NT_STATUS_EQUAL(status, NT_STATUS_NO_MORE_ENTRIES))))
2843 torture_fail(tctx, "Could not list domains");
2844
2845 talloc_free(p2);
2846
2847 d.in.logon_server = talloc_asprintf(tctx, "\\\\%s",
2848 dcerpc_server_name(p));
2849 d.out.dcname = &dcname;
2850
2851 for (i=0; i<domains.count * 4; i++) {
2852 struct lsa_DomainInfo *info =
2853 &domains.domains[rand()%domains.count];
2854
2855 d.in.domainname = info->name.string;
2856
2857 status = dcerpc_netr_GetAnyDCName(p, tctx, &d);
2858 torture_assert_ntstatus_ok(tctx, status, "GetAnyDCName");
2859
2860 torture_comment(tctx, "\tDC for domain %s is %s\n", info->name.string,
2861 dcname ? dcname : "unknown");
2862 }
2863
2864 return true;
2865 }
2866
2867 static bool test_SetPassword_with_flags(struct torture_context *tctx,
2868 struct dcerpc_pipe *p,
2869 struct cli_credentials *machine_credentials)
2870 {
2871 uint32_t flags[] = { 0, NETLOGON_NEG_STRONG_KEYS };
2872 struct netlogon_creds_CredentialState *creds;
2873 int i;
2874
2875 if (!test_SetupCredentials2(p, tctx, 0,
2876 machine_credentials,
2877 cli_credentials_get_secure_channel_type(machine_credentials),
2878 &creds)) {
2879 torture_skip(tctx, "DC does not support negotiation of 64bit session keys");
2880 }
2881
2882 for (i=0; i < ARRAY_SIZE(flags); i++) {
2883 torture_assert(tctx,
2884 test_SetPassword_flags(tctx, p, machine_credentials, flags[i]),
2885 talloc_asprintf(tctx, "failed to test SetPassword negotiating with 0x%08x flags", flags[i]));
2886 }
2887
2888 return true;
2889 }
2890
2891 struct torture_suite *torture_rpc_netlogon(TALLOC_CTX *mem_ctx)
2892 {
2893 struct torture_suite *suite = torture_suite_create(mem_ctx, "NETLOGON");
2894 struct torture_rpc_tcase *tcase;
2895 struct torture_test *test;
2896
2897 tcase = torture_suite_add_machine_bdc_rpc_iface_tcase(suite, "netlogon",
2898 &ndr_table_netlogon, TEST_MACHINE_NAME);
2899
2900 torture_rpc_tcase_add_test(tcase, "LogonUasLogon", test_LogonUasLogon);
2901 torture_rpc_tcase_add_test(tcase, "LogonUasLogoff", test_LogonUasLogoff);
2902 torture_rpc_tcase_add_test_creds(tcase, "SamLogon", test_SamLogon);
2903 torture_rpc_tcase_add_test_creds(tcase, "SetPassword", test_SetPassword);
2904 torture_rpc_tcase_add_test_creds(tcase, "SetPassword2", test_SetPassword2);
2905 torture_rpc_tcase_add_test_creds(tcase, "GetPassword", test_GetPassword);
2906 torture_rpc_tcase_add_test_creds(tcase, "GetTrustPasswords", test_GetTrustPasswords);
2907 torture_rpc_tcase_add_test_creds(tcase, "GetDomainInfo", test_GetDomainInfo);
2908 torture_rpc_tcase_add_test_creds(tcase, "DatabaseSync", test_DatabaseSync);
2909 torture_rpc_tcase_add_test_creds(tcase, "DatabaseDeltas", test_DatabaseDeltas);
2910 torture_rpc_tcase_add_test_creds(tcase, "DatabaseRedo", test_DatabaseRedo);
2911 torture_rpc_tcase_add_test_creds(tcase, "AccountDeltas", test_AccountDeltas);
2912 torture_rpc_tcase_add_test_creds(tcase, "AccountSync", test_AccountSync);
2913 torture_rpc_tcase_add_test(tcase, "GetDcName", test_GetDcName);
2914 torture_rpc_tcase_add_test(tcase, "ManyGetDCName", test_ManyGetDCName);
2915 torture_rpc_tcase_add_test(tcase, "GetAnyDCName", test_GetAnyDCName);
2916 torture_rpc_tcase_add_test_creds(tcase, "DatabaseSync2", test_DatabaseSync2);
2917 torture_rpc_tcase_add_test(tcase, "DsrEnumerateDomainTrusts", test_DsrEnumerateDomainTrusts);
2918 torture_rpc_tcase_add_test(tcase, "NetrEnumerateTrustedDomains", test_netr_NetrEnumerateTrustedDomains);
2919 torture_rpc_tcase_add_test(tcase, "NetrEnumerateTrustedDomainsEx", test_netr_NetrEnumerateTrustedDomainsEx);
2920 test = torture_rpc_tcase_add_test_creds(tcase, "GetDomainInfo_async", test_GetDomainInfo_async);
2921 test->dangerous = true;
2922 torture_rpc_tcase_add_test(tcase, "DsRGetDCName", test_netr_DsRGetDCName);
2923 torture_rpc_tcase_add_test(tcase, "DsRGetDCNameEx", test_netr_DsRGetDCNameEx);
2924 torture_rpc_tcase_add_test(tcase, "DsRGetDCNameEx2", test_netr_DsRGetDCNameEx2);
2925 torture_rpc_tcase_add_test(tcase, "DsrGetDcSiteCoverageW", test_netr_DsrGetDcSiteCoverageW);
2926 torture_rpc_tcase_add_test(tcase, "DsRAddressToSitenamesW", test_netr_DsRAddressToSitenamesW);
2927 torture_rpc_tcase_add_test(tcase, "DsRAddressToSitenamesExW", test_netr_DsRAddressToSitenamesExW);
2928 torture_rpc_tcase_add_test_creds(tcase, "ServerGetTrustInfo", test_netr_ServerGetTrustInfo);
2929
2930 return suite;
2931 }
2932
2933 struct torture_suite *torture_rpc_netlogon_s3(TALLOC_CTX *mem_ctx)
2934 {
2935 struct torture_suite *suite = torture_suite_create(mem_ctx, "NETLOGON-S3");
2936 struct torture_rpc_tcase *tcase;
2937
2938 tcase = torture_suite_add_machine_bdc_rpc_iface_tcase(suite, "netlogon",
2939 &ndr_table_netlogon, TEST_MACHINE_NAME);
2940
2941 torture_rpc_tcase_add_test_creds(tcase, "SamLogon", test_SamLogon);
2942 torture_rpc_tcase_add_test_creds(tcase, "SetPassword", test_SetPassword);
2943 torture_rpc_tcase_add_test_creds(tcase, "SetPassword_with_flags", test_SetPassword_with_flags);
2944 torture_rpc_tcase_add_test_creds(tcase, "SetPassword2", test_SetPassword2);
2945 torture_rpc_tcase_add_test(tcase, "NetrEnumerateTrustedDomains", test_netr_NetrEnumerateTrustedDomains);
2946
2947 return suite;
2948 }
2949
2950 struct torture_suite *torture_rpc_netlogon_admin(TALLOC_CTX *mem_ctx)
2951 {
2952 struct torture_suite *suite = torture_suite_create(mem_ctx, "NETLOGON-ADMIN");
2953 struct torture_rpc_tcase *tcase;
2954
2955 tcase = torture_suite_add_machine_bdc_rpc_iface_tcase(suite, "netlogon",
2956 &ndr_table_netlogon, TEST_MACHINE_NAME);
2957 torture_rpc_tcase_add_test_creds(tcase, "LogonControl", test_LogonControl);
2958 torture_rpc_tcase_add_test_creds(tcase, "LogonControl2", test_LogonControl2);
2959 torture_rpc_tcase_add_test_creds(tcase, "LogonControl2Ex", test_LogonControl2Ex);
2960
2961 tcase = torture_suite_add_machine_workstation_rpc_iface_tcase(suite, "netlogon",
2962 &ndr_table_netlogon, TEST_MACHINE_NAME);
2963 torture_rpc_tcase_add_test_creds(tcase, "LogonControl", test_LogonControl);
2964 torture_rpc_tcase_add_test_creds(tcase, "LogonControl2", test_LogonControl2);
2965 torture_rpc_tcase_add_test_creds(tcase, "LogonControl2Ex", test_LogonControl2Ex);
2966
2967 tcase = torture_suite_add_rpc_iface_tcase(suite, "netlogon",
2968 &ndr_table_netlogon);
2969 torture_rpc_tcase_add_test_creds(tcase, "LogonControl", test_LogonControl);
2970 torture_rpc_tcase_add_test_creds(tcase, "LogonControl2", test_LogonControl2);
2971 torture_rpc_tcase_add_test_creds(tcase, "LogonControl2Ex", test_LogonControl2Ex);
2972
2973 return suite;
2974 }