-/*
+/*
Unix SMB/CIFS implementation.
test suite for netlogon rpc operations
Copyright (C) Andrew Bartlett <abartlet@samba.org> 2003-2004
Copyright (C) Tim Potter 2003
Copyright (C) Matthias Dieter Wallnöfer 2009-2010
-
+
This program is free software; you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation; either version 3 of the License, or
(at your option) any later version.
-
+
This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
GNU General Public License for more details.
-
+
You should have received a copy of the GNU General Public License
along with this program. If not, see <http://www.gnu.org/licenses/>.
*/
#define TEST_MACHINE_NAME "torturetest"
-static bool test_LogonUasLogon(struct torture_context *tctx,
+static bool test_netr_broken_binding_handle(struct torture_context *tctx,
+ struct dcerpc_pipe *p)
+{
+ NTSTATUS status;
+ struct netr_DsRGetSiteName r;
+ const char *site = NULL;
+ struct dcerpc_binding_handle *b = p->binding_handle;
+
+ r.in.computer_name = talloc_asprintf(tctx, "\\\\%s",
+ dcerpc_server_name(p));
+ r.out.site = &site;
+
+ torture_comment(tctx,
+ "Testing netlogon request with correct binding handle: %s\n",
+ r.in.computer_name);
+
+ status = dcerpc_netr_DsRGetSiteName_r(b, tctx, &r);
+ torture_assert_ntstatus_ok(tctx, status,
+ "Netlogon request with broken binding handle");
+ torture_assert_werr_ok(tctx, r.out.result,
+ "Netlogon request with broken binding handle");
+
+ if (torture_setting_bool(tctx, "samba3", false) ||
+ torture_setting_bool(tctx, "samba4", false)) {
+ torture_skip(tctx,
+ "Skipping broken binding handle check against Samba");
+ }
+
+ r.in.computer_name = talloc_asprintf(tctx, "\\\\\\\\%s",
+ dcerpc_server_name(p));
+
+ torture_comment(tctx,
+ "Testing netlogon request with broken binding handle: %s\n",
+ r.in.computer_name);
+
+ status = dcerpc_netr_DsRGetSiteName_r(b, tctx, &r);
+ torture_assert_ntstatus_ok(tctx, status,
+ "Netlogon request with broken binding handle");
+ torture_assert_werr_equal(tctx, r.out.result,
+ WERR_INVALID_COMPUTERNAME,
+ "Netlogon request with broken binding handle");
+
+ r.in.computer_name = "\\\\\\\\THIS_IS_NOT_VALID";
+
+ torture_comment(tctx,
+ "Testing netlogon request with broken binding handle: %s\n",
+ r.in.computer_name);
+
+ status = dcerpc_netr_DsRGetSiteName_r(b, tctx, &r);
+ torture_assert_ntstatus_ok(tctx, status,
+ "Netlogon request with broken binding handle");
+ torture_assert_werr_equal(tctx, r.out.result,
+ WERR_INVALID_COMPUTERNAME,
+ "Netlogon request with broken binding handle");
+
+ return true;
+}
+
+static bool test_LogonUasLogon(struct torture_context *tctx,
struct dcerpc_pipe *p)
{
NTSTATUS status;
creds = netlogon_creds_client_init(tctx, a.in.account_name,
a.in.computer_name,
- &credentials1, &credentials2,
- mach_password, &credentials3,
+ &credentials1, &credentials2,
+ mach_password, &credentials3,
0);
torture_assert(tctx, creds != NULL, "memory allocation");
/* This allows the tests to continue against the more fussy windows 2008 */
if (NT_STATUS_EQUAL(a.out.result, NT_STATUS_DOWNGRADE_DETECTED)) {
- return test_SetupCredentials2(p, tctx, NETLOGON_NEG_AUTH2_ADS_FLAGS,
+ return test_SetupCredentials2(p, tctx, NETLOGON_NEG_AUTH2_ADS_FLAGS,
credentials,
cli_credentials_get_secure_channel_type(credentials),
creds_out);
torture_assert_ntstatus_ok(tctx, a.out.result, "ServerAuthenticate");
- torture_assert(tctx, netlogon_creds_client_check(creds, &credentials3),
+ torture_assert(tctx, netlogon_creds_client_check(creds, &credentials3),
"Credential chaining failed");
*creds_out = creds;
a.out.return_credentials = &credentials3;
creds = netlogon_creds_client_init(tctx, a.in.account_name,
- a.in.computer_name,
- &credentials1, &credentials2,
- mach_password, &credentials3,
+ a.in.computer_name,
+ &credentials1, &credentials2,
+ mach_password, &credentials3,
negotiate_flags);
torture_assert(tctx, creds != NULL, "memory allocation");
"ServerAuthenticate2 failed");
torture_assert_ntstatus_ok(tctx, a.out.result, "ServerAuthenticate2 failed");
- torture_assert(tctx, netlogon_creds_client_check(creds, &credentials3),
+ torture_assert(tctx, netlogon_creds_client_check(creds, &credentials3),
"Credential chaining failed");
torture_comment(tctx, "negotiate_flags=0x%08x\n", negotiate_flags);
creds = netlogon_creds_client_init(tctx, a.in.account_name,
a.in.computer_name,
- &credentials1, &credentials2,
+ &credentials1, &credentials2,
&mach_password, &credentials3,
negotiate_flags);
-
+
torture_assert(tctx, creds != NULL, "memory allocation");
torture_comment(tctx, "Testing ServerAuthenticate3\n");
torture_assert(tctx, netlogon_creds_client_check(creds, &credentials3), "Credential chaining failed");
torture_comment(tctx, "negotiate_flags=0x%08x\n", negotiate_flags);
-
+
/* Prove that requesting a challenge again won't break it */
torture_assert_ntstatus_ok(tctx, dcerpc_netr_ServerReqChallenge_r(b, tctx, &r),
"ServerReqChallenge failed");
/*
try a change password for our machine account
*/
-static bool test_SetPassword(struct torture_context *tctx,
+static bool test_SetPassword(struct torture_context *tctx,
struct dcerpc_pipe *p,
struct cli_credentials *machine_credentials)
{
netlogon_creds_des_encrypt(creds, &new_password);
torture_comment(tctx, "Testing ServerPasswordSet on machine account\n");
- torture_comment(tctx, "Changing machine account password to '%s'\n",
+ torture_comment(tctx, "Changing machine account password to '%s'\n",
password);
netlogon_creds_client_authenticator(creds, &credential);
credentials chaining fully, and we verify that the server
allows the password to be set to the same value twice in a
row (match win2k3) */
- torture_comment(tctx,
+ torture_comment(tctx,
"Testing a second ServerPasswordSet on machine account\n");
- torture_comment(tctx,
+ torture_comment(tctx,
"Changing machine account password to '%s' (same as previous run)\n", password);
netlogon_creds_client_authenticator(creds, &credential);
cli_credentials_set_password(machine_credentials, password, CRED_SPECIFIED);
- torture_assert(tctx,
- test_SetupCredentials(p, tctx, machine_credentials, &creds),
+ torture_assert(tctx,
+ test_SetupCredentials(p, tctx, machine_credentials, &creds),
"ServerPasswordSet failed to actually change the password");
return true;
/*
try a change password for our machine account
*/
-static bool test_SetPassword2(struct torture_context *tctx,
- struct dcerpc_pipe *p,
- struct cli_credentials *machine_credentials)
+static bool test_SetPassword2_with_flags(struct torture_context *tctx,
+ struct dcerpc_pipe *p,
+ struct cli_credentials *machine_credentials,
+ uint32_t flags)
{
struct netr_ServerPasswordSet2 r;
const char *password;
struct netr_CryptPassword new_password;
struct dcerpc_binding_handle *b = p->binding_handle;
- if (!test_SetupCredentials(p, tctx, machine_credentials, &creds)) {
+ if (!test_SetupCredentials2(p, tctx, flags, machine_credentials, cli_credentials_get_secure_channel_type(machine_credentials), &creds)) {
return false;
}
password = generate_random_password(tctx, 8, 255);
encode_pw_buffer(password_buf.data, password, STR_UNICODE);
- netlogon_creds_arcfour_crypt(creds, password_buf.data, 516);
+ if (creds->negotiate_flags & NETLOGON_NEG_SUPPORTS_AES) {
+ netlogon_creds_aes_encrypt(creds, password_buf.data, 516);
+ } else {
+ netlogon_creds_arcfour_crypt(creds, password_buf.data, 516);
+ }
memcpy(new_password.data, password_buf.data, 512);
new_password.length = IVAL(password_buf.data, 512);
cli_credentials_set_password(machine_credentials, password, CRED_SPECIFIED);
if (!torture_setting_bool(tctx, "dangerous", false)) {
- torture_comment(tctx,
+ torture_comment(tctx,
"Not testing ability to set password to '', enable dangerous tests to perform this test\n");
} else {
/* by changing the machine password to ""
*/
password = "";
encode_pw_buffer(password_buf.data, password, STR_UNICODE);
- netlogon_creds_arcfour_crypt(creds, password_buf.data, 516);
-
+ if (creds->negotiate_flags & NETLOGON_NEG_SUPPORTS_AES) {
+ netlogon_creds_aes_encrypt(creds, password_buf.data, 516);
+ } else {
+ netlogon_creds_arcfour_crypt(creds, password_buf.data, 516);
+ }
memcpy(new_password.data, password_buf.data, 512);
new_password.length = IVAL(password_buf.data, 512);
-
- torture_comment(tctx,
+
+ torture_comment(tctx,
"Testing ServerPasswordSet2 on machine account\n");
- torture_comment(tctx,
+ torture_comment(tctx,
"Changing machine account password to '%s'\n", password);
-
+
netlogon_creds_client_authenticator(creds, &credential);
-
+
torture_assert_ntstatus_ok(tctx, dcerpc_netr_ServerPasswordSet2_r(b, tctx, &r),
"ServerPasswordSet2 failed");
torture_assert_ntstatus_ok(tctx, r.out.result, "ServerPasswordSet2 failed");
-
+
if (!netlogon_creds_client_check(creds, &r.out.return_authenticator->cred)) {
torture_comment(tctx, "Credential chaining failed\n");
}
-
+
cli_credentials_set_password(machine_credentials, password, CRED_SPECIFIED);
}
- torture_assert(tctx, test_SetupCredentials(p, tctx, machine_credentials, &creds),
+ torture_assert(tctx, test_SetupCredentials(p, tctx, machine_credentials, &creds),
"ServerPasswordSet failed to actually change the password");
/* now try a random password */
password = generate_random_password(tctx, 8, 255);
encode_pw_buffer(password_buf.data, password, STR_UNICODE);
- netlogon_creds_arcfour_crypt(creds, password_buf.data, 516);
-
+ if (creds->negotiate_flags & NETLOGON_NEG_SUPPORTS_AES) {
+ netlogon_creds_aes_encrypt(creds, password_buf.data, 516);
+ } else {
+ netlogon_creds_arcfour_crypt(creds, password_buf.data, 516);
+ }
memcpy(new_password.data, password_buf.data, 512);
new_password.length = IVAL(password_buf.data, 512);
credentials chaining fully, and we verify that the server
allows the password to be set to the same value twice in a
row (match win2k3) */
- torture_comment(tctx,
+ torture_comment(tctx,
"Testing a second ServerPasswordSet2 on machine account\n");
- torture_comment(tctx,
+ torture_comment(tctx,
"Changing machine account password to '%s' (same as previous run)\n", password);
netlogon_creds_client_authenticator(creds, &credential);
cli_credentials_set_password(machine_credentials, password, CRED_SPECIFIED);
- torture_assert (tctx,
- test_SetupCredentials(p, tctx, machine_credentials, &creds),
+ torture_assert (tctx,
+ test_SetupCredentials(p, tctx, machine_credentials, &creds),
"ServerPasswordSet failed to actually change the password");
new_random_pass = netlogon_very_rand_pass(tctx, 128);
/* now try a random stream of bytes for a password */
set_pw_in_buffer(password_buf.data, &new_random_pass);
- netlogon_creds_arcfour_crypt(creds, password_buf.data, 516);
+ if (creds->negotiate_flags & NETLOGON_NEG_SUPPORTS_AES) {
+ netlogon_creds_aes_encrypt(creds, password_buf.data, 516);
+ } else {
+ netlogon_creds_arcfour_crypt(creds, password_buf.data, 516);
+ }
memcpy(new_password.data, password_buf.data, 512);
new_password.length = IVAL(password_buf.data, 512);
- torture_comment(tctx,
+ torture_comment(tctx,
"Testing a third ServerPasswordSet2 on machine account, with a completely random password\n");
netlogon_creds_client_authenticator(creds, &credential);
cli_credentials_set_password(machine_credentials, NULL, CRED_UNINITIALISED);
cli_credentials_set_nt_hash(machine_credentials, &nt_hash, CRED_SPECIFIED);
- torture_assert (tctx,
- test_SetupCredentials(p, tctx, machine_credentials, &creds),
+ torture_assert (tctx,
+ test_SetupCredentials(p, tctx, machine_credentials, &creds),
"ServerPasswordSet failed to actually change the password");
return true;
}
+static bool test_SetPassword2(struct torture_context *tctx,
+ struct dcerpc_pipe *p,
+ struct cli_credentials *machine_credentials)
+{
+ return test_SetPassword2_with_flags(tctx, p, machine_credentials, NETLOGON_NEG_AUTH2_ADS_FLAGS);
+}
+
+static bool test_SetPassword2_AES(struct torture_context *tctx,
+ struct dcerpc_pipe *p,
+ struct cli_credentials *machine_credentials)
+{
+ return test_SetPassword2_with_flags(tctx, p, machine_credentials, NETLOGON_NEG_AUTH2_ADS_FLAGS | NETLOGON_NEG_SUPPORTS_AES);
+}
+
static bool test_GetPassword(struct torture_context *tctx,
struct dcerpc_pipe *p,
struct cli_credentials *machine_credentials)
flags |= CLI_CRED_NTLMv2_AUTH;
}
- cli_credentials_get_ntlm_username_domain(cmdline_credentials, tctx,
+ cli_credentials_get_ntlm_username_domain(cmdline_credentials, tctx,
&ninfo.identity_info.account_name.string,
&ninfo.identity_info.domain_name.string);
ninfo.identity_info.domain_name.string = NULL;
}
- generate_random_buffer(ninfo.challenge,
+ generate_random_buffer(ninfo.challenge,
sizeof(ninfo.challenge));
- chal = data_blob_const(ninfo.challenge,
+ chal = data_blob_const(ninfo.challenge,
sizeof(ninfo.challenge));
- names_blob = NTLMv2_generate_names_blob(tctx, cli_credentials_get_workstation(credentials),
+ names_blob = NTLMv2_generate_names_blob(tctx, cli_credentials_get_workstation(credentials),
cli_credentials_get_domain(credentials));
- status = cli_credentials_get_ntlm_response(cmdline_credentials, tctx,
- &flags,
+ status = cli_credentials_get_ntlm_response(cmdline_credentials, tctx,
+ &flags,
chal,
names_blob,
&lm_resp, &nt_resp,
r.in.computer_name = cli_credentials_get_workstation(credentials);
r.in.credential = &auth;
r.in.return_authenticator = &auth2;
- r.in.logon_level = 2;
+ r.in.logon_level = NetlogonNetworkInformation;
r.in.logon = &logon;
r.out.validation = &validation;
r.out.authoritative = &authoritative;
d_printf("Testing LogonSamLogon with name %s\n", ninfo.identity_info.account_name.string);
-
+
for (i=2;i<=3;i++) {
ZERO_STRUCT(auth2);
netlogon_creds_client_authenticator(creds, &auth);
-
+
r.in.validation_level = i;
-
+
torture_assert_ntstatus_ok(tctx, dcerpc_netr_LogonSamLogon_r(b, tctx, &r),
"LogonSamLogon failed");
torture_assert_ntstatus_ok(tctx, r.out.result, "LogonSamLogon failed");
-
- torture_assert(tctx, netlogon_creds_client_check(creds,
- &r.out.return_authenticator->cred),
+
+ torture_assert(tctx, netlogon_creds_client_check(creds,
+ &r.out.return_authenticator->cred),
"Credential chaining failed");
torture_assert_int_equal(tctx, *r.out.authoritative, 1,
"LogonSamLogon invalid *r.out.authoritative");
"LogonSamLogon invalid *r.out.authoritative");
}
- r.in.logon_level = 2;
+ r.in.logon_level = NetlogonNetworkInformation;
r.in.credential = &auth;
for (i=2;i<=3;i++) {
return test_netlogon_ops_args(p, tctx, credentials, creds, false);
}
+/*
+ try a netlogon GetCapabilities
+*/
+bool test_netlogon_capabilities(struct dcerpc_pipe *p, struct torture_context *tctx,
+ struct cli_credentials *credentials,
+ struct netlogon_creds_CredentialState *creds)
+{
+ NTSTATUS status;
+ struct netr_LogonGetCapabilities r;
+ union netr_Capabilities capabilities;
+ struct netr_Authenticator auth, return_auth;
+ struct netlogon_creds_CredentialState tmp_creds;
+ struct dcerpc_binding_handle *b = p->binding_handle;
+
+ r.in.server_name = talloc_asprintf(tctx, "\\\\%s", dcerpc_server_name(p));
+ r.in.computer_name = cli_credentials_get_workstation(credentials);
+ r.in.credential = &auth;
+ r.in.return_authenticator = &return_auth;
+ r.in.query_level = 1;
+ r.out.capabilities = &capabilities;
+ r.out.return_authenticator = &return_auth;
+
+ torture_comment(tctx, "Testing LogonGetCapabilities\n");
+
+ ZERO_STRUCT(return_auth);
+
+ /*
+ * we need to operate on a temporary copy of creds
+ * because dcerpc_netr_LogonGetCapabilities was
+ * dcerpc_netr_DummyFunction and returns NT_STATUS_NOT_IMPLEMENTED
+ * without looking a the authenticator.
+ */
+ tmp_creds = *creds;
+ netlogon_creds_client_authenticator(&tmp_creds, &auth);
+
+ status = dcerpc_netr_LogonGetCapabilities_r(b, tctx, &r);
+ torture_assert_ntstatus_ok(tctx, status, "LogonGetCapabilities failed");
+ if (NT_STATUS_EQUAL(r.out.result, NT_STATUS_NOT_IMPLEMENTED)) {
+ return true;
+ }
+
+ *creds = tmp_creds;
+
+ torture_assert(tctx, netlogon_creds_client_check(creds,
+ &r.out.return_authenticator->cred),
+ "Credential chaining failed");
+
+ torture_assert_int_equal(tctx, creds->negotiate_flags,
+ capabilities.server_capabilities,
+ "negotiate flags");
+
+ return true;
+}
+
/*
try a netlogon SamLogon
*/
-static bool test_SamLogon(struct torture_context *tctx,
+static bool test_SamLogon(struct torture_context *tctx,
struct dcerpc_pipe *p,
struct cli_credentials *credentials)
{
/*
try a netlogon DatabaseSync
*/
-static bool test_DatabaseSync(struct torture_context *tctx,
+static bool test_DatabaseSync(struct torture_context *tctx,
struct dcerpc_pipe *p,
struct cli_credentials *machine_credentials)
{
struct netr_DatabaseSync r;
struct netlogon_creds_CredentialState *creds;
- const uint32_t database_ids[] = {SAM_DATABASE_DOMAIN, SAM_DATABASE_BUILTIN, SAM_DATABASE_PRIVS};
+ const uint32_t database_ids[] = {SAM_DATABASE_DOMAIN, SAM_DATABASE_BUILTIN, SAM_DATABASE_PRIVS};
int i;
struct netr_DELTA_ENUM_ARRAY *delta_enum_array = NULL;
struct netr_Authenticator credential, return_authenticator;
delta_enum_array->num_deltas > 0 &&
delta_enum_array->delta_enum[0].delta_type == NETR_DELTA_DOMAIN &&
delta_enum_array->delta_enum[0].delta_union.domain) {
- sequence_nums[r.in.database_id] =
+ sequence_nums[r.in.database_id] =
delta_enum_array->delta_enum[0].delta_union.domain->sequence_num;
torture_comment(tctx, "\tsequence_nums[%d]=%llu\n",
- r.in.database_id,
+ r.in.database_id,
(unsigned long long)sequence_nums[r.in.database_id]);
}
} while (NT_STATUS_EQUAL(r.out.result, STATUS_MORE_ENTRIES));
/*
try a netlogon DatabaseDeltas
*/
-static bool test_DatabaseDeltas(struct torture_context *tctx,
+static bool test_DatabaseDeltas(struct torture_context *tctx,
struct dcerpc_pipe *p,
struct cli_credentials *machine_credentials)
{
struct netr_Authenticator credential;
struct netr_Authenticator return_authenticator;
struct netr_DELTA_ENUM_ARRAY *delta_enum_array = NULL;
- const uint32_t database_ids[] = {0, 1, 2};
+ const uint32_t database_ids[] = {0, 1, 2};
int i;
struct dcerpc_binding_handle *b = p->binding_handle;
*r.in.sequence_num -= 1;
- torture_comment(tctx, "Testing DatabaseDeltas of id %d at %llu\n",
+ torture_comment(tctx, "Testing DatabaseDeltas of id %d at %llu\n",
r.in.database_id, (unsigned long long)*r.in.sequence_num);
do {
/*
try a netlogon AccountDeltas
*/
-static bool test_AccountDeltas(struct torture_context *tctx,
+static bool test_AccountDeltas(struct torture_context *tctx,
struct dcerpc_pipe *p,
struct cli_credentials *machine_credentials)
{
/*
try a netlogon AccountSync
*/
-static bool test_AccountSync(struct torture_context *tctx, struct dcerpc_pipe *p,
+static bool test_AccountSync(struct torture_context *tctx, struct dcerpc_pipe *p,
struct cli_credentials *machine_credentials)
{
struct netr_AccountSync r;
/*
try a netlogon GetDcName
*/
-static bool test_GetDcName(struct torture_context *tctx,
+static bool test_GetDcName(struct torture_context *tctx,
struct dcerpc_pipe *p)
{
struct netr_GetDcName r;
/*
- try a netlogon LogonControl
+ try a netlogon LogonControl
*/
-static bool test_LogonControl(struct torture_context *tctx,
+static bool test_LogonControl(struct torture_context *tctx,
struct dcerpc_pipe *p,
struct cli_credentials *machine_credentials)
/*
try a netlogon GetAnyDCName
*/
-static bool test_GetAnyDCName(struct torture_context *tctx,
+static bool test_GetAnyDCName(struct torture_context *tctx,
struct dcerpc_pipe *p)
{
NTSTATUS status;
/*
try a netlogon LogonControl2
*/
-static bool test_LogonControl2(struct torture_context *tctx,
+static bool test_LogonControl2(struct torture_context *tctx,
struct dcerpc_pipe *p,
struct cli_credentials *machine_credentials)
/*
try a netlogon DatabaseSync2
*/
-static bool test_DatabaseSync2(struct torture_context *tctx,
+static bool test_DatabaseSync2(struct torture_context *tctx,
struct dcerpc_pipe *p,
struct cli_credentials *machine_credentials)
{
struct netr_Authenticator return_authenticator, credential;
struct netlogon_creds_CredentialState *creds;
- const uint32_t database_ids[] = {0, 1, 2};
+ const uint32_t database_ids[] = {0, 1, 2};
int i;
struct dcerpc_binding_handle *b = p->binding_handle;
- if (!test_SetupCredentials2(p, tctx, NETLOGON_NEG_AUTH2_FLAGS,
+ if (!test_SetupCredentials2(p, tctx, NETLOGON_NEG_AUTH2_FLAGS,
machine_credentials,
cli_credentials_get_secure_channel_type(machine_credentials),
&creds)) {
/*
try a netlogon LogonControl2Ex
*/
-static bool test_LogonControl2Ex(struct torture_context *tctx,
+static bool test_LogonControl2Ex(struct torture_context *tctx,
struct dcerpc_pipe *p,
struct cli_credentials *machine_credentials)
for (i=1;i<4;i++) {
r.in.level = i;
- torture_comment(tctx, "Testing LogonControl2Ex level %d function %d\n",
+ torture_comment(tctx, "Testing LogonControl2Ex level %d function %d\n",
i, r.in.function_code);
status = dcerpc_netr_LogonControl2Ex_r(b, tctx, &r);
for (i=1;i<4;i++) {
r.in.level = i;
- torture_comment(tctx, "Testing LogonControl2Ex level %d function %d\n",
+ torture_comment(tctx, "Testing LogonControl2Ex level %d function %d\n",
i, r.in.function_code);
status = dcerpc_netr_LogonControl2Ex_r(b, tctx, &r);
for (i=1;i<4;i++) {
r.in.level = i;
- torture_comment(tctx, "Testing LogonControl2Ex level %d function %d\n",
+ torture_comment(tctx, "Testing LogonControl2Ex level %d function %d\n",
i, r.in.function_code);
status = dcerpc_netr_LogonControl2Ex_r(b, tctx, &r);
for (i=1;i<4;i++) {
r.in.level = i;
- torture_comment(tctx, "Testing LogonControl2Ex level %d function %d\n",
+ torture_comment(tctx, "Testing LogonControl2Ex level %d function %d\n",
i, r.in.function_code);
status = dcerpc_netr_LogonControl2Ex_r(b, tctx, &r);
return true;
}
-static bool test_netr_DsRGetForestTrustInformation(struct torture_context *tctx,
- struct dcerpc_pipe *p, const char *trusted_domain_name)
+static bool test_netr_DsRGetForestTrustInformation(struct torture_context *tctx,
+ struct dcerpc_pipe *p, const char *trusted_domain_name)
{
NTSTATUS status;
struct netr_DsRGetForestTrustInformation r;
/*
try a netlogon netr_DsrEnumerateDomainTrusts
*/
-static bool test_DsrEnumerateDomainTrusts(struct torture_context *tctx,
+static bool test_DsrEnumerateDomainTrusts(struct torture_context *tctx,
struct dcerpc_pipe *p)
{
NTSTATUS status;
/* get info for transitive forest trusts */
if (r.out.trusts->array[i].trust_attributes & NETR_TRUST_ATTRIBUTE_FOREST_TRANSITIVE) {
- if (!test_netr_DsRGetForestTrustInformation(tctx, p,
+ if (!test_netr_DsRGetForestTrustInformation(tctx, p,
r.out.trusts->array[i].dns_name)) {
return false;
}
static bool test_netr_DsRGetSiteName(struct dcerpc_pipe *p, struct torture_context *tctx,
- const char *computer_name,
- const char *expected_site)
+ const char *computer_name,
+ const char *expected_site)
{
NTSTATUS status;
struct netr_DsRGetSiteName r;
torture_assert_werr_ok(tctx, r.out.result, "DsRGetSiteName");
torture_assert_str_equal(tctx, expected_site, site, "netr_DsRGetSiteName");
- if (torture_setting_bool(tctx, "samba4", false))
- torture_skip(tctx, "skipping computer name check against Samba4");
-
- r.in.computer_name = talloc_asprintf(tctx, "\\\\%s", computer_name);
- torture_comment(tctx,
- "Testing netr_DsRGetSiteName with broken computer name: %s\n", r.in.computer_name);
-
- status = dcerpc_netr_DsRGetSiteName_r(b, tctx, &r);
- torture_assert_ntstatus_ok(tctx, status, "DsRGetSiteName");
- torture_assert_werr_equal(tctx, r.out.result, WERR_INVALID_COMPUTERNAME, "netr_DsRGetSiteName");
-
return true;
}
/*
try a netlogon netr_DsRGetDCName
*/
-static bool test_netr_DsRGetDCName(struct torture_context *tctx,
+static bool test_netr_DsRGetDCName(struct torture_context *tctx,
struct dcerpc_pipe *p)
{
NTSTATUS status;
torture_assert_ntstatus_ok(tctx, status, "DsRGetDCName");
torture_assert_werr_ok(tctx, r.out.result, "DsRGetDCName");
+ torture_assert_int_equal(tctx,
+ (info->dc_flags & (DS_DNS_CONTROLLER)),
+ DS_DNS_CONTROLLER,
+ "DsRGetDCName");
+ torture_assert_int_equal(tctx,
+ (info->dc_flags & (DS_DNS_DOMAIN)),
+ DS_DNS_DOMAIN,
+ "DsRGetDCName");
+ torture_assert_int_equal(tctx,
+ (info->dc_flags & (DS_DNS_FOREST_ROOT)),
+ DS_DNS_FOREST_ROOT,
+ "DsRGetDCName");
+
r.in.domain_name = lpcfg_workgroup(tctx->lp_ctx);
+ r.in.flags = 0;
status = dcerpc_netr_DsRGetDCName_r(b, tctx, &r);
torture_assert_ntstatus_ok(tctx, status, "DsRGetDCName");
torture_assert_werr_ok(tctx, r.out.result, "DsRGetDCName");
- return test_netr_DsRGetSiteName(p, tctx,
+ torture_assert_int_equal(tctx,
+ (info->dc_flags & (DS_DNS_CONTROLLER)), 0,
+ "DsRGetDCName");
+ torture_assert_int_equal(tctx,
+ (info->dc_flags & (DS_DNS_DOMAIN)), 0,
+ "DsRGetDCName");
+ torture_assert_int_equal(tctx,
+ (info->dc_flags & (DS_DNS_FOREST_ROOT)),
+ DS_DNS_FOREST_ROOT,
+ "DsRGetDCName");
+
+ if (strcasecmp(info->dc_site_name, info->client_site_name) == 0) {
+ torture_assert_int_equal(tctx,
+ (info->dc_flags & (DS_SERVER_CLOSEST)),
+ DS_SERVER_CLOSEST,
+ "DsRGetDCName");
+ }
+
+ return test_netr_DsRGetSiteName(p, tctx,
info->dc_unc,
info->dc_site_name);
}
/*
try a netlogon netr_DsRGetDCNameEx
*/
-static bool test_netr_DsRGetDCNameEx(struct torture_context *tctx,
+static bool test_netr_DsRGetDCNameEx(struct torture_context *tctx,
struct dcerpc_pipe *p)
{
NTSTATUS status;
torture_assert_ntstatus_ok(tctx, status, "netr_DsRGetDCNameEx");
torture_assert_werr_ok(tctx, r.out.result, "netr_DsRGetDCNameEx");
+ torture_assert_int_equal(tctx,
+ (info->dc_flags & (DS_DNS_CONTROLLER)),
+ DS_DNS_CONTROLLER,
+ "DsRGetDCNameEx");
+ torture_assert_int_equal(tctx,
+ (info->dc_flags & (DS_DNS_DOMAIN)),
+ DS_DNS_DOMAIN,
+ "DsRGetDCNameEx");
+ torture_assert_int_equal(tctx,
+ (info->dc_flags & (DS_DNS_FOREST_ROOT)),
+ DS_DNS_FOREST_ROOT,
+ "DsRGetDCNameEx");
+
r.in.domain_name = lpcfg_workgroup(tctx->lp_ctx);
+ r.in.flags = 0;
status = dcerpc_netr_DsRGetDCNameEx_r(b, tctx, &r);
torture_assert_ntstatus_ok(tctx, status, "netr_DsRGetDCNameEx");
torture_assert_werr_ok(tctx, r.out.result, "netr_DsRGetDCNameEx");
+ torture_assert_int_equal(tctx,
+ (info->dc_flags & (DS_DNS_CONTROLLER)), 0,
+ "DsRGetDCNameEx");
+ torture_assert_int_equal(tctx,
+ (info->dc_flags & (DS_DNS_DOMAIN)), 0,
+ "DsRGetDCNameEx");
+ torture_assert_int_equal(tctx,
+ (info->dc_flags & (DS_DNS_FOREST_ROOT)),
+ DS_DNS_FOREST_ROOT,
+ "DsRGetDCNameEx");
+
+ if (strcasecmp(info->dc_site_name, info->client_site_name) == 0) {
+ torture_assert_int_equal(tctx,
+ (info->dc_flags & (DS_SERVER_CLOSEST)),
+ DS_SERVER_CLOSEST,
+ "DsRGetDCNameEx");
+ }
+
return test_netr_DsRGetSiteName(p, tctx, info->dc_unc,
info->dc_site_name);
}
/*
try a netlogon netr_DsRGetDCNameEx2
*/
-static bool test_netr_DsRGetDCNameEx2(struct torture_context *tctx,
+static bool test_netr_DsRGetDCNameEx2(struct torture_context *tctx,
struct dcerpc_pipe *p)
{
NTSTATUS status;
torture_assert_ntstatus_ok(tctx, status, "netr_DsRGetDCNameEx2");
torture_assert_werr_ok(tctx, r.out.result, "netr_DsRGetDCNameEx2");
+ torture_assert_int_equal(tctx,
+ (info->dc_flags & (DS_DNS_CONTROLLER)),
+ DS_DNS_CONTROLLER,
+ "DsRGetDCNameEx2");
+ torture_assert_int_equal(tctx,
+ (info->dc_flags & (DS_DNS_DOMAIN)),
+ DS_DNS_DOMAIN,
+ "DsRGetDCNameEx2");
+ torture_assert_int_equal(tctx,
+ (info->dc_flags & (DS_DNS_FOREST_ROOT)),
+ DS_DNS_FOREST_ROOT,
+ "DsRGetDCNameEx2");
+
r.in.server_unc = talloc_asprintf(tctx, "\\\\%s", dcerpc_server_name(p));
r.in.client_account = NULL;
r.in.mask = 0x00000000;
torture_assert_werr_ok(tctx, r.out.result, "netr_DsRGetDCNameEx2");
r.in.domain_name = lpcfg_workgroup(tctx->lp_ctx);
+ r.in.flags = 0;
status = dcerpc_netr_DsRGetDCNameEx2_r(b, tctx, &r);
torture_assert_ntstatus_ok(tctx, status, "netr_DsRGetDCNameEx2");
torture_assert_werr_ok(tctx, r.out.result, "netr_DsRGetDCNameEx2");
+ torture_assert_int_equal(tctx,
+ (info->dc_flags & (DS_DNS_CONTROLLER)), 0,
+ "DsRGetDCNameEx2");
+ torture_assert_int_equal(tctx,
+ (info->dc_flags & (DS_DNS_DOMAIN)), 0,
+ "DsRGetDCNameEx2");
+ torture_assert_int_equal(tctx,
+ (info->dc_flags & (DS_DNS_FOREST_ROOT)),
+ DS_DNS_FOREST_ROOT,
+ "DsRGetDCNameEx2");
+
+ if (strcasecmp(info->dc_site_name, info->client_site_name) == 0) {
+ torture_assert_int_equal(tctx,
+ (info->dc_flags & (DS_SERVER_CLOSEST)),
+ DS_SERVER_CLOSEST,
+ "DsRGetDCNameEx2");
+ }
+
torture_comment(tctx, "Testing netr_DsRGetDCNameEx2 with client account\n");
r.in.client_account = TEST_MACHINE_NAME"$";
r.in.mask = ACB_SVRTRUST;
return NULL;
}
-static bool test_netr_DsrGetDcSiteCoverageW(struct torture_context *tctx,
+static bool test_netr_DsrGetDcSiteCoverageW(struct torture_context *tctx,
struct dcerpc_pipe *p)
{
char *url;
return true;
}
-static bool test_netr_ServerGetTrustInfo(struct torture_context *tctx,
- struct dcerpc_pipe *p,
- struct cli_credentials *machine_credentials)
+static bool test_netr_ServerGetTrustInfo_flags(struct torture_context *tctx,
+ struct dcerpc_pipe *p,
+ struct cli_credentials *machine_credentials,
+ uint32_t negotiate_flags)
{
struct netr_ServerGetTrustInfo r;
struct netlogon_creds_CredentialState *creds;
struct dcerpc_binding_handle *b = p->binding_handle;
- if (!test_SetupCredentials3(p, tctx, NETLOGON_NEG_AUTH2_ADS_FLAGS,
+ struct samr_Password nt_hash;
+
+ if (!test_SetupCredentials3(p, tctx, negotiate_flags,
machine_credentials, &creds)) {
return false;
}
torture_assert_ntstatus_ok(tctx, r.out.result, "ServerGetTrustInfo failed");
torture_assert(tctx, netlogon_creds_client_check(creds, &return_authenticator.cred), "Credential chaining failed");
+ E_md4hash(cli_credentials_get_password(machine_credentials), nt_hash.hash);
+
+ netlogon_creds_des_decrypt(creds, &new_owf_password);
+
+ dump_data(1, new_owf_password.hash, 16);
+ dump_data(1, nt_hash.hash, 16);
+
+ torture_assert_mem_equal(tctx, new_owf_password.hash, nt_hash.hash, 16,
+ "received unexpected owf password\n");
+
return true;
}
+static bool test_netr_ServerGetTrustInfo(struct torture_context *tctx,
+ struct dcerpc_pipe *p,
+ struct cli_credentials *machine_credentials)
+{
+ return test_netr_ServerGetTrustInfo_flags(tctx, p, machine_credentials,
+ NETLOGON_NEG_AUTH2_ADS_FLAGS);
+}
+
+static bool test_netr_ServerGetTrustInfo_AES(struct torture_context *tctx,
+ struct dcerpc_pipe *p,
+ struct cli_credentials *machine_credentials)
+{
+ return test_netr_ServerGetTrustInfo_flags(tctx, p, machine_credentials,
+ NETLOGON_NEG_AUTH2_ADS_FLAGS | NETLOGON_NEG_SUPPORTS_AES);
+}
-static bool test_GetDomainInfo(struct torture_context *tctx,
+static bool test_GetDomainInfo(struct torture_context *tctx,
struct dcerpc_pipe *p,
struct cli_credentials *machine_credentials)
{
torture_comment(tctx, "Testing netr_LogonGetDomainInfo\n");
- if (!test_SetupCredentials3(p, tctx, NETLOGON_NEG_AUTH2_ADS_FLAGS,
+ if (!test_SetupCredentials3(p, tctx, NETLOGON_NEG_AUTH2_ADS_FLAGS,
machine_credentials, &creds)) {
return false;
}
"(sAMAccountName=%s$)", TEST_MACHINE_NAME);
old_dnsname =
ldb_msg_find_attr_as_string(res[0], "dNSHostName", NULL);
-
+
/* Gets back the "servicePrincipalName"s in AD */
spn_el = ldb_msg_find_element(res[0], "servicePrincipalName");
if (spn_el != NULL) {
the same in combination with the "servicePrincipalName"s.
The DNS hostname should also be returned by our
"LogonGetDomainInfo" call (in the domain info structure). */
-
+
torture_assert_str_equal(tctx,
ldb_msg_find_attr_as_string(res[0], "dNSHostName", NULL),
old_dnsname, "'DNS hostname' was not set!");
-
+
spn_el = ldb_msg_find_element(res[0], "servicePrincipalName");
torture_assert(tctx, ((spns != NULL) && (spn_el != NULL)),
"'servicePrincipalName's not set!");
the "servicePrincipalName"s should remain empty and no DNS
hostname should be returned by our "LogonGetDomainInfo"
call (in the domain info structure). */
-
+
torture_assert(tctx,
ldb_msg_find_attr_as_string(res[0], "dNSHostName", NULL) == NULL,
"'DNS hostname' was set!");
-
+
spn_el = ldb_msg_find_element(res[0], "servicePrincipalName");
torture_assert(tctx, ((spns == NULL) && (spn_el == NULL)),
"'servicePrincipalName's were set!");
-
+
torture_assert(tctx,
info.domain_info->dns_hostname.string == NULL,
"Out 'DNS host name' was set!");
torture_assert_str_equal(tctx,
ldb_msg_find_attr_as_string(res[0], "dNSHostName", NULL),
old_dnsname, "'DNS host name' did change!");
-
+
/* Find the two "servicePrincipalName"s which the DC shouldn't have been
updated (HOST/<Netbios name> and HOST/<FQDN name>) - see MS-NRPC
3.5.4.3.9 */
break;
torture_assert(tctx, i != spn_el->num_values,
"'servicePrincipalName' HOST/<FQDN name> not found!");
-
+
/* Check that the out DNS hostname was set properly */
torture_assert_str_equal(tctx, info.domain_info->dns_hostname.string,
old_dnsname, "Out 'DNS hostname' doesn't match the old one!");
return true;
}
-static bool test_GetDomainInfo_async(struct torture_context *tctx,
+static bool test_GetDomainInfo_async(struct torture_context *tctx,
struct dcerpc_pipe *p,
struct cli_credentials *machine_credentials)
{
torture_comment(tctx, "Testing netr_LogonGetDomainInfo - async count %d\n", ASYNC_COUNT);
- if (!test_SetupCredentials3(p, tctx, NETLOGON_NEG_AUTH2_ADS_FLAGS,
+ if (!test_SetupCredentials3(p, tctx, NETLOGON_NEG_AUTH2_ADS_FLAGS,
machine_credentials, &creds)) {
return false;
}
creds_async[i] = (struct netlogon_creds_CredentialState *)talloc_memdup(creds, creds, sizeof(*creds));
req[i] = dcerpc_netr_LogonGetDomainInfo_r_send(tctx, tctx->ev, p->binding_handle, &r);
- /* even with this flush per request a w2k3 server seems to
+ /* even with this flush per request a w2k3 server seems to
clag with multiple outstanding requests. bleergh. */
- torture_assert_int_equal(tctx, event_loop_once(dcerpc_event_context(p)), 0,
- "event_loop_once failed");
+ torture_assert_int_equal(tctx, tevent_loop_once(dcerpc_event_context(p)), 0,
+ "tevent_loop_once failed");
}
for (i=0;i<ASYNC_COUNT;i++) {
status = dcerpc_netr_LogonGetDomainInfo_r_recv(req[i], tctx);
torture_assert_ntstatus_ok(tctx, status, "netr_LogonGetDomainInfo_async");
- torture_assert_ntstatus_ok(tctx, r.out.result, "netr_LogonGetDomainInfo_async");
+ torture_assert_ntstatus_ok(tctx, r.out.result, "netr_LogonGetDomainInfo_async");
- torture_assert(tctx, netlogon_creds_client_check(creds_async[i], &a.cred),
+ torture_assert(tctx, netlogon_creds_client_check(creds_async[i], &a.cred),
"Credential chaining failed at async");
}
- torture_comment(tctx,
+ torture_comment(tctx,
"Testing netr_LogonGetDomainInfo - async count %d OK\n", ASYNC_COUNT);
return true;
}
-static bool test_ManyGetDCName(struct torture_context *tctx,
+static bool test_ManyGetDCName(struct torture_context *tctx,
struct dcerpc_pipe *p)
{
NTSTATUS status;
tcase = torture_suite_add_machine_bdc_rpc_iface_tcase(suite, "netlogon",
&ndr_table_netlogon, TEST_MACHINE_NAME);
+ torture_rpc_tcase_add_test(tcase, "Broken RPC binding handle",
+ test_netr_broken_binding_handle);
+
torture_rpc_tcase_add_test(tcase, "LogonUasLogon", test_LogonUasLogon);
torture_rpc_tcase_add_test(tcase, "LogonUasLogoff", test_LogonUasLogoff);
torture_rpc_tcase_add_test_creds(tcase, "SamLogon", test_SamLogon);
torture_rpc_tcase_add_test_creds(tcase, "SetPassword", test_SetPassword);
torture_rpc_tcase_add_test_creds(tcase, "SetPassword2", test_SetPassword2);
+ torture_rpc_tcase_add_test_creds(tcase, "SetPassword2_AES", test_SetPassword2_AES);
torture_rpc_tcase_add_test_creds(tcase, "GetPassword", test_GetPassword);
torture_rpc_tcase_add_test_creds(tcase, "GetTrustPasswords", test_GetTrustPasswords);
torture_rpc_tcase_add_test_creds(tcase, "GetDomainInfo", test_GetDomainInfo);
torture_rpc_tcase_add_test(tcase, "DsRAddressToSitenamesW", test_netr_DsRAddressToSitenamesW);
torture_rpc_tcase_add_test(tcase, "DsRAddressToSitenamesExW", test_netr_DsRAddressToSitenamesExW);
torture_rpc_tcase_add_test_creds(tcase, "ServerGetTrustInfo", test_netr_ServerGetTrustInfo);
+ torture_rpc_tcase_add_test_creds(tcase, "ServerGetTrustInfo_AES", test_netr_ServerGetTrustInfo_AES);
torture_rpc_tcase_add_test_creds(tcase, "GetForestTrustInformation", test_netr_GetForestTrustInformation);
return suite;
torture_rpc_tcase_add_test_creds(tcase, "SetPassword", test_SetPassword);
torture_rpc_tcase_add_test_creds(tcase, "SetPassword_with_flags", test_SetPassword_with_flags);
torture_rpc_tcase_add_test_creds(tcase, "SetPassword2", test_SetPassword2);
+ torture_rpc_tcase_add_test_creds(tcase, "SetPassword2_AES", test_SetPassword2_AES);
torture_rpc_tcase_add_test(tcase, "NetrEnumerateTrustedDomains", test_netr_NetrEnumerateTrustedDomains);
return suite;
git.samba.org / abartlet / samba-debian.git / blobdiff