source4/torture/rpc/samsync.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3
   4    test suite for netlogon rpc operations
   5
   6    Copyright (C) Andrew Tridgell 2003
   7    Copyright (C) Andrew Bartlett <abartlet@samba.org> 2003-2004
   8    Copyright (C) Tim Potter      2003
   9
  10    This program is free software; you can redistribute it and/or modify
  11    it under the terms of the GNU General Public License as published by
  12    the Free Software Foundation; either version 2 of the License, or
  13    (at your option) any later version.
  14
  15    This program is distributed in the hope that it will be useful,
  16    but WITHOUT ANY WARRANTY; without even the implied warranty of
  17    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  18    GNU General Public License for more details.
  19
  20    You should have received a copy of the GNU General Public License
  21    along with this program; if not, write to the Free Software
  22    Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  23 */
  24
  25 #include "includes.h"
  26 #include "librpc/gen_ndr/ndr_netlogon.h"
  27 #include "auth/auth.h"
  28 #include "dlinklist.h"
  29 #include "lib/crypto/crypto.h"
  30 #include "system/time.h"
  31
  32 #define TEST_MACHINE_NAME "samsynctest"
  33 #define TEST_MACHINE_NAME2 "samsynctest2"
  34
  35 /*
  36   try a netlogon SamLogon
  37 */
  38 static NTSTATUS test_SamLogon(struct dcerpc_pipe *p, TALLOC_CTX *mem_ctx,
  39                               struct creds_CredentialState *creds,
  40                               const char *domain, const char *account_name,
  41                               const char *workstation,
  42                               struct samr_Password *lm_hash,
  43                               struct samr_Password *nt_hash,
  44                               struct netr_SamInfo3 **info3)
  45 {
  46         NTSTATUS status;
  47         struct netr_LogonSamLogon r;
  48         struct netr_Authenticator auth, auth2;
  49         struct netr_NetworkInfo ninfo;
  50
  51         ninfo.identity_info.domain_name.string = domain;
  52         ninfo.identity_info.parameter_control = 0;
  53         ninfo.identity_info.logon_id_low = 0;
  54         ninfo.identity_info.logon_id_high = 0;
  55         ninfo.identity_info.account_name.string = account_name;
  56         ninfo.identity_info.workstation.string = workstation;
  57         generate_random_buffer(ninfo.challenge,
  58                                sizeof(ninfo.challenge));
  59         if (nt_hash) {
  60                 ninfo.nt.length = 24;
  61                 ninfo.nt.data = talloc(mem_ctx, 24);
  62                 SMBOWFencrypt(nt_hash->hash, ninfo.challenge, ninfo.nt.data);
  63         } else {
  64                 ninfo.nt.length = 0;
  65                 ninfo.nt.data = NULL;
  66         }
  67
  68         if (lm_hash) {
  69                 ninfo.lm.length = 24;
  70                 ninfo.lm.data = talloc(mem_ctx, 24);
  71                 SMBOWFencrypt(lm_hash->hash, ninfo.challenge, ninfo.lm.data);
  72         } else {
  73                 ninfo.lm.length = 0;
  74                 ninfo.lm.data = NULL;
  75         }
  76
  77         r.in.server_name = talloc_asprintf(mem_ctx, "\\\\%s", dcerpc_server_name(p));
  78         r.in.workstation = workstation;
  79         r.in.credential = &auth;
  80         r.in.return_authenticator = &auth2;
  81         r.in.logon_level = 2;
  82         r.in.logon.network = &ninfo;
  83
  84         ZERO_STRUCT(auth2);
  85         creds_client_authenticator(creds, &auth);
  86
  87         r.in.validation_level = 3;
  88
  89         status = dcerpc_netr_LogonSamLogon(p, mem_ctx, &r);
  90
  91         if (!creds_client_check(creds, &r.out.return_authenticator->cred)) {
  92                 printf("Credential chaining failed\n");
  93         }
  94
  95         if (info3) {
  96                 *info3 = r.out.validation.sam3;
  97         }
  98
  99         return status;
 100 }
 101
 102 struct samsync_state {
 103 /* we remember the sequence numbers so we can easily do a DatabaseDelta */
 104         uint64_t seq_num[3];
 105         char *domain_name[2];
 106         struct samsync_secret *secrets;
 107         struct samsync_trusted_domain *trusted_domains;
 108         struct creds_CredentialState *creds;
 109         struct creds_CredentialState *creds_netlogon_wksta;
 110         struct policy_handle *connect_handle;
 111         struct policy_handle *domain_handle[2];
 112         struct dom_sid *sid[2];
 113         struct dcerpc_pipe *p;
 114         struct dcerpc_pipe *p_netlogon_wksta;
 115         struct dcerpc_pipe *p_samr;
 116         struct dcerpc_pipe *p_lsa;
 117         struct policy_handle *lsa_handle;
 118 };
 119
 120 struct samsync_secret {
 121         struct samsync_secret *prev, *next;
 122         DATA_BLOB secret;
 123         char *name;
 124 };
 125
 126 struct samsync_trusted_domain {
 127         struct samsync_trusted_domain *prev, *next;
 128         struct dom_sid *sid;
 129         char *name;
 130 };
 131
 132 static struct policy_handle *samsync_open_domain(TALLOC_CTX *mem_ctx,
 133                                                  struct samsync_state *samsync_state,
 134                                                  const char *domain,
 135                                                  struct dom_sid **sid)
 136 {
 137         struct samr_String name;
 138         struct samr_OpenDomain o;
 139         struct samr_LookupDomain l;
 140         struct policy_handle *domain_handle = talloc_p(mem_ctx, struct policy_handle);
 141         NTSTATUS nt_status;
 142
 143         name.string = domain;
 144         l.in.connect_handle = samsync_state->connect_handle;
 145         l.in.domain = &name;
 146
 147         nt_status = dcerpc_samr_LookupDomain(samsync_state->p_samr, mem_ctx, &l);
 148         if (!NT_STATUS_IS_OK(nt_status)) {
 149                 printf("LookupDomain failed - %s\n", nt_errstr(nt_status));
 150                 return NULL;
 151         }
 152
 153         o.in.connect_handle = samsync_state->connect_handle;
 154         o.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
 155         o.in.sid = l.out.sid;
 156         o.out.domain_handle = domain_handle;
 157
 158         if (sid) {
 159                 *sid = l.out.sid;
 160         }
 161
 162         nt_status = dcerpc_samr_OpenDomain(samsync_state->p_samr, mem_ctx, &o);
 163         if (!NT_STATUS_IS_OK(nt_status)) {
 164                 printf("OpenDomain failed - %s\n", nt_errstr(nt_status));
 165                 return NULL;
 166         }
 167
 168         return domain_handle;
 169 }
 170
 171 static struct sec_desc_buf *samsync_query_samr_sec_desc(TALLOC_CTX *mem_ctx,
 172                                                         struct samsync_state *samsync_state,
 173                                                         struct policy_handle *handle)
 174 {
 175         struct samr_QuerySecurity r;
 176         NTSTATUS status;
 177
 178         r.in.handle = handle;
 179         r.in.sec_info = 0x7;
 180
 181         status = dcerpc_samr_QuerySecurity(samsync_state->p_samr, mem_ctx, &r);
 182         if (!NT_STATUS_IS_OK(status)) {
 183                 printf("SAMR QuerySecurity failed - %s\n", nt_errstr(status));
 184                 return NULL;
 185         }
 186
 187         return r.out.sdbuf;
 188 }
 189
 190 static struct sec_desc_buf *samsync_query_lsa_sec_desc(TALLOC_CTX *mem_ctx,
 191                                                        struct samsync_state *samsync_state,
 192                                                        struct policy_handle *handle)
 193 {
 194         struct lsa_QuerySecurity r;
 195         NTSTATUS status;
 196
 197         r.in.handle = handle;
 198         r.in.sec_info = 0x7;
 199
 200         status = dcerpc_lsa_QuerySecurity(samsync_state->p_lsa, mem_ctx, &r);
 201         if (!NT_STATUS_IS_OK(status)) {
 202                 printf("LSA QuerySecurity failed - %s\n", nt_errstr(status));
 203                 return NULL;
 204         }
 205
 206         return r.out.sdbuf;
 207 }
 208
 209 #define TEST_UINT64_EQUAL(i1, i2) do {\
 210         if (i1 != i2) {\
 211               printf("uint64 mismatch: " #i1 ": 0x%08x%08x (%lld) != " #i2 ": 0x%08x%08x (%lld)\n", \
 212                      (uint32_t)(i1 >> 32), (uint32_t)(i1 & 0xFFFFFFFF), i1, \
 213                      (uint32_t)(i2 >> 32), (uint32_t)(i2 & 0xFFFFFFFF), i2);\
 214               ret = False;\
 215         } \
 216 } while (0)
 217 #define TEST_INT_EQUAL(i1, i2) do {\
 218         if (i1 != i2) {\
 219               printf("integer mismatch: " #i1 ":%d != " #i2 ": %d\n", \
 220                      i1, i2);\
 221               ret = False;\
 222         } \
 223 } while (0)
 224 #define TEST_TIME_EQUAL(t1, t2) do {\
 225         if (t1 != t2) {\
 226               printf("NTTIME mismatch: " #t1 ":%s != " #t2 ": %s\n", \
 227                      nt_time_string(mem_ctx, t1),  nt_time_string(mem_ctx, t2));\
 228               ret = False;\
 229         } \
 230 } while (0)
 231
 232 #define TEST_STRING_EQUAL(s1, s2) do {\
 233         if (!((!s1.string || s1.string[0]=='\0') && (!s2.string || s2.string[0]=='\0')) \
 234             && strcmp_safe(s1.string, s2.string) != 0) {\
 235               printf("string mismatch: " #s1 ":%s != " #s2 ": %s\n", \
 236                      s1.string, s2.string);\
 237               ret = False;\
 238         } \
 239 } while (0)
 240
 241 #define TEST_SID_EQUAL(s1, s2) do {\
 242         if (!dom_sid_equal(s1, s2)) {\
 243               printf("dom_sid mismatch: " #s1 ":%s != " #s2 ": %s\n", \
 244                      dom_sid_string(mem_ctx, s1), dom_sid_string(mem_ctx, s2));\
 245               ret = False;\
 246         } \
 247 } while (0)
 248
 249 /* The ~SEC_DESC_SACL_PRESENT is because we don't, as administrator,
 250  * get back the SACL part of the SD when we ask over SAMR */
 251
 252 #define TEST_SEC_DESC_EQUAL(sd1, pipe, handle) do {\
 253         struct sec_desc_buf *sdbuf = samsync_query_ ##pipe## _sec_desc(mem_ctx, samsync_state, \
 254                                                             handle); \
 255         if (!sdbuf || !sdbuf->sd) { \
 256                 printf("Could not obtain security descriptor to match " #sd1 "\n");\
 257                 ret = False; \
 258         } else {\
 259                 if (!security_descriptor_mask_equal(sd1.sd, sdbuf->sd, \
 260                             ~SEC_DESC_SACL_PRESENT)) {\
 261                         printf("Security Descriptor Mismatch for %s:\n", #sd1);\
 262                         ndr_print_debug((ndr_print_fn_t)ndr_print_security_descriptor, "SamSync", sd1.sd);\
 263                         ndr_print_debug((ndr_print_fn_t)ndr_print_security_descriptor, "SamR", sdbuf->sd);\
 264                         ret = False;\
 265                 }\
 266         }\
 267 } while (0)
 268
 269 static BOOL samsync_handle_domain(TALLOC_CTX *mem_ctx, struct samsync_state *samsync_state,
 270                            int database_id, struct netr_DELTA_ENUM *delta)
 271 {
 272         struct netr_DELTA_DOMAIN *domain = delta->delta_union.domain;
 273         struct dom_sid *dom_sid;
 274         struct samr_QueryDomainInfo q[14]; /* q[0] will be unused simple for clarity */
 275         uint16_t levels[] = {1, 2, 3, 4, 5, 6, 7, 8, 9, 11, 12, 13};
 276         NTSTATUS nt_status;
 277         int i;
 278         BOOL ret = True;
 279
 280         samsync_state->seq_num[database_id] =
 281                 domain->sequence_num;
 282         switch (database_id) {
 283         case SAM_DATABASE_DOMAIN:
 284                 break;
 285         case SAM_DATABASE_BUILTIN:
 286                 if (StrCaseCmp("BUILTIN", domain->domain_name.string) != 0) {
 287                         printf("BUILTIN domain has different name: %s\n", domain->domain_name.string);
 288                 }
 289                 break;
 290         case SAM_DATABASE_PRIVS:
 291                 printf("DOMAIN entry on privs DB!\n");
 292                 return False;
 293                 break;
 294         }
 295
 296         if (!samsync_state->domain_name[database_id]) {
 297                 samsync_state->domain_name[database_id] =
 298                         talloc_reference(samsync_state, domain->domain_name.string);
 299         } else {
 300                 if (StrCaseCmp(samsync_state->domain_name[database_id], domain->domain_name.string) != 0) {
 301                         printf("Domain has name varies!: %s != %s\n", samsync_state->domain_name[database_id],
 302                                domain->domain_name.string);
 303                         return False;
 304                 }
 305         }
 306
 307         if (!samsync_state->domain_handle[database_id]) {
 308                 samsync_state->domain_handle[database_id]
 309                         = samsync_open_domain(mem_ctx, samsync_state, samsync_state->domain_name[database_id],
 310                                               &dom_sid);
 311         }
 312         if (samsync_state->domain_handle[database_id]) {
 313                 samsync_state->sid[database_id] = talloc_reference(samsync_state, dom_sid);
 314         }
 315
 316         printf("\tsequence_nums[%d/%s]=%llu\n",
 317                database_id, domain->domain_name.string,
 318                samsync_state->seq_num[database_id]);
 319
 320         for (i=0;i<ARRAY_SIZE(levels);i++) {
 321                 q[levels[i]].in.domain_handle = samsync_state->domain_handle[database_id];
 322                 q[levels[i]].in.level = levels[i];
 323
 324                 nt_status = dcerpc_samr_QueryDomainInfo(samsync_state->p_samr, mem_ctx, &q[levels[i]]);
 325
 326                 if (!NT_STATUS_IS_OK(nt_status)) {
 327                         printf("QueryDomainInfo level %u failed - %s\n",
 328                                q[levels[i]].in.level, nt_errstr(nt_status));
 329                         return False;
 330                 }
 331         }
 332
 333         TEST_STRING_EQUAL(q[5].out.info->info5.domain_name, domain->domain_name);
 334
 335         TEST_STRING_EQUAL(q[2].out.info->info2.comment, domain->comment);
 336         TEST_STRING_EQUAL(q[4].out.info->info4.comment, domain->comment);
 337         TEST_TIME_EQUAL(q[2].out.info->info2.force_logoff_time, domain->force_logoff_time);
 338         TEST_TIME_EQUAL(q[3].out.info->info3.force_logoff_time, domain->force_logoff_time);
 339
 340         TEST_TIME_EQUAL(q[1].out.info->info1.min_password_length, domain->min_password_length);
 341         TEST_TIME_EQUAL(q[1].out.info->info1.password_history_length, domain->password_history_length);
 342         TEST_TIME_EQUAL(q[1].out.info->info1.max_password_age, domain->max_password_age);
 343         TEST_TIME_EQUAL(q[1].out.info->info1.min_password_age, domain->min_password_age);
 344
 345         TEST_UINT64_EQUAL(q[8].out.info->info8.sequence_num,
 346                         domain->sequence_num);
 347         TEST_TIME_EQUAL(q[8].out.info->info8.domain_create_time,
 348                         domain->domain_create_time);
 349         TEST_TIME_EQUAL(q[13].out.info->info13.domain_create_time,
 350                         domain->domain_create_time);
 351
 352         TEST_SEC_DESC_EQUAL(domain->sdbuf, samr, samsync_state->domain_handle[database_id]);
 353
 354         return ret;
 355 }
 356
 357 static BOOL samsync_handle_policy(TALLOC_CTX *mem_ctx, struct samsync_state *samsync_state,
 358                            int database_id, struct netr_DELTA_ENUM *delta)
 359 {
 360         struct netr_DELTA_POLICY *policy = delta->delta_union.policy;
 361
 362         samsync_state->seq_num[database_id] =
 363                 policy->sequence_num;
 364
 365         if (!samsync_state->domain_name[SAM_DATABASE_DOMAIN]) {
 366                 samsync_state->domain_name[SAM_DATABASE_DOMAIN] =
 367                         talloc_reference(samsync_state, policy->primary_domain_name.string);
 368         } else {
 369                 if (StrCaseCmp(samsync_state->domain_name[SAM_DATABASE_DOMAIN], policy->primary_domain_name.string) != 0) {
 370                         printf("PRIMARY domain has name varies between DOMAIN and POLICY!: %s != %s\n", samsync_state->domain_name[SAM_DATABASE_DOMAIN],
 371                                policy->primary_domain_name.string);
 372                         return False;
 373                 }
 374         }
 375
 376         if (!dom_sid_equal(samsync_state->sid[SAM_DATABASE_DOMAIN], policy->sid)) {
 377                 printf("Domain SID from POLICY (%s) does not match domain sid from SAMR (%s)\n",
 378                        dom_sid_string(mem_ctx, policy->sid), dom_sid_string(mem_ctx, samsync_state->sid[SAM_DATABASE_DOMAIN]));
 379                 return False;
 380         }
 381
 382         printf("\tsequence_nums[%d/PRIVS]=%llu\n",
 383                database_id,
 384                samsync_state->seq_num[database_id]);
 385         return True;
 386 }
 387
 388 static BOOL samsync_handle_user(TALLOC_CTX *mem_ctx, struct samsync_state *samsync_state,
 389                                 int database_id, struct netr_DELTA_ENUM *delta)
 390 {
 391         uint32 rid = delta->delta_id_union.rid;
 392         struct netr_DELTA_USER *user = delta->delta_union.user;
 393         struct netr_SamInfo3 *info3;
 394         struct samr_Password lm_hash;
 395         struct samr_Password nt_hash;
 396         struct samr_Password *lm_hash_p = NULL;
 397         struct samr_Password *nt_hash_p = NULL;
 398         const char *domain = samsync_state->domain_name[database_id];
 399         const char *username = user->account_name.string;
 400         NTSTATUS nt_status;
 401         BOOL ret = True;
 402
 403         struct samr_OpenUser r;
 404         struct samr_QueryUserInfo q;
 405         struct policy_handle user_handle;
 406
 407         if (!samsync_state->domain_name || !samsync_state->domain_handle[database_id]) {
 408                 printf("SamSync needs domain information before the users\n");
 409                 return False;
 410         }
 411
 412         r.in.domain_handle = samsync_state->domain_handle[database_id];
 413         r.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
 414         r.in.rid = rid;
 415         r.out.user_handle = &user_handle;
 416
 417         nt_status = dcerpc_samr_OpenUser(samsync_state->p_samr, mem_ctx, &r);
 418         if (!NT_STATUS_IS_OK(nt_status)) {
 419                 printf("OpenUser(%u) failed - %s\n", rid, nt_errstr(nt_status));
 420                 return False;
 421         }
 422
 423         q.in.user_handle = &user_handle;
 424         q.in.level = 21;
 425
 426         TEST_SEC_DESC_EQUAL(user->sdbuf, samr, &user_handle);
 427
 428         nt_status = dcerpc_samr_QueryUserInfo(samsync_state->p_samr, mem_ctx, &q);
 429         if (!test_samr_handle_Close(samsync_state->p_samr, mem_ctx, &user_handle)) {
 430                 return False;
 431         }
 432
 433         if (!NT_STATUS_IS_OK(nt_status)) {
 434                 printf("QueryUserInfo level %u failed - %s\n",
 435                        q.in.level, nt_errstr(nt_status));
 436                 return False;
 437         }
 438
 439         TEST_STRING_EQUAL(q.out.info->info21.account_name, user->account_name);
 440         TEST_STRING_EQUAL(q.out.info->info21.full_name, user->full_name);
 441         TEST_INT_EQUAL(q.out.info->info21.rid, user->rid);
 442         TEST_INT_EQUAL(q.out.info->info21.primary_gid, user->primary_gid);
 443         TEST_STRING_EQUAL(q.out.info->info21.home_directory, user->home_directory);
 444         TEST_STRING_EQUAL(q.out.info->info21.home_drive, user->home_drive);
 445         TEST_STRING_EQUAL(q.out.info->info21.logon_script, user->logon_script);
 446         TEST_STRING_EQUAL(q.out.info->info21.description, user->description);
 447         TEST_STRING_EQUAL(q.out.info->info21.workstations, user->workstations);
 448
 449         TEST_TIME_EQUAL(q.out.info->info21.last_logon, user->last_logon);
 450         TEST_TIME_EQUAL(q.out.info->info21.last_logoff, user->last_logoff);
 451
 452
 453         TEST_INT_EQUAL(q.out.info->info21.logon_hours.units_per_week,
 454                        user->logon_hours.units_per_week);
 455         if (ret) {
 456                 if (memcmp(q.out.info->info21.logon_hours.bitmap, user->logon_hours.bitmap,
 457                            q.out.info->info21.logon_hours.units_per_week/8) != 0) {
 458                         printf("Logon hours mismatch\n");
 459                         ret = False;
 460                 }
 461         }
 462
 463         TEST_INT_EQUAL(q.out.info->info21.bad_password_count,
 464                        user->bad_password_count);
 465         TEST_INT_EQUAL(q.out.info->info21.logon_count,
 466                        user->logon_count);
 467
 468         TEST_TIME_EQUAL(q.out.info->info21.last_password_change,
 469                        user->last_password_change);
 470         TEST_TIME_EQUAL(q.out.info->info21.acct_expiry,
 471                        user->acct_expiry);
 472
 473         TEST_INT_EQUAL(q.out.info->info21.acct_flags, user->acct_flags);
 474         TEST_INT_EQUAL(q.out.info->info21.nt_password_set, user->nt_password_present);
 475         TEST_INT_EQUAL(q.out.info->info21.lm_password_set, user->lm_password_present);
 476         TEST_INT_EQUAL(q.out.info->info21.password_expired, user->password_expired);
 477
 478         TEST_STRING_EQUAL(q.out.info->info21.comment, user->comment);
 479         TEST_STRING_EQUAL(q.out.info->info21.parameters, user->parameters);
 480
 481         TEST_INT_EQUAL(q.out.info->info21.country_code, user->country_code);
 482         TEST_INT_EQUAL(q.out.info->info21.code_page, user->code_page);
 483
 484         TEST_STRING_EQUAL(q.out.info->info21.profile_path, user->profile_path);
 485
 486         if (user->lm_password_present) {
 487                 sam_rid_crypt(rid, user->lmpassword.hash, lm_hash.hash, 0);
 488                 lm_hash_p = &lm_hash;
 489         }
 490         if (user->nt_password_present) {
 491                 sam_rid_crypt(rid, user->ntpassword.hash, nt_hash.hash, 0);
 492                 nt_hash_p = &nt_hash;
 493         }
 494
 495         if (user->user_private_info.SensitiveData) {
 496                 DATA_BLOB data;
 497                 struct netr_USER_KEYS keys;
 498                 data.data = user->user_private_info.SensitiveData;
 499                 data.length = user->user_private_info.DataLength;
 500                 creds_arcfour_crypt(samsync_state->creds, data.data, data.length);
 501 #if 0
 502                 printf("Sensitive Data for %s:\n", username);
 503                 dump_data(0, data.data, data.length);
 504 #endif
 505                 nt_status = ndr_pull_struct_blob(&data, mem_ctx, &keys, (ndr_pull_flags_fn_t)ndr_pull_netr_USER_KEYS);
 506                 if (NT_STATUS_IS_OK(nt_status)) {
 507                         if (keys.keys.keys2.lmpassword.length == 16) {
 508                                 sam_rid_crypt(rid, keys.keys.keys2.lmpassword.pwd.hash, lm_hash.hash, 0);
 509                                 lm_hash_p = &lm_hash;
 510                         }
 511                         if (keys.keys.keys2.ntpassword.length == 16) {
 512                                 sam_rid_crypt(rid, keys.keys.keys2.ntpassword.pwd.hash, nt_hash.hash, 0);
 513                                 nt_hash_p = &nt_hash;
 514                         }
 515                 }
 516
 517         }
 518
 519         nt_status = test_SamLogon(samsync_state->p, mem_ctx, samsync_state->creds,
 520                                   domain,
 521                                   username,
 522                                   TEST_MACHINE_NAME,
 523                                   lm_hash_p,
 524                                   nt_hash_p,
 525                                   &info3);
 526
 527         if (NT_STATUS_EQUAL(nt_status, NT_STATUS_ACCOUNT_DISABLED)) {
 528                 if (user->acct_flags & ACB_DISABLED) {
 529                         return True;
 530                 }
 531         } else if (NT_STATUS_EQUAL(nt_status, NT_STATUS_NOLOGON_WORKSTATION_TRUST_ACCOUNT)) {
 532                 if (user->acct_flags & ACB_WSTRUST) {
 533                         return True;
 534                 }
 535         } else if (NT_STATUS_EQUAL(nt_status, NT_STATUS_NOLOGON_SERVER_TRUST_ACCOUNT)) {
 536                 if (user->acct_flags & ACB_SVRTRUST) {
 537                         return True;
 538                 }
 539         } else if (NT_STATUS_EQUAL(nt_status, NT_STATUS_NOLOGON_INTERDOMAIN_TRUST_ACCOUNT)) {
 540                 if (user->acct_flags & ACB_DOMTRUST) {
 541                         return True;
 542                 }
 543         } else if (NT_STATUS_EQUAL(nt_status, NT_STATUS_NOLOGON_INTERDOMAIN_TRUST_ACCOUNT)) {
 544                 if (user->acct_flags & ACB_DOMTRUST) {
 545                         return True;
 546                 }
 547         } else if (NT_STATUS_EQUAL(nt_status, NT_STATUS_ACCOUNT_LOCKED_OUT)) {
 548                 if (user->acct_flags & ACB_AUTOLOCK) {
 549                         return True;
 550                 }
 551         } else if (NT_STATUS_EQUAL(nt_status, NT_STATUS_WRONG_PASSWORD)) {
 552                 if (!lm_hash_p && !nt_hash_p) {
 553                         return True;
 554                 }
 555         } else if (NT_STATUS_IS_OK(nt_status)) {
 556                 TEST_INT_EQUAL(user->rid, info3->base.rid);
 557                 TEST_INT_EQUAL(user->primary_gid, info3->base.primary_gid);
 558                 /* this is 0x0 from NT4 sp6 */
 559                 if (info3->base.acct_flags) {
 560                         TEST_INT_EQUAL(user->acct_flags, info3->base.acct_flags);
 561                 }
 562                 /* this is NULL from NT4 sp6 */
 563                 if (info3->base.account_name.string) {
 564                         TEST_STRING_EQUAL(user->account_name, info3->base.account_name);
 565                 }
 566                 TEST_STRING_EQUAL(user->full_name, info3->base.full_name);
 567                 TEST_STRING_EQUAL(user->logon_script, info3->base.logon_script);
 568                 TEST_STRING_EQUAL(user->profile_path, info3->base.profile_path);
 569                 TEST_STRING_EQUAL(user->home_directory, info3->base.home_directory);
 570                 TEST_STRING_EQUAL(user->home_drive, info3->base.home_drive);
 571                 TEST_STRING_EQUAL(user->logon_script, info3->base.logon_script);
 572
 573
 574                 TEST_TIME_EQUAL(user->last_logon, info3->base.last_logon);
 575                 TEST_TIME_EQUAL(user->acct_expiry, info3->base.acct_expiry);
 576                 TEST_TIME_EQUAL(user->last_password_change, info3->base.last_password_change);
 577
 578                 /* Does the concept of a logoff time ever really
 579                  * exist? (not in any sensible way, according to the
 580                  * doco I read -- abartlet) */
 581
 582                 /* This copes with the two different versions of 0 I see */
 583                 /* with NT4 sp6 we have the || case */
 584                 if (!((user->last_logoff == 0)
 585                       || (info3->base.last_logoff == 0x7fffffffffffffffLL))) {
 586                         TEST_TIME_EQUAL(user->last_logoff, info3->base.last_logoff);
 587                 }
 588                 return ret;
 589         } else {
 590                 printf("Could not validate password for user %s\\%s: %s\n",
 591                        domain, username, nt_errstr(nt_status));
 592                 return False;
 593         }
 594         return False;
 595 }
 596
 597 static BOOL samsync_handle_alias(TALLOC_CTX *mem_ctx, struct samsync_state *samsync_state,
 598                                  int database_id, struct netr_DELTA_ENUM *delta)
 599 {
 600         uint32 rid = delta->delta_id_union.rid;
 601         struct netr_DELTA_ALIAS *alias = delta->delta_union.alias;
 602         NTSTATUS nt_status;
 603         BOOL ret = True;
 604
 605         struct samr_OpenAlias r;
 606         struct samr_QueryAliasInfo q;
 607         struct policy_handle alias_handle;
 608
 609         if (!samsync_state->domain_name || !samsync_state->domain_handle[database_id]) {
 610                 printf("SamSync needs domain information before the users\n");
 611                 return False;
 612         }
 613
 614         r.in.domain_handle = samsync_state->domain_handle[database_id];
 615         r.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
 616         r.in.rid = rid;
 617         r.out.alias_handle = &alias_handle;
 618
 619         nt_status = dcerpc_samr_OpenAlias(samsync_state->p_samr, mem_ctx, &r);
 620         if (!NT_STATUS_IS_OK(nt_status)) {
 621                 printf("OpenUser(%u) failed - %s\n", rid, nt_errstr(nt_status));
 622                 return False;
 623         }
 624
 625         q.in.alias_handle = &alias_handle;
 626         q.in.level = 1;
 627
 628         TEST_SEC_DESC_EQUAL(alias->sdbuf, samr, &alias_handle);
 629
 630         nt_status = dcerpc_samr_QueryAliasInfo(samsync_state->p_samr, mem_ctx, &q);
 631         if (!test_samr_handle_Close(samsync_state->p_samr, mem_ctx, &alias_handle)) {
 632                 return False;
 633         }
 634
 635         if (!NT_STATUS_IS_OK(nt_status)) {
 636                 printf("QueryAliasInfo level %u failed - %s\n",
 637                        q.in.level, nt_errstr(nt_status));
 638                 return False;
 639         }
 640
 641         TEST_STRING_EQUAL(q.out.info->all.name, alias->alias_name);
 642         TEST_STRING_EQUAL(q.out.info->all.description, alias->description);
 643         return ret;
 644 }
 645
 646 static BOOL samsync_handle_group(TALLOC_CTX *mem_ctx, struct samsync_state *samsync_state,
 647                                  int database_id, struct netr_DELTA_ENUM *delta)
 648 {
 649         uint32 rid = delta->delta_id_union.rid;
 650         struct netr_DELTA_GROUP *group = delta->delta_union.group;
 651         NTSTATUS nt_status;
 652         BOOL ret = True;
 653
 654         struct samr_OpenGroup r;
 655         struct samr_QueryGroupInfo q;
 656         struct policy_handle group_handle;
 657
 658         if (!samsync_state->domain_name || !samsync_state->domain_handle[database_id]) {
 659                 printf("SamSync needs domain information before the users\n");
 660                 return False;
 661         }
 662
 663         r.in.domain_handle = samsync_state->domain_handle[database_id];
 664         r.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
 665         r.in.rid = rid;
 666         r.out.group_handle = &group_handle;
 667
 668         nt_status = dcerpc_samr_OpenGroup(samsync_state->p_samr, mem_ctx, &r);
 669         if (!NT_STATUS_IS_OK(nt_status)) {
 670                 printf("OpenUser(%u) failed - %s\n", rid, nt_errstr(nt_status));
 671                 return False;
 672         }
 673
 674         q.in.group_handle = &group_handle;
 675         q.in.level = 1;
 676
 677         TEST_SEC_DESC_EQUAL(group->sdbuf, samr, &group_handle);
 678
 679         nt_status = dcerpc_samr_QueryGroupInfo(samsync_state->p_samr, mem_ctx, &q);
 680         if (!test_samr_handle_Close(samsync_state->p_samr, mem_ctx, &group_handle)) {
 681                 return False;
 682         }
 683
 684         if (!NT_STATUS_IS_OK(nt_status)) {
 685                 printf("QueryGroupInfo level %u failed - %s\n",
 686                        q.in.level, nt_errstr(nt_status));
 687                 return False;
 688         }
 689
 690         TEST_STRING_EQUAL(q.out.info->all.name, group->group_name);
 691         TEST_INT_EQUAL(q.out.info->all.attributes, group->attributes);
 692         TEST_STRING_EQUAL(q.out.info->all.description, group->description);
 693         return ret;
 694 }
 695
 696 static BOOL samsync_handle_secret(TALLOC_CTX *mem_ctx, struct samsync_state *samsync_state,
 697                                   int database_id, struct netr_DELTA_ENUM *delta)
 698 {
 699         struct netr_DELTA_SECRET *secret = delta->delta_union.secret;
 700         const char *name = delta->delta_id_union.name;
 701         struct samsync_secret *new = talloc_p(samsync_state, struct samsync_secret);
 702         struct lsa_QuerySecret q;
 703         struct lsa_OpenSecret o;
 704         struct policy_handle sec_handle;
 705         struct lsa_DATA_BUF_PTR bufp1;
 706         NTTIME new_mtime;
 707         BOOL ret = True;
 708         DATA_BLOB lsa_blob1, lsa_blob_out, session_key;
 709         NTSTATUS status;
 710
 711         creds_arcfour_crypt(samsync_state->creds, secret->current_cipher.cipher_data,
 712                             secret->current_cipher.maxlen);
 713
 714         creds_arcfour_crypt(samsync_state->creds, secret->old_cipher.cipher_data,
 715                             secret->old_cipher.maxlen);
 716
 717         new->name = talloc_reference(new, name);
 718         new->secret = data_blob_talloc(new, secret->current_cipher.cipher_data, secret->current_cipher.maxlen);
 719
 720         DLIST_ADD(samsync_state->secrets, new);
 721
 722         o.in.handle = samsync_state->lsa_handle;
 723         o.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
 724         o.in.name.string = name;
 725         o.out.sec_handle = &sec_handle;
 726
 727         status = dcerpc_lsa_OpenSecret(samsync_state->p_lsa, mem_ctx, &o);
 728         if (!NT_STATUS_IS_OK(status)) {
 729                 printf("OpenSecret failed - %s\n", nt_errstr(status));
 730                 return False;
 731         }
 732
 733         TEST_SEC_DESC_EQUAL(secret->sdbuf, lsa, &sec_handle);
 734
 735         status = dcerpc_fetch_session_key(samsync_state->p_lsa, &session_key);
 736         if (!NT_STATUS_IS_OK(status)) {
 737                 printf("dcerpc_fetch_session_key failed - %s\n", nt_errstr(status));
 738                 return False;
 739         }
 740
 741
 742         ZERO_STRUCT(new_mtime);
 743
 744         /* fetch the secret back again */
 745         q.in.handle = &sec_handle;
 746         q.in.new_val = &bufp1;
 747         q.in.new_mtime = &new_mtime;
 748         q.in.old_val = NULL;
 749         q.in.old_mtime = NULL;
 750
 751         bufp1.buf = NULL;
 752
 753         status = dcerpc_lsa_QuerySecret(samsync_state->p_lsa, mem_ctx, &q);
 754         if (!NT_STATUS_IS_OK(status)) {
 755                 printf("QuerySecret failed - %s\n", nt_errstr(status));
 756                 return False;
 757         }
 758
 759         if (q.out.new_val->buf == NULL) {
 760                 /* probably just not available due to ACLs */
 761         } else {
 762                 lsa_blob1.data = q.out.new_val->buf->data;
 763                 lsa_blob1.length = q.out.new_val->buf->length;
 764
 765                 lsa_blob_out = sess_decrypt_blob(mem_ctx, &lsa_blob1, &session_key);
 766
 767                 if (new->secret.length != lsa_blob_out.length) {
 768                         printf("Returned secret %s doesn't match: %d != %d\n",
 769                                new->name, new->secret.length, lsa_blob_out.length);
 770                         ret = False;
 771                 }
 772
 773                 if (memcmp(lsa_blob_out.data,
 774                            new->secret.data, new->secret.length) != 0) {
 775                         printf("Returned secret %s doesn't match: \n",
 776                                new->name);
 777                         DEBUG(1, ("SamSync Secret:\n"));
 778                         dump_data(1, new->secret.data, new->secret.length);
 779                         DEBUG(1, ("LSA Secret:\n"));
 780                         dump_data(1, lsa_blob_out.data, lsa_blob_out.length);
 781                         ret = False;
 782                 }
 783         }
 784
 785         return ret;
 786 }
 787
 788 static BOOL samsync_handle_trusted_domain(TALLOC_CTX *mem_ctx, struct samsync_state *samsync_state,
 789                                           int database_id, struct netr_DELTA_ENUM *delta)
 790 {
 791         NTSTATUS status;
 792         BOOL ret = True;
 793         struct netr_DELTA_TRUSTED_DOMAIN *trusted_domain = delta->delta_union.trusted_domain;
 794         struct dom_sid *dom_sid = delta->delta_id_union.sid;
 795
 796         struct samsync_trusted_domain *new = talloc_p(samsync_state, struct samsync_trusted_domain);
 797         struct lsa_OpenTrustedDomain t;
 798         struct policy_handle trustdom_handle;
 799         struct lsa_QueryTrustedDomainInfo q;
 800         union lsa_TrustedDomainInfo *info[9];
 801         int levels [] = {1, 3, 8};
 802         int i;
 803
 804         new->name = talloc_reference(new, trusted_domain->domain_name.string);
 805         new->sid = talloc_reference(new, dom_sid);
 806
 807         t.in.handle = samsync_state->lsa_handle;
 808         t.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
 809         t.in.sid = dom_sid;
 810         t.out.trustdom_handle = &trustdom_handle;
 811
 812         status = dcerpc_lsa_OpenTrustedDomain(samsync_state->p_lsa, mem_ctx, &t);
 813         if (!NT_STATUS_IS_OK(status)) {
 814                 printf("OpenTrustedDomain failed - %s\n", nt_errstr(status));
 815                 return False;
 816         }
 817
 818         for (i=0; i< ARRAY_SIZE(levels); i++) {
 819                 q.in.trustdom_handle = &trustdom_handle;
 820                 q.in.level = levels[i];
 821                 status = dcerpc_lsa_QueryTrustedDomainInfo(samsync_state->p_lsa, mem_ctx, &q);
 822                 if (!NT_STATUS_IS_OK(status)) {
 823                         if (q.in.level == 8 && NT_STATUS_EQUAL(status,NT_STATUS_INVALID_PARAMETER)) {
 824                                 info[levels[i]] = NULL;
 825                                 continue;
 826                         }
 827                         printf("QueryInfoTrustedDomain level %d failed - %s\n",
 828                                levels[i], nt_errstr(status));
 829                         return False;
 830                 }
 831                 info[levels[i]]  = q.out.info;
 832         }
 833
 834         if (info[8]) {
 835                 TEST_SID_EQUAL(info[8]->full_info.info_ex.sid, dom_sid);
 836                 TEST_STRING_EQUAL(info[8]->full_info.info_ex.netbios_name, trusted_domain->domain_name);
 837         }
 838         TEST_STRING_EQUAL(info[1]->name.netbios_name, trusted_domain->domain_name);
 839         TEST_INT_EQUAL(info[3]->flags.flags, trusted_domain->flags);
 840         TEST_SEC_DESC_EQUAL(trusted_domain->sdbuf, lsa, &trustdom_handle);
 841
 842         DLIST_ADD(samsync_state->trusted_domains, new);
 843
 844         return ret;
 845 }
 846
 847 static BOOL samsync_handle_account(TALLOC_CTX *mem_ctx, struct samsync_state *samsync_state,
 848                                           int database_id, struct netr_DELTA_ENUM *delta)
 849 {
 850         NTSTATUS status;
 851         BOOL ret = True;
 852         struct netr_DELTA_ACCOUNT *account = delta->delta_union.account;
 853         struct dom_sid *dom_sid = delta->delta_id_union.sid;
 854
 855         struct lsa_OpenAccount a;
 856         struct policy_handle acct_handle;
 857         struct lsa_EnumPrivsAccount e;
 858         struct lsa_LookupPrivName r;
 859
 860         int i, j;
 861
 862         BOOL *found_priv_in_lsa;
 863
 864         a.in.handle = samsync_state->lsa_handle;
 865         a.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
 866         a.in.sid = dom_sid;
 867         a.out.acct_handle = &acct_handle;
 868
 869         status = dcerpc_lsa_OpenAccount(samsync_state->p_lsa, mem_ctx, &a);
 870         if (!NT_STATUS_IS_OK(status)) {
 871                 printf("OpenTrustedDomain failed - %s\n", nt_errstr(status));
 872                 return False;
 873         }
 874
 875         TEST_SEC_DESC_EQUAL(account->sdbuf, lsa, &acct_handle);
 876
 877         found_priv_in_lsa = talloc_zero_array_p(mem_ctx, BOOL, account->privilege_entries);
 878
 879         e.in.handle = &acct_handle;
 880
 881         status = dcerpc_lsa_EnumPrivsAccount(samsync_state->p_lsa, mem_ctx, &e);
 882         if (!NT_STATUS_IS_OK(status)) {
 883                 printf("EnumPrivsAccount failed - %s\n", nt_errstr(status));
 884                 return False;
 885         }
 886
 887         if (!e.out.privs) {
 888                 return account->privilege_entries != 0;
 889         }
 890
 891         if ((account->privilege_entries && !e.out.privs)) {
 892                 return False;
 893         }
 894
 895         TEST_INT_EQUAL(account->privilege_entries, e.out.privs->count);
 896
 897         for (i=0;i< e.out.privs->count; i++) {
 898                 r.in.handle = samsync_state->lsa_handle;
 899                 r.in.luid = &e.out.privs->set[i].luid;
 900
 901                 status = dcerpc_lsa_LookupPrivName(samsync_state->p_lsa, mem_ctx, &r);
 902                 if (!NT_STATUS_IS_OK(status)) {
 903                         printf("\nLookupPrivName failed - %s\n", nt_errstr(status));
 904                         return False;
 905                 }
 906
 907                 if (!r.out.name) {
 908                         printf("\nLookupPrivName failed to return a name\n");
 909                         return False;
 910                 }
 911                 for (j=0;j<account->privilege_entries; j++) {
 912                         if (strcmp(r.out.name->string, account->privilege_name[j].string) == 0) {
 913                                 found_priv_in_lsa[j] = True;
 914                                 break;
 915                         }
 916                 }
 917         }
 918         for (j=0;j<account->privilege_entries; j++) {
 919                 if (!found_priv_in_lsa[j]) {
 920                         printf("Privilage %s on account %s not found in LSA\n", account->privilege_name[j].string,
 921                                dom_sid_string(mem_ctx, dom_sid));
 922                         ret = False;
 923                 }
 924         }
 925         return ret;
 926 }
 927
 928 /*
 929   try a netlogon DatabaseSync
 930 */
 931 static BOOL test_DatabaseSync(struct samsync_state *samsync_state,
 932                               TALLOC_CTX *mem_ctx)
 933 {
 934         NTSTATUS status;
 935         struct netr_DatabaseSync r;
 936         const uint32_t database_ids[] = {SAM_DATABASE_DOMAIN, SAM_DATABASE_BUILTIN, SAM_DATABASE_PRIVS};
 937         int i, d;
 938         BOOL ret = True;
 939         struct samsync_trusted_domain *t;
 940         struct samsync_secret *s;
 941
 942         const char *domain, *username;
 943
 944         r.in.logon_server = talloc_asprintf(mem_ctx, "\\\\%s", dcerpc_server_name(samsync_state->p));
 945         r.in.computername = TEST_MACHINE_NAME;
 946         r.in.preferredmaximumlength = (uint32_t)-1;
 947         ZERO_STRUCT(r.in.return_authenticator);
 948
 949         for (i=0;i<ARRAY_SIZE(database_ids);i++) {
 950                 r.in.sync_context = 0;
 951                 r.in.database_id = database_ids[i];
 952
 953                 printf("Testing DatabaseSync of id %d\n", r.in.database_id);
 954
 955                 do {
 956                         creds_client_authenticator(samsync_state->creds, &r.in.credential);
 957
 958                         status = dcerpc_netr_DatabaseSync(samsync_state->p, mem_ctx, &r);
 959                         if (!NT_STATUS_IS_OK(status) &&
 960                             !NT_STATUS_EQUAL(status, STATUS_MORE_ENTRIES)) {
 961                                 printf("DatabaseSync - %s\n", nt_errstr(status));
 962                                 ret = False;
 963                                 break;
 964                         }
 965
 966                         if (!creds_client_check(samsync_state->creds, &r.out.return_authenticator.cred)) {
 967                                 printf("Credential chaining failed\n");
 968                         }
 969
 970                         r.in.sync_context = r.out.sync_context;
 971
 972                         for (d=0; d < r.out.delta_enum_array->num_deltas; d++) {
 973                                 switch (r.out.delta_enum_array->delta_enum[d].delta_type) {
 974                                 case NETR_DELTA_DOMAIN:
 975                                         ret &= samsync_handle_domain(mem_ctx, samsync_state,
 976                                                                      r.in.database_id, &r.out.delta_enum_array->delta_enum[d]);
 977                                         break;
 978                                 case NETR_DELTA_GROUP:
 979                                         ret &= samsync_handle_group(mem_ctx, samsync_state,
 980                                                                     r.in.database_id, &r.out.delta_enum_array->delta_enum[d]);
 981                                         break;
 982                                 case NETR_DELTA_USER:
 983                                         ret &= samsync_handle_user(mem_ctx, samsync_state,
 984                                                                    r.in.database_id, &r.out.delta_enum_array->delta_enum[d]);
 985                                         break;
 986                                 case NETR_DELTA_ALIAS:
 987                                         ret &= samsync_handle_alias(mem_ctx, samsync_state,
 988                                                                     r.in.database_id, &r.out.delta_enum_array->delta_enum[d]);
 989                                         break;
 990                                 case NETR_DELTA_POLICY:
 991                                         ret &= samsync_handle_policy(mem_ctx, samsync_state,
 992                                                                      r.in.database_id, &r.out.delta_enum_array->delta_enum[d]);
 993                                         break;
 994                                 case NETR_DELTA_TRUSTED_DOMAIN:
 995                                         ret &= samsync_handle_trusted_domain(mem_ctx, samsync_state,
 996                                                                              r.in.database_id, &r.out.delta_enum_array->delta_enum[d]);
 997                                         break;
 998                                 case NETR_DELTA_ACCOUNT:
 999                                         ret &= samsync_handle_account(mem_ctx, samsync_state,
1000                                                                      r.in.database_id, &r.out.delta_enum_array->delta_enum[d]);
1001                                         break;
1002                                 case NETR_DELTA_SECRET:
1003                                         ret &= samsync_handle_secret(mem_ctx, samsync_state,
1004                                                                      r.in.database_id, &r.out.delta_enum_array->delta_enum[d]);
1005                                         break;
1006                                 }
1007                         }
1008                 } while (NT_STATUS_EQUAL(status, STATUS_MORE_ENTRIES));
1009
1010         }
1011
1012         domain = samsync_state->domain_name[SAM_DATABASE_DOMAIN];
1013         if (!domain) {
1014                 printf("Never got a DOMAIN object in samsync!\n");
1015                 return False;
1016         }
1017
1018         username = talloc_asprintf(mem_ctx, "%s$", domain);
1019         for (t=samsync_state->trusted_domains; t; t=t->next) {
1020                 char *secret_name = talloc_asprintf(mem_ctx, "G$$%s", t->name);
1021                 for (s=samsync_state->secrets; s; s=s->next) {
1022                         if (StrCaseCmp(s->name, secret_name) == 0) {
1023                                 NTSTATUS nt_status;
1024                                 struct samr_Password nt_hash;
1025                                 mdfour(nt_hash.hash, s->secret.data, s->secret.length);
1026
1027                                 printf("Checking password for %s\\%s\n", t->name, username);
1028                                 nt_status = test_SamLogon(samsync_state->p_netlogon_wksta, mem_ctx, samsync_state->creds_netlogon_wksta,
1029                                                           t->name,
1030                                                           username,
1031                                                           TEST_MACHINE_NAME2,
1032                                                           NULL,
1033                                                           &nt_hash,
1034                                                           NULL);
1035                                 if (NT_STATUS_EQUAL(nt_status, NT_STATUS_NO_LOGON_SERVERS)) {
1036                                         printf("Verifiction of trust password to %s failed: %s (the trusted domain is not available)\n",
1037                                                t->name, nt_errstr(nt_status));
1038
1039                                         break;
1040                                 }
1041                                 if (!NT_STATUS_EQUAL(nt_status, NT_STATUS_NOLOGON_INTERDOMAIN_TRUST_ACCOUNT)) {
1042                                         printf("Verifiction of trust password to %s: should have failed (nologon interdomain trust account), instead: %s\n",
1043                                                t->name, nt_errstr(nt_status));
1044                                         ret = False;
1045                                 }
1046
1047                                 /* break it */
1048                                 nt_hash.hash[0]++;
1049                                 nt_status = test_SamLogon(samsync_state->p_netlogon_wksta, mem_ctx, samsync_state->creds_netlogon_wksta,
1050                                                           t->name,
1051                                                           username,
1052                                                           TEST_MACHINE_NAME2,
1053                                                           NULL,
1054                                                           &nt_hash,
1055                                                           NULL);
1056
1057                                 if (!NT_STATUS_EQUAL(nt_status, NT_STATUS_WRONG_PASSWORD)) {
1058                                         printf("Verifiction of trust password to %s: should have failed (wrong password), instead: %s\n",
1059                                                t->name, nt_errstr(nt_status));
1060                                         ret = False;
1061                                         ret = False;
1062                                 }
1063
1064                                 break;
1065                         }
1066                 }
1067         }
1068         return ret;
1069 }
1070
1071
1072 /*
1073   try a netlogon DatabaseDeltas
1074 */
1075 static BOOL test_DatabaseDeltas(struct samsync_state *samsync_state, TALLOC_CTX *mem_ctx)
1076 {
1077         NTSTATUS status;
1078         struct netr_DatabaseDeltas r;
1079         const uint32_t database_ids[] = {0, 1, 2};
1080         int i;
1081         BOOL ret = True;
1082
1083         r.in.logon_server = talloc_asprintf(mem_ctx, "\\\\%s", dcerpc_server_name(samsync_state->p));
1084         r.in.computername = TEST_MACHINE_NAME;
1085         r.in.preferredmaximumlength = (uint32_t)-1;
1086         ZERO_STRUCT(r.in.return_authenticator);
1087
1088         for (i=0;i<ARRAY_SIZE(database_ids);i++) {
1089                 r.in.database_id = database_ids[i];
1090                 r.in.sequence_num = samsync_state->seq_num[i];
1091
1092                 if (r.in.sequence_num == 0) continue;
1093
1094                 r.in.sequence_num -= 1;
1095
1096
1097                 printf("Testing DatabaseDeltas of id %d at %llu\n",
1098                        r.in.database_id, r.in.sequence_num);
1099
1100                 do {
1101                         creds_client_authenticator(samsync_state->creds, &r.in.credential);
1102
1103                         status = dcerpc_netr_DatabaseDeltas(samsync_state->p, mem_ctx, &r);
1104                         if (!NT_STATUS_IS_OK(status) &&
1105                             !NT_STATUS_EQUAL(status, STATUS_MORE_ENTRIES)) {
1106                                 printf("DatabaseDeltas - %s\n", nt_errstr(status));
1107                                 ret = False;
1108                                 break;
1109                         }
1110
1111                         if (!creds_client_check(samsync_state->creds, &r.out.return_authenticator.cred)) {
1112                                 printf("Credential chaining failed\n");
1113                         }
1114
1115                         r.in.sequence_num++;
1116                 } while (NT_STATUS_EQUAL(status, STATUS_MORE_ENTRIES));
1117         }
1118
1119         return ret;
1120 }
1121
1122
1123 /*
1124   try a netlogon DatabaseSync2
1125 */
1126 static BOOL test_DatabaseSync2(struct dcerpc_pipe *p, TALLOC_CTX *mem_ctx,
1127                                struct creds_CredentialState *creds)
1128 {
1129         NTSTATUS status;
1130         struct netr_DatabaseSync2 r;
1131         const uint32_t database_ids[] = {0, 1, 2};
1132         int i;
1133         BOOL ret = True;
1134
1135         r.in.logon_server = talloc_asprintf(mem_ctx, "\\\\%s", dcerpc_server_name(p));
1136         r.in.computername = TEST_MACHINE_NAME;
1137         r.in.preferredmaximumlength = (uint32_t)-1;
1138         ZERO_STRUCT(r.in.return_authenticator);
1139
1140         for (i=0;i<ARRAY_SIZE(database_ids);i++) {
1141                 r.in.sync_context = 0;
1142                 r.in.database_id = database_ids[i];
1143                 r.in.restart_state = 0;
1144
1145                 printf("Testing DatabaseSync2 of id %d\n", r.in.database_id);
1146
1147                 do {
1148                         creds_client_authenticator(creds, &r.in.credential);
1149
1150                         status = dcerpc_netr_DatabaseSync2(p, mem_ctx, &r);
1151                         if (!NT_STATUS_IS_OK(status) &&
1152                             !NT_STATUS_EQUAL(status, STATUS_MORE_ENTRIES)) {
1153                                 printf("DatabaseSync2 - %s\n", nt_errstr(status));
1154                                 ret = False;
1155                                 break;
1156                         }
1157
1158                         if (!creds_client_check(creds, &r.out.return_authenticator.cred)) {
1159                                 printf("Credential chaining failed\n");
1160                         }
1161
1162                         r.in.sync_context = r.out.sync_context;
1163                 } while (NT_STATUS_EQUAL(status, STATUS_MORE_ENTRIES));
1164         }
1165
1166         return ret;
1167 }
1168
1169
1170
1171 BOOL torture_rpc_samsync(void)
1172 {
1173         NTSTATUS status;
1174         TALLOC_CTX *mem_ctx;
1175         BOOL ret = True;
1176         struct test_join *join_ctx;
1177         struct test_join *join_ctx2;
1178         const char *machine_password;
1179         const char *machine_password2;
1180         const char *binding = lp_parm_string(-1, "torture", "binding");
1181         struct dcerpc_binding b;
1182         struct dcerpc_binding b_netlogon_wksta;
1183         struct samr_Connect c;
1184         struct samr_SetDomainInfo s;
1185         struct policy_handle *domain_policy;
1186
1187         struct lsa_ObjectAttribute attr;
1188         struct lsa_QosInfo qos;
1189         struct lsa_OpenPolicy2 r;
1190
1191         struct samsync_state *samsync_state;
1192
1193         mem_ctx = talloc_init("torture_rpc_netlogon");
1194
1195         join_ctx = torture_join_domain(TEST_MACHINE_NAME, lp_workgroup(), ACB_SVRTRUST,
1196                                        &machine_password);
1197         if (!join_ctx) {
1198                 printf("Failed to join as BDC\n");
1199                 return False;
1200         }
1201
1202         join_ctx2 = torture_join_domain(TEST_MACHINE_NAME2, lp_workgroup(), ACB_WSTRUST,
1203                                        &machine_password2);
1204         if (!join_ctx2) {
1205                 printf("Failed to join as member\n");
1206                 return False;
1207         }
1208
1209         samsync_state = talloc_zero_p(mem_ctx, struct samsync_state);
1210
1211         samsync_state->p_samr = torture_join_samr_pipe(join_ctx);
1212         samsync_state->connect_handle = talloc_zero_p(samsync_state, struct policy_handle);
1213         samsync_state->lsa_handle = talloc_zero_p(samsync_state, struct policy_handle);
1214         c.in.system_name = NULL;
1215         c.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
1216         c.out.connect_handle = samsync_state->connect_handle;
1217
1218         status = dcerpc_samr_Connect(samsync_state->p_samr, mem_ctx, &c);
1219         if (!NT_STATUS_IS_OK(status)) {
1220                 printf("samr_Connect failed\n");
1221                 ret = False;
1222                 goto failed;
1223         }
1224
1225         domain_policy = samsync_open_domain(mem_ctx, samsync_state, lp_workgroup(), NULL);
1226         if (!domain_policy) {
1227                 printf("samrsync_open_domain failed\n");
1228                 ret = False;
1229                 goto failed;
1230         }
1231
1232         s.in.domain_handle = domain_policy;
1233         s.in.level = 4;
1234         s.in.info = talloc_p(mem_ctx, union samr_DomainInfo);
1235
1236         s.in.info->info4.comment.string
1237                 = talloc_asprintf(mem_ctx,
1238                                   "Tortured by Samba4: %s",
1239                                   timestring(mem_ctx, time(NULL)));
1240         status = dcerpc_samr_SetDomainInfo(samsync_state->p_samr, mem_ctx, &s);
1241
1242         if (!test_samr_handle_Close(samsync_state->p_samr, mem_ctx, domain_policy)) {
1243                 ret = False;
1244                 goto failed;
1245         }
1246
1247         if (!NT_STATUS_IS_OK(status)) {
1248                 printf("SetDomainInfo level %u failed - %s\n",
1249                        s.in.level, nt_errstr(status));
1250                 ret = False;
1251                 goto failed;
1252         }
1253
1254
1255         status = torture_rpc_connection(&samsync_state->p_lsa,
1256                                         DCERPC_LSARPC_NAME,
1257                                         DCERPC_LSARPC_UUID,
1258                                         DCERPC_LSARPC_VERSION);
1259
1260         if (!NT_STATUS_IS_OK(status)) {
1261                 ret = False;
1262                 goto failed;
1263         }
1264
1265         qos.len = 0;
1266         qos.impersonation_level = 2;
1267         qos.context_mode = 1;
1268         qos.effective_only = 0;
1269
1270         attr.len = 0;
1271         attr.root_dir = NULL;
1272         attr.object_name = NULL;
1273         attr.attributes = 0;
1274         attr.sec_desc = NULL;
1275         attr.sec_qos = &qos;
1276
1277         r.in.system_name = "\\";
1278         r.in.attr = &attr;
1279         r.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
1280         r.out.handle = samsync_state->lsa_handle;
1281
1282         status = dcerpc_lsa_OpenPolicy2(samsync_state->p_lsa, mem_ctx, &r);
1283         if (!NT_STATUS_IS_OK(status)) {
1284                 printf("OpenPolicy2 failed - %s\n", nt_errstr(status));
1285                 ret = False;
1286                 goto failed;
1287         }
1288
1289         status = dcerpc_parse_binding(mem_ctx, binding, &b);
1290         if (!NT_STATUS_IS_OK(status)) {
1291                 printf("Bad binding string %s\n", binding);
1292                 ret = False;
1293                 goto failed;
1294         }
1295
1296         b.flags &= ~DCERPC_AUTH_OPTIONS;
1297         b.flags |= DCERPC_SCHANNEL_BDC | DCERPC_SIGN;
1298
1299         status = dcerpc_pipe_connect_b(&samsync_state->p, &b,
1300                                        DCERPC_NETLOGON_UUID,
1301                                        DCERPC_NETLOGON_VERSION,
1302                                        lp_workgroup(),
1303                                        TEST_MACHINE_NAME,
1304                                        machine_password);
1305
1306         if (!NT_STATUS_IS_OK(status)) {
1307                 ret = False;
1308                 goto failed;
1309         }
1310
1311         status = dcerpc_schannel_creds(samsync_state->p->security_state.generic_state, mem_ctx, &samsync_state->creds);
1312         if (!NT_STATUS_IS_OK(status)) {
1313                 ret = False;
1314         }
1315
1316
1317
1318         status = dcerpc_parse_binding(mem_ctx, binding, &b_netlogon_wksta);
1319         if (!NT_STATUS_IS_OK(status)) {
1320                 printf("Bad binding string %s\n", binding);
1321                 ret = False;
1322                 goto failed;
1323         }
1324
1325         b_netlogon_wksta.flags &= ~DCERPC_AUTH_OPTIONS;
1326         b_netlogon_wksta.flags |= DCERPC_SCHANNEL_WORKSTATION | DCERPC_SIGN;
1327
1328         status = dcerpc_pipe_connect_b(&samsync_state->p_netlogon_wksta, &b_netlogon_wksta,
1329                                        DCERPC_NETLOGON_UUID,
1330                                        DCERPC_NETLOGON_VERSION,
1331                                        lp_workgroup(),
1332                                        TEST_MACHINE_NAME2,
1333                                        machine_password2);
1334
1335         if (!NT_STATUS_IS_OK(status)) {
1336                 ret = False;
1337                 goto failed;
1338         }
1339
1340         status = dcerpc_schannel_creds(samsync_state->p_netlogon_wksta->security_state.generic_state, mem_ctx, &samsync_state->creds_netlogon_wksta);
1341         if (!NT_STATUS_IS_OK(status)) {
1342                 ret = False;
1343         }
1344
1345         if (!test_DatabaseSync(samsync_state, mem_ctx)) {
1346                 ret = False;
1347         }
1348
1349         if (!test_DatabaseDeltas(samsync_state, mem_ctx)) {
1350                 ret = False;
1351         }
1352
1353         if (!test_DatabaseSync2(samsync_state->p, mem_ctx, samsync_state->creds)) {
1354                 ret = False;
1355         }
1356 failed:
1357         torture_rpc_close(samsync_state->p);
1358
1359         torture_leave_domain(join_ctx);
1360         torture_leave_domain(join_ctx2);
1361
1362         talloc_destroy(mem_ctx);
1363
1364         return ret;
1365 }