2 Unix SMB/CIFS implementation.
4 test suite for netlogon rpc operations
6 Copyright (C) Andrew Tridgell 2003
7 Copyright (C) Andrew Bartlett <abartlet@samba.org> 2003-2004
8 Copyright (C) Tim Potter 2003
10 This program is free software; you can redistribute it and/or modify
11 it under the terms of the GNU General Public License as published by
12 the Free Software Foundation; either version 3 of the License, or
13 (at your option) any later version.
15 This program is distributed in the hope that it will be useful,
16 but WITHOUT ANY WARRANTY; without even the implied warranty of
17 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
18 GNU General Public License for more details.
20 You should have received a copy of the GNU General Public License
21 along with this program. If not, see <http://www.gnu.org/licenses/>.
25 #include "torture/torture.h"
26 #include "lib/events/events.h"
27 #include "auth/auth.h"
28 #include "auth/gensec/gensec.h"
29 #include "lib/cmdline/popt_common.h"
30 #include "torture/rpc/rpc.h"
31 #include "torture/rpc/netlogon.h"
32 #include "../lib/crypto/crypto.h"
33 #include "libcli/auth/libcli_auth.h"
34 #include "librpc/gen_ndr/ndr_netlogon_c.h"
35 #include "librpc/gen_ndr/ndr_netlogon.h"
36 #include "librpc/gen_ndr/ndr_lsa_c.h"
37 #include "param/param.h"
38 #include "libcli/security/security.h"
40 #define TEST_MACHINE_NAME "torturetest"
42 static bool test_LogonUasLogon(struct torture_context *tctx,
43 struct dcerpc_pipe *p)
46 struct netr_LogonUasLogon r;
47 struct netr_UasInfo *info = NULL;
49 r.in.server_name = NULL;
50 r.in.account_name = cli_credentials_get_username(cmdline_credentials);
51 r.in.workstation = TEST_MACHINE_NAME;
54 status = dcerpc_netr_LogonUasLogon(p, tctx, &r);
55 torture_assert_ntstatus_ok(tctx, status, "LogonUasLogon");
60 static bool test_LogonUasLogoff(struct torture_context *tctx,
61 struct dcerpc_pipe *p)
64 struct netr_LogonUasLogoff r;
65 struct netr_UasLogoffInfo info;
67 r.in.server_name = NULL;
68 r.in.account_name = cli_credentials_get_username(cmdline_credentials);
69 r.in.workstation = TEST_MACHINE_NAME;
72 status = dcerpc_netr_LogonUasLogoff(p, tctx, &r);
73 torture_assert_ntstatus_ok(tctx, status, "LogonUasLogoff");
78 bool test_SetupCredentials(struct dcerpc_pipe *p, struct torture_context *tctx,
79 struct cli_credentials *credentials,
80 struct netlogon_creds_CredentialState **creds_out)
83 struct netr_ServerReqChallenge r;
84 struct netr_ServerAuthenticate a;
85 struct netr_Credential credentials1, credentials2, credentials3;
86 struct netlogon_creds_CredentialState *creds;
87 const struct samr_Password *mach_password;
88 const char *machine_name;
90 mach_password = cli_credentials_get_nt_hash(credentials, tctx);
91 machine_name = cli_credentials_get_workstation(credentials);
93 torture_comment(tctx, "Testing ServerReqChallenge\n");
95 r.in.server_name = NULL;
96 r.in.computer_name = machine_name;
97 r.in.credentials = &credentials1;
98 r.out.return_credentials = &credentials2;
100 generate_random_buffer(credentials1.data, sizeof(credentials1.data));
102 status = dcerpc_netr_ServerReqChallenge(p, tctx, &r);
103 torture_assert_ntstatus_ok(tctx, status, "ServerReqChallenge");
105 a.in.server_name = NULL;
106 a.in.account_name = talloc_asprintf(tctx, "%s$", machine_name);
107 a.in.secure_channel_type = SEC_CHAN_BDC;
108 a.in.computer_name = machine_name;
109 a.in.credentials = &credentials3;
110 a.out.return_credentials = &credentials3;
112 creds = netlogon_creds_client_init(tctx, a.in.account_name,
114 &credentials1, &credentials2,
115 mach_password, &credentials3,
117 torture_assert(tctx, creds != NULL, "memory allocation");
120 torture_comment(tctx, "Testing ServerAuthenticate\n");
122 status = dcerpc_netr_ServerAuthenticate(p, tctx, &a);
124 /* This allows the tests to continue against the more fussy windows 2008 */
125 if (NT_STATUS_EQUAL(status, NT_STATUS_DOWNGRADE_DETECTED)) {
126 return test_SetupCredentials2(p, tctx, NETLOGON_NEG_AUTH2_ADS_FLAGS,
127 credentials, SEC_CHAN_BDC, creds_out);
130 torture_assert_ntstatus_ok(tctx, status, "ServerAuthenticate");
132 torture_assert(tctx, netlogon_creds_client_check(creds, &credentials3),
133 "Credential chaining failed");
139 bool test_SetupCredentials2(struct dcerpc_pipe *p, struct torture_context *tctx,
140 uint32_t negotiate_flags,
141 struct cli_credentials *machine_credentials,
143 struct netlogon_creds_CredentialState **creds_out)
146 struct netr_ServerReqChallenge r;
147 struct netr_ServerAuthenticate2 a;
148 struct netr_Credential credentials1, credentials2, credentials3;
149 struct netlogon_creds_CredentialState *creds;
150 const struct samr_Password *mach_password;
151 const char *machine_name;
153 mach_password = cli_credentials_get_nt_hash(machine_credentials, tctx);
154 machine_name = cli_credentials_get_workstation(machine_credentials);
156 torture_comment(tctx, "Testing ServerReqChallenge\n");
159 r.in.server_name = NULL;
160 r.in.computer_name = machine_name;
161 r.in.credentials = &credentials1;
162 r.out.return_credentials = &credentials2;
164 generate_random_buffer(credentials1.data, sizeof(credentials1.data));
166 status = dcerpc_netr_ServerReqChallenge(p, tctx, &r);
167 torture_assert_ntstatus_ok(tctx, status, "ServerReqChallenge");
169 a.in.server_name = NULL;
170 a.in.account_name = talloc_asprintf(tctx, "%s$", machine_name);
171 a.in.secure_channel_type = sec_chan_type;
172 a.in.computer_name = machine_name;
173 a.in.negotiate_flags = &negotiate_flags;
174 a.out.negotiate_flags = &negotiate_flags;
175 a.in.credentials = &credentials3;
176 a.out.return_credentials = &credentials3;
178 creds = netlogon_creds_client_init(tctx, a.in.account_name,
180 &credentials1, &credentials2,
181 mach_password, &credentials3,
184 torture_assert(tctx, creds != NULL, "memory allocation");
186 torture_comment(tctx, "Testing ServerAuthenticate2\n");
188 status = dcerpc_netr_ServerAuthenticate2(p, tctx, &a);
189 torture_assert_ntstatus_ok(tctx, status, "ServerAuthenticate2");
191 torture_assert(tctx, netlogon_creds_client_check(creds, &credentials3),
192 "Credential chaining failed");
194 torture_comment(tctx, "negotiate_flags=0x%08x\n", negotiate_flags);
201 static bool test_SetupCredentials3(struct dcerpc_pipe *p, struct torture_context *tctx,
202 uint32_t negotiate_flags,
203 struct cli_credentials *machine_credentials,
204 struct netlogon_creds_CredentialState **creds_out)
207 struct netr_ServerReqChallenge r;
208 struct netr_ServerAuthenticate3 a;
209 struct netr_Credential credentials1, credentials2, credentials3;
210 struct netlogon_creds_CredentialState *creds;
211 struct samr_Password mach_password;
213 const char *machine_name;
214 const char *plain_pass;
216 machine_name = cli_credentials_get_workstation(machine_credentials);
217 plain_pass = cli_credentials_get_password(machine_credentials);
219 torture_comment(tctx, "Testing ServerReqChallenge\n");
221 r.in.server_name = NULL;
222 r.in.computer_name = machine_name;
223 r.in.credentials = &credentials1;
224 r.out.return_credentials = &credentials2;
226 generate_random_buffer(credentials1.data, sizeof(credentials1.data));
228 status = dcerpc_netr_ServerReqChallenge(p, tctx, &r);
229 torture_assert_ntstatus_ok(tctx, status, "ServerReqChallenge");
231 E_md4hash(plain_pass, mach_password.hash);
233 a.in.server_name = NULL;
234 a.in.account_name = talloc_asprintf(tctx, "%s$", machine_name);
235 a.in.secure_channel_type = SEC_CHAN_BDC;
236 a.in.computer_name = machine_name;
237 a.in.negotiate_flags = &negotiate_flags;
238 a.in.credentials = &credentials3;
239 a.out.return_credentials = &credentials3;
240 a.out.negotiate_flags = &negotiate_flags;
243 creds = netlogon_creds_client_init(tctx, a.in.account_name,
245 &credentials1, &credentials2,
246 &mach_password, &credentials3,
249 torture_assert(tctx, creds != NULL, "memory allocation");
251 torture_comment(tctx, "Testing ServerAuthenticate3\n");
253 status = dcerpc_netr_ServerAuthenticate3(p, tctx, &a);
254 torture_assert_ntstatus_ok(tctx, status, "ServerAuthenticate3");
255 torture_assert(tctx, netlogon_creds_client_check(creds, &credentials3), "Credential chaining failed");
257 torture_comment(tctx, "negotiate_flags=0x%08x\n", negotiate_flags);
259 /* Prove that requesting a challenge again won't break it */
260 status = dcerpc_netr_ServerReqChallenge(p, tctx, &r);
261 torture_assert_ntstatus_ok(tctx, status, "ServerReqChallenge");
268 try a change password for our machine account
270 static bool test_SetPassword(struct torture_context *tctx,
271 struct dcerpc_pipe *p,
272 struct cli_credentials *machine_credentials)
275 struct netr_ServerPasswordSet r;
276 const char *password;
277 struct netlogon_creds_CredentialState *creds;
278 struct netr_Authenticator credential, return_authenticator;
279 struct samr_Password new_password;
281 if (!test_SetupCredentials(p, tctx, machine_credentials, &creds)) {
285 r.in.server_name = talloc_asprintf(tctx, "\\\\%s", dcerpc_server_name(p));
286 r.in.account_name = talloc_asprintf(tctx, "%s$", TEST_MACHINE_NAME);
287 r.in.secure_channel_type = SEC_CHAN_BDC;
288 r.in.computer_name = TEST_MACHINE_NAME;
289 r.in.credential = &credential;
290 r.in.new_password = &new_password;
291 r.out.return_authenticator = &return_authenticator;
293 password = generate_random_str(tctx, 8);
294 E_md4hash(password, new_password.hash);
296 netlogon_creds_des_encrypt(creds, &new_password);
298 torture_comment(tctx, "Testing ServerPasswordSet on machine account\n");
299 torture_comment(tctx, "Changing machine account password to '%s'\n",
302 netlogon_creds_client_authenticator(creds, &credential);
304 status = dcerpc_netr_ServerPasswordSet(p, tctx, &r);
305 torture_assert_ntstatus_ok(tctx, status, "ServerPasswordSet");
307 if (!netlogon_creds_client_check(creds, &r.out.return_authenticator->cred)) {
308 torture_comment(tctx, "Credential chaining failed\n");
311 /* by changing the machine password twice we test the
312 credentials chaining fully, and we verify that the server
313 allows the password to be set to the same value twice in a
314 row (match win2k3) */
315 torture_comment(tctx,
316 "Testing a second ServerPasswordSet on machine account\n");
317 torture_comment(tctx,
318 "Changing machine account password to '%s' (same as previous run)\n", password);
320 netlogon_creds_client_authenticator(creds, &credential);
322 status = dcerpc_netr_ServerPasswordSet(p, tctx, &r);
323 torture_assert_ntstatus_ok(tctx, status, "ServerPasswordSet (2)");
325 if (!netlogon_creds_client_check(creds, &r.out.return_authenticator->cred)) {
326 torture_comment(tctx, "Credential chaining failed\n");
329 cli_credentials_set_password(machine_credentials, password, CRED_SPECIFIED);
332 test_SetupCredentials(p, tctx, machine_credentials, &creds),
333 "ServerPasswordSet failed to actually change the password");
339 generate a random password for password change tests
341 static DATA_BLOB netlogon_very_rand_pass(TALLOC_CTX *mem_ctx, int len)
344 DATA_BLOB password = data_blob_talloc(mem_ctx, NULL, len * 2 /* number of unicode chars */);
345 generate_random_buffer(password.data, password.length);
347 for (i=0; i < len; i++) {
348 if (((uint16_t *)password.data)[i] == 0) {
349 ((uint16_t *)password.data)[i] = 1;
357 try a change password for our machine account
359 static bool test_SetPassword2(struct torture_context *tctx,
360 struct dcerpc_pipe *p,
361 struct cli_credentials *machine_credentials)
364 struct netr_ServerPasswordSet2 r;
365 const char *password;
366 DATA_BLOB new_random_pass;
367 struct netlogon_creds_CredentialState *creds;
368 struct samr_CryptPassword password_buf;
369 struct samr_Password nt_hash;
370 struct netr_Authenticator credential, return_authenticator;
371 struct netr_CryptPassword new_password;
373 if (!test_SetupCredentials(p, tctx, machine_credentials, &creds)) {
377 r.in.server_name = talloc_asprintf(tctx, "\\\\%s", dcerpc_server_name(p));
378 r.in.account_name = talloc_asprintf(tctx, "%s$", TEST_MACHINE_NAME);
379 r.in.secure_channel_type = SEC_CHAN_BDC;
380 r.in.computer_name = TEST_MACHINE_NAME;
381 r.in.credential = &credential;
382 r.in.new_password = &new_password;
383 r.out.return_authenticator = &return_authenticator;
385 password = generate_random_str(tctx, 8);
386 encode_pw_buffer(password_buf.data, password, STR_UNICODE);
387 netlogon_creds_arcfour_crypt(creds, password_buf.data, 516);
389 memcpy(new_password.data, password_buf.data, 512);
390 new_password.length = IVAL(password_buf.data, 512);
392 torture_comment(tctx, "Testing ServerPasswordSet2 on machine account\n");
393 torture_comment(tctx, "Changing machine account password to '%s'\n", password);
395 netlogon_creds_client_authenticator(creds, &credential);
397 status = dcerpc_netr_ServerPasswordSet2(p, tctx, &r);
398 torture_assert_ntstatus_ok(tctx, status, "ServerPasswordSet2");
400 if (!netlogon_creds_client_check(creds, &r.out.return_authenticator->cred)) {
401 torture_comment(tctx, "Credential chaining failed\n");
404 cli_credentials_set_password(machine_credentials, password, CRED_SPECIFIED);
406 if (!torture_setting_bool(tctx, "dangerous", false)) {
407 torture_comment(tctx,
408 "Not testing ability to set password to '', enable dangerous tests to perform this test\n");
410 /* by changing the machine password to ""
411 * we check if the server uses password restrictions
412 * for ServerPasswordSet2
413 * (win2k3 accepts "")
416 encode_pw_buffer(password_buf.data, password, STR_UNICODE);
417 netlogon_creds_arcfour_crypt(creds, password_buf.data, 516);
419 memcpy(new_password.data, password_buf.data, 512);
420 new_password.length = IVAL(password_buf.data, 512);
422 torture_comment(tctx,
423 "Testing ServerPasswordSet2 on machine account\n");
424 torture_comment(tctx,
425 "Changing machine account password to '%s'\n", password);
427 netlogon_creds_client_authenticator(creds, &credential);
429 status = dcerpc_netr_ServerPasswordSet2(p, tctx, &r);
430 torture_assert_ntstatus_ok(tctx, status, "ServerPasswordSet2");
432 if (!netlogon_creds_client_check(creds, &r.out.return_authenticator->cred)) {
433 torture_comment(tctx, "Credential chaining failed\n");
436 cli_credentials_set_password(machine_credentials, password, CRED_SPECIFIED);
439 torture_assert(tctx, test_SetupCredentials(p, tctx, machine_credentials, &creds),
440 "ServerPasswordSet failed to actually change the password");
442 /* now try a random password */
443 password = generate_random_str(tctx, 8);
444 encode_pw_buffer(password_buf.data, password, STR_UNICODE);
445 netlogon_creds_arcfour_crypt(creds, password_buf.data, 516);
447 memcpy(new_password.data, password_buf.data, 512);
448 new_password.length = IVAL(password_buf.data, 512);
450 torture_comment(tctx, "Testing second ServerPasswordSet2 on machine account\n");
451 torture_comment(tctx, "Changing machine account password to '%s'\n", password);
453 netlogon_creds_client_authenticator(creds, &credential);
455 status = dcerpc_netr_ServerPasswordSet2(p, tctx, &r);
456 torture_assert_ntstatus_ok(tctx, status, "ServerPasswordSet2 (2)");
458 if (!netlogon_creds_client_check(creds, &r.out.return_authenticator->cred)) {
459 torture_comment(tctx, "Credential chaining failed\n");
462 /* by changing the machine password twice we test the
463 credentials chaining fully, and we verify that the server
464 allows the password to be set to the same value twice in a
465 row (match win2k3) */
466 torture_comment(tctx,
467 "Testing a second ServerPasswordSet2 on machine account\n");
468 torture_comment(tctx,
469 "Changing machine account password to '%s' (same as previous run)\n", password);
471 netlogon_creds_client_authenticator(creds, &credential);
473 status = dcerpc_netr_ServerPasswordSet2(p, tctx, &r);
474 torture_assert_ntstatus_ok(tctx, status, "ServerPasswordSet (3)");
476 if (!netlogon_creds_client_check(creds, &r.out.return_authenticator->cred)) {
477 torture_comment(tctx, "Credential chaining failed\n");
480 cli_credentials_set_password(machine_credentials, password, CRED_SPECIFIED);
482 torture_assert (tctx,
483 test_SetupCredentials(p, tctx, machine_credentials, &creds),
484 "ServerPasswordSet failed to actually change the password");
486 new_random_pass = netlogon_very_rand_pass(tctx, 128);
488 /* now try a random stream of bytes for a password */
489 set_pw_in_buffer(password_buf.data, &new_random_pass);
491 netlogon_creds_arcfour_crypt(creds, password_buf.data, 516);
493 memcpy(new_password.data, password_buf.data, 512);
494 new_password.length = IVAL(password_buf.data, 512);
496 torture_comment(tctx,
497 "Testing a third ServerPasswordSet2 on machine account, with a compleatly random password\n");
499 netlogon_creds_client_authenticator(creds, &credential);
501 status = dcerpc_netr_ServerPasswordSet2(p, tctx, &r);
502 torture_assert_ntstatus_ok(tctx, status, "ServerPasswordSet (3)");
504 if (!netlogon_creds_client_check(creds, &r.out.return_authenticator->cred)) {
505 torture_comment(tctx, "Credential chaining failed\n");
508 mdfour(nt_hash.hash, new_random_pass.data, new_random_pass.length);
510 cli_credentials_set_password(machine_credentials, NULL, CRED_UNINITIALISED);
511 cli_credentials_set_nt_hash(machine_credentials, &nt_hash, CRED_SPECIFIED);
513 torture_assert (tctx,
514 test_SetupCredentials(p, tctx, machine_credentials, &creds),
515 "ServerPasswordSet failed to actually change the password");
520 static bool test_GetPassword(struct torture_context *tctx,
521 struct dcerpc_pipe *p,
522 struct cli_credentials *machine_credentials)
524 struct netr_ServerPasswordGet r;
525 struct netlogon_creds_CredentialState *creds;
526 struct netr_Authenticator credential;
528 struct netr_Authenticator return_authenticator;
529 struct samr_Password password;
531 if (!test_SetupCredentials(p, tctx, machine_credentials, &creds)) {
535 netlogon_creds_client_authenticator(creds, &credential);
537 r.in.server_name = talloc_asprintf(tctx, "\\\\%s", dcerpc_server_name(p));
538 r.in.account_name = talloc_asprintf(tctx, "%s$", TEST_MACHINE_NAME);
539 r.in.secure_channel_type = SEC_CHAN_BDC;
540 r.in.computer_name = TEST_MACHINE_NAME;
541 r.in.credential = &credential;
542 r.out.return_authenticator = &return_authenticator;
543 r.out.password = &password;
545 status = dcerpc_netr_ServerPasswordGet(p, tctx, &r);
546 torture_assert_ntstatus_ok(tctx, status, "ServerPasswordGet");
551 static bool test_GetTrustPasswords(struct torture_context *tctx,
552 struct dcerpc_pipe *p,
553 struct cli_credentials *machine_credentials)
555 struct netr_ServerTrustPasswordsGet r;
556 struct netlogon_creds_CredentialState *creds;
557 struct netr_Authenticator credential;
559 struct netr_Authenticator return_authenticator;
560 struct samr_Password password, password2;
562 if (!test_SetupCredentials(p, tctx, machine_credentials, &creds)) {
566 netlogon_creds_client_authenticator(creds, &credential);
568 r.in.server_name = talloc_asprintf(tctx, "\\\\%s", dcerpc_server_name(p));
569 r.in.account_name = talloc_asprintf(tctx, "%s$", TEST_MACHINE_NAME);
570 r.in.secure_channel_type = SEC_CHAN_BDC;
571 r.in.computer_name = TEST_MACHINE_NAME;
572 r.in.credential = &credential;
573 r.out.return_authenticator = &return_authenticator;
574 r.out.password = &password;
575 r.out.password2 = &password2;
577 status = dcerpc_netr_ServerTrustPasswordsGet(p, tctx, &r);
578 torture_assert_ntstatus_ok(tctx, status, "ServerTrustPasswordsGet");
584 try a netlogon SamLogon
586 bool test_netlogon_ops(struct dcerpc_pipe *p, struct torture_context *tctx,
587 struct cli_credentials *credentials,
588 struct netlogon_creds_CredentialState *creds)
591 struct netr_LogonSamLogon r;
592 struct netr_Authenticator auth, auth2;
593 union netr_LogonLevel logon;
594 union netr_Validation validation;
595 uint8_t authoritative;
596 struct netr_NetworkInfo ninfo;
597 DATA_BLOB names_blob, chal, lm_resp, nt_resp;
599 int flags = CLI_CRED_NTLM_AUTH;
600 if (lp_client_lanman_auth(tctx->lp_ctx)) {
601 flags |= CLI_CRED_LANMAN_AUTH;
604 if (lp_client_ntlmv2_auth(tctx->lp_ctx)) {
605 flags |= CLI_CRED_NTLMv2_AUTH;
608 cli_credentials_get_ntlm_username_domain(cmdline_credentials, tctx,
609 &ninfo.identity_info.account_name.string,
610 &ninfo.identity_info.domain_name.string);
612 generate_random_buffer(ninfo.challenge,
613 sizeof(ninfo.challenge));
614 chal = data_blob_const(ninfo.challenge,
615 sizeof(ninfo.challenge));
617 names_blob = NTLMv2_generate_names_blob(tctx, cli_credentials_get_workstation(credentials),
618 cli_credentials_get_domain(credentials));
620 status = cli_credentials_get_ntlm_response(cmdline_credentials, tctx,
626 torture_assert_ntstatus_ok(tctx, status, "cli_credentials_get_ntlm_response failed");
628 ninfo.lm.data = lm_resp.data;
629 ninfo.lm.length = lm_resp.length;
631 ninfo.nt.data = nt_resp.data;
632 ninfo.nt.length = nt_resp.length;
634 ninfo.identity_info.parameter_control = 0;
635 ninfo.identity_info.logon_id_low = 0;
636 ninfo.identity_info.logon_id_high = 0;
637 ninfo.identity_info.workstation.string = cli_credentials_get_workstation(credentials);
639 logon.network = &ninfo;
641 r.in.server_name = talloc_asprintf(tctx, "\\\\%s", dcerpc_server_name(p));
642 r.in.computer_name = cli_credentials_get_workstation(credentials);
643 r.in.credential = &auth;
644 r.in.return_authenticator = &auth2;
645 r.in.logon_level = 2;
647 r.out.validation = &validation;
648 r.out.authoritative = &authoritative;
650 d_printf("Testing LogonSamLogon with name %s\n", ninfo.identity_info.account_name.string);
654 netlogon_creds_client_authenticator(creds, &auth);
656 r.in.validation_level = i;
658 status = dcerpc_netr_LogonSamLogon(p, tctx, &r);
659 torture_assert_ntstatus_ok(tctx, status, "LogonSamLogon failed");
661 torture_assert(tctx, netlogon_creds_client_check(creds,
662 &r.out.return_authenticator->cred),
663 "Credential chaining failed");
666 r.in.credential = NULL;
670 r.in.validation_level = i;
672 torture_comment(tctx, "Testing SamLogon with validation level %d and a NULL credential\n", i);
674 status = dcerpc_netr_LogonSamLogon(p, tctx, &r);
675 torture_assert_ntstatus_equal(tctx, status, NT_STATUS_INVALID_PARAMETER,
676 "LogonSamLogon expected INVALID_PARAMETER");
684 try a netlogon SamLogon
686 static bool test_SamLogon(struct torture_context *tctx,
687 struct dcerpc_pipe *p,
688 struct cli_credentials *credentials)
690 struct netlogon_creds_CredentialState *creds;
692 if (!test_SetupCredentials(p, tctx, credentials, &creds)) {
696 return test_netlogon_ops(p, tctx, credentials, creds);
699 /* we remember the sequence numbers so we can easily do a DatabaseDelta */
700 static uint64_t sequence_nums[3];
703 try a netlogon DatabaseSync
705 static bool test_DatabaseSync(struct torture_context *tctx,
706 struct dcerpc_pipe *p,
707 struct cli_credentials *machine_credentials)
710 struct netr_DatabaseSync r;
711 struct netlogon_creds_CredentialState *creds;
712 const uint32_t database_ids[] = {SAM_DATABASE_DOMAIN, SAM_DATABASE_BUILTIN, SAM_DATABASE_PRIVS};
714 struct netr_DELTA_ENUM_ARRAY *delta_enum_array = NULL;
715 struct netr_Authenticator credential, return_authenticator;
717 if (!test_SetupCredentials(p, tctx, machine_credentials, &creds)) {
721 ZERO_STRUCT(return_authenticator);
723 r.in.logon_server = talloc_asprintf(tctx, "\\\\%s", dcerpc_server_name(p));
724 r.in.computername = TEST_MACHINE_NAME;
725 r.in.preferredmaximumlength = (uint32_t)-1;
726 r.in.return_authenticator = &return_authenticator;
727 r.out.delta_enum_array = &delta_enum_array;
728 r.out.return_authenticator = &return_authenticator;
730 for (i=0;i<ARRAY_SIZE(database_ids);i++) {
732 uint32_t sync_context = 0;
734 r.in.database_id = database_ids[i];
735 r.in.sync_context = &sync_context;
736 r.out.sync_context = &sync_context;
738 torture_comment(tctx, "Testing DatabaseSync of id %d\n", r.in.database_id);
741 netlogon_creds_client_authenticator(creds, &credential);
743 r.in.credential = &credential;
745 status = dcerpc_netr_DatabaseSync(p, tctx, &r);
746 if (NT_STATUS_EQUAL(status, STATUS_MORE_ENTRIES))
749 /* Native mode servers don't do this */
750 if (NT_STATUS_EQUAL(status, NT_STATUS_NOT_SUPPORTED)) {
753 torture_assert_ntstatus_ok(tctx, status, "DatabaseSync");
755 if (!netlogon_creds_client_check(creds, &r.out.return_authenticator->cred)) {
756 torture_comment(tctx, "Credential chaining failed\n");
759 if (delta_enum_array &&
760 delta_enum_array->num_deltas > 0 &&
761 delta_enum_array->delta_enum[0].delta_type == NETR_DELTA_DOMAIN &&
762 delta_enum_array->delta_enum[0].delta_union.domain) {
763 sequence_nums[r.in.database_id] =
764 delta_enum_array->delta_enum[0].delta_union.domain->sequence_num;
765 torture_comment(tctx, "\tsequence_nums[%d]=%llu\n",
767 (unsigned long long)sequence_nums[r.in.database_id]);
769 } while (NT_STATUS_EQUAL(status, STATUS_MORE_ENTRIES));
777 try a netlogon DatabaseDeltas
779 static bool test_DatabaseDeltas(struct torture_context *tctx,
780 struct dcerpc_pipe *p,
781 struct cli_credentials *machine_credentials)
784 struct netr_DatabaseDeltas r;
785 struct netlogon_creds_CredentialState *creds;
786 struct netr_Authenticator credential;
787 struct netr_Authenticator return_authenticator;
788 struct netr_DELTA_ENUM_ARRAY *delta_enum_array = NULL;
789 const uint32_t database_ids[] = {0, 1, 2};
792 if (!test_SetupCredentials(p, tctx, machine_credentials, &creds)) {
796 r.in.logon_server = talloc_asprintf(tctx, "\\\\%s", dcerpc_server_name(p));
797 r.in.computername = TEST_MACHINE_NAME;
798 r.in.preferredmaximumlength = (uint32_t)-1;
799 ZERO_STRUCT(r.in.return_authenticator);
800 r.out.return_authenticator = &return_authenticator;
801 r.out.delta_enum_array = &delta_enum_array;
803 for (i=0;i<ARRAY_SIZE(database_ids);i++) {
804 r.in.database_id = database_ids[i];
805 r.in.sequence_num = &sequence_nums[r.in.database_id];
807 if (*r.in.sequence_num == 0) continue;
809 *r.in.sequence_num -= 1;
811 torture_comment(tctx, "Testing DatabaseDeltas of id %d at %llu\n",
812 r.in.database_id, (unsigned long long)*r.in.sequence_num);
815 netlogon_creds_client_authenticator(creds, &credential);
817 status = dcerpc_netr_DatabaseDeltas(p, tctx, &r);
818 if (NT_STATUS_EQUAL(status,
819 NT_STATUS_SYNCHRONIZATION_REQUIRED)) {
820 torture_comment(tctx, "not considering %s to be an error\n",
824 if (NT_STATUS_EQUAL(status, STATUS_MORE_ENTRIES))
827 torture_assert_ntstatus_ok(tctx, status, "DatabaseDeltas");
829 if (!netlogon_creds_client_check(creds, &return_authenticator.cred)) {
830 torture_comment(tctx, "Credential chaining failed\n");
833 (*r.in.sequence_num)++;
834 } while (NT_STATUS_EQUAL(status, STATUS_MORE_ENTRIES));
840 static bool test_DatabaseRedo(struct torture_context *tctx,
841 struct dcerpc_pipe *p,
842 struct cli_credentials *machine_credentials)
845 struct netr_DatabaseRedo r;
846 struct netlogon_creds_CredentialState *creds;
847 struct netr_Authenticator credential;
848 struct netr_Authenticator return_authenticator;
849 struct netr_DELTA_ENUM_ARRAY *delta_enum_array = NULL;
850 struct netr_ChangeLogEntry e;
851 struct dom_sid null_sid, *sid;
854 ZERO_STRUCT(null_sid);
856 sid = dom_sid_parse_talloc(tctx, "S-1-5-21-1111111111-2222222222-333333333-500");
867 NTSTATUS expected_error;
868 uint32_t expected_num_results;
869 uint8_t expected_delta_type_1;
870 uint8_t expected_delta_type_2;
874 /* SAM_DATABASE_DOMAIN */
879 .db_index = SAM_DATABASE_DOMAIN,
880 .delta_type = NETR_DELTA_MODIFY_COUNT,
883 .expected_error = NT_STATUS_SYNCHRONIZATION_REQUIRED,
884 .expected_num_results = 0,
885 .comment = "NETR_DELTA_MODIFY_COUNT"
890 .db_index = SAM_DATABASE_DOMAIN,
894 .expected_error = NT_STATUS_OK,
895 .expected_num_results = 1,
896 .expected_delta_type_1 = NETR_DELTA_DOMAIN,
897 .comment = "NULL DELTA"
902 .db_index = SAM_DATABASE_DOMAIN,
903 .delta_type = NETR_DELTA_DOMAIN,
906 .expected_error = NT_STATUS_OK,
907 .expected_num_results = 1,
908 .expected_delta_type_1 = NETR_DELTA_DOMAIN,
909 .comment = "NETR_DELTA_DOMAIN"
912 .rid = DOMAIN_RID_ADMINISTRATOR,
914 .db_index = SAM_DATABASE_DOMAIN,
915 .delta_type = NETR_DELTA_USER,
918 .expected_error = NT_STATUS_OK,
919 .expected_num_results = 1,
920 .expected_delta_type_1 = NETR_DELTA_USER,
921 .comment = "NETR_DELTA_USER by rid 500"
924 .rid = DOMAIN_RID_GUEST,
926 .db_index = SAM_DATABASE_DOMAIN,
927 .delta_type = NETR_DELTA_USER,
930 .expected_error = NT_STATUS_OK,
931 .expected_num_results = 1,
932 .expected_delta_type_1 = NETR_DELTA_USER,
933 .comment = "NETR_DELTA_USER by rid 501"
937 .flags = NETR_CHANGELOG_SID_INCLUDED,
938 .db_index = SAM_DATABASE_DOMAIN,
939 .delta_type = NETR_DELTA_USER,
942 .expected_error = NT_STATUS_OK,
943 .expected_num_results = 1,
944 .expected_delta_type_1 = NETR_DELTA_DELETE_USER,
945 .comment = "NETR_DELTA_USER by sid and flags"
949 .flags = NETR_CHANGELOG_SID_INCLUDED,
950 .db_index = SAM_DATABASE_DOMAIN,
951 .delta_type = NETR_DELTA_USER,
954 .expected_error = NT_STATUS_OK,
955 .expected_num_results = 1,
956 .expected_delta_type_1 = NETR_DELTA_DELETE_USER,
957 .comment = "NETR_DELTA_USER by null_sid and flags"
961 .flags = NETR_CHANGELOG_NAME_INCLUDED,
962 .db_index = SAM_DATABASE_DOMAIN,
963 .delta_type = NETR_DELTA_USER,
965 .name = "administrator",
966 .expected_error = NT_STATUS_OK,
967 .expected_num_results = 1,
968 .expected_delta_type_1 = NETR_DELTA_DELETE_USER,
969 .comment = "NETR_DELTA_USER by name 'administrator'"
972 .rid = DOMAIN_RID_ADMINS,
974 .db_index = SAM_DATABASE_DOMAIN,
975 .delta_type = NETR_DELTA_GROUP,
978 .expected_error = NT_STATUS_OK,
979 .expected_num_results = 2,
980 .expected_delta_type_1 = NETR_DELTA_GROUP,
981 .expected_delta_type_2 = NETR_DELTA_GROUP_MEMBER,
982 .comment = "NETR_DELTA_GROUP by rid 512"
985 .rid = DOMAIN_RID_ADMINS,
987 .db_index = SAM_DATABASE_DOMAIN,
988 .delta_type = NETR_DELTA_GROUP_MEMBER,
991 .expected_error = NT_STATUS_OK,
992 .expected_num_results = 2,
993 .expected_delta_type_1 = NETR_DELTA_GROUP,
994 .expected_delta_type_2 = NETR_DELTA_GROUP_MEMBER,
995 .comment = "NETR_DELTA_GROUP_MEMBER by rid 512"
999 /* SAM_DATABASE_BUILTIN */
1004 .db_index = SAM_DATABASE_BUILTIN,
1005 .delta_type = NETR_DELTA_MODIFY_COUNT,
1008 .expected_error = NT_STATUS_SYNCHRONIZATION_REQUIRED,
1009 .expected_num_results = 0,
1010 .comment = "NETR_DELTA_MODIFY_COUNT"
1015 .db_index = SAM_DATABASE_BUILTIN,
1016 .delta_type = NETR_DELTA_DOMAIN,
1019 .expected_error = NT_STATUS_OK,
1020 .expected_num_results = 1,
1021 .expected_delta_type_1 = NETR_DELTA_DOMAIN,
1022 .comment = "NETR_DELTA_DOMAIN"
1025 .rid = DOMAIN_RID_ADMINISTRATOR,
1027 .db_index = SAM_DATABASE_BUILTIN,
1028 .delta_type = NETR_DELTA_USER,
1031 .expected_error = NT_STATUS_OK,
1032 .expected_num_results = 1,
1033 .expected_delta_type_1 = NETR_DELTA_DELETE_USER,
1034 .comment = "NETR_DELTA_USER by rid 500"
1039 .db_index = SAM_DATABASE_BUILTIN,
1040 .delta_type = NETR_DELTA_USER,
1043 .expected_error = NT_STATUS_OK,
1044 .expected_num_results = 1,
1045 .expected_delta_type_1 = NETR_DELTA_DELETE_USER,
1046 .comment = "NETR_DELTA_USER"
1051 .db_index = SAM_DATABASE_BUILTIN,
1052 .delta_type = NETR_DELTA_ALIAS,
1055 .expected_error = NT_STATUS_OK,
1056 .expected_num_results = 2,
1057 .expected_delta_type_1 = NETR_DELTA_ALIAS,
1058 .expected_delta_type_2 = NETR_DELTA_ALIAS_MEMBER,
1059 .comment = "NETR_DELTA_ALIAS by rid 544"
1064 .db_index = SAM_DATABASE_BUILTIN,
1065 .delta_type = NETR_DELTA_ALIAS_MEMBER,
1068 .expected_error = NT_STATUS_OK,
1069 .expected_num_results = 2,
1070 .expected_delta_type_1 = NETR_DELTA_ALIAS,
1071 .expected_delta_type_2 = NETR_DELTA_ALIAS_MEMBER,
1072 .comment = "NETR_DELTA_ALIAS_MEMBER by rid 544"
1077 .db_index = SAM_DATABASE_BUILTIN,
1081 .expected_error = NT_STATUS_OK,
1082 .expected_num_results = 1,
1083 .expected_delta_type_1 = NETR_DELTA_DOMAIN,
1084 .comment = "NULL DELTA by rid 544"
1088 .flags = NETR_CHANGELOG_SID_INCLUDED,
1089 .db_index = SAM_DATABASE_BUILTIN,
1091 .sid = *dom_sid_parse_talloc(tctx, "S-1-5-32-544"),
1093 .expected_error = NT_STATUS_OK,
1094 .expected_num_results = 1,
1095 .expected_delta_type_1 = NETR_DELTA_DOMAIN,
1096 .comment = "NULL DELTA by rid 544 sid S-1-5-32-544 and flags"
1100 .flags = NETR_CHANGELOG_SID_INCLUDED,
1101 .db_index = SAM_DATABASE_BUILTIN,
1102 .delta_type = NETR_DELTA_ALIAS,
1103 .sid = *dom_sid_parse_talloc(tctx, "S-1-5-32-544"),
1105 .expected_error = NT_STATUS_OK,
1106 .expected_num_results = 2,
1107 .expected_delta_type_1 = NETR_DELTA_ALIAS,
1108 .expected_delta_type_2 = NETR_DELTA_ALIAS_MEMBER,
1109 .comment = "NETR_DELTA_ALIAS by rid 544 and sid S-1-5-32-544 and flags"
1113 .flags = NETR_CHANGELOG_SID_INCLUDED,
1114 .db_index = SAM_DATABASE_BUILTIN,
1115 .delta_type = NETR_DELTA_ALIAS,
1116 .sid = *dom_sid_parse_talloc(tctx, "S-1-5-32-544"),
1118 .expected_error = NT_STATUS_OK,
1119 .expected_num_results = 1,
1120 .expected_delta_type_1 = NETR_DELTA_DELETE_ALIAS,
1121 .comment = "NETR_DELTA_ALIAS by sid S-1-5-32-544 and flags"
1124 /* SAM_DATABASE_PRIVS */
1129 .db_index = SAM_DATABASE_PRIVS,
1133 .expected_error = NT_STATUS_ACCESS_DENIED,
1134 .expected_num_results = 0,
1135 .comment = "NULL DELTA"
1140 .db_index = SAM_DATABASE_PRIVS,
1141 .delta_type = NETR_DELTA_MODIFY_COUNT,
1144 .expected_error = NT_STATUS_SYNCHRONIZATION_REQUIRED,
1145 .expected_num_results = 0,
1146 .comment = "NETR_DELTA_MODIFY_COUNT"
1151 .db_index = SAM_DATABASE_PRIVS,
1152 .delta_type = NETR_DELTA_POLICY,
1155 .expected_error = NT_STATUS_OK,
1156 .expected_num_results = 1,
1157 .expected_delta_type_1 = NETR_DELTA_POLICY,
1158 .comment = "NETR_DELTA_POLICY"
1162 .flags = NETR_CHANGELOG_SID_INCLUDED,
1163 .db_index = SAM_DATABASE_PRIVS,
1164 .delta_type = NETR_DELTA_POLICY,
1167 .expected_error = NT_STATUS_OK,
1168 .expected_num_results = 1,
1169 .expected_delta_type_1 = NETR_DELTA_POLICY,
1170 .comment = "NETR_DELTA_POLICY by null sid and flags"
1174 .flags = NETR_CHANGELOG_SID_INCLUDED,
1175 .db_index = SAM_DATABASE_PRIVS,
1176 .delta_type = NETR_DELTA_POLICY,
1177 .sid = *dom_sid_parse_talloc(tctx, "S-1-5-32"),
1179 .expected_error = NT_STATUS_OK,
1180 .expected_num_results = 1,
1181 .expected_delta_type_1 = NETR_DELTA_POLICY,
1182 .comment = "NETR_DELTA_POLICY by sid S-1-5-32 and flags"
1185 .rid = DOMAIN_RID_ADMINISTRATOR,
1187 .db_index = SAM_DATABASE_PRIVS,
1188 .delta_type = NETR_DELTA_ACCOUNT,
1191 .expected_error = NT_STATUS_SYNCHRONIZATION_REQUIRED, /* strange */
1192 .expected_num_results = 0,
1193 .comment = "NETR_DELTA_ACCOUNT by rid 500"
1197 .flags = NETR_CHANGELOG_SID_INCLUDED,
1198 .db_index = SAM_DATABASE_PRIVS,
1199 .delta_type = NETR_DELTA_ACCOUNT,
1200 .sid = *dom_sid_parse_talloc(tctx, "S-1-1-0"),
1202 .expected_error = NT_STATUS_OK,
1203 .expected_num_results = 1,
1204 .expected_delta_type_1 = NETR_DELTA_ACCOUNT,
1205 .comment = "NETR_DELTA_ACCOUNT by sid S-1-1-0 and flags"
1209 .flags = NETR_CHANGELOG_SID_INCLUDED |
1210 NETR_CHANGELOG_IMMEDIATE_REPL_REQUIRED,
1211 .db_index = SAM_DATABASE_PRIVS,
1212 .delta_type = NETR_DELTA_ACCOUNT,
1213 .sid = *dom_sid_parse_talloc(tctx, "S-1-1-0"),
1215 .expected_error = NT_STATUS_OK,
1216 .expected_num_results = 1,
1217 .expected_delta_type_1 = NETR_DELTA_ACCOUNT,
1218 .comment = "NETR_DELTA_ACCOUNT by sid S-1-1-0 and 2 flags"
1222 .flags = NETR_CHANGELOG_SID_INCLUDED |
1223 NETR_CHANGELOG_NAME_INCLUDED,
1224 .db_index = SAM_DATABASE_PRIVS,
1225 .delta_type = NETR_DELTA_ACCOUNT,
1226 .sid = *dom_sid_parse_talloc(tctx, "S-1-1-0"),
1228 .expected_error = NT_STATUS_INVALID_PARAMETER,
1229 .expected_num_results = 0,
1230 .comment = "NETR_DELTA_ACCOUNT by sid S-1-1-0 and invalid flags"
1233 .rid = DOMAIN_RID_ADMINISTRATOR,
1234 .flags = NETR_CHANGELOG_SID_INCLUDED,
1235 .db_index = SAM_DATABASE_PRIVS,
1236 .delta_type = NETR_DELTA_ACCOUNT,
1239 .expected_error = NT_STATUS_OK,
1240 .expected_num_results = 1,
1241 .expected_delta_type_1 = NETR_DELTA_DELETE_ACCOUNT,
1242 .comment = "NETR_DELTA_ACCOUNT by rid 500, sid and flags"
1246 .flags = NETR_CHANGELOG_NAME_INCLUDED,
1247 .db_index = SAM_DATABASE_PRIVS,
1248 .delta_type = NETR_DELTA_SECRET,
1250 .name = "IsurelydontexistIhope",
1251 .expected_error = NT_STATUS_OK,
1252 .expected_num_results = 1,
1253 .expected_delta_type_1 = NETR_DELTA_DELETE_SECRET,
1254 .comment = "NETR_DELTA_SECRET by name 'IsurelydontexistIhope' and flags"
1258 .flags = NETR_CHANGELOG_NAME_INCLUDED,
1259 .db_index = SAM_DATABASE_PRIVS,
1260 .delta_type = NETR_DELTA_SECRET,
1262 .name = "G$BCKUPKEY_P",
1263 .expected_error = NT_STATUS_OK,
1264 .expected_num_results = 1,
1265 .expected_delta_type_1 = NETR_DELTA_SECRET,
1266 .comment = "NETR_DELTA_SECRET by name 'G$BCKUPKEY_P' and flags"
1270 ZERO_STRUCT(return_authenticator);
1272 r.in.logon_server = talloc_asprintf(tctx, "\\\\%s", dcerpc_server_name(p));
1273 r.in.computername = TEST_MACHINE_NAME;
1274 r.in.return_authenticator = &return_authenticator;
1275 r.out.return_authenticator = &return_authenticator;
1276 r.out.delta_enum_array = &delta_enum_array;
1278 for (d=0; d<3; d++) {
1280 const char *database;
1287 database = "BUILTIN";
1296 torture_comment(tctx, "Testing DatabaseRedo\n");
1298 if (!test_SetupCredentials(p, tctx, machine_credentials, &creds)) {
1302 for (i=0;i<ARRAY_SIZE(changes);i++) {
1304 if (d != changes[i].db_index) {
1308 netlogon_creds_client_authenticator(creds, &credential);
1310 r.in.credential = &credential;
1312 e.serial_number1 = 0;
1313 e.serial_number2 = 0;
1314 e.object_rid = changes[i].rid;
1315 e.flags = changes[i].flags;
1316 e.db_index = changes[i].db_index;
1317 e.delta_type = changes[i].delta_type;
1319 switch (changes[i].flags & (NETR_CHANGELOG_NAME_INCLUDED | NETR_CHANGELOG_SID_INCLUDED)) {
1320 case NETR_CHANGELOG_SID_INCLUDED:
1321 e.object.object_sid = changes[i].sid;
1323 case NETR_CHANGELOG_NAME_INCLUDED:
1324 e.object.object_name = changes[i].name;
1330 r.in.change_log_entry = e;
1332 torture_comment(tctx, "Testing DatabaseRedo with database %s and %s\n",
1333 database, changes[i].comment);
1335 status = dcerpc_netr_DatabaseRedo(p, tctx, &r);
1336 if (NT_STATUS_EQUAL(status, NT_STATUS_NOT_SUPPORTED)) {
1340 torture_assert_ntstatus_equal(tctx, status, changes[i].expected_error, changes[i].comment);
1341 if (delta_enum_array) {
1342 torture_assert_int_equal(tctx,
1343 delta_enum_array->num_deltas,
1344 changes[i].expected_num_results,
1345 changes[i].comment);
1346 if (delta_enum_array->num_deltas > 0) {
1347 torture_assert_int_equal(tctx,
1348 delta_enum_array->delta_enum[0].delta_type,
1349 changes[i].expected_delta_type_1,
1350 changes[i].comment);
1352 if (delta_enum_array->num_deltas > 1) {
1353 torture_assert_int_equal(tctx,
1354 delta_enum_array->delta_enum[1].delta_type,
1355 changes[i].expected_delta_type_2,
1356 changes[i].comment);
1360 if (!netlogon_creds_client_check(creds, &return_authenticator.cred)) {
1361 torture_comment(tctx, "Credential chaining failed\n");
1362 if (!test_SetupCredentials(p, tctx, machine_credentials, &creds)) {
1374 try a netlogon AccountDeltas
1376 static bool test_AccountDeltas(struct torture_context *tctx,
1377 struct dcerpc_pipe *p,
1378 struct cli_credentials *machine_credentials)
1381 struct netr_AccountDeltas r;
1382 struct netlogon_creds_CredentialState *creds;
1384 struct netr_AccountBuffer buffer;
1385 uint32_t count_returned = 0;
1386 uint32_t total_entries = 0;
1387 struct netr_UAS_INFO_0 recordid;
1388 struct netr_Authenticator return_authenticator;
1390 if (!test_SetupCredentials(p, tctx, machine_credentials, &creds)) {
1394 ZERO_STRUCT(return_authenticator);
1396 r.in.logon_server = talloc_asprintf(tctx, "\\\\%s", dcerpc_server_name(p));
1397 r.in.computername = TEST_MACHINE_NAME;
1398 r.in.return_authenticator = &return_authenticator;
1399 netlogon_creds_client_authenticator(creds, &r.in.credential);
1400 ZERO_STRUCT(r.in.uas);
1403 r.in.buffersize=100;
1404 r.out.buffer = &buffer;
1405 r.out.count_returned = &count_returned;
1406 r.out.total_entries = &total_entries;
1407 r.out.recordid = &recordid;
1408 r.out.return_authenticator = &return_authenticator;
1410 /* w2k3 returns "NOT IMPLEMENTED" for this call */
1411 status = dcerpc_netr_AccountDeltas(p, tctx, &r);
1412 torture_assert_ntstatus_equal(tctx, status, NT_STATUS_NOT_IMPLEMENTED, "AccountDeltas");
1418 try a netlogon AccountSync
1420 static bool test_AccountSync(struct torture_context *tctx, struct dcerpc_pipe *p,
1421 struct cli_credentials *machine_credentials)
1424 struct netr_AccountSync r;
1425 struct netlogon_creds_CredentialState *creds;
1427 struct netr_AccountBuffer buffer;
1428 uint32_t count_returned = 0;
1429 uint32_t total_entries = 0;
1430 uint32_t next_reference = 0;
1431 struct netr_UAS_INFO_0 recordid;
1432 struct netr_Authenticator return_authenticator;
1434 ZERO_STRUCT(recordid);
1435 ZERO_STRUCT(return_authenticator);
1437 if (!test_SetupCredentials(p, tctx, machine_credentials, &creds)) {
1441 r.in.logon_server = talloc_asprintf(tctx, "\\\\%s", dcerpc_server_name(p));
1442 r.in.computername = TEST_MACHINE_NAME;
1443 r.in.return_authenticator = &return_authenticator;
1444 netlogon_creds_client_authenticator(creds, &r.in.credential);
1445 r.in.recordid = &recordid;
1448 r.in.buffersize=100;
1449 r.out.buffer = &buffer;
1450 r.out.count_returned = &count_returned;
1451 r.out.total_entries = &total_entries;
1452 r.out.next_reference = &next_reference;
1453 r.out.recordid = &recordid;
1454 r.out.return_authenticator = &return_authenticator;
1456 /* w2k3 returns "NOT IMPLEMENTED" for this call */
1457 status = dcerpc_netr_AccountSync(p, tctx, &r);
1458 torture_assert_ntstatus_equal(tctx, status, NT_STATUS_NOT_IMPLEMENTED, "AccountSync");
1464 try a netlogon GetDcName
1466 static bool test_GetDcName(struct torture_context *tctx,
1467 struct dcerpc_pipe *p)
1470 struct netr_GetDcName r;
1471 const char *dcname = NULL;
1473 r.in.logon_server = talloc_asprintf(tctx, "\\\\%s", dcerpc_server_name(p));
1474 r.in.domainname = lp_workgroup(tctx->lp_ctx);
1475 r.out.dcname = &dcname;
1477 status = dcerpc_netr_GetDcName(p, tctx, &r);
1478 torture_assert_ntstatus_ok(tctx, status, "GetDcName");
1479 torture_assert_werr_ok(tctx, r.out.result, "GetDcName");
1481 torture_comment(tctx, "\tDC is at '%s'\n", dcname);
1487 try a netlogon LogonControl
1489 static bool test_LogonControl(struct torture_context *tctx,
1490 struct dcerpc_pipe *p)
1493 struct netr_LogonControl r;
1494 union netr_CONTROL_QUERY_INFORMATION info;
1497 r.in.logon_server = talloc_asprintf(tctx, "\\\\%s", dcerpc_server_name(p));
1498 r.in.function_code = 1;
1504 torture_comment(tctx, "Testing LogonControl level %d\n", i);
1506 status = dcerpc_netr_LogonControl(p, tctx, &r);
1507 torture_assert_ntstatus_ok(tctx, status, "LogonControl");
1515 try a netlogon GetAnyDCName
1517 static bool test_GetAnyDCName(struct torture_context *tctx,
1518 struct dcerpc_pipe *p)
1521 struct netr_GetAnyDCName r;
1522 const char *dcname = NULL;
1524 r.in.logon_server = talloc_asprintf(tctx, "\\\\%s", dcerpc_server_name(p));
1525 r.in.domainname = lp_workgroup(tctx->lp_ctx);
1526 r.out.dcname = &dcname;
1528 status = dcerpc_netr_GetAnyDCName(p, tctx, &r);
1529 torture_assert_ntstatus_ok(tctx, status, "GetAnyDCName");
1530 torture_assert_werr_ok(tctx, r.out.result, "GetAnyDCName");
1533 torture_comment(tctx, "\tDC is at '%s'\n", dcname);
1541 try a netlogon LogonControl2
1543 static bool test_LogonControl2(struct torture_context *tctx,
1544 struct dcerpc_pipe *p)
1547 struct netr_LogonControl2 r;
1548 union netr_CONTROL_DATA_INFORMATION data;
1549 union netr_CONTROL_QUERY_INFORMATION query;
1552 data.domain = lp_workgroup(tctx->lp_ctx);
1554 r.in.logon_server = talloc_asprintf(tctx, "\\\\%s", dcerpc_server_name(p));
1556 r.in.function_code = NETLOGON_CONTROL_REDISCOVER;
1558 r.out.query = &query;
1563 torture_comment(tctx, "Testing LogonControl2 level %d function %d\n",
1564 i, r.in.function_code);
1566 status = dcerpc_netr_LogonControl2(p, tctx, &r);
1567 torture_assert_ntstatus_ok(tctx, status, "LogonControl");
1570 data.domain = lp_workgroup(tctx->lp_ctx);
1572 r.in.function_code = NETLOGON_CONTROL_TC_QUERY;
1578 torture_comment(tctx, "Testing LogonControl2 level %d function %d\n",
1579 i, r.in.function_code);
1581 status = dcerpc_netr_LogonControl2(p, tctx, &r);
1582 torture_assert_ntstatus_ok(tctx, status, "LogonControl");
1585 data.domain = lp_workgroup(tctx->lp_ctx);
1587 r.in.function_code = NETLOGON_CONTROL_TRANSPORT_NOTIFY;
1593 torture_comment(tctx, "Testing LogonControl2 level %d function %d\n",
1594 i, r.in.function_code);
1596 status = dcerpc_netr_LogonControl2(p, tctx, &r);
1597 torture_assert_ntstatus_ok(tctx, status, "LogonControl");
1600 data.debug_level = ~0;
1602 r.in.function_code = NETLOGON_CONTROL_SET_DBFLAG;
1608 torture_comment(tctx, "Testing LogonControl2 level %d function %d\n",
1609 i, r.in.function_code);
1611 status = dcerpc_netr_LogonControl2(p, tctx, &r);
1612 torture_assert_ntstatus_ok(tctx, status, "LogonControl");
1619 try a netlogon DatabaseSync2
1621 static bool test_DatabaseSync2(struct torture_context *tctx,
1622 struct dcerpc_pipe *p,
1623 struct cli_credentials *machine_credentials)
1626 struct netr_DatabaseSync2 r;
1627 struct netr_DELTA_ENUM_ARRAY *delta_enum_array = NULL;
1628 struct netr_Authenticator return_authenticator, credential;
1630 struct netlogon_creds_CredentialState *creds;
1631 const uint32_t database_ids[] = {0, 1, 2};
1634 if (!test_SetupCredentials2(p, tctx, NETLOGON_NEG_AUTH2_FLAGS,
1635 machine_credentials,
1636 SEC_CHAN_BDC, &creds)) {
1640 ZERO_STRUCT(return_authenticator);
1642 r.in.logon_server = talloc_asprintf(tctx, "\\\\%s", dcerpc_server_name(p));
1643 r.in.computername = TEST_MACHINE_NAME;
1644 r.in.preferredmaximumlength = (uint32_t)-1;
1645 r.in.return_authenticator = &return_authenticator;
1646 r.out.return_authenticator = &return_authenticator;
1647 r.out.delta_enum_array = &delta_enum_array;
1649 for (i=0;i<ARRAY_SIZE(database_ids);i++) {
1651 uint32_t sync_context = 0;
1653 r.in.database_id = database_ids[i];
1654 r.in.sync_context = &sync_context;
1655 r.out.sync_context = &sync_context;
1656 r.in.restart_state = 0;
1658 torture_comment(tctx, "Testing DatabaseSync2 of id %d\n", r.in.database_id);
1661 netlogon_creds_client_authenticator(creds, &credential);
1663 r.in.credential = &credential;
1665 status = dcerpc_netr_DatabaseSync2(p, tctx, &r);
1666 if (NT_STATUS_EQUAL(status, STATUS_MORE_ENTRIES))
1669 /* Native mode servers don't do this */
1670 if (NT_STATUS_EQUAL(status, NT_STATUS_NOT_SUPPORTED)) {
1674 torture_assert_ntstatus_ok(tctx, status, "DatabaseSync2");
1676 if (!netlogon_creds_client_check(creds, &r.out.return_authenticator->cred)) {
1677 torture_comment(tctx, "Credential chaining failed\n");
1680 } while (NT_STATUS_EQUAL(status, STATUS_MORE_ENTRIES));
1688 try a netlogon LogonControl2Ex
1690 static bool test_LogonControl2Ex(struct torture_context *tctx,
1691 struct dcerpc_pipe *p)
1694 struct netr_LogonControl2Ex r;
1695 union netr_CONTROL_DATA_INFORMATION data;
1696 union netr_CONTROL_QUERY_INFORMATION query;
1699 data.domain = lp_workgroup(tctx->lp_ctx);
1701 r.in.logon_server = talloc_asprintf(tctx, "\\\\%s", dcerpc_server_name(p));
1703 r.in.function_code = NETLOGON_CONTROL_REDISCOVER;
1705 r.out.query = &query;
1710 torture_comment(tctx, "Testing LogonControl2Ex level %d function %d\n",
1711 i, r.in.function_code);
1713 status = dcerpc_netr_LogonControl2Ex(p, tctx, &r);
1714 torture_assert_ntstatus_ok(tctx, status, "LogonControl");
1717 data.domain = lp_workgroup(tctx->lp_ctx);
1719 r.in.function_code = NETLOGON_CONTROL_TC_QUERY;
1725 torture_comment(tctx, "Testing LogonControl2Ex level %d function %d\n",
1726 i, r.in.function_code);
1728 status = dcerpc_netr_LogonControl2Ex(p, tctx, &r);
1729 torture_assert_ntstatus_ok(tctx, status, "LogonControl");
1732 data.domain = lp_workgroup(tctx->lp_ctx);
1734 r.in.function_code = NETLOGON_CONTROL_TRANSPORT_NOTIFY;
1740 torture_comment(tctx, "Testing LogonControl2Ex level %d function %d\n",
1741 i, r.in.function_code);
1743 status = dcerpc_netr_LogonControl2Ex(p, tctx, &r);
1744 torture_assert_ntstatus_ok(tctx, status, "LogonControl");
1747 data.debug_level = ~0;
1749 r.in.function_code = NETLOGON_CONTROL_SET_DBFLAG;
1755 torture_comment(tctx, "Testing LogonControl2Ex level %d function %d\n",
1756 i, r.in.function_code);
1758 status = dcerpc_netr_LogonControl2Ex(p, tctx, &r);
1759 torture_assert_ntstatus_ok(tctx, status, "LogonControl");
1765 static bool test_netr_DsRGetForestTrustInformation(struct torture_context *tctx,
1766 struct dcerpc_pipe *p, const char *trusted_domain_name)
1769 struct netr_DsRGetForestTrustInformation r;
1770 struct lsa_ForestTrustInformation info, *info_ptr;
1774 r.in.server_name = talloc_asprintf(tctx, "\\\\%s", dcerpc_server_name(p));
1775 r.in.trusted_domain_name = trusted_domain_name;
1777 r.out.forest_trust_info = &info_ptr;
1779 torture_comment(tctx ,"Testing netr_DsRGetForestTrustInformation\n");
1781 status = dcerpc_netr_DsRGetForestTrustInformation(p, tctx, &r);
1782 torture_assert_ntstatus_ok(tctx, status, "DsRGetForestTrustInformation");
1783 torture_assert_werr_ok(tctx, r.out.result, "DsRGetForestTrustInformation");
1789 try a netlogon netr_DsrEnumerateDomainTrusts
1791 static bool test_DsrEnumerateDomainTrusts(struct torture_context *tctx,
1792 struct dcerpc_pipe *p)
1795 struct netr_DsrEnumerateDomainTrusts r;
1796 struct netr_DomainTrustList trusts;
1799 r.in.server_name = talloc_asprintf(tctx, "\\\\%s", dcerpc_server_name(p));
1800 r.in.trust_flags = 0x3f;
1801 r.out.trusts = &trusts;
1803 status = dcerpc_netr_DsrEnumerateDomainTrusts(p, tctx, &r);
1804 torture_assert_ntstatus_ok(tctx, status, "DsrEnumerateDomaintrusts");
1805 torture_assert_werr_ok(tctx, r.out.result, "DsrEnumerateDomaintrusts");
1807 /* when trusted_domain_name is NULL, netr_DsRGetForestTrustInformation
1808 * will show non-forest trusts and all UPN suffixes of the own forest
1809 * as LSA_FOREST_TRUST_TOP_LEVEL_NAME types */
1811 if (r.out.trusts->count) {
1812 if (!test_netr_DsRGetForestTrustInformation(tctx, p, NULL)) {
1817 for (i=0; i<r.out.trusts->count; i++) {
1819 /* get info for transitive forest trusts */
1821 if (r.out.trusts->array[i].trust_attributes & NETR_TRUST_ATTRIBUTE_FOREST_TRANSITIVE) {
1822 if (!test_netr_DsRGetForestTrustInformation(tctx, p,
1823 r.out.trusts->array[i].dns_name)) {
1832 static bool test_netr_NetrEnumerateTrustedDomains(struct torture_context *tctx,
1833 struct dcerpc_pipe *p)
1836 struct netr_NetrEnumerateTrustedDomains r;
1837 struct netr_Blob trusted_domains_blob;
1839 r.in.server_name = talloc_asprintf(tctx, "\\\\%s", dcerpc_server_name(p));
1840 r.out.trusted_domains_blob = &trusted_domains_blob;
1842 status = dcerpc_netr_NetrEnumerateTrustedDomains(p, tctx, &r);
1843 torture_assert_ntstatus_ok(tctx, status, "netr_NetrEnumerateTrustedDomains");
1844 torture_assert_werr_ok(tctx, r.out.result, "NetrEnumerateTrustedDomains");
1849 static bool test_netr_NetrEnumerateTrustedDomainsEx(struct torture_context *tctx,
1850 struct dcerpc_pipe *p)
1853 struct netr_NetrEnumerateTrustedDomainsEx r;
1854 struct netr_DomainTrustList dom_trust_list;
1856 r.in.server_name = talloc_asprintf(tctx, "\\\\%s", dcerpc_server_name(p));
1857 r.out.dom_trust_list = &dom_trust_list;
1859 status = dcerpc_netr_NetrEnumerateTrustedDomainsEx(p, tctx, &r);
1860 torture_assert_ntstatus_ok(tctx, status, "netr_NetrEnumerateTrustedDomainsEx");
1861 torture_assert_werr_ok(tctx, r.out.result, "NetrEnumerateTrustedDomainsEx");
1867 static bool test_netr_DsRGetSiteName(struct dcerpc_pipe *p, struct torture_context *tctx,
1868 const char *computer_name,
1869 const char *expected_site)
1872 struct netr_DsRGetSiteName r;
1873 const char *site = NULL;
1875 if (torture_setting_bool(tctx, "samba4", false))
1876 torture_skip(tctx, "skipping DsRGetSiteName test against Samba4");
1878 r.in.computer_name = computer_name;
1880 torture_comment(tctx, "Testing netr_DsRGetSiteName\n");
1882 status = dcerpc_netr_DsRGetSiteName(p, tctx, &r);
1883 torture_assert_ntstatus_ok(tctx, status, "DsRGetSiteName");
1884 torture_assert_werr_ok(tctx, r.out.result, "DsRGetSiteName");
1885 torture_assert_str_equal(tctx, expected_site, site, "netr_DsRGetSiteName");
1887 r.in.computer_name = talloc_asprintf(tctx, "\\\\%s", computer_name);
1888 torture_comment(tctx,
1889 "Testing netr_DsRGetSiteName with broken computer name: %s\n", r.in.computer_name);
1891 status = dcerpc_netr_DsRGetSiteName(p, tctx, &r);
1892 torture_assert_ntstatus_ok(tctx, status, "DsRGetSiteName");
1893 torture_assert_werr_equal(tctx, r.out.result, WERR_INVALID_COMPUTERNAME, "netr_DsRGetSiteName");
1899 try a netlogon netr_DsRGetDCName
1901 static bool test_netr_DsRGetDCName(struct torture_context *tctx,
1902 struct dcerpc_pipe *p)
1905 struct netr_DsRGetDCName r;
1906 struct netr_DsRGetDCNameInfo *info = NULL;
1908 r.in.server_unc = talloc_asprintf(tctx, "\\\\%s", dcerpc_server_name(p));
1909 r.in.domain_name = talloc_asprintf(tctx, "%s", lp_realm(tctx->lp_ctx));
1910 r.in.domain_guid = NULL;
1911 r.in.site_guid = NULL;
1912 r.in.flags = DS_RETURN_DNS_NAME;
1915 status = dcerpc_netr_DsRGetDCName(p, tctx, &r);
1916 torture_assert_ntstatus_ok(tctx, status, "DsRGetDCName");
1917 torture_assert_werr_ok(tctx, r.out.result, "DsRGetDCName");
1918 return test_netr_DsRGetSiteName(p, tctx,
1920 info->dc_site_name);
1924 try a netlogon netr_DsRGetDCNameEx
1926 static bool test_netr_DsRGetDCNameEx(struct torture_context *tctx,
1927 struct dcerpc_pipe *p)
1930 struct netr_DsRGetDCNameEx r;
1931 struct netr_DsRGetDCNameInfo *info = NULL;
1933 r.in.server_unc = talloc_asprintf(tctx, "\\\\%s", dcerpc_server_name(p));
1934 r.in.domain_name = talloc_asprintf(tctx, "%s", lp_realm(tctx->lp_ctx));
1935 r.in.domain_guid = NULL;
1936 r.in.site_name = NULL;
1937 r.in.flags = DS_RETURN_DNS_NAME;
1940 status = dcerpc_netr_DsRGetDCNameEx(p, tctx, &r);
1941 torture_assert_ntstatus_ok(tctx, status, "netr_DsRGetDCNameEx");
1942 torture_assert_werr_ok(tctx, r.out.result, "netr_DsRGetDCNameEx");
1944 return test_netr_DsRGetSiteName(p, tctx, info->dc_unc,
1945 info->dc_site_name);
1949 try a netlogon netr_DsRGetDCNameEx2
1951 static bool test_netr_DsRGetDCNameEx2(struct torture_context *tctx,
1952 struct dcerpc_pipe *p)
1955 struct netr_DsRGetDCNameEx2 r;
1956 struct netr_DsRGetDCNameInfo *info = NULL;
1958 r.in.server_unc = talloc_asprintf(tctx, "\\\\%s", dcerpc_server_name(p));
1959 r.in.client_account = NULL;
1960 r.in.mask = 0x00000000;
1961 r.in.domain_name = talloc_asprintf(tctx, "%s", lp_realm(tctx->lp_ctx));
1962 r.in.domain_guid = NULL;
1963 r.in.site_name = NULL;
1964 r.in.flags = DS_RETURN_DNS_NAME;
1967 torture_comment(tctx, "Testing netr_DsRGetDCNameEx2 without client account\n");
1969 status = dcerpc_netr_DsRGetDCNameEx2(p, tctx, &r);
1970 torture_assert_ntstatus_ok(tctx, status, "netr_DsRGetDCNameEx2");
1971 torture_assert_werr_ok(tctx, r.out.result, "netr_DsRGetDCNameEx2");
1973 torture_comment(tctx, "Testing netr_DsRGetDCNameEx2 with client acount\n");
1974 r.in.client_account = TEST_MACHINE_NAME"$";
1975 r.in.mask = ACB_SVRTRUST;
1976 r.in.flags = DS_RETURN_FLAT_NAME;
1979 status = dcerpc_netr_DsRGetDCNameEx2(p, tctx, &r);
1980 torture_assert_ntstatus_ok(tctx, status, "netr_DsRGetDCNameEx2");
1981 torture_assert_werr_ok(tctx, r.out.result, "netr_DsRGetDCNameEx2");
1982 return test_netr_DsRGetSiteName(p, tctx, info->dc_unc,
1983 info->dc_site_name);
1986 static bool test_netr_DsrGetDcSiteCoverageW(struct torture_context *tctx,
1987 struct dcerpc_pipe *p)
1990 struct netr_DsrGetDcSiteCoverageW r;
1991 struct DcSitesCtr *ctr = NULL;
1993 r.in.server_name = talloc_asprintf(tctx, "\\\\%s", dcerpc_server_name(p));
1996 status = dcerpc_netr_DsrGetDcSiteCoverageW(p, tctx, &r);
1997 torture_assert_ntstatus_ok(tctx, status, "failed");
1998 torture_assert_werr_ok(tctx, r.out.result, "failed");
2003 static bool test_netr_DsRAddressToSitenamesW(struct torture_context *tctx,
2004 struct dcerpc_pipe *p)
2007 struct netr_DsRAddressToSitenamesW r;
2008 struct netr_DsRAddress addr;
2009 struct netr_DsRAddressToSitenamesWCtr *ctr;
2011 ctr = talloc(tctx, struct netr_DsRAddressToSitenamesWCtr);
2014 addr.buffer = talloc_zero_array(tctx, uint8_t, addr.size);
2016 addr.buffer[0] = 2; /* AF_INET */
2017 addr.buffer[4] = 127;
2022 r.in.server_name = talloc_asprintf(tctx, "\\\\%s", dcerpc_server_name(p));
2024 r.in.addresses = talloc_zero_array(tctx, struct netr_DsRAddress, r.in.count);
2025 r.in.addresses[0] = addr;
2028 status = dcerpc_netr_DsRAddressToSitenamesW(p, tctx, &r);
2029 torture_assert_ntstatus_ok(tctx, status, "failed");
2030 torture_assert_werr_ok(tctx, r.out.result, "failed");
2035 static bool test_netr_DsRAddressToSitenamesExW(struct torture_context *tctx,
2036 struct dcerpc_pipe *p)
2039 struct netr_DsRAddressToSitenamesExW r;
2040 struct netr_DsRAddress addr;
2041 struct netr_DsRAddressToSitenamesExWCtr *ctr;
2043 ctr = talloc(tctx, struct netr_DsRAddressToSitenamesExWCtr);
2046 addr.buffer = talloc_zero_array(tctx, uint8_t, addr.size);
2048 addr.buffer[0] = 2; /* AF_INET */
2049 addr.buffer[4] = 127;
2054 r.in.server_name = talloc_asprintf(tctx, "\\\\%s", dcerpc_server_name(p));
2056 r.in.addresses = talloc_zero_array(tctx, struct netr_DsRAddress, r.in.count);
2057 r.in.addresses[0] = addr;
2060 status = dcerpc_netr_DsRAddressToSitenamesExW(p, tctx, &r);
2061 torture_assert_ntstatus_ok(tctx, status, "failed");
2062 torture_assert_werr_ok(tctx, r.out.result, "failed");
2067 static bool test_netr_ServerGetTrustInfo(struct torture_context *tctx,
2068 struct dcerpc_pipe *p,
2069 struct cli_credentials *machine_credentials)
2072 struct netr_ServerGetTrustInfo r;
2074 struct netr_Authenticator a;
2075 struct netr_Authenticator return_authenticator;
2076 struct samr_Password new_owf_password;
2077 struct samr_Password old_owf_password;
2078 struct netr_TrustInfo *trust_info;
2080 struct netlogon_creds_CredentialState *creds;
2082 if (!test_SetupCredentials3(p, tctx, NETLOGON_NEG_AUTH2_ADS_FLAGS,
2083 machine_credentials, &creds)) {
2087 netlogon_creds_client_authenticator(creds, &a);
2089 r.in.server_name = talloc_asprintf(tctx, "\\\\%s", dcerpc_server_name(p));
2090 r.in.account_name = talloc_asprintf(tctx, "%s$", TEST_MACHINE_NAME);
2091 r.in.secure_channel_type = SEC_CHAN_BDC;
2092 r.in.computer_name = TEST_MACHINE_NAME;
2093 r.in.credential = &a;
2095 r.out.return_authenticator = &return_authenticator;
2096 r.out.new_owf_password = &new_owf_password;
2097 r.out.old_owf_password = &old_owf_password;
2098 r.out.trust_info = &trust_info;
2100 status = dcerpc_netr_ServerGetTrustInfo(p, tctx, &r);
2101 torture_assert_ntstatus_ok(tctx, status, "failed");
2102 torture_assert(tctx, netlogon_creds_client_check(creds, &return_authenticator.cred), "Credential chaining failed");
2108 static bool test_GetDomainInfo(struct torture_context *tctx,
2109 struct dcerpc_pipe *p,
2110 struct cli_credentials *machine_credentials)
2113 struct netr_LogonGetDomainInfo r;
2114 struct netr_DomainQuery1 q1;
2115 struct netr_Authenticator a;
2116 struct netlogon_creds_CredentialState *creds;
2117 union netr_DomainInfo info;
2119 if (!test_SetupCredentials3(p, tctx, NETLOGON_NEG_AUTH2_ADS_FLAGS,
2120 machine_credentials, &creds)) {
2126 netlogon_creds_client_authenticator(creds, &a);
2128 r.in.server_name = talloc_asprintf(tctx, "\\\\%s", dcerpc_server_name(p));
2129 r.in.computer_name = TEST_MACHINE_NAME;
2131 r.in.credential = &a;
2132 r.in.return_authenticator = &a;
2133 r.out.return_authenticator = &a;
2136 r.in.query.query1 = &q1;
2139 /* this should really be the fully qualified name */
2140 q1.workstation_domain = TEST_MACHINE_NAME;
2141 q1.workstation_site = "Default-First-Site-Name";
2142 q1.blob2.length = 0;
2144 q1.blob2.array = NULL;
2145 q1.product.string = "product string";
2147 torture_comment(tctx, "Testing netr_LogonGetDomainInfo\n");
2149 status = dcerpc_netr_LogonGetDomainInfo(p, tctx, &r);
2150 torture_assert_ntstatus_ok(tctx, status, "netr_LogonGetDomainInfo");
2151 torture_assert(tctx, netlogon_creds_client_check(creds, &a.cred), "Credential chaining failed");
2153 torture_comment(tctx, "Testing netr_LogonGetDomainInfo 2nd call\n");
2154 netlogon_creds_client_authenticator(creds, &a);
2156 status = dcerpc_netr_LogonGetDomainInfo(p, tctx, &r);
2157 torture_assert_ntstatus_ok(tctx, status, "netr_LogonGetDomainInfo");
2158 torture_assert(tctx, netlogon_creds_client_check(creds, &a.cred), "Credential chaining failed");
2164 static void async_callback(struct rpc_request *req)
2166 int *counter = (int *)req->async.private_data;
2167 if (NT_STATUS_IS_OK(req->status)) {
2172 static bool test_GetDomainInfo_async(struct torture_context *tctx,
2173 struct dcerpc_pipe *p,
2174 struct cli_credentials *machine_credentials)
2177 struct netr_LogonGetDomainInfo r;
2178 struct netr_DomainQuery1 q1;
2179 struct netr_Authenticator a;
2180 #define ASYNC_COUNT 100
2181 struct netlogon_creds_CredentialState *creds;
2182 struct netlogon_creds_CredentialState *creds_async[ASYNC_COUNT];
2183 struct rpc_request *req[ASYNC_COUNT];
2185 int *async_counter = talloc(tctx, int);
2186 union netr_DomainInfo info;
2188 if (!test_SetupCredentials3(p, tctx, NETLOGON_NEG_AUTH2_ADS_FLAGS,
2189 machine_credentials, &creds)) {
2194 r.in.server_name = talloc_asprintf(tctx, "\\\\%s", dcerpc_server_name(p));
2195 r.in.computer_name = TEST_MACHINE_NAME;
2197 r.in.credential = &a;
2198 r.in.return_authenticator = &a;
2199 r.out.return_authenticator = &a;
2202 r.in.query.query1 = &q1;
2205 /* this should really be the fully qualified name */
2206 q1.workstation_domain = TEST_MACHINE_NAME;
2207 q1.workstation_site = "Default-First-Site-Name";
2208 q1.blob2.length = 0;
2210 q1.blob2.array = NULL;
2211 q1.product.string = "product string";
2213 torture_comment(tctx, "Testing netr_LogonGetDomainInfo - async count %d\n", ASYNC_COUNT);
2217 for (i=0;i<ASYNC_COUNT;i++) {
2218 netlogon_creds_client_authenticator(creds, &a);
2220 creds_async[i] = (struct netlogon_creds_CredentialState *)talloc_memdup(creds, creds, sizeof(*creds));
2221 req[i] = dcerpc_netr_LogonGetDomainInfo_send(p, tctx, &r);
2223 req[i]->async.callback = async_callback;
2224 req[i]->async.private_data = async_counter;
2226 /* even with this flush per request a w2k3 server seems to
2227 clag with multiple outstanding requests. bleergh. */
2228 torture_assert_int_equal(tctx, event_loop_once(dcerpc_event_context(p)), 0,
2229 "event_loop_once failed");
2232 for (i=0;i<ASYNC_COUNT;i++) {
2233 status = dcerpc_ndr_request_recv(req[i]);
2235 torture_assert_ntstatus_ok(tctx, status, "netr_LogonGetDomainInfo_async");
2236 torture_assert_ntstatus_ok(tctx, r.out.result, "netr_LogonGetDomainInfo_async");
2238 torture_assert(tctx, netlogon_creds_client_check(creds_async[i], &a.cred),
2239 "Credential chaining failed at async");
2242 torture_comment(tctx,
2243 "Testing netr_LogonGetDomainInfo - async count %d OK\n", *async_counter);
2245 torture_assert_int_equal(tctx, (*async_counter), ASYNC_COUNT, "int");
2250 static bool test_ManyGetDCName(struct torture_context *tctx,
2251 struct dcerpc_pipe *p)
2254 struct dcerpc_pipe *p2;
2255 struct lsa_ObjectAttribute attr;
2256 struct lsa_QosInfo qos;
2257 struct lsa_OpenPolicy2 o;
2258 struct policy_handle lsa_handle;
2259 struct lsa_DomainList domains;
2261 struct lsa_EnumTrustDom t;
2262 uint32_t resume_handle = 0;
2263 struct netr_GetAnyDCName d;
2264 const char *dcname = NULL;
2268 if (p->conn->transport.transport != NCACN_NP) {
2272 torture_comment(tctx, "Torturing GetDCName\n");
2274 status = dcerpc_secondary_connection(p, &p2, p->binding);
2275 torture_assert_ntstatus_ok(tctx, status, "Failed to create secondary connection");
2277 status = dcerpc_bind_auth_none(p2, &ndr_table_lsarpc);
2278 torture_assert_ntstatus_ok(tctx, status, "Failed to create bind on secondary connection");
2281 qos.impersonation_level = 2;
2282 qos.context_mode = 1;
2283 qos.effective_only = 0;
2286 attr.root_dir = NULL;
2287 attr.object_name = NULL;
2288 attr.attributes = 0;
2289 attr.sec_desc = NULL;
2290 attr.sec_qos = &qos;
2292 o.in.system_name = "\\";
2294 o.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
2295 o.out.handle = &lsa_handle;
2297 status = dcerpc_lsa_OpenPolicy2(p2, tctx, &o);
2298 torture_assert_ntstatus_ok(tctx, status, "OpenPolicy2 failed");
2300 t.in.handle = &lsa_handle;
2301 t.in.resume_handle = &resume_handle;
2302 t.in.max_size = 1000;
2303 t.out.domains = &domains;
2304 t.out.resume_handle = &resume_handle;
2306 status = dcerpc_lsa_EnumTrustDom(p2, tctx, &t);
2308 if ((!NT_STATUS_IS_OK(status) &&
2309 (!NT_STATUS_EQUAL(status, NT_STATUS_NO_MORE_ENTRIES))))
2310 torture_fail(tctx, "Could not list domains");
2314 d.in.logon_server = talloc_asprintf(tctx, "\\\\%s",
2315 dcerpc_server_name(p));
2316 d.out.dcname = &dcname;
2318 for (i=0; i<domains.count * 4; i++) {
2319 struct lsa_DomainInfo *info =
2320 &domains.domains[rand()%domains.count];
2322 d.in.domainname = info->name.string;
2324 status = dcerpc_netr_GetAnyDCName(p, tctx, &d);
2325 torture_assert_ntstatus_ok(tctx, status, "GetAnyDCName");
2327 torture_comment(tctx, "\tDC for domain %s is %s\n", info->name.string,
2328 dcname ? dcname : "unknown");
2334 struct torture_suite *torture_rpc_netlogon(TALLOC_CTX *mem_ctx)
2336 struct torture_suite *suite = torture_suite_create(mem_ctx, "NETLOGON");
2337 struct torture_rpc_tcase *tcase;
2338 struct torture_test *test;
2340 tcase = torture_suite_add_machine_rpc_iface_tcase(suite, "netlogon",
2341 &ndr_table_netlogon, TEST_MACHINE_NAME);
2343 torture_rpc_tcase_add_test(tcase, "LogonUasLogon", test_LogonUasLogon);
2344 torture_rpc_tcase_add_test(tcase, "LogonUasLogoff", test_LogonUasLogoff);
2345 torture_rpc_tcase_add_test_creds(tcase, "SamLogon", test_SamLogon);
2346 torture_rpc_tcase_add_test_creds(tcase, "SetPassword", test_SetPassword);
2347 torture_rpc_tcase_add_test_creds(tcase, "SetPassword2", test_SetPassword2);
2348 torture_rpc_tcase_add_test_creds(tcase, "GetPassword", test_GetPassword);
2349 torture_rpc_tcase_add_test_creds(tcase, "GetTrustPasswords", test_GetTrustPasswords);
2350 torture_rpc_tcase_add_test_creds(tcase, "GetDomainInfo", test_GetDomainInfo);
2351 torture_rpc_tcase_add_test_creds(tcase, "DatabaseSync", test_DatabaseSync);
2352 torture_rpc_tcase_add_test_creds(tcase, "DatabaseDeltas", test_DatabaseDeltas);
2353 torture_rpc_tcase_add_test_creds(tcase, "DatabaseRedo", test_DatabaseRedo);
2354 torture_rpc_tcase_add_test_creds(tcase, "AccountDeltas", test_AccountDeltas);
2355 torture_rpc_tcase_add_test_creds(tcase, "AccountSync", test_AccountSync);
2356 torture_rpc_tcase_add_test(tcase, "GetDcName", test_GetDcName);
2357 torture_rpc_tcase_add_test(tcase, "ManyGetDCName", test_ManyGetDCName);
2358 torture_rpc_tcase_add_test(tcase, "LogonControl", test_LogonControl);
2359 torture_rpc_tcase_add_test(tcase, "GetAnyDCName", test_GetAnyDCName);
2360 torture_rpc_tcase_add_test(tcase, "LogonControl2", test_LogonControl2);
2361 torture_rpc_tcase_add_test_creds(tcase, "DatabaseSync2", test_DatabaseSync2);
2362 torture_rpc_tcase_add_test(tcase, "LogonControl2Ex", test_LogonControl2Ex);
2363 torture_rpc_tcase_add_test(tcase, "DsrEnumerateDomainTrusts", test_DsrEnumerateDomainTrusts);
2364 torture_rpc_tcase_add_test(tcase, "NetrEnumerateTrustedDomains", test_netr_NetrEnumerateTrustedDomains);
2365 torture_rpc_tcase_add_test(tcase, "NetrEnumerateTrustedDomainsEx", test_netr_NetrEnumerateTrustedDomainsEx);
2366 test = torture_rpc_tcase_add_test_creds(tcase, "GetDomainInfo_async", test_GetDomainInfo_async);
2367 test->dangerous = true;
2368 torture_rpc_tcase_add_test(tcase, "DsRGetDCName", test_netr_DsRGetDCName);
2369 torture_rpc_tcase_add_test(tcase, "DsRGetDCNameEx", test_netr_DsRGetDCNameEx);
2370 torture_rpc_tcase_add_test(tcase, "DsRGetDCNameEx2", test_netr_DsRGetDCNameEx2);
2371 torture_rpc_tcase_add_test(tcase, "DsrGetDcSiteCoverageW", test_netr_DsrGetDcSiteCoverageW);
2372 torture_rpc_tcase_add_test(tcase, "DsRAddressToSitenamesW", test_netr_DsRAddressToSitenamesW);
2373 torture_rpc_tcase_add_test(tcase, "DsRAddressToSitenamesExW", test_netr_DsRAddressToSitenamesExW);
2374 torture_rpc_tcase_add_test_creds(tcase, "ServerGetTrustInfo", test_netr_ServerGetTrustInfo);