source4/torture/rpc/samsync.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3
   4    test suite for netlogon rpc operations
   5
   6    Copyright (C) Andrew Tridgell 2003
   7    Copyright (C) Andrew Bartlett <abartlet@samba.org> 2003-2004
   8    Copyright (C) Tim Potter      2003
   9
  10    This program is free software; you can redistribute it and/or modify
  11    it under the terms of the GNU General Public License as published by
  12    the Free Software Foundation; either version 2 of the License, or
  13    (at your option) any later version.
  14
  15    This program is distributed in the hope that it will be useful,
  16    but WITHOUT ANY WARRANTY; without even the implied warranty of
  17    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  18    GNU General Public License for more details.
  19
  20    You should have received a copy of the GNU General Public License
  21    along with this program; if not, write to the Free Software
  22    Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  23 */
  24
  25 #include "includes.h"
  26 #include "librpc/gen_ndr/ndr_netlogon.h"
  27 #include "auth/auth.h"
  28 #include "dlinklist.h"
  29 #include "lib/crypto/crypto.h"
  30
  31 #define TEST_MACHINE_NAME "samsynctest"
  32
  33 /*
  34   try a netlogon SamLogon
  35 */
  36 static NTSTATUS test_SamLogon(struct dcerpc_pipe *p, TALLOC_CTX *mem_ctx,
  37                               struct creds_CredentialState *creds,
  38                               const char *domain, const char *username,
  39                               struct samr_Password *lm_hash,
  40                               struct samr_Password *nt_hash,
  41                               struct netr_SamInfo3 **info3)
  42 {
  43         NTSTATUS status;
  44         struct netr_LogonSamLogon r;
  45         struct netr_Authenticator auth, auth2;
  46         struct netr_NetworkInfo ninfo;
  47
  48         ninfo.identity_info.domain_name.string = domain;
  49         ninfo.identity_info.parameter_control = 0;
  50         ninfo.identity_info.logon_id_low = 0;
  51         ninfo.identity_info.logon_id_high = 0;
  52         ninfo.identity_info.account_name.string = username;
  53         ninfo.identity_info.workstation.string = TEST_MACHINE_NAME;
  54         generate_random_buffer(ninfo.challenge,
  55                                sizeof(ninfo.challenge));
  56         if (nt_hash) {
  57                 ninfo.nt.length = 24;
  58                 ninfo.nt.data = talloc(mem_ctx, 24);
  59                 SMBOWFencrypt(nt_hash->hash, ninfo.challenge, ninfo.nt.data);
  60         } else {
  61                 ninfo.nt.length = 0;
  62                 ninfo.nt.data = NULL;
  63         }
  64
  65         if (lm_hash) {
  66                 ninfo.lm.length = 24;
  67                 ninfo.lm.data = talloc(mem_ctx, 24);
  68                 SMBOWFencrypt(lm_hash->hash, ninfo.challenge, ninfo.lm.data);
  69         } else {
  70                 ninfo.lm.length = 0;
  71                 ninfo.lm.data = NULL;
  72         }
  73
  74         r.in.server_name = talloc_asprintf(mem_ctx, "\\\\%s", dcerpc_server_name(p));
  75         r.in.workstation = TEST_MACHINE_NAME;
  76         r.in.credential = &auth;
  77         r.in.return_authenticator = &auth2;
  78         r.in.logon_level = 2;
  79         r.in.logon.network = &ninfo;
  80
  81         ZERO_STRUCT(auth2);
  82         creds_client_authenticator(creds, &auth);
  83
  84         r.in.validation_level = 3;
  85
  86         status = dcerpc_netr_LogonSamLogon(p, mem_ctx, &r);
  87
  88         if (!creds_client_check(creds, &r.out.return_authenticator->cred)) {
  89                 printf("Credential chaining failed\n");
  90         }
  91
  92         if (info3) {
  93                 *info3 = r.out.validation.sam3;
  94         }
  95
  96         return status;
  97 }
  98
  99 struct samsync_state {
 100 /* we remember the sequence numbers so we can easily do a DatabaseDelta */
 101         uint64_t seq_num[3];
 102         char *domain_name[2];
 103         struct samsync_secret *secrets;
 104         struct samsync_trusted_domain *trusted_domains;
 105         struct creds_CredentialState *creds;
 106         struct policy_handle *connect_handle;
 107         struct policy_handle *domain_handle[2];
 108         struct dom_sid *sid[2];
 109         struct dcerpc_pipe *p;
 110         struct dcerpc_pipe *p_samr;
 111 };
 112
 113 struct samsync_secret {
 114         struct samsync_secret *prev, *next;
 115         DATA_BLOB secret;
 116         char *name;
 117 };
 118
 119 struct samsync_trusted_domain {
 120         struct samsync_trusted_domain *prev, *next;
 121         struct dom_sid *sid;
 122         char *name;
 123 };
 124
 125 static struct policy_handle *samsync_open_domain(TALLOC_CTX *mem_ctx,
 126                                                  struct samsync_state *samsync_state,
 127                                                  const char *domain,
 128                                                  struct dom_sid **sid)
 129 {
 130         struct samr_String name;
 131         struct samr_OpenDomain o;
 132         struct samr_LookupDomain l;
 133         struct policy_handle *domain_handle = talloc_p(mem_ctx, struct policy_handle);
 134         NTSTATUS nt_status;
 135
 136         name.string = domain;
 137         l.in.connect_handle = samsync_state->connect_handle;
 138         l.in.domain = &name;
 139
 140         nt_status = dcerpc_samr_LookupDomain(samsync_state->p_samr, mem_ctx, &l);
 141         if (!NT_STATUS_IS_OK(nt_status)) {
 142                 printf("LookupDomain failed - %s\n", nt_errstr(nt_status));
 143                 return NULL;
 144         }
 145
 146         o.in.connect_handle = samsync_state->connect_handle;
 147         o.in.access_mask = SEC_RIGHTS_MAXIMUM_ALLOWED;
 148         o.in.sid = l.out.sid;
 149         o.out.domain_handle = domain_handle;
 150
 151         if (sid) {
 152                 *sid = l.out.sid;
 153         }
 154
 155         nt_status = dcerpc_samr_OpenDomain(samsync_state->p_samr, mem_ctx, &o);
 156         if (!NT_STATUS_IS_OK(nt_status)) {
 157                 printf("OpenDomain failed - %s\n", nt_errstr(nt_status));
 158                 return NULL;
 159         }
 160
 161         return domain_handle;
 162 }
 163
 164 static BOOL samsync_handle_domain(TALLOC_CTX *mem_ctx, struct samsync_state *samsync_state,
 165                            int database_id, struct netr_DELTA_ENUM *delta)
 166 {
 167         struct netr_DELTA_DOMAIN *domain = delta->delta_union.domain;
 168         struct dom_sid *dom_sid;
 169         samsync_state->seq_num[database_id] =
 170                 domain->sequence_num;
 171         switch (database_id) {
 172         case SAM_DATABASE_DOMAIN:
 173                 break;
 174         case SAM_DATABASE_BUILTIN:
 175                 if (StrCaseCmp("BUILTIN", domain->domain_name.string) != 0) {
 176                         printf("BUILTIN domain has different name: %s\n", domain->domain_name.string);
 177                 }
 178                 break;
 179         case SAM_DATABASE_PRIVS:
 180                 printf("DOMAIN entry on privs DB!\n");
 181                 return False;
 182                 break;
 183         }
 184
 185         if (!samsync_state->domain_name[database_id]) {
 186                 samsync_state->domain_name[database_id] =
 187                         talloc_reference(samsync_state, domain->domain_name.string);
 188         } else {
 189                 if (StrCaseCmp(samsync_state->domain_name[database_id], domain->domain_name.string) != 0) {
 190                         printf("Domain has name varies!: %s != %s\n", samsync_state->domain_name[database_id],
 191                                domain->domain_name.string);
 192                         return False;
 193                 }
 194         }
 195
 196         if (!samsync_state->domain_handle[database_id]) {
 197                 samsync_state->domain_handle[database_id]
 198                         = samsync_open_domain(mem_ctx, samsync_state, samsync_state->domain_name[database_id],
 199                                               &dom_sid);
 200         }
 201         if (samsync_state->domain_handle[database_id]) {
 202                 samsync_state->sid[database_id] = talloc_reference(samsync_state, dom_sid);
 203         }
 204
 205         printf("\tsequence_nums[%d/%s]=%llu\n",
 206                database_id, domain->domain_name.string,
 207                samsync_state->seq_num[database_id]);
 208         return True;
 209 }
 210
 211 static BOOL samsync_handle_policy(TALLOC_CTX *mem_ctx, struct samsync_state *samsync_state,
 212                            int database_id, struct netr_DELTA_ENUM *delta)
 213 {
 214         struct netr_DELTA_POLICY *policy = delta->delta_union.policy;
 215
 216         samsync_state->seq_num[database_id] =
 217                 policy->sequence_num;
 218
 219         if (!samsync_state->domain_name[SAM_DATABASE_DOMAIN]) {
 220                 samsync_state->domain_name[SAM_DATABASE_DOMAIN] =
 221                         talloc_reference(samsync_state, policy->primary_domain_name.string);
 222         } else {
 223                 if (StrCaseCmp(samsync_state->domain_name[SAM_DATABASE_DOMAIN], policy->primary_domain_name.string) != 0) {
 224                         printf("PRIMARY domain has name varies between DOMAIN and POLICY!: %s != %s\n", samsync_state->domain_name[SAM_DATABASE_DOMAIN],
 225                                policy->primary_domain_name.string);
 226                         return False;
 227                 }
 228         }
 229
 230         if (!sid_equal(samsync_state->sid[SAM_DATABASE_DOMAIN], policy->sid)) {
 231                 printf("Domain SID from POLICY (%s) does not match domain sid from SAMR (%s)\n",
 232                        dom_sid_string(mem_ctx, policy->sid), dom_sid_string(mem_ctx, samsync_state->sid[SAM_DATABASE_DOMAIN]));
 233                 return False;
 234         }
 235
 236         printf("\tsequence_nums[%d/PRIVS]=%llu\n",
 237                database_id,
 238                samsync_state->seq_num[database_id]);
 239         return True;
 240 }
 241
 242 #define TEST_INT_EQUAL(i1, i2) do {\
 243         if (i1 != i2) {\
 244               printf("integer mismatch: " #i1 ":%d != " #i2 ": %d\n", \
 245                      i1, i2);\
 246               ret = False;\
 247         } \
 248 } while (0)
 249 #define TEST_TIME_EQUAL(t1, t2) do {\
 250         if (t1 != t2) {\
 251               printf("NTTIME mismatch: " #t1 ":%s != " #t2 ": %s\n", \
 252                      nt_time_string(mem_ctx, t1),  nt_time_string(mem_ctx, t2));\
 253               ret = False;\
 254         } \
 255 } while (0)
 256 #define TEST_STRING_EQUAL(s1, s2) do {\
 257         if (!((!s1.string || s1.string[0]=='\0') && (!s2.string || s2.string[0]=='\0')) \
 258             && strcmp_safe(s1.string, s2.string) != 0) {\
 259               printf("string mismatch: " #s1 ":%s != " #s2 ": %s\n", \
 260                      s1.string, s2.string);\
 261               ret = False;\
 262         } \
 263 } while (0)
 264
 265
 266 static BOOL samsync_handle_user(TALLOC_CTX *mem_ctx, struct samsync_state *samsync_state,
 267                                 int database_id, struct netr_DELTA_ENUM *delta)
 268 {
 269         uint32 rid = delta->delta_id_union.rid;
 270         struct netr_DELTA_USER *user = delta->delta_union.user;
 271         struct netr_SamInfo3 *info3;
 272         struct samr_Password lm_hash;
 273         struct samr_Password nt_hash;
 274         struct samr_Password *lm_hash_p = NULL;
 275         struct samr_Password *nt_hash_p = NULL;
 276         const char *domain = samsync_state->domain_name[database_id];
 277         const char *username = user->account_name.string;
 278         NTSTATUS nt_status;
 279         BOOL ret = True;
 280
 281         struct samr_OpenUser r;
 282         struct samr_QueryUserInfo q;
 283         struct policy_handle user_handle;
 284
 285         if (!samsync_state->domain_name || !samsync_state->domain_handle[database_id]) {
 286                 printf("SamSync needs domain information before the users\n");
 287                 return False;
 288         }
 289
 290         r.in.domain_handle = samsync_state->domain_handle[database_id];
 291         r.in.access_mask = SEC_RIGHTS_MAXIMUM_ALLOWED;
 292         r.in.rid = rid;
 293         r.out.user_handle = &user_handle;
 294
 295         nt_status = dcerpc_samr_OpenUser(samsync_state->p_samr, mem_ctx, &r);
 296         if (!NT_STATUS_IS_OK(nt_status)) {
 297                 printf("OpenUser(%u) failed - %s\n", rid, nt_errstr(nt_status));
 298                 return False;
 299         }
 300
 301         q.in.user_handle = &user_handle;
 302         q.in.level = 21;
 303
 304         nt_status = dcerpc_samr_QueryUserInfo(samsync_state->p_samr, mem_ctx, &q);
 305         if (!test_samr_handle_Close(samsync_state->p_samr, mem_ctx, &user_handle)) {
 306                 return False;
 307         }
 308
 309         if (!NT_STATUS_IS_OK(nt_status)) {
 310                 printf("QueryUserInfo level %u failed - %s\n",
 311                        q.in.level, nt_errstr(nt_status));
 312                 return False;
 313         }
 314
 315         TEST_STRING_EQUAL(q.out.info->info21.account_name, user->account_name);
 316         TEST_STRING_EQUAL(q.out.info->info21.full_name, user->full_name);
 317         TEST_INT_EQUAL(q.out.info->info21.rid, user->rid);
 318         TEST_INT_EQUAL(q.out.info->info21.primary_gid, user->primary_gid);
 319         TEST_STRING_EQUAL(q.out.info->info21.home_directory, user->home_directory);
 320         TEST_STRING_EQUAL(q.out.info->info21.home_drive, user->home_drive);
 321         TEST_STRING_EQUAL(q.out.info->info21.logon_script, user->logon_script);
 322         TEST_STRING_EQUAL(q.out.info->info21.description, user->description);
 323         TEST_STRING_EQUAL(q.out.info->info21.workstations, user->workstations);
 324
 325         TEST_TIME_EQUAL(q.out.info->info21.last_logon, user->last_logon);
 326         TEST_TIME_EQUAL(q.out.info->info21.last_logoff, user->last_logoff);
 327
 328
 329         TEST_INT_EQUAL(q.out.info->info21.logon_hours.units_per_week,
 330                        user->logon_hours.units_per_week);
 331         if (ret) {
 332                 if (memcmp(q.out.info->info21.logon_hours.bitmap, user->logon_hours.bitmap,
 333                            q.out.info->info21.logon_hours.units_per_week/8) != 0) {
 334                         printf("Logon hours mismatch\n");
 335                         ret = False;
 336                 }
 337         }
 338
 339         TEST_INT_EQUAL(q.out.info->info21.bad_password_count,
 340                        user->bad_password_count);
 341         TEST_INT_EQUAL(q.out.info->info21.logon_count,
 342                        user->logon_count);
 343
 344         TEST_TIME_EQUAL(q.out.info->info21.last_password_change,
 345                        user->last_password_change);
 346         TEST_TIME_EQUAL(q.out.info->info21.acct_expiry,
 347                        user->acct_expiry);
 348
 349         TEST_INT_EQUAL(q.out.info->info21.logon_hours.units_per_week,
 350                        user->logon_hours.units_per_week);
 351
 352         TEST_INT_EQUAL(q.out.info->info21.acct_flags, user->acct_flags);
 353         TEST_INT_EQUAL(q.out.info->info21.nt_password_set, user->nt_password_present);
 354         TEST_INT_EQUAL(q.out.info->info21.lm_password_set, user->lm_password_present);
 355         TEST_INT_EQUAL(q.out.info->info21.password_expired, user->password_expired);
 356
 357         TEST_STRING_EQUAL(q.out.info->info21.comment, user->comment);
 358         TEST_STRING_EQUAL(q.out.info->info21.parameters, user->parameters);
 359
 360         TEST_INT_EQUAL(q.out.info->info21.country_code, user->country_code);
 361         TEST_INT_EQUAL(q.out.info->info21.code_page, user->code_page);
 362
 363         TEST_STRING_EQUAL(q.out.info->info21.profile_path, user->profile_path);
 364
 365         if (user->lm_password_present) {
 366                 sam_rid_crypt(rid, user->lmpassword.hash, lm_hash.hash, 0);
 367                 lm_hash_p = &lm_hash;
 368         }
 369         if (user->nt_password_present) {
 370                 sam_rid_crypt(rid, user->ntpassword.hash, nt_hash.hash, 0);
 371                 nt_hash_p = &nt_hash;
 372         }
 373
 374         if (user->user_private_info.SensitiveData) {
 375                 DATA_BLOB data;
 376                 struct netr_USER_KEYS keys;
 377                 data.data = user->user_private_info.SensitiveData;
 378                 data.length = user->user_private_info.DataLength;
 379                 creds_arcfour_crypt(samsync_state->creds, data.data, data.length);
 380 #if 0
 381                 printf("Sensitive Data for %s:\n", username);
 382                 dump_data(0, data.data, data.length);
 383 #endif
 384                 nt_status = ndr_pull_struct_blob(&data, mem_ctx, &keys, (ndr_pull_flags_fn_t)ndr_pull_netr_USER_KEYS);
 385                 if (NT_STATUS_IS_OK(nt_status)) {
 386                         if (keys.keys.keys2.lmpassword.length == 16) {
 387                                 sam_rid_crypt(rid, keys.keys.keys2.lmpassword.pwd.hash, lm_hash.hash, 0);
 388                                 lm_hash_p = &lm_hash;
 389                         }
 390                         if (keys.keys.keys2.ntpassword.length == 16) {
 391                                 sam_rid_crypt(rid, keys.keys.keys2.ntpassword.pwd.hash, nt_hash.hash, 0);
 392                                 nt_hash_p = &nt_hash;
 393                         }
 394                 }
 395
 396         }
 397
 398         if (!lm_hash_p && !nt_hash_p) {
 399                 printf("NO password set for %s\n",
 400                        user->account_name.string);
 401                 return True;
 402         }
 403
 404         nt_status = test_SamLogon(samsync_state->p, mem_ctx, samsync_state->creds,
 405                                   domain,
 406                                   username,
 407                                   lm_hash_p,
 408                                   nt_hash_p,
 409                                   &info3);
 410
 411         if (NT_STATUS_EQUAL(nt_status, NT_STATUS_ACCOUNT_DISABLED)) {
 412                 if (user->acct_flags & ACB_DISABLED) {
 413                         return True;
 414                 }
 415         } else if (NT_STATUS_EQUAL(nt_status, NT_STATUS_NOLOGON_WORKSTATION_TRUST_ACCOUNT)) {
 416                 if (user->acct_flags & ACB_WSTRUST) {
 417                         return True;
 418                 }
 419         } else if (NT_STATUS_EQUAL(nt_status, NT_STATUS_NOLOGON_SERVER_TRUST_ACCOUNT)) {
 420                 if (user->acct_flags & ACB_SVRTRUST) {
 421                         return True;
 422                 }
 423         } else if (NT_STATUS_EQUAL(nt_status, NT_STATUS_NOLOGON_INTERDOMAIN_TRUST_ACCOUNT)) {
 424                 if (user->acct_flags & ACB_DOMTRUST) {
 425                         return True;
 426                 }
 427         } else if (NT_STATUS_EQUAL(nt_status, NT_STATUS_NOLOGON_INTERDOMAIN_TRUST_ACCOUNT)) {
 428                 if (user->acct_flags & ACB_DOMTRUST) {
 429                         return True;
 430                 }
 431         } else if (NT_STATUS_EQUAL(nt_status, NT_STATUS_ACCOUNT_LOCKED_OUT)) {
 432                 if (user->acct_flags & ACB_AUTOLOCK) {
 433                         return True;
 434                 }
 435         } else if (NT_STATUS_IS_OK(nt_status)) {
 436                 TEST_INT_EQUAL(user->rid, info3->base.rid);
 437                 TEST_INT_EQUAL(user->primary_gid, info3->base.primary_gid);
 438                 TEST_INT_EQUAL(user->acct_flags, info3->base.acct_flags);
 439                 TEST_STRING_EQUAL(user->account_name, info3->base.account_name);
 440                 TEST_STRING_EQUAL(user->full_name, info3->base.full_name);
 441                 TEST_STRING_EQUAL(user->logon_script, info3->base.logon_script);
 442                 TEST_STRING_EQUAL(user->profile_path, info3->base.profile_path);
 443                 TEST_STRING_EQUAL(user->home_directory, info3->base.home_directory);
 444                 TEST_STRING_EQUAL(user->home_drive, info3->base.home_drive);
 445                 TEST_STRING_EQUAL(user->logon_script, info3->base.logon_script);
 446
 447
 448                 TEST_TIME_EQUAL(user->last_logon, info3->base.last_logon);
 449                 TEST_TIME_EQUAL(user->acct_expiry, info3->base.acct_expiry);
 450                 TEST_TIME_EQUAL(user->last_password_change, info3->base.last_password_change);
 451
 452                 /* Does the concept of a logoff time ever really
 453                  * exist? (not in any sensible way, according to the
 454                  * doco I read -- abartlet) */
 455
 456                 /* This copes with the two different versions of 0 I see */
 457                 if (!((user->last_logoff == 0)
 458                       && (info3->base.last_logoff == 0x7fffffffffffffffLL))) {
 459                         TEST_TIME_EQUAL(user->last_logoff, info3->base.last_logoff);
 460                 }
 461                 return ret;
 462         } else {
 463                 printf("Could not validate password for user %s\\%s: %s\n",
 464                        domain, username, nt_errstr(nt_status));
 465                 return False;
 466         }
 467         return False;
 468 }
 469
 470 static BOOL samsync_handle_secret(TALLOC_CTX *mem_ctx, struct samsync_state *samsync_state,
 471                                   int database_id, struct netr_DELTA_ENUM *delta)
 472 {
 473         struct netr_DELTA_SECRET *secret = delta->delta_union.secret;
 474         const char *name = delta->delta_id_union.name;
 475         struct samsync_secret *new = talloc_p(samsync_state, struct samsync_secret);
 476
 477         creds_arcfour_crypt(samsync_state->creds, secret->current_cipher.cipher_data,
 478                             secret->current_cipher.maxlen);
 479
 480         creds_arcfour_crypt(samsync_state->creds, secret->old_cipher.cipher_data,
 481                             secret->old_cipher.maxlen);
 482
 483         new->name = talloc_reference(new, name);
 484         new->secret = data_blob_talloc(new, secret->current_cipher.cipher_data, secret->current_cipher.maxlen);
 485
 486         DLIST_ADD(samsync_state->secrets, new);
 487
 488         return True;
 489 }
 490
 491 static BOOL samsync_handle_trusted_domain(TALLOC_CTX *mem_ctx, struct samsync_state *samsync_state,
 492                                           int database_id, struct netr_DELTA_ENUM *delta)
 493 {
 494         struct netr_DELTA_TRUSTED_DOMAIN *trusted_domain = delta->delta_union.trusted_domain;
 495         struct dom_sid *dom_sid = delta->delta_id_union.sid;
 496
 497         struct samsync_trusted_domain *new = talloc_p(samsync_state, struct samsync_trusted_domain);
 498         new->name = talloc_reference(new, trusted_domain->domain_name.string);
 499         new->sid = talloc_reference(new, dom_sid);
 500
 501         DLIST_ADD(samsync_state->trusted_domains, new);
 502
 503         return True;
 504 }
 505
 506 /*
 507   try a netlogon DatabaseSync
 508 */
 509 static BOOL test_DatabaseSync(struct samsync_state *samsync_state,
 510                               TALLOC_CTX *mem_ctx)
 511 {
 512         NTSTATUS status;
 513         struct netr_DatabaseSync r;
 514         const uint32_t database_ids[] = {SAM_DATABASE_DOMAIN, SAM_DATABASE_BUILTIN, SAM_DATABASE_PRIVS};
 515         int i, d;
 516         BOOL ret = True;
 517         struct samsync_trusted_domain *t;
 518         struct samsync_secret *s;
 519
 520         const char *domain, *username;
 521
 522         r.in.logon_server = talloc_asprintf(mem_ctx, "\\\\%s", dcerpc_server_name(samsync_state->p));
 523         r.in.computername = TEST_MACHINE_NAME;
 524         r.in.preferredmaximumlength = (uint32_t)-1;
 525         ZERO_STRUCT(r.in.return_authenticator);
 526
 527         for (i=0;i<ARRAY_SIZE(database_ids);i++) {
 528                 r.in.sync_context = 0;
 529                 r.in.database_id = database_ids[i];
 530
 531                 printf("Testing DatabaseSync of id %d\n", r.in.database_id);
 532
 533                 do {
 534                         creds_client_authenticator(samsync_state->creds, &r.in.credential);
 535
 536                         status = dcerpc_netr_DatabaseSync(samsync_state->p, mem_ctx, &r);
 537                         if (!NT_STATUS_IS_OK(status) &&
 538                             !NT_STATUS_EQUAL(status, STATUS_MORE_ENTRIES)) {
 539                                 printf("DatabaseSync - %s\n", nt_errstr(status));
 540                                 ret = False;
 541                                 break;
 542                         }
 543
 544                         if (!creds_client_check(samsync_state->creds, &r.out.return_authenticator.cred)) {
 545                                 printf("Credential chaining failed\n");
 546                         }
 547
 548                         r.in.sync_context = r.out.sync_context;
 549
 550                         for (d=0; d < r.out.delta_enum_array->num_deltas; d++) {
 551                                 switch (r.out.delta_enum_array->delta_enum[d].delta_type) {
 552                                 case NETR_DELTA_DOMAIN:
 553                                         ret &= samsync_handle_domain(mem_ctx, samsync_state,
 554                                                                      r.in.database_id, &r.out.delta_enum_array->delta_enum[d]);
 555                                         break;
 556                                 case NETR_DELTA_USER:
 557                                         ret &= samsync_handle_user(mem_ctx, samsync_state,
 558                                                                    r.in.database_id, &r.out.delta_enum_array->delta_enum[d]);
 559                                         break;
 560                                 case NETR_DELTA_TRUSTED_DOMAIN:
 561                                         ret &= samsync_handle_trusted_domain(mem_ctx, samsync_state,
 562                                                                              r.in.database_id, &r.out.delta_enum_array->delta_enum[d]);
 563                                         break;
 564                                 case NETR_DELTA_SECRET:
 565                                         ret &= samsync_handle_secret(mem_ctx, samsync_state,
 566                                                                      r.in.database_id, &r.out.delta_enum_array->delta_enum[d]);
 567                                         break;
 568                                 case NETR_DELTA_POLICY:
 569                                         ret &= samsync_handle_policy(mem_ctx, samsync_state,
 570                                                                      r.in.database_id, &r.out.delta_enum_array->delta_enum[d]);
 571                                         break;
 572                                 }
 573                         }
 574                 } while (NT_STATUS_EQUAL(status, STATUS_MORE_ENTRIES));
 575
 576         }
 577
 578         domain = samsync_state->domain_name[SAM_DATABASE_DOMAIN];
 579         if (!domain) {
 580                 printf("Never got a DOMAIN object in samsync!\n");
 581                 return False;
 582         }
 583
 584         username = talloc_asprintf(mem_ctx, "%s$", domain);
 585         for (t=samsync_state->trusted_domains; t; t=t->next) {
 586                 char *secret_name = talloc_asprintf(mem_ctx, "G$$%s", t->name);
 587                 for (s=samsync_state->secrets; s; s=s->next) {
 588                         printf("Checking secret %s against %s\n",
 589                                s->name, secret_name);
 590                         if (StrCaseCmp(s->name, secret_name) == 0) {
 591                                 NTSTATUS nt_status;
 592                                 struct samr_Password nt_hash;
 593                                 mdfour(nt_hash.hash, s->secret.data, s->secret.length);
 594
 595                                 printf("Checking password for %s\\%s\n", t->name, username);
 596                                 nt_status = test_SamLogon(samsync_state->p, mem_ctx, samsync_state->creds,
 597                                                           t->name,
 598                                                           username,
 599                                                           NULL,
 600                                                           &nt_hash,
 601                                                           NULL);
 602                                 if (!NT_STATUS_EQUAL(nt_status, NT_STATUS_NOLOGON_INTERDOMAIN_TRUST_ACCOUNT)) {
 603                                         printf("Could not verify trust password to %s: %s\n",
 604                                                t->name, nt_errstr(nt_status));
 605                                         ret = False;
 606                                 }
 607
 608                                 /* break it */
 609                                 nt_hash.hash[0]++;
 610                                 nt_status = test_SamLogon(samsync_state->p, mem_ctx, samsync_state->creds,
 611                                                           t->name,
 612                                                           username,
 613                                                           NULL,
 614                                                           &nt_hash,
 615                                                           NULL);
 616
 617                                 if (!NT_STATUS_EQUAL(nt_status, NT_STATUS_WRONG_PASSWORD)) {
 618                                         printf("Verifiction of trust password to %s: should have failed (wrong password), instead: %s\n",
 619                                                t->name, nt_errstr(nt_status));
 620                                         ret = False;
 621                                         ret = False;
 622                                 }
 623
 624                                 break;
 625                         }
 626                 }
 627         }
 628         return ret;
 629 }
 630
 631
 632 /*
 633   try a netlogon DatabaseDeltas
 634 */
 635 static BOOL test_DatabaseDeltas(struct samsync_state *samsync_state, TALLOC_CTX *mem_ctx)
 636 {
 637         NTSTATUS status;
 638         struct netr_DatabaseDeltas r;
 639         const uint32_t database_ids[] = {0, 1, 2};
 640         int i;
 641         BOOL ret = True;
 642
 643         r.in.logon_server = talloc_asprintf(mem_ctx, "\\\\%s", dcerpc_server_name(samsync_state->p));
 644         r.in.computername = TEST_MACHINE_NAME;
 645         r.in.preferredmaximumlength = (uint32_t)-1;
 646         ZERO_STRUCT(r.in.return_authenticator);
 647
 648         for (i=0;i<ARRAY_SIZE(database_ids);i++) {
 649                 r.in.database_id = database_ids[i];
 650                 r.in.sequence_num = samsync_state->seq_num[i];
 651
 652                 if (r.in.sequence_num == 0) continue;
 653
 654                 r.in.sequence_num -= 1;
 655
 656
 657                 printf("Testing DatabaseDeltas of id %d at %llu\n",
 658                        r.in.database_id, r.in.sequence_num);
 659
 660                 do {
 661                         creds_client_authenticator(samsync_state->creds, &r.in.credential);
 662
 663                         status = dcerpc_netr_DatabaseDeltas(samsync_state->p, mem_ctx, &r);
 664                         if (!NT_STATUS_IS_OK(status) &&
 665                             !NT_STATUS_EQUAL(status, STATUS_MORE_ENTRIES)) {
 666                                 printf("DatabaseDeltas - %s\n", nt_errstr(status));
 667                                 ret = False;
 668                                 break;
 669                         }
 670
 671                         if (!creds_client_check(samsync_state->creds, &r.out.return_authenticator.cred)) {
 672                                 printf("Credential chaining failed\n");
 673                         }
 674
 675                         r.in.sequence_num++;
 676                 } while (NT_STATUS_EQUAL(status, STATUS_MORE_ENTRIES));
 677         }
 678
 679         return ret;
 680 }
 681
 682
 683 /*
 684   try a netlogon DatabaseSync2
 685 */
 686 static BOOL test_DatabaseSync2(struct dcerpc_pipe *p, TALLOC_CTX *mem_ctx,
 687                                struct creds_CredentialState *creds)
 688 {
 689         NTSTATUS status;
 690         struct netr_DatabaseSync2 r;
 691         const uint32_t database_ids[] = {0, 1, 2};
 692         int i;
 693         BOOL ret = True;
 694
 695         r.in.logon_server = talloc_asprintf(mem_ctx, "\\\\%s", dcerpc_server_name(p));
 696         r.in.computername = TEST_MACHINE_NAME;
 697         r.in.preferredmaximumlength = (uint32_t)-1;
 698         ZERO_STRUCT(r.in.return_authenticator);
 699
 700         for (i=0;i<ARRAY_SIZE(database_ids);i++) {
 701                 r.in.sync_context = 0;
 702                 r.in.database_id = database_ids[i];
 703                 r.in.restart_state = 0;
 704
 705                 printf("Testing DatabaseSync2 of id %d\n", r.in.database_id);
 706
 707                 do {
 708                         creds_client_authenticator(creds, &r.in.credential);
 709
 710                         status = dcerpc_netr_DatabaseSync2(p, mem_ctx, &r);
 711                         if (!NT_STATUS_IS_OK(status) &&
 712                             !NT_STATUS_EQUAL(status, STATUS_MORE_ENTRIES)) {
 713                                 printf("DatabaseSync2 - %s\n", nt_errstr(status));
 714                                 ret = False;
 715                                 break;
 716                         }
 717
 718                         if (!creds_client_check(creds, &r.out.return_authenticator.cred)) {
 719                                 printf("Credential chaining failed\n");
 720                         }
 721
 722                         r.in.sync_context = r.out.sync_context;
 723                 } while (NT_STATUS_EQUAL(status, STATUS_MORE_ENTRIES));
 724         }
 725
 726         return ret;
 727 }
 728
 729
 730
 731 BOOL torture_rpc_samsync(void)
 732 {
 733         NTSTATUS status;
 734         TALLOC_CTX *mem_ctx;
 735         BOOL ret = True;
 736         struct test_join *join_ctx;
 737         const char *machine_password;
 738         const char *binding = lp_parm_string(-1, "torture", "binding");
 739         struct dcerpc_binding b;
 740         struct samr_Connect c;
 741
 742         struct samsync_state *samsync_state;
 743
 744         mem_ctx = talloc_init("torture_rpc_netlogon");
 745
 746         join_ctx = torture_join_domain(TEST_MACHINE_NAME, lp_workgroup(), ACB_SVRTRUST,
 747                                        &machine_password);
 748         if (!join_ctx) {
 749                 printf("Failed to join as BDC\n");
 750                 return False;
 751         }
 752
 753         samsync_state = talloc_zero_p(mem_ctx, struct samsync_state);
 754
 755         samsync_state->p_samr = torture_join_samr_pipe(join_ctx);
 756         samsync_state->connect_handle = talloc_zero_p(samsync_state, struct policy_handle);
 757         c.in.system_name = NULL;
 758         c.in.access_mask = SEC_RIGHTS_MAXIMUM_ALLOWED;
 759         c.out.connect_handle = samsync_state->connect_handle;
 760
 761         status = dcerpc_samr_Connect(samsync_state->p_samr, mem_ctx, &c);
 762         if (!NT_STATUS_IS_OK(status)) {
 763                 printf("samr_Connect failed\n");
 764                 ret = False;
 765                 goto failed;
 766         }
 767
 768         status = dcerpc_parse_binding(mem_ctx, binding, &b);
 769         if (!NT_STATUS_IS_OK(status)) {
 770                 printf("Bad binding string %s\n", binding);
 771                 return False;
 772                 goto failed;
 773         }
 774
 775         b.flags &= ~DCERPC_AUTH_OPTIONS;
 776         b.flags |= DCERPC_SCHANNEL_BDC | DCERPC_SIGN | DCERPC_SCHANNEL_128;
 777
 778         status = dcerpc_pipe_connect_b(&samsync_state->p, &b,
 779                                        DCERPC_NETLOGON_UUID,
 780                                        DCERPC_NETLOGON_VERSION,
 781                                        lp_workgroup(),
 782                                        TEST_MACHINE_NAME,
 783                                        machine_password);
 784
 785         if (!NT_STATUS_IS_OK(status)) {
 786                 ret = False;
 787                 goto failed;
 788         }
 789
 790         status = dcerpc_schannel_creds(samsync_state->p->security_state.generic_state, mem_ctx, &samsync_state->creds);
 791         if (!NT_STATUS_IS_OK(status)) {
 792                 ret = False;
 793         }
 794
 795         if (!test_DatabaseSync(samsync_state, mem_ctx)) {
 796                 ret = False;
 797         }
 798
 799         if (!test_DatabaseDeltas(samsync_state, mem_ctx)) {
 800                 ret = False;
 801         }
 802
 803         if (!test_DatabaseSync2(samsync_state->p, mem_ctx, samsync_state->creds)) {
 804                 ret = False;
 805         }
 806 failed:
 807         torture_rpc_close(samsync_state->p);
 808
 809         torture_leave_domain(join_ctx);
 810
 811         talloc_destroy(mem_ctx);
 812
 813         return ret;
 814 }