2 Unix SMB/CIFS implementation.
4 test suite for netlogon rpc operations
6 Copyright (C) Andrew Tridgell 2003
8 This program is free software; you can redistribute it and/or modify
9 it under the terms of the GNU General Public License as published by
10 the Free Software Foundation; either version 2 of the License, or
11 (at your option) any later version.
13 This program is distributed in the hope that it will be useful,
14 but WITHOUT ANY WARRANTY; without even the implied warranty of
15 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
16 GNU General Public License for more details.
18 You should have received a copy of the GNU General Public License
19 along with this program; if not, write to the Free Software
20 Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
26 static BOOL test_LogonUasLogon(struct dcerpc_pipe *p, TALLOC_CTX *mem_ctx)
29 struct netr_LogonUasLogon r;
31 r.in.server_name = NULL;
32 r.in.username = lp_parm_string(-1, "torture", "username");
33 r.in.workstation = lp_netbios_name();
35 printf("Testing LogonUasLogon\n");
37 status = dcerpc_netr_LogonUasLogon(p, mem_ctx, &r);
38 if (!NT_STATUS_IS_OK(status)) {
39 printf("LogonUasLogon - %s\n", nt_errstr(status));
47 static BOOL test_LogonUasLogoff(struct dcerpc_pipe *p, TALLOC_CTX *mem_ctx)
50 struct netr_LogonUasLogoff r;
52 r.in.server_name = NULL;
53 r.in.username = lp_parm_string(-1, "torture", "username");
54 r.in.workstation = lp_netbios_name();
56 printf("Testing LogonUasLogoff\n");
58 status = dcerpc_netr_LogonUasLogoff(p, mem_ctx, &r);
59 if (!NT_STATUS_IS_OK(status)) {
60 printf("LogonUasLogoff - %s\n", nt_errstr(status));
68 static BOOL test_SetupCredentials(struct dcerpc_pipe *p, TALLOC_CTX *mem_ctx,
69 struct netr_CredentialState *creds)
72 struct netr_ServerReqChallenge r;
73 struct netr_ServerAuthenticate a;
74 const char *plain_pass;
77 printf("Testing ServerReqChallenge\n");
79 r.in.server_name = NULL;
80 r.in.computer_name = lp_netbios_name();
81 generate_random_buffer(r.in.credentials.data, sizeof(r.in.credentials.data), False);
83 status = dcerpc_netr_ServerReqChallenge(p, mem_ctx, &r);
84 if (!NT_STATUS_IS_OK(status)) {
85 printf("ServerReqChallenge - %s\n", nt_errstr(status));
89 plain_pass = secrets_fetch_machine_password();
91 printf("Unable to fetch machine password!\n");
95 E_md4hash(plain_pass, mach_pwd);
97 creds_client_init(creds, &r.in.credentials, &r.out.credentials, mach_pwd,
100 a.in.server_name = NULL;
101 a.in.username = talloc_asprintf(mem_ctx, "%s$", lp_netbios_name());
102 a.in.secure_challenge_type = SEC_CHAN_BDC;
103 a.in.computer_name = lp_netbios_name();
105 printf("Testing ServerAuthenticate\n");
107 status = dcerpc_netr_ServerAuthenticate(p, mem_ctx, &a);
108 if (!NT_STATUS_IS_OK(status)) {
109 printf("ServerAuthenticate - %s\n", nt_errstr(status));
113 if (!creds_client_check(creds, &a.out.credentials)) {
114 printf("Credential chaining failed\n");
122 try a netlogon SamLogon
124 static BOOL test_SamLogon(struct dcerpc_pipe *p, TALLOC_CTX *mem_ctx)
127 struct netr_LogonSamLogon r;
128 struct netr_Authenticator auth, auth2;
129 struct netr_NetworkInfo ninfo;
130 const char *username = lp_parm_string(-1, "torture", "username");
131 const char *password = lp_parm_string(-1, "torture", "password");
132 struct netr_CredentialState creds;
134 if (!test_SetupCredentials(p, mem_ctx, &creds)) {
138 ninfo.logon_info.domain_name.string = lp_workgroup();
139 ninfo.logon_info.parameter_control = 0;
140 ninfo.logon_info.logon_id_low = 0;
141 ninfo.logon_info.logon_id_high = 0;
142 ninfo.logon_info.username.string = username;
143 ninfo.logon_info.workstation.string = lp_netbios_name();
144 generate_random_buffer(ninfo.challenge,
145 sizeof(ninfo.challenge), False);
146 ninfo.nt.length = 24;
147 ninfo.nt.data = talloc(mem_ctx, 24);
148 SMBNTencrypt(password, ninfo.challenge, ninfo.nt.data);
149 ninfo.lm.length = 24;
150 ninfo.lm.data = talloc(mem_ctx, 24);
151 SMBencrypt(password, ninfo.challenge, ninfo.lm.data);
155 creds_client_authenticator(&creds, &auth);
157 r.in.server_name = talloc_asprintf(mem_ctx, "\\\\%s", dcerpc_server_name(p));
158 r.in.workstation = lp_netbios_name();
159 r.in.credential = &auth;
160 r.in.authenticator = &auth2;
161 r.in.logon_level = 2;
162 r.in.logon.network = &ninfo;
163 r.in.validation_level = 2;
165 printf("Testing SamLogon\n");
167 status = dcerpc_netr_LogonSamLogon(p, mem_ctx, &r);
168 if (!NT_STATUS_IS_OK(status)) {
169 printf("LogonSamLogon - %s\n", nt_errstr(status));
173 if (!creds_client_check(&creds, &r.out.authenticator->cred)) {
174 printf("Credential chaining failed\n");
182 try a change password for our machine account
184 static BOOL test_SetPassword(struct dcerpc_pipe *p, TALLOC_CTX *mem_ctx)
187 struct netr_ServerPasswordSet r;
188 const char *password;
189 struct netr_CredentialState creds;
191 if (!test_SetupCredentials(p, mem_ctx, &creds)) {
195 r.in.server_name = talloc_asprintf(mem_ctx, "\\\\%s", dcerpc_server_name(p));
196 r.in.username = talloc_asprintf(mem_ctx, "%s$", lp_netbios_name());
197 r.in.secure_challenge_type = SEC_CHAN_BDC;
198 r.in.computer_name = lp_netbios_name();
200 password = generate_random_str(8);
201 E_md4hash(password, r.in.new_password.data);
203 creds_client_encrypt(&creds, &r.in.new_password);
205 printf("Testing ServerPasswordSet on machine account\n");
207 creds_client_authenticator(&creds, &r.in.credential);
209 status = dcerpc_netr_ServerPasswordSet(p, mem_ctx, &r);
210 if (!NT_STATUS_IS_OK(status)) {
211 printf("ServerPasswordSet - %s\n", nt_errstr(status));
215 if (!secrets_store_machine_password(password)) {
216 printf("Failed to save machine password\n");
219 if (!creds_client_check(&creds, &r.out.return_authenticator.cred)) {
220 printf("Credential chaining failed\n");
223 /* by changing the machine password twice we test the credentials
225 printf("Testing a second ServerPasswordSet on machine account\n");
227 creds_client_authenticator(&creds, &r.in.credential);
229 status = dcerpc_netr_ServerPasswordSet(p, mem_ctx, &r);
230 if (!NT_STATUS_IS_OK(status)) {
231 printf("ServerPasswordSet - %s\n", nt_errstr(status));
235 if (!creds_client_check(&creds, &r.out.return_authenticator.cred)) {
236 printf("Credential chaining failed\n");
243 /* we remember the sequence numbers so we can easily do a DatabaseDelta */
244 static struct ULONG8 sequence_nums[3];
247 try a netlogon DatabaseSync
249 static BOOL test_DatabaseSync(struct dcerpc_pipe *p, TALLOC_CTX *mem_ctx)
252 struct netr_DatabaseSync r;
253 struct netr_CredentialState creds;
254 const uint32 database_ids[] = {0, 1, 2};
258 if (!test_SetupCredentials(p, mem_ctx, &creds)) {
262 r.in.logonserver = talloc_asprintf(mem_ctx, "\\\\%s", dcerpc_server_name(p));
263 r.in.computername = lp_netbios_name();
264 r.in.preferredmaximumlength = (uint32)-1;
265 ZERO_STRUCT(r.in.return_authenticator);
267 for (i=0;i<ARRAY_SIZE(database_ids);i++) {
268 r.in.sync_context = 0;
269 r.in.database_id = database_ids[i];
271 printf("Testing DatabaseSync of id %d\n", r.in.database_id);
274 creds_client_authenticator(&creds, &r.in.credential);
276 status = dcerpc_netr_DatabaseSync(p, mem_ctx, &r);
277 if (!NT_STATUS_IS_OK(status) &&
278 !NT_STATUS_EQUAL(status, STATUS_MORE_ENTRIES)) {
279 printf("DatabaseSync - %s\n", nt_errstr(status));
284 if (!creds_client_check(&creds, &r.out.return_authenticator.cred)) {
285 printf("Credential chaining failed\n");
288 r.in.sync_context = r.out.sync_context;
290 if (r.out.delta_enum_array &&
291 r.out.delta_enum_array->num_deltas > 0 &&
292 r.out.delta_enum_array->delta_enum[0].delta_type == 1 &&
293 r.out.delta_enum_array->delta_enum[0].delta_union.domain) {
294 sequence_nums[r.in.database_id] =
295 r.out.delta_enum_array->delta_enum[0].delta_union.domain->sequence_num;
296 printf("sequence_nums[%d]=0x%08x%08x\n",
298 sequence_nums[r.in.database_id].high,
299 sequence_nums[r.in.database_id].low);
301 } while (NT_STATUS_EQUAL(status, STATUS_MORE_ENTRIES));
309 try a netlogon DatabaseDeltas
311 static BOOL test_DatabaseDeltas(struct dcerpc_pipe *p, TALLOC_CTX *mem_ctx)
314 struct netr_DatabaseDeltas r;
315 struct netr_CredentialState creds;
316 const uint32 database_ids[] = {0, 1, 2};
320 if (!test_SetupCredentials(p, mem_ctx, &creds)) {
324 r.in.logonserver = talloc_asprintf(mem_ctx, "\\\\%s", dcerpc_server_name(p));
325 r.in.computername = lp_netbios_name();
326 r.in.preferredmaximumlength = (uint32)-1;
327 ZERO_STRUCT(r.in.return_authenticator);
329 for (i=0;i<ARRAY_SIZE(database_ids);i++) {
330 r.in.database_id = database_ids[i];
331 r.in.sequence_num = sequence_nums[r.in.database_id];
332 r.in.sequence_num.low -= 1;
334 printf("Testing DatabaseDeltas of id %d at %d\n",
335 r.in.database_id, r.in.sequence_num.low);
338 creds_client_authenticator(&creds, &r.in.credential);
340 status = dcerpc_netr_DatabaseDeltas(p, mem_ctx, &r);
341 if (!NT_STATUS_IS_OK(status) &&
342 !NT_STATUS_EQUAL(status, STATUS_MORE_ENTRIES)) {
343 printf("DatabaseDeltas - %s\n", nt_errstr(status));
348 if (!creds_client_check(&creds, &r.out.return_authenticator.cred)) {
349 printf("Credential chaining failed\n");
352 r.in.sequence_num.low++;
353 r.in.sequence_num.high = 0;
354 } while (NT_STATUS_EQUAL(status, STATUS_MORE_ENTRIES));
361 BOOL torture_rpc_netlogon(int dummy)
364 struct dcerpc_pipe *p;
368 mem_ctx = talloc_init("torture_rpc_netlogon");
370 status = torture_rpc_connection(&p,
371 DCERPC_NETLOGON_NAME,
372 DCERPC_NETLOGON_UUID,
373 DCERPC_NETLOGON_VERSION);
374 if (!NT_STATUS_IS_OK(status)) {
378 p->flags |= DCERPC_DEBUG_PRINT_BOTH;
380 if (!test_LogonUasLogon(p, mem_ctx)) {
384 if (!test_LogonUasLogoff(p, mem_ctx)) {
388 if (!test_SetPassword(p, mem_ctx)) {
392 if (!test_SamLogon(p, mem_ctx)) {
396 if (!test_DatabaseSync(p, mem_ctx)) {
400 if (!test_DatabaseDeltas(p, mem_ctx)) {
404 torture_rpc_close(p);