source4/torture/rpc/netlogon.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3
   4    test suite for netlogon rpc operations
   5
   6    Copyright (C) Andrew Tridgell 2003
   7    Copyright (C) Andrew Bartlett <abartlet@samba.org> 2003-2004
   8    Copyright (C) Tim Potter      2003
   9
  10    This program is free software; you can redistribute it and/or modify
  11    it under the terms of the GNU General Public License as published by
  12    the Free Software Foundation; either version 3 of the License, or
  13    (at your option) any later version.
  14
  15    This program is distributed in the hope that it will be useful,
  16    but WITHOUT ANY WARRANTY; without even the implied warranty of
  17    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  18    GNU General Public License for more details.
  19
  20    You should have received a copy of the GNU General Public License
  21    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  22 */
  23
  24 #include "includes.h"
  25 #include "torture/torture.h"
  26 #include "lib/events/events.h"
  27 #include "auth/auth.h"
  28 #include "auth/gensec/gensec.h"
  29 #include "lib/cmdline/popt_common.h"
  30 #include "torture/rpc/rpc.h"
  31 #include "torture/rpc/netlogon.h"
  32 #include "../lib/crypto/crypto.h"
  33 #include "libcli/auth/libcli_auth.h"
  34 #include "librpc/gen_ndr/ndr_netlogon_c.h"
  35 #include "librpc/gen_ndr/ndr_netlogon.h"
  36 #include "librpc/gen_ndr/ndr_lsa_c.h"
  37 #include "param/param.h"
  38 #include "libcli/security/security.h"
  39
  40 #define TEST_MACHINE_NAME "torturetest"
  41
  42 static bool test_LogonUasLogon(struct torture_context *tctx,
  43                                struct dcerpc_pipe *p)
  44 {
  45         NTSTATUS status;
  46         struct netr_LogonUasLogon r;
  47         struct netr_UasInfo *info = NULL;
  48
  49         r.in.server_name = NULL;
  50         r.in.account_name = cli_credentials_get_username(cmdline_credentials);
  51         r.in.workstation = TEST_MACHINE_NAME;
  52         r.out.info = &info;
  53
  54         status = dcerpc_netr_LogonUasLogon(p, tctx, &r);
  55         torture_assert_ntstatus_ok(tctx, status, "LogonUasLogon");
  56
  57         return true;
  58 }
  59
  60 static bool test_LogonUasLogoff(struct torture_context *tctx,
  61                                 struct dcerpc_pipe *p)
  62 {
  63         NTSTATUS status;
  64         struct netr_LogonUasLogoff r;
  65         struct netr_UasLogoffInfo info;
  66
  67         r.in.server_name = NULL;
  68         r.in.account_name = cli_credentials_get_username(cmdline_credentials);
  69         r.in.workstation = TEST_MACHINE_NAME;
  70         r.out.info = &info;
  71
  72         status = dcerpc_netr_LogonUasLogoff(p, tctx, &r);
  73         torture_assert_ntstatus_ok(tctx, status, "LogonUasLogoff");
  74
  75         return true;
  76 }
  77
  78 static bool test_SetupCredentials(struct dcerpc_pipe *p, struct torture_context *tctx,
  79                                   struct cli_credentials *credentials,
  80                                   struct creds_CredentialState **creds_out)
  81 {
  82         NTSTATUS status;
  83         struct netr_ServerReqChallenge r;
  84         struct netr_ServerAuthenticate a;
  85         struct netr_Credential credentials1, credentials2, credentials3;
  86         struct creds_CredentialState *creds;
  87         const struct samr_Password *mach_password;
  88         const char *machine_name;
  89
  90         mach_password = cli_credentials_get_nt_hash(credentials, tctx);
  91         machine_name = cli_credentials_get_workstation(credentials);
  92
  93         torture_comment(tctx, "Testing ServerReqChallenge\n");
  94
  95         creds = talloc(tctx, struct creds_CredentialState);
  96         torture_assert(tctx, creds != NULL, "memory allocation");
  97
  98         r.in.server_name = NULL;
  99         r.in.computer_name = machine_name;
 100         r.in.credentials = &credentials1;
 101         r.out.return_credentials = &credentials2;
 102
 103         generate_random_buffer(credentials1.data, sizeof(credentials1.data));
 104
 105         status = dcerpc_netr_ServerReqChallenge(p, tctx, &r);
 106         torture_assert_ntstatus_ok(tctx, status, "ServerReqChallenge");
 107
 108         a.in.server_name = NULL;
 109         a.in.account_name = talloc_asprintf(tctx, "%s$", machine_name);
 110         a.in.secure_channel_type = SEC_CHAN_BDC;
 111         a.in.computer_name = machine_name;
 112         a.in.credentials = &credentials3;
 113         a.out.return_credentials = &credentials3;
 114
 115         creds_client_init(creds, &credentials1, &credentials2,
 116                           mach_password, &credentials3,
 117                           0);
 118
 119         torture_comment(tctx, "Testing ServerAuthenticate\n");
 120
 121         status = dcerpc_netr_ServerAuthenticate(p, tctx, &a);
 122
 123         /* This allows the tests to continue against the more fussy windows 2008 */
 124         if (NT_STATUS_EQUAL(status, NT_STATUS_DOWNGRADE_DETECTED)) {
 125                 return test_SetupCredentials2(p, tctx, NETLOGON_NEG_AUTH2_ADS_FLAGS,
 126                                               credentials, SEC_CHAN_BDC, creds_out);
 127         }
 128
 129         torture_assert_ntstatus_ok(tctx, status, "ServerAuthenticate");
 130
 131         torture_assert(tctx, creds_client_check(creds, &credentials3),
 132                        "Credential chaining failed");
 133
 134         *creds_out = creds;
 135         return true;
 136 }
 137
 138 bool test_SetupCredentials2(struct dcerpc_pipe *p, struct torture_context *tctx,
 139                             uint32_t negotiate_flags,
 140                             struct cli_credentials *machine_credentials,
 141                             int sec_chan_type,
 142                             struct creds_CredentialState **creds_out)
 143 {
 144         NTSTATUS status;
 145         struct netr_ServerReqChallenge r;
 146         struct netr_ServerAuthenticate2 a;
 147         struct netr_Credential credentials1, credentials2, credentials3;
 148         struct creds_CredentialState *creds;
 149         const struct samr_Password *mach_password;
 150         const char *machine_name;
 151         const char *plain_pass;
 152
 153         mach_password = cli_credentials_get_nt_hash(machine_credentials, tctx);
 154         machine_name = cli_credentials_get_workstation(machine_credentials);
 155
 156         torture_comment(tctx, "Testing ServerReqChallenge\n");
 157
 158         creds = talloc(tctx, struct creds_CredentialState);
 159         torture_assert(tctx, creds != NULL, "memory allocation");
 160
 161         r.in.server_name = NULL;
 162         r.in.computer_name = machine_name;
 163         r.in.credentials = &credentials1;
 164         r.out.return_credentials = &credentials2;
 165
 166         generate_random_buffer(credentials1.data, sizeof(credentials1.data));
 167
 168         status = dcerpc_netr_ServerReqChallenge(p, tctx, &r);
 169         torture_assert_ntstatus_ok(tctx, status, "ServerReqChallenge");
 170
 171         a.in.server_name = NULL;
 172         a.in.account_name = talloc_asprintf(tctx, "%s$", machine_name);
 173         a.in.secure_channel_type = sec_chan_type;
 174         a.in.computer_name = machine_name;
 175         a.in.negotiate_flags = &negotiate_flags;
 176         a.out.negotiate_flags = &negotiate_flags;
 177         a.in.credentials = &credentials3;
 178         a.out.return_credentials = &credentials3;
 179
 180         creds_client_init(creds, &credentials1, &credentials2,
 181                           mach_password, &credentials3,
 182                           negotiate_flags);
 183
 184         torture_comment(tctx, "Testing ServerAuthenticate2\n");
 185
 186         status = dcerpc_netr_ServerAuthenticate2(p, tctx, &a);
 187         torture_assert_ntstatus_ok(tctx, status, "ServerAuthenticate2");
 188
 189         torture_assert(tctx, creds_client_check(creds, &credentials3),
 190                 "Credential chaining failed");
 191
 192         torture_comment(tctx, "negotiate_flags=0x%08x\n", negotiate_flags);
 193
 194         *creds_out = creds;
 195         return true;
 196 }
 197
 198
 199 static bool test_SetupCredentials3(struct dcerpc_pipe *p, struct torture_context *tctx,
 200                             uint32_t negotiate_flags,
 201                             struct cli_credentials *machine_credentials,
 202                             struct creds_CredentialState **creds_out)
 203 {
 204         NTSTATUS status;
 205         struct netr_ServerReqChallenge r;
 206         struct netr_ServerAuthenticate3 a;
 207         struct netr_Credential credentials1, credentials2, credentials3;
 208         struct creds_CredentialState *creds;
 209         struct samr_Password mach_password;
 210         uint32_t rid;
 211         const char *machine_name;
 212         const char *plain_pass;
 213
 214         machine_name = cli_credentials_get_workstation(machine_credentials);
 215         plain_pass = cli_credentials_get_password(machine_credentials);
 216
 217         torture_comment(tctx, "Testing ServerReqChallenge\n");
 218
 219         creds = talloc(tctx, struct creds_CredentialState);
 220         torture_assert(tctx, creds != NULL, "memory allocation");
 221
 222         r.in.server_name = NULL;
 223         r.in.computer_name = machine_name;
 224         r.in.credentials = &credentials1;
 225         r.out.return_credentials = &credentials2;
 226
 227         generate_random_buffer(credentials1.data, sizeof(credentials1.data));
 228
 229         status = dcerpc_netr_ServerReqChallenge(p, tctx, &r);
 230         torture_assert_ntstatus_ok(tctx, status, "ServerReqChallenge");
 231
 232         E_md4hash(plain_pass, mach_password.hash);
 233
 234         a.in.server_name = NULL;
 235         a.in.account_name = talloc_asprintf(tctx, "%s$", machine_name);
 236         a.in.secure_channel_type = SEC_CHAN_BDC;
 237         a.in.computer_name = machine_name;
 238         a.in.negotiate_flags = &negotiate_flags;
 239         a.in.credentials = &credentials3;
 240         a.out.return_credentials = &credentials3;
 241         a.out.negotiate_flags = &negotiate_flags;
 242         a.out.rid = &rid;
 243
 244         creds_client_init(creds, &credentials1, &credentials2,
 245                           &mach_password, &credentials3,
 246                           negotiate_flags);
 247
 248         torture_comment(tctx, "Testing ServerAuthenticate3\n");
 249
 250         status = dcerpc_netr_ServerAuthenticate3(p, tctx, &a);
 251         torture_assert_ntstatus_ok(tctx, status, "ServerAuthenticate3");
 252         torture_assert(tctx, creds_client_check(creds, &credentials3), "Credential chaining failed");
 253
 254         torture_comment(tctx, "negotiate_flags=0x%08x\n", negotiate_flags);
 255
 256         /* Prove that requesting a challenge again won't break it */
 257         status = dcerpc_netr_ServerReqChallenge(p, tctx, &r);
 258         torture_assert_ntstatus_ok(tctx, status, "ServerReqChallenge");
 259
 260         *creds_out = creds;
 261         return true;
 262 }
 263
 264 /*
 265   try a change password for our machine account
 266 */
 267 static bool test_SetPassword(struct torture_context *tctx,
 268                              struct dcerpc_pipe *p,
 269                              struct cli_credentials *machine_credentials)
 270 {
 271         NTSTATUS status;
 272         struct netr_ServerPasswordSet r;
 273         const char *password;
 274         struct creds_CredentialState *creds;
 275         struct netr_Authenticator credential, return_authenticator;
 276         struct samr_Password new_password;
 277
 278         if (!test_SetupCredentials(p, tctx, machine_credentials, &creds)) {
 279                 return false;
 280         }
 281
 282         r.in.server_name = talloc_asprintf(tctx, "\\\\%s", dcerpc_server_name(p));
 283         r.in.account_name = talloc_asprintf(tctx, "%s$", TEST_MACHINE_NAME);
 284         r.in.secure_channel_type = SEC_CHAN_BDC;
 285         r.in.computer_name = TEST_MACHINE_NAME;
 286         r.in.credential = &credential;
 287         r.in.new_password = &new_password;
 288         r.out.return_authenticator = &return_authenticator;
 289
 290         password = generate_random_str(tctx, 8);
 291         E_md4hash(password, new_password.hash);
 292
 293         creds_des_encrypt(creds, &new_password);
 294
 295         torture_comment(tctx, "Testing ServerPasswordSet on machine account\n");
 296         torture_comment(tctx, "Changing machine account password to '%s'\n",
 297                         password);
 298
 299         creds_client_authenticator(creds, &credential);
 300
 301         status = dcerpc_netr_ServerPasswordSet(p, tctx, &r);
 302         torture_assert_ntstatus_ok(tctx, status, "ServerPasswordSet");
 303
 304         if (!creds_client_check(creds, &r.out.return_authenticator->cred)) {
 305                 torture_comment(tctx, "Credential chaining failed\n");
 306         }
 307
 308         /* by changing the machine password twice we test the
 309            credentials chaining fully, and we verify that the server
 310            allows the password to be set to the same value twice in a
 311            row (match win2k3) */
 312         torture_comment(tctx,
 313                 "Testing a second ServerPasswordSet on machine account\n");
 314         torture_comment(tctx,
 315                 "Changing machine account password to '%s' (same as previous run)\n", password);
 316
 317         creds_client_authenticator(creds, &credential);
 318
 319         status = dcerpc_netr_ServerPasswordSet(p, tctx, &r);
 320         torture_assert_ntstatus_ok(tctx, status, "ServerPasswordSet (2)");
 321
 322         if (!creds_client_check(creds, &r.out.return_authenticator->cred)) {
 323                 torture_comment(tctx, "Credential chaining failed\n");
 324         }
 325
 326         cli_credentials_set_password(machine_credentials, password, CRED_SPECIFIED);
 327
 328         torture_assert(tctx,
 329                 test_SetupCredentials(p, tctx, machine_credentials, &creds),
 330                 "ServerPasswordSet failed to actually change the password");
 331
 332         return true;
 333 }
 334
 335 /*
 336   generate a random password for password change tests
 337 */
 338 static DATA_BLOB netlogon_very_rand_pass(TALLOC_CTX *mem_ctx, int len)
 339 {
 340         int i;
 341         DATA_BLOB password = data_blob_talloc(mem_ctx, NULL, len * 2 /* number of unicode chars */);
 342         generate_random_buffer(password.data, password.length);
 343
 344         for (i=0; i < len; i++) {
 345                 if (((uint16_t *)password.data)[i] == 0) {
 346                         ((uint16_t *)password.data)[i] = 1;
 347                 }
 348         }
 349
 350         return password;
 351 }
 352
 353 /*
 354   try a change password for our machine account
 355 */
 356 static bool test_SetPassword2(struct torture_context *tctx,
 357                               struct dcerpc_pipe *p,
 358                               struct cli_credentials *machine_credentials)
 359 {
 360         NTSTATUS status;
 361         struct netr_ServerPasswordSet2 r;
 362         const char *password;
 363         DATA_BLOB new_random_pass;
 364         struct creds_CredentialState *creds;
 365         struct samr_CryptPassword password_buf;
 366         struct samr_Password nt_hash;
 367         struct netr_Authenticator credential, return_authenticator;
 368         struct netr_CryptPassword new_password;
 369
 370         if (!test_SetupCredentials(p, tctx, machine_credentials, &creds)) {
 371                 return false;
 372         }
 373
 374         r.in.server_name = talloc_asprintf(tctx, "\\\\%s", dcerpc_server_name(p));
 375         r.in.account_name = talloc_asprintf(tctx, "%s$", TEST_MACHINE_NAME);
 376         r.in.secure_channel_type = SEC_CHAN_BDC;
 377         r.in.computer_name = TEST_MACHINE_NAME;
 378         r.in.credential = &credential;
 379         r.in.new_password = &new_password;
 380         r.out.return_authenticator = &return_authenticator;
 381
 382         password = generate_random_str(tctx, 8);
 383         encode_pw_buffer(password_buf.data, password, STR_UNICODE);
 384         creds_arcfour_crypt(creds, password_buf.data, 516);
 385
 386         memcpy(new_password.data, password_buf.data, 512);
 387         new_password.length = IVAL(password_buf.data, 512);
 388
 389         torture_comment(tctx, "Testing ServerPasswordSet2 on machine account\n");
 390         torture_comment(tctx, "Changing machine account password to '%s'\n", password);
 391
 392         creds_client_authenticator(creds, &credential);
 393
 394         status = dcerpc_netr_ServerPasswordSet2(p, tctx, &r);
 395         torture_assert_ntstatus_ok(tctx, status, "ServerPasswordSet2");
 396
 397         if (!creds_client_check(creds, &r.out.return_authenticator->cred)) {
 398                 torture_comment(tctx, "Credential chaining failed\n");
 399         }
 400
 401         cli_credentials_set_password(machine_credentials, password, CRED_SPECIFIED);
 402
 403         if (!torture_setting_bool(tctx, "dangerous", false)) {
 404                 torture_comment(tctx,
 405                         "Not testing ability to set password to '', enable dangerous tests to perform this test\n");
 406         } else {
 407                 /* by changing the machine password to ""
 408                  * we check if the server uses password restrictions
 409                  * for ServerPasswordSet2
 410                  * (win2k3 accepts "")
 411                  */
 412                 password = "";
 413                 encode_pw_buffer(password_buf.data, password, STR_UNICODE);
 414                 creds_arcfour_crypt(creds, password_buf.data, 516);
 415
 416                 memcpy(new_password.data, password_buf.data, 512);
 417                 new_password.length = IVAL(password_buf.data, 512);
 418
 419                 torture_comment(tctx,
 420                         "Testing ServerPasswordSet2 on machine account\n");
 421                 torture_comment(tctx,
 422                         "Changing machine account password to '%s'\n", password);
 423
 424                 creds_client_authenticator(creds, &credential);
 425
 426                 status = dcerpc_netr_ServerPasswordSet2(p, tctx, &r);
 427                 torture_assert_ntstatus_ok(tctx, status, "ServerPasswordSet2");
 428
 429                 if (!creds_client_check(creds, &r.out.return_authenticator->cred)) {
 430                         torture_comment(tctx, "Credential chaining failed\n");
 431                 }
 432
 433                 cli_credentials_set_password(machine_credentials, password, CRED_SPECIFIED);
 434         }
 435
 436         torture_assert(tctx, test_SetupCredentials(p, tctx, machine_credentials, &creds),
 437                 "ServerPasswordSet failed to actually change the password");
 438
 439         /* now try a random password */
 440         password = generate_random_str(tctx, 8);
 441         encode_pw_buffer(password_buf.data, password, STR_UNICODE);
 442         creds_arcfour_crypt(creds, password_buf.data, 516);
 443
 444         memcpy(new_password.data, password_buf.data, 512);
 445         new_password.length = IVAL(password_buf.data, 512);
 446
 447         torture_comment(tctx, "Testing second ServerPasswordSet2 on machine account\n");
 448         torture_comment(tctx, "Changing machine account password to '%s'\n", password);
 449
 450         creds_client_authenticator(creds, &credential);
 451
 452         status = dcerpc_netr_ServerPasswordSet2(p, tctx, &r);
 453         torture_assert_ntstatus_ok(tctx, status, "ServerPasswordSet2 (2)");
 454
 455         if (!creds_client_check(creds, &r.out.return_authenticator->cred)) {
 456                 torture_comment(tctx, "Credential chaining failed\n");
 457         }
 458
 459         /* by changing the machine password twice we test the
 460            credentials chaining fully, and we verify that the server
 461            allows the password to be set to the same value twice in a
 462            row (match win2k3) */
 463         torture_comment(tctx,
 464                 "Testing a second ServerPasswordSet2 on machine account\n");
 465         torture_comment(tctx,
 466                 "Changing machine account password to '%s' (same as previous run)\n", password);
 467
 468         creds_client_authenticator(creds, &credential);
 469
 470         status = dcerpc_netr_ServerPasswordSet2(p, tctx, &r);
 471         torture_assert_ntstatus_ok(tctx, status, "ServerPasswordSet (3)");
 472
 473         if (!creds_client_check(creds, &r.out.return_authenticator->cred)) {
 474                 torture_comment(tctx, "Credential chaining failed\n");
 475         }
 476
 477         cli_credentials_set_password(machine_credentials, password, CRED_SPECIFIED);
 478
 479         torture_assert (tctx,
 480                 test_SetupCredentials(p, tctx, machine_credentials, &creds),
 481                 "ServerPasswordSet failed to actually change the password");
 482
 483         new_random_pass = netlogon_very_rand_pass(tctx, 128);
 484
 485         /* now try a random stream of bytes for a password */
 486         set_pw_in_buffer(password_buf.data, &new_random_pass);
 487
 488         creds_arcfour_crypt(creds, password_buf.data, 516);
 489
 490         memcpy(new_password.data, password_buf.data, 512);
 491         new_password.length = IVAL(password_buf.data, 512);
 492
 493         torture_comment(tctx,
 494                 "Testing a third ServerPasswordSet2 on machine account, with a compleatly random password\n");
 495
 496         creds_client_authenticator(creds, &credential);
 497
 498         status = dcerpc_netr_ServerPasswordSet2(p, tctx, &r);
 499         torture_assert_ntstatus_ok(tctx, status, "ServerPasswordSet (3)");
 500
 501         if (!creds_client_check(creds, &r.out.return_authenticator->cred)) {
 502                 torture_comment(tctx, "Credential chaining failed\n");
 503         }
 504
 505         mdfour(nt_hash.hash, new_random_pass.data, new_random_pass.length);
 506
 507         cli_credentials_set_password(machine_credentials, NULL, CRED_UNINITIALISED);
 508         cli_credentials_set_nt_hash(machine_credentials, &nt_hash, CRED_SPECIFIED);
 509
 510         torture_assert (tctx,
 511                 test_SetupCredentials(p, tctx, machine_credentials, &creds),
 512                 "ServerPasswordSet failed to actually change the password");
 513
 514         return true;
 515 }
 516
 517 static bool test_GetPassword(struct torture_context *tctx,
 518                              struct dcerpc_pipe *p,
 519                              struct cli_credentials *machine_credentials)
 520 {
 521         struct netr_ServerPasswordGet r;
 522         struct creds_CredentialState *creds;
 523         struct netr_Authenticator credential;
 524         NTSTATUS status;
 525         struct netr_Authenticator return_authenticator;
 526         struct samr_Password password;
 527
 528         if (!test_SetupCredentials(p, tctx, machine_credentials, &creds)) {
 529                 return false;
 530         }
 531
 532         creds_client_authenticator(creds, &credential);
 533
 534         r.in.server_name = talloc_asprintf(tctx, "\\\\%s", dcerpc_server_name(p));
 535         r.in.account_name = talloc_asprintf(tctx, "%s$", TEST_MACHINE_NAME);
 536         r.in.secure_channel_type = SEC_CHAN_BDC;
 537         r.in.computer_name = TEST_MACHINE_NAME;
 538         r.in.credential = &credential;
 539         r.out.return_authenticator = &return_authenticator;
 540         r.out.password = &password;
 541
 542         status = dcerpc_netr_ServerPasswordGet(p, tctx, &r);
 543         torture_assert_ntstatus_ok(tctx, status, "ServerPasswordGet");
 544
 545         return true;
 546 }
 547
 548 static bool test_GetTrustPasswords(struct torture_context *tctx,
 549                                    struct dcerpc_pipe *p,
 550                                    struct cli_credentials *machine_credentials)
 551 {
 552         struct netr_ServerTrustPasswordsGet r;
 553         struct creds_CredentialState *creds;
 554         struct netr_Authenticator credential;
 555         NTSTATUS status;
 556         struct netr_Authenticator return_authenticator;
 557         struct samr_Password password, password2;
 558
 559         if (!test_SetupCredentials(p, tctx, machine_credentials, &creds)) {
 560                 return false;
 561         }
 562
 563         creds_client_authenticator(creds, &credential);
 564
 565         r.in.server_name = talloc_asprintf(tctx, "\\\\%s", dcerpc_server_name(p));
 566         r.in.account_name = talloc_asprintf(tctx, "%s$", TEST_MACHINE_NAME);
 567         r.in.secure_channel_type = SEC_CHAN_BDC;
 568         r.in.computer_name = TEST_MACHINE_NAME;
 569         r.in.credential = &credential;
 570         r.out.return_authenticator = &return_authenticator;
 571         r.out.password = &password;
 572         r.out.password2 = &password2;
 573
 574         status = dcerpc_netr_ServerTrustPasswordsGet(p, tctx, &r);
 575         torture_assert_ntstatus_ok(tctx, status, "ServerTrustPasswordsGet");
 576
 577         return true;
 578 }
 579
 580 /*
 581   try a netlogon SamLogon
 582 */
 583 bool test_netlogon_ops(struct dcerpc_pipe *p, struct torture_context *tctx,
 584                               struct cli_credentials *credentials,
 585                               struct creds_CredentialState *creds)
 586 {
 587         NTSTATUS status;
 588         struct netr_LogonSamLogon r;
 589         struct netr_Authenticator auth, auth2;
 590         union netr_LogonLevel logon;
 591         union netr_Validation validation;
 592         uint8_t authoritative;
 593         struct netr_NetworkInfo ninfo;
 594         DATA_BLOB names_blob, chal, lm_resp, nt_resp;
 595         int i;
 596         int flags = CLI_CRED_NTLM_AUTH;
 597         if (lp_client_lanman_auth(tctx->lp_ctx)) {
 598                 flags |= CLI_CRED_LANMAN_AUTH;
 599         }
 600
 601         if (lp_client_ntlmv2_auth(tctx->lp_ctx)) {
 602                 flags |= CLI_CRED_NTLMv2_AUTH;
 603         }
 604
 605         cli_credentials_get_ntlm_username_domain(cmdline_credentials, tctx,
 606                                                  &ninfo.identity_info.account_name.string,
 607                                                  &ninfo.identity_info.domain_name.string);
 608
 609         generate_random_buffer(ninfo.challenge,
 610                                sizeof(ninfo.challenge));
 611         chal = data_blob_const(ninfo.challenge,
 612                                sizeof(ninfo.challenge));
 613
 614         names_blob = NTLMv2_generate_names_blob(tctx, cli_credentials_get_workstation(credentials),
 615                                                 cli_credentials_get_domain(credentials));
 616
 617         status = cli_credentials_get_ntlm_response(cmdline_credentials, tctx,
 618                                                    &flags,
 619                                                    chal,
 620                                                    names_blob,
 621                                                    &lm_resp, &nt_resp,
 622                                                    NULL, NULL);
 623         torture_assert_ntstatus_ok(tctx, status, "cli_credentials_get_ntlm_response failed");
 624
 625         ninfo.lm.data = lm_resp.data;
 626         ninfo.lm.length = lm_resp.length;
 627
 628         ninfo.nt.data = nt_resp.data;
 629         ninfo.nt.length = nt_resp.length;
 630
 631         ninfo.identity_info.parameter_control = 0;
 632         ninfo.identity_info.logon_id_low = 0;
 633         ninfo.identity_info.logon_id_high = 0;
 634         ninfo.identity_info.workstation.string = cli_credentials_get_workstation(credentials);
 635
 636         logon.network = &ninfo;
 637
 638         r.in.server_name = talloc_asprintf(tctx, "\\\\%s", dcerpc_server_name(p));
 639         r.in.computer_name = cli_credentials_get_workstation(credentials);
 640         r.in.credential = &auth;
 641         r.in.return_authenticator = &auth2;
 642         r.in.logon_level = 2;
 643         r.in.logon = &logon;
 644         r.out.validation = &validation;
 645         r.out.authoritative = &authoritative;
 646
 647         d_printf("Testing LogonSamLogon with name %s\n", ninfo.identity_info.account_name.string);
 648
 649         for (i=2;i<3;i++) {
 650                 ZERO_STRUCT(auth2);
 651                 creds_client_authenticator(creds, &auth);
 652
 653                 r.in.validation_level = i;
 654
 655                 status = dcerpc_netr_LogonSamLogon(p, tctx, &r);
 656                 torture_assert_ntstatus_ok(tctx, status, "LogonSamLogon failed");
 657
 658                 torture_assert(tctx, creds_client_check(creds, &r.out.return_authenticator->cred),
 659                         "Credential chaining failed");
 660         }
 661
 662         r.in.credential = NULL;
 663
 664         for (i=2;i<=3;i++) {
 665
 666                 r.in.validation_level = i;
 667
 668                 torture_comment(tctx, "Testing SamLogon with validation level %d and a NULL credential\n", i);
 669
 670                 status = dcerpc_netr_LogonSamLogon(p, tctx, &r);
 671                 torture_assert_ntstatus_equal(tctx, status, NT_STATUS_INVALID_PARAMETER,
 672                         "LogonSamLogon expected INVALID_PARAMETER");
 673
 674         }
 675
 676         return true;
 677 }
 678
 679 /*
 680   try a netlogon SamLogon
 681 */
 682 static bool test_SamLogon(struct torture_context *tctx,
 683                           struct dcerpc_pipe *p,
 684                           struct cli_credentials *credentials)
 685 {
 686         struct creds_CredentialState *creds;
 687
 688         if (!test_SetupCredentials(p, tctx, credentials, &creds)) {
 689                 return false;
 690         }
 691
 692         return test_netlogon_ops(p, tctx, credentials, creds);
 693 }
 694
 695 /* we remember the sequence numbers so we can easily do a DatabaseDelta */
 696 static uint64_t sequence_nums[3];
 697
 698 /*
 699   try a netlogon DatabaseSync
 700 */
 701 static bool test_DatabaseSync(struct torture_context *tctx,
 702                               struct dcerpc_pipe *p,
 703                               struct cli_credentials *machine_credentials)
 704 {
 705         NTSTATUS status;
 706         struct netr_DatabaseSync r;
 707         struct creds_CredentialState *creds;
 708         const uint32_t database_ids[] = {SAM_DATABASE_DOMAIN, SAM_DATABASE_BUILTIN, SAM_DATABASE_PRIVS};
 709         int i;
 710         struct netr_DELTA_ENUM_ARRAY *delta_enum_array = NULL;
 711         struct netr_Authenticator credential, return_authenticator;
 712
 713         if (!test_SetupCredentials(p, tctx, machine_credentials, &creds)) {
 714                 return false;
 715         }
 716
 717         ZERO_STRUCT(return_authenticator);
 718
 719         r.in.logon_server = talloc_asprintf(tctx, "\\\\%s", dcerpc_server_name(p));
 720         r.in.computername = TEST_MACHINE_NAME;
 721         r.in.preferredmaximumlength = (uint32_t)-1;
 722         r.in.return_authenticator = &return_authenticator;
 723         r.out.delta_enum_array = &delta_enum_array;
 724         r.out.return_authenticator = &return_authenticator;
 725
 726         for (i=0;i<ARRAY_SIZE(database_ids);i++) {
 727
 728                 uint32_t sync_context = 0;
 729
 730                 r.in.database_id = database_ids[i];
 731                 r.in.sync_context = &sync_context;
 732                 r.out.sync_context = &sync_context;
 733
 734                 torture_comment(tctx, "Testing DatabaseSync of id %d\n", r.in.database_id);
 735
 736                 do {
 737                         creds_client_authenticator(creds, &credential);
 738
 739                         r.in.credential = &credential;
 740
 741                         status = dcerpc_netr_DatabaseSync(p, tctx, &r);
 742                         if (NT_STATUS_EQUAL(status, STATUS_MORE_ENTRIES))
 743                             break;
 744
 745                         /* Native mode servers don't do this */
 746                         if (NT_STATUS_EQUAL(status, NT_STATUS_NOT_SUPPORTED)) {
 747                                 return true;
 748                         }
 749                         torture_assert_ntstatus_ok(tctx, status, "DatabaseSync");
 750
 751                         if (!creds_client_check(creds, &r.out.return_authenticator->cred)) {
 752                                 torture_comment(tctx, "Credential chaining failed\n");
 753                         }
 754
 755                         if (delta_enum_array &&
 756                             delta_enum_array->num_deltas > 0 &&
 757                             delta_enum_array->delta_enum[0].delta_type == NETR_DELTA_DOMAIN &&
 758                             delta_enum_array->delta_enum[0].delta_union.domain) {
 759                                 sequence_nums[r.in.database_id] =
 760                                         delta_enum_array->delta_enum[0].delta_union.domain->sequence_num;
 761                                 torture_comment(tctx, "\tsequence_nums[%d]=%llu\n",
 762                                        r.in.database_id,
 763                                        (unsigned long long)sequence_nums[r.in.database_id]);
 764                         }
 765                 } while (NT_STATUS_EQUAL(status, STATUS_MORE_ENTRIES));
 766         }
 767
 768         return true;
 769 }
 770
 771
 772 /*
 773   try a netlogon DatabaseDeltas
 774 */
 775 static bool test_DatabaseDeltas(struct torture_context *tctx,
 776                                 struct dcerpc_pipe *p,
 777                                 struct cli_credentials *machine_credentials)
 778 {
 779         NTSTATUS status;
 780         struct netr_DatabaseDeltas r;
 781         struct creds_CredentialState *creds;
 782         struct netr_Authenticator credential;
 783         struct netr_Authenticator return_authenticator;
 784         struct netr_DELTA_ENUM_ARRAY *delta_enum_array = NULL;
 785         const uint32_t database_ids[] = {0, 1, 2};
 786         int i;
 787
 788         if (!test_SetupCredentials(p, tctx, machine_credentials, &creds)) {
 789                 return false;
 790         }
 791
 792         r.in.logon_server = talloc_asprintf(tctx, "\\\\%s", dcerpc_server_name(p));
 793         r.in.computername = TEST_MACHINE_NAME;
 794         r.in.preferredmaximumlength = (uint32_t)-1;
 795         ZERO_STRUCT(r.in.return_authenticator);
 796         r.out.return_authenticator = &return_authenticator;
 797         r.out.delta_enum_array = &delta_enum_array;
 798
 799         for (i=0;i<ARRAY_SIZE(database_ids);i++) {
 800                 r.in.database_id = database_ids[i];
 801                 r.in.sequence_num = &sequence_nums[r.in.database_id];
 802
 803                 if (*r.in.sequence_num == 0) continue;
 804
 805                 *r.in.sequence_num -= 1;
 806
 807                 torture_comment(tctx, "Testing DatabaseDeltas of id %d at %llu\n",
 808                        r.in.database_id, (unsigned long long)*r.in.sequence_num);
 809
 810                 do {
 811                         creds_client_authenticator(creds, &credential);
 812
 813                         status = dcerpc_netr_DatabaseDeltas(p, tctx, &r);
 814                         if (NT_STATUS_EQUAL(status,
 815                                              NT_STATUS_SYNCHRONIZATION_REQUIRED)) {
 816                                 torture_comment(tctx, "not considering %s to be an error\n",
 817                                        nt_errstr(status));
 818                                 return true;
 819                         }
 820                         if (NT_STATUS_EQUAL(status, STATUS_MORE_ENTRIES))
 821                             break;
 822
 823                         torture_assert_ntstatus_ok(tctx, status, "DatabaseDeltas");
 824
 825                         if (!creds_client_check(creds, &return_authenticator.cred)) {
 826                                 torture_comment(tctx, "Credential chaining failed\n");
 827                         }
 828
 829                         (*r.in.sequence_num)++;
 830                 } while (NT_STATUS_EQUAL(status, STATUS_MORE_ENTRIES));
 831         }
 832
 833         return true;
 834 }
 835
 836 static bool test_DatabaseRedo(struct torture_context *tctx,
 837                               struct dcerpc_pipe *p,
 838                               struct cli_credentials *machine_credentials)
 839 {
 840         NTSTATUS status;
 841         struct netr_DatabaseRedo r;
 842         struct creds_CredentialState *creds;
 843         struct netr_Authenticator credential;
 844         struct netr_Authenticator return_authenticator;
 845         struct netr_DELTA_ENUM_ARRAY *delta_enum_array = NULL;
 846         struct netr_ChangeLogEntry e;
 847         struct dom_sid null_sid, *sid;
 848         int i,d;
 849
 850         ZERO_STRUCT(null_sid);
 851
 852         sid = dom_sid_parse_talloc(tctx, "S-1-5-21-1111111111-2222222222-333333333-500");
 853
 854         {
 855
 856         struct {
 857                 uint32_t rid;
 858                 uint16_t flags;
 859                 uint8_t db_index;
 860                 uint8_t delta_type;
 861                 struct dom_sid sid;
 862                 const char *name;
 863                 NTSTATUS expected_error;
 864                 uint32_t expected_num_results;
 865                 uint8_t expected_delta_type_1;
 866                 uint8_t expected_delta_type_2;
 867                 const char *comment;
 868         } changes[] = {
 869
 870                 /* SAM_DATABASE_DOMAIN */
 871
 872                 {
 873                         .rid                    = 0,
 874                         .flags                  = 0,
 875                         .db_index               = SAM_DATABASE_DOMAIN,
 876                         .delta_type             = NETR_DELTA_MODIFY_COUNT,
 877                         .sid                    = null_sid,
 878                         .name                   = NULL,
 879                         .expected_error         = NT_STATUS_SYNCHRONIZATION_REQUIRED,
 880                         .expected_num_results   = 0,
 881                         .comment                = "NETR_DELTA_MODIFY_COUNT"
 882                 },
 883                 {
 884                         .rid                    = 0,
 885                         .flags                  = 0,
 886                         .db_index               = SAM_DATABASE_DOMAIN,
 887                         .delta_type             = 0,
 888                         .sid                    = null_sid,
 889                         .name                   = NULL,
 890                         .expected_error         = NT_STATUS_OK,
 891                         .expected_num_results   = 1,
 892                         .expected_delta_type_1  = NETR_DELTA_DOMAIN,
 893                         .comment                = "NULL DELTA"
 894                 },
 895                 {
 896                         .rid                    = 0,
 897                         .flags                  = 0,
 898                         .db_index               = SAM_DATABASE_DOMAIN,
 899                         .delta_type             = NETR_DELTA_DOMAIN,
 900                         .sid                    = null_sid,
 901                         .name                   = NULL,
 902                         .expected_error         = NT_STATUS_OK,
 903                         .expected_num_results   = 1,
 904                         .expected_delta_type_1  = NETR_DELTA_DOMAIN,
 905                         .comment                = "NETR_DELTA_DOMAIN"
 906                 },
 907                 {
 908                         .rid                    = DOMAIN_RID_ADMINISTRATOR,
 909                         .flags                  = 0,
 910                         .db_index               = SAM_DATABASE_DOMAIN,
 911                         .delta_type             = NETR_DELTA_USER,
 912                         .sid                    = null_sid,
 913                         .name                   = NULL,
 914                         .expected_error         = NT_STATUS_OK,
 915                         .expected_num_results   = 1,
 916                         .expected_delta_type_1  = NETR_DELTA_USER,
 917                         .comment                = "NETR_DELTA_USER by rid 500"
 918                 },
 919                 {
 920                         .rid                    = DOMAIN_RID_GUEST,
 921                         .flags                  = 0,
 922                         .db_index               = SAM_DATABASE_DOMAIN,
 923                         .delta_type             = NETR_DELTA_USER,
 924                         .sid                    = null_sid,
 925                         .name                   = NULL,
 926                         .expected_error         = NT_STATUS_OK,
 927                         .expected_num_results   = 1,
 928                         .expected_delta_type_1  = NETR_DELTA_USER,
 929                         .comment                = "NETR_DELTA_USER by rid 501"
 930                 },
 931                 {
 932                         .rid                    = 0,
 933                         .flags                  = NETR_CHANGELOG_SID_INCLUDED,
 934                         .db_index               = SAM_DATABASE_DOMAIN,
 935                         .delta_type             = NETR_DELTA_USER,
 936                         .sid                    = *sid,
 937                         .name                   = NULL,
 938                         .expected_error         = NT_STATUS_OK,
 939                         .expected_num_results   = 1,
 940                         .expected_delta_type_1  = NETR_DELTA_DELETE_USER,
 941                         .comment                = "NETR_DELTA_USER by sid and flags"
 942                 },
 943                 {
 944                         .rid                    = 0,
 945                         .flags                  = NETR_CHANGELOG_SID_INCLUDED,
 946                         .db_index               = SAM_DATABASE_DOMAIN,
 947                         .delta_type             = NETR_DELTA_USER,
 948                         .sid                    = null_sid,
 949                         .name                   = NULL,
 950                         .expected_error         = NT_STATUS_OK,
 951                         .expected_num_results   = 1,
 952                         .expected_delta_type_1  = NETR_DELTA_DELETE_USER,
 953                         .comment                = "NETR_DELTA_USER by null_sid and flags"
 954                 },
 955                 {
 956                         .rid                    = 0,
 957                         .flags                  = NETR_CHANGELOG_NAME_INCLUDED,
 958                         .db_index               = SAM_DATABASE_DOMAIN,
 959                         .delta_type             = NETR_DELTA_USER,
 960                         .sid                    = null_sid,
 961                         .name                   = "administrator",
 962                         .expected_error         = NT_STATUS_OK,
 963                         .expected_num_results   = 1,
 964                         .expected_delta_type_1  = NETR_DELTA_DELETE_USER,
 965                         .comment                = "NETR_DELTA_USER by name 'administrator'"
 966                 },
 967                 {
 968                         .rid                    = DOMAIN_RID_ADMINS,
 969                         .flags                  = 0,
 970                         .db_index               = SAM_DATABASE_DOMAIN,
 971                         .delta_type             = NETR_DELTA_GROUP,
 972                         .sid                    = null_sid,
 973                         .name                   = NULL,
 974                         .expected_error         = NT_STATUS_OK,
 975                         .expected_num_results   = 2,
 976                         .expected_delta_type_1  = NETR_DELTA_GROUP,
 977                         .expected_delta_type_2  = NETR_DELTA_GROUP_MEMBER,
 978                         .comment                = "NETR_DELTA_GROUP by rid 512"
 979                 },
 980                 {
 981                         .rid                    = DOMAIN_RID_ADMINS,
 982                         .flags                  = 0,
 983                         .db_index               = SAM_DATABASE_DOMAIN,
 984                         .delta_type             = NETR_DELTA_GROUP_MEMBER,
 985                         .sid                    = null_sid,
 986                         .name                   = NULL,
 987                         .expected_error         = NT_STATUS_OK,
 988                         .expected_num_results   = 2,
 989                         .expected_delta_type_1  = NETR_DELTA_GROUP,
 990                         .expected_delta_type_2  = NETR_DELTA_GROUP_MEMBER,
 991                         .comment                = "NETR_DELTA_GROUP_MEMBER by rid 512"
 992                 },
 993
 994
 995                 /* SAM_DATABASE_BUILTIN */
 996
 997                 {
 998                         .rid                    = 0,
 999                         .flags                  = 0,
1000                         .db_index               = SAM_DATABASE_BUILTIN,
1001                         .delta_type             = NETR_DELTA_MODIFY_COUNT,
1002                         .sid                    = null_sid,
1003                         .name                   = NULL,
1004                         .expected_error         = NT_STATUS_SYNCHRONIZATION_REQUIRED,
1005                         .expected_num_results   = 0,
1006                         .comment                = "NETR_DELTA_MODIFY_COUNT"
1007                 },
1008                 {
1009                         .rid                    = 0,
1010                         .flags                  = 0,
1011                         .db_index               = SAM_DATABASE_BUILTIN,
1012                         .delta_type             = NETR_DELTA_DOMAIN,
1013                         .sid                    = null_sid,
1014                         .name                   = NULL,
1015                         .expected_error         = NT_STATUS_OK,
1016                         .expected_num_results   = 1,
1017                         .expected_delta_type_1  = NETR_DELTA_DOMAIN,
1018                         .comment                = "NETR_DELTA_DOMAIN"
1019                 },
1020                 {
1021                         .rid                    = DOMAIN_RID_ADMINISTRATOR,
1022                         .flags                  = 0,
1023                         .db_index               = SAM_DATABASE_BUILTIN,
1024                         .delta_type             = NETR_DELTA_USER,
1025                         .sid                    = null_sid,
1026                         .name                   = NULL,
1027                         .expected_error         = NT_STATUS_OK,
1028                         .expected_num_results   = 1,
1029                         .expected_delta_type_1  = NETR_DELTA_DELETE_USER,
1030                         .comment                = "NETR_DELTA_USER by rid 500"
1031                 },
1032                 {
1033                         .rid                    = 0,
1034                         .flags                  = 0,
1035                         .db_index               = SAM_DATABASE_BUILTIN,
1036                         .delta_type             = NETR_DELTA_USER,
1037                         .sid                    = null_sid,
1038                         .name                   = NULL,
1039                         .expected_error         = NT_STATUS_OK,
1040                         .expected_num_results   = 1,
1041                         .expected_delta_type_1  = NETR_DELTA_DELETE_USER,
1042                         .comment                = "NETR_DELTA_USER"
1043                 },
1044                 {
1045                         .rid                    = 544,
1046                         .flags                  = 0,
1047                         .db_index               = SAM_DATABASE_BUILTIN,
1048                         .delta_type             = NETR_DELTA_ALIAS,
1049                         .sid                    = null_sid,
1050                         .name                   = NULL,
1051                         .expected_error         = NT_STATUS_OK,
1052                         .expected_num_results   = 2,
1053                         .expected_delta_type_1  = NETR_DELTA_ALIAS,
1054                         .expected_delta_type_2  = NETR_DELTA_ALIAS_MEMBER,
1055                         .comment                = "NETR_DELTA_ALIAS by rid 544"
1056                 },
1057                 {
1058                         .rid                    = 544,
1059                         .flags                  = 0,
1060                         .db_index               = SAM_DATABASE_BUILTIN,
1061                         .delta_type             = NETR_DELTA_ALIAS_MEMBER,
1062                         .sid                    = null_sid,
1063                         .name                   = NULL,
1064                         .expected_error         = NT_STATUS_OK,
1065                         .expected_num_results   = 2,
1066                         .expected_delta_type_1  = NETR_DELTA_ALIAS,
1067                         .expected_delta_type_2  = NETR_DELTA_ALIAS_MEMBER,
1068                         .comment                = "NETR_DELTA_ALIAS_MEMBER by rid 544"
1069                 },
1070                 {
1071                         .rid                    = 544,
1072                         .flags                  = 0,
1073                         .db_index               = SAM_DATABASE_BUILTIN,
1074                         .delta_type             = 0,
1075                         .sid                    = null_sid,
1076                         .name                   = NULL,
1077                         .expected_error         = NT_STATUS_OK,
1078                         .expected_num_results   = 1,
1079                         .expected_delta_type_1  = NETR_DELTA_DOMAIN,
1080                         .comment                = "NULL DELTA by rid 544"
1081                 },
1082                 {
1083                         .rid                    = 544,
1084                         .flags                  = NETR_CHANGELOG_SID_INCLUDED,
1085                         .db_index               = SAM_DATABASE_BUILTIN,
1086                         .delta_type             = 0,
1087                         .sid                    = *dom_sid_parse_talloc(tctx, "S-1-5-32-544"),
1088                         .name                   = NULL,
1089                         .expected_error         = NT_STATUS_OK,
1090                         .expected_num_results   = 1,
1091                         .expected_delta_type_1  = NETR_DELTA_DOMAIN,
1092                         .comment                = "NULL DELTA by rid 544 sid S-1-5-32-544 and flags"
1093                 },
1094                 {
1095                         .rid                    = 544,
1096                         .flags                  = NETR_CHANGELOG_SID_INCLUDED,
1097                         .db_index               = SAM_DATABASE_BUILTIN,
1098                         .delta_type             = NETR_DELTA_ALIAS,
1099                         .sid                    = *dom_sid_parse_talloc(tctx, "S-1-5-32-544"),
1100                         .name                   = NULL,
1101                         .expected_error         = NT_STATUS_OK,
1102                         .expected_num_results   = 2,
1103                         .expected_delta_type_1  = NETR_DELTA_ALIAS,
1104                         .expected_delta_type_2  = NETR_DELTA_ALIAS_MEMBER,
1105                         .comment                = "NETR_DELTA_ALIAS by rid 544 and sid S-1-5-32-544 and flags"
1106                 },
1107                 {
1108                         .rid                    = 0,
1109                         .flags                  = NETR_CHANGELOG_SID_INCLUDED,
1110                         .db_index               = SAM_DATABASE_BUILTIN,
1111                         .delta_type             = NETR_DELTA_ALIAS,
1112                         .sid                    = *dom_sid_parse_talloc(tctx, "S-1-5-32-544"),
1113                         .name                   = NULL,
1114                         .expected_error         = NT_STATUS_OK,
1115                         .expected_num_results   = 1,
1116                         .expected_delta_type_1  = NETR_DELTA_DELETE_ALIAS,
1117                         .comment                = "NETR_DELTA_ALIAS by sid S-1-5-32-544 and flags"
1118                 },
1119
1120                 /* SAM_DATABASE_PRIVS */
1121
1122                 {
1123                         .rid                    = 0,
1124                         .flags                  = 0,
1125                         .db_index               = SAM_DATABASE_PRIVS,
1126                         .delta_type             = 0,
1127                         .sid                    = null_sid,
1128                         .name                   = NULL,
1129                         .expected_error         = NT_STATUS_ACCESS_DENIED,
1130                         .expected_num_results   = 0,
1131                         .comment                = "NULL DELTA"
1132                 },
1133                 {
1134                         .rid                    = 0,
1135                         .flags                  = 0,
1136                         .db_index               = SAM_DATABASE_PRIVS,
1137                         .delta_type             = NETR_DELTA_MODIFY_COUNT,
1138                         .sid                    = null_sid,
1139                         .name                   = NULL,
1140                         .expected_error         = NT_STATUS_SYNCHRONIZATION_REQUIRED,
1141                         .expected_num_results   = 0,
1142                         .comment                = "NETR_DELTA_MODIFY_COUNT"
1143                 },
1144                 {
1145                         .rid                    = 0,
1146                         .flags                  = 0,
1147                         .db_index               = SAM_DATABASE_PRIVS,
1148                         .delta_type             = NETR_DELTA_POLICY,
1149                         .sid                    = null_sid,
1150                         .name                   = NULL,
1151                         .expected_error         = NT_STATUS_OK,
1152                         .expected_num_results   = 1,
1153                         .expected_delta_type_1  = NETR_DELTA_POLICY,
1154                         .comment                = "NETR_DELTA_POLICY"
1155                 },
1156                 {
1157                         .rid                    = 0,
1158                         .flags                  = NETR_CHANGELOG_SID_INCLUDED,
1159                         .db_index               = SAM_DATABASE_PRIVS,
1160                         .delta_type             = NETR_DELTA_POLICY,
1161                         .sid                    = null_sid,
1162                         .name                   = NULL,
1163                         .expected_error         = NT_STATUS_OK,
1164                         .expected_num_results   = 1,
1165                         .expected_delta_type_1  = NETR_DELTA_POLICY,
1166                         .comment                = "NETR_DELTA_POLICY by null sid and flags"
1167                 },
1168                 {
1169                         .rid                    = 0,
1170                         .flags                  = NETR_CHANGELOG_SID_INCLUDED,
1171                         .db_index               = SAM_DATABASE_PRIVS,
1172                         .delta_type             = NETR_DELTA_POLICY,
1173                         .sid                    = *dom_sid_parse_talloc(tctx, "S-1-5-32"),
1174                         .name                   = NULL,
1175                         .expected_error         = NT_STATUS_OK,
1176                         .expected_num_results   = 1,
1177                         .expected_delta_type_1  = NETR_DELTA_POLICY,
1178                         .comment                = "NETR_DELTA_POLICY by sid S-1-5-32 and flags"
1179                 },
1180                 {
1181                         .rid                    = DOMAIN_RID_ADMINISTRATOR,
1182                         .flags                  = 0,
1183                         .db_index               = SAM_DATABASE_PRIVS,
1184                         .delta_type             = NETR_DELTA_ACCOUNT,
1185                         .sid                    = null_sid,
1186                         .name                   = NULL,
1187                         .expected_error         = NT_STATUS_SYNCHRONIZATION_REQUIRED, /* strange */
1188                         .expected_num_results   = 0,
1189                         .comment                = "NETR_DELTA_ACCOUNT by rid 500"
1190                 },
1191                 {
1192                         .rid                    = 0,
1193                         .flags                  = NETR_CHANGELOG_SID_INCLUDED,
1194                         .db_index               = SAM_DATABASE_PRIVS,
1195                         .delta_type             = NETR_DELTA_ACCOUNT,
1196                         .sid                    = *dom_sid_parse_talloc(tctx, "S-1-1-0"),
1197                         .name                   = NULL,
1198                         .expected_error         = NT_STATUS_OK,
1199                         .expected_num_results   = 1,
1200                         .expected_delta_type_1  = NETR_DELTA_ACCOUNT,
1201                         .comment                = "NETR_DELTA_ACCOUNT by sid S-1-1-0 and flags"
1202                 },
1203                 {
1204                         .rid                    = 0,
1205                         .flags                  = NETR_CHANGELOG_SID_INCLUDED |
1206                                                   NETR_CHANGELOG_IMMEDIATE_REPL_REQUIRED,
1207                         .db_index               = SAM_DATABASE_PRIVS,
1208                         .delta_type             = NETR_DELTA_ACCOUNT,
1209                         .sid                    = *dom_sid_parse_talloc(tctx, "S-1-1-0"),
1210                         .name                   = NULL,
1211                         .expected_error         = NT_STATUS_OK,
1212                         .expected_num_results   = 1,
1213                         .expected_delta_type_1  = NETR_DELTA_ACCOUNT,
1214                         .comment                = "NETR_DELTA_ACCOUNT by sid S-1-1-0 and 2 flags"
1215                 },
1216                 {
1217                         .rid                    = 0,
1218                         .flags                  = NETR_CHANGELOG_SID_INCLUDED |
1219                                                   NETR_CHANGELOG_NAME_INCLUDED,
1220                         .db_index               = SAM_DATABASE_PRIVS,
1221                         .delta_type             = NETR_DELTA_ACCOUNT,
1222                         .sid                    = *dom_sid_parse_talloc(tctx, "S-1-1-0"),
1223                         .name                   = NULL,
1224                         .expected_error         = NT_STATUS_INVALID_PARAMETER,
1225                         .expected_num_results   = 0,
1226                         .comment                = "NETR_DELTA_ACCOUNT by sid S-1-1-0 and invalid flags"
1227                 },
1228                 {
1229                         .rid                    = DOMAIN_RID_ADMINISTRATOR,
1230                         .flags                  = NETR_CHANGELOG_SID_INCLUDED,
1231                         .db_index               = SAM_DATABASE_PRIVS,
1232                         .delta_type             = NETR_DELTA_ACCOUNT,
1233                         .sid                    = *sid,
1234                         .name                   = NULL,
1235                         .expected_error         = NT_STATUS_OK,
1236                         .expected_num_results   = 1,
1237                         .expected_delta_type_1  = NETR_DELTA_DELETE_ACCOUNT,
1238                         .comment                = "NETR_DELTA_ACCOUNT by rid 500, sid and flags"
1239                 },
1240                 {
1241                         .rid                    = 0,
1242                         .flags                  = NETR_CHANGELOG_NAME_INCLUDED,
1243                         .db_index               = SAM_DATABASE_PRIVS,
1244                         .delta_type             = NETR_DELTA_SECRET,
1245                         .sid                    = null_sid,
1246                         .name                   = "IsurelydontexistIhope",
1247                         .expected_error         = NT_STATUS_OK,
1248                         .expected_num_results   = 1,
1249                         .expected_delta_type_1  = NETR_DELTA_DELETE_SECRET,
1250                         .comment                = "NETR_DELTA_SECRET by name 'IsurelydontexistIhope' and flags"
1251                 },
1252                 {
1253                         .rid                    = 0,
1254                         .flags                  = NETR_CHANGELOG_NAME_INCLUDED,
1255                         .db_index               = SAM_DATABASE_PRIVS,
1256                         .delta_type             = NETR_DELTA_SECRET,
1257                         .sid                    = null_sid,
1258                         .name                   = "G$BCKUPKEY_P",
1259                         .expected_error         = NT_STATUS_OK,
1260                         .expected_num_results   = 1,
1261                         .expected_delta_type_1  = NETR_DELTA_SECRET,
1262                         .comment                = "NETR_DELTA_SECRET by name 'G$BCKUPKEY_P' and flags"
1263                 }
1264         };
1265
1266         ZERO_STRUCT(return_authenticator);
1267
1268         r.in.logon_server = talloc_asprintf(tctx, "\\\\%s", dcerpc_server_name(p));
1269         r.in.computername = TEST_MACHINE_NAME;
1270         r.in.return_authenticator = &return_authenticator;
1271         r.out.return_authenticator = &return_authenticator;
1272         r.out.delta_enum_array = &delta_enum_array;
1273
1274         for (d=0; d<3; d++) {
1275
1276                 const char *database;
1277
1278                 switch (d) {
1279                 case 0:
1280                         database = "SAM";
1281                         break;
1282                 case 1:
1283                         database = "BUILTIN";
1284                         break;
1285                 case 2:
1286                         database = "LSA";
1287                         break;
1288                 default:
1289                         break;
1290                 }
1291
1292                 torture_comment(tctx, "Testing DatabaseRedo\n");
1293
1294                 if (!test_SetupCredentials(p, tctx, machine_credentials, &creds)) {
1295                         return false;
1296                 }
1297
1298                 for (i=0;i<ARRAY_SIZE(changes);i++) {
1299
1300                         if (d != changes[i].db_index) {
1301                                 continue;
1302                         }
1303
1304                         creds_client_authenticator(creds, &credential);
1305
1306                         r.in.credential = &credential;
1307
1308                         e.serial_number1        = 0;
1309                         e.serial_number2        = 0;
1310                         e.object_rid            = changes[i].rid;
1311                         e.flags                 = changes[i].flags;
1312                         e.db_index              = changes[i].db_index;
1313                         e.delta_type            = changes[i].delta_type;
1314
1315                         switch (changes[i].flags & (NETR_CHANGELOG_NAME_INCLUDED | NETR_CHANGELOG_SID_INCLUDED)) {
1316                         case NETR_CHANGELOG_SID_INCLUDED:
1317                                 e.object.object_sid             = changes[i].sid;
1318                                 break;
1319                         case NETR_CHANGELOG_NAME_INCLUDED:
1320                                 e.object.object_name            = changes[i].name;
1321                                 break;
1322                         default:
1323                                 break;
1324                         }
1325
1326                         r.in.change_log_entry = e;
1327
1328                         torture_comment(tctx, "Testing DatabaseRedo with database %s and %s\n",
1329                                 database, changes[i].comment);
1330
1331                         status = dcerpc_netr_DatabaseRedo(p, tctx, &r);
1332                         if (NT_STATUS_EQUAL(status, NT_STATUS_NOT_SUPPORTED)) {
1333                                 return true;
1334                         }
1335
1336                         torture_assert_ntstatus_equal(tctx, status, changes[i].expected_error, changes[i].comment);
1337                         if (delta_enum_array) {
1338                                 torture_assert_int_equal(tctx,
1339                                         delta_enum_array->num_deltas,
1340                                         changes[i].expected_num_results,
1341                                         changes[i].comment);
1342                                 if (delta_enum_array->num_deltas > 0) {
1343                                         torture_assert_int_equal(tctx,
1344                                                 delta_enum_array->delta_enum[0].delta_type,
1345                                                 changes[i].expected_delta_type_1,
1346                                                 changes[i].comment);
1347                                 }
1348                                 if (delta_enum_array->num_deltas > 1) {
1349                                         torture_assert_int_equal(tctx,
1350                                                 delta_enum_array->delta_enum[1].delta_type,
1351                                                 changes[i].expected_delta_type_2,
1352                                                 changes[i].comment);
1353                                 }
1354                         }
1355
1356                         if (!creds_client_check(creds, &return_authenticator.cred)) {
1357                                 torture_comment(tctx, "Credential chaining failed\n");
1358                                 if (!test_SetupCredentials(p, tctx, machine_credentials, &creds)) {
1359                                         return false;
1360                                 }
1361                         }
1362                 }
1363         }
1364         }
1365
1366         return true;
1367 }
1368
1369 /*
1370   try a netlogon AccountDeltas
1371 */
1372 static bool test_AccountDeltas(struct torture_context *tctx,
1373                                struct dcerpc_pipe *p,
1374                                struct cli_credentials *machine_credentials)
1375 {
1376         NTSTATUS status;
1377         struct netr_AccountDeltas r;
1378         struct creds_CredentialState *creds;
1379
1380         struct netr_AccountBuffer buffer;
1381         uint32_t count_returned = 0;
1382         uint32_t total_entries = 0;
1383         struct netr_UAS_INFO_0 recordid;
1384         struct netr_Authenticator return_authenticator;
1385
1386         if (!test_SetupCredentials(p, tctx, machine_credentials, &creds)) {
1387                 return false;
1388         }
1389
1390         ZERO_STRUCT(return_authenticator);
1391
1392         r.in.logon_server = talloc_asprintf(tctx, "\\\\%s", dcerpc_server_name(p));
1393         r.in.computername = TEST_MACHINE_NAME;
1394         r.in.return_authenticator = &return_authenticator;
1395         creds_client_authenticator(creds, &r.in.credential);
1396         ZERO_STRUCT(r.in.uas);
1397         r.in.count=10;
1398         r.in.level=0;
1399         r.in.buffersize=100;
1400         r.out.buffer = &buffer;
1401         r.out.count_returned = &count_returned;
1402         r.out.total_entries = &total_entries;
1403         r.out.recordid = &recordid;
1404         r.out.return_authenticator = &return_authenticator;
1405
1406         /* w2k3 returns "NOT IMPLEMENTED" for this call */
1407         status = dcerpc_netr_AccountDeltas(p, tctx, &r);
1408         torture_assert_ntstatus_equal(tctx, status, NT_STATUS_NOT_IMPLEMENTED, "AccountDeltas");
1409
1410         return true;
1411 }
1412
1413 /*
1414   try a netlogon AccountSync
1415 */
1416 static bool test_AccountSync(struct torture_context *tctx, struct dcerpc_pipe *p,
1417                              struct cli_credentials *machine_credentials)
1418 {
1419         NTSTATUS status;
1420         struct netr_AccountSync r;
1421         struct creds_CredentialState *creds;
1422
1423         struct netr_AccountBuffer buffer;
1424         uint32_t count_returned = 0;
1425         uint32_t total_entries = 0;
1426         uint32_t next_reference = 0;
1427         struct netr_UAS_INFO_0 recordid;
1428         struct netr_Authenticator return_authenticator;
1429
1430         ZERO_STRUCT(recordid);
1431         ZERO_STRUCT(return_authenticator);
1432
1433         if (!test_SetupCredentials(p, tctx, machine_credentials, &creds)) {
1434                 return false;
1435         }
1436
1437         r.in.logon_server = talloc_asprintf(tctx, "\\\\%s", dcerpc_server_name(p));
1438         r.in.computername = TEST_MACHINE_NAME;
1439         r.in.return_authenticator = &return_authenticator;
1440         creds_client_authenticator(creds, &r.in.credential);
1441         r.in.recordid = &recordid;
1442         r.in.reference=0;
1443         r.in.level=0;
1444         r.in.buffersize=100;
1445         r.out.buffer = &buffer;
1446         r.out.count_returned = &count_returned;
1447         r.out.total_entries = &total_entries;
1448         r.out.next_reference = &next_reference;
1449         r.out.recordid = &recordid;
1450         r.out.return_authenticator = &return_authenticator;
1451
1452         /* w2k3 returns "NOT IMPLEMENTED" for this call */
1453         status = dcerpc_netr_AccountSync(p, tctx, &r);
1454         torture_assert_ntstatus_equal(tctx, status, NT_STATUS_NOT_IMPLEMENTED, "AccountSync");
1455
1456         return true;
1457 }
1458
1459 /*
1460   try a netlogon GetDcName
1461 */
1462 static bool test_GetDcName(struct torture_context *tctx,
1463                            struct dcerpc_pipe *p)
1464 {
1465         NTSTATUS status;
1466         struct netr_GetDcName r;
1467         const char *dcname = NULL;
1468
1469         r.in.logon_server = talloc_asprintf(tctx, "\\\\%s", dcerpc_server_name(p));
1470         r.in.domainname = lp_workgroup(tctx->lp_ctx);
1471         r.out.dcname = &dcname;
1472
1473         status = dcerpc_netr_GetDcName(p, tctx, &r);
1474         torture_assert_ntstatus_ok(tctx, status, "GetDcName");
1475         torture_assert_werr_ok(tctx, r.out.result, "GetDcName");
1476
1477         torture_comment(tctx, "\tDC is at '%s'\n", dcname);
1478
1479         return true;
1480 }
1481
1482 /*
1483   try a netlogon LogonControl
1484 */
1485 static bool test_LogonControl(struct torture_context *tctx,
1486                               struct dcerpc_pipe *p)
1487 {
1488         NTSTATUS status;
1489         struct netr_LogonControl r;
1490         union netr_CONTROL_QUERY_INFORMATION info;
1491         int i;
1492
1493         r.in.logon_server = talloc_asprintf(tctx, "\\\\%s", dcerpc_server_name(p));
1494         r.in.function_code = 1;
1495         r.out.info = &info;
1496
1497         for (i=1;i<4;i++) {
1498                 r.in.level = i;
1499
1500                 torture_comment(tctx, "Testing LogonControl level %d\n", i);
1501
1502                 status = dcerpc_netr_LogonControl(p, tctx, &r);
1503                 torture_assert_ntstatus_ok(tctx, status, "LogonControl");
1504         }
1505
1506         return true;
1507 }
1508
1509
1510 /*
1511   try a netlogon GetAnyDCName
1512 */
1513 static bool test_GetAnyDCName(struct torture_context *tctx,
1514                               struct dcerpc_pipe *p)
1515 {
1516         NTSTATUS status;
1517         struct netr_GetAnyDCName r;
1518         const char *dcname = NULL;
1519
1520         r.in.logon_server = talloc_asprintf(tctx, "\\\\%s", dcerpc_server_name(p));
1521         r.in.domainname = lp_workgroup(tctx->lp_ctx);
1522         r.out.dcname = &dcname;
1523
1524         status = dcerpc_netr_GetAnyDCName(p, tctx, &r);
1525         torture_assert_ntstatus_ok(tctx, status, "GetAnyDCName");
1526
1527         if (dcname) {
1528             torture_comment(tctx, "\tDC is at '%s'\n", dcname);
1529         }
1530
1531         return true;
1532 }
1533
1534
1535 /*
1536   try a netlogon LogonControl2
1537 */
1538 static bool test_LogonControl2(struct torture_context *tctx,
1539                                struct dcerpc_pipe *p)
1540 {
1541         NTSTATUS status;
1542         struct netr_LogonControl2 r;
1543         union netr_CONTROL_DATA_INFORMATION data;
1544         union netr_CONTROL_QUERY_INFORMATION query;
1545         int i;
1546
1547         data.domain = lp_workgroup(tctx->lp_ctx);
1548
1549         r.in.logon_server = talloc_asprintf(tctx, "\\\\%s", dcerpc_server_name(p));
1550
1551         r.in.function_code = NETLOGON_CONTROL_REDISCOVER;
1552         r.in.data = &data;
1553         r.out.query = &query;
1554
1555         for (i=1;i<4;i++) {
1556                 r.in.level = i;
1557
1558                 torture_comment(tctx, "Testing LogonControl2 level %d function %d\n",
1559                        i, r.in.function_code);
1560
1561                 status = dcerpc_netr_LogonControl2(p, tctx, &r);
1562                 torture_assert_ntstatus_ok(tctx, status, "LogonControl");
1563         }
1564
1565         data.domain = lp_workgroup(tctx->lp_ctx);
1566
1567         r.in.function_code = NETLOGON_CONTROL_TC_QUERY;
1568         r.in.data = &data;
1569
1570         for (i=1;i<4;i++) {
1571                 r.in.level = i;
1572
1573                 torture_comment(tctx, "Testing LogonControl2 level %d function %d\n",
1574                        i, r.in.function_code);
1575
1576                 status = dcerpc_netr_LogonControl2(p, tctx, &r);
1577                 torture_assert_ntstatus_ok(tctx, status, "LogonControl");
1578         }
1579
1580         data.domain = lp_workgroup(tctx->lp_ctx);
1581
1582         r.in.function_code = NETLOGON_CONTROL_TRANSPORT_NOTIFY;
1583         r.in.data = &data;
1584
1585         for (i=1;i<4;i++) {
1586                 r.in.level = i;
1587
1588                 torture_comment(tctx, "Testing LogonControl2 level %d function %d\n",
1589                        i, r.in.function_code);
1590
1591                 status = dcerpc_netr_LogonControl2(p, tctx, &r);
1592                 torture_assert_ntstatus_ok(tctx, status, "LogonControl");
1593         }
1594
1595         data.debug_level = ~0;
1596
1597         r.in.function_code = NETLOGON_CONTROL_SET_DBFLAG;
1598         r.in.data = &data;
1599
1600         for (i=1;i<4;i++) {
1601                 r.in.level = i;
1602
1603                 torture_comment(tctx, "Testing LogonControl2 level %d function %d\n",
1604                        i, r.in.function_code);
1605
1606                 status = dcerpc_netr_LogonControl2(p, tctx, &r);
1607                 torture_assert_ntstatus_ok(tctx, status, "LogonControl");
1608         }
1609
1610         return true;
1611 }
1612
1613 /*
1614   try a netlogon DatabaseSync2
1615 */
1616 static bool test_DatabaseSync2(struct torture_context *tctx,
1617                                struct dcerpc_pipe *p,
1618                                struct cli_credentials *machine_credentials)
1619 {
1620         NTSTATUS status;
1621         struct netr_DatabaseSync2 r;
1622         struct netr_DELTA_ENUM_ARRAY *delta_enum_array = NULL;
1623         struct netr_Authenticator return_authenticator, credential;
1624
1625         struct creds_CredentialState *creds;
1626         const uint32_t database_ids[] = {0, 1, 2};
1627         int i;
1628
1629         if (!test_SetupCredentials2(p, tctx, NETLOGON_NEG_AUTH2_FLAGS,
1630                                     machine_credentials,
1631                                     SEC_CHAN_BDC, &creds)) {
1632                 return false;
1633         }
1634
1635         ZERO_STRUCT(return_authenticator);
1636
1637         r.in.logon_server = talloc_asprintf(tctx, "\\\\%s", dcerpc_server_name(p));
1638         r.in.computername = TEST_MACHINE_NAME;
1639         r.in.preferredmaximumlength = (uint32_t)-1;
1640         r.in.return_authenticator = &return_authenticator;
1641         r.out.return_authenticator = &return_authenticator;
1642         r.out.delta_enum_array = &delta_enum_array;
1643
1644         for (i=0;i<ARRAY_SIZE(database_ids);i++) {
1645
1646                 uint32_t sync_context = 0;
1647
1648                 r.in.database_id = database_ids[i];
1649                 r.in.sync_context = &sync_context;
1650                 r.out.sync_context = &sync_context;
1651                 r.in.restart_state = 0;
1652
1653                 torture_comment(tctx, "Testing DatabaseSync2 of id %d\n", r.in.database_id);
1654
1655                 do {
1656                         creds_client_authenticator(creds, &credential);
1657
1658                         r.in.credential = &credential;
1659
1660                         status = dcerpc_netr_DatabaseSync2(p, tctx, &r);
1661                         if (NT_STATUS_EQUAL(status, STATUS_MORE_ENTRIES))
1662                             break;
1663
1664                         /* Native mode servers don't do this */
1665                         if (NT_STATUS_EQUAL(status, NT_STATUS_NOT_SUPPORTED)) {
1666                                 return true;
1667                         }
1668
1669                         torture_assert_ntstatus_ok(tctx, status, "DatabaseSync2");
1670
1671                         if (!creds_client_check(creds, &r.out.return_authenticator->cred)) {
1672                                 torture_comment(tctx, "Credential chaining failed\n");
1673                         }
1674
1675                 } while (NT_STATUS_EQUAL(status, STATUS_MORE_ENTRIES));
1676         }
1677
1678         return true;
1679 }
1680
1681
1682 /*
1683   try a netlogon LogonControl2Ex
1684 */
1685 static bool test_LogonControl2Ex(struct torture_context *tctx,
1686                                  struct dcerpc_pipe *p)
1687 {
1688         NTSTATUS status;
1689         struct netr_LogonControl2Ex r;
1690         union netr_CONTROL_QUERY_INFORMATION query;
1691         int i;
1692
1693         r.in.logon_server = talloc_asprintf(tctx, "\\\\%s", dcerpc_server_name(p));
1694
1695         r.in.function_code = NETLOGON_CONTROL_REDISCOVER;
1696         r.in.data.domain = lp_workgroup(tctx->lp_ctx);
1697         r.out.query = &query;
1698
1699         for (i=1;i<4;i++) {
1700                 r.in.level = i;
1701
1702                 torture_comment(tctx, "Testing LogonControl2Ex level %d function %d\n",
1703                        i, r.in.function_code);
1704
1705                 status = dcerpc_netr_LogonControl2Ex(p, tctx, &r);
1706                 torture_assert_ntstatus_ok(tctx, status, "LogonControl");
1707         }
1708
1709         r.in.function_code = NETLOGON_CONTROL_TC_QUERY;
1710         r.in.data.domain = lp_workgroup(tctx->lp_ctx);
1711
1712         for (i=1;i<4;i++) {
1713                 r.in.level = i;
1714
1715                 torture_comment(tctx, "Testing LogonControl2Ex level %d function %d\n",
1716                        i, r.in.function_code);
1717
1718                 status = dcerpc_netr_LogonControl2Ex(p, tctx, &r);
1719                 torture_assert_ntstatus_ok(tctx, status, "LogonControl");
1720         }
1721
1722         r.in.function_code = NETLOGON_CONTROL_TRANSPORT_NOTIFY;
1723         r.in.data.domain = lp_workgroup(tctx->lp_ctx);
1724
1725         for (i=1;i<4;i++) {
1726                 r.in.level = i;
1727
1728                 torture_comment(tctx, "Testing LogonControl2Ex level %d function %d\n",
1729                        i, r.in.function_code);
1730
1731                 status = dcerpc_netr_LogonControl2Ex(p, tctx, &r);
1732                 torture_assert_ntstatus_ok(tctx, status, "LogonControl");
1733         }
1734
1735         r.in.function_code = NETLOGON_CONTROL_SET_DBFLAG;
1736         r.in.data.debug_level = ~0;
1737
1738         for (i=1;i<4;i++) {
1739                 r.in.level = i;
1740
1741                 torture_comment(tctx, "Testing LogonControl2Ex level %d function %d\n",
1742                        i, r.in.function_code);
1743
1744                 status = dcerpc_netr_LogonControl2Ex(p, tctx, &r);
1745                 torture_assert_ntstatus_ok(tctx, status, "LogonControl");
1746         }
1747
1748         return true;
1749 }
1750
1751 static bool test_netr_DsRGetForestTrustInformation(struct torture_context *tctx,
1752                                                    struct dcerpc_pipe *p, const char *trusted_domain_name)
1753 {
1754         NTSTATUS status;
1755         struct netr_DsRGetForestTrustInformation r;
1756         struct lsa_ForestTrustInformation info, *info_ptr;
1757
1758         info_ptr = &info;
1759
1760         r.in.server_name = talloc_asprintf(tctx, "\\\\%s", dcerpc_server_name(p));
1761         r.in.trusted_domain_name = trusted_domain_name;
1762         r.in.flags = 0;
1763         r.out.forest_trust_info = &info_ptr;
1764
1765         torture_comment(tctx ,"Testing netr_DsRGetForestTrustInformation\n");
1766
1767         status = dcerpc_netr_DsRGetForestTrustInformation(p, tctx, &r);
1768         torture_assert_ntstatus_ok(tctx, status, "DsRGetForestTrustInformation");
1769         torture_assert_werr_ok(tctx, r.out.result, "DsRGetForestTrustInformation");
1770
1771         return true;
1772 }
1773
1774 /*
1775   try a netlogon netr_DsrEnumerateDomainTrusts
1776 */
1777 static bool test_DsrEnumerateDomainTrusts(struct torture_context *tctx,
1778                                           struct dcerpc_pipe *p)
1779 {
1780         NTSTATUS status;
1781         struct netr_DsrEnumerateDomainTrusts r;
1782         struct netr_DomainTrustList trusts;
1783         int i;
1784
1785         r.in.server_name = talloc_asprintf(tctx, "\\\\%s", dcerpc_server_name(p));
1786         r.in.trust_flags = 0x3f;
1787         r.out.trusts = &trusts;
1788
1789         status = dcerpc_netr_DsrEnumerateDomainTrusts(p, tctx, &r);
1790         torture_assert_ntstatus_ok(tctx, status, "DsrEnumerateDomaintrusts");
1791         torture_assert_werr_ok(tctx, r.out.result, "DsrEnumerateDomaintrusts");
1792
1793         /* when trusted_domain_name is NULL, netr_DsRGetForestTrustInformation
1794          * will show non-forest trusts and all UPN suffixes of the own forest
1795          * as LSA_FOREST_TRUST_TOP_LEVEL_NAME types */
1796
1797         if (r.out.trusts->count) {
1798                 if (!test_netr_DsRGetForestTrustInformation(tctx, p, NULL)) {
1799                         return false;
1800                 }
1801         }
1802
1803         for (i=0; i<r.out.trusts->count; i++) {
1804
1805                 /* get info for transitive forest trusts */
1806
1807                 if (r.out.trusts->array[i].trust_attributes & NETR_TRUST_ATTRIBUTE_FOREST_TRANSITIVE) {
1808                         if (!test_netr_DsRGetForestTrustInformation(tctx, p,
1809                                                                     r.out.trusts->array[i].dns_name)) {
1810                                 return false;
1811                         }
1812                 }
1813         }
1814
1815         return true;
1816 }
1817
1818 static bool test_netr_NetrEnumerateTrustedDomains(struct torture_context *tctx,
1819                                                   struct dcerpc_pipe *p)
1820 {
1821         NTSTATUS status;
1822         struct netr_NetrEnumerateTrustedDomains r;
1823         struct netr_Blob trusted_domains_blob;
1824
1825         r.in.server_name = talloc_asprintf(tctx, "\\\\%s", dcerpc_server_name(p));
1826         r.out.trusted_domains_blob = &trusted_domains_blob;
1827
1828         status = dcerpc_netr_NetrEnumerateTrustedDomains(p, tctx, &r);
1829         torture_assert_ntstatus_ok(tctx, status, "netr_NetrEnumerateTrustedDomains");
1830         torture_assert_werr_ok(tctx, r.out.result, "NetrEnumerateTrustedDomains");
1831
1832         return true;
1833 }
1834
1835 static bool test_netr_NetrEnumerateTrustedDomainsEx(struct torture_context *tctx,
1836                                                     struct dcerpc_pipe *p)
1837 {
1838         NTSTATUS status;
1839         struct netr_NetrEnumerateTrustedDomainsEx r;
1840         struct netr_DomainTrustList dom_trust_list;
1841
1842         r.in.server_name = talloc_asprintf(tctx, "\\\\%s", dcerpc_server_name(p));
1843         r.out.dom_trust_list = &dom_trust_list;
1844
1845         status = dcerpc_netr_NetrEnumerateTrustedDomainsEx(p, tctx, &r);
1846         torture_assert_ntstatus_ok(tctx, status, "netr_NetrEnumerateTrustedDomainsEx");
1847         torture_assert_werr_ok(tctx, r.out.result, "NetrEnumerateTrustedDomainsEx");
1848
1849         return true;
1850 }
1851
1852
1853 static bool test_netr_DsRGetSiteName(struct dcerpc_pipe *p, struct torture_context *tctx,
1854                                      const char *computer_name,
1855                                      const char *expected_site)
1856 {
1857         NTSTATUS status;
1858         struct netr_DsRGetSiteName r;
1859         const char *site = NULL;
1860
1861         if (torture_setting_bool(tctx, "samba4", false))
1862                 torture_skip(tctx, "skipping DsRGetSiteName test against Samba4");
1863
1864         r.in.computer_name              = computer_name;
1865         r.out.site                      = &site;
1866         torture_comment(tctx, "Testing netr_DsRGetSiteName\n");
1867
1868         status = dcerpc_netr_DsRGetSiteName(p, tctx, &r);
1869         torture_assert_ntstatus_ok(tctx, status, "DsRGetSiteName");
1870         torture_assert_werr_ok(tctx, r.out.result, "DsRGetSiteName");
1871         torture_assert_str_equal(tctx, expected_site, site, "netr_DsRGetSiteName");
1872
1873         r.in.computer_name              = talloc_asprintf(tctx, "\\\\%s", computer_name);
1874         torture_comment(tctx,
1875                         "Testing netr_DsRGetSiteName with broken computer name: %s\n", r.in.computer_name);
1876
1877         status = dcerpc_netr_DsRGetSiteName(p, tctx, &r);
1878         torture_assert_ntstatus_ok(tctx, status, "DsRGetSiteName");
1879         torture_assert_werr_equal(tctx, r.out.result, WERR_INVALID_COMPUTERNAME, "netr_DsRGetSiteName");
1880
1881         return true;
1882 }
1883
1884 /*
1885   try a netlogon netr_DsRGetDCName
1886 */
1887 static bool test_netr_DsRGetDCName(struct torture_context *tctx,
1888                                    struct dcerpc_pipe *p)
1889 {
1890         NTSTATUS status;
1891         struct netr_DsRGetDCName r;
1892         struct netr_DsRGetDCNameInfo *info = NULL;
1893
1894         r.in.server_unc         = talloc_asprintf(tctx, "\\\\%s", dcerpc_server_name(p));
1895         r.in.domain_name        = talloc_asprintf(tctx, "%s", lp_realm(tctx->lp_ctx));
1896         r.in.domain_guid        = NULL;
1897         r.in.site_guid          = NULL;
1898         r.in.flags              = DS_RETURN_DNS_NAME;
1899         r.out.info              = &info;
1900
1901         status = dcerpc_netr_DsRGetDCName(p, tctx, &r);
1902         torture_assert_ntstatus_ok(tctx, status, "DsRGetDCName");
1903         torture_assert_werr_ok(tctx, r.out.result, "DsRGetDCName");
1904         return test_netr_DsRGetSiteName(p, tctx,
1905                                        info->dc_unc,
1906                                        info->dc_site_name);
1907 }
1908
1909 /*
1910   try a netlogon netr_DsRGetDCNameEx
1911 */
1912 static bool test_netr_DsRGetDCNameEx(struct torture_context *tctx,
1913                                      struct dcerpc_pipe *p)
1914 {
1915         NTSTATUS status;
1916         struct netr_DsRGetDCNameEx r;
1917         struct netr_DsRGetDCNameInfo *info = NULL;
1918
1919         r.in.server_unc         = talloc_asprintf(tctx, "\\\\%s", dcerpc_server_name(p));
1920         r.in.domain_name        = talloc_asprintf(tctx, "%s", lp_realm(tctx->lp_ctx));
1921         r.in.domain_guid        = NULL;
1922         r.in.site_name          = NULL;
1923         r.in.flags              = DS_RETURN_DNS_NAME;
1924         r.out.info              = &info;
1925
1926         status = dcerpc_netr_DsRGetDCNameEx(p, tctx, &r);
1927         torture_assert_ntstatus_ok(tctx, status, "netr_DsRGetDCNameEx");
1928         torture_assert_werr_ok(tctx, r.out.result, "netr_DsRGetDCNameEx");
1929
1930         return test_netr_DsRGetSiteName(p, tctx, info->dc_unc,
1931                                         info->dc_site_name);
1932 }
1933
1934 /*
1935   try a netlogon netr_DsRGetDCNameEx2
1936 */
1937 static bool test_netr_DsRGetDCNameEx2(struct torture_context *tctx,
1938                                       struct dcerpc_pipe *p)
1939 {
1940         NTSTATUS status;
1941         struct netr_DsRGetDCNameEx2 r;
1942         struct netr_DsRGetDCNameInfo *info = NULL;
1943
1944         r.in.server_unc         = talloc_asprintf(tctx, "\\\\%s", dcerpc_server_name(p));
1945         r.in.client_account     = NULL;
1946         r.in.mask               = 0x00000000;
1947         r.in.domain_name        = talloc_asprintf(tctx, "%s", lp_realm(tctx->lp_ctx));
1948         r.in.domain_guid        = NULL;
1949         r.in.site_name          = NULL;
1950         r.in.flags              = DS_RETURN_DNS_NAME;
1951         r.out.info              = &info;
1952
1953         torture_comment(tctx, "Testing netr_DsRGetDCNameEx2 without client account\n");
1954
1955         status = dcerpc_netr_DsRGetDCNameEx2(p, tctx, &r);
1956         torture_assert_ntstatus_ok(tctx, status, "netr_DsRGetDCNameEx2");
1957         torture_assert_werr_ok(tctx, r.out.result, "netr_DsRGetDCNameEx2");
1958
1959         torture_comment(tctx, "Testing netr_DsRGetDCNameEx2 with client acount\n");
1960         r.in.client_account     = TEST_MACHINE_NAME"$";
1961         r.in.mask               = ACB_SVRTRUST;
1962         r.in.flags              = DS_RETURN_FLAT_NAME;
1963         r.out.info              = &info;
1964
1965         status = dcerpc_netr_DsRGetDCNameEx2(p, tctx, &r);
1966         torture_assert_ntstatus_ok(tctx, status, "netr_DsRGetDCNameEx2");
1967         torture_assert_werr_ok(tctx, r.out.result, "netr_DsRGetDCNameEx2");
1968         return test_netr_DsRGetSiteName(p, tctx, info->dc_unc,
1969                                         info->dc_site_name);
1970 }
1971
1972 static bool test_netr_DsrGetDcSiteCoverageW(struct torture_context *tctx,
1973                                             struct dcerpc_pipe *p)
1974 {
1975         NTSTATUS status;
1976         struct netr_DsrGetDcSiteCoverageW r;
1977         struct DcSitesCtr *ctr = NULL;
1978
1979         r.in.server_name = talloc_asprintf(tctx, "\\\\%s", dcerpc_server_name(p));
1980         r.out.ctr = &ctr;
1981
1982         status = dcerpc_netr_DsrGetDcSiteCoverageW(p, tctx, &r);
1983         torture_assert_ntstatus_ok(tctx, status, "failed");
1984         torture_assert_werr_ok(tctx, r.out.result, "failed");
1985
1986         return true;
1987 }
1988
1989 static bool test_netr_DsRAddressToSitenamesW(struct torture_context *tctx,
1990                                              struct dcerpc_pipe *p)
1991 {
1992         NTSTATUS status;
1993         struct netr_DsRAddressToSitenamesW r;
1994         struct netr_DsRAddress addr;
1995         struct netr_DsRAddressToSitenamesWCtr *ctr;
1996
1997         ctr = talloc(tctx, struct netr_DsRAddressToSitenamesWCtr);
1998
1999         addr.size = 16;
2000         addr.buffer = talloc_zero_array(tctx, uint8_t, addr.size);
2001
2002         addr.buffer[0] = 2; /* AF_INET */
2003         addr.buffer[4] = 127;
2004         addr.buffer[5] = 0;
2005         addr.buffer[6] = 0;
2006         addr.buffer[7] = 1;
2007
2008         r.in.server_name = talloc_asprintf(tctx, "\\\\%s", dcerpc_server_name(p));
2009         r.in.count = 1;
2010         r.in.addresses = talloc_zero_array(tctx, struct netr_DsRAddress, r.in.count);
2011         r.in.addresses[0] = addr;
2012         r.out.ctr = &ctr;
2013
2014         status = dcerpc_netr_DsRAddressToSitenamesW(p, tctx, &r);
2015         torture_assert_ntstatus_ok(tctx, status, "failed");
2016         torture_assert_werr_ok(tctx, r.out.result, "failed");
2017
2018         return true;
2019 }
2020
2021 static bool test_netr_DsRAddressToSitenamesExW(struct torture_context *tctx,
2022                                                struct dcerpc_pipe *p)
2023 {
2024         NTSTATUS status;
2025         struct netr_DsRAddressToSitenamesExW r;
2026         struct netr_DsRAddress addr;
2027         struct netr_DsRAddressToSitenamesExWCtr *ctr;
2028
2029         ctr = talloc(tctx, struct netr_DsRAddressToSitenamesExWCtr);
2030
2031         addr.size = 16;
2032         addr.buffer = talloc_zero_array(tctx, uint8_t, addr.size);
2033
2034         addr.buffer[0] = 2; /* AF_INET */
2035         addr.buffer[4] = 127;
2036         addr.buffer[5] = 0;
2037         addr.buffer[6] = 0;
2038         addr.buffer[7] = 1;
2039
2040         r.in.server_name = talloc_asprintf(tctx, "\\\\%s", dcerpc_server_name(p));
2041         r.in.count = 1;
2042         r.in.addresses = talloc_zero_array(tctx, struct netr_DsRAddress, r.in.count);
2043         r.in.addresses[0] = addr;
2044         r.out.ctr = &ctr;
2045
2046         status = dcerpc_netr_DsRAddressToSitenamesExW(p, tctx, &r);
2047         torture_assert_ntstatus_ok(tctx, status, "failed");
2048         torture_assert_werr_ok(tctx, r.out.result, "failed");
2049
2050         return true;
2051 }
2052
2053 static bool test_GetDomainInfo(struct torture_context *tctx,
2054                                struct dcerpc_pipe *p,
2055                                struct cli_credentials *machine_credentials)
2056 {
2057         NTSTATUS status;
2058         struct netr_LogonGetDomainInfo r;
2059         struct netr_DomainQuery1 q1;
2060         struct netr_Authenticator a;
2061         struct creds_CredentialState *creds;
2062         union netr_DomainInfo info;
2063
2064         if (!test_SetupCredentials3(p, tctx, NETLOGON_NEG_AUTH2_ADS_FLAGS,
2065                                     machine_credentials, &creds)) {
2066                 return false;
2067         }
2068
2069         ZERO_STRUCT(r);
2070
2071         creds_client_authenticator(creds, &a);
2072
2073         r.in.server_name = talloc_asprintf(tctx, "\\\\%s", dcerpc_server_name(p));
2074         r.in.computer_name = TEST_MACHINE_NAME;
2075         r.in.level = 1;
2076         r.in.credential = &a;
2077         r.in.return_authenticator = &a;
2078         r.out.return_authenticator = &a;
2079         r.out.info = &info;
2080
2081         r.in.query.query1 = &q1;
2082         ZERO_STRUCT(q1);
2083
2084         /* this should really be the fully qualified name */
2085         q1.workstation_domain = TEST_MACHINE_NAME;
2086         q1.workstation_site = "Default-First-Site-Name";
2087         q1.blob2.length = 0;
2088         q1.blob2.size = 0;
2089         q1.blob2.data = NULL;
2090         q1.product.string = "product string";
2091
2092         torture_comment(tctx, "Testing netr_LogonGetDomainInfo\n");
2093
2094         status = dcerpc_netr_LogonGetDomainInfo(p, tctx, &r);
2095         torture_assert_ntstatus_ok(tctx, status, "netr_LogonGetDomainInfo");
2096         torture_assert(tctx, creds_client_check(creds, &a.cred), "Credential chaining failed");
2097
2098         torture_comment(tctx, "Testing netr_LogonGetDomainInfo 2nd call\n");
2099         creds_client_authenticator(creds, &a);
2100
2101         status = dcerpc_netr_LogonGetDomainInfo(p, tctx, &r);
2102         torture_assert_ntstatus_ok(tctx, status, "netr_LogonGetDomainInfo");
2103         torture_assert(tctx, creds_client_check(creds, &a.cred), "Credential chaining failed");
2104
2105         return true;
2106 }
2107
2108
2109 static void async_callback(struct rpc_request *req)
2110 {
2111         int *counter = (int *)req->async.private_data;
2112         if (NT_STATUS_IS_OK(req->status)) {
2113                 (*counter)++;
2114         }
2115 }
2116
2117 static bool test_GetDomainInfo_async(struct torture_context *tctx,
2118                                      struct dcerpc_pipe *p,
2119                                      struct cli_credentials *machine_credentials)
2120 {
2121         NTSTATUS status;
2122         struct netr_LogonGetDomainInfo r;
2123         struct netr_DomainQuery1 q1;
2124         struct netr_Authenticator a;
2125 #define ASYNC_COUNT 100
2126         struct creds_CredentialState *creds;
2127         struct creds_CredentialState *creds_async[ASYNC_COUNT];
2128         struct rpc_request *req[ASYNC_COUNT];
2129         int i;
2130         int *async_counter = talloc(tctx, int);
2131         union netr_DomainInfo info;
2132
2133         if (!test_SetupCredentials3(p, tctx, NETLOGON_NEG_AUTH2_ADS_FLAGS,
2134                                     machine_credentials, &creds)) {
2135                 return false;
2136         }
2137
2138         ZERO_STRUCT(r);
2139         r.in.server_name = talloc_asprintf(tctx, "\\\\%s", dcerpc_server_name(p));
2140         r.in.computer_name = TEST_MACHINE_NAME;
2141         r.in.level = 1;
2142         r.in.credential = &a;
2143         r.in.return_authenticator = &a;
2144         r.out.return_authenticator = &a;
2145         r.out.info = &info;
2146
2147         r.in.query.query1 = &q1;
2148         ZERO_STRUCT(q1);
2149
2150         /* this should really be the fully qualified name */
2151         q1.workstation_domain = TEST_MACHINE_NAME;
2152         q1.workstation_site = "Default-First-Site-Name";
2153         q1.blob2.length = 0;
2154         q1.blob2.size = 0;
2155         q1.blob2.data = NULL;
2156         q1.product.string = "product string";
2157
2158         torture_comment(tctx, "Testing netr_LogonGetDomainInfo - async count %d\n", ASYNC_COUNT);
2159
2160         *async_counter = 0;
2161
2162         for (i=0;i<ASYNC_COUNT;i++) {
2163                 creds_client_authenticator(creds, &a);
2164
2165                 creds_async[i] = (struct creds_CredentialState *)talloc_memdup(creds, creds, sizeof(*creds));
2166                 req[i] = dcerpc_netr_LogonGetDomainInfo_send(p, tctx, &r);
2167
2168                 req[i]->async.callback = async_callback;
2169                 req[i]->async.private_data = async_counter;
2170
2171                 /* even with this flush per request a w2k3 server seems to
2172                    clag with multiple outstanding requests. bleergh. */
2173                 torture_assert_int_equal(tctx, event_loop_once(dcerpc_event_context(p)), 0,
2174                                          "event_loop_once failed");
2175         }
2176
2177         for (i=0;i<ASYNC_COUNT;i++) {
2178                 status = dcerpc_ndr_request_recv(req[i]);
2179
2180                 torture_assert_ntstatus_ok(tctx, status, "netr_LogonGetDomainInfo_async");
2181                 torture_assert_ntstatus_ok(tctx, r.out.result, "netr_LogonGetDomainInfo_async");
2182
2183                 torture_assert(tctx, creds_client_check(creds_async[i], &a.cred),
2184                         "Credential chaining failed at async");
2185         }
2186
2187         torture_comment(tctx,
2188                         "Testing netr_LogonGetDomainInfo - async count %d OK\n", *async_counter);
2189
2190         torture_assert_int_equal(tctx, (*async_counter), ASYNC_COUNT, "int");
2191
2192         return true;
2193 }
2194
2195 static bool test_ManyGetDCName(struct torture_context *tctx,
2196                                struct dcerpc_pipe *p)
2197 {
2198         NTSTATUS status;
2199         struct dcerpc_pipe *p2;
2200         struct lsa_ObjectAttribute attr;
2201         struct lsa_QosInfo qos;
2202         struct lsa_OpenPolicy2 o;
2203         struct policy_handle lsa_handle;
2204         struct lsa_DomainList domains;
2205
2206         struct lsa_EnumTrustDom t;
2207         uint32_t resume_handle = 0;
2208         struct netr_GetAnyDCName d;
2209         const char *dcname = NULL;
2210
2211         int i;
2212
2213         if (p->conn->transport.transport != NCACN_NP) {
2214                 return true;
2215         }
2216
2217         torture_comment(tctx, "Torturing GetDCName\n");
2218
2219         status = dcerpc_secondary_connection(p, &p2, p->binding);
2220         torture_assert_ntstatus_ok(tctx, status, "Failed to create secondary connection");
2221
2222         status = dcerpc_bind_auth_none(p2, &ndr_table_lsarpc);
2223         torture_assert_ntstatus_ok(tctx, status, "Failed to create bind on secondary connection");
2224
2225         qos.len = 0;
2226         qos.impersonation_level = 2;
2227         qos.context_mode = 1;
2228         qos.effective_only = 0;
2229
2230         attr.len = 0;
2231         attr.root_dir = NULL;
2232         attr.object_name = NULL;
2233         attr.attributes = 0;
2234         attr.sec_desc = NULL;
2235         attr.sec_qos = &qos;
2236
2237         o.in.system_name = "\\";
2238         o.in.attr = &attr;
2239         o.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
2240         o.out.handle = &lsa_handle;
2241
2242         status = dcerpc_lsa_OpenPolicy2(p2, tctx, &o);
2243         torture_assert_ntstatus_ok(tctx, status, "OpenPolicy2 failed");
2244
2245         t.in.handle = &lsa_handle;
2246         t.in.resume_handle = &resume_handle;
2247         t.in.max_size = 1000;
2248         t.out.domains = &domains;
2249         t.out.resume_handle = &resume_handle;
2250
2251         status = dcerpc_lsa_EnumTrustDom(p2, tctx, &t);
2252
2253         if ((!NT_STATUS_IS_OK(status) &&
2254              (!NT_STATUS_EQUAL(status, NT_STATUS_NO_MORE_ENTRIES))))
2255                 torture_fail(tctx, "Could not list domains");
2256
2257         talloc_free(p2);
2258
2259         d.in.logon_server = talloc_asprintf(tctx, "\\\\%s",
2260                                             dcerpc_server_name(p));
2261         d.out.dcname = &dcname;
2262
2263         for (i=0; i<domains.count * 4; i++) {
2264                 struct lsa_DomainInfo *info =
2265                         &domains.domains[rand()%domains.count];
2266
2267                 d.in.domainname = info->name.string;
2268
2269                 status = dcerpc_netr_GetAnyDCName(p, tctx, &d);
2270                 torture_assert_ntstatus_ok(tctx, status, "GetAnyDCName");
2271
2272                 torture_comment(tctx, "\tDC for domain %s is %s\n", info->name.string,
2273                        dcname ? dcname : "unknown");
2274         }
2275
2276         return true;
2277 }
2278
2279 struct torture_suite *torture_rpc_netlogon(TALLOC_CTX *mem_ctx)
2280 {
2281         struct torture_suite *suite = torture_suite_create(mem_ctx, "NETLOGON");
2282         struct torture_rpc_tcase *tcase;
2283         struct torture_test *test;
2284
2285         tcase = torture_suite_add_machine_rpc_iface_tcase(suite, "netlogon",
2286                                                   &ndr_table_netlogon, TEST_MACHINE_NAME);
2287
2288         torture_rpc_tcase_add_test(tcase, "LogonUasLogon", test_LogonUasLogon);
2289         torture_rpc_tcase_add_test(tcase, "LogonUasLogoff", test_LogonUasLogoff);
2290         torture_rpc_tcase_add_test_creds(tcase, "SamLogon", test_SamLogon);
2291         torture_rpc_tcase_add_test_creds(tcase, "SetPassword", test_SetPassword);
2292         torture_rpc_tcase_add_test_creds(tcase, "SetPassword2", test_SetPassword2);
2293         torture_rpc_tcase_add_test_creds(tcase, "GetPassword", test_GetPassword);
2294         torture_rpc_tcase_add_test_creds(tcase, "GetTrustPasswords", test_GetTrustPasswords);
2295         torture_rpc_tcase_add_test_creds(tcase, "GetDomainInfo", test_GetDomainInfo);
2296         torture_rpc_tcase_add_test_creds(tcase, "DatabaseSync", test_DatabaseSync);
2297         torture_rpc_tcase_add_test_creds(tcase, "DatabaseDeltas", test_DatabaseDeltas);
2298         torture_rpc_tcase_add_test_creds(tcase, "DatabaseRedo", test_DatabaseRedo);
2299         torture_rpc_tcase_add_test_creds(tcase, "AccountDeltas", test_AccountDeltas);
2300         torture_rpc_tcase_add_test_creds(tcase, "AccountSync", test_AccountSync);
2301         torture_rpc_tcase_add_test(tcase, "GetDcName", test_GetDcName);
2302         torture_rpc_tcase_add_test(tcase, "ManyGetDCName", test_ManyGetDCName);
2303         torture_rpc_tcase_add_test(tcase, "LogonControl", test_LogonControl);
2304         torture_rpc_tcase_add_test(tcase, "GetAnyDCName", test_GetAnyDCName);
2305         torture_rpc_tcase_add_test(tcase, "LogonControl2", test_LogonControl2);
2306         torture_rpc_tcase_add_test_creds(tcase, "DatabaseSync2", test_DatabaseSync2);
2307         torture_rpc_tcase_add_test(tcase, "LogonControl2Ex", test_LogonControl2Ex);
2308         torture_rpc_tcase_add_test(tcase, "DsrEnumerateDomainTrusts", test_DsrEnumerateDomainTrusts);
2309         torture_rpc_tcase_add_test(tcase, "NetrEnumerateTrustedDomains", test_netr_NetrEnumerateTrustedDomains);
2310         torture_rpc_tcase_add_test(tcase, "NetrEnumerateTrustedDomainsEx", test_netr_NetrEnumerateTrustedDomainsEx);
2311         test = torture_rpc_tcase_add_test_creds(tcase, "GetDomainInfo_async", test_GetDomainInfo_async);
2312         test->dangerous = true;
2313         torture_rpc_tcase_add_test(tcase, "DsRGetDCName", test_netr_DsRGetDCName);
2314         torture_rpc_tcase_add_test(tcase, "DsRGetDCNameEx", test_netr_DsRGetDCNameEx);
2315         torture_rpc_tcase_add_test(tcase, "DsRGetDCNameEx2", test_netr_DsRGetDCNameEx2);
2316         torture_rpc_tcase_add_test(tcase, "DsrGetDcSiteCoverageW", test_netr_DsrGetDcSiteCoverageW);
2317         torture_rpc_tcase_add_test(tcase, "DsRAddressToSitenamesW", test_netr_DsRAddressToSitenamesW);
2318         torture_rpc_tcase_add_test(tcase, "DsRAddressToSitenamesExW", test_netr_DsRAddressToSitenamesExW);
2319
2320         return suite;
2321 }