source4/torture/rpc/netlogon.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3
   4    test suite for netlogon rpc operations
   5
   6    Copyright (C) Andrew Tridgell 2003
   7    Copyright (C) Andrew Bartlett <abartlet@samba.org> 2003-2004
   8    Copyright (C) Tim Potter      2003
   9
  10    This program is free software; you can redistribute it and/or modify
  11    it under the terms of the GNU General Public License as published by
  12    the Free Software Foundation; either version 3 of the License, or
  13    (at your option) any later version.
  14
  15    This program is distributed in the hope that it will be useful,
  16    but WITHOUT ANY WARRANTY; without even the implied warranty of
  17    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  18    GNU General Public License for more details.
  19
  20    You should have received a copy of the GNU General Public License
  21    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  22 */
  23
  24 #include "includes.h"
  25 #include "torture/torture.h"
  26 #include "lib/events/events.h"
  27 #include "auth/auth.h"
  28 #include "auth/gensec/gensec.h"
  29 #include "lib/cmdline/popt_common.h"
  30 #include "torture/rpc/rpc.h"
  31 #include "torture/rpc/netlogon.h"
  32 #include "../lib/crypto/crypto.h"
  33 #include "libcli/auth/libcli_auth.h"
  34 #include "librpc/gen_ndr/ndr_netlogon_c.h"
  35 #include "librpc/gen_ndr/ndr_lsa_c.h"
  36 #include "param/param.h"
  37
  38 #define TEST_MACHINE_NAME "torturetest"
  39
  40 static bool test_LogonUasLogon(struct torture_context *tctx,
  41                                struct dcerpc_pipe *p)
  42 {
  43         NTSTATUS status;
  44         struct netr_LogonUasLogon r;
  45         struct netr_UasInfo *info = NULL;
  46
  47         r.in.server_name = NULL;
  48         r.in.account_name = cli_credentials_get_username(cmdline_credentials);
  49         r.in.workstation = TEST_MACHINE_NAME;
  50         r.out.info = &info;
  51
  52         status = dcerpc_netr_LogonUasLogon(p, tctx, &r);
  53         torture_assert_ntstatus_ok(tctx, status, "LogonUasLogon");
  54
  55         return true;
  56 }
  57
  58 static bool test_LogonUasLogoff(struct torture_context *tctx,
  59                                 struct dcerpc_pipe *p)
  60 {
  61         NTSTATUS status;
  62         struct netr_LogonUasLogoff r;
  63         struct netr_UasLogoffInfo info;
  64
  65         r.in.server_name = NULL;
  66         r.in.account_name = cli_credentials_get_username(cmdline_credentials);
  67         r.in.workstation = TEST_MACHINE_NAME;
  68         r.out.info = &info;
  69
  70         status = dcerpc_netr_LogonUasLogoff(p, tctx, &r);
  71         torture_assert_ntstatus_ok(tctx, status, "LogonUasLogoff");
  72
  73         return true;
  74 }
  75
  76 static bool test_SetupCredentials(struct dcerpc_pipe *p, struct torture_context *tctx,
  77                                   struct cli_credentials *credentials,
  78                                   struct creds_CredentialState **creds_out)
  79 {
  80         NTSTATUS status;
  81         struct netr_ServerReqChallenge r;
  82         struct netr_ServerAuthenticate a;
  83         struct netr_Credential credentials1, credentials2, credentials3;
  84         struct creds_CredentialState *creds;
  85         const struct samr_Password *mach_password;
  86         const char *machine_name;
  87
  88         mach_password = cli_credentials_get_nt_hash(credentials, tctx);
  89         machine_name = cli_credentials_get_workstation(credentials);
  90
  91         torture_comment(tctx, "Testing ServerReqChallenge\n");
  92
  93         creds = talloc(tctx, struct creds_CredentialState);
  94         torture_assert(tctx, creds != NULL, "memory allocation");
  95
  96         r.in.server_name = NULL;
  97         r.in.computer_name = machine_name;
  98         r.in.credentials = &credentials1;
  99         r.out.credentials = &credentials2;
 100
 101         generate_random_buffer(credentials1.data, sizeof(credentials1.data));
 102
 103         status = dcerpc_netr_ServerReqChallenge(p, tctx, &r);
 104         torture_assert_ntstatus_ok(tctx, status, "ServerReqChallenge");
 105
 106         a.in.server_name = NULL;
 107         a.in.account_name = talloc_asprintf(tctx, "%s$", machine_name);
 108         a.in.secure_channel_type = SEC_CHAN_BDC;
 109         a.in.computer_name = machine_name;
 110         a.in.credentials = &credentials3;
 111         a.out.credentials = &credentials3;
 112
 113         creds_client_init(creds, &credentials1, &credentials2,
 114                           mach_password, &credentials3,
 115                           0);
 116
 117         torture_comment(tctx, "Testing ServerAuthenticate\n");
 118
 119         status = dcerpc_netr_ServerAuthenticate(p, tctx, &a);
 120
 121         /* This allows the tests to continue against the more fussy windows 2008 */
 122         if (NT_STATUS_EQUAL(status, NT_STATUS_DOWNGRADE_DETECTED)) {
 123                 return test_SetupCredentials2(p, tctx, NETLOGON_NEG_AUTH2_ADS_FLAGS,
 124                                               credentials, SEC_CHAN_BDC, creds_out);
 125         }
 126
 127         torture_assert_ntstatus_ok(tctx, status, "ServerAuthenticate");
 128
 129         torture_assert(tctx, creds_client_check(creds, &credentials3),
 130                        "Credential chaining failed");
 131
 132         *creds_out = creds;
 133         return true;
 134 }
 135
 136 bool test_SetupCredentials2(struct dcerpc_pipe *p, struct torture_context *tctx,
 137                             uint32_t negotiate_flags,
 138                             struct cli_credentials *machine_credentials,
 139                             int sec_chan_type,
 140                             struct creds_CredentialState **creds_out)
 141 {
 142         NTSTATUS status;
 143         struct netr_ServerReqChallenge r;
 144         struct netr_ServerAuthenticate2 a;
 145         struct netr_Credential credentials1, credentials2, credentials3;
 146         struct creds_CredentialState *creds;
 147         const struct samr_Password *mach_password;
 148         const char *machine_name;
 149         const char *plain_pass;
 150
 151         mach_password = cli_credentials_get_nt_hash(machine_credentials, tctx);
 152         machine_name = cli_credentials_get_workstation(machine_credentials);
 153
 154         torture_comment(tctx, "Testing ServerReqChallenge\n");
 155
 156         creds = talloc(tctx, struct creds_CredentialState);
 157         torture_assert(tctx, creds != NULL, "memory allocation");
 158
 159         r.in.server_name = NULL;
 160         r.in.computer_name = machine_name;
 161         r.in.credentials = &credentials1;
 162         r.out.credentials = &credentials2;
 163
 164         generate_random_buffer(credentials1.data, sizeof(credentials1.data));
 165
 166         status = dcerpc_netr_ServerReqChallenge(p, tctx, &r);
 167         torture_assert_ntstatus_ok(tctx, status, "ServerReqChallenge");
 168
 169         a.in.server_name = NULL;
 170         a.in.account_name = talloc_asprintf(tctx, "%s$", machine_name);
 171         a.in.secure_channel_type = sec_chan_type;
 172         a.in.computer_name = machine_name;
 173         a.in.negotiate_flags = &negotiate_flags;
 174         a.out.negotiate_flags = &negotiate_flags;
 175         a.in.credentials = &credentials3;
 176         a.out.credentials = &credentials3;
 177
 178         creds_client_init(creds, &credentials1, &credentials2,
 179                           mach_password, &credentials3,
 180                           negotiate_flags);
 181
 182         torture_comment(tctx, "Testing ServerAuthenticate2\n");
 183
 184         status = dcerpc_netr_ServerAuthenticate2(p, tctx, &a);
 185         torture_assert_ntstatus_ok(tctx, status, "ServerAuthenticate2");
 186
 187         torture_assert(tctx, creds_client_check(creds, &credentials3),
 188                 "Credential chaining failed");
 189
 190         torture_comment(tctx, "negotiate_flags=0x%08x\n", negotiate_flags);
 191
 192         *creds_out = creds;
 193         return true;
 194 }
 195
 196
 197 static bool test_SetupCredentials3(struct dcerpc_pipe *p, struct torture_context *tctx,
 198                             uint32_t negotiate_flags,
 199                             struct cli_credentials *machine_credentials,
 200                             struct creds_CredentialState **creds_out)
 201 {
 202         NTSTATUS status;
 203         struct netr_ServerReqChallenge r;
 204         struct netr_ServerAuthenticate3 a;
 205         struct netr_Credential credentials1, credentials2, credentials3;
 206         struct creds_CredentialState *creds;
 207         struct samr_Password mach_password;
 208         uint32_t rid;
 209         const char *machine_name;
 210         const char *plain_pass;
 211
 212         machine_name = cli_credentials_get_workstation(machine_credentials);
 213         plain_pass = cli_credentials_get_password(machine_credentials);
 214
 215         torture_comment(tctx, "Testing ServerReqChallenge\n");
 216
 217         creds = talloc(tctx, struct creds_CredentialState);
 218         torture_assert(tctx, creds != NULL, "memory allocation");
 219
 220         r.in.server_name = NULL;
 221         r.in.computer_name = machine_name;
 222         r.in.credentials = &credentials1;
 223         r.out.credentials = &credentials2;
 224
 225         generate_random_buffer(credentials1.data, sizeof(credentials1.data));
 226
 227         status = dcerpc_netr_ServerReqChallenge(p, tctx, &r);
 228         torture_assert_ntstatus_ok(tctx, status, "ServerReqChallenge");
 229
 230         E_md4hash(plain_pass, mach_password.hash);
 231
 232         a.in.server_name = NULL;
 233         a.in.account_name = talloc_asprintf(tctx, "%s$", machine_name);
 234         a.in.secure_channel_type = SEC_CHAN_BDC;
 235         a.in.computer_name = machine_name;
 236         a.in.negotiate_flags = &negotiate_flags;
 237         a.in.credentials = &credentials3;
 238         a.out.credentials = &credentials3;
 239         a.out.negotiate_flags = &negotiate_flags;
 240         a.out.rid = &rid;
 241
 242         creds_client_init(creds, &credentials1, &credentials2,
 243                           &mach_password, &credentials3,
 244                           negotiate_flags);
 245
 246         torture_comment(tctx, "Testing ServerAuthenticate3\n");
 247
 248         status = dcerpc_netr_ServerAuthenticate3(p, tctx, &a);
 249         torture_assert_ntstatus_ok(tctx, status, "ServerAuthenticate3");
 250         torture_assert(tctx, creds_client_check(creds, &credentials3), "Credential chaining failed");
 251
 252         torture_comment(tctx, "negotiate_flags=0x%08x\n", negotiate_flags);
 253
 254         /* Prove that requesting a challenge again won't break it */
 255         status = dcerpc_netr_ServerReqChallenge(p, tctx, &r);
 256         torture_assert_ntstatus_ok(tctx, status, "ServerReqChallenge");
 257
 258         *creds_out = creds;
 259         return true;
 260 }
 261
 262 /*
 263   try a change password for our machine account
 264 */
 265 static bool test_SetPassword(struct torture_context *tctx,
 266                              struct dcerpc_pipe *p,
 267                              struct cli_credentials *machine_credentials)
 268 {
 269         NTSTATUS status;
 270         struct netr_ServerPasswordSet r;
 271         const char *password;
 272         struct creds_CredentialState *creds;
 273
 274         if (!test_SetupCredentials(p, tctx, machine_credentials, &creds)) {
 275                 return false;
 276         }
 277
 278         r.in.server_name = talloc_asprintf(tctx, "\\\\%s", dcerpc_server_name(p));
 279         r.in.account_name = talloc_asprintf(tctx, "%s$", TEST_MACHINE_NAME);
 280         r.in.secure_channel_type = SEC_CHAN_BDC;
 281         r.in.computer_name = TEST_MACHINE_NAME;
 282
 283         password = generate_random_str(tctx, 8);
 284         E_md4hash(password, r.in.new_password.hash);
 285
 286         creds_des_encrypt(creds, &r.in.new_password);
 287
 288         torture_comment(tctx, "Testing ServerPasswordSet on machine account\n");
 289         torture_comment(tctx, "Changing machine account password to '%s'\n",
 290                         password);
 291
 292         creds_client_authenticator(creds, &r.in.credential);
 293
 294         status = dcerpc_netr_ServerPasswordSet(p, tctx, &r);
 295         torture_assert_ntstatus_ok(tctx, status, "ServerPasswordSet");
 296
 297         if (!creds_client_check(creds, &r.out.return_authenticator.cred)) {
 298                 torture_comment(tctx, "Credential chaining failed\n");
 299         }
 300
 301         /* by changing the machine password twice we test the
 302            credentials chaining fully, and we verify that the server
 303            allows the password to be set to the same value twice in a
 304            row (match win2k3) */
 305         torture_comment(tctx,
 306                 "Testing a second ServerPasswordSet on machine account\n");
 307         torture_comment(tctx,
 308                 "Changing machine account password to '%s' (same as previous run)\n", password);
 309
 310         creds_client_authenticator(creds, &r.in.credential);
 311
 312         status = dcerpc_netr_ServerPasswordSet(p, tctx, &r);
 313         torture_assert_ntstatus_ok(tctx, status, "ServerPasswordSet (2)");
 314
 315         if (!creds_client_check(creds, &r.out.return_authenticator.cred)) {
 316                 torture_comment(tctx, "Credential chaining failed\n");
 317         }
 318
 319         cli_credentials_set_password(machine_credentials, password, CRED_SPECIFIED);
 320
 321         torture_assert(tctx,
 322                 test_SetupCredentials(p, tctx, machine_credentials, &creds),
 323                 "ServerPasswordSet failed to actually change the password");
 324
 325         return true;
 326 }
 327
 328 /*
 329   generate a random password for password change tests
 330 */
 331 static DATA_BLOB netlogon_very_rand_pass(TALLOC_CTX *mem_ctx, int len)
 332 {
 333         int i;
 334         DATA_BLOB password = data_blob_talloc(mem_ctx, NULL, len * 2 /* number of unicode chars */);
 335         generate_random_buffer(password.data, password.length);
 336
 337         for (i=0; i < len; i++) {
 338                 if (((uint16_t *)password.data)[i] == 0) {
 339                         ((uint16_t *)password.data)[i] = 1;
 340                 }
 341         }
 342
 343         return password;
 344 }
 345
 346 /*
 347   try a change password for our machine account
 348 */
 349 static bool test_SetPassword2(struct torture_context *tctx,
 350                               struct dcerpc_pipe *p,
 351                               struct cli_credentials *machine_credentials)
 352 {
 353         NTSTATUS status;
 354         struct netr_ServerPasswordSet2 r;
 355         const char *password;
 356         DATA_BLOB new_random_pass;
 357         struct creds_CredentialState *creds;
 358         struct samr_CryptPassword password_buf;
 359         struct samr_Password nt_hash;
 360
 361         if (!test_SetupCredentials(p, tctx, machine_credentials, &creds)) {
 362                 return false;
 363         }
 364
 365         r.in.server_name = talloc_asprintf(tctx, "\\\\%s", dcerpc_server_name(p));
 366         r.in.account_name = talloc_asprintf(tctx, "%s$", TEST_MACHINE_NAME);
 367         r.in.secure_channel_type = SEC_CHAN_BDC;
 368         r.in.computer_name = TEST_MACHINE_NAME;
 369
 370         password = generate_random_str(tctx, 8);
 371         encode_pw_buffer(password_buf.data, password, STR_UNICODE);
 372         creds_arcfour_crypt(creds, password_buf.data, 516);
 373
 374         memcpy(r.in.new_password.data, password_buf.data, 512);
 375         r.in.new_password.length = IVAL(password_buf.data, 512);
 376
 377         torture_comment(tctx, "Testing ServerPasswordSet2 on machine account\n");
 378         torture_comment(tctx, "Changing machine account password to '%s'\n", password);
 379
 380         creds_client_authenticator(creds, &r.in.credential);
 381
 382         status = dcerpc_netr_ServerPasswordSet2(p, tctx, &r);
 383         torture_assert_ntstatus_ok(tctx, status, "ServerPasswordSet2");
 384
 385         if (!creds_client_check(creds, &r.out.return_authenticator.cred)) {
 386                 torture_comment(tctx, "Credential chaining failed\n");
 387         }
 388
 389         cli_credentials_set_password(machine_credentials, password, CRED_SPECIFIED);
 390
 391         if (!torture_setting_bool(tctx, "dangerous", false)) {
 392                 torture_comment(tctx,
 393                         "Not testing ability to set password to '', enable dangerous tests to perform this test\n");
 394         } else {
 395                 /* by changing the machine password to ""
 396                  * we check if the server uses password restrictions
 397                  * for ServerPasswordSet2
 398                  * (win2k3 accepts "")
 399                  */
 400                 password = "";
 401                 encode_pw_buffer(password_buf.data, password, STR_UNICODE);
 402                 creds_arcfour_crypt(creds, password_buf.data, 516);
 403
 404                 memcpy(r.in.new_password.data, password_buf.data, 512);
 405                 r.in.new_password.length = IVAL(password_buf.data, 512);
 406
 407                 torture_comment(tctx,
 408                         "Testing ServerPasswordSet2 on machine account\n");
 409                 torture_comment(tctx,
 410                         "Changing machine account password to '%s'\n", password);
 411
 412                 creds_client_authenticator(creds, &r.in.credential);
 413
 414                 status = dcerpc_netr_ServerPasswordSet2(p, tctx, &r);
 415                 torture_assert_ntstatus_ok(tctx, status, "ServerPasswordSet2");
 416
 417                 if (!creds_client_check(creds, &r.out.return_authenticator.cred)) {
 418                         torture_comment(tctx, "Credential chaining failed\n");
 419                 }
 420
 421                 cli_credentials_set_password(machine_credentials, password, CRED_SPECIFIED);
 422         }
 423
 424         torture_assert(tctx, test_SetupCredentials(p, tctx, machine_credentials, &creds),
 425                 "ServerPasswordSet failed to actually change the password");
 426
 427         /* now try a random password */
 428         password = generate_random_str(tctx, 8);
 429         encode_pw_buffer(password_buf.data, password, STR_UNICODE);
 430         creds_arcfour_crypt(creds, password_buf.data, 516);
 431
 432         memcpy(r.in.new_password.data, password_buf.data, 512);
 433         r.in.new_password.length = IVAL(password_buf.data, 512);
 434
 435         torture_comment(tctx, "Testing second ServerPasswordSet2 on machine account\n");
 436         torture_comment(tctx, "Changing machine account password to '%s'\n", password);
 437
 438         creds_client_authenticator(creds, &r.in.credential);
 439
 440         status = dcerpc_netr_ServerPasswordSet2(p, tctx, &r);
 441         torture_assert_ntstatus_ok(tctx, status, "ServerPasswordSet2 (2)");
 442
 443         if (!creds_client_check(creds, &r.out.return_authenticator.cred)) {
 444                 torture_comment(tctx, "Credential chaining failed\n");
 445         }
 446
 447         /* by changing the machine password twice we test the
 448            credentials chaining fully, and we verify that the server
 449            allows the password to be set to the same value twice in a
 450            row (match win2k3) */
 451         torture_comment(tctx,
 452                 "Testing a second ServerPasswordSet2 on machine account\n");
 453         torture_comment(tctx,
 454                 "Changing machine account password to '%s' (same as previous run)\n", password);
 455
 456         creds_client_authenticator(creds, &r.in.credential);
 457
 458         status = dcerpc_netr_ServerPasswordSet2(p, tctx, &r);
 459         torture_assert_ntstatus_ok(tctx, status, "ServerPasswordSet (3)");
 460
 461         if (!creds_client_check(creds, &r.out.return_authenticator.cred)) {
 462                 torture_comment(tctx, "Credential chaining failed\n");
 463         }
 464
 465         cli_credentials_set_password(machine_credentials, password, CRED_SPECIFIED);
 466
 467         torture_assert (tctx,
 468                 test_SetupCredentials(p, tctx, machine_credentials, &creds),
 469                 "ServerPasswordSet failed to actually change the password");
 470
 471         new_random_pass = netlogon_very_rand_pass(tctx, 128);
 472
 473         /* now try a random stream of bytes for a password */
 474         set_pw_in_buffer(password_buf.data, &new_random_pass);
 475
 476         creds_arcfour_crypt(creds, password_buf.data, 516);
 477
 478         memcpy(r.in.new_password.data, password_buf.data, 512);
 479         r.in.new_password.length = IVAL(password_buf.data, 512);
 480
 481         torture_comment(tctx,
 482                 "Testing a third ServerPasswordSet2 on machine account, with a compleatly random password\n");
 483
 484         creds_client_authenticator(creds, &r.in.credential);
 485
 486         status = dcerpc_netr_ServerPasswordSet2(p, tctx, &r);
 487         torture_assert_ntstatus_ok(tctx, status, "ServerPasswordSet (3)");
 488
 489         if (!creds_client_check(creds, &r.out.return_authenticator.cred)) {
 490                 torture_comment(tctx, "Credential chaining failed\n");
 491         }
 492
 493         mdfour(nt_hash.hash, new_random_pass.data, new_random_pass.length);
 494
 495         cli_credentials_set_password(machine_credentials, NULL, CRED_UNINITIALISED);
 496         cli_credentials_set_nt_hash(machine_credentials, &nt_hash, CRED_SPECIFIED);
 497
 498         torture_assert (tctx,
 499                 test_SetupCredentials(p, tctx, machine_credentials, &creds),
 500                 "ServerPasswordSet failed to actually change the password");
 501
 502         return true;
 503 }
 504
 505 static bool test_GetPassword(struct torture_context *tctx,
 506                              struct dcerpc_pipe *p,
 507                              struct cli_credentials *machine_credentials)
 508 {
 509         struct netr_ServerPasswordGet r;
 510         struct creds_CredentialState *creds;
 511         struct netr_Authenticator credential;
 512         NTSTATUS status;
 513         struct netr_Authenticator return_authenticator;
 514         struct samr_Password password;
 515
 516         if (!test_SetupCredentials(p, tctx, machine_credentials, &creds)) {
 517                 return false;
 518         }
 519
 520         creds_client_authenticator(creds, &credential);
 521
 522         r.in.server_name = talloc_asprintf(tctx, "\\\\%s", dcerpc_server_name(p));
 523         r.in.account_name = talloc_asprintf(tctx, "%s$", TEST_MACHINE_NAME);
 524         r.in.secure_channel_type = SEC_CHAN_BDC;
 525         r.in.computer_name = TEST_MACHINE_NAME;
 526         r.in.credential = &credential;
 527         r.out.return_authenticator = &return_authenticator;
 528         r.out.password = &password;
 529
 530         status = dcerpc_netr_ServerPasswordGet(p, tctx, &r);
 531         torture_assert_ntstatus_ok(tctx, status, "ServerPasswordGet");
 532
 533         return true;
 534 }
 535
 536 static bool test_GetTrustPasswords(struct torture_context *tctx,
 537                                    struct dcerpc_pipe *p,
 538                                    struct cli_credentials *machine_credentials)
 539 {
 540         struct netr_ServerTrustPasswordsGet r;
 541         struct creds_CredentialState *creds;
 542         struct netr_Authenticator credential;
 543         NTSTATUS status;
 544         struct netr_Authenticator return_authenticator;
 545         struct samr_Password password, password2;
 546
 547         if (!test_SetupCredentials(p, tctx, machine_credentials, &creds)) {
 548                 return false;
 549         }
 550
 551         creds_client_authenticator(creds, &credential);
 552
 553         r.in.server_name = talloc_asprintf(tctx, "\\\\%s", dcerpc_server_name(p));
 554         r.in.account_name = talloc_asprintf(tctx, "%s$", TEST_MACHINE_NAME);
 555         r.in.secure_channel_type = SEC_CHAN_BDC;
 556         r.in.computer_name = TEST_MACHINE_NAME;
 557         r.in.credential = &credential;
 558         r.out.return_authenticator = &return_authenticator;
 559         r.out.password = &password;
 560         r.out.password2 = &password2;
 561
 562         status = dcerpc_netr_ServerTrustPasswordsGet(p, tctx, &r);
 563         torture_assert_ntstatus_ok(tctx, status, "ServerTrustPasswordsGet");
 564
 565         return true;
 566 }
 567
 568 /*
 569   try a netlogon SamLogon
 570 */
 571 bool test_netlogon_ops(struct dcerpc_pipe *p, struct torture_context *tctx,
 572                               struct cli_credentials *credentials,
 573                               struct creds_CredentialState *creds)
 574 {
 575         NTSTATUS status;
 576         struct netr_LogonSamLogon r;
 577         struct netr_Authenticator auth, auth2;
 578         struct netr_NetworkInfo ninfo;
 579         DATA_BLOB names_blob, chal, lm_resp, nt_resp;
 580         int i;
 581         int flags = CLI_CRED_NTLM_AUTH;
 582         if (lp_client_lanman_auth(tctx->lp_ctx)) {
 583                 flags |= CLI_CRED_LANMAN_AUTH;
 584         }
 585
 586         if (lp_client_ntlmv2_auth(tctx->lp_ctx)) {
 587                 flags |= CLI_CRED_NTLMv2_AUTH;
 588         }
 589
 590         cli_credentials_get_ntlm_username_domain(cmdline_credentials, tctx,
 591                                                  &ninfo.identity_info.account_name.string,
 592                                                  &ninfo.identity_info.domain_name.string);
 593
 594         generate_random_buffer(ninfo.challenge,
 595                                sizeof(ninfo.challenge));
 596         chal = data_blob_const(ninfo.challenge,
 597                                sizeof(ninfo.challenge));
 598
 599         names_blob = NTLMv2_generate_names_blob(tctx, cli_credentials_get_workstation(credentials),
 600                                                 cli_credentials_get_domain(credentials));
 601
 602         status = cli_credentials_get_ntlm_response(cmdline_credentials, tctx,
 603                                                    &flags,
 604                                                    chal,
 605                                                    names_blob,
 606                                                    &lm_resp, &nt_resp,
 607                                                    NULL, NULL);
 608         torture_assert_ntstatus_ok(tctx, status, "cli_credentials_get_ntlm_response failed");
 609
 610         ninfo.lm.data = lm_resp.data;
 611         ninfo.lm.length = lm_resp.length;
 612
 613         ninfo.nt.data = nt_resp.data;
 614         ninfo.nt.length = nt_resp.length;
 615
 616         ninfo.identity_info.parameter_control = 0;
 617         ninfo.identity_info.logon_id_low = 0;
 618         ninfo.identity_info.logon_id_high = 0;
 619         ninfo.identity_info.workstation.string = cli_credentials_get_workstation(credentials);
 620
 621         r.in.server_name = talloc_asprintf(tctx, "\\\\%s", dcerpc_server_name(p));
 622         r.in.computer_name = cli_credentials_get_workstation(credentials);
 623         r.in.credential = &auth;
 624         r.in.return_authenticator = &auth2;
 625         r.in.logon_level = 2;
 626         r.in.logon.network = &ninfo;
 627
 628         d_printf("Testing LogonSamLogon with name %s\n", ninfo.identity_info.account_name.string);
 629
 630         for (i=2;i<3;i++) {
 631                 ZERO_STRUCT(auth2);
 632                 creds_client_authenticator(creds, &auth);
 633
 634                 r.in.validation_level = i;
 635
 636                 status = dcerpc_netr_LogonSamLogon(p, tctx, &r);
 637                 torture_assert_ntstatus_ok(tctx, status, "LogonSamLogon failed");
 638
 639                 torture_assert(tctx, creds_client_check(creds, &r.out.return_authenticator->cred),
 640                         "Credential chaining failed");
 641         }
 642
 643         r.in.credential = NULL;
 644
 645         for (i=2;i<=3;i++) {
 646
 647                 r.in.validation_level = i;
 648
 649                 torture_comment(tctx, "Testing SamLogon with validation level %d and a NULL credential\n", i);
 650
 651                 status = dcerpc_netr_LogonSamLogon(p, tctx, &r);
 652                 torture_assert_ntstatus_equal(tctx, status, NT_STATUS_INVALID_PARAMETER,
 653                         "LogonSamLogon expected INVALID_PARAMETER");
 654
 655         }
 656
 657         return true;
 658 }
 659
 660 /*
 661   try a netlogon SamLogon
 662 */
 663 static bool test_SamLogon(struct torture_context *tctx,
 664                           struct dcerpc_pipe *p,
 665                           struct cli_credentials *credentials)
 666 {
 667         struct creds_CredentialState *creds;
 668
 669         if (!test_SetupCredentials(p, tctx, credentials, &creds)) {
 670                 return false;
 671         }
 672
 673         return test_netlogon_ops(p, tctx, credentials, creds);
 674 }
 675
 676 /* we remember the sequence numbers so we can easily do a DatabaseDelta */
 677 static uint64_t sequence_nums[3];
 678
 679 /*
 680   try a netlogon DatabaseSync
 681 */
 682 static bool test_DatabaseSync(struct torture_context *tctx,
 683                               struct dcerpc_pipe *p,
 684                               struct cli_credentials *machine_credentials)
 685 {
 686         NTSTATUS status;
 687         struct netr_DatabaseSync r;
 688         struct creds_CredentialState *creds;
 689         const uint32_t database_ids[] = {SAM_DATABASE_DOMAIN, SAM_DATABASE_BUILTIN, SAM_DATABASE_PRIVS};
 690         int i;
 691
 692         if (!test_SetupCredentials(p, tctx, machine_credentials, &creds)) {
 693                 return false;
 694         }
 695
 696         r.in.logon_server = talloc_asprintf(tctx, "\\\\%s", dcerpc_server_name(p));
 697         r.in.computername = TEST_MACHINE_NAME;
 698         r.in.preferredmaximumlength = (uint32_t)-1;
 699         ZERO_STRUCT(r.in.return_authenticator);
 700
 701         for (i=0;i<ARRAY_SIZE(database_ids);i++) {
 702                 r.in.sync_context = 0;
 703                 r.in.database_id = database_ids[i];
 704
 705                 torture_comment(tctx, "Testing DatabaseSync of id %d\n", r.in.database_id);
 706
 707                 do {
 708                         creds_client_authenticator(creds, &r.in.credential);
 709
 710                         status = dcerpc_netr_DatabaseSync(p, tctx, &r);
 711                         if (NT_STATUS_EQUAL(status, STATUS_MORE_ENTRIES))
 712                             break;
 713
 714                         /* Native mode servers don't do this */
 715                         if (NT_STATUS_EQUAL(status, NT_STATUS_NOT_SUPPORTED)) {
 716                                 return true;
 717                         }
 718                         torture_assert_ntstatus_ok(tctx, status, "DatabaseSync");
 719
 720                         if (!creds_client_check(creds, &r.out.return_authenticator.cred)) {
 721                                 torture_comment(tctx, "Credential chaining failed\n");
 722                         }
 723
 724                         r.in.sync_context = r.out.sync_context;
 725
 726                         if (r.out.delta_enum_array &&
 727                             r.out.delta_enum_array->num_deltas > 0 &&
 728                             r.out.delta_enum_array->delta_enum[0].delta_type == NETR_DELTA_DOMAIN &&
 729                             r.out.delta_enum_array->delta_enum[0].delta_union.domain) {
 730                                 sequence_nums[r.in.database_id] =
 731                                         r.out.delta_enum_array->delta_enum[0].delta_union.domain->sequence_num;
 732                                 torture_comment(tctx, "\tsequence_nums[%d]=%llu\n",
 733                                        r.in.database_id,
 734                                        (unsigned long long)sequence_nums[r.in.database_id]);
 735                         }
 736                 } while (NT_STATUS_EQUAL(status, STATUS_MORE_ENTRIES));
 737         }
 738
 739         return true;
 740 }
 741
 742
 743 /*
 744   try a netlogon DatabaseDeltas
 745 */
 746 static bool test_DatabaseDeltas(struct torture_context *tctx,
 747                                 struct dcerpc_pipe *p,
 748                                 struct cli_credentials *machine_credentials)
 749 {
 750         NTSTATUS status;
 751         struct netr_DatabaseDeltas r;
 752         struct creds_CredentialState *creds;
 753         const uint32_t database_ids[] = {0, 1, 2};
 754         int i;
 755
 756         if (!test_SetupCredentials(p, tctx, machine_credentials, &creds)) {
 757                 return false;
 758         }
 759
 760         r.in.logon_server = talloc_asprintf(tctx, "\\\\%s", dcerpc_server_name(p));
 761         r.in.computername = TEST_MACHINE_NAME;
 762         r.in.preferredmaximumlength = (uint32_t)-1;
 763         ZERO_STRUCT(r.in.return_authenticator);
 764
 765         for (i=0;i<ARRAY_SIZE(database_ids);i++) {
 766                 r.in.database_id = database_ids[i];
 767                 r.in.sequence_num = sequence_nums[r.in.database_id];
 768
 769                 if (r.in.sequence_num == 0) continue;
 770
 771                 r.in.sequence_num -= 1;
 772
 773                 torture_comment(tctx, "Testing DatabaseDeltas of id %d at %llu\n",
 774                        r.in.database_id, (unsigned long long)r.in.sequence_num);
 775
 776                 do {
 777                         creds_client_authenticator(creds, &r.in.credential);
 778
 779                         status = dcerpc_netr_DatabaseDeltas(p, tctx, &r);
 780                         if (NT_STATUS_EQUAL(status,
 781                                              NT_STATUS_SYNCHRONIZATION_REQUIRED)) {
 782                                 torture_comment(tctx, "not considering %s to be an error\n",
 783                                        nt_errstr(status));
 784                                 return true;
 785                         }
 786                         if (NT_STATUS_EQUAL(status, STATUS_MORE_ENTRIES))
 787                             break;
 788
 789                         torture_assert_ntstatus_ok(tctx, status, "DatabaseDeltas");
 790
 791                         if (!creds_client_check(creds, &r.out.return_authenticator.cred)) {
 792                                 torture_comment(tctx, "Credential chaining failed\n");
 793                         }
 794
 795                         r.in.sequence_num++;
 796                 } while (NT_STATUS_EQUAL(status, STATUS_MORE_ENTRIES));
 797         }
 798
 799         return true;
 800 }
 801
 802
 803 /*
 804   try a netlogon AccountDeltas
 805 */
 806 static bool test_AccountDeltas(struct torture_context *tctx,
 807                                struct dcerpc_pipe *p,
 808                                struct cli_credentials *machine_credentials)
 809 {
 810         NTSTATUS status;
 811         struct netr_AccountDeltas r;
 812         struct creds_CredentialState *creds;
 813
 814         if (!test_SetupCredentials(p, tctx, machine_credentials, &creds)) {
 815                 return false;
 816         }
 817
 818         r.in.logon_server = talloc_asprintf(tctx, "\\\\%s", dcerpc_server_name(p));
 819         r.in.computername = TEST_MACHINE_NAME;
 820         ZERO_STRUCT(r.in.return_authenticator);
 821         creds_client_authenticator(creds, &r.in.credential);
 822         ZERO_STRUCT(r.in.uas);
 823         r.in.count=10;
 824         r.in.level=0;
 825         r.in.buffersize=100;
 826
 827         /* w2k3 returns "NOT IMPLEMENTED" for this call */
 828         status = dcerpc_netr_AccountDeltas(p, tctx, &r);
 829         torture_assert_ntstatus_equal(tctx, status, NT_STATUS_NOT_IMPLEMENTED, "AccountDeltas");
 830
 831         return true;
 832 }
 833
 834 /*
 835   try a netlogon AccountSync
 836 */
 837 static bool test_AccountSync(struct torture_context *tctx, struct dcerpc_pipe *p,
 838                              struct cli_credentials *machine_credentials)
 839 {
 840         NTSTATUS status;
 841         struct netr_AccountSync r;
 842         struct creds_CredentialState *creds;
 843
 844         if (!test_SetupCredentials(p, tctx, machine_credentials, &creds)) {
 845                 return false;
 846         }
 847
 848         r.in.logon_server = talloc_asprintf(tctx, "\\\\%s", dcerpc_server_name(p));
 849         r.in.computername = TEST_MACHINE_NAME;
 850         ZERO_STRUCT(r.in.return_authenticator);
 851         creds_client_authenticator(creds, &r.in.credential);
 852         ZERO_STRUCT(r.in.recordid);
 853         r.in.reference=0;
 854         r.in.level=0;
 855         r.in.buffersize=100;
 856
 857         /* w2k3 returns "NOT IMPLEMENTED" for this call */
 858         status = dcerpc_netr_AccountSync(p, tctx, &r);
 859         torture_assert_ntstatus_equal(tctx, status, NT_STATUS_NOT_IMPLEMENTED, "AccountSync");
 860
 861         return true;
 862 }
 863
 864 /*
 865   try a netlogon GetDcName
 866 */
 867 static bool test_GetDcName(struct torture_context *tctx,
 868                            struct dcerpc_pipe *p)
 869 {
 870         NTSTATUS status;
 871         struct netr_GetDcName r;
 872         const char *dcname = NULL;
 873
 874         r.in.logon_server = talloc_asprintf(tctx, "\\\\%s", dcerpc_server_name(p));
 875         r.in.domainname = lp_workgroup(tctx->lp_ctx);
 876         r.out.dcname = &dcname;
 877
 878         status = dcerpc_netr_GetDcName(p, tctx, &r);
 879         torture_assert_ntstatus_ok(tctx, status, "GetDcName");
 880         torture_assert_werr_ok(tctx, r.out.result, "GetDcName");
 881
 882         torture_comment(tctx, "\tDC is at '%s'\n", dcname);
 883
 884         return true;
 885 }
 886
 887 /*
 888   try a netlogon LogonControl
 889 */
 890 static bool test_LogonControl(struct torture_context *tctx,
 891                               struct dcerpc_pipe *p)
 892 {
 893         NTSTATUS status;
 894         struct netr_LogonControl r;
 895         int i;
 896
 897         r.in.logon_server = talloc_asprintf(tctx, "\\\\%s", dcerpc_server_name(p));
 898         r.in.function_code = 1;
 899
 900         for (i=1;i<4;i++) {
 901                 r.in.level = i;
 902
 903                 torture_comment(tctx, "Testing LogonControl level %d\n", i);
 904
 905                 status = dcerpc_netr_LogonControl(p, tctx, &r);
 906                 torture_assert_ntstatus_ok(tctx, status, "LogonControl");
 907         }
 908
 909         return true;
 910 }
 911
 912
 913 /*
 914   try a netlogon GetAnyDCName
 915 */
 916 static bool test_GetAnyDCName(struct torture_context *tctx,
 917                               struct dcerpc_pipe *p)
 918 {
 919         NTSTATUS status;
 920         struct netr_GetAnyDCName r;
 921         const char *dcname = NULL;
 922
 923         r.in.logon_server = talloc_asprintf(tctx, "\\\\%s", dcerpc_server_name(p));
 924         r.in.domainname = lp_workgroup(tctx->lp_ctx);
 925         r.out.dcname = &dcname;
 926
 927         status = dcerpc_netr_GetAnyDCName(p, tctx, &r);
 928         torture_assert_ntstatus_ok(tctx, status, "GetAnyDCName");
 929
 930         if (dcname) {
 931             torture_comment(tctx, "\tDC is at '%s'\n", dcname);
 932         }
 933
 934         return true;
 935 }
 936
 937
 938 /*
 939   try a netlogon LogonControl2
 940 */
 941 static bool test_LogonControl2(struct torture_context *tctx,
 942                                struct dcerpc_pipe *p)
 943 {
 944         NTSTATUS status;
 945         struct netr_LogonControl2 r;
 946         int i;
 947
 948         r.in.logon_server = talloc_asprintf(tctx, "\\\\%s", dcerpc_server_name(p));
 949
 950         r.in.function_code = NETLOGON_CONTROL_REDISCOVER;
 951         r.in.data.domain = lp_workgroup(tctx->lp_ctx);
 952
 953         for (i=1;i<4;i++) {
 954                 r.in.level = i;
 955
 956                 torture_comment(tctx, "Testing LogonControl2 level %d function %d\n",
 957                        i, r.in.function_code);
 958
 959                 status = dcerpc_netr_LogonControl2(p, tctx, &r);
 960                 torture_assert_ntstatus_ok(tctx, status, "LogonControl");
 961         }
 962
 963         r.in.function_code = NETLOGON_CONTROL_TC_QUERY;
 964         r.in.data.domain = lp_workgroup(tctx->lp_ctx);
 965
 966         for (i=1;i<4;i++) {
 967                 r.in.level = i;
 968
 969                 torture_comment(tctx, "Testing LogonControl2 level %d function %d\n",
 970                        i, r.in.function_code);
 971
 972                 status = dcerpc_netr_LogonControl2(p, tctx, &r);
 973                 torture_assert_ntstatus_ok(tctx, status, "LogonControl");
 974         }
 975
 976         r.in.function_code = NETLOGON_CONTROL_TRANSPORT_NOTIFY;
 977         r.in.data.domain = lp_workgroup(tctx->lp_ctx);
 978
 979         for (i=1;i<4;i++) {
 980                 r.in.level = i;
 981
 982                 torture_comment(tctx, "Testing LogonControl2 level %d function %d\n",
 983                        i, r.in.function_code);
 984
 985                 status = dcerpc_netr_LogonControl2(p, tctx, &r);
 986                 torture_assert_ntstatus_ok(tctx, status, "LogonControl");
 987         }
 988
 989         r.in.function_code = NETLOGON_CONTROL_SET_DBFLAG;
 990         r.in.data.debug_level = ~0;
 991
 992         for (i=1;i<4;i++) {
 993                 r.in.level = i;
 994
 995                 torture_comment(tctx, "Testing LogonControl2 level %d function %d\n",
 996                        i, r.in.function_code);
 997
 998                 status = dcerpc_netr_LogonControl2(p, tctx, &r);
 999                 torture_assert_ntstatus_ok(tctx, status, "LogonControl");
1000         }
1001
1002         return true;
1003 }
1004
1005 /*
1006   try a netlogon DatabaseSync2
1007 */
1008 static bool test_DatabaseSync2(struct torture_context *tctx,
1009                                struct dcerpc_pipe *p,
1010                                struct cli_credentials *machine_credentials)
1011 {
1012         NTSTATUS status;
1013         struct netr_DatabaseSync2 r;
1014         struct creds_CredentialState *creds;
1015         const uint32_t database_ids[] = {0, 1, 2};
1016         int i;
1017
1018         if (!test_SetupCredentials2(p, tctx, NETLOGON_NEG_AUTH2_FLAGS,
1019                                     machine_credentials,
1020                                     SEC_CHAN_BDC, &creds)) {
1021                 return false;
1022         }
1023
1024         r.in.logon_server = talloc_asprintf(tctx, "\\\\%s", dcerpc_server_name(p));
1025         r.in.computername = TEST_MACHINE_NAME;
1026         r.in.preferredmaximumlength = (uint32_t)-1;
1027         ZERO_STRUCT(r.in.return_authenticator);
1028
1029         for (i=0;i<ARRAY_SIZE(database_ids);i++) {
1030                 r.in.sync_context = 0;
1031                 r.in.database_id = database_ids[i];
1032                 r.in.restart_state = 0;
1033
1034                 torture_comment(tctx, "Testing DatabaseSync2 of id %d\n", r.in.database_id);
1035
1036                 do {
1037                         creds_client_authenticator(creds, &r.in.credential);
1038
1039                         status = dcerpc_netr_DatabaseSync2(p, tctx, &r);
1040                         if (NT_STATUS_EQUAL(status, STATUS_MORE_ENTRIES))
1041                             break;
1042
1043                         /* Native mode servers don't do this */
1044                         if (NT_STATUS_EQUAL(status, NT_STATUS_NOT_SUPPORTED)) {
1045                                 return true;
1046                         }
1047
1048                         torture_assert_ntstatus_ok(tctx, status, "DatabaseSync2");
1049
1050                         if (!creds_client_check(creds, &r.out.return_authenticator.cred)) {
1051                                 torture_comment(tctx, "Credential chaining failed\n");
1052                         }
1053
1054                         r.in.sync_context = r.out.sync_context;
1055                 } while (NT_STATUS_EQUAL(status, STATUS_MORE_ENTRIES));
1056         }
1057
1058         return true;
1059 }
1060
1061
1062 /*
1063   try a netlogon LogonControl2Ex
1064 */
1065 static bool test_LogonControl2Ex(struct torture_context *tctx,
1066                                  struct dcerpc_pipe *p)
1067 {
1068         NTSTATUS status;
1069         struct netr_LogonControl2Ex r;
1070         int i;
1071
1072         r.in.logon_server = talloc_asprintf(tctx, "\\\\%s", dcerpc_server_name(p));
1073
1074         r.in.function_code = NETLOGON_CONTROL_REDISCOVER;
1075         r.in.data.domain = lp_workgroup(tctx->lp_ctx);
1076
1077         for (i=1;i<4;i++) {
1078                 r.in.level = i;
1079
1080                 torture_comment(tctx, "Testing LogonControl2Ex level %d function %d\n",
1081                        i, r.in.function_code);
1082
1083                 status = dcerpc_netr_LogonControl2Ex(p, tctx, &r);
1084                 torture_assert_ntstatus_ok(tctx, status, "LogonControl");
1085         }
1086
1087         r.in.function_code = NETLOGON_CONTROL_TC_QUERY;
1088         r.in.data.domain = lp_workgroup(tctx->lp_ctx);
1089
1090         for (i=1;i<4;i++) {
1091                 r.in.level = i;
1092
1093                 torture_comment(tctx, "Testing LogonControl2Ex level %d function %d\n",
1094                        i, r.in.function_code);
1095
1096                 status = dcerpc_netr_LogonControl2Ex(p, tctx, &r);
1097                 torture_assert_ntstatus_ok(tctx, status, "LogonControl");
1098         }
1099
1100         r.in.function_code = NETLOGON_CONTROL_TRANSPORT_NOTIFY;
1101         r.in.data.domain = lp_workgroup(tctx->lp_ctx);
1102
1103         for (i=1;i<4;i++) {
1104                 r.in.level = i;
1105
1106                 torture_comment(tctx, "Testing LogonControl2Ex level %d function %d\n",
1107                        i, r.in.function_code);
1108
1109                 status = dcerpc_netr_LogonControl2Ex(p, tctx, &r);
1110                 torture_assert_ntstatus_ok(tctx, status, "LogonControl");
1111         }
1112
1113         r.in.function_code = NETLOGON_CONTROL_SET_DBFLAG;
1114         r.in.data.debug_level = ~0;
1115
1116         for (i=1;i<4;i++) {
1117                 r.in.level = i;
1118
1119                 torture_comment(tctx, "Testing LogonControl2Ex level %d function %d\n",
1120                        i, r.in.function_code);
1121
1122                 status = dcerpc_netr_LogonControl2Ex(p, tctx, &r);
1123                 torture_assert_ntstatus_ok(tctx, status, "LogonControl");
1124         }
1125
1126         return true;
1127 }
1128
1129 static bool test_netr_DsRGetForestTrustInformation(struct torture_context *tctx,
1130                                                    struct dcerpc_pipe *p, const char *trusted_domain_name)
1131 {
1132         NTSTATUS status;
1133         struct netr_DsRGetForestTrustInformation r;
1134         struct lsa_ForestTrustInformation info, *info_ptr;
1135
1136         info_ptr = &info;
1137
1138         r.in.server_name = talloc_asprintf(tctx, "\\\\%s", dcerpc_server_name(p));
1139         r.in.trusted_domain_name = trusted_domain_name;
1140         r.in.flags = 0;
1141         r.out.forest_trust_info = &info_ptr;
1142
1143         torture_comment(tctx ,"Testing netr_DsRGetForestTrustInformation\n");
1144
1145         status = dcerpc_netr_DsRGetForestTrustInformation(p, tctx, &r);
1146         torture_assert_ntstatus_ok(tctx, status, "DsRGetForestTrustInformation");
1147         torture_assert_werr_ok(tctx, r.out.result, "DsRGetForestTrustInformation");
1148
1149         return true;
1150 }
1151
1152 /*
1153   try a netlogon netr_DsrEnumerateDomainTrusts
1154 */
1155 static bool test_DsrEnumerateDomainTrusts(struct torture_context *tctx,
1156                                           struct dcerpc_pipe *p)
1157 {
1158         NTSTATUS status;
1159         struct netr_DsrEnumerateDomainTrusts r;
1160         struct netr_DomainTrustList trusts;
1161         int i;
1162
1163         r.in.server_name = talloc_asprintf(tctx, "\\\\%s", dcerpc_server_name(p));
1164         r.in.trust_flags = 0x3f;
1165         r.out.trusts = &trusts;
1166
1167         status = dcerpc_netr_DsrEnumerateDomainTrusts(p, tctx, &r);
1168         torture_assert_ntstatus_ok(tctx, status, "DsrEnumerateDomaintrusts");
1169         torture_assert_werr_ok(tctx, r.out.result, "DsrEnumerateDomaintrusts");
1170
1171         /* when trusted_domain_name is NULL, netr_DsRGetForestTrustInformation
1172          * will show non-forest trusts and all UPN suffixes of the own forest
1173          * as LSA_FOREST_TRUST_TOP_LEVEL_NAME types */
1174
1175         if (r.out.trusts->count) {
1176                 if (!test_netr_DsRGetForestTrustInformation(tctx, p, NULL)) {
1177                         return false;
1178                 }
1179         }
1180
1181         for (i=0; i<r.out.trusts->count; i++) {
1182
1183                 /* get info for transitive forest trusts */
1184
1185                 if (r.out.trusts->array[i].trust_attributes & NETR_TRUST_ATTRIBUTE_FOREST_TRANSITIVE) {
1186                         if (!test_netr_DsRGetForestTrustInformation(tctx, p,
1187                                                                     r.out.trusts->array[i].dns_name)) {
1188                                 return false;
1189                         }
1190                 }
1191         }
1192
1193         return true;
1194 }
1195
1196 static bool test_netr_NetrEnumerateTrustedDomains(struct torture_context *tctx,
1197                                                   struct dcerpc_pipe *p)
1198 {
1199         NTSTATUS status;
1200         struct netr_NetrEnumerateTrustedDomains r;
1201         struct netr_Blob trusted_domains_blob;
1202
1203         r.in.server_name = talloc_asprintf(tctx, "\\\\%s", dcerpc_server_name(p));
1204         r.out.trusted_domains_blob = &trusted_domains_blob;
1205
1206         status = dcerpc_netr_NetrEnumerateTrustedDomains(p, tctx, &r);
1207         torture_assert_ntstatus_ok(tctx, status, "netr_NetrEnumerateTrustedDomains");
1208         torture_assert_werr_ok(tctx, r.out.result, "NetrEnumerateTrustedDomains");
1209
1210         return true;
1211 }
1212
1213 static bool test_netr_NetrEnumerateTrustedDomainsEx(struct torture_context *tctx,
1214                                                     struct dcerpc_pipe *p)
1215 {
1216         NTSTATUS status;
1217         struct netr_NetrEnumerateTrustedDomainsEx r;
1218         struct netr_DomainTrustList dom_trust_list;
1219
1220         r.in.server_name = talloc_asprintf(tctx, "\\\\%s", dcerpc_server_name(p));
1221         r.out.dom_trust_list = &dom_trust_list;
1222
1223         status = dcerpc_netr_NetrEnumerateTrustedDomainsEx(p, tctx, &r);
1224         torture_assert_ntstatus_ok(tctx, status, "netr_NetrEnumerateTrustedDomainsEx");
1225         torture_assert_werr_ok(tctx, r.out.result, "NetrEnumerateTrustedDomainsEx");
1226
1227         return true;
1228 }
1229
1230
1231 static bool test_netr_DsRGetSiteName(struct dcerpc_pipe *p, struct torture_context *tctx,
1232                                      const char *computer_name,
1233                                      const char *expected_site)
1234 {
1235         NTSTATUS status;
1236         struct netr_DsRGetSiteName r;
1237         const char *site = NULL;
1238
1239         if (torture_setting_bool(tctx, "samba4", false))
1240                 torture_skip(tctx, "skipping DsRGetSiteName test against Samba4");
1241
1242         r.in.computer_name              = computer_name;
1243         r.out.site                      = &site;
1244         torture_comment(tctx, "Testing netr_DsRGetSiteName\n");
1245
1246         status = dcerpc_netr_DsRGetSiteName(p, tctx, &r);
1247         torture_assert_ntstatus_ok(tctx, status, "DsRGetSiteName");
1248         torture_assert_werr_ok(tctx, r.out.result, "DsRGetSiteName");
1249         torture_assert_str_equal(tctx, expected_site, site, "netr_DsRGetSiteName");
1250
1251         r.in.computer_name              = talloc_asprintf(tctx, "\\\\%s", computer_name);
1252         torture_comment(tctx,
1253                         "Testing netr_DsRGetSiteName with broken computer name: %s\n", r.in.computer_name);
1254
1255         status = dcerpc_netr_DsRGetSiteName(p, tctx, &r);
1256         torture_assert_ntstatus_ok(tctx, status, "DsRGetSiteName");
1257         torture_assert_werr_equal(tctx, r.out.result, WERR_INVALID_COMPUTERNAME, "netr_DsRGetSiteName");
1258
1259         return true;
1260 }
1261
1262 /*
1263   try a netlogon netr_DsRGetDCName
1264 */
1265 static bool test_netr_DsRGetDCName(struct torture_context *tctx,
1266                                    struct dcerpc_pipe *p)
1267 {
1268         NTSTATUS status;
1269         struct netr_DsRGetDCName r;
1270
1271         r.in.server_unc         = talloc_asprintf(tctx, "\\\\%s", dcerpc_server_name(p));
1272         r.in.domain_name        = talloc_asprintf(tctx, "%s", lp_realm(tctx->lp_ctx));
1273         r.in.domain_guid        = NULL;
1274         r.in.site_guid          = NULL;
1275         r.in.flags              = DS_RETURN_DNS_NAME;
1276
1277         status = dcerpc_netr_DsRGetDCName(p, tctx, &r);
1278         torture_assert_ntstatus_ok(tctx, status, "DsRGetDCName");
1279         torture_assert_werr_ok(tctx, r.out.result, "DsRGetDCName");
1280         return test_netr_DsRGetSiteName(p, tctx,
1281                                        r.out.info->dc_unc,
1282                                        r.out.info->dc_site_name);
1283 }
1284
1285 /*
1286   try a netlogon netr_DsRGetDCNameEx
1287 */
1288 static bool test_netr_DsRGetDCNameEx(struct torture_context *tctx,
1289                                      struct dcerpc_pipe *p)
1290 {
1291         NTSTATUS status;
1292         struct netr_DsRGetDCNameEx r;
1293
1294         r.in.server_unc         = talloc_asprintf(tctx, "\\\\%s", dcerpc_server_name(p));
1295         r.in.domain_name        = talloc_asprintf(tctx, "%s", lp_realm(tctx->lp_ctx));
1296         r.in.domain_guid        = NULL;
1297         r.in.site_name          = NULL;
1298         r.in.flags              = DS_RETURN_DNS_NAME;
1299
1300         status = dcerpc_netr_DsRGetDCNameEx(p, tctx, &r);
1301         torture_assert_ntstatus_ok(tctx, status, "netr_DsRGetDCNameEx");
1302         torture_assert_werr_ok(tctx, r.out.result, "netr_DsRGetDCNameEx");
1303
1304         return test_netr_DsRGetSiteName(p, tctx, r.out.info->dc_unc,
1305                                        r.out.info->dc_site_name);
1306 }
1307
1308 /*
1309   try a netlogon netr_DsRGetDCNameEx2
1310 */
1311 static bool test_netr_DsRGetDCNameEx2(struct torture_context *tctx,
1312                                       struct dcerpc_pipe *p)
1313 {
1314         NTSTATUS status;
1315         struct netr_DsRGetDCNameEx2 r;
1316
1317         r.in.server_unc         = talloc_asprintf(tctx, "\\\\%s", dcerpc_server_name(p));
1318         r.in.client_account     = NULL;
1319         r.in.mask               = 0x00000000;
1320         r.in.domain_name        = talloc_asprintf(tctx, "%s", lp_realm(tctx->lp_ctx));
1321         r.in.domain_guid        = NULL;
1322         r.in.site_name          = NULL;
1323         r.in.flags              = DS_RETURN_DNS_NAME;
1324
1325         torture_comment(tctx, "Testing netr_DsRGetDCNameEx2 without client account\n");
1326
1327         status = dcerpc_netr_DsRGetDCNameEx2(p, tctx, &r);
1328         torture_assert_ntstatus_ok(tctx, status, "netr_DsRGetDCNameEx2");
1329         torture_assert_werr_ok(tctx, r.out.result, "netr_DsRGetDCNameEx2");
1330
1331         torture_comment(tctx, "Testing netr_DsRGetDCNameEx2 with client acount\n");
1332         r.in.client_account     = TEST_MACHINE_NAME"$";
1333         r.in.mask               = ACB_SVRTRUST;
1334         r.in.flags              = DS_RETURN_FLAT_NAME;
1335
1336         status = dcerpc_netr_DsRGetDCNameEx2(p, tctx, &r);
1337         torture_assert_ntstatus_ok(tctx, status, "netr_DsRGetDCNameEx2");
1338         torture_assert_werr_ok(tctx, r.out.result, "netr_DsRGetDCNameEx2");
1339         return test_netr_DsRGetSiteName(p, tctx, r.out.info->dc_unc,
1340                                         r.out.info->dc_site_name);
1341 }
1342
1343 static bool test_netr_DsrGetDcSiteCoverageW(struct torture_context *tctx,
1344                                             struct dcerpc_pipe *p)
1345 {
1346         NTSTATUS status;
1347         struct netr_DsrGetDcSiteCoverageW r;
1348         struct DcSitesCtr *ctr = NULL;
1349
1350         r.in.server_name = talloc_asprintf(tctx, "\\\\%s", dcerpc_server_name(p));
1351         r.out.ctr = &ctr;
1352
1353         status = dcerpc_netr_DsrGetDcSiteCoverageW(p, tctx, &r);
1354         torture_assert_ntstatus_ok(tctx, status, "failed");
1355         torture_assert_werr_ok(tctx, r.out.result, "failed");
1356
1357         return true;
1358 }
1359
1360 static bool test_netr_DsRAddressToSitenamesW(struct torture_context *tctx,
1361                                              struct dcerpc_pipe *p)
1362 {
1363         NTSTATUS status;
1364         struct netr_DsRAddressToSitenamesW r;
1365         struct netr_DsRAddress addr;
1366         struct netr_DsRAddressToSitenamesWCtr *ctr;
1367
1368         ctr = talloc(tctx, struct netr_DsRAddressToSitenamesWCtr);
1369
1370         addr.size = 16;
1371         addr.buffer = talloc_zero_array(tctx, uint8_t, addr.size);
1372
1373         addr.buffer[0] = 2; /* AF_INET */
1374         addr.buffer[4] = 127;
1375         addr.buffer[5] = 0;
1376         addr.buffer[6] = 0;
1377         addr.buffer[7] = 1;
1378
1379         r.in.server_name = talloc_asprintf(tctx, "\\\\%s", dcerpc_server_name(p));
1380         r.in.count = 1;
1381         r.in.addresses = talloc_zero_array(tctx, struct netr_DsRAddress, r.in.count);
1382         r.in.addresses[0] = addr;
1383         r.out.ctr = &ctr;
1384
1385         status = dcerpc_netr_DsRAddressToSitenamesW(p, tctx, &r);
1386         torture_assert_ntstatus_ok(tctx, status, "failed");
1387         torture_assert_werr_ok(tctx, r.out.result, "failed");
1388
1389         return true;
1390 }
1391
1392 static bool test_netr_DsRAddressToSitenamesExW(struct torture_context *tctx,
1393                                                struct dcerpc_pipe *p)
1394 {
1395         NTSTATUS status;
1396         struct netr_DsRAddressToSitenamesExW r;
1397         struct netr_DsRAddress addr;
1398         struct netr_DsRAddressToSitenamesExWCtr *ctr;
1399
1400         ctr = talloc(tctx, struct netr_DsRAddressToSitenamesExWCtr);
1401
1402         addr.size = 16;
1403         addr.buffer = talloc_zero_array(tctx, uint8_t, addr.size);
1404
1405         addr.buffer[0] = 2; /* AF_INET */
1406         addr.buffer[4] = 127;
1407         addr.buffer[5] = 0;
1408         addr.buffer[6] = 0;
1409         addr.buffer[7] = 1;
1410
1411         r.in.server_name = talloc_asprintf(tctx, "\\\\%s", dcerpc_server_name(p));
1412         r.in.count = 1;
1413         r.in.addresses = talloc_zero_array(tctx, struct netr_DsRAddress, r.in.count);
1414         r.in.addresses[0] = addr;
1415         r.out.ctr = &ctr;
1416
1417         status = dcerpc_netr_DsRAddressToSitenamesExW(p, tctx, &r);
1418         torture_assert_ntstatus_ok(tctx, status, "failed");
1419         torture_assert_werr_ok(tctx, r.out.result, "failed");
1420
1421         return true;
1422 }
1423
1424 static bool test_GetDomainInfo(struct torture_context *tctx,
1425                                struct dcerpc_pipe *p,
1426                                struct cli_credentials *machine_credentials)
1427 {
1428         NTSTATUS status;
1429         struct netr_LogonGetDomainInfo r;
1430         struct netr_DomainQuery1 q1;
1431         struct netr_Authenticator a;
1432         struct creds_CredentialState *creds;
1433
1434         if (!test_SetupCredentials3(p, tctx, NETLOGON_NEG_AUTH2_ADS_FLAGS,
1435                                     machine_credentials, &creds)) {
1436                 return false;
1437         }
1438
1439         ZERO_STRUCT(r);
1440
1441         creds_client_authenticator(creds, &a);
1442
1443         r.in.server_name = talloc_asprintf(tctx, "\\\\%s", dcerpc_server_name(p));
1444         r.in.computer_name = TEST_MACHINE_NAME;
1445         r.in.level = 1;
1446         r.in.credential = &a;
1447         r.in.return_authenticator = &a;
1448         r.out.return_authenticator = &a;
1449
1450         r.in.query.query1 = &q1;
1451         ZERO_STRUCT(q1);
1452
1453         /* this should really be the fully qualified name */
1454         q1.workstation_domain = TEST_MACHINE_NAME;
1455         q1.workstation_site = "Default-First-Site-Name";
1456         q1.blob2.length = 0;
1457         q1.blob2.size = 0;
1458         q1.blob2.data = NULL;
1459         q1.product.string = "product string";
1460
1461         torture_comment(tctx, "Testing netr_LogonGetDomainInfo\n");
1462
1463         status = dcerpc_netr_LogonGetDomainInfo(p, tctx, &r);
1464         torture_assert_ntstatus_ok(tctx, status, "netr_LogonGetDomainInfo");
1465         torture_assert(tctx, creds_client_check(creds, &a.cred), "Credential chaining failed");
1466
1467         torture_comment(tctx, "Testing netr_LogonGetDomainInfo 2nd call\n");
1468         creds_client_authenticator(creds, &a);
1469
1470         status = dcerpc_netr_LogonGetDomainInfo(p, tctx, &r);
1471         torture_assert_ntstatus_ok(tctx, status, "netr_LogonGetDomainInfo");
1472         torture_assert(tctx, creds_client_check(creds, &a.cred), "Credential chaining failed");
1473
1474         return true;
1475 }
1476
1477
1478 static void async_callback(struct rpc_request *req)
1479 {
1480         int *counter = (int *)req->async.private_data;
1481         if (NT_STATUS_IS_OK(req->status)) {
1482                 (*counter)++;
1483         }
1484 }
1485
1486 static bool test_GetDomainInfo_async(struct torture_context *tctx,
1487                                      struct dcerpc_pipe *p,
1488                                      struct cli_credentials *machine_credentials)
1489 {
1490         NTSTATUS status;
1491         struct netr_LogonGetDomainInfo r;
1492         struct netr_DomainQuery1 q1;
1493         struct netr_Authenticator a;
1494 #define ASYNC_COUNT 100
1495         struct creds_CredentialState *creds;
1496         struct creds_CredentialState *creds_async[ASYNC_COUNT];
1497         struct rpc_request *req[ASYNC_COUNT];
1498         int i;
1499         int *async_counter = talloc(tctx, int);
1500
1501         if (!test_SetupCredentials3(p, tctx, NETLOGON_NEG_AUTH2_ADS_FLAGS,
1502                                     machine_credentials, &creds)) {
1503                 return false;
1504         }
1505
1506         ZERO_STRUCT(r);
1507         r.in.server_name = talloc_asprintf(tctx, "\\\\%s", dcerpc_server_name(p));
1508         r.in.computer_name = TEST_MACHINE_NAME;
1509         r.in.level = 1;
1510         r.in.credential = &a;
1511         r.in.return_authenticator = &a;
1512         r.out.return_authenticator = &a;
1513
1514         r.in.query.query1 = &q1;
1515         ZERO_STRUCT(q1);
1516
1517         /* this should really be the fully qualified name */
1518         q1.workstation_domain = TEST_MACHINE_NAME;
1519         q1.workstation_site = "Default-First-Site-Name";
1520         q1.blob2.length = 0;
1521         q1.blob2.size = 0;
1522         q1.blob2.data = NULL;
1523         q1.product.string = "product string";
1524
1525         torture_comment(tctx, "Testing netr_LogonGetDomainInfo - async count %d\n", ASYNC_COUNT);
1526
1527         *async_counter = 0;
1528
1529         for (i=0;i<ASYNC_COUNT;i++) {
1530                 creds_client_authenticator(creds, &a);
1531
1532                 creds_async[i] = (struct creds_CredentialState *)talloc_memdup(creds, creds, sizeof(*creds));
1533                 req[i] = dcerpc_netr_LogonGetDomainInfo_send(p, tctx, &r);
1534
1535                 req[i]->async.callback = async_callback;
1536                 req[i]->async.private_data = async_counter;
1537
1538                 /* even with this flush per request a w2k3 server seems to
1539                    clag with multiple outstanding requests. bleergh. */
1540                 torture_assert_int_equal(tctx, event_loop_once(dcerpc_event_context(p)), 0,
1541                                          "event_loop_once failed");
1542         }
1543
1544         for (i=0;i<ASYNC_COUNT;i++) {
1545                 status = dcerpc_ndr_request_recv(req[i]);
1546
1547                 torture_assert_ntstatus_ok(tctx, status, "netr_LogonGetDomainInfo_async");
1548                 torture_assert_ntstatus_ok(tctx, r.out.result, "netr_LogonGetDomainInfo_async");
1549
1550                 torture_assert(tctx, creds_client_check(creds_async[i], &a.cred),
1551                         "Credential chaining failed at async");
1552         }
1553
1554         torture_comment(tctx,
1555                         "Testing netr_LogonGetDomainInfo - async count %d OK\n", *async_counter);
1556
1557         torture_assert_int_equal(tctx, (*async_counter), ASYNC_COUNT, "int");
1558
1559         return true;
1560 }
1561
1562 static bool test_ManyGetDCName(struct torture_context *tctx,
1563                                struct dcerpc_pipe *p)
1564 {
1565         NTSTATUS status;
1566         struct dcerpc_pipe *p2;
1567         struct lsa_ObjectAttribute attr;
1568         struct lsa_QosInfo qos;
1569         struct lsa_OpenPolicy2 o;
1570         struct policy_handle lsa_handle;
1571         struct lsa_DomainList domains;
1572
1573         struct lsa_EnumTrustDom t;
1574         uint32_t resume_handle = 0;
1575         struct netr_GetAnyDCName d;
1576         const char *dcname = NULL;
1577
1578         int i;
1579
1580         if (p->conn->transport.transport != NCACN_NP) {
1581                 return true;
1582         }
1583
1584         torture_comment(tctx, "Torturing GetDCName\n");
1585
1586         status = dcerpc_secondary_connection(p, &p2, p->binding);
1587         torture_assert_ntstatus_ok(tctx, status, "Failed to create secondary connection");
1588
1589         status = dcerpc_bind_auth_none(p2, &ndr_table_lsarpc);
1590         torture_assert_ntstatus_ok(tctx, status, "Failed to create bind on secondary connection");
1591
1592         qos.len = 0;
1593         qos.impersonation_level = 2;
1594         qos.context_mode = 1;
1595         qos.effective_only = 0;
1596
1597         attr.len = 0;
1598         attr.root_dir = NULL;
1599         attr.object_name = NULL;
1600         attr.attributes = 0;
1601         attr.sec_desc = NULL;
1602         attr.sec_qos = &qos;
1603
1604         o.in.system_name = "\\";
1605         o.in.attr = &attr;
1606         o.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
1607         o.out.handle = &lsa_handle;
1608
1609         status = dcerpc_lsa_OpenPolicy2(p2, tctx, &o);
1610         torture_assert_ntstatus_ok(tctx, status, "OpenPolicy2 failed");
1611
1612         t.in.handle = &lsa_handle;
1613         t.in.resume_handle = &resume_handle;
1614         t.in.max_size = 1000;
1615         t.out.domains = &domains;
1616         t.out.resume_handle = &resume_handle;
1617
1618         status = dcerpc_lsa_EnumTrustDom(p2, tctx, &t);
1619
1620         if ((!NT_STATUS_IS_OK(status) &&
1621              (!NT_STATUS_EQUAL(status, NT_STATUS_NO_MORE_ENTRIES))))
1622                 torture_fail(tctx, "Could not list domains");
1623
1624         talloc_free(p2);
1625
1626         d.in.logon_server = talloc_asprintf(tctx, "\\\\%s",
1627                                             dcerpc_server_name(p));
1628         d.out.dcname = &dcname;
1629
1630         for (i=0; i<domains.count * 4; i++) {
1631                 struct lsa_DomainInfo *info =
1632                         &domains.domains[rand()%domains.count];
1633
1634                 d.in.domainname = info->name.string;
1635
1636                 status = dcerpc_netr_GetAnyDCName(p, tctx, &d);
1637                 torture_assert_ntstatus_ok(tctx, status, "GetAnyDCName");
1638
1639                 torture_comment(tctx, "\tDC for domain %s is %s\n", info->name.string,
1640                        dcname ? dcname : "unknown");
1641         }
1642
1643         return true;
1644 }
1645
1646 struct torture_suite *torture_rpc_netlogon(TALLOC_CTX *mem_ctx)
1647 {
1648         struct torture_suite *suite = torture_suite_create(mem_ctx, "NETLOGON");
1649         struct torture_rpc_tcase *tcase;
1650         struct torture_test *test;
1651
1652         tcase = torture_suite_add_machine_rpc_iface_tcase(suite, "netlogon",
1653                                                   &ndr_table_netlogon, TEST_MACHINE_NAME);
1654
1655         torture_rpc_tcase_add_test(tcase, "LogonUasLogon", test_LogonUasLogon);
1656         torture_rpc_tcase_add_test(tcase, "LogonUasLogoff", test_LogonUasLogoff);
1657         torture_rpc_tcase_add_test_creds(tcase, "SamLogon", test_SamLogon);
1658         torture_rpc_tcase_add_test_creds(tcase, "SetPassword", test_SetPassword);
1659         torture_rpc_tcase_add_test_creds(tcase, "SetPassword2", test_SetPassword2);
1660         torture_rpc_tcase_add_test_creds(tcase, "GetPassword", test_GetPassword);
1661         torture_rpc_tcase_add_test_creds(tcase, "GetTrustPasswords", test_GetTrustPasswords);
1662         torture_rpc_tcase_add_test_creds(tcase, "GetDomainInfo", test_GetDomainInfo);
1663         torture_rpc_tcase_add_test_creds(tcase, "DatabaseSync", test_DatabaseSync);
1664         torture_rpc_tcase_add_test_creds(tcase, "DatabaseDeltas", test_DatabaseDeltas);
1665         torture_rpc_tcase_add_test_creds(tcase, "AccountDeltas", test_AccountDeltas);
1666         torture_rpc_tcase_add_test_creds(tcase, "AccountSync", test_AccountSync);
1667         torture_rpc_tcase_add_test(tcase, "GetDcName", test_GetDcName);
1668         torture_rpc_tcase_add_test(tcase, "ManyGetDCName", test_ManyGetDCName);
1669         torture_rpc_tcase_add_test(tcase, "LogonControl", test_LogonControl);
1670         torture_rpc_tcase_add_test(tcase, "GetAnyDCName", test_GetAnyDCName);
1671         torture_rpc_tcase_add_test(tcase, "LogonControl2", test_LogonControl2);
1672         torture_rpc_tcase_add_test_creds(tcase, "DatabaseSync2", test_DatabaseSync2);
1673         torture_rpc_tcase_add_test(tcase, "LogonControl2Ex", test_LogonControl2Ex);
1674         torture_rpc_tcase_add_test(tcase, "DsrEnumerateDomainTrusts", test_DsrEnumerateDomainTrusts);
1675         torture_rpc_tcase_add_test(tcase, "NetrEnumerateTrustedDomains", test_netr_NetrEnumerateTrustedDomains);
1676         torture_rpc_tcase_add_test(tcase, "NetrEnumerateTrustedDomainsEx", test_netr_NetrEnumerateTrustedDomainsEx);
1677         test = torture_rpc_tcase_add_test_creds(tcase, "GetDomainInfo_async", test_GetDomainInfo_async);
1678         test->dangerous = true;
1679         torture_rpc_tcase_add_test(tcase, "DsRGetDCName", test_netr_DsRGetDCName);
1680         torture_rpc_tcase_add_test(tcase, "DsRGetDCNameEx", test_netr_DsRGetDCNameEx);
1681         torture_rpc_tcase_add_test(tcase, "DsRGetDCNameEx2", test_netr_DsRGetDCNameEx2);
1682         torture_rpc_tcase_add_test(tcase, "DsrGetDcSiteCoverageW", test_netr_DsrGetDcSiteCoverageW);
1683         torture_rpc_tcase_add_test(tcase, "DsRAddressToSitenamesW", test_netr_DsRAddressToSitenamesW);
1684         torture_rpc_tcase_add_test(tcase, "DsRAddressToSitenamesExW", test_netr_DsRAddressToSitenamesExW);
1685
1686         return suite;
1687 }