Attachment 8318 Details for Bug 9438 – Patches for v4-0-test

[patch] Patches for v4-0-test

tmp40.diff (text/plain), 128.97 KB, created by Stefan Metzmacher on 2012-12-10 07:25:10 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Stefan Metzmacher

Created: 2012-12-10 07:25:10 UTC

Size: 128.97 KB

patch

obsolete

>From 50fb2b9a7f6557ca6ee8fcdddb2fdf0b79f68f4a Mon Sep 17 00:00:00 2001
>From: =?UTF-8?q?G=C3=BCnther=20Deschner?= <gd@samba.org>
>Date: Thu, 29 Nov 2012 21:23:30 +0100
>Subject: [PATCH 01/28] libcli/auth: add netlogon_creds_aes_{en|de}crypt
> routines.
>MIME-Version: 1.0
>Content-Type: text/plain; charset=UTF-8
>Content-Transfer-Encoding: 8bit
>
>Guenther
>
>Signed-off-by: GÃ¼nther Deschner <gd@samba.org>
>Reviewed-by: Stefan Metzmacher <metze@samba.org>
>(cherry picked from commit 429600c5f3079c8433d5a542383908d6ff61fe60)
>---
> libcli/auth/credentials.c |   28 ++++++++++++++++++++++++++++
> libcli/auth/proto.h       |    2 ++
> 2 files changed, 30 insertions(+)
>
>diff --git a/libcli/auth/credentials.c b/libcli/auth/credentials.c
>index dfbfdb3..be43c95 100644
>--- a/libcli/auth/credentials.c
>+++ b/libcli/auth/credentials.c
>@@ -222,6 +222,34 @@ void netlogon_creds_arcfour_crypt(struct netlogon_creds_CredentialState *creds,
> 	data_blob_free(&session_key);
> }
> 
>+/*
>+  AES encrypt a password buffer using the session key
>+*/
>+void netlogon_creds_aes_encrypt(struct netlogon_creds_CredentialState *creds, uint8_t *data, size_t len)
>+{
>+	AES_KEY key;
>+	uint8_t iv[AES_BLOCK_SIZE];
>+
>+	AES_set_encrypt_key(creds->session_key, 128, &key);
>+	ZERO_STRUCT(iv);
>+
>+	aes_cfb8_encrypt(data, data, len, &key, iv, AES_ENCRYPT);
>+}
>+
>+/*
>+  AES decrypt a password buffer using the session key
>+*/
>+void netlogon_creds_aes_decrypt(struct netlogon_creds_CredentialState *creds, uint8_t *data, size_t len)
>+{
>+	AES_KEY key;
>+	uint8_t iv[AES_BLOCK_SIZE];
>+
>+	AES_set_encrypt_key(creds->session_key, 128, &key);
>+	ZERO_STRUCT(iv);
>+
>+	aes_cfb8_encrypt(data, data, len, &key, iv, AES_DECRYPT);
>+}
>+
> /*****************************************************************
> The above functions are common to the client and server interface
> next comes the client specific functions
>diff --git a/libcli/auth/proto.h b/libcli/auth/proto.h
>index 37c87b4..b9d91d0 100644
>--- a/libcli/auth/proto.h
>+++ b/libcli/auth/proto.h
>@@ -16,6 +16,8 @@ void netlogon_creds_des_decrypt_LMKey(struct netlogon_creds_CredentialState *cre
> void netlogon_creds_des_encrypt(struct netlogon_creds_CredentialState *creds, struct samr_Password *pass);
> void netlogon_creds_des_decrypt(struct netlogon_creds_CredentialState *creds, struct samr_Password *pass);
> void netlogon_creds_arcfour_crypt(struct netlogon_creds_CredentialState *creds, uint8_t *data, size_t len);
>+void netlogon_creds_aes_encrypt(struct netlogon_creds_CredentialState *creds, uint8_t *data, size_t len);
>+void netlogon_creds_aes_decrypt(struct netlogon_creds_CredentialState *creds, uint8_t *data, size_t len);
> 
> /*****************************************************************
> The above functions are common to the client and server interface
>-- 
>1.7.9.5
>
>
>From bb25ca0b0aceec28bf7949350daf7bcbe126f59a Mon Sep 17 00:00:00 2001
>From: =?UTF-8?q?G=C3=BCnther=20Deschner?= <gd@samba.org>
>Date: Thu, 29 Nov 2012 21:30:24 +0100
>Subject: [PATCH 02/28] s3-rpc_client: use netlogon_creds_arcfour_crypt() in
> init_netr_CryptPassword.
>MIME-Version: 1.0
>Content-Type: text/plain; charset=UTF-8
>Content-Transfer-Encoding: 8bit
>
>Guenther
>
>Signed-off-by: GÃ¼nther Deschner <gd@samba.org>
>Reviewed-by: Stefan Metzmacher <metze@samba.org>
>(cherry picked from commit ec06c81db313f2862544c972cbf582a07bb844c2)
>---
> source3/rpc_client/cli_netlogon.c  |    2 +-
> source3/rpc_client/init_netlogon.c |    6 +++---
> source3/rpc_client/init_netlogon.h |    2 +-
> 3 files changed, 5 insertions(+), 5 deletions(-)
>
>diff --git a/source3/rpc_client/cli_netlogon.c b/source3/rpc_client/cli_netlogon.c
>index bbcca06..463741a 100644
>--- a/source3/rpc_client/cli_netlogon.c
>+++ b/source3/rpc_client/cli_netlogon.c
>@@ -628,7 +628,7 @@ NTSTATUS rpccli_netlogon_set_trust_password(struct rpc_pipe_client *cli,
> 		uint32_t old_timeout;
> 
> 		init_netr_CryptPassword(new_trust_pwd_cleartext,
>-					cli->dc->session_key,
>+					cli->dc,
> 					&new_password);
> 
> 		old_timeout = dcerpc_binding_handle_set_timeout(b, 600000);
>diff --git a/source3/rpc_client/init_netlogon.c b/source3/rpc_client/init_netlogon.c
>index 445108a..0d33d6f 100644
>--- a/source3/rpc_client/init_netlogon.c
>+++ b/source3/rpc_client/init_netlogon.c
>@@ -1,7 +1,7 @@
> /*
>  *  Unix SMB/CIFS implementation.
>  *  RPC Pipe client / server routines
>- *  Copyright (C) Guenther Deschner                  2008.
>+ *  Copyright (C) Guenther Deschner                  2008,2012
>  *
>  *  This program is free software; you can redistribute it and/or modify
>  *  it under the terms of the GNU General Public License as published by
>@@ -27,14 +27,14 @@
>  *************************************************************************/
> 
> void init_netr_CryptPassword(const char *pwd,
>-			     unsigned char session_key[16],
>+			     struct netlogon_creds_CredentialState *creds,
> 			     struct netr_CryptPassword *pwd_buf)
> {
> 	struct samr_CryptPassword password_buf;
> 
> 	encode_pw_buffer(password_buf.data, pwd, STR_UNICODE);
> 
>-	arcfour_crypt(password_buf.data, session_key, 516);
>+	netlogon_creds_arcfour_crypt(creds, password_buf.data, 516);
> 	memcpy(pwd_buf->data, password_buf.data, 512);
> 	pwd_buf->length = IVAL(password_buf.data, 512);
> }
>diff --git a/source3/rpc_client/init_netlogon.h b/source3/rpc_client/init_netlogon.h
>index 826d0c5..bb4496b 100644
>--- a/source3/rpc_client/init_netlogon.h
>+++ b/source3/rpc_client/init_netlogon.h
>@@ -23,7 +23,7 @@
> /* The following definitions come from rpc_client/init_netlogon.c  */
> 
> void init_netr_CryptPassword(const char *pwd,
>-			     unsigned char session_key[16],
>+			     struct netlogon_creds_CredentialState *creds,
> 			     struct netr_CryptPassword *pwd_buf);
> 
> #endif /* _RPC_CLIENT_INIT_NETLOGON_H_ */
>-- 
>1.7.9.5
>
>
>From 2ed45a1c9864a09e740346a86561687e18922d79 Mon Sep 17 00:00:00 2001
>From: =?UTF-8?q?G=C3=BCnther=20Deschner?= <gd@samba.org>
>Date: Thu, 29 Nov 2012 21:34:36 +0100
>Subject: [PATCH 03/28] s3-rpc_client: support AES encryption in
> netr_ServerPasswordSet2 client.
>MIME-Version: 1.0
>Content-Type: text/plain; charset=UTF-8
>Content-Transfer-Encoding: 8bit
>
>Guenther
>
>Signed-off-by: GÃ¼nther Deschner <gd@samba.org>
>Reviewed-by: Stefan Metzmacher <metze@samba.org>
>(cherry picked from commit 64345018cda744d16b123d6ef5c4a982340484dc)
>---
> source3/rpc_client/init_netlogon.c |    8 ++++++--
> 1 file changed, 6 insertions(+), 2 deletions(-)
>
>diff --git a/source3/rpc_client/init_netlogon.c b/source3/rpc_client/init_netlogon.c
>index 0d33d6f..4d9157b 100644
>--- a/source3/rpc_client/init_netlogon.c
>+++ b/source3/rpc_client/init_netlogon.c
>@@ -19,7 +19,7 @@
> 
> #include "includes.h"
> #include "../libcli/auth/libcli_auth.h"
>-#include "../lib/crypto/arcfour.h"
>+#include "../lib/crypto/crypto.h"
> #include "rpc_client/init_netlogon.h"
> 
> /*************************************************************************
>@@ -34,7 +34,11 @@ void init_netr_CryptPassword(const char *pwd,
> 
> 	encode_pw_buffer(password_buf.data, pwd, STR_UNICODE);
> 
>-	netlogon_creds_arcfour_crypt(creds, password_buf.data, 516);
>+	if (creds->negotiate_flags & NETLOGON_NEG_SUPPORTS_AES) {
>+		netlogon_creds_aes_encrypt(creds, password_buf.data, 516);
>+	} else {
>+		netlogon_creds_arcfour_crypt(creds, password_buf.data, 516);
>+	}
> 	memcpy(pwd_buf->data, password_buf.data, 512);
> 	pwd_buf->length = IVAL(password_buf.data, 512);
> }
>-- 
>1.7.9.5
>
>
>From 9d2276fb39e180018f90ce2b73da7883b6a3341a Mon Sep 17 00:00:00 2001
>From: =?UTF-8?q?G=C3=BCnther=20Deschner?= <gd@samba.org>
>Date: Thu, 29 Nov 2012 21:35:04 +0100
>Subject: [PATCH 04/28] s3-rpc_server: support AES decryption in
> netr_ServerPasswordSet2 server.
>MIME-Version: 1.0
>Content-Type: text/plain; charset=UTF-8
>Content-Transfer-Encoding: 8bit
>
>Guenther
>
>Signed-off-by: GÃ¼nther Deschner <gd@samba.org>
>Reviewed-by: Stefan Metzmacher <metze@samba.org>
>(cherry picked from commit 1362d542df715aa31e9b818ee8783b5ee35f8870)
>---
> source3/rpc_server/netlogon/srv_netlog_nt.c |    7 ++++++-
> 1 file changed, 6 insertions(+), 1 deletion(-)
>
>diff --git a/source3/rpc_server/netlogon/srv_netlog_nt.c b/source3/rpc_server/netlogon/srv_netlog_nt.c
>index d992a65..5fc2756 100644
>--- a/source3/rpc_server/netlogon/srv_netlog_nt.c
>+++ b/source3/rpc_server/netlogon/srv_netlog_nt.c
>@@ -1332,7 +1332,12 @@ NTSTATUS _netr_ServerPasswordSet2(struct pipes_struct *p,
> 
> 	memcpy(password_buf.data, r->in.new_password->data, 512);
> 	SIVAL(password_buf.data, 512, r->in.new_password->length);
>-	netlogon_creds_arcfour_crypt(creds, password_buf.data, 516);
>+
>+	if (creds->negotiate_flags & NETLOGON_NEG_SUPPORTS_AES) {
>+		netlogon_creds_aes_decrypt(creds, password_buf.data, 516);
>+	} else {
>+		netlogon_creds_arcfour_crypt(creds, password_buf.data, 516);
>+	}
> 
> 	if (!extract_pw_from_buffer(p->mem_ctx, password_buf.data, &plaintext)) {
> 		TALLOC_FREE(creds);
>-- 
>1.7.9.5
>
>
>From 5e95422806f0a83fda02c1b2eac1fb1043344657 Mon Sep 17 00:00:00 2001
>From: =?UTF-8?q?G=C3=BCnther=20Deschner?= <gd@samba.org>
>Date: Thu, 29 Nov 2012 22:24:37 +0100
>Subject: [PATCH 05/28] s4-torture: remove trailing whitespace from netlogon
> test.
>MIME-Version: 1.0
>Content-Type: text/plain; charset=UTF-8
>Content-Transfer-Encoding: 8bit
>
>Guenther
>
>Signed-off-by: GÃ¼nther Deschner <gd@samba.org>
>Reviewed-by: Stefan Metzmacher <metze@samba.org>
>(cherry picked from commit d1f481ffe17ce84ffddbedf1bd7efb0654e2807e)
>---
> source4/torture/rpc/netlogon.c |  210 ++++++++++++++++++++--------------------
> 1 file changed, 105 insertions(+), 105 deletions(-)
>
>diff --git a/source4/torture/rpc/netlogon.c b/source4/torture/rpc/netlogon.c
>index f1d605c..e5de0e8 100644
>--- a/source4/torture/rpc/netlogon.c
>+++ b/source4/torture/rpc/netlogon.c
>@@ -1,4 +1,4 @@
>-/* 
>+/*
>    Unix SMB/CIFS implementation.
> 
>    test suite for netlogon rpc operations
>@@ -7,17 +7,17 @@
>    Copyright (C) Andrew Bartlett <abartlet@samba.org> 2003-2004
>    Copyright (C) Tim Potter      2003
>    Copyright (C) Matthias Dieter WallnÃ¶fer            2009-2010
>-   
>+
>    This program is free software; you can redistribute it and/or modify
>    it under the terms of the GNU General Public License as published by
>    the Free Software Foundation; either version 3 of the License, or
>    (at your option) any later version.
>-   
>+
>    This program is distributed in the hope that it will be useful,
>    but WITHOUT ANY WARRANTY; without even the implied warranty of
>    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
>    GNU General Public License for more details.
>-   
>+
>    You should have received a copy of the GNU General Public License
>    along with this program.  If not, see <http://www.gnu.org/licenses/>.
> */
>@@ -98,7 +98,7 @@ static bool test_netr_broken_binding_handle(struct torture_context *tctx,
> 	return true;
> }
> 
>-static bool test_LogonUasLogon(struct torture_context *tctx, 
>+static bool test_LogonUasLogon(struct torture_context *tctx,
> 			       struct dcerpc_pipe *p)
> {
> 	NTSTATUS status;
>@@ -173,8 +173,8 @@ bool test_SetupCredentials(struct dcerpc_pipe *p, struct torture_context *tctx,
> 
> 	creds = netlogon_creds_client_init(tctx, a.in.account_name,
> 					   a.in.computer_name,
>-					   &credentials1, &credentials2, 
>-					   mach_password, &credentials3, 
>+					   &credentials1, &credentials2,
>+					   mach_password, &credentials3,
> 					   0);
> 	torture_assert(tctx, creds != NULL, "memory allocation");
> 
>@@ -186,7 +186,7 @@ bool test_SetupCredentials(struct dcerpc_pipe *p, struct torture_context *tctx,
> 
> 	/* This allows the tests to continue against the more fussy windows 2008 */
> 	if (NT_STATUS_EQUAL(a.out.result, NT_STATUS_DOWNGRADE_DETECTED)) {
>-		return test_SetupCredentials2(p, tctx, NETLOGON_NEG_AUTH2_ADS_FLAGS, 
>+		return test_SetupCredentials2(p, tctx, NETLOGON_NEG_AUTH2_ADS_FLAGS,
> 					      credentials,
> 					      cli_credentials_get_secure_channel_type(credentials),
> 					      creds_out);
>@@ -194,7 +194,7 @@ bool test_SetupCredentials(struct dcerpc_pipe *p, struct torture_context *tctx,
> 
> 	torture_assert_ntstatus_ok(tctx, a.out.result, "ServerAuthenticate");
> 
>-	torture_assert(tctx, netlogon_creds_client_check(creds, &credentials3), 
>+	torture_assert(tctx, netlogon_creds_client_check(creds, &credentials3),
> 		       "Credential chaining failed");
> 
> 	*creds_out = creds;
>@@ -242,9 +242,9 @@ bool test_SetupCredentials2(struct dcerpc_pipe *p, struct torture_context *tctx,
> 	a.out.return_credentials = &credentials3;
> 
> 	creds = netlogon_creds_client_init(tctx, a.in.account_name,
>-					   a.in.computer_name, 
>-					   &credentials1, &credentials2, 
>-					   mach_password, &credentials3, 
>+					   a.in.computer_name,
>+					   &credentials1, &credentials2,
>+					   mach_password, &credentials3,
> 					   negotiate_flags);
> 
> 	torture_assert(tctx, creds != NULL, "memory allocation");
>@@ -255,7 +255,7 @@ bool test_SetupCredentials2(struct dcerpc_pipe *p, struct torture_context *tctx,
> 		"ServerAuthenticate2 failed");
> 	torture_assert_ntstatus_ok(tctx, a.out.result, "ServerAuthenticate2 failed");
> 
>-	torture_assert(tctx, netlogon_creds_client_check(creds, &credentials3), 
>+	torture_assert(tctx, netlogon_creds_client_check(creds, &credentials3),
> 		"Credential chaining failed");
> 
> 	torture_comment(tctx, "negotiate_flags=0x%08x\n", negotiate_flags);
>@@ -310,10 +310,10 @@ bool test_SetupCredentials3(struct dcerpc_pipe *p, struct torture_context *tctx,
> 
> 	creds = netlogon_creds_client_init(tctx, a.in.account_name,
> 					   a.in.computer_name,
>-					   &credentials1, &credentials2, 
>+					   &credentials1, &credentials2,
> 					   &mach_password, &credentials3,
> 					   negotiate_flags);
>-	
>+
> 	torture_assert(tctx, creds != NULL, "memory allocation");
> 
> 	torture_comment(tctx, "Testing ServerAuthenticate3\n");
>@@ -324,7 +324,7 @@ bool test_SetupCredentials3(struct dcerpc_pipe *p, struct torture_context *tctx,
> 	torture_assert(tctx, netlogon_creds_client_check(creds, &credentials3), "Credential chaining failed");
> 
> 	torture_comment(tctx, "negotiate_flags=0x%08x\n", negotiate_flags);
>-	
>+
> 	/* Prove that requesting a challenge again won't break it */
> 	torture_assert_ntstatus_ok(tctx, dcerpc_netr_ServerReqChallenge_r(b, tctx, &r),
> 		"ServerReqChallenge failed");
>@@ -337,7 +337,7 @@ bool test_SetupCredentials3(struct dcerpc_pipe *p, struct torture_context *tctx,
> /*
>   try a change password for our machine account
> */
>-static bool test_SetPassword(struct torture_context *tctx, 
>+static bool test_SetPassword(struct torture_context *tctx,
> 			     struct dcerpc_pipe *p,
> 			     struct cli_credentials *machine_credentials)
> {
>@@ -366,7 +366,7 @@ static bool test_SetPassword(struct torture_context *tctx,
> 	netlogon_creds_des_encrypt(creds, &new_password);
> 
> 	torture_comment(tctx, "Testing ServerPasswordSet on machine account\n");
>-	torture_comment(tctx, "Changing machine account password to '%s'\n", 
>+	torture_comment(tctx, "Changing machine account password to '%s'\n",
> 			password);
> 
> 	netlogon_creds_client_authenticator(creds, &credential);
>@@ -383,9 +383,9 @@ static bool test_SetPassword(struct torture_context *tctx,
> 	   credentials chaining fully, and we verify that the server
> 	   allows the password to be set to the same value twice in a
> 	   row (match win2k3) */
>-	torture_comment(tctx, 
>+	torture_comment(tctx,
> 		"Testing a second ServerPasswordSet on machine account\n");
>-	torture_comment(tctx, 
>+	torture_comment(tctx,
> 		"Changing machine account password to '%s' (same as previous run)\n", password);
> 
> 	netlogon_creds_client_authenticator(creds, &credential);
>@@ -400,8 +400,8 @@ static bool test_SetPassword(struct torture_context *tctx,
> 
> 	cli_credentials_set_password(machine_credentials, password, CRED_SPECIFIED);
> 
>-	torture_assert(tctx, 
>-		test_SetupCredentials(p, tctx, machine_credentials, &creds), 
>+	torture_assert(tctx,
>+		test_SetupCredentials(p, tctx, machine_credentials, &creds),
> 		"ServerPasswordSet failed to actually change the password");
> 
> 	return true;
>@@ -506,8 +506,8 @@ static DATA_BLOB netlogon_very_rand_pass(TALLOC_CTX *mem_ctx, int len)
> /*
>   try a change password for our machine account
> */
>-static bool test_SetPassword2(struct torture_context *tctx, 
>-			      struct dcerpc_pipe *p, 
>+static bool test_SetPassword2(struct torture_context *tctx,
>+			      struct dcerpc_pipe *p,
> 			      struct cli_credentials *machine_credentials)
> {
> 	struct netr_ServerPasswordSet2 r;
>@@ -555,7 +555,7 @@ static bool test_SetPassword2(struct torture_context *tctx,
> 	cli_credentials_set_password(machine_credentials, password, CRED_SPECIFIED);
> 
> 	if (!torture_setting_bool(tctx, "dangerous", false)) {
>-		torture_comment(tctx, 
>+		torture_comment(tctx,
> 			"Not testing ability to set password to '', enable dangerous tests to perform this test\n");
> 	} else {
> 		/* by changing the machine password to ""
>@@ -566,29 +566,29 @@ static bool test_SetPassword2(struct torture_context *tctx,
> 		password = "";
> 		encode_pw_buffer(password_buf.data, password, STR_UNICODE);
> 		netlogon_creds_arcfour_crypt(creds, password_buf.data, 516);
>-		
>+
> 		memcpy(new_password.data, password_buf.data, 512);
> 		new_password.length = IVAL(password_buf.data, 512);
>-		
>-		torture_comment(tctx, 
>+
>+		torture_comment(tctx,
> 			"Testing ServerPasswordSet2 on machine account\n");
>-		torture_comment(tctx, 
>+		torture_comment(tctx,
> 			"Changing machine account password to '%s'\n", password);
>-		
>+
> 		netlogon_creds_client_authenticator(creds, &credential);
>-		
>+
> 		torture_assert_ntstatus_ok(tctx, dcerpc_netr_ServerPasswordSet2_r(b, tctx, &r),
> 			"ServerPasswordSet2 failed");
> 		torture_assert_ntstatus_ok(tctx, r.out.result, "ServerPasswordSet2 failed");
>-		
>+
> 		if (!netlogon_creds_client_check(creds, &r.out.return_authenticator->cred)) {
> 			torture_comment(tctx, "Credential chaining failed\n");
> 		}
>-		
>+
> 		cli_credentials_set_password(machine_credentials, password, CRED_SPECIFIED);
> 	}
> 
>-	torture_assert(tctx, test_SetupCredentials(p, tctx, machine_credentials, &creds), 
>+	torture_assert(tctx, test_SetupCredentials(p, tctx, machine_credentials, &creds),
> 		"ServerPasswordSet failed to actually change the password");
> 
> 	/* now try a random password */
>@@ -616,9 +616,9 @@ static bool test_SetPassword2(struct torture_context *tctx,
> 	   credentials chaining fully, and we verify that the server
> 	   allows the password to be set to the same value twice in a
> 	   row (match win2k3) */
>-	torture_comment(tctx, 
>+	torture_comment(tctx,
> 		"Testing a second ServerPasswordSet2 on machine account\n");
>-	torture_comment(tctx, 
>+	torture_comment(tctx,
> 		"Changing machine account password to '%s' (same as previous run)\n", password);
> 
> 	netlogon_creds_client_authenticator(creds, &credential);
>@@ -633,8 +633,8 @@ static bool test_SetPassword2(struct torture_context *tctx,
> 
> 	cli_credentials_set_password(machine_credentials, password, CRED_SPECIFIED);
> 
>-	torture_assert (tctx, 
>-		test_SetupCredentials(p, tctx, machine_credentials, &creds), 
>+	torture_assert (tctx,
>+		test_SetupCredentials(p, tctx, machine_credentials, &creds),
> 		"ServerPasswordSet failed to actually change the password");
> 
> 	new_random_pass = netlogon_very_rand_pass(tctx, 128);
>@@ -647,7 +647,7 @@ static bool test_SetPassword2(struct torture_context *tctx,
> 	memcpy(new_password.data, password_buf.data, 512);
> 	new_password.length = IVAL(password_buf.data, 512);
> 
>-	torture_comment(tctx, 
>+	torture_comment(tctx,
> 		"Testing a third ServerPasswordSet2 on machine account, with a completely random password\n");
> 
> 	netlogon_creds_client_authenticator(creds, &credential);
>@@ -665,8 +665,8 @@ static bool test_SetPassword2(struct torture_context *tctx,
> 	cli_credentials_set_password(machine_credentials, NULL, CRED_UNINITIALISED);
> 	cli_credentials_set_nt_hash(machine_credentials, &nt_hash, CRED_SPECIFIED);
> 
>-	torture_assert (tctx, 
>-		test_SetupCredentials(p, tctx, machine_credentials, &creds), 
>+	torture_assert (tctx,
>+		test_SetupCredentials(p, tctx, machine_credentials, &creds),
> 		"ServerPasswordSet failed to actually change the password");
> 
> 	return true;
>@@ -765,7 +765,7 @@ static bool test_netlogon_ops_args(struct dcerpc_pipe *p, struct torture_context
> 		flags |= CLI_CRED_NTLMv2_AUTH;
> 	}
> 
>-	cli_credentials_get_ntlm_username_domain(cmdline_credentials, tctx, 
>+	cli_credentials_get_ntlm_username_domain(cmdline_credentials, tctx,
> 						 &ninfo.identity_info.account_name.string,
> 						 &ninfo.identity_info.domain_name.string);
> 
>@@ -773,16 +773,16 @@ static bool test_netlogon_ops_args(struct dcerpc_pipe *p, struct torture_context
> 		ninfo.identity_info.domain_name.string = NULL;
> 	}
> 
>-	generate_random_buffer(ninfo.challenge, 
>+	generate_random_buffer(ninfo.challenge,
> 			       sizeof(ninfo.challenge));
>-	chal = data_blob_const(ninfo.challenge, 
>+	chal = data_blob_const(ninfo.challenge,
> 			       sizeof(ninfo.challenge));
> 
>-	names_blob = NTLMv2_generate_names_blob(tctx, cli_credentials_get_workstation(credentials), 
>+	names_blob = NTLMv2_generate_names_blob(tctx, cli_credentials_get_workstation(credentials),
> 						cli_credentials_get_domain(credentials));
> 
>-	status = cli_credentials_get_ntlm_response(cmdline_credentials, tctx, 
>-						   &flags, 
>+	status = cli_credentials_get_ntlm_response(cmdline_credentials, tctx,
>+						   &flags,
> 						   chal,
> 						   names_blob,
> 						   &lm_resp, &nt_resp,
>@@ -812,19 +812,19 @@ static bool test_netlogon_ops_args(struct dcerpc_pipe *p, struct torture_context
> 	r.out.authoritative = &authoritative;
> 
> 	d_printf("Testing LogonSamLogon with name %s\n", ninfo.identity_info.account_name.string);
>-	
>+
> 	for (i=2;i<=3;i++) {
> 		ZERO_STRUCT(auth2);
> 		netlogon_creds_client_authenticator(creds, &auth);
>-		
>+
> 		r.in.validation_level = i;
>-		
>+
> 		torture_assert_ntstatus_ok(tctx, dcerpc_netr_LogonSamLogon_r(b, tctx, &r),
> 			"LogonSamLogon failed");
> 		torture_assert_ntstatus_ok(tctx, r.out.result, "LogonSamLogon failed");
>-		
>-		torture_assert(tctx, netlogon_creds_client_check(creds, 
>-								 &r.out.return_authenticator->cred), 
>+
>+		torture_assert(tctx, netlogon_creds_client_check(creds,
>+								 &r.out.return_authenticator->cred),
> 			"Credential chaining failed");
> 		torture_assert_int_equal(tctx, *r.out.authoritative, 1,
> 					 "LogonSamLogon invalid  *r.out.authoritative");
>@@ -999,7 +999,7 @@ bool test_netlogon_capabilities(struct dcerpc_pipe *p, struct torture_context *t
> /*
>   try a netlogon SamLogon
> */
>-static bool test_SamLogon(struct torture_context *tctx, 
>+static bool test_SamLogon(struct torture_context *tctx,
> 			  struct dcerpc_pipe *p,
> 			  struct cli_credentials *credentials)
> {
>@@ -1031,13 +1031,13 @@ static uint64_t sequence_nums[3];
> /*
>   try a netlogon DatabaseSync
> */
>-static bool test_DatabaseSync(struct torture_context *tctx, 
>+static bool test_DatabaseSync(struct torture_context *tctx,
> 			      struct dcerpc_pipe *p,
> 			      struct cli_credentials *machine_credentials)
> {
> 	struct netr_DatabaseSync r;
> 	struct netlogon_creds_CredentialState *creds;
>-	const uint32_t database_ids[] = {SAM_DATABASE_DOMAIN, SAM_DATABASE_BUILTIN, SAM_DATABASE_PRIVS}; 
>+	const uint32_t database_ids[] = {SAM_DATABASE_DOMAIN, SAM_DATABASE_BUILTIN, SAM_DATABASE_PRIVS};
> 	int i;
> 	struct netr_DELTA_ENUM_ARRAY *delta_enum_array = NULL;
> 	struct netr_Authenticator credential, return_authenticator;
>@@ -1090,10 +1090,10 @@ static bool test_DatabaseSync(struct torture_context *tctx,
> 			    delta_enum_array->num_deltas > 0 &&
> 			    delta_enum_array->delta_enum[0].delta_type == NETR_DELTA_DOMAIN &&
> 			    delta_enum_array->delta_enum[0].delta_union.domain) {
>-				sequence_nums[r.in.database_id] = 
>+				sequence_nums[r.in.database_id] =
> 					delta_enum_array->delta_enum[0].delta_union.domain->sequence_num;
> 				torture_comment(tctx, "\tsequence_nums[%d]=%llu\n",
>-				       r.in.database_id, 
>+				       r.in.database_id,
> 				       (unsigned long long)sequence_nums[r.in.database_id]);
> 			}
> 		} while (NT_STATUS_EQUAL(r.out.result, STATUS_MORE_ENTRIES));
>@@ -1106,7 +1106,7 @@ static bool test_DatabaseSync(struct torture_context *tctx,
> /*
>   try a netlogon DatabaseDeltas
> */
>-static bool test_DatabaseDeltas(struct torture_context *tctx, 
>+static bool test_DatabaseDeltas(struct torture_context *tctx,
> 				struct dcerpc_pipe *p,
> 				struct cli_credentials *machine_credentials)
> {
>@@ -1115,7 +1115,7 @@ static bool test_DatabaseDeltas(struct torture_context *tctx,
> 	struct netr_Authenticator credential;
> 	struct netr_Authenticator return_authenticator;
> 	struct netr_DELTA_ENUM_ARRAY *delta_enum_array = NULL;
>-	const uint32_t database_ids[] = {0, 1, 2}; 
>+	const uint32_t database_ids[] = {0, 1, 2};
> 	int i;
> 	struct dcerpc_binding_handle *b = p->binding_handle;
> 
>@@ -1138,7 +1138,7 @@ static bool test_DatabaseDeltas(struct torture_context *tctx,
> 
> 		*r.in.sequence_num -= 1;
> 
>-		torture_comment(tctx, "Testing DatabaseDeltas of id %d at %llu\n", 
>+		torture_comment(tctx, "Testing DatabaseDeltas of id %d at %llu\n",
> 		       r.in.database_id, (unsigned long long)*r.in.sequence_num);
> 
> 		do {
>@@ -1704,7 +1704,7 @@ static bool test_DatabaseRedo(struct torture_context *tctx,
> /*
>   try a netlogon AccountDeltas
> */
>-static bool test_AccountDeltas(struct torture_context *tctx, 
>+static bool test_AccountDeltas(struct torture_context *tctx,
> 			       struct dcerpc_pipe *p,
> 			       struct cli_credentials *machine_credentials)
> {
>@@ -1749,7 +1749,7 @@ static bool test_AccountDeltas(struct torture_context *tctx,
> /*
>   try a netlogon AccountSync
> */
>-static bool test_AccountSync(struct torture_context *tctx, struct dcerpc_pipe *p, 
>+static bool test_AccountSync(struct torture_context *tctx, struct dcerpc_pipe *p,
> 			     struct cli_credentials *machine_credentials)
> {
> 	struct netr_AccountSync r;
>@@ -1796,7 +1796,7 @@ static bool test_AccountSync(struct torture_context *tctx, struct dcerpc_pipe *p
> /*
>   try a netlogon GetDcName
> */
>-static bool test_GetDcName(struct torture_context *tctx, 
>+static bool test_GetDcName(struct torture_context *tctx,
> 			   struct dcerpc_pipe *p)
> {
> 	struct netr_GetDcName r;
>@@ -1860,9 +1860,9 @@ static const char *function_code_str(TALLOC_CTX *mem_ctx,
> 
> 
> /*
>-  try a netlogon LogonControl 
>+  try a netlogon LogonControl
> */
>-static bool test_LogonControl(struct torture_context *tctx, 
>+static bool test_LogonControl(struct torture_context *tctx,
> 			      struct dcerpc_pipe *p,
> 			      struct cli_credentials *machine_credentials)
> 
>@@ -1988,7 +1988,7 @@ static bool test_LogonControl(struct torture_context *tctx,
> /*
>   try a netlogon GetAnyDCName
> */
>-static bool test_GetAnyDCName(struct torture_context *tctx, 
>+static bool test_GetAnyDCName(struct torture_context *tctx,
> 			      struct dcerpc_pipe *p)
> {
> 	NTSTATUS status;
>@@ -2036,7 +2036,7 @@ static bool test_GetAnyDCName(struct torture_context *tctx,
> /*
>   try a netlogon LogonControl2
> */
>-static bool test_LogonControl2(struct torture_context *tctx, 
>+static bool test_LogonControl2(struct torture_context *tctx,
> 			       struct dcerpc_pipe *p,
> 			       struct cli_credentials *machine_credentials)
> 
>@@ -2141,7 +2141,7 @@ static bool test_LogonControl2(struct torture_context *tctx,
> /*
>   try a netlogon DatabaseSync2
> */
>-static bool test_DatabaseSync2(struct torture_context *tctx, 
>+static bool test_DatabaseSync2(struct torture_context *tctx,
> 			       struct dcerpc_pipe *p,
> 			       struct cli_credentials *machine_credentials)
> {
>@@ -2150,11 +2150,11 @@ static bool test_DatabaseSync2(struct torture_context *tctx,
> 	struct netr_Authenticator return_authenticator, credential;
> 
> 	struct netlogon_creds_CredentialState *creds;
>-	const uint32_t database_ids[] = {0, 1, 2}; 
>+	const uint32_t database_ids[] = {0, 1, 2};
> 	int i;
> 	struct dcerpc_binding_handle *b = p->binding_handle;
> 
>-	if (!test_SetupCredentials2(p, tctx, NETLOGON_NEG_AUTH2_FLAGS, 
>+	if (!test_SetupCredentials2(p, tctx, NETLOGON_NEG_AUTH2_FLAGS,
> 				    machine_credentials,
> 				    cli_credentials_get_secure_channel_type(machine_credentials),
> 				    &creds)) {
>@@ -2212,7 +2212,7 @@ static bool test_DatabaseSync2(struct torture_context *tctx,
> /*
>   try a netlogon LogonControl2Ex
> */
>-static bool test_LogonControl2Ex(struct torture_context *tctx, 
>+static bool test_LogonControl2Ex(struct torture_context *tctx,
> 				 struct dcerpc_pipe *p,
> 				 struct cli_credentials *machine_credentials)
> 
>@@ -2235,7 +2235,7 @@ static bool test_LogonControl2Ex(struct torture_context *tctx,
> 	for (i=1;i<4;i++) {
> 		r.in.level = i;
> 
>-		torture_comment(tctx, "Testing LogonControl2Ex level %d function %d\n", 
>+		torture_comment(tctx, "Testing LogonControl2Ex level %d function %d\n",
> 		       i, r.in.function_code);
> 
> 		status = dcerpc_netr_LogonControl2Ex_r(b, tctx, &r);
>@@ -2250,7 +2250,7 @@ static bool test_LogonControl2Ex(struct torture_context *tctx,
> 	for (i=1;i<4;i++) {
> 		r.in.level = i;
> 
>-		torture_comment(tctx, "Testing LogonControl2Ex level %d function %d\n", 
>+		torture_comment(tctx, "Testing LogonControl2Ex level %d function %d\n",
> 		       i, r.in.function_code);
> 
> 		status = dcerpc_netr_LogonControl2Ex_r(b, tctx, &r);
>@@ -2265,7 +2265,7 @@ static bool test_LogonControl2Ex(struct torture_context *tctx,
> 	for (i=1;i<4;i++) {
> 		r.in.level = i;
> 
>-		torture_comment(tctx, "Testing LogonControl2Ex level %d function %d\n", 
>+		torture_comment(tctx, "Testing LogonControl2Ex level %d function %d\n",
> 		       i, r.in.function_code);
> 
> 		status = dcerpc_netr_LogonControl2Ex_r(b, tctx, &r);
>@@ -2280,7 +2280,7 @@ static bool test_LogonControl2Ex(struct torture_context *tctx,
> 	for (i=1;i<4;i++) {
> 		r.in.level = i;
> 
>-		torture_comment(tctx, "Testing LogonControl2Ex level %d function %d\n", 
>+		torture_comment(tctx, "Testing LogonControl2Ex level %d function %d\n",
> 		       i, r.in.function_code);
> 
> 		status = dcerpc_netr_LogonControl2Ex_r(b, tctx, &r);
>@@ -2332,8 +2332,8 @@ static bool test_netr_GetForestTrustInformation(struct torture_context *tctx,
> 	return true;
> }
> 
>-static bool test_netr_DsRGetForestTrustInformation(struct torture_context *tctx, 
>-						   struct dcerpc_pipe *p, const char *trusted_domain_name) 
>+static bool test_netr_DsRGetForestTrustInformation(struct torture_context *tctx,
>+						   struct dcerpc_pipe *p, const char *trusted_domain_name)
> {
> 	NTSTATUS status;
> 	struct netr_DsRGetForestTrustInformation r;
>@@ -2359,7 +2359,7 @@ static bool test_netr_DsRGetForestTrustInformation(struct torture_context *tctx,
> /*
>   try a netlogon netr_DsrEnumerateDomainTrusts
> */
>-static bool test_DsrEnumerateDomainTrusts(struct torture_context *tctx, 
>+static bool test_DsrEnumerateDomainTrusts(struct torture_context *tctx,
> 					  struct dcerpc_pipe *p)
> {
> 	NTSTATUS status;
>@@ -2391,7 +2391,7 @@ static bool test_DsrEnumerateDomainTrusts(struct torture_context *tctx,
> 		/* get info for transitive forest trusts */
> 
> 		if (r.out.trusts->array[i].trust_attributes & NETR_TRUST_ATTRIBUTE_FOREST_TRANSITIVE) {
>-			if (!test_netr_DsRGetForestTrustInformation(tctx, p, 
>+			if (!test_netr_DsRGetForestTrustInformation(tctx, p,
> 								    r.out.trusts->array[i].dns_name)) {
> 				return false;
> 			}
>@@ -2439,8 +2439,8 @@ static bool test_netr_NetrEnumerateTrustedDomainsEx(struct torture_context *tctx
> 
> 
> static bool test_netr_DsRGetSiteName(struct dcerpc_pipe *p, struct torture_context *tctx,
>-				     const char *computer_name, 
>-				     const char *expected_site) 
>+				     const char *computer_name,
>+				     const char *expected_site)
> {
> 	NTSTATUS status;
> 	struct netr_DsRGetSiteName r;
>@@ -2462,7 +2462,7 @@ static bool test_netr_DsRGetSiteName(struct dcerpc_pipe *p, struct torture_conte
> /*
>   try a netlogon netr_DsRGetDCName
> */
>-static bool test_netr_DsRGetDCName(struct torture_context *tctx, 
>+static bool test_netr_DsRGetDCName(struct torture_context *tctx,
> 				   struct dcerpc_pipe *p)
> {
> 	NTSTATUS status;
>@@ -2519,7 +2519,7 @@ static bool test_netr_DsRGetDCName(struct torture_context *tctx,
> 					 "DsRGetDCName");
> 	}
> 
>-	return test_netr_DsRGetSiteName(p, tctx, 
>+	return test_netr_DsRGetSiteName(p, tctx,
> 				       info->dc_unc,
> 				       info->dc_site_name);
> }
>@@ -2527,7 +2527,7 @@ static bool test_netr_DsRGetDCName(struct torture_context *tctx,
> /*
>   try a netlogon netr_DsRGetDCNameEx
> */
>-static bool test_netr_DsRGetDCNameEx(struct torture_context *tctx, 
>+static bool test_netr_DsRGetDCNameEx(struct torture_context *tctx,
> 				     struct dcerpc_pipe *p)
> {
> 	NTSTATUS status;
>@@ -2591,7 +2591,7 @@ static bool test_netr_DsRGetDCNameEx(struct torture_context *tctx,
> /*
>   try a netlogon netr_DsRGetDCNameEx2
> */
>-static bool test_netr_DsRGetDCNameEx2(struct torture_context *tctx, 
>+static bool test_netr_DsRGetDCNameEx2(struct torture_context *tctx,
> 				      struct dcerpc_pipe *p)
> {
> 	NTSTATUS status;
>@@ -2724,7 +2724,7 @@ failed:
> 	return NULL;
> }
> 
>-static bool test_netr_DsrGetDcSiteCoverageW(struct torture_context *tctx, 
>+static bool test_netr_DsrGetDcSiteCoverageW(struct torture_context *tctx,
> 					    struct dcerpc_pipe *p)
> {
> 	char *url;
>@@ -3168,7 +3168,7 @@ static bool test_netr_ServerGetTrustInfo(struct torture_context *tctx,
> }
> 
> 
>-static bool test_GetDomainInfo(struct torture_context *tctx, 
>+static bool test_GetDomainInfo(struct torture_context *tctx,
> 			       struct dcerpc_pipe *p,
> 			       struct cli_credentials *machine_credentials)
> {
>@@ -3196,7 +3196,7 @@ static bool test_GetDomainInfo(struct torture_context *tctx,
> 
> 	torture_comment(tctx, "Testing netr_LogonGetDomainInfo\n");
> 
>-	if (!test_SetupCredentials3(p, tctx, NETLOGON_NEG_AUTH2_ADS_FLAGS, 
>+	if (!test_SetupCredentials3(p, tctx, NETLOGON_NEG_AUTH2_ADS_FLAGS,
> 				    machine_credentials, &creds)) {
> 		return false;
> 	}
>@@ -3261,7 +3261,7 @@ static bool test_GetDomainInfo(struct torture_context *tctx,
> 				   "(sAMAccountName=%s$)", TEST_MACHINE_NAME);
> 		old_dnsname =
> 			ldb_msg_find_attr_as_string(res[0], "dNSHostName", NULL);
>-		
>+
> 		/* Gets back the "servicePrincipalName"s in AD */
> 		spn_el = ldb_msg_find_element(res[0], "servicePrincipalName");
> 		if (spn_el != NULL) {
>@@ -3300,11 +3300,11 @@ static bool test_GetDomainInfo(struct torture_context *tctx,
> 			   the same in combination with the "servicePrincipalName"s.
> 			   The DNS hostname should also be returned by our
> 			   "LogonGetDomainInfo" call (in the domain info structure). */
>-			
>+
> 			torture_assert_str_equal(tctx,
> 						 ldb_msg_find_attr_as_string(res[0], "dNSHostName", NULL),
> 						 old_dnsname, "'DNS hostname' was not set!");
>-			
>+
> 			spn_el = ldb_msg_find_element(res[0], "servicePrincipalName");
> 			torture_assert(tctx, ((spns != NULL) && (spn_el != NULL)),
> 				       "'servicePrincipalName's not set!");
>@@ -3324,15 +3324,15 @@ static bool test_GetDomainInfo(struct torture_context *tctx,
> 			   the "servicePrincipalName"s should remain empty and no DNS
> 			   hostname should be returned by our "LogonGetDomainInfo"
> 			   call (in the domain info structure). */
>-			
>+
> 			torture_assert(tctx,
> 				       ldb_msg_find_attr_as_string(res[0], "dNSHostName", NULL) == NULL,
> 				       "'DNS hostname' was set!");
>-			
>+
> 			spn_el = ldb_msg_find_element(res[0], "servicePrincipalName");
> 			torture_assert(tctx, ((spns == NULL) && (spn_el == NULL)),
> 				       "'servicePrincipalName's were set!");
>-			
>+
> 			torture_assert(tctx,
> 				       info.domain_info->dns_hostname.string == NULL,
> 				       "Out 'DNS host name' was set!");
>@@ -3390,7 +3390,7 @@ static bool test_GetDomainInfo(struct torture_context *tctx,
> 		torture_assert_str_equal(tctx,
> 					 ldb_msg_find_attr_as_string(res[0], "dNSHostName", NULL),
> 					 old_dnsname, "'DNS host name' did change!");
>-		
>+
> 		/* Find the two "servicePrincipalName"s which the DC shouldn't have been
> 		   updated (HOST/<Netbios name> and HOST/<FQDN name>) - see MS-NRPC
> 		   3.5.4.3.9 */
>@@ -3409,7 +3409,7 @@ static bool test_GetDomainInfo(struct torture_context *tctx,
> 				break;
> 		torture_assert(tctx, i != spn_el->num_values,
> 			       "'servicePrincipalName' HOST/<FQDN name> not found!");
>-		
>+
> 		/* Check that the out DNS hostname was set properly */
> 		torture_assert_str_equal(tctx, info.domain_info->dns_hostname.string,
> 					 old_dnsname, "Out 'DNS hostname' doesn't match the old one!");
>@@ -3601,7 +3601,7 @@ static bool test_GetDomainInfo(struct torture_context *tctx,
> 	return true;
> }
> 
>-static bool test_GetDomainInfo_async(struct torture_context *tctx, 
>+static bool test_GetDomainInfo_async(struct torture_context *tctx,
> 				     struct dcerpc_pipe *p,
> 				     struct cli_credentials *machine_credentials)
> {
>@@ -3619,7 +3619,7 @@ static bool test_GetDomainInfo_async(struct torture_context *tctx,
> 
> 	torture_comment(tctx, "Testing netr_LogonGetDomainInfo - async count %d\n", ASYNC_COUNT);
> 
>-	if (!test_SetupCredentials3(p, tctx, NETLOGON_NEG_AUTH2_ADS_FLAGS, 
>+	if (!test_SetupCredentials3(p, tctx, NETLOGON_NEG_AUTH2_ADS_FLAGS,
> 				    machine_credentials, &creds)) {
> 		return false;
> 	}
>@@ -3648,9 +3648,9 @@ static bool test_GetDomainInfo_async(struct torture_context *tctx,
> 		creds_async[i] = (struct netlogon_creds_CredentialState *)talloc_memdup(creds, creds, sizeof(*creds));
> 		req[i] = dcerpc_netr_LogonGetDomainInfo_r_send(tctx, tctx->ev, p->binding_handle, &r);
> 
>-		/* even with this flush per request a w2k3 server seems to 
>+		/* even with this flush per request a w2k3 server seems to
> 		   clag with multiple outstanding requests. bleergh. */
>-		torture_assert_int_equal(tctx, tevent_loop_once(dcerpc_event_context(p)), 0, 
>+		torture_assert_int_equal(tctx, tevent_loop_once(dcerpc_event_context(p)), 0,
> 					 "tevent_loop_once failed");
> 	}
> 
>@@ -3661,19 +3661,19 @@ static bool test_GetDomainInfo_async(struct torture_context *tctx,
> 		status = dcerpc_netr_LogonGetDomainInfo_r_recv(req[i], tctx);
> 
> 		torture_assert_ntstatus_ok(tctx, status, "netr_LogonGetDomainInfo_async");
>-		torture_assert_ntstatus_ok(tctx, r.out.result, "netr_LogonGetDomainInfo_async"); 
>+		torture_assert_ntstatus_ok(tctx, r.out.result, "netr_LogonGetDomainInfo_async");
> 
>-		torture_assert(tctx, netlogon_creds_client_check(creds_async[i], &a.cred), 
>+		torture_assert(tctx, netlogon_creds_client_check(creds_async[i], &a.cred),
> 			"Credential chaining failed at async");
> 	}
> 
>-	torture_comment(tctx, 
>+	torture_comment(tctx,
> 			"Testing netr_LogonGetDomainInfo - async count %d OK\n", ASYNC_COUNT);
> 
> 	return true;
> }
> 
>-static bool test_ManyGetDCName(struct torture_context *tctx, 
>+static bool test_ManyGetDCName(struct torture_context *tctx,
> 			       struct dcerpc_pipe *p)
> {
> 	NTSTATUS status;
>-- 
>1.7.9.5
>
>
>From e55fd0feab50eaf0af6a1b3eb617d99ac9e379e4 Mon Sep 17 00:00:00 2001
>From: =?UTF-8?q?G=C3=BCnther=20Deschner?= <gd@samba.org>
>Date: Thu, 29 Nov 2012 22:44:33 +0100
>Subject: [PATCH 06/28] s4-torture: pass down netlogon flags in
> netr_ServerPasswordSet2 tests.
>MIME-Version: 1.0
>Content-Type: text/plain; charset=UTF-8
>Content-Transfer-Encoding: 8bit
>
>Guenther
>
>Signed-off-by: GÃ¼nther Deschner <gd@samba.org>
>Reviewed-by: Stefan Metzmacher <metze@samba.org>
>(cherry picked from commit 0a091604a45b4b143745a20fa842878ceb745c39)
>---
> source4/torture/rpc/netlogon.c |   16 ++++++++++++----
> 1 file changed, 12 insertions(+), 4 deletions(-)
>
>diff --git a/source4/torture/rpc/netlogon.c b/source4/torture/rpc/netlogon.c
>index e5de0e8..b79eb1a 100644
>--- a/source4/torture/rpc/netlogon.c
>+++ b/source4/torture/rpc/netlogon.c
>@@ -506,9 +506,10 @@ static DATA_BLOB netlogon_very_rand_pass(TALLOC_CTX *mem_ctx, int len)
> /*
>   try a change password for our machine account
> */
>-static bool test_SetPassword2(struct torture_context *tctx,
>-			      struct dcerpc_pipe *p,
>-			      struct cli_credentials *machine_credentials)
>+static bool test_SetPassword2_with_flags(struct torture_context *tctx,
>+					 struct dcerpc_pipe *p,
>+					 struct cli_credentials *machine_credentials,
>+					 uint32_t flags)
> {
> 	struct netr_ServerPasswordSet2 r;
> 	const char *password;
>@@ -520,7 +521,7 @@ static bool test_SetPassword2(struct torture_context *tctx,
> 	struct netr_CryptPassword new_password;
> 	struct dcerpc_binding_handle *b = p->binding_handle;
> 
>-	if (!test_SetupCredentials(p, tctx, machine_credentials, &creds)) {
>+	if (!test_SetupCredentials2(p, tctx, flags, machine_credentials, cli_credentials_get_secure_channel_type(machine_credentials), &creds)) {
> 		return false;
> 	}
> 
>@@ -672,6 +673,13 @@ static bool test_SetPassword2(struct torture_context *tctx,
> 	return true;
> }
> 
>+static bool test_SetPassword2(struct torture_context *tctx,
>+			      struct dcerpc_pipe *p,
>+			      struct cli_credentials *machine_credentials)
>+{
>+	return test_SetPassword2_with_flags(tctx, p, machine_credentials, NETLOGON_NEG_AUTH2_ADS_FLAGS);
>+}
>+
> static bool test_GetPassword(struct torture_context *tctx,
> 			     struct dcerpc_pipe *p,
> 			     struct cli_credentials *machine_credentials)
>-- 
>1.7.9.5
>
>
>From a2009b4035e2e1ce5425b4d2c8b64a3a52f8929c Mon Sep 17 00:00:00 2001
>From: =?UTF-8?q?G=C3=BCnther=20Deschner?= <gd@samba.org>
>Date: Thu, 29 Nov 2012 22:47:19 +0100
>Subject: [PATCH 07/28] s4-torture: add AES support for
> netr_ServerPasswordSet2 tests.
>MIME-Version: 1.0
>Content-Type: text/plain; charset=UTF-8
>Content-Transfer-Encoding: 8bit
>
>Guenther
>
>Signed-off-by: GÃ¼nther Deschner <gd@samba.org>
>Reviewed-by: Stefan Metzmacher <metze@samba.org>
>(cherry picked from commit 3dc8c20b8a94063c6578b60750757c5a40d7db38)
>---
> source4/torture/rpc/netlogon.c |   35 +++++++++++++++++++++++++++++------
> 1 file changed, 29 insertions(+), 6 deletions(-)
>
>diff --git a/source4/torture/rpc/netlogon.c b/source4/torture/rpc/netlogon.c
>index b79eb1a..2f7e913 100644
>--- a/source4/torture/rpc/netlogon.c
>+++ b/source4/torture/rpc/netlogon.c
>@@ -535,7 +535,11 @@ static bool test_SetPassword2_with_flags(struct torture_context *tctx,
> 
> 	password = generate_random_password(tctx, 8, 255);
> 	encode_pw_buffer(password_buf.data, password, STR_UNICODE);
>-	netlogon_creds_arcfour_crypt(creds, password_buf.data, 516);
>+	if (creds->negotiate_flags & NETLOGON_NEG_SUPPORTS_AES) {
>+		netlogon_creds_aes_encrypt(creds, password_buf.data, 516);
>+	} else {
>+		netlogon_creds_arcfour_crypt(creds, password_buf.data, 516);
>+	}
> 
> 	memcpy(new_password.data, password_buf.data, 512);
> 	new_password.length = IVAL(password_buf.data, 512);
>@@ -566,8 +570,11 @@ static bool test_SetPassword2_with_flags(struct torture_context *tctx,
> 		 */
> 		password = "";
> 		encode_pw_buffer(password_buf.data, password, STR_UNICODE);
>-		netlogon_creds_arcfour_crypt(creds, password_buf.data, 516);
>-
>+		if (creds->negotiate_flags & NETLOGON_NEG_SUPPORTS_AES) {
>+			netlogon_creds_aes_encrypt(creds, password_buf.data, 516);
>+		} else {
>+			netlogon_creds_arcfour_crypt(creds, password_buf.data, 516);
>+		}
> 		memcpy(new_password.data, password_buf.data, 512);
> 		new_password.length = IVAL(password_buf.data, 512);
> 
>@@ -595,8 +602,11 @@ static bool test_SetPassword2_with_flags(struct torture_context *tctx,
> 	/* now try a random password */
> 	password = generate_random_password(tctx, 8, 255);
> 	encode_pw_buffer(password_buf.data, password, STR_UNICODE);
>-	netlogon_creds_arcfour_crypt(creds, password_buf.data, 516);
>-
>+	if (creds->negotiate_flags & NETLOGON_NEG_SUPPORTS_AES) {
>+		netlogon_creds_aes_encrypt(creds, password_buf.data, 516);
>+	} else {
>+		netlogon_creds_arcfour_crypt(creds, password_buf.data, 516);
>+	}
> 	memcpy(new_password.data, password_buf.data, 512);
> 	new_password.length = IVAL(password_buf.data, 512);
> 
>@@ -643,7 +653,11 @@ static bool test_SetPassword2_with_flags(struct torture_context *tctx,
> 	/* now try a random stream of bytes for a password */
> 	set_pw_in_buffer(password_buf.data, &new_random_pass);
> 
>-	netlogon_creds_arcfour_crypt(creds, password_buf.data, 516);
>+	if (creds->negotiate_flags & NETLOGON_NEG_SUPPORTS_AES) {
>+		netlogon_creds_aes_encrypt(creds, password_buf.data, 516);
>+	} else {
>+		netlogon_creds_arcfour_crypt(creds, password_buf.data, 516);
>+	}
> 
> 	memcpy(new_password.data, password_buf.data, 512);
> 	new_password.length = IVAL(password_buf.data, 512);
>@@ -680,6 +694,13 @@ static bool test_SetPassword2(struct torture_context *tctx,
> 	return test_SetPassword2_with_flags(tctx, p, machine_credentials, NETLOGON_NEG_AUTH2_ADS_FLAGS);
> }
> 
>+static bool test_SetPassword2_AES(struct torture_context *tctx,
>+				  struct dcerpc_pipe *p,
>+				  struct cli_credentials *machine_credentials)
>+{
>+	return test_SetPassword2_with_flags(tctx, p, machine_credentials, NETLOGON_NEG_AUTH2_ADS_FLAGS | NETLOGON_NEG_SUPPORTS_AES);
>+}
>+
> static bool test_GetPassword(struct torture_context *tctx,
> 			     struct dcerpc_pipe *p,
> 			     struct cli_credentials *machine_credentials)
>@@ -3811,6 +3832,7 @@ struct torture_suite *torture_rpc_netlogon(TALLOC_CTX *mem_ctx)
> 	torture_rpc_tcase_add_test_creds(tcase, "SamLogon", test_SamLogon);
> 	torture_rpc_tcase_add_test_creds(tcase, "SetPassword", test_SetPassword);
> 	torture_rpc_tcase_add_test_creds(tcase, "SetPassword2", test_SetPassword2);
>+	torture_rpc_tcase_add_test_creds(tcase, "SetPassword2_AES", test_SetPassword2_AES);
> 	torture_rpc_tcase_add_test_creds(tcase, "GetPassword", test_GetPassword);
> 	torture_rpc_tcase_add_test_creds(tcase, "GetTrustPasswords", test_GetTrustPasswords);
> 	torture_rpc_tcase_add_test_creds(tcase, "GetDomainInfo", test_GetDomainInfo);
>@@ -3853,6 +3875,7 @@ struct torture_suite *torture_rpc_netlogon_s3(TALLOC_CTX *mem_ctx)
> 	torture_rpc_tcase_add_test_creds(tcase, "SetPassword", test_SetPassword);
> 	torture_rpc_tcase_add_test_creds(tcase, "SetPassword_with_flags", test_SetPassword_with_flags);
> 	torture_rpc_tcase_add_test_creds(tcase, "SetPassword2", test_SetPassword2);
>+	torture_rpc_tcase_add_test_creds(tcase, "SetPassword2_AES", test_SetPassword2_AES);
> 	torture_rpc_tcase_add_test(tcase, "NetrEnumerateTrustedDomains", test_netr_NetrEnumerateTrustedDomains);
> 
> 	return suite;
>-- 
>1.7.9.5
>
>
>From ded4c8d802fd29a27971f9a74a49c5419ea5ee3a Mon Sep 17 00:00:00 2001
>From: =?UTF-8?q?G=C3=BCnther=20Deschner?= <gd@samba.org>
>Date: Thu, 29 Nov 2012 22:47:40 +0100
>Subject: [PATCH 08/28] s4-rpc_server: support AES decryption in
> netr_ServerPasswordSet2 server.
>MIME-Version: 1.0
>Content-Type: text/plain; charset=UTF-8
>Content-Transfer-Encoding: 8bit
>
>Guenther
>
>Signed-off-by: GÃ¼nther Deschner <gd@samba.org>
>Reviewed-by: Stefan Metzmacher <metze@samba.org>
>(cherry picked from commit 01e69703fb8c58ab1940bb560e34f6c3f10e0ae9)
>---
> source4/rpc_server/netlogon/dcerpc_netlogon.c |    7 ++++++-
> 1 file changed, 6 insertions(+), 1 deletion(-)
>
>diff --git a/source4/rpc_server/netlogon/dcerpc_netlogon.c b/source4/rpc_server/netlogon/dcerpc_netlogon.c
>index 309601e..ef4351b 100644
>--- a/source4/rpc_server/netlogon/dcerpc_netlogon.c
>+++ b/source4/rpc_server/netlogon/dcerpc_netlogon.c
>@@ -487,7 +487,12 @@ static NTSTATUS dcesrv_netr_ServerPasswordSet2(struct dcesrv_call_state *dce_cal
> 
> 	memcpy(password_buf.data, r->in.new_password->data, 512);
> 	SIVAL(password_buf.data, 512, r->in.new_password->length);
>-	netlogon_creds_arcfour_crypt(creds, password_buf.data, 516);
>+
>+	if (creds->negotiate_flags & NETLOGON_NEG_SUPPORTS_AES) {
>+		netlogon_creds_aes_decrypt(creds, password_buf.data, 516);
>+	} else {
>+		netlogon_creds_arcfour_crypt(creds, password_buf.data, 516);
>+	}
> 
> 	if (!extract_pw_from_buffer(mem_ctx, password_buf.data, &new_password)) {
> 		DEBUG(3,("samr: failed to decode password buffer\n"));
>-- 
>1.7.9.5
>
>
>From 2eff79f8b90426372e20fec483cc95256a34afee Mon Sep 17 00:00:00 2001
>From: =?UTF-8?q?G=C3=BCnther=20Deschner?= <gd@samba.org>
>Date: Sat, 1 Dec 2012 00:59:44 +0100
>Subject: [PATCH 09/28] s3-rpc_client: use netlogon_creds_aes_encrypt in
> interactive netlogon samlogon.
>MIME-Version: 1.0
>Content-Type: text/plain; charset=UTF-8
>Content-Transfer-Encoding: 8bit
>
>Guenther
>
>Signed-off-by: GÃ¼nther Deschner <gd@samba.org>
>Reviewed-by: Stefan Metzmacher <metze@samba.org>
>(cherry picked from commit c6f4745c5670e8da77078e19f2d6a3a485e7adc6)
>---
> source3/rpc_client/cli_netlogon.c |    5 ++++-
> 1 file changed, 4 insertions(+), 1 deletion(-)
>
>diff --git a/source3/rpc_client/cli_netlogon.c b/source3/rpc_client/cli_netlogon.c
>index 463741a..a0a9457 100644
>--- a/source3/rpc_client/cli_netlogon.c
>+++ b/source3/rpc_client/cli_netlogon.c
>@@ -207,7 +207,10 @@ NTSTATUS rpccli_netlogon_sam_logon(struct rpc_pipe_client *cli,
> 
> 		nt_lm_owf_gen(password, ntpassword.hash, lmpassword.hash);
> 
>-		if (cli->dc->negotiate_flags & NETLOGON_NEG_ARCFOUR) {
>+		if (cli->dc->negotiate_flags & NETLOGON_NEG_SUPPORTS_AES) {
>+			netlogon_creds_aes_encrypt(cli->dc, lmpassword.hash, 16);
>+			netlogon_creds_aes_encrypt(cli->dc, ntpassword.hash, 16);
>+		} else if (cli->dc->negotiate_flags & NETLOGON_NEG_ARCFOUR) {
> 			netlogon_creds_arcfour_crypt(cli->dc, lmpassword.hash, 16);
> 			netlogon_creds_arcfour_crypt(cli->dc, ntpassword.hash, 16);
> 		} else {
>-- 
>1.7.9.5
>
>
>From bf73d1244c793a83a9ccf0d864f27fb8531606d2 Mon Sep 17 00:00:00 2001
>From: =?UTF-8?q?G=C3=BCnther=20Deschner?= <gd@samba.org>
>Date: Tue, 4 Dec 2012 23:11:10 +0100
>Subject: [PATCH 10/28] s4-torture: remove trailing whitespace in smbtorture
> remote_pac test.
>MIME-Version: 1.0
>Content-Type: text/plain; charset=UTF-8
>Content-Transfer-Encoding: 8bit
>
>Guenther
>
>Signed-off-by: GÃ¼nther Deschner <gd@samba.org>
>Reviewed-by: Stefan Metzmacher <metze@samba.org>
>(cherry picked from commit 7ea9da0c9f0a0a8de416534d6cb1b0248d13f6cf)
>---
> source4/torture/rpc/remote_pac.c |   82 +++++++++++++++++++-------------------
> 1 file changed, 41 insertions(+), 41 deletions(-)
>
>diff --git a/source4/torture/rpc/remote_pac.c b/source4/torture/rpc/remote_pac.c
>index 3e25a46..3f7afc3 100644
>--- a/source4/torture/rpc/remote_pac.c
>+++ b/source4/torture/rpc/remote_pac.c
>@@ -1,20 +1,20 @@
>-/* 
>+/*
>    Unix SMB/CIFS implementation.
> 
>    test suite for netlogon PAC operations
> 
>    Copyright (C) Andrew Bartlett <abartlet@samba.org> 2012
>-   
>+
>    This program is free software; you can redistribute it and/or modify
>    it under the terms of the GNU General Public License as published by
>    the Free Software Foundation; either version 3 of the License, or
>    (at your option) any later version.
>-   
>+
>    This program is distributed in the hope that it will be useful,
>    but WITHOUT ANY WARRANTY; without even the implied warranty of
>    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
>    GNU General Public License for more details.
>-   
>+
>    You should have received a copy of the GNU General Public License
>    along with this program.  If not, see <http://www.gnu.org/licenses/>.
> */
>@@ -67,7 +67,7 @@ static NTSTATUS test_generate_session_info_pac(struct auth4_context *auth_ctx,
> 	tmp_ctx = talloc_named(mem_ctx, 0, "gensec_gssapi_session_info context");
> 	NT_STATUS_HAVE_NO_MEMORY(tmp_ctx);
> 
>-	auth_ctx->private_data = pac_data = talloc_zero(auth_ctx, struct pac_data); 
>+	auth_ctx->private_data = pac_data = talloc_zero(auth_ctx, struct pac_data);
> 
> 	pac_data->pac_srv_sig = talloc(tmp_ctx, struct PAC_SIGNATURE_DATA);
> 	if (!pac_data->pac_srv_sig) {
>@@ -117,7 +117,7 @@ static NTSTATUS test_generate_session_info_pac(struct auth4_context *auth_ctx,
> 
> /* Also happens to be a really good one-step verfication of our Kerberos stack */
> 
>-static bool test_PACVerify(struct torture_context *tctx, 
>+static bool test_PACVerify(struct torture_context *tctx,
> 			   struct dcerpc_pipe *p,
> 			   struct cli_credentials *credentials,
> 			   enum netr_SchannelType secure_channel_type,
>@@ -134,14 +134,14 @@ static bool test_PACVerify(struct torture_context *tctx,
> 
> 	struct netr_GenericInfo generic;
> 	struct netr_Authenticator auth, auth2;
>-	
>+
> 	struct netlogon_creds_CredentialState *creds;
> 	struct gensec_security *gensec_client_context;
> 	struct gensec_security *gensec_server_context;
> 
> 	DATA_BLOB client_to_server, server_to_client, pac_wrapped, payload;
> 	struct PAC_Validate pac_wrapped_struct;
>-	
>+
> 	enum ndr_err_code ndr_err;
> 
> 	struct auth4_context *auth_context;
>@@ -152,7 +152,7 @@ static bool test_PACVerify(struct torture_context *tctx,
> 	TALLOC_CTX *tmp_ctx = talloc_new(tctx);
> 	torture_assert(tctx, tmp_ctx != NULL, "talloc_new() failed");
> 
>-	if (!test_SetupCredentials2(p, tctx, NETLOGON_NEG_AUTH2_ADS_FLAGS, 
>+	if (!test_SetupCredentials2(p, tctx, NETLOGON_NEG_AUTH2_ADS_FLAGS,
> 				    credentials, secure_channel_type,
> 				    &creds)) {
> 		return false;
>@@ -187,7 +187,7 @@ static bool test_PACVerify(struct torture_context *tctx,
> 	torture_assert_ntstatus_ok(tctx, status, "gensec_start_mech_by_sasl_name (server) failed");
> 
> 	server_to_client = data_blob(NULL, 0);
>-	
>+
> 	do {
> 		/* Do a client-server update dance */
> 		status = gensec_update(gensec_client_context, tmp_ctx, tctx->ev, server_to_client, &client_to_server);
>@@ -220,20 +220,20 @@ static bool test_PACVerify(struct torture_context *tctx,
> 	pac_wrapped_struct.SignatureType = pac_data->pac_kdc_sig->type;
> 	pac_wrapped_struct.SignatureLength = pac_data->pac_kdc_sig->signature.length;
> 	pac_wrapped_struct.ChecksumAndSignature = payload
>-		= data_blob_talloc(tmp_ctx, NULL, 
>+		= data_blob_talloc(tmp_ctx, NULL,
> 				   pac_wrapped_struct.ChecksumLength
> 				   + pac_wrapped_struct.SignatureLength);
>-	memcpy(&payload.data[0], 
>+	memcpy(&payload.data[0],
> 	       pac_data->pac_srv_sig->signature.data,
> 	       pac_wrapped_struct.ChecksumLength);
>-	memcpy(&payload.data[pac_wrapped_struct.ChecksumLength], 
>+	memcpy(&payload.data[pac_wrapped_struct.ChecksumLength],
> 	       pac_data->pac_kdc_sig->signature.data,
> 	       pac_wrapped_struct.SignatureLength);
> 
> 	ndr_err = ndr_push_struct_blob(&pac_wrapped, tmp_ctx, &pac_wrapped_struct,
> 				       (ndr_push_flags_fn_t)ndr_push_PAC_Validate);
> 	torture_assert(tctx, NDR_ERR_CODE_IS_SUCCESS(ndr_err), "ndr_push_struct_blob of PACValidate structure failed");
>-		
>+
> 	torture_assert(tctx, (creds->negotiate_flags & NETLOGON_NEG_ARCFOUR), "not willing to even try a PACValidate without RC4 encryption");
> 	netlogon_creds_arcfour_crypt(creds, pac_wrapped.data, pac_wrapped.length);
> 
>@@ -270,7 +270,7 @@ static bool test_PACVerify(struct torture_context *tctx,
> 		"LogonSamLogon failed");
> 
> 	torture_assert_ntstatus_ok(tctx, r.out.result, "LogonSamLogon failed");
>-	
>+
> 	/* This will break the signature nicely (even in the crypto wrapping), check we get a logon failure */
> 	generic.data[generic.length-1]++;
> 
>@@ -290,8 +290,8 @@ static bool test_PACVerify(struct torture_context *tctx,
> 		"LogonSamLogon failed");
> 
> 	torture_assert_ntstatus_equal(tctx, r.out.result, NT_STATUS_LOGON_FAILURE, "LogonSamLogon failed");
>-	
>-	torture_assert(tctx, netlogon_creds_client_check(creds, &r.out.return_authenticator->cred), 
>+
>+	torture_assert(tctx, netlogon_creds_client_check(creds, &r.out.return_authenticator->cred),
> 		       "Credential chaining failed");
> 
> 	/* This will break the parsing nicely (even in the crypto wrapping), check we get INVALID_PARAMETER */
>@@ -313,36 +313,36 @@ static bool test_PACVerify(struct torture_context *tctx,
> 		"LogonSamLogon failed");
> 
> 	torture_assert_ntstatus_equal(tctx, r.out.result, NT_STATUS_INVALID_PARAMETER, "LogonSamLogon failed");
>-	
>-	torture_assert(tctx, netlogon_creds_client_check(creds, 
>-							 &r.out.return_authenticator->cred), 
>+
>+	torture_assert(tctx, netlogon_creds_client_check(creds,
>+							 &r.out.return_authenticator->cred),
> 		       "Credential chaining failed");
> 
> 	pac_wrapped_struct.ChecksumLength = pac_data->pac_srv_sig->signature.length;
> 	pac_wrapped_struct.SignatureType = pac_data->pac_kdc_sig->type;
>-	
>+
> 	/* Break the SignatureType */
> 	pac_wrapped_struct.SignatureType++;
> 
> 	pac_wrapped_struct.SignatureLength = pac_data->pac_kdc_sig->signature.length;
> 	pac_wrapped_struct.ChecksumAndSignature = payload
>-		= data_blob_talloc(tmp_ctx, NULL, 
>+		= data_blob_talloc(tmp_ctx, NULL,
> 				   pac_wrapped_struct.ChecksumLength
> 				   + pac_wrapped_struct.SignatureLength);
>-	memcpy(&payload.data[0], 
>+	memcpy(&payload.data[0],
> 	       pac_data->pac_srv_sig->signature.data,
> 	       pac_wrapped_struct.ChecksumLength);
>-	memcpy(&payload.data[pac_wrapped_struct.ChecksumLength], 
>+	memcpy(&payload.data[pac_wrapped_struct.ChecksumLength],
> 	       pac_data->pac_kdc_sig->signature.data,
> 	       pac_wrapped_struct.SignatureLength);
>-	
>+
> 	ndr_err = ndr_push_struct_blob(&pac_wrapped, tmp_ctx, &pac_wrapped_struct,
> 				       (ndr_push_flags_fn_t)ndr_push_PAC_Validate);
> 	torture_assert(tctx, NDR_ERR_CODE_IS_SUCCESS(ndr_err), "ndr_push_struct_blob of PACValidate structure failed");
>-	
>+
> 	torture_assert(tctx, (creds->negotiate_flags & NETLOGON_NEG_ARCFOUR), "not willing to even try a PACValidate without RC4 encryption");
> 	netlogon_creds_arcfour_crypt(creds, pac_wrapped.data, pac_wrapped.length);
>-	
>+
> 	generic.length = pac_wrapped.length;
> 	generic.data = pac_wrapped.data;
> 
>@@ -357,13 +357,13 @@ static bool test_PACVerify(struct torture_context *tctx,
> 	r.in.server_name = talloc_asprintf(tctx, "\\\\%s", dcerpc_server_name(p));
> 	r.in.computer_name = cli_credentials_get_workstation(credentials);
> 	r.in.validation_level = NetlogonValidationGenericInfo2;
>-	
>+
> 	torture_assert_ntstatus_ok(tctx, dcerpc_netr_LogonSamLogon_r(b, tctx, &r),
> 		"LogonSamLogon failed");
>-	
>+
> 	torture_assert_ntstatus_equal(tctx, r.out.result, NT_STATUS_LOGON_FAILURE, "LogonSamLogon failed");
>-	
>-	torture_assert(tctx, netlogon_creds_client_check(creds, &r.out.return_authenticator->cred), 
>+
>+	torture_assert(tctx, netlogon_creds_client_check(creds, &r.out.return_authenticator->cred),
> 		       "Credential chaining failed");
> 
> 	pac_wrapped_struct.ChecksumLength = pac_data->pac_srv_sig->signature.length;
>@@ -371,26 +371,26 @@ static bool test_PACVerify(struct torture_context *tctx,
> 	pac_wrapped_struct.SignatureLength = pac_data->pac_kdc_sig->signature.length;
> 
> 	pac_wrapped_struct.ChecksumAndSignature = payload
>-		= data_blob_talloc(tmp_ctx, NULL, 
>+		= data_blob_talloc(tmp_ctx, NULL,
> 				   pac_wrapped_struct.ChecksumLength
> 				   + pac_wrapped_struct.SignatureLength);
>-	memcpy(&payload.data[0], 
>+	memcpy(&payload.data[0],
> 	       pac_data->pac_srv_sig->signature.data,
> 	       pac_wrapped_struct.ChecksumLength);
>-	memcpy(&payload.data[pac_wrapped_struct.ChecksumLength], 
>+	memcpy(&payload.data[pac_wrapped_struct.ChecksumLength],
> 	       pac_data->pac_kdc_sig->signature.data,
> 	       pac_wrapped_struct.SignatureLength);
>-	
>+
> 	/* Break the signature length */
> 	pac_wrapped_struct.SignatureLength++;
> 
> 	ndr_err = ndr_push_struct_blob(&pac_wrapped, tmp_ctx, &pac_wrapped_struct,
> 				       (ndr_push_flags_fn_t)ndr_push_PAC_Validate);
> 	torture_assert(tctx, NDR_ERR_CODE_IS_SUCCESS(ndr_err), "ndr_push_struct_blob of PACValidate structure failed");
>-	
>+
> 	torture_assert(tctx, (creds->negotiate_flags & NETLOGON_NEG_ARCFOUR), "not willing to even try a PACValidate without RC4 encryption");
> 	netlogon_creds_arcfour_crypt(creds, pac_wrapped.data, pac_wrapped.length);
>-	
>+
> 	generic.length = pac_wrapped.length;
> 	generic.data = pac_wrapped.data;
> 
>@@ -405,13 +405,13 @@ static bool test_PACVerify(struct torture_context *tctx,
> 	r.in.server_name = talloc_asprintf(tctx, "\\\\%s", dcerpc_server_name(p));
> 	r.in.computer_name = cli_credentials_get_workstation(credentials);
> 	r.in.validation_level = NetlogonValidationGenericInfo2;
>-	
>+
> 	torture_assert_ntstatus_ok(tctx, dcerpc_netr_LogonSamLogon_r(b, tctx, &r),
> 		"LogonSamLogon failed");
>-	
>+
> 	torture_assert_ntstatus_equal(tctx, r.out.result, NT_STATUS_INVALID_PARAMETER, "LogonSamLogon failed");
>-	
>-	torture_assert(tctx, netlogon_creds_client_check(creds, &r.out.return_authenticator->cred), 
>+
>+	torture_assert(tctx, netlogon_creds_client_check(creds, &r.out.return_authenticator->cred),
> 		       "Credential chaining failed");
> 
> 	return true;
>-- 
>1.7.9.5
>
>
>From b61d676003413bbc2209739d458e57046ab805a9 Mon Sep 17 00:00:00 2001
>From: =?UTF-8?q?G=C3=BCnther=20Deschner?= <gd@samba.org>
>Date: Wed, 5 Dec 2012 16:11:19 +0100
>Subject: [PATCH 11/28] s4-torture: use names for r.in.logon_level of netlogon
> samlogon requests.
>MIME-Version: 1.0
>Content-Type: text/plain; charset=UTF-8
>Content-Transfer-Encoding: 8bit
>
>Guenther
>
>Signed-off-by: GÃ¼nther Deschner <gd@samba.org>
>Reviewed-by: Stefan Metzmacher <metze@samba.org>
>(cherry picked from commit 3dffd29904b3de145941a7420d56b30611f9616f)
>---
> source4/torture/rpc/netlogon.c   |    4 ++--
> source4/torture/rpc/remote_pac.c |    2 +-
> source4/torture/rpc/samba3rpc.c  |    4 ++--
> source4/torture/rpc/samlogon.c   |    4 ++--
> source4/torture/rpc/samsync.c    |    2 +-
> source4/torture/rpc/schannel.c   |    4 ++--
> 6 files changed, 10 insertions(+), 10 deletions(-)
>
>diff --git a/source4/torture/rpc/netlogon.c b/source4/torture/rpc/netlogon.c
>index 2f7e913..e7cece3 100644
>--- a/source4/torture/rpc/netlogon.c
>+++ b/source4/torture/rpc/netlogon.c
>@@ -835,7 +835,7 @@ static bool test_netlogon_ops_args(struct dcerpc_pipe *p, struct torture_context
> 	r.in.computer_name = cli_credentials_get_workstation(credentials);
> 	r.in.credential = &auth;
> 	r.in.return_authenticator = &auth2;
>-	r.in.logon_level = 2;
>+	r.in.logon_level = NetlogonNetworkInformation;
> 	r.in.logon = &logon;
> 	r.out.validation = &validation;
> 	r.out.authoritative = &authoritative;
>@@ -941,7 +941,7 @@ static bool test_netlogon_ops_args(struct dcerpc_pipe *p, struct torture_context
> 					 "LogonSamLogon invalid  *r.out.authoritative");
> 	}
> 
>-	r.in.logon_level = 2;
>+	r.in.logon_level = NetlogonNetworkInformation;
> 	r.in.credential = &auth;
> 
> 	for (i=2;i<=3;i++) {
>diff --git a/source4/torture/rpc/remote_pac.c b/source4/torture/rpc/remote_pac.c
>index 3f7afc3..6b0c044 100644
>--- a/source4/torture/rpc/remote_pac.c
>+++ b/source4/torture/rpc/remote_pac.c
>@@ -663,7 +663,7 @@ static bool test_S2U4Self(struct torture_context *tctx,
> 	r.in.computer_name = cli_credentials_get_workstation(credentials);
> 	r.in.credential = &auth;
> 	r.in.return_authenticator = &auth2;
>-	r.in.logon_level = 2;
>+	r.in.logon_level = NetlogonNetworkInformation;
> 	r.in.logon = &logon;
> 	r.out.validation = &validation;
> 	r.out.authoritative = &authoritative;
>diff --git a/source4/torture/rpc/samba3rpc.c b/source4/torture/rpc/samba3rpc.c
>index f7968b1..d8d90ce 100644
>--- a/source4/torture/rpc/samba3rpc.c
>+++ b/source4/torture/rpc/samba3rpc.c
>@@ -1163,7 +1163,7 @@ static bool schan(struct torture_context *tctx,
> 			cli_credentials_get_workstation(wks_creds);
> 		r.in.credential = &netr_auth;
> 		r.in.return_authenticator = &netr_auth2;
>-		r.in.logon_level = 2;
>+		r.in.logon_level = NetlogonNetworkInformation;
> 		r.in.validation_level = i;
> 		r.in.logon = &logon;
> 		r.out.validation = &validation;
>@@ -1203,7 +1203,7 @@ static bool schan(struct torture_context *tctx,
> 
> 		logon.password = &pinfo;
> 
>-		r.in.logon_level = 1;
>+		r.in.logon_level = NetlogonInteractiveInformation;
> 		r.in.logon = &logon;
> 		r.out.return_authenticator = &return_authenticator;
> 
>diff --git a/source4/torture/rpc/samlogon.c b/source4/torture/rpc/samlogon.c
>index 640bd6a..8d13a63 100644
>--- a/source4/torture/rpc/samlogon.c
>+++ b/source4/torture/rpc/samlogon.c
>@@ -1344,7 +1344,7 @@ static bool test_SamLogon(struct dcerpc_pipe *p, TALLOC_CTX *mem_ctx,
> 	int i, v, l, f;
> 	bool ret = true;
> 	int validation_levels[] = {2,3,6};
>-	int logon_levels[] = { 2, 6 };
>+	int logon_levels[] = { NetlogonNetworkInformation, NetlogonNetworkTransitiveInformation };
> 	int function_levels[] = {
> 		NDR_NETR_LOGONSAMLOGON,
> 		NDR_NETR_LOGONSAMLOGONEX,
>@@ -1484,7 +1484,7 @@ bool test_InteractiveLogon(struct dcerpc_pipe *p, TALLOC_CTX *mem_ctx,
> 	r.in.computer_name = TEST_MACHINE_NAME;
> 	r.in.credential = &a;
> 	r.in.return_authenticator = &ra;
>-	r.in.logon_level = 5;
>+	r.in.logon_level = NetlogonInteractiveTransitiveInformation;
> 	r.in.logon = &logon;
> 	r.in.validation_level = 6;
> 	r.in.flags = &flags;
>diff --git a/source4/torture/rpc/samsync.c b/source4/torture/rpc/samsync.c
>index b92eb21..7249705 100644
>--- a/source4/torture/rpc/samsync.c
>+++ b/source4/torture/rpc/samsync.c
>@@ -95,7 +95,7 @@ static NTSTATUS test_SamLogon(struct torture_context *tctx,
> 	r.in.computer_name = workstation;
> 	r.in.credential = &auth;
> 	r.in.return_authenticator = &auth2;
>-	r.in.logon_level = 2;
>+	r.in.logon_level = NetlogonNetworkInformation;
> 	r.in.logon = &logon;
> 	r.out.validation = &validation;
> 	r.out.authoritative = &authoritative;
>diff --git a/source4/torture/rpc/schannel.c b/source4/torture/rpc/schannel.c
>index 8a11a20..7e3e6aa 100644
>--- a/source4/torture/rpc/schannel.c
>+++ b/source4/torture/rpc/schannel.c
>@@ -102,7 +102,7 @@ bool test_netlogon_ex_ops(struct dcerpc_pipe *p, struct torture_context *tctx,
> 
> 	r.in.server_name = talloc_asprintf(tctx, "\\\\%s", dcerpc_server_name(p));
> 	r.in.computer_name = cli_credentials_get_workstation(credentials);
>-	r.in.logon_level = 2;
>+	r.in.logon_level = NetlogonNetworkInformation;
> 	r.in.logon= &logon;
> 	r.in.flags = &_flags;
> 	r.out.validation = &validation;
>@@ -656,7 +656,7 @@ static bool torture_schannel_bench_start(struct torture_schannel_bench_conn *con
> 
> 	conn->r.in.server_name = talloc_asprintf(conn->tmp, "\\\\%s", dcerpc_server_name(conn->pipe));
> 	conn->r.in.computer_name = cli_credentials_get_workstation(conn->wks_creds);
>-	conn->r.in.logon_level = 2;
>+	conn->r.in.logon_level = NetlogonNetworkInformation;
> 	conn->r.in.logon = talloc(conn->tmp, union netr_LogonLevel);
> 	conn->r.in.logon->network = &conn->ninfo;
> 	conn->r.in.flags = talloc(conn->tmp, uint32_t);
>-- 
>1.7.9.5
>
>
>From 4e06e21b17f05251e9a00581edd2c9d4360c4136 Mon Sep 17 00:00:00 2001
>From: =?UTF-8?q?G=C3=BCnther=20Deschner?= <gd@samba.org>
>Date: Wed, 5 Dec 2012 16:23:34 +0100
>Subject: [PATCH 12/28] s4-torture: support AES encryption in
> pac_verify/generic samlogon netlogon tests.
>MIME-Version: 1.0
>Content-Type: text/plain; charset=UTF-8
>Content-Transfer-Encoding: 8bit
>
>Guenther
>
>Signed-off-by: GÃ¼nther Deschner <gd@samba.org>
>Reviewed-by: Stefan Metzmacher <metze@samba.org>
>(cherry picked from commit d94f012f3fb428027709a9c8becf8edb85072463)
>---
> source4/torture/rpc/remote_pac.c |   87 +++++++++++++++++++++++++++++---------
> 1 file changed, 68 insertions(+), 19 deletions(-)
>
>diff --git a/source4/torture/rpc/remote_pac.c b/source4/torture/rpc/remote_pac.c
>index 6b0c044..ccecc06 100644
>--- a/source4/torture/rpc/remote_pac.c
>+++ b/source4/torture/rpc/remote_pac.c
>@@ -121,7 +121,8 @@ static bool test_PACVerify(struct torture_context *tctx,
> 			   struct dcerpc_pipe *p,
> 			   struct cli_credentials *credentials,
> 			   enum netr_SchannelType secure_channel_type,
>-			   const char *test_machine_name)
>+			   const char *test_machine_name,
>+			   uint32_t negotiate_flags)
> {
> 	NTSTATUS status;
> 
>@@ -152,7 +153,11 @@ static bool test_PACVerify(struct torture_context *tctx,
> 	TALLOC_CTX *tmp_ctx = talloc_new(tctx);
> 	torture_assert(tctx, tmp_ctx != NULL, "talloc_new() failed");
> 
>-	if (!test_SetupCredentials2(p, tctx, NETLOGON_NEG_AUTH2_ADS_FLAGS,
>+	torture_comment(tctx,
>+		"Testing PAC Verify (secure_channel_type: %d, machine: %s, negotiate_flags: 0x%08x\n",
>+		secure_channel_type, test_machine_name, negotiate_flags);
>+
>+	if (!test_SetupCredentials2(p, tctx, negotiate_flags,
> 				    credentials, secure_channel_type,
> 				    &creds)) {
> 		return false;
>@@ -235,7 +240,11 @@ static bool test_PACVerify(struct torture_context *tctx,
> 	torture_assert(tctx, NDR_ERR_CODE_IS_SUCCESS(ndr_err), "ndr_push_struct_blob of PACValidate structure failed");
> 
> 	torture_assert(tctx, (creds->negotiate_flags & NETLOGON_NEG_ARCFOUR), "not willing to even try a PACValidate without RC4 encryption");
>-	netlogon_creds_arcfour_crypt(creds, pac_wrapped.data, pac_wrapped.length);
>+	if (creds->negotiate_flags & NETLOGON_NEG_SUPPORTS_AES) {
>+		netlogon_creds_aes_encrypt(creds, pac_wrapped.data, pac_wrapped.length);
>+	} else {
>+		netlogon_creds_arcfour_crypt(creds, pac_wrapped.data, pac_wrapped.length);
>+	}
> 
> 	generic.length = pac_wrapped.length;
> 	generic.data = pac_wrapped.data;
>@@ -341,7 +350,11 @@ static bool test_PACVerify(struct torture_context *tctx,
> 	torture_assert(tctx, NDR_ERR_CODE_IS_SUCCESS(ndr_err), "ndr_push_struct_blob of PACValidate structure failed");
> 
> 	torture_assert(tctx, (creds->negotiate_flags & NETLOGON_NEG_ARCFOUR), "not willing to even try a PACValidate without RC4 encryption");
>-	netlogon_creds_arcfour_crypt(creds, pac_wrapped.data, pac_wrapped.length);
>+	if (creds->negotiate_flags & NETLOGON_NEG_SUPPORTS_AES) {
>+		netlogon_creds_aes_encrypt(creds, pac_wrapped.data, pac_wrapped.length);
>+	} else {
>+		netlogon_creds_arcfour_crypt(creds, pac_wrapped.data, pac_wrapped.length);
>+	}
> 
> 	generic.length = pac_wrapped.length;
> 	generic.data = pac_wrapped.data;
>@@ -389,7 +402,11 @@ static bool test_PACVerify(struct torture_context *tctx,
> 	torture_assert(tctx, NDR_ERR_CODE_IS_SUCCESS(ndr_err), "ndr_push_struct_blob of PACValidate structure failed");
> 
> 	torture_assert(tctx, (creds->negotiate_flags & NETLOGON_NEG_ARCFOUR), "not willing to even try a PACValidate without RC4 encryption");
>-	netlogon_creds_arcfour_crypt(creds, pac_wrapped.data, pac_wrapped.length);
>+	if (creds->negotiate_flags & NETLOGON_NEG_SUPPORTS_AES) {
>+		netlogon_creds_aes_encrypt(creds, pac_wrapped.data, pac_wrapped.length);
>+	} else {
>+		netlogon_creds_arcfour_crypt(creds, pac_wrapped.data, pac_wrapped.length);
>+	}
> 
> 	generic.length = pac_wrapped.length;
> 	generic.data = pac_wrapped.data;
>@@ -417,18 +434,40 @@ static bool test_PACVerify(struct torture_context *tctx,
> 	return true;
> }
> 
>-static bool test_PACVerify_bdc(struct torture_context *tctx,
>-			       struct dcerpc_pipe *p,
>-			       struct cli_credentials *credentials)
>+static bool test_PACVerify_bdc_arcfour(struct torture_context *tctx,
>+				       struct dcerpc_pipe *p,
>+				       struct cli_credentials *credentials)
> {
>-	return test_PACVerify(tctx, p, credentials, SEC_CHAN_BDC, TEST_MACHINE_NAME_BDC);
>+	return test_PACVerify(tctx, p, credentials, SEC_CHAN_BDC,
>+			      TEST_MACHINE_NAME_BDC,
>+			      NETLOGON_NEG_AUTH2_ADS_FLAGS);
> }
> 
>-static bool test_PACVerify_workstation(struct torture_context *tctx,
>-				  struct dcerpc_pipe *p,
>-				  struct cli_credentials *credentials)
>+static bool test_PACVerify_bdc_aes(struct torture_context *tctx,
>+				   struct dcerpc_pipe *p,
>+				   struct cli_credentials *credentials)
>+{
>+	return test_PACVerify(tctx, p, credentials, SEC_CHAN_BDC,
>+			      TEST_MACHINE_NAME_BDC,
>+			      NETLOGON_NEG_AUTH2_ADS_FLAGS | NETLOGON_NEG_SUPPORTS_AES);
>+}
>+
>+static bool test_PACVerify_workstation_arcfour(struct torture_context *tctx,
>+					       struct dcerpc_pipe *p,
>+					       struct cli_credentials *credentials)
> {
>-	return test_PACVerify(tctx, p, credentials, SEC_CHAN_WKSTA, TEST_MACHINE_NAME_WKSTA);
>+	return test_PACVerify(tctx, p, credentials, SEC_CHAN_WKSTA,
>+			      TEST_MACHINE_NAME_WKSTA,
>+			      NETLOGON_NEG_AUTH2_ADS_FLAGS);
>+}
>+
>+static bool test_PACVerify_workstation_aes(struct torture_context *tctx,
>+					   struct dcerpc_pipe *p,
>+					   struct cli_credentials *credentials)
>+{
>+	return test_PACVerify(tctx, p, credentials, SEC_CHAN_WKSTA,
>+			      TEST_MACHINE_NAME_WKSTA,
>+			      NETLOGON_NEG_AUTH2_ADS_FLAGS | NETLOGON_NEG_SUPPORTS_AES);
> }
> 
> static bool test_PACVerify_workstation_des(struct torture_context *tctx,
>@@ -465,7 +504,9 @@ static bool test_PACVerify_workstation_des(struct torture_context *tctx,
> 	torture_assert_ntstatus_ok(tctx, r.out.result,
> 		"failed to set DES into account flags");
> 
>-	return test_PACVerify(tctx, p, credentials, SEC_CHAN_WKSTA, TEST_MACHINE_NAME_WKSTA_DES);
>+	return test_PACVerify(tctx, p, credentials, SEC_CHAN_WKSTA,
>+			      TEST_MACHINE_NAME_WKSTA_DES,
>+			      NETLOGON_NEG_AUTH2_ADS_FLAGS);
> }
> 
> 
>@@ -668,7 +709,7 @@ static bool test_S2U4Self(struct torture_context *tctx,
> 	r.out.validation = &validation;
> 	r.out.authoritative = &authoritative;
> 
>-	if (!test_SetupCredentials2(p, tctx, NETLOGON_NEG_AUTH2_ADS_FLAGS,
>+	if (!test_SetupCredentials2(p, tctx, NETLOGON_NEG_AUTH2_ADS_FLAGS | NETLOGON_NEG_SUPPORTS_AES,
> 				    credentials, secure_channel_type,
> 				    &creds)) {
> 		return false;
>@@ -737,13 +778,21 @@ struct torture_suite *torture_rpc_remote_pac(TALLOC_CTX *mem_ctx)
> 	struct torture_rpc_tcase *tcase;
> 
> 	/* It is important to use different names, so that old entries in our credential cache are not used */
>-	tcase = torture_suite_add_machine_bdc_rpc_iface_tcase(suite, "netlogon-bdc",
>+	tcase = torture_suite_add_machine_bdc_rpc_iface_tcase(suite, "netr-bdc-arcfour",
> 							      &ndr_table_netlogon, TEST_MACHINE_NAME_BDC);
>-	torture_rpc_tcase_add_test_creds(tcase, "verify-sig", test_PACVerify_bdc);
>+	torture_rpc_tcase_add_test_creds(tcase, "verify-sig-arcfour", test_PACVerify_bdc_arcfour);
> 
>-	tcase = torture_suite_add_machine_workstation_rpc_iface_tcase(suite, "netlogon-member",
>+	tcase = torture_suite_add_machine_bdc_rpc_iface_tcase(suite, "netr-bdc-aes",
>+							      &ndr_table_netlogon, TEST_MACHINE_NAME_BDC);
>+	torture_rpc_tcase_add_test_creds(tcase, "verify-sig-aes", test_PACVerify_bdc_aes);
>+
>+	tcase = torture_suite_add_machine_workstation_rpc_iface_tcase(suite, "netr-mem-arcfour",
>+								      &ndr_table_netlogon, TEST_MACHINE_NAME_WKSTA);
>+	torture_rpc_tcase_add_test_creds(tcase, "verify-sig-arcfour", test_PACVerify_workstation_arcfour);
>+
>+	tcase = torture_suite_add_machine_workstation_rpc_iface_tcase(suite, "netr-mem-aes",
> 								      &ndr_table_netlogon, TEST_MACHINE_NAME_WKSTA);
>-	torture_rpc_tcase_add_test_creds(tcase, "verify-sig", test_PACVerify_workstation);
>+	torture_rpc_tcase_add_test_creds(tcase, "verify-sig-aes", test_PACVerify_workstation_aes);
> 
> 	tcase = torture_suite_add_machine_workstation_rpc_iface_tcase(suite, "netlogon-member-des",
> 								      &ndr_table_netlogon, TEST_MACHINE_NAME_WKSTA_DES);
>-- 
>1.7.9.5
>
>
>From ebb54e1300de87d76b9cbed324a88a9ec6231474 Mon Sep 17 00:00:00 2001
>From: =?UTF-8?q?G=C3=BCnther=20Deschner?= <gd@samba.org>
>Date: Wed, 5 Dec 2012 16:20:14 +0100
>Subject: [PATCH 13/28] s4-torture: support AES encryption in interactive
> samlogon tests in rpc.samr.
>MIME-Version: 1.0
>Content-Type: text/plain; charset=UTF-8
>Content-Transfer-Encoding: 8bit
>
>Guenther
>
>Signed-off-by: GÃ¼nther Deschner <gd@samba.org>
>Reviewed-by: Stefan Metzmacher <metze@samba.org>
>(cherry picked from commit 5089442bfdbeff7314e589387c3702f9c401e12a)
>---
> source4/torture/rpc/samr.c |    7 +++++--
> 1 file changed, 5 insertions(+), 2 deletions(-)
>
>diff --git a/source4/torture/rpc/samr.c b/source4/torture/rpc/samr.c
>index a460211..7f50ce9 100644
>--- a/source4/torture/rpc/samr.c
>+++ b/source4/torture/rpc/samr.c
>@@ -2888,7 +2888,10 @@ static bool test_SamLogon(struct torture_context *tctx,
> 		}
> 		E_md4hash(cli_credentials_get_password(test_credentials), pinfo.ntpassword.hash);
> 
>-		if (creds->negotiate_flags & NETLOGON_NEG_ARCFOUR) {
>+		if (creds->negotiate_flags & NETLOGON_NEG_SUPPORTS_AES) {
>+			netlogon_creds_aes_encrypt(creds, pinfo.lmpassword.hash, 16);
>+			netlogon_creds_aes_encrypt(creds, pinfo.ntpassword.hash, 16);
>+		} else if (creds->negotiate_flags & NETLOGON_NEG_ARCFOUR) {
> 			netlogon_creds_arcfour_crypt(creds, pinfo.lmpassword.hash, 16);
> 			netlogon_creds_arcfour_crypt(creds, pinfo.ntpassword.hash, 16);
> 		} else {
>@@ -3072,7 +3075,7 @@ static bool setup_schannel_netlogon_pipe(struct torture_context *tctx,
> 	 * with INTERNAL_ERROR */
> 
> 	b->flags &= ~DCERPC_AUTH_OPTIONS;
>-	b->flags |= DCERPC_SCHANNEL | DCERPC_SIGN | DCERPC_SCHANNEL_128;
>+	b->flags |= DCERPC_SCHANNEL | DCERPC_SIGN | DCERPC_SCHANNEL_AUTO;
> 
> 	torture_assert_ntstatus_ok(tctx,
> 		dcerpc_pipe_connect_b(tctx, p, b, &ndr_table_netlogon,
>-- 
>1.7.9.5
>
>
>From 3d7ec009cf60857dc2bcf506be1ed16f737b16a6 Mon Sep 17 00:00:00 2001
>From: =?UTF-8?q?G=C3=BCnther=20Deschner?= <gd@samba.org>
>Date: Wed, 5 Dec 2012 16:21:59 +0100
>Subject: [PATCH 14/28] s4-torture: exit early when join fails in samba3rpc
> tests.
>MIME-Version: 1.0
>Content-Type: text/plain; charset=UTF-8
>Content-Transfer-Encoding: 8bit
>
>Guenther
>
>Signed-off-by: GÃ¼nther Deschner <gd@samba.org>
>Reviewed-by: Stefan Metzmacher <metze@samba.org>
>(cherry picked from commit 4afb7dcb43c6903568c0fe2c2c2044706e9bd613)
>---
> source4/torture/rpc/samba3rpc.c |    6 ++++--
> 1 file changed, 4 insertions(+), 2 deletions(-)
>
>diff --git a/source4/torture/rpc/samba3rpc.c b/source4/torture/rpc/samba3rpc.c
>index d8d90ce..0dd9dbd 100644
>--- a/source4/torture/rpc/samba3rpc.c
>+++ b/source4/torture/rpc/samba3rpc.c
>@@ -399,7 +399,9 @@ static bool get_usr_handle(struct torture_context *tctx,
> 
> 	samr_pipe = dcerpc_pipe_init(mem_ctx, tctx->ev);
> 	torture_assert(tctx, samr_pipe, "dcerpc_pipe_init failed");
>-
>+#if 0
>+	samr_pipe->conn->flags |= DCERPC_DEBUG_PRINT_IN | DCERPC_DEBUG_PRINT_OUT;
>+#endif
> 	samr_handle = samr_pipe->binding_handle;
> 
> 	torture_assert_ntstatus_ok(tctx,
>@@ -744,7 +746,7 @@ static bool join3(struct torture_context *tctx,
> 		goto done;
> 	}
> 	samr_handle = samr_pipe->binding_handle;
>-
>+	ret = false;
> 	{
> 		struct samr_QueryUserInfo q;
> 		union samr_UserInfo *info;
>-- 
>1.7.9.5
>
>
>From 054e8f9440b5ed4478f029828d9ea2b93bbc7d83 Mon Sep 17 00:00:00 2001
>From: =?UTF-8?q?G=C3=BCnther=20Deschner?= <gd@samba.org>
>Date: Wed, 5 Dec 2012 18:38:01 +0100
>Subject: [PATCH 15/28] s4-torture: use netlogon_creds_arcfour_crypt() in
> samba3rpc test.
>MIME-Version: 1.0
>Content-Type: text/plain; charset=UTF-8
>Content-Transfer-Encoding: 8bit
>
>Guenther
>
>Signed-off-by: GÃ¼nther Deschner <gd@samba.org>
>Reviewed-by: Stefan Metzmacher <metze@samba.org>
>(cherry picked from commit fd7087020344f7d24737e3be2f3afbd0417b0026)
>---
> source4/torture/rpc/samba3rpc.c |    9 +++------
> 1 file changed, 3 insertions(+), 6 deletions(-)
>
>diff --git a/source4/torture/rpc/samba3rpc.c b/source4/torture/rpc/samba3rpc.c
>index 0dd9dbd..c19476d 100644
>--- a/source4/torture/rpc/samba3rpc.c
>+++ b/source4/torture/rpc/samba3rpc.c
>@@ -1104,7 +1104,7 @@ static bool schan(struct torture_context *tctx,
> 
> 	for (i=2; i<4; i++) {
> 		int flags;
>-		DATA_BLOB chal, nt_resp, lm_resp, names_blob, session_key;
>+		DATA_BLOB chal, nt_resp, lm_resp, names_blob;
> 		struct netlogon_creds_CredentialState *creds_state;
> 		struct netr_Authenticator netr_auth, netr_auth2;
> 		struct netr_NetworkInfo ninfo;
>@@ -1197,11 +1197,8 @@ static bool schan(struct torture_context *tctx,
> 		ZERO_STRUCT(pinfo.lmpassword.hash);
> 		E_md4hash(cli_credentials_get_password(user_creds),
> 			  pinfo.ntpassword.hash);
>-		session_key = data_blob_talloc(mem_ctx,
>-					       creds_state->session_key, 16);
>-		arcfour_crypt_blob(pinfo.ntpassword.hash,
>-				   sizeof(pinfo.ntpassword.hash),
>-				   &session_key);
>+
>+		netlogon_creds_arcfour_crypt(creds_state, pinfo.ntpassword.hash, 16);
> 
> 		logon.password = &pinfo;
> 
>-- 
>1.7.9.5
>
>
>From 4b01a3e5f8ac11de67e9ba1d5de2bd085feb2f41 Mon Sep 17 00:00:00 2001
>From: =?UTF-8?q?G=C3=BCnther=20Deschner?= <gd@samba.org>
>Date: Wed, 5 Dec 2012 16:37:02 +0100
>Subject: [PATCH 16/28] s3-rpc_server: pass down netlogon cred state in
> _netr_ServerGetTrustInfo().
>MIME-Version: 1.0
>Content-Type: text/plain; charset=UTF-8
>Content-Transfer-Encoding: 8bit
>
>Guenther
>
>Signed-off-by: GÃ¼nther Deschner <gd@samba.org>
>Reviewed-by: Stefan Metzmacher <metze@samba.org>
>(cherry picked from commit 306a78d97f2fdfaa81c58bafdebcfab0fb8f1636)
>---
> source3/rpc_server/netlogon/srv_netlog_nt.c |   14 +++++---------
> 1 file changed, 5 insertions(+), 9 deletions(-)
>
>diff --git a/source3/rpc_server/netlogon/srv_netlog_nt.c b/source3/rpc_server/netlogon/srv_netlog_nt.c
>index 5fc2756..aef97e4 100644
>--- a/source3/rpc_server/netlogon/srv_netlog_nt.c
>+++ b/source3/rpc_server/netlogon/srv_netlog_nt.c
>@@ -2398,7 +2398,7 @@ NTSTATUS _netr_GetForestTrustInformation(struct pipes_struct *p,
> 
> static NTSTATUS get_password_from_trustAuth(TALLOC_CTX *mem_ctx,
> 					    const DATA_BLOB *trustAuth_blob,
>-					    const DATA_BLOB *session_key,
>+					    struct netlogon_creds_CredentialState *creds,
> 					    struct samr_Password *current_pw_enc,
> 					    struct samr_Password *previous_pw_enc)
> {
>@@ -2421,8 +2421,7 @@ static NTSTATUS get_password_from_trustAuth(TALLOC_CTX *mem_ctx,
> 		return NT_STATUS_UNSUCCESSFUL;
> 	}
> 
>-	arcfour_crypt_blob(current_pw_enc->hash, sizeof(current_pw_enc->hash),
>-			   session_key);
>+	netlogon_creds_arcfour_crypt(creds, current_pw_enc->hash, sizeof(current_pw_enc->hash));
> 
> 	if (trustAuth.previous.count != 0 &&
> 	    trustAuth.previous.array[0].AuthType == TRUST_AUTH_TYPE_CLEAR) {
>@@ -2432,8 +2431,8 @@ static NTSTATUS get_password_from_trustAuth(TALLOC_CTX *mem_ctx,
> 	} else {
> 		mdfour(previous_pw_enc->hash, NULL, 0);
> 	}
>-	arcfour_crypt_blob(previous_pw_enc->hash, sizeof(previous_pw_enc->hash),
>-			   session_key);
>+
>+	netlogon_creds_arcfour_crypt(creds, previous_pw_enc->hash, sizeof(previous_pw_enc->hash));
> 
> 	return NT_STATUS_OK;
> }
>@@ -2455,7 +2454,6 @@ NTSTATUS _netr_ServerGetTrustInfo(struct pipes_struct *p,
> 	DATA_BLOB trustAuth_blob;
> 	struct samr_Password *new_owf_enc;
> 	struct samr_Password *old_owf_enc;
>-	DATA_BLOB session_key;
> 	struct loadparm_context *lp_ctx;
> 
> 	lp_ctx = loadparm_init_s3(p->mem_ctx, loadparm_s3_helpers());
>@@ -2543,10 +2541,8 @@ NTSTATUS _netr_ServerGetTrustInfo(struct pipes_struct *p,
> 			trustAuth_blob = td->trust_auth_outgoing;
> 		}
> 
>-		session_key.data = creds->session_key;
>-		session_key.length = sizeof(creds->session_key);
> 		status = get_password_from_trustAuth(p->mem_ctx, &trustAuth_blob,
>-						     &session_key,
>+						     creds,
> 						     new_owf_enc, old_owf_enc);
> 
> 		if (!NT_STATUS_IS_OK(status)) {
>-- 
>1.7.9.5
>
>
>From ab5f0b796cd4e95270f25bcdad1f5e4f2ebb435b Mon Sep 17 00:00:00 2001
>From: =?UTF-8?q?G=C3=BCnther=20Deschner?= <gd@samba.org>
>Date: Wed, 5 Dec 2012 17:59:12 +0100
>Subject: [PATCH 17/28] s4-torture: validate owf password hash and negotiate
> AES ServerGetTrustInfo test.
>MIME-Version: 1.0
>Content-Type: text/plain; charset=UTF-8
>Content-Transfer-Encoding: 8bit
>
>Guenther
>
>Signed-off-by: GÃ¼nther Deschner <gd@samba.org>
>Reviewed-by: Stefan Metzmacher <metze@samba.org>
>(cherry picked from commit 83b00afe9f2116ef04378c251070143595450a3e)
>---
> source4/torture/rpc/netlogon.c |   37 +++++++++++++++++++++++++++++++++----
> 1 file changed, 33 insertions(+), 4 deletions(-)
>
>diff --git a/source4/torture/rpc/netlogon.c b/source4/torture/rpc/netlogon.c
>index e7cece3..1f92bc6 100644
>--- a/source4/torture/rpc/netlogon.c
>+++ b/source4/torture/rpc/netlogon.c
>@@ -3155,9 +3155,10 @@ static bool test_netr_DsRAddressToSitenamesExW(struct torture_context *tctx,
> 	return true;
> }
> 
>-static bool test_netr_ServerGetTrustInfo(struct torture_context *tctx,
>-					 struct dcerpc_pipe *p,
>-					 struct cli_credentials *machine_credentials)
>+static bool test_netr_ServerGetTrustInfo_flags(struct torture_context *tctx,
>+					       struct dcerpc_pipe *p,
>+					       struct cli_credentials *machine_credentials,
>+					       uint32_t negotiate_flags)
> {
> 	struct netr_ServerGetTrustInfo r;
> 
>@@ -3170,7 +3171,9 @@ static bool test_netr_ServerGetTrustInfo(struct torture_context *tctx,
> 	struct netlogon_creds_CredentialState *creds;
> 	struct dcerpc_binding_handle *b = p->binding_handle;
> 
>-	if (!test_SetupCredentials3(p, tctx, NETLOGON_NEG_AUTH2_ADS_FLAGS,
>+	struct samr_Password nt_hash;
>+
>+	if (!test_SetupCredentials3(p, tctx, negotiate_flags,
> 				    machine_credentials, &creds)) {
> 		return false;
> 	}
>@@ -3193,9 +3196,34 @@ static bool test_netr_ServerGetTrustInfo(struct torture_context *tctx,
> 	torture_assert_ntstatus_ok(tctx, r.out.result, "ServerGetTrustInfo failed");
> 	torture_assert(tctx, netlogon_creds_client_check(creds, &return_authenticator.cred), "Credential chaining failed");
> 
>+	E_md4hash(cli_credentials_get_password(machine_credentials), nt_hash.hash);
>+
>+	netlogon_creds_des_decrypt(creds, &new_owf_password);
>+
>+	dump_data(1, new_owf_password.hash, 16);
>+	dump_data(1, nt_hash.hash, 16);
>+
>+	torture_assert_mem_equal(tctx, new_owf_password.hash, nt_hash.hash, 16,
>+		"received unexpected owf password\n");
>+
> 	return true;
> }
> 
>+static bool test_netr_ServerGetTrustInfo(struct torture_context *tctx,
>+					 struct dcerpc_pipe *p,
>+					 struct cli_credentials *machine_credentials)
>+{
>+	return test_netr_ServerGetTrustInfo_flags(tctx, p, machine_credentials,
>+						  NETLOGON_NEG_AUTH2_ADS_FLAGS);
>+}
>+
>+static bool test_netr_ServerGetTrustInfo_AES(struct torture_context *tctx,
>+					     struct dcerpc_pipe *p,
>+					     struct cli_credentials *machine_credentials)
>+{
>+	return test_netr_ServerGetTrustInfo_flags(tctx, p, machine_credentials,
>+						  NETLOGON_NEG_AUTH2_ADS_FLAGS | NETLOGON_NEG_SUPPORTS_AES);
>+}
> 
> static bool test_GetDomainInfo(struct torture_context *tctx,
> 			       struct dcerpc_pipe *p,
>@@ -3857,6 +3885,7 @@ struct torture_suite *torture_rpc_netlogon(TALLOC_CTX *mem_ctx)
> 	torture_rpc_tcase_add_test(tcase, "DsRAddressToSitenamesW", test_netr_DsRAddressToSitenamesW);
> 	torture_rpc_tcase_add_test(tcase, "DsRAddressToSitenamesExW", test_netr_DsRAddressToSitenamesExW);
> 	torture_rpc_tcase_add_test_creds(tcase, "ServerGetTrustInfo", test_netr_ServerGetTrustInfo);
>+	torture_rpc_tcase_add_test_creds(tcase, "ServerGetTrustInfo_AES", test_netr_ServerGetTrustInfo_AES);
> 	torture_rpc_tcase_add_test_creds(tcase, "GetForestTrustInformation", test_netr_GetForestTrustInformation);
> 
> 	return suite;
>-- 
>1.7.9.5
>
>
>From 5bd71a6355be4132b9808a49b3bc72a551e98e61 Mon Sep 17 00:00:00 2001
>From: =?UTF-8?q?G=C3=BCnther=20Deschner?= <gd@samba.org>
>Date: Wed, 5 Dec 2012 18:06:54 +0100
>Subject: [PATCH 18/28] s4-torture: validate owf password hash and negotiate
> AES in forest trust test.
>MIME-Version: 1.0
>Content-Type: text/plain; charset=UTF-8
>Content-Transfer-Encoding: 8bit
>
>Guenther
>
>Signed-off-by: GÃ¼nther Deschner <gd@samba.org>
>Reviewed-by: Stefan Metzmacher <metze@samba.org>
>(cherry picked from commit 6aec126566d01dd9ddbbd5488f73b61729094a52)
>---
> source4/torture/rpc/forest_trust.c |   13 ++++++++++++-
> 1 file changed, 12 insertions(+), 1 deletion(-)
>
>diff --git a/source4/torture/rpc/forest_trust.c b/source4/torture/rpc/forest_trust.c
>index f416054..2208280 100644
>--- a/source4/torture/rpc/forest_trust.c
>+++ b/source4/torture/rpc/forest_trust.c
>@@ -597,6 +597,7 @@ static bool test_validate_trust(struct torture_context *tctx,
> 	struct netr_GetForestTrustInformation fr;
> 	struct lsa_ForestTrustInformation *forest_trust_info;
> 	int i;
>+	struct samr_Password nt_hash;
> 
> 	status = dcerpc_parse_binding(tctx, binding, &b);
> 	torture_assert_ntstatus_ok(tctx, status, "Bad binding string");
>@@ -630,7 +631,7 @@ static bool test_validate_trust(struct torture_context *tctx,
> 		return false;
> 	}
> 
>-	if (!test_SetupCredentials3(pipe, tctx, NETLOGON_NEG_AUTH2_ADS_FLAGS,
>+	if (!test_SetupCredentials3(pipe, tctx, NETLOGON_NEG_AUTH2_ADS_FLAGS | NETLOGON_NEG_SUPPORTS_AES,
> 				    credentials, &creds)) {
> 		torture_comment(tctx, "test_SetupCredentials3 failed.\n");
> 		return false;
>@@ -670,6 +671,16 @@ static bool test_validate_trust(struct torture_context *tctx,
> 		return false;
> 	}
> 
>+	E_md4hash(cli_credentials_get_password(credentials), nt_hash.hash);
>+
>+	netlogon_creds_des_decrypt(creds, &new_owf_password);
>+
>+	dump_data(1, new_owf_password.hash, 16);
>+	dump_data(1, nt_hash.hash, 16);
>+
>+	torture_assert_mem_equal(tctx, new_owf_password.hash, nt_hash.hash, 16,
>+		"received unexpected owf password\n");
>+
> 	netlogon_creds_client_authenticator(creds, &a);
> 
> 	fr.in.server_name = talloc_asprintf(tctx, "\\\\%s",
>-- 
>1.7.9.5
>
>
>From 91f680dac21f8c14e3684a71645c647379f58295 Mon Sep 17 00:00:00 2001
>From: =?UTF-8?q?G=C3=BCnther=20Deschner?= <gd@samba.org>
>Date: Wed, 5 Dec 2012 19:52:54 +0100
>Subject: [PATCH 19/28] s3-rpc_server: we need to encrypt OWFs using DES in
> _netr_ServerGetTrustInfo().
>MIME-Version: 1.0
>Content-Type: text/plain; charset=UTF-8
>Content-Transfer-Encoding: 8bit
>
>Sumit, please check.
>
>Guenther
>
>Signed-off-by: GÃ¼nther Deschner <gd@samba.org>
>Reviewed-by: Stefan Metzmacher <metze@samba.org>
>(cherry picked from commit a52115ce67c2e5bd1e478d7601483fd2490aea31)
>---
> source3/rpc_server/netlogon/srv_netlog_nt.c |    4 ++--
> 1 file changed, 2 insertions(+), 2 deletions(-)
>
>diff --git a/source3/rpc_server/netlogon/srv_netlog_nt.c b/source3/rpc_server/netlogon/srv_netlog_nt.c
>index aef97e4..16542f8 100644
>--- a/source3/rpc_server/netlogon/srv_netlog_nt.c
>+++ b/source3/rpc_server/netlogon/srv_netlog_nt.c
>@@ -2421,7 +2421,7 @@ static NTSTATUS get_password_from_trustAuth(TALLOC_CTX *mem_ctx,
> 		return NT_STATUS_UNSUCCESSFUL;
> 	}
> 
>-	netlogon_creds_arcfour_crypt(creds, current_pw_enc->hash, sizeof(current_pw_enc->hash));
>+	netlogon_creds_des_encrypt(creds, current_pw_enc);
> 
> 	if (trustAuth.previous.count != 0 &&
> 	    trustAuth.previous.array[0].AuthType == TRUST_AUTH_TYPE_CLEAR) {
>@@ -2432,7 +2432,7 @@ static NTSTATUS get_password_from_trustAuth(TALLOC_CTX *mem_ctx,
> 		mdfour(previous_pw_enc->hash, NULL, 0);
> 	}
> 
>-	netlogon_creds_arcfour_crypt(creds, previous_pw_enc->hash, sizeof(previous_pw_enc->hash));
>+	netlogon_creds_des_encrypt(creds, previous_pw_enc);
> 
> 	return NT_STATUS_OK;
> }
>-- 
>1.7.9.5
>
>
>From 25863e90961e57099af2520d6fc6346600258ec5 Mon Sep 17 00:00:00 2001
>From: =?UTF-8?q?G=C3=BCnther=20Deschner?= <gd@samba.org>
>Date: Wed, 5 Dec 2012 16:24:24 +0100
>Subject: [PATCH 20/28] s4-rpc_server: support AES encryption in interactive
> and generic samlogon.
>MIME-Version: 1.0
>Content-Type: text/plain; charset=UTF-8
>Content-Transfer-Encoding: 8bit
>
>Guenther
>
>Signed-off-by: GÃ¼nther Deschner <gd@samba.org>
>Reviewed-by: Stefan Metzmacher <metze@samba.org>
>(cherry picked from commit 71572632bd33dcb5c03a701bbb72a707e5642237)
>---
> source4/rpc_server/netlogon/dcerpc_netlogon.c |   28 ++++++++++++++++++++-----
> 1 file changed, 23 insertions(+), 5 deletions(-)
>
>diff --git a/source4/rpc_server/netlogon/dcerpc_netlogon.c b/source4/rpc_server/netlogon/dcerpc_netlogon.c
>index ef4351b..ac69d3d 100644
>--- a/source4/rpc_server/netlogon/dcerpc_netlogon.c
>+++ b/source4/rpc_server/netlogon/dcerpc_netlogon.c
>@@ -635,7 +635,14 @@ static NTSTATUS dcesrv_netr_LogonSamLogon_base(struct dcesrv_call_state *dce_cal
> 	case NetlogonServiceInformation:
> 	case NetlogonInteractiveTransitiveInformation:
> 	case NetlogonServiceTransitiveInformation:
>-		if (creds->negotiate_flags & NETLOGON_NEG_ARCFOUR) {
>+		if (creds->negotiate_flags & NETLOGON_NEG_SUPPORTS_AES) {
>+			netlogon_creds_aes_decrypt(creds,
>+						   r->in.logon->password->lmpassword.hash,
>+						   sizeof(r->in.logon->password->lmpassword.hash));
>+			netlogon_creds_aes_decrypt(creds,
>+						   r->in.logon->password->ntpassword.hash,
>+						   sizeof(r->in.logon->password->ntpassword.hash));
>+		} else if (creds->negotiate_flags & NETLOGON_NEG_ARCFOUR) {
> 			netlogon_creds_arcfour_crypt(creds,
> 					    r->in.logon->password->lmpassword.hash,
> 					    sizeof(r->in.logon->password->lmpassword.hash));
>@@ -698,7 +705,10 @@ static NTSTATUS dcesrv_netr_LogonSamLogon_base(struct dcesrv_call_state *dce_cal
> 
> 	case NetlogonGenericInformation:
> 	{
>-		if (creds->negotiate_flags & NETLOGON_NEG_ARCFOUR) {
>+		if (creds->negotiate_flags & NETLOGON_NEG_SUPPORTS_AES) {
>+			netlogon_creds_aes_decrypt(creds,
>+					    r->in.logon->generic->data, r->in.logon->generic->length);
>+		} else if (creds->negotiate_flags & NETLOGON_NEG_ARCFOUR) {
> 			netlogon_creds_arcfour_crypt(creds,
> 					    r->in.logon->generic->data, r->in.logon->generic->length);
> 		} else {
>@@ -811,8 +821,12 @@ static NTSTATUS dcesrv_netr_LogonSamLogon_base(struct dcesrv_call_state *dce_cal
> 	/* It appears that level 6 is not individually encrypted */
> 	if ((r->in.validation_level != 6) &&
> 	    memcmp(sam->key.key, zeros, sizeof(sam->key.key)) != 0) {
>-		/* This key is sent unencrypted without the ARCFOUR flag set */
>-		if (creds->negotiate_flags & NETLOGON_NEG_ARCFOUR) {
>+		/* This key is sent unencrypted without the ARCFOUR or AES flag set */
>+		if (creds->negotiate_flags & NETLOGON_NEG_SUPPORTS_AES) {
>+			netlogon_creds_aes_encrypt(creds,
>+					    sam->key.key,
>+					    sizeof(sam->key.key));
>+		} else if (creds->negotiate_flags & NETLOGON_NEG_ARCFOUR) {
> 			netlogon_creds_arcfour_crypt(creds,
> 					    sam->key.key,
> 					    sizeof(sam->key.key));
>@@ -823,7 +837,11 @@ static NTSTATUS dcesrv_netr_LogonSamLogon_base(struct dcesrv_call_state *dce_cal
> 	/* It appears that level 6 is not individually encrypted */
> 	if ((r->in.validation_level != 6) &&
> 	    memcmp(sam->LMSessKey.key, zeros, sizeof(sam->LMSessKey.key)) != 0) {
>-		if (creds->negotiate_flags & NETLOGON_NEG_ARCFOUR) {
>+		if (creds->negotiate_flags & NETLOGON_NEG_SUPPORTS_AES) {
>+			netlogon_creds_aes_encrypt(creds,
>+					    sam->LMSessKey.key,
>+					    sizeof(sam->LMSessKey.key));
>+		} else if (creds->negotiate_flags & NETLOGON_NEG_ARCFOUR) {
> 			netlogon_creds_arcfour_crypt(creds,
> 					    sam->LMSessKey.key,
> 					    sizeof(sam->LMSessKey.key));
>-- 
>1.7.9.5
>
>
>From 8a78339e5b64053f87da4ac7907973877c5b900a Mon Sep 17 00:00:00 2001
>From: =?UTF-8?q?G=C3=BCnther=20Deschner?= <gd@samba.org>
>Date: Wed, 5 Dec 2012 19:49:52 +0100
>Subject: [PATCH 21/28] s3-rpc_server: support AES for interactive netlogon
> samlogon password decryption.
>MIME-Version: 1.0
>Content-Type: text/plain; charset=UTF-8
>Content-Transfer-Encoding: 8bit
>
>Still need to fix AES support for the returned validation info.
>
>Guenther
>
>Signed-off-by: GÃ¼nther Deschner <gd@samba.org>
>Reviewed-by: Stefan Metzmacher <metze@samba.org>
>(cherry picked from commit 645289216eeb718eab1201dd3ad0a50fdf85753c)
>---
> source3/auth/auth_util.c                    |   34 +------------------------
> source3/auth/proto.h                        |    3 +--
> source3/rpc_server/netlogon/srv_netlog_nt.c |   36 +++++++++++++++++++++++++--
> 3 files changed, 36 insertions(+), 37 deletions(-)
>
>diff --git a/source3/auth/auth_util.c b/source3/auth/auth_util.c
>index 83c95a9..b75a390 100644
>--- a/source3/auth/auth_util.c
>+++ b/source3/auth/auth_util.c
>@@ -207,16 +207,12 @@ bool make_user_info_netlogon_interactive(struct auth_usersupplied_info **user_in
> 					 uint32 logon_parameters,
> 					 const uchar chal[8], 
> 					 const uchar lm_interactive_pwd[16], 
>-					 const uchar nt_interactive_pwd[16], 
>-					 const uchar *dc_sess_key)
>+					 const uchar nt_interactive_pwd[16])
> {
> 	struct samr_Password lm_pwd;
> 	struct samr_Password nt_pwd;
> 	unsigned char local_lm_response[24];
> 	unsigned char local_nt_response[24];
>-	unsigned char key[16];
>-
>-	memcpy(key, dc_sess_key, 16);
> 
> 	if (lm_interactive_pwd)
> 		memcpy(lm_pwd.hash, lm_interactive_pwd, sizeof(lm_pwd.hash));
>@@ -224,31 +220,6 @@ bool make_user_info_netlogon_interactive(struct auth_usersupplied_info **user_in
> 	if (nt_interactive_pwd)
> 		memcpy(nt_pwd.hash, nt_interactive_pwd, sizeof(nt_pwd.hash));
> 
>-#ifdef DEBUG_PASSWORD
>-	DEBUG(100,("key:"));
>-	dump_data(100, key, sizeof(key));
>-
>-	DEBUG(100,("lm owf password:"));
>-	dump_data(100, lm_pwd.hash, sizeof(lm_pwd.hash));
>-
>-	DEBUG(100,("nt owf password:"));
>-	dump_data(100, nt_pwd.hash, sizeof(nt_pwd.hash));
>-#endif
>-
>-	if (lm_interactive_pwd)
>-		arcfour_crypt(lm_pwd.hash, key, sizeof(lm_pwd.hash));
>-
>-	if (nt_interactive_pwd)
>-		arcfour_crypt(nt_pwd.hash, key, sizeof(nt_pwd.hash));
>-
>-#ifdef DEBUG_PASSWORD
>-	DEBUG(100,("decrypt of lm owf password:"));
>-	dump_data(100, lm_pwd.hash, sizeof(lm_pwd));
>-
>-	DEBUG(100,("decrypt of nt owf password:"));
>-	dump_data(100, nt_pwd.hash, sizeof(nt_pwd));
>-#endif
>-
> 	if (lm_interactive_pwd)
> 		SMBOWFencrypt(lm_pwd.hash, chal,
> 			      local_lm_response);
>@@ -257,9 +228,6 @@ bool make_user_info_netlogon_interactive(struct auth_usersupplied_info **user_in
> 		SMBOWFencrypt(nt_pwd.hash, chal,
> 			      local_nt_response);
> 
>-	/* Password info paranoia */
>-	ZERO_STRUCT(key);
>-
> 	{
> 		bool ret;
> 		NTSTATUS nt_status;
>diff --git a/source3/auth/proto.h b/source3/auth/proto.h
>index 98b48df..6c996722 100644
>--- a/source3/auth/proto.h
>+++ b/source3/auth/proto.h
>@@ -174,8 +174,7 @@ bool make_user_info_netlogon_interactive(struct auth_usersupplied_info **user_in
> 					 uint32 logon_parameters,
> 					 const uchar chal[8],
> 					 const uchar lm_interactive_pwd[16],
>-					 const uchar nt_interactive_pwd[16],
>-					 const uchar *dc_sess_key);
>+					 const uchar nt_interactive_pwd[16]);
> bool make_user_info_for_reply(struct auth_usersupplied_info **user_info,
> 			      const char *smb_name,
> 			      const char *client_domain,
>diff --git a/source3/rpc_server/netlogon/srv_netlog_nt.c b/source3/rpc_server/netlogon/srv_netlog_nt.c
>index 16542f8..cb932b4 100644
>--- a/source3/rpc_server/netlogon/srv_netlog_nt.c
>+++ b/source3/rpc_server/netlogon/srv_netlog_nt.c
>@@ -1596,6 +1596,39 @@ static NTSTATUS _netr_LogonSamLogon_base(struct pipes_struct *p,
> 	{
> 		uint8_t chal[8];
> 
>+#ifdef DEBUG_PASSWORD
>+		DEBUG(100,("lm owf password:"));
>+		dump_data(100, logon->password->lmpassword.hash, 16);
>+
>+		DEBUG(100,("nt owf password:"));
>+		dump_data(100, logon->password->ntpassword.hash, 16);
>+#endif
>+		if (creds->negotiate_flags & NETLOGON_NEG_SUPPORTS_AES) {
>+			netlogon_creds_aes_decrypt(creds,
>+						   logon->password->lmpassword.hash,
>+						   16);
>+			netlogon_creds_aes_decrypt(creds,
>+						   logon->password->ntpassword.hash,
>+						   16);
>+		} else if (creds->negotiate_flags & NETLOGON_NEG_ARCFOUR) {
>+			netlogon_creds_arcfour_crypt(creds,
>+						     logon->password->lmpassword.hash,
>+						     16);
>+			netlogon_creds_arcfour_crypt(creds,
>+						     logon->password->ntpassword.hash,
>+						     16);
>+		} else {
>+			netlogon_creds_des_decrypt(creds, &logon->password->lmpassword);
>+			netlogon_creds_des_decrypt(creds, &logon->password->ntpassword);
>+		}
>+
>+#ifdef DEBUG_PASSWORD
>+		DEBUG(100,("decrypt of lm owf password:"));
>+		dump_data(100, logon->password->lmpassword.hash, 16);
>+
>+		DEBUG(100,("decrypt of nt owf password:"));
>+		dump_data(100, logon->password->ntpassword.hash, 16);
>+#endif
> 		status = make_auth_context_subsystem(talloc_tos(),
> 						     &auth_context);
> 		if (!NT_STATUS_IS_OK(status)) {
>@@ -1611,8 +1644,7 @@ static NTSTATUS _netr_LogonSamLogon_base(struct pipes_struct *p,
> 							 logon->password->identity_info.parameter_control,
> 							 chal,
> 							 logon->password->lmpassword.hash,
>-							 logon->password->ntpassword.hash,
>-							 creds->session_key)) {
>+							 logon->password->ntpassword.hash)) {
> 			status = NT_STATUS_NO_MEMORY;
> 		}
> 		break;
>-- 
>1.7.9.5
>
>
>From 14597acfabeee0eb144ef9daf9561e472a690352 Mon Sep 17 00:00:00 2001
>From: =?UTF-8?q?G=C3=BCnther=20Deschner?= <gd@samba.org>
>Date: Thu, 6 Dec 2012 14:31:32 +0100
>Subject: [PATCH 22/28] s3-auth: session keys in validation level 6 samlogon
> replies are *not* encrypted.
>MIME-Version: 1.0
>Content-Type: text/plain; charset=UTF-8
>Content-Transfer-Encoding: 8bit
>
>Guenther
>
>Signed-off-by: GÃ¼nther Deschner <gd@samba.org>
>Reviewed-by: Stefan Metzmacher <metze@samba.org>
>(cherry picked from commit 7f435bd649f0b313804f40807a38de9478478b6c)
>---
> source3/auth/server_info.c |    8 --------
> 1 file changed, 8 deletions(-)
>
>diff --git a/source3/auth/server_info.c b/source3/auth/server_info.c
>index 216e5e3..02bf689 100644
>--- a/source3/auth/server_info.c
>+++ b/source3/auth/server_info.c
>@@ -176,20 +176,12 @@ NTSTATUS serverinfo_to_SamInfo6(struct auth_serversupplied_info *server_info,
> 		       server_info->session_key.data,
> 		       MIN(sizeof(info3->base.key.key),
> 			   server_info->session_key.length));
>-		if (pipe_session_key) {
>-			arcfour_crypt(info3->base.key.key,
>-				      pipe_session_key, 16);
>-		}
> 	}
> 	if (server_info->lm_session_key.length) {
> 		memcpy(info3->base.LMSessKey.key,
> 		       server_info->lm_session_key.data,
> 		       MIN(sizeof(info3->base.LMSessKey.key),
> 			   server_info->lm_session_key.length));
>-		if (pipe_session_key) {
>-			arcfour_crypt(info3->base.LMSessKey.key,
>-				      pipe_session_key, 8);
>-		}
> 	}
> 
> 	sam6->base = info3->base;
>-- 
>1.7.9.5
>
>
>From 063dbdbc356b66ceb3078afbca85ac4ccf324e63 Mon Sep 17 00:00:00 2001
>From: =?UTF-8?q?G=C3=BCnther=20Deschner?= <gd@samba.org>
>Date: Thu, 6 Dec 2012 14:54:25 +0100
>Subject: [PATCH 23/28] s3-rpc_server: Remove obsolete process_creds boolean
> in samlogon server.
>MIME-Version: 1.0
>Content-Type: text/plain; charset=UTF-8
>Content-Transfer-Encoding: 8bit
>
>Guenther
>
>Signed-off-by: GÃ¼nther Deschner <gd@samba.org>
>Reviewed-by: Stefan Metzmacher <metze@samba.org>
>(cherry picked from commit c1fb595081c2b0bf66bce06c09750f53e8031311)
>---
> source3/rpc_server/netlogon/srv_netlog_nt.c |   27 +++------------------------
> 1 file changed, 3 insertions(+), 24 deletions(-)
>
>diff --git a/source3/rpc_server/netlogon/srv_netlog_nt.c b/source3/rpc_server/netlogon/srv_netlog_nt.c
>index cb932b4..4be2355 100644
>--- a/source3/rpc_server/netlogon/srv_netlog_nt.c
>+++ b/source3/rpc_server/netlogon/srv_netlog_nt.c
>@@ -1465,21 +1465,16 @@ static NTSTATUS _netr_LogonSamLogon_base(struct pipes_struct *p,
> 	struct auth_usersupplied_info *user_info = NULL;
> 	struct auth_serversupplied_info *server_info = NULL;
> 	struct auth_context *auth_context = NULL;
>-	uint8_t pipe_session_key[16];
>-	bool process_creds = true;
> 	const char *fn;
> 
> 	switch (p->opnum) {
> 		case NDR_NETR_LOGONSAMLOGON:
>-			process_creds = true;
> 			fn = "_netr_LogonSamLogon";
> 			break;
> 		case NDR_NETR_LOGONSAMLOGONWITHFLAGS:
>-			process_creds = true;
> 			fn = "_netr_LogonSamLogonWithFlags";
> 			break;
> 		case NDR_NETR_LOGONSAMLOGONEX:
>-			process_creds = false;
> 			fn = "_netr_LogonSamLogonEx";
> 			break;
> 		default:
>@@ -1693,33 +1688,17 @@ static NTSTATUS _netr_LogonSamLogon_base(struct pipes_struct *p,
>            the SAM Local Security Authority should record that the user is
>            logged in to the domain.  */
> 
>-	if (process_creds) {
>-		/* Get the pipe session key from the creds. */
>-		memcpy(pipe_session_key, creds->session_key, 16);
>-	} else {
>-		struct schannel_state *schannel_auth;
>-		/* Get the pipe session key from the schannel. */
>-		if ((p->auth.auth_type != DCERPC_AUTH_TYPE_SCHANNEL)
>-		    || (p->auth.auth_ctx == NULL)) {
>-			return NT_STATUS_INVALID_HANDLE;
>-		}
>-
>-		schannel_auth = talloc_get_type_abort(p->auth.auth_ctx,
>-						      struct schannel_state);
>-		memcpy(pipe_session_key, schannel_auth->creds->session_key, 16);
>-	}
>-
> 	switch (r->in.validation_level) {
> 	case 2:
>-		status = serverinfo_to_SamInfo2(server_info, pipe_session_key, 16,
>+		status = serverinfo_to_SamInfo2(server_info, creds->session_key, 16,
> 						r->out.validation->sam2);
> 		break;
> 	case 3:
>-		status = serverinfo_to_SamInfo3(server_info, pipe_session_key, 16,
>+		status = serverinfo_to_SamInfo3(server_info, creds->session_key, 16,
> 						r->out.validation->sam3);
> 		break;
> 	case 6:
>-		status = serverinfo_to_SamInfo6(server_info, pipe_session_key, 16,
>+		status = serverinfo_to_SamInfo6(server_info, creds->session_key, 16,
> 						r->out.validation->sam6);
> 		break;
> 	}
>-- 
>1.7.9.5
>
>
>From 2105d420bcf83eb644e6e2a9f14e716911159dad Mon Sep 17 00:00:00 2001
>From: =?UTF-8?q?G=C3=BCnther=20Deschner?= <gd@samba.org>
>Date: Thu, 6 Dec 2012 15:21:02 +0100
>Subject: [PATCH 24/28] s3-auth: remove crypto from serverinfo_to_SamInfoX
> calls.
>MIME-Version: 1.0
>Content-Type: text/plain; charset=UTF-8
>Content-Transfer-Encoding: 8bit
>
>All crypto is dealt with within the netlogon samlogon server now.
>
>Guenther
>
>Signed-off-by: GÃ¼nther Deschner <gd@samba.org>
>Reviewed-by: Stefan Metzmacher <metze@samba.org>
>(cherry picked from commit f2d9589b178c0e3374e1c1ad363639b9e2bdce5f)
>---
> source3/auth/check_samsec.c                 |    2 +-
> source3/auth/proto.h                        |    6 -----
> source3/auth/server_info.c                  |   22 ------------------
> source3/rpc_server/netlogon/srv_netlog_nt.c |   32 +++++++++++++++++++++++----
> source3/torture/pdbtest.c                   |    2 +-
> 5 files changed, 30 insertions(+), 34 deletions(-)
>
>diff --git a/source3/auth/check_samsec.c b/source3/auth/check_samsec.c
>index 2d3cb65..7ed8cc2 100644
>--- a/source3/auth/check_samsec.c
>+++ b/source3/auth/check_samsec.c
>@@ -537,7 +537,7 @@ NTSTATUS check_sam_security_info3(const DATA_BLOB *challenge,
> 		goto done;
> 	}
> 
>-	status = serverinfo_to_SamInfo3(server_info, NULL, 0, info3);
>+	status = serverinfo_to_SamInfo3(server_info, info3);
> 	if (!NT_STATUS_IS_OK(status)) {
> 		DEBUG(10, ("serverinfo_to_SamInfo3 failed: %s\n",
> 			   nt_errstr(status)));
>diff --git a/source3/auth/proto.h b/source3/auth/proto.h
>index 6c996722..76661fc 100644
>--- a/source3/auth/proto.h
>+++ b/source3/auth/proto.h
>@@ -276,16 +276,10 @@ struct netr_SamInfo6;
> 
> struct auth_serversupplied_info *make_server_info(TALLOC_CTX *mem_ctx);
> NTSTATUS serverinfo_to_SamInfo2(struct auth_serversupplied_info *server_info,
>-				uint8_t *pipe_session_key,
>-				size_t pipe_session_key_len,
> 				struct netr_SamInfo2 *sam2);
> NTSTATUS serverinfo_to_SamInfo3(const struct auth_serversupplied_info *server_info,
>-				uint8_t *pipe_session_key,
>-				size_t pipe_session_key_len,
> 				struct netr_SamInfo3 *sam3);
> NTSTATUS serverinfo_to_SamInfo6(struct auth_serversupplied_info *server_info,
>-				uint8_t *pipe_session_key,
>-				size_t pipe_session_key_len,
> 				struct netr_SamInfo6 *sam6);
> NTSTATUS samu_to_SamInfo3(TALLOC_CTX *mem_ctx,
> 			  struct samu *samu,
>diff --git a/source3/auth/server_info.c b/source3/auth/server_info.c
>index 02bf689..3f4f708 100644
>--- a/source3/auth/server_info.c
>+++ b/source3/auth/server_info.c
>@@ -59,8 +59,6 @@ struct auth_serversupplied_info *make_server_info(TALLOC_CTX *mem_ctx)
> *****************************************************************************/
> 
> NTSTATUS serverinfo_to_SamInfo2(struct auth_serversupplied_info *server_info,
>-				uint8_t *pipe_session_key,
>-				size_t pipe_session_key_len,
> 				struct netr_SamInfo2 *sam2)
> {
> 	struct netr_SamInfo3 *info3;
>@@ -75,20 +73,12 @@ NTSTATUS serverinfo_to_SamInfo2(struct auth_serversupplied_info *server_info,
> 		       server_info->session_key.data,
> 		       MIN(sizeof(info3->base.key.key),
> 			   server_info->session_key.length));
>-		if (pipe_session_key) {
>-			arcfour_crypt(info3->base.key.key,
>-				      pipe_session_key, 16);
>-		}
> 	}
> 	if (server_info->lm_session_key.length) {
> 		memcpy(info3->base.LMSessKey.key,
> 		       server_info->lm_session_key.data,
> 		       MIN(sizeof(info3->base.LMSessKey.key),
> 			   server_info->lm_session_key.length));
>-		if (pipe_session_key) {
>-			arcfour_crypt(info3->base.LMSessKey.key,
>-				      pipe_session_key, 8);
>-		}
> 	}
> 
> 	sam2->base = info3->base;
>@@ -102,8 +92,6 @@ NTSTATUS serverinfo_to_SamInfo2(struct auth_serversupplied_info *server_info,
> *****************************************************************************/
> 
> NTSTATUS serverinfo_to_SamInfo3(const struct auth_serversupplied_info *server_info,
>-				uint8_t *pipe_session_key,
>-				size_t pipe_session_key_len,
> 				struct netr_SamInfo3 *sam3)
> {
> 	struct netr_SamInfo3 *info3;
>@@ -118,20 +106,12 @@ NTSTATUS serverinfo_to_SamInfo3(const struct auth_serversupplied_info *server_in
> 		       server_info->session_key.data,
> 		       MIN(sizeof(info3->base.key.key),
> 			   server_info->session_key.length));
>-		if (pipe_session_key) {
>-			arcfour_crypt(info3->base.key.key,
>-				      pipe_session_key, 16);
>-		}
> 	}
> 	if (server_info->lm_session_key.length) {
> 		memcpy(info3->base.LMSessKey.key,
> 		       server_info->lm_session_key.data,
> 		       MIN(sizeof(info3->base.LMSessKey.key),
> 			   server_info->lm_session_key.length));
>-		if (pipe_session_key) {
>-			arcfour_crypt(info3->base.LMSessKey.key,
>-				      pipe_session_key, 8);
>-		}
> 	}
> 
> 	sam3->base = info3->base;
>@@ -148,8 +128,6 @@ NTSTATUS serverinfo_to_SamInfo3(const struct auth_serversupplied_info *server_in
> *****************************************************************************/
> 
> NTSTATUS serverinfo_to_SamInfo6(struct auth_serversupplied_info *server_info,
>-				uint8_t *pipe_session_key,
>-				size_t pipe_session_key_len,
> 				struct netr_SamInfo6 *sam6)
> {
> 	struct pdb_domain_info *dominfo;
>diff --git a/source3/rpc_server/netlogon/srv_netlog_nt.c b/source3/rpc_server/netlogon/srv_netlog_nt.c
>index 4be2355..9b50655 100644
>--- a/source3/rpc_server/netlogon/srv_netlog_nt.c
>+++ b/source3/rpc_server/netlogon/srv_netlog_nt.c
>@@ -1466,6 +1466,7 @@ static NTSTATUS _netr_LogonSamLogon_base(struct pipes_struct *p,
> 	struct auth_serversupplied_info *server_info = NULL;
> 	struct auth_context *auth_context = NULL;
> 	const char *fn;
>+	struct netr_SamBaseInfo *base;
> 
> 	switch (p->opnum) {
> 		case NDR_NETR_LOGONSAMLOGON:
>@@ -1690,22 +1691,45 @@ static NTSTATUS _netr_LogonSamLogon_base(struct pipes_struct *p,
> 
> 	switch (r->in.validation_level) {
> 	case 2:
>-		status = serverinfo_to_SamInfo2(server_info, creds->session_key, 16,
>+		status = serverinfo_to_SamInfo2(server_info,
> 						r->out.validation->sam2);
>+		base = &r->out.validation->sam2->base;
> 		break;
> 	case 3:
>-		status = serverinfo_to_SamInfo3(server_info, creds->session_key, 16,
>+		status = serverinfo_to_SamInfo3(server_info,
> 						r->out.validation->sam3);
>+		base = &r->out.validation->sam3->base;
> 		break;
> 	case 6:
>-		status = serverinfo_to_SamInfo6(server_info, creds->session_key, 16,
>+		status = serverinfo_to_SamInfo6(server_info,
> 						r->out.validation->sam6);
>+		base = &r->out.validation->sam6->base;
> 		break;
> 	}
> 
> 	TALLOC_FREE(server_info);
> 
>-	return status;
>+	if (!NT_STATUS_IS_OK(status)) {
>+		return status;
>+	}
>+
>+	if (r->in.validation_level == 6) {
>+		/* no further crypto to be applied - gd */
>+		return NT_STATUS_OK;
>+	}
>+
>+	if (creds->negotiate_flags & NETLOGON_NEG_SUPPORTS_AES) {
>+		netlogon_creds_aes_encrypt(creds, base->key.key, 16);
>+		netlogon_creds_aes_encrypt(creds, base->LMSessKey.key, 8);
>+	} else if (creds->negotiate_flags & NETLOGON_NEG_ARCFOUR) {
>+		netlogon_creds_arcfour_crypt(creds, base->key.key, 16);
>+		netlogon_creds_arcfour_crypt(creds, base->LMSessKey.key, 8);
>+	} else {
>+		/* key is unencrypted when neither AES nor RC4 bits are set */
>+		netlogon_creds_des_encrypt_LMKey(creds, &base->LMSessKey);
>+	}
>+
>+	return NT_STATUS_OK;
> }
> 
> /****************************************************************
>diff --git a/source3/torture/pdbtest.c b/source3/torture/pdbtest.c
>index d0d529e..17da455 100644
>--- a/source3/torture/pdbtest.c
>+++ b/source3/torture/pdbtest.c
>@@ -316,7 +316,7 @@ static bool test_auth(TALLOC_CTX *mem_ctx, struct samu *pdb_entry)
> 		return False;
> 	}
> 
>-	status = serverinfo_to_SamInfo3(server_info, NULL, 0, info3_auth);
>+	status = serverinfo_to_SamInfo3(server_info, info3_auth);
> 	if (!NT_STATUS_IS_OK(status)) {
> 		DEBUG(0, ("serverinfo_to_SamInfo3 failed: %s\n",
> 			  nt_errstr(status)));
>-- 
>1.7.9.5
>
>
>From 786ba6342bb7d2747785e24bec39401d88a5ac08 Mon Sep 17 00:00:00 2001
>From: =?UTF-8?q?G=C3=BCnther=20Deschner?= <gd@samba.org>
>Date: Fri, 7 Dec 2012 01:05:00 +0100
>Subject: [PATCH 25/28] libcli/auth: remove trailing whitespace.
>MIME-Version: 1.0
>Content-Type: text/plain; charset=UTF-8
>Content-Transfer-Encoding: 8bit
>
>Guenther
>
>Signed-off-by: GÃ¼nther Deschner <gd@samba.org>
>Reviewed-by: Stefan Metzmacher <metze@samba.org>
>(cherry picked from commit be296a21fc509cacaedb5aad0c3ca4ccd44b4a62)
>---
> libcli/auth/credentials.c |   76 ++++++++++++++++++++++-----------------------
> 1 file changed, 38 insertions(+), 38 deletions(-)
>
>diff --git a/libcli/auth/credentials.c b/libcli/auth/credentials.c
>index be43c95..77df7f7 100644
>--- a/libcli/auth/credentials.c
>+++ b/libcli/auth/credentials.c
>@@ -1,21 +1,21 @@
>-/* 
>+/*
>    Unix SMB/CIFS implementation.
> 
>    code to manipulate domain credentials
> 
>    Copyright (C) Andrew Tridgell 1997-2003
>    Copyright (C) Andrew Bartlett <abartlet@samba.org> 2004
>-   
>+
>    This program is free software; you can redistribute it and/or modify
>    it under the terms of the GNU General Public License as published by
>    the Free Software Foundation; either version 3 of the License, or
>    (at your option) any later version.
>-   
>+
>    This program is distributed in the hope that it will be useful,
>    but WITHOUT ANY WARRANTY; without even the implied warranty of
>    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
>    GNU General Public License for more details.
>-   
>+
>    You should have received a copy of the GNU General Public License
>    along with this program.  If not, see <http://www.gnu.org/licenses/>.
> */
>@@ -85,7 +85,7 @@ static void netlogon_creds_init_128bit(struct netlogon_creds_CredentialState *cr
> 
> 	memset(zero, 0, sizeof(zero));
> 
>-	hmac_md5_init_rfc2104(machine_password->hash, sizeof(machine_password->hash), &ctx);	
>+	hmac_md5_init_rfc2104(machine_password->hash, sizeof(machine_password->hash), &ctx);
> 	MD5Init(&md5);
> 	MD5Update(&md5, zero, sizeof(zero));
> 	MD5Update(&md5, client_challenge->data, 8);
>@@ -142,7 +142,7 @@ static void netlogon_creds_step(struct netlogon_creds_CredentialState *creds)
> {
> 	struct netr_Credential time_cred;
> 
>-	DEBUG(5,("\tseed        %08x:%08x\n", 
>+	DEBUG(5,("\tseed        %08x:%08x\n",
> 		 IVAL(creds->seed.data, 0), IVAL(creds->seed.data, 4)));
> 
> 	SIVAL(time_cred.data, 0, IVAL(creds->seed.data, 0) + creds->sequence);
>@@ -152,18 +152,18 @@ static void netlogon_creds_step(struct netlogon_creds_CredentialState *creds)
> 
> 	netlogon_creds_step_crypt(creds, &time_cred, &creds->client);
> 
>-	DEBUG(5,("\tCLIENT      %08x:%08x\n", 
>+	DEBUG(5,("\tCLIENT      %08x:%08x\n",
> 		 IVAL(creds->client.data, 0), IVAL(creds->client.data, 4)));
> 
> 	SIVAL(time_cred.data, 0, IVAL(creds->seed.data, 0) + creds->sequence + 1);
> 	SIVAL(time_cred.data, 4, IVAL(creds->seed.data, 4));
> 
>-	DEBUG(5,("\tseed+time+1 %08x:%08x\n", 
>+	DEBUG(5,("\tseed+time+1 %08x:%08x\n",
> 		 IVAL(time_cred.data, 0), IVAL(time_cred.data, 4)));
> 
> 	netlogon_creds_step_crypt(creds, &time_cred, &creds->server);
> 
>-	DEBUG(5,("\tSERVER      %08x:%08x\n", 
>+	DEBUG(5,("\tSERVER      %08x:%08x\n",
> 		 IVAL(creds->server.data, 0), IVAL(creds->server.data, 4)));
> 
> 	creds->seed = time_cred;
>@@ -259,10 +259,10 @@ next comes the client specific functions
>   initialise the credentials chain and return the first client
>   credentials
> */
>- 
>-struct netlogon_creds_CredentialState *netlogon_creds_client_init(TALLOC_CTX *mem_ctx, 
>+
>+struct netlogon_creds_CredentialState *netlogon_creds_client_init(TALLOC_CTX *mem_ctx,
> 								  const char *client_account,
>-								  const char *client_computer_name, 
>+								  const char *client_computer_name,
> 								  const struct netr_Credential *client_challenge,
> 								  const struct netr_Credential *server_challenge,
> 								  const struct samr_Password *machine_password,
>@@ -270,11 +270,11 @@ struct netlogon_creds_CredentialState *netlogon_creds_client_init(TALLOC_CTX *me
> 								  uint32_t negotiate_flags)
> {
> 	struct netlogon_creds_CredentialState *creds = talloc_zero(mem_ctx, struct netlogon_creds_CredentialState);
>-	
>+
> 	if (!creds) {
> 		return NULL;
> 	}
>-	
>+
> 	creds->sequence = time(NULL);
> 	creds->negotiate_flags = negotiate_flags;
> 
>@@ -317,7 +317,7 @@ struct netlogon_creds_CredentialState *netlogon_creds_client_init(TALLOC_CTX *me
>   initialise the credentials structure with only a session key.  The caller better know what they are doing!
>  */
> 
>-struct netlogon_creds_CredentialState *netlogon_creds_client_init_session_key(TALLOC_CTX *mem_ctx, 
>+struct netlogon_creds_CredentialState *netlogon_creds_client_init_session_key(TALLOC_CTX *mem_ctx,
> 									      const uint8_t session_key[16])
> {
> 	struct netlogon_creds_CredentialState *creds;
>@@ -326,7 +326,7 @@ struct netlogon_creds_CredentialState *netlogon_creds_client_init_session_key(TA
> 	if (!creds) {
> 		return NULL;
> 	}
>-	
>+
> 	memcpy(creds->session_key, session_key, 16);
> 
> 	return creds;
>@@ -336,12 +336,12 @@ struct netlogon_creds_CredentialState *netlogon_creds_client_init_session_key(TA
>   step the credentials to the next element in the chain, updating the
>   current client and server credentials and the seed
> 
>-  produce the next authenticator in the sequence ready to send to 
>+  produce the next authenticator in the sequence ready to send to
>   the server
> */
> void netlogon_creds_client_authenticator(struct netlogon_creds_CredentialState *creds,
> 				struct netr_Authenticator *next)
>-{	
>+{
> 	creds->sequence += 2;
> 	netlogon_creds_step(creds);
> 
>@@ -355,7 +355,7 @@ void netlogon_creds_client_authenticator(struct netlogon_creds_CredentialState *
> bool netlogon_creds_client_check(struct netlogon_creds_CredentialState *creds,
> 			const struct netr_Credential *received_credentials)
> {
>-	if (!received_credentials || 
>+	if (!received_credentials ||
> 	    memcmp(received_credentials->data, creds->server.data, 8) != 0) {
> 		DEBUG(2,("credentials check failed\n"));
> 		return false;
>@@ -388,9 +388,9 @@ static bool netlogon_creds_server_check_internal(const struct netlogon_creds_Cre
>   initialise the credentials chain and return the first server
>   credentials
> */
>-struct netlogon_creds_CredentialState *netlogon_creds_server_init(TALLOC_CTX *mem_ctx, 
>+struct netlogon_creds_CredentialState *netlogon_creds_server_init(TALLOC_CTX *mem_ctx,
> 								  const char *client_account,
>-								  const char *client_computer_name, 
>+								  const char *client_computer_name,
> 								  uint16_t secure_channel_type,
> 								  const struct netr_Credential *client_challenge,
> 								  const struct netr_Credential *server_challenge,
>@@ -399,13 +399,13 @@ struct netlogon_creds_CredentialState *netlogon_creds_server_init(TALLOC_CTX *me
> 								  struct netr_Credential *credentials_out,
> 								  uint32_t negotiate_flags)
> {
>-	
>+
> 	struct netlogon_creds_CredentialState *creds = talloc_zero(mem_ctx, struct netlogon_creds_CredentialState);
>-	
>+
> 	if (!creds) {
> 		return NULL;
> 	}
>-	
>+
> 	creds->negotiate_flags = negotiate_flags;
> 	creds->secure_channel_type = secure_channel_type;
> 
>@@ -430,10 +430,10 @@ struct netlogon_creds_CredentialState *netlogon_creds_server_init(TALLOC_CTX *me
> 						server_challenge,
> 						machine_password);
> 	} else if (negotiate_flags & NETLOGON_NEG_STRONG_KEYS) {
>-		netlogon_creds_init_128bit(creds, client_challenge, server_challenge, 
>+		netlogon_creds_init_128bit(creds, client_challenge, server_challenge,
> 					   machine_password);
> 	} else {
>-		netlogon_creds_init_64bit(creds, client_challenge, server_challenge, 
>+		netlogon_creds_init_64bit(creds, client_challenge, server_challenge,
> 					  machine_password);
> 	}
> 
>@@ -461,7 +461,7 @@ struct netlogon_creds_CredentialState *netlogon_creds_server_init(TALLOC_CTX *me
> 
> NTSTATUS netlogon_creds_server_step_check(struct netlogon_creds_CredentialState *creds,
> 				 struct netr_Authenticator *received_authenticator,
>-				 struct netr_Authenticator *return_authenticator) 
>+				 struct netr_Authenticator *return_authenticator)
> {
> 	if (!received_authenticator || !return_authenticator) {
> 		return NT_STATUS_INVALID_PARAMETER;
>@@ -487,7 +487,7 @@ NTSTATUS netlogon_creds_server_step_check(struct netlogon_creds_CredentialState
> 
> void netlogon_creds_decrypt_samlogon(struct netlogon_creds_CredentialState *creds,
> 			    uint16_t validation_level,
>-			    union netr_Validation *validation) 
>+			    union netr_Validation *validation)
> {
> 	static const char zeros[16];
> 
>@@ -521,27 +521,27 @@ void netlogon_creds_decrypt_samlogon(struct netlogon_creds_CredentialState *cred
> 	if (validation_level == 6) {
> 		/* they aren't encrypted! */
> 	} else if (creds->negotiate_flags & NETLOGON_NEG_ARCFOUR) {
>-		if (memcmp(base->key.key, zeros,  
>+		if (memcmp(base->key.key, zeros,
> 			   sizeof(base->key.key)) != 0) {
>-			netlogon_creds_arcfour_crypt(creds, 
>-					    base->key.key, 
>+			netlogon_creds_arcfour_crypt(creds,
>+					    base->key.key,
> 					    sizeof(base->key.key));
> 		}
>-			
>-		if (memcmp(base->LMSessKey.key, zeros,  
>+
>+		if (memcmp(base->LMSessKey.key, zeros,
> 			   sizeof(base->LMSessKey.key)) != 0) {
>-			netlogon_creds_arcfour_crypt(creds, 
>-					    base->LMSessKey.key, 
>+			netlogon_creds_arcfour_crypt(creds,
>+					    base->LMSessKey.key,
> 					    sizeof(base->LMSessKey.key));
> 		}
> 	} else {
>-		if (memcmp(base->LMSessKey.key, zeros,  
>+		if (memcmp(base->LMSessKey.key, zeros,
> 			   sizeof(base->LMSessKey.key)) != 0) {
>-			netlogon_creds_des_decrypt_LMKey(creds, 
>+			netlogon_creds_des_decrypt_LMKey(creds,
> 						&base->LMSessKey);
> 		}
> 	}
>-}	
>+}
> 
> /*
>   copy a netlogon_creds_CredentialState struct
>-- 
>1.7.9.5
>
>
>From 7f695f315122db827eea05b8941342ad8541ed70 Mon Sep 17 00:00:00 2001
>From: =?UTF-8?q?G=C3=BCnther=20Deschner?= <gd@samba.org>
>Date: Fri, 7 Dec 2012 12:38:16 +0100
>Subject: [PATCH 26/28] libcli/auth: support AES decryption in
> netlogon_creds_decrypt_samlogon().
>MIME-Version: 1.0
>Content-Type: text/plain; charset=UTF-8
>Content-Transfer-Encoding: 8bit
>
>Guenther
>
>Signed-off-by: GÃ¼nther Deschner <gd@samba.org>
>Reviewed-by: Stefan Metzmacher <metze@samba.org>
>(cherry picked from commit f6cb8049b2fe62054d254a006b8a39f000d1d1d5)
>---
> libcli/auth/credentials.c |   14 ++++++++++++++
> 1 file changed, 14 insertions(+)
>
>diff --git a/libcli/auth/credentials.c b/libcli/auth/credentials.c
>index 77df7f7..63407e7 100644
>--- a/libcli/auth/credentials.c
>+++ b/libcli/auth/credentials.c
>@@ -520,6 +520,20 @@ void netlogon_creds_decrypt_samlogon(struct netlogon_creds_CredentialState *cred
> 	/* find and decyrpt the session keys, return in parameters above */
> 	if (validation_level == 6) {
> 		/* they aren't encrypted! */
>+	} else if (creds->negotiate_flags & NETLOGON_NEG_SUPPORTS_AES) {
>+		if (memcmp(base->key.key, zeros,
>+			   sizeof(base->key.key)) != 0) {
>+			netlogon_creds_aes_decrypt(creds,
>+					    base->key.key,
>+					    sizeof(base->key.key));
>+		}
>+
>+		if (memcmp(base->LMSessKey.key, zeros,
>+			   sizeof(base->LMSessKey.key)) != 0) {
>+			netlogon_creds_aes_decrypt(creds,
>+					    base->LMSessKey.key,
>+					    sizeof(base->LMSessKey.key));
>+		}
> 	} else if (creds->negotiate_flags & NETLOGON_NEG_ARCFOUR) {
> 		if (memcmp(base->key.key, zeros,
> 			   sizeof(base->key.key)) != 0) {
>-- 
>1.7.9.5
>
>
>From 742dbcce98966e4f5045f08e12357a1c2cd3a325 Mon Sep 17 00:00:00 2001
>From: =?UTF-8?q?G=C3=BCnther=20Deschner?= <gd@samba.org>
>Date: Fri, 7 Dec 2012 12:57:18 +0100
>Subject: [PATCH 27/28] s4-torture: precalculate expected session keys from
> samlogon in schannel test.
>MIME-Version: 1.0
>Content-Type: text/plain; charset=UTF-8
>Content-Transfer-Encoding: 8bit
>
>Guenther
>
>Signed-off-by: GÃ¼nther Deschner <gd@samba.org>
>Reviewed-by: Stefan Metzmacher <metze@samba.org>
>(cherry picked from commit d0bad6c3350698b26ba009bb0c91d0265cc22f60)
>---
> source4/torture/rpc/schannel.c |  118 +++++++++++++++++++++++++++++++++++++---
> 1 file changed, 111 insertions(+), 7 deletions(-)
>
>diff --git a/source4/torture/rpc/schannel.c b/source4/torture/rpc/schannel.c
>index 7e3e6aa..e0862d2 100644
>--- a/source4/torture/rpc/schannel.c
>+++ b/source4/torture/rpc/schannel.c
>@@ -58,6 +58,13 @@ bool test_netlogon_ex_ops(struct dcerpc_pipe *p, struct torture_context *tctx,
> 	int flags = CLI_CRED_NTLM_AUTH;
> 	struct dcerpc_binding_handle *b = p->binding_handle;
> 
>+	struct netr_UserSessionKey key;
>+	struct netr_LMSessionKey LMSessKey;
>+	uint32_t validation_levels[] = { 2, 3 };
>+	struct netr_SamBaseInfo *base;
>+	const char *crypto_alg = "";
>+	bool can_do_validation_6 = true;
>+
> 	if (lpcfg_client_lanman_auth(tctx->lp_ctx)) {
> 		flags |= CLI_CRED_LANMAN_AUTH;
> 	}
>@@ -109,16 +116,113 @@ bool test_netlogon_ex_ops(struct dcerpc_pipe *p, struct torture_context *tctx,
> 	r.out.authoritative = &authoritative;
> 	r.out.flags = &_flags;
> 
>+	/*
>+	- retrieve level6
>+	- save usrsession and lmsession key
>+	- retrieve level 2
>+	- calculate, compare
>+	- retrieve level 3
>+	- calculate, compare
>+	*/
>+
>+	if (creds) {
>+		if (creds->negotiate_flags & NETLOGON_NEG_SUPPORTS_AES) {
>+			crypto_alg = "AES";
>+		} else if (creds->negotiate_flags & NETLOGON_NEG_ARCFOUR) {
>+			crypto_alg = "ARCFOUR";
>+		}
>+	}
>+
>+	r.in.validation_level = 6;
>+
> 	torture_comment(tctx,
>-			"Testing LogonSamLogonEx with name %s\n",
>-			ninfo.identity_info.account_name.string);
>+			"Testing LogonSamLogonEx with name %s using %s and validation_level: %d\n",
>+			ninfo.identity_info.account_name.string, crypto_alg,
>+			r.in.validation_level);
>+
>+	torture_assert_ntstatus_ok(tctx,
>+		dcerpc_netr_LogonSamLogonEx_r(b, tctx, &r),
>+		"LogonSamLogonEx failed");
>+	if (NT_STATUS_EQUAL(r.out.result, NT_STATUS_INVALID_INFO_CLASS)) {
>+		can_do_validation_6 = false;
>+	} else {
>+		torture_assert_ntstatus_ok(tctx, r.out.result,
>+			"LogonSamLogonEx failed");
>+
>+		key = r.out.validation->sam6->base.key;
>+		LMSessKey = r.out.validation->sam6->base.LMSessKey;
>+
>+		DEBUG(1,("unencrypted session keys from validation_level 6:\n"));
>+		dump_data(1, r.out.validation->sam6->base.key.key, 16);
>+		dump_data(1, r.out.validation->sam6->base.LMSessKey.key, 8);
>+	}
>+
>+	for (i=0; i < ARRAY_SIZE(validation_levels); i++) {
> 
>-	for (i=2;i<3;i++) {
>-		r.in.validation_level = i;
>+		r.in.validation_level = validation_levels[i];
>+
>+		torture_comment(tctx,
>+			"Testing LogonSamLogonEx with name %s using %s and validation_level: %d\n",
>+			ninfo.identity_info.account_name.string, crypto_alg,
>+			r.in.validation_level);
>+
>+		torture_assert_ntstatus_ok(tctx,
>+			dcerpc_netr_LogonSamLogonEx_r(b, tctx, &r),
>+			"LogonSamLogonEx failed");
>+		torture_assert_ntstatus_ok(tctx, r.out.result,
>+			"LogonSamLogonEx failed");
>+
>+		if (creds == NULL) {
>+			/* when this test is called without creds no point in
>+			 * testing the session keys */
>+			continue;
>+		}
>+
>+		switch (validation_levels[i]) {
>+		case 2:
>+			base = &r.out.validation->sam2->base;
>+			break;
>+		case 3:
>+			base = &r.out.validation->sam3->base;
>+			break;
>+		default:
>+			break;
>+		}
>+
>+		DEBUG(1,("encrypted keys validation_level %d:\n",
>+			validation_levels[i]));
>+		dump_data(1, base->key.key, 16);
>+		dump_data(1, base->LMSessKey.key, 8);
>+
>+		if (creds->negotiate_flags & NETLOGON_NEG_SUPPORTS_AES) {
>+			netlogon_creds_aes_decrypt(creds, base->key.key, 16);
>+			netlogon_creds_aes_decrypt(creds, base->LMSessKey.key, 8);
>+		} else if (creds->negotiate_flags & NETLOGON_NEG_ARCFOUR) {
>+			netlogon_creds_arcfour_crypt(creds, base->key.key, 16);
>+			netlogon_creds_arcfour_crypt(creds, base->LMSessKey.key, 8);
>+		}
>+
>+		DEBUG(1,("decryped keys validation_level %d\n",
>+			validation_levels[i]));
>+
>+		dump_data(1, base->key.key, 16);
>+		dump_data(1, base->LMSessKey.key, 8);
>+
>+		if (!can_do_validation_6) {
>+			/* we cant compare against unencrypted keys */
>+			continue;
>+		}
> 
>-		torture_assert_ntstatus_ok(tctx, dcerpc_netr_LogonSamLogonEx_r(b, tctx, &r),
>-			"LogonSamLogon failed");
>-		torture_assert_ntstatus_ok(tctx, r.out.result, "LogonSamLogon failed");
>+		torture_assert_mem_equal(tctx,
>+					 base->key.key,
>+					 key.key,
>+					 16,
>+					 "unexpected user session key\n");
>+		torture_assert_mem_equal(tctx,
>+					 base->LMSessKey.key,
>+					 LMSessKey.key,
>+					 8,
>+					 "unexpected LM session key\n");
> 	}
> 
> 	return true;
>-- 
>1.7.9.5
>
>
>From e390bd120f58c19d50273058dcb52ea3aa809c5d Mon Sep 17 00:00:00 2001
>From: =?UTF-8?q?G=C3=BCnther=20Deschner?= <gd@samba.org>
>Date: Fri, 7 Dec 2012 12:51:10 +0100
>Subject: [PATCH 28/28] s4-torture: call the s4u2self tests with arcfour and
> aes.
>MIME-Version: 1.0
>Content-Type: text/plain; charset=UTF-8
>Content-Transfer-Encoding: 8bit
>
>Guenther
>
>Signed-off-by: GÃ¼nther Deschner <gd@samba.org>
>Signed-off-by: Stefan Metzmacher <metze@samba.org>
>
>Autobuild-User(master): Stefan Metzmacher <metze@samba.org>
>Autobuild-Date(master): Sun Dec  9 21:24:44 CET 2012 on sn-devel-104
>(cherry picked from commit ade5bfd304cc806758a58f04b35834cd730dd9ba)
>---
> source4/torture/rpc/remote_pac.c |   59 ++++++++++++++++++++++++++++++--------
> 1 file changed, 47 insertions(+), 12 deletions(-)
>
>diff --git a/source4/torture/rpc/remote_pac.c b/source4/torture/rpc/remote_pac.c
>index ccecc06..b95773f 100644
>--- a/source4/torture/rpc/remote_pac.c
>+++ b/source4/torture/rpc/remote_pac.c
>@@ -515,7 +515,8 @@ static bool test_S2U4Self(struct torture_context *tctx,
> 			  struct dcerpc_pipe *p,
> 			  struct cli_credentials *credentials,
> 			  enum netr_SchannelType secure_channel_type,
>-			  const char *test_machine_name)
>+			  const char *test_machine_name,
>+			  uint32_t negotiate_flags)
> {
> 	NTSTATUS status;
> 	struct dcerpc_binding_handle *b = p->binding_handle;
>@@ -550,6 +551,10 @@ static bool test_S2U4Self(struct torture_context *tctx,
> 
> 	torture_assert(tctx, tmp_ctx != NULL, "talloc_new() failed");
> 
>+	torture_comment(tctx,
>+		"Testing S4U2SELF (secure_channel_type: %d, machine: %s, negotiate_flags: 0x%08x\n",
>+		secure_channel_type, test_machine_name, negotiate_flags);
>+
> 	auth_context = talloc_zero(tmp_ctx, struct auth4_context);
> 	torture_assert(tctx, auth_context != NULL, "talloc_new() failed");
> 
>@@ -709,7 +714,7 @@ static bool test_S2U4Self(struct torture_context *tctx,
> 	r.out.validation = &validation;
> 	r.out.authoritative = &authoritative;
> 
>-	if (!test_SetupCredentials2(p, tctx, NETLOGON_NEG_AUTH2_ADS_FLAGS | NETLOGON_NEG_SUPPORTS_AES,
>+	if (!test_SetupCredentials2(p, tctx, negotiate_flags,
> 				    credentials, secure_channel_type,
> 				    &creds)) {
> 		return false;
>@@ -758,18 +763,40 @@ static bool test_S2U4Self(struct torture_context *tctx,
> 	return true;
> }
> 
>-static bool test_S2U4Self_bdc(struct torture_context *tctx,
>-			       struct dcerpc_pipe *p,
>-			       struct cli_credentials *credentials)
>+static bool test_S2U4Self_bdc_arcfour(struct torture_context *tctx,
>+				      struct dcerpc_pipe *p,
>+				      struct cli_credentials *credentials)
> {
>-	return test_S2U4Self(tctx, p, credentials, SEC_CHAN_BDC, TEST_MACHINE_NAME_S2U4SELF_BDC);
>+	return test_S2U4Self(tctx, p, credentials, SEC_CHAN_BDC,
>+			     TEST_MACHINE_NAME_S2U4SELF_BDC,
>+			     NETLOGON_NEG_AUTH2_ADS_FLAGS);
> }
> 
>-static bool test_S2U4Self_workstation(struct torture_context *tctx,
>+static bool test_S2U4Self_bdc_aes(struct torture_context *tctx,
> 				  struct dcerpc_pipe *p,
> 				  struct cli_credentials *credentials)
> {
>-	return test_S2U4Self(tctx, p, credentials, SEC_CHAN_WKSTA, TEST_MACHINE_NAME_S2U4SELF_WKSTA);
>+	return test_S2U4Self(tctx, p, credentials, SEC_CHAN_BDC,
>+			     TEST_MACHINE_NAME_S2U4SELF_BDC,
>+			     NETLOGON_NEG_AUTH2_ADS_FLAGS | NETLOGON_NEG_SUPPORTS_AES);
>+}
>+
>+static bool test_S2U4Self_workstation_arcfour(struct torture_context *tctx,
>+					      struct dcerpc_pipe *p,
>+					      struct cli_credentials *credentials)
>+{
>+	return test_S2U4Self(tctx, p, credentials, SEC_CHAN_WKSTA,
>+			     TEST_MACHINE_NAME_S2U4SELF_WKSTA,
>+			     NETLOGON_NEG_AUTH2_ADS_FLAGS);
>+}
>+
>+static bool test_S2U4Self_workstation_aes(struct torture_context *tctx,
>+					  struct dcerpc_pipe *p,
>+					  struct cli_credentials *credentials)
>+{
>+	return test_S2U4Self(tctx, p, credentials, SEC_CHAN_WKSTA,
>+			     TEST_MACHINE_NAME_S2U4SELF_WKSTA,
>+			     NETLOGON_NEG_AUTH2_ADS_FLAGS | NETLOGON_NEG_SUPPORTS_AES);
> }
> 
> struct torture_suite *torture_rpc_remote_pac(TALLOC_CTX *mem_ctx)
>@@ -798,13 +825,21 @@ struct torture_suite *torture_rpc_remote_pac(TALLOC_CTX *mem_ctx)
> 								      &ndr_table_netlogon, TEST_MACHINE_NAME_WKSTA_DES);
> 	torture_rpc_tcase_add_test_join(tcase, "verify-sig", test_PACVerify_workstation_des);
> 
>-	tcase = torture_suite_add_machine_bdc_rpc_iface_tcase(suite, "netlogon-bdc",
>+	tcase = torture_suite_add_machine_bdc_rpc_iface_tcase(suite, "netr-bdc-arcfour",
>+							      &ndr_table_netlogon, TEST_MACHINE_NAME_S2U4SELF_BDC);
>+	torture_rpc_tcase_add_test_creds(tcase, "s2u4self-arcfour", test_S2U4Self_bdc_arcfour);
>+
>+	tcase = torture_suite_add_machine_bdc_rpc_iface_tcase(suite, "netr-bcd-aes",
> 							      &ndr_table_netlogon, TEST_MACHINE_NAME_S2U4SELF_BDC);
>-	torture_rpc_tcase_add_test_creds(tcase, "s2u4self", test_S2U4Self_bdc);
>+	torture_rpc_tcase_add_test_creds(tcase, "s2u4self-aes", test_S2U4Self_bdc_aes);
> 
>-	tcase = torture_suite_add_machine_workstation_rpc_iface_tcase(suite, "netlogon-member",
>+	tcase = torture_suite_add_machine_workstation_rpc_iface_tcase(suite, "netr-mem-arcfour",
>+								      &ndr_table_netlogon, TEST_MACHINE_NAME_S2U4SELF_WKSTA);
>+	torture_rpc_tcase_add_test_creds(tcase, "s2u4self-arcfour", test_S2U4Self_workstation_arcfour);
>+
>+	tcase = torture_suite_add_machine_workstation_rpc_iface_tcase(suite, "netr-mem-aes",
> 								      &ndr_table_netlogon, TEST_MACHINE_NAME_S2U4SELF_WKSTA);
>+	torture_rpc_tcase_add_test_creds(tcase, "s2u4self-aes", test_S2U4Self_workstation_aes);
> 
>-	torture_rpc_tcase_add_test_creds(tcase, "s2u4self", test_S2U4Self_workstation);
> 	return suite;
> }
>-- 
>1.7.9.5
>

Flags:

gd: review+
metze: review+

Actions: View

Attachments on bug 9438: 8318