?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
s4:torture/samba3rpc: use pipe_bind_smb() in more places
[Samba.git] / source4 / torture / rpc / samba3rpc.c
blob6832940db4eaabc1c6080219bb489024fb80a4ba
1 /*
2 Unix SMB/CIFS implementation.
3
4 dcerpc torture tests, designed to walk Samba3 code paths
5
6 Copyright (C) Volker Lendecke 2006
7
8 This program is free software; you can redistribute it and/or modify
9 it under the terms of the GNU General Public License as published by
10 the Free Software Foundation; either version 3 of the License, or
11 (at your option) any later version.
12
13 This program is distributed in the hope that it will be useful,
14 but WITHOUT ANY WARRANTY; without even the implied warranty of
15 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
16 GNU General Public License for more details.
17
18 You should have received a copy of the GNU General Public License
19 along with this program. If not, see <http://www.gnu.org/licenses/>.
20 */
21
22 #include "includes.h"
23 #include "libcli/raw/libcliraw.h"
24 #include "libcli/raw/raw_proto.h"
25 #include "torture/util.h"
26 #include "libcli/rap/rap.h"
27 #include "librpc/gen_ndr/ndr_lsa_c.h"
28 #include "librpc/gen_ndr/ndr_samr_c.h"
29 #include "librpc/gen_ndr/ndr_netlogon_c.h"
30 #include "librpc/gen_ndr/ndr_srvsvc_c.h"
31 #include "librpc/gen_ndr/ndr_spoolss_c.h"
32 #include "librpc/gen_ndr/ndr_winreg_c.h"
33 #include "librpc/gen_ndr/ndr_wkssvc_c.h"
34 #include "lib/cmdline/popt_common.h"
35 #include "torture/rpc/torture_rpc.h"
36 #include "libcli/libcli.h"
37 #include "libcli/smb_composite/smb_composite.h"
38 #include "libcli/auth/libcli_auth.h"
39 #include "../lib/crypto/crypto.h"
40 #include "libcli/security/security.h"
41 #include "param/param.h"
42 #include "lib/registry/registry.h"
43 #include "libcli/resolve/resolve.h"
44 #include "torture/ndr/ndr.h"
45 #include "libcli/smb2/smb2.h"
46 #include "libcli/smb2/smb2_calls.h"
47 #include "librpc/rpc/dcerpc.h"
48 #include "librpc/rpc/dcerpc_proto.h"
49 #include "libcli/smb/smbXcli_base.h"
50
51 /*
52 * open pipe and bind, given an IPC$ context
53 */
54
55 static NTSTATUS pipe_bind_smb(struct torture_context *tctx,
56 TALLOC_CTX *mem_ctx,
57 struct smbcli_tree *tree,
58 const char *pipe_name,
59 const struct ndr_interface_table *iface,
60 struct dcerpc_pipe **p)
61 {
62 struct dcerpc_pipe *result;
63 NTSTATUS status;
64
65 if (!(result = dcerpc_pipe_init(mem_ctx, tctx->ev))) {
66 return NT_STATUS_NO_MEMORY;
67 }
68
69 status = dcerpc_pipe_open_smb(result, tree, pipe_name);
70 if (!NT_STATUS_IS_OK(status)) {
71 torture_comment(tctx, "dcerpc_pipe_open_smb failed: %s\n",
72 nt_errstr(status));
73 talloc_free(result);
74 return status;
75 }
76
77 status = dcerpc_bind_auth_none(result, iface);
78 if (!NT_STATUS_IS_OK(status)) {
79 torture_comment(tctx, "dcerpc_bind_auth_none failed: %s\n", nt_errstr(status));
80 talloc_free(result);
81 return status;
82 }
83
84 *p = result;
85 return NT_STATUS_OK;
86 }
87
88 /*
89 * This tests a RPC call using an invalid vuid
90 */
91
92 bool torture_bind_authcontext(struct torture_context *torture)
93 {
94 TALLOC_CTX *mem_ctx;
95 NTSTATUS status;
96 bool ret = false;
97 struct lsa_ObjectAttribute objectattr;
98 struct lsa_OpenPolicy2 openpolicy;
99 struct policy_handle handle;
100 struct lsa_Close close_handle;
101 struct smbcli_session *tmp;
102 uint16_t tmp_vuid;
103 struct smbcli_session *session2;
104 struct smbcli_state *cli;
105 struct dcerpc_pipe *lsa_pipe;
106 struct dcerpc_binding_handle *lsa_handle;
107 struct cli_credentials *anon_creds;
108 struct smb_composite_sesssetup setup;
109 struct smbcli_options options;
110 struct smbcli_session_options session_options;
111
112 mem_ctx = talloc_init("torture_bind_authcontext");
113
114 if (mem_ctx == NULL) {
115 torture_comment(torture, "talloc_init failed\n");
116 return false;
117 }
118
119 lpcfg_smbcli_options(torture->lp_ctx, &options);
120 lpcfg_smbcli_session_options(torture->lp_ctx, &session_options);
121
122 status = smbcli_full_connection(mem_ctx, &cli,
123 torture_setting_string(torture, "host", NULL),
124 lpcfg_smb_ports(torture->lp_ctx),
125 "IPC$", NULL,
126 lpcfg_socket_options(torture->lp_ctx),
127 cmdline_credentials,
128 lpcfg_resolve_context(torture->lp_ctx),
129 torture->ev, &options, &session_options,
130 lpcfg_gensec_settings(torture, torture->lp_ctx));
131 if (!NT_STATUS_IS_OK(status)) {
132 torture_comment(torture, "smbcli_full_connection failed: %s\n",
133 nt_errstr(status));
134 goto done;
135 }
136
137 status = pipe_bind_smb(torture, mem_ctx, cli->tree, "\\lsarpc",
138 &ndr_table_lsarpc, &lsa_pipe);
139 torture_assert_ntstatus_ok_goto(torture, status, ret, done,
140 "pipe_bind_smb failed");
141 lsa_handle = lsa_pipe->binding_handle;
142
143 openpolicy.in.system_name =talloc_asprintf(
144 mem_ctx, "\\\\%s", dcerpc_server_name(lsa_pipe));
145 ZERO_STRUCT(objectattr);
146 openpolicy.in.attr = &objectattr;
147 openpolicy.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
148 openpolicy.out.handle = &handle;
149
150 status = dcerpc_lsa_OpenPolicy2_r(lsa_handle, mem_ctx, &openpolicy);
151
152 if (!NT_STATUS_IS_OK(status)) {
153 torture_comment(torture, "dcerpc_lsa_OpenPolicy2 failed: %s\n",
154 nt_errstr(status));
155 goto done;
156 }
157 if (!NT_STATUS_IS_OK(openpolicy.out.result)) {
158 torture_comment(torture, "dcerpc_lsa_OpenPolicy2 failed: %s\n",
159 nt_errstr(openpolicy.out.result));
160 goto done;
161 }
162
163 close_handle.in.handle = &handle;
164 close_handle.out.handle = &handle;
165
166 status = dcerpc_lsa_Close_r(lsa_handle, mem_ctx, &close_handle);
167 if (!NT_STATUS_IS_OK(status)) {
168 torture_comment(torture, "dcerpc_lsa_Close failed: %s\n",
169 nt_errstr(status));
170 goto done;
171 }
172 if (!NT_STATUS_IS_OK(close_handle.out.result)) {
173 torture_comment(torture, "dcerpc_lsa_Close failed: %s\n",
174 nt_errstr(close_handle.out.result));
175 goto done;
176 }
177
178 session2 = smbcli_session_init(cli->transport, mem_ctx, false, session_options);
179 if (session2 == NULL) {
180 torture_comment(torture, "smbcli_session_init failed\n");
181 goto done;
182 }
183
184 if (!(anon_creds = cli_credentials_init_anon(mem_ctx))) {
185 torture_comment(torture, "create_anon_creds failed\n");
186 goto done;
187 }
188
189 setup.in.sesskey = cli->transport->negotiate.sesskey;
190 setup.in.capabilities = cli->transport->negotiate.capabilities;
191 setup.in.workgroup = "";
192 setup.in.credentials = anon_creds;
193 setup.in.gensec_settings = lpcfg_gensec_settings(torture, torture->lp_ctx);
194
195 status = smb_composite_sesssetup(session2, &setup);
196 if (!NT_STATUS_IS_OK(status)) {
197 torture_comment(torture, "anon session setup failed: %s\n",
198 nt_errstr(status));
199 goto done;
200 }
201 session2->vuid = setup.out.vuid;
202
203 tmp = cli->tree->session;
204 tmp_vuid = smb1cli_session_current_id(tmp->smbXcli);
205 smb1cli_session_set_id(tmp->smbXcli, session2->vuid);
206 cli->tree->session = session2;
207
208 status = dcerpc_lsa_OpenPolicy2_r(lsa_handle, mem_ctx, &openpolicy);
209
210 torture_assert(torture, smbXcli_conn_is_connected(cli->transport->conn),
211 "smb still connected");
212 torture_assert(torture, !dcerpc_binding_handle_is_connected(lsa_handle),
213 "dcerpc disonnected");
214
215 if (NT_STATUS_EQUAL(status, NT_STATUS_INVALID_HANDLE)) {
216 torture_comment(torture, "dcerpc_lsa_OpenPolicy2 with wrong vuid gave %s, "
217 "expected NT_STATUS_CONNECTION_DISCONNECTED\n",
218 nt_errstr(status));
219 status = NT_STATUS_CONNECTION_DISCONNECTED;
220 }
221 if (NT_STATUS_EQUAL(status, NT_STATUS_IO_DEVICE_ERROR)) {
222 torture_comment(torture, "dcerpc_lsa_OpenPolicy2 with wrong vuid gave %s, "
223 "expected NT_STATUS_CONNECTION_DISCONNECTED\n",
224 nt_errstr(status));
225 status = NT_STATUS_CONNECTION_DISCONNECTED;
226 }
227
228 torture_assert_ntstatus_equal(torture, status, NT_STATUS_CONNECTION_DISCONNECTED,
229 "lsa connection disconnected");
230
231 smb1cli_session_set_id(tmp->smbXcli, tmp_vuid);
232 cli->tree->session = tmp;
233 talloc_free(lsa_pipe);
234 lsa_pipe = NULL;
235
236 ret = true;
237 done:
238 talloc_free(mem_ctx);
239 return ret;
240 }
241
242 /*
243 * Bind to lsa using a specific auth method
244 */
245
246 static bool bindtest(struct torture_context *tctx,
247 struct smbcli_state *cli,
248 struct cli_credentials *credentials,
249 uint8_t auth_type, uint8_t auth_level)
250 {
251 TALLOC_CTX *mem_ctx;
252 bool ret = false;
253 NTSTATUS status;
254
255 struct dcerpc_pipe *lsa_pipe;
256 struct dcerpc_binding_handle *lsa_handle;
257 struct lsa_ObjectAttribute objectattr;
258 struct lsa_OpenPolicy2 openpolicy;
259 struct lsa_QueryInfoPolicy query;
260 union lsa_PolicyInformation *info = NULL;
261 struct policy_handle handle;
262 struct lsa_Close close_handle;
263
264 if ((mem_ctx = talloc_init("bindtest")) == NULL) {
265 torture_comment(tctx, "talloc_init failed\n");
266 return false;
267 }
268
269 lsa_pipe = dcerpc_pipe_init(mem_ctx, tctx->ev);
270 if (lsa_pipe == NULL) {
271 torture_comment(tctx, "dcerpc_pipe_init failed\n");
272 goto done;
273 }
274 lsa_handle = lsa_pipe->binding_handle;
275
276 status = dcerpc_pipe_open_smb(lsa_pipe, cli->tree, "\\lsarpc");
277 if (!NT_STATUS_IS_OK(status)) {
278 torture_comment(tctx, "dcerpc_pipe_open_smb failed: %s\n",
279 nt_errstr(status));
280 goto done;
281 }
282
283 status = dcerpc_bind_auth(lsa_pipe, &ndr_table_lsarpc,
284 credentials, lpcfg_gensec_settings(tctx->lp_ctx, tctx->lp_ctx), auth_type, auth_level,
285 NULL);
286 if (!NT_STATUS_IS_OK(status)) {
287 torture_comment(tctx, "dcerpc_bind_auth failed: %s\n", nt_errstr(status));
288 goto done;
289 }
290
291 openpolicy.in.system_name =talloc_asprintf(
292 mem_ctx, "\\\\%s", dcerpc_server_name(lsa_pipe));
293 ZERO_STRUCT(objectattr);
294 openpolicy.in.attr = &objectattr;
295 openpolicy.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
296 openpolicy.out.handle = &handle;
297
298 status = dcerpc_lsa_OpenPolicy2_r(lsa_handle, mem_ctx, &openpolicy);
299
300 if (!NT_STATUS_IS_OK(status)) {
301 torture_comment(tctx, "dcerpc_lsa_OpenPolicy2 failed: %s\n",
302 nt_errstr(status));
303 goto done;
304 }
305 if (!NT_STATUS_IS_OK(openpolicy.out.result)) {
306 torture_comment(tctx, "dcerpc_lsa_OpenPolicy2 failed: %s\n",
307 nt_errstr(openpolicy.out.result));
308 goto done;
309 }
310
311 query.in.handle = &handle;
312 query.in.level = LSA_POLICY_INFO_DOMAIN;
313 query.out.info = &info;
314
315 status = dcerpc_lsa_QueryInfoPolicy_r(lsa_handle, mem_ctx, &query);
316 if (!NT_STATUS_IS_OK(status)) {
317 torture_comment(tctx, "dcerpc_lsa_QueryInfoPolicy failed: %s\n",
318 nt_errstr(status));
319 goto done;
320 }
321 if (!NT_STATUS_IS_OK(query.out.result)) {
322 torture_comment(tctx, "dcerpc_lsa_QueryInfoPolicy failed: %s\n",
323 nt_errstr(query.out.result));
324 goto done;
325 }
326
327 close_handle.in.handle = &handle;
328 close_handle.out.handle = &handle;
329
330 status = dcerpc_lsa_Close_r(lsa_handle, mem_ctx, &close_handle);
331 if (!NT_STATUS_IS_OK(status)) {
332 torture_comment(tctx, "dcerpc_lsa_Close failed: %s\n",
333 nt_errstr(status));
334 goto done;
335 }
336 if (!NT_STATUS_IS_OK(close_handle.out.result)) {
337 torture_comment(tctx, "dcerpc_lsa_Close failed: %s\n",
338 nt_errstr(close_handle.out.result));
339 goto done;
340 }
341
342
343 ret = true;
344 done:
345 talloc_free(mem_ctx);
346 return ret;
347 }
348
349 /*
350 * test authenticated RPC binds with the variants Samba3 does support
351 */
352
353 static bool torture_bind_samba3(struct torture_context *torture)
354 {
355 TALLOC_CTX *mem_ctx;
356 NTSTATUS status;
357 bool ret = false;
358 struct smbcli_state *cli;
359 struct smbcli_options options;
360 struct smbcli_session_options session_options;
361
362 mem_ctx = talloc_init("torture_bind_authcontext");
363
364 if (mem_ctx == NULL) {
365 torture_comment(torture, "talloc_init failed\n");
366 return false;
367 }
368
369 lpcfg_smbcli_options(torture->lp_ctx, &options);
370 lpcfg_smbcli_session_options(torture->lp_ctx, &session_options);
371
372 status = smbcli_full_connection(mem_ctx, &cli,
373 torture_setting_string(torture, "host", NULL),
374 lpcfg_smb_ports(torture->lp_ctx),
375 "IPC$", NULL,
376 lpcfg_socket_options(torture->lp_ctx),
377 cmdline_credentials,
378 lpcfg_resolve_context(torture->lp_ctx),
379 torture->ev, &options, &session_options,
380 lpcfg_gensec_settings(torture, torture->lp_ctx));
381 if (!NT_STATUS_IS_OK(status)) {
382 torture_comment(torture, "smbcli_full_connection failed: %s\n",
383 nt_errstr(status));
384 goto done;
385 }
386
387 ret = true;
388
389 ret &= bindtest(torture, cli, cmdline_credentials, DCERPC_AUTH_TYPE_NTLMSSP,
390 DCERPC_AUTH_LEVEL_INTEGRITY);
391 ret &= bindtest(torture, cli, cmdline_credentials, DCERPC_AUTH_TYPE_NTLMSSP,
392 DCERPC_AUTH_LEVEL_PRIVACY);
393 ret &= bindtest(torture, cli, cmdline_credentials, DCERPC_AUTH_TYPE_SPNEGO,
394 DCERPC_AUTH_LEVEL_INTEGRITY);
395 ret &= bindtest(torture, cli, cmdline_credentials, DCERPC_AUTH_TYPE_SPNEGO,
396 DCERPC_AUTH_LEVEL_PRIVACY);
397
398 done:
399 talloc_free(mem_ctx);
400 return ret;
401 }
402
403 /*
404 * Lookup or create a user and return all necessary info
405 */
406
407 static bool get_usr_handle(struct torture_context *tctx,
408 struct smbcli_state *cli,
409 TALLOC_CTX *mem_ctx,
410 struct cli_credentials *admin_creds,
411 uint8_t auth_type,
412 uint8_t auth_level,
413 const char *username,
414 char **domain,
415 struct dcerpc_pipe **result_pipe,
416 struct policy_handle **result_handle,
417 struct dom_sid **sid_p)
418 {
419 struct dcerpc_pipe *samr_pipe;
420 struct dcerpc_binding_handle *samr_handle;
421 NTSTATUS status;
422 struct policy_handle conn_handle;
423 struct policy_handle domain_handle;
424 struct policy_handle *user_handle;
425 struct samr_Connect2 conn;
426 struct samr_EnumDomains enumdom;
427 uint32_t resume_handle = 0;
428 uint32_t num_entries = 0;
429 struct samr_SamArray *sam = NULL;
430 struct samr_LookupDomain l;
431 struct dom_sid2 *sid = NULL;
432 int dom_idx;
433 struct lsa_String domain_name;
434 struct lsa_String user_name;
435 struct samr_OpenDomain o;
436 struct samr_CreateUser2 c;
437 uint32_t user_rid,access_granted;
438
439 samr_pipe = dcerpc_pipe_init(mem_ctx, tctx->ev);
440 torture_assert(tctx, samr_pipe, "dcerpc_pipe_init failed");
441 #if 0
442 samr_pipe->conn->flags |= DCERPC_DEBUG_PRINT_IN | DCERPC_DEBUG_PRINT_OUT;
443 #endif
444 samr_handle = samr_pipe->binding_handle;
445
446 torture_assert_ntstatus_ok(tctx,
447 dcerpc_pipe_open_smb(samr_pipe, cli->tree, "\\samr"),
448 "dcerpc_pipe_open_smb failed");
449
450 if (admin_creds != NULL) {
451 torture_assert_ntstatus_ok(tctx,
452 dcerpc_bind_auth(samr_pipe, &ndr_table_samr,
453 admin_creds, lpcfg_gensec_settings(tctx->lp_ctx, tctx->lp_ctx), auth_type, auth_level,
454 NULL),
455 "dcerpc_bind_auth failed");
456 } else {
457 /* We must have an authenticated SMB connection */
458 torture_assert_ntstatus_ok(tctx,
459 dcerpc_bind_auth_none(samr_pipe, &ndr_table_samr),
460 "dcerpc_bind_auth_none failed");
461 }
462
463 conn.in.system_name = talloc_asprintf(
464 mem_ctx, "\\\\%s", dcerpc_server_name(samr_pipe));
465 conn.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
466 conn.out.connect_handle = &conn_handle;
467
468 torture_assert_ntstatus_ok(tctx,
469 dcerpc_samr_Connect2_r(samr_handle, mem_ctx, &conn),
470 "samr_Connect2 failed");
471 torture_assert_ntstatus_ok(tctx, conn.out.result,
472 "samr_Connect2 failed");
473
474 enumdom.in.connect_handle = &conn_handle;
475 enumdom.in.resume_handle = &resume_handle;
476 enumdom.in.buf_size = (uint32_t)-1;
477 enumdom.out.resume_handle = &resume_handle;
478 enumdom.out.num_entries = &num_entries;
479 enumdom.out.sam = &sam;
480
481 torture_assert_ntstatus_ok(tctx,
482 dcerpc_samr_EnumDomains_r(samr_handle, mem_ctx, &enumdom),
483 "samr_EnumDomains failed");
484 torture_assert_ntstatus_ok(tctx, enumdom.out.result,
485 "samr_EnumDomains failed");
486
487 torture_assert_int_equal(tctx, *enumdom.out.num_entries, 2,
488 "samr_EnumDomains returned unexpected num_entries");
489
490 dom_idx = strequal(sam->entries[0].name.string,
491 "builtin") ? 1:0;
492
493 l.in.connect_handle = &conn_handle;
494 domain_name.string = sam->entries[dom_idx].name.string;
495 *domain = talloc_strdup(mem_ctx, domain_name.string);
496 l.in.domain_name = &domain_name;
497 l.out.sid = &sid;
498
499 torture_assert_ntstatus_ok(tctx,
500 dcerpc_samr_LookupDomain_r(samr_handle, mem_ctx, &l),
501 "samr_LookupDomain failed");
502 torture_assert_ntstatus_ok(tctx, l.out.result,
503 "samr_LookupDomain failed");
504
505 o.in.connect_handle = &conn_handle;
506 o.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
507 o.in.sid = *l.out.sid;
508 o.out.domain_handle = &domain_handle;
509
510 torture_assert_ntstatus_ok(tctx,
511 dcerpc_samr_OpenDomain_r(samr_handle, mem_ctx, &o),
512 "samr_OpenDomain failed");
513 torture_assert_ntstatus_ok(tctx, o.out.result,
514 "samr_OpenDomain failed");
515
516 c.in.domain_handle = &domain_handle;
517 user_name.string = username;
518 c.in.account_name = &user_name;
519 c.in.acct_flags = ACB_NORMAL;
520 c.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
521 user_handle = talloc(mem_ctx, struct policy_handle);
522 c.out.user_handle = user_handle;
523 c.out.access_granted = &access_granted;
524 c.out.rid = &user_rid;
525
526 torture_assert_ntstatus_ok(tctx,
527 dcerpc_samr_CreateUser2_r(samr_handle, mem_ctx, &c),
528 "samr_CreateUser2 failed");
529
530 if (NT_STATUS_EQUAL(c.out.result, NT_STATUS_USER_EXISTS)) {
531 struct samr_LookupNames ln;
532 struct samr_OpenUser ou;
533 struct samr_Ids rids, types;
534
535 ln.in.domain_handle = &domain_handle;
536 ln.in.num_names = 1;
537 ln.in.names = &user_name;
538 ln.out.rids = &rids;
539 ln.out.types = &types;
540
541 torture_assert_ntstatus_ok(tctx,
542 dcerpc_samr_LookupNames_r(samr_handle, mem_ctx, &ln),
543 "samr_LookupNames failed");
544 torture_assert_ntstatus_ok(tctx, ln.out.result,
545 "samr_LookupNames failed");
546
547 ou.in.domain_handle = &domain_handle;
548 ou.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
549 user_rid = ou.in.rid = ln.out.rids->ids[0];
550 ou.out.user_handle = user_handle;
551
552 torture_assert_ntstatus_ok(tctx,
553 dcerpc_samr_OpenUser_r(samr_handle, mem_ctx, &ou),
554 "samr_OpenUser failed");
555 status = ou.out.result;
556 } else {
557 status = c.out.result;
558 }
559
560 torture_assert_ntstatus_ok(tctx, status,
561 "samr_CreateUser failed");
562
563 *result_pipe = samr_pipe;
564 *result_handle = user_handle;
565 if (sid_p != NULL) {
566 *sid_p = dom_sid_add_rid(mem_ctx, *l.out.sid, user_rid);
567 }
568 return true;
569
570 }
571
572 /*
573 * Create a test user
574 */
575
576 static bool create_user(struct torture_context *tctx,
577 TALLOC_CTX *mem_ctx, struct smbcli_state *cli,
578 struct cli_credentials *admin_creds,
579 const char *username, const char *password,
580 char **domain_name,
581 struct dom_sid **user_sid)
582 {
583 TALLOC_CTX *tmp_ctx;
584 NTSTATUS status;
585 struct dcerpc_pipe *samr_pipe;
586 struct dcerpc_binding_handle *samr_handle;
587 struct policy_handle *wks_handle;
588 bool ret = false;
589
590 if (!(tmp_ctx = talloc_new(mem_ctx))) {
591 torture_comment(tctx, "talloc_init failed\n");
592 return false;
593 }
594
595 ret = get_usr_handle(tctx, cli, tmp_ctx, admin_creds,
596 DCERPC_AUTH_TYPE_NTLMSSP,
597 DCERPC_AUTH_LEVEL_INTEGRITY,
598 username, domain_name, &samr_pipe, &wks_handle,
599 user_sid);
600 if (ret == false) {
601 torture_comment(tctx, "get_usr_handle failed\n");
602 goto done;
603 }
604 samr_handle = samr_pipe->binding_handle;
605
606 {
607 struct samr_SetUserInfo2 sui2;
608 struct samr_SetUserInfo sui;
609 struct samr_QueryUserInfo qui;
610 union samr_UserInfo u_info;
611 union samr_UserInfo *info;
612 DATA_BLOB session_key;
613
614
615 ZERO_STRUCT(u_info);
616 encode_pw_buffer(u_info.info23.password.data, password,
617 STR_UNICODE);
618
619 status = dcerpc_fetch_session_key(samr_pipe, &session_key);
620 if (!NT_STATUS_IS_OK(status)) {
621 torture_comment(tctx, "dcerpc_fetch_session_key failed\n");
622 goto done;
623 }
624 arcfour_crypt_blob(u_info.info23.password.data, 516,
625 &session_key);
626 u_info.info23.info.password_expired = 0;
627 u_info.info23.info.fields_present = SAMR_FIELD_NT_PASSWORD_PRESENT |
628 SAMR_FIELD_LM_PASSWORD_PRESENT |
629 SAMR_FIELD_EXPIRED_FLAG;
630 sui2.in.user_handle = wks_handle;
631 sui2.in.info = &u_info;
632 sui2.in.level = 23;
633
634 status = dcerpc_samr_SetUserInfo2_r(samr_handle, tmp_ctx, &sui2);
635 if (!NT_STATUS_IS_OK(status)) {
636 torture_comment(tctx, "samr_SetUserInfo(23) failed: %s\n",
637 nt_errstr(status));
638 goto done;
639 }
640 if (!NT_STATUS_IS_OK(sui2.out.result)) {
641 torture_comment(tctx, "samr_SetUserInfo(23) failed: %s\n",
642 nt_errstr(sui2.out.result));
643 goto done;
644 }
645
646 u_info.info16.acct_flags = ACB_NORMAL;
647 sui.in.user_handle = wks_handle;
648 sui.in.info = &u_info;
649 sui.in.level = 16;
650
651 status = dcerpc_samr_SetUserInfo_r(samr_handle, tmp_ctx, &sui);
652 if (!NT_STATUS_IS_OK(status) || !NT_STATUS_IS_OK(sui.out.result)) {
653 torture_comment(tctx, "samr_SetUserInfo(16) failed\n");
654 goto done;
655 }
656
657 qui.in.user_handle = wks_handle;
658 qui.in.level = 21;
659 qui.out.info = &info;
660
661 status = dcerpc_samr_QueryUserInfo_r(samr_handle, tmp_ctx, &qui);
662 if (!NT_STATUS_IS_OK(status) || !NT_STATUS_IS_OK(qui.out.result)) {
663 torture_comment(tctx, "samr_QueryUserInfo(21) failed\n");
664 goto done;
665 }
666
667 info->info21.allow_password_change = 0;
668 info->info21.force_password_change = 0;
669 info->info21.account_name.string = NULL;
670 info->info21.rid = 0;
671 info->info21.acct_expiry = 0;
672 info->info21.fields_present = 0x81827fa; /* copy usrmgr.exe */
673
674 u_info.info21 = info->info21;
675 sui.in.user_handle = wks_handle;
676 sui.in.info = &u_info;
677 sui.in.level = 21;
678
679 status = dcerpc_samr_SetUserInfo_r(samr_handle, tmp_ctx, &sui);
680 if (!NT_STATUS_IS_OK(status) || !NT_STATUS_IS_OK(sui.out.result)) {
681 torture_comment(tctx, "samr_SetUserInfo(21) failed\n");
682 goto done;
683 }
684 }
685
686 *domain_name= talloc_steal(mem_ctx, *domain_name);
687 *user_sid = talloc_steal(mem_ctx, *user_sid);
688 ret = true;
689 done:
690 talloc_free(tmp_ctx);
691 return ret;
692 }
693
694 /*
695 * Delete a test user
696 */
697
698 static bool delete_user(struct torture_context *tctx,
699 struct smbcli_state *cli,
700 struct cli_credentials *admin_creds,
701 const char *username)
702 {
703 TALLOC_CTX *mem_ctx;
704 NTSTATUS status;
705 char *dom_name;
706 struct dcerpc_pipe *samr_pipe;
707 struct dcerpc_binding_handle *samr_handle;
708 struct policy_handle *user_handle;
709 bool ret = false;
710
711 if ((mem_ctx = talloc_init("leave")) == NULL) {
712 torture_comment(tctx, "talloc_init failed\n");
713 return false;
714 }
715
716 ret = get_usr_handle(tctx, cli, mem_ctx, admin_creds,
717 DCERPC_AUTH_TYPE_NTLMSSP,
718 DCERPC_AUTH_LEVEL_INTEGRITY,
719 username, &dom_name, &samr_pipe,
720 &user_handle, NULL);
721 if (ret == false) {
722 torture_comment(tctx, "get_wks_handle failed\n");
723 goto done;
724 }
725 samr_handle = samr_pipe->binding_handle;
726
727 {
728 struct samr_DeleteUser d;
729
730 d.in.user_handle = user_handle;
731 d.out.user_handle = user_handle;
732
733 status = dcerpc_samr_DeleteUser_r(samr_handle, mem_ctx, &d);
734 if (!NT_STATUS_IS_OK(status)) {
735 torture_comment(tctx, "samr_DeleteUser failed %s\n", nt_errstr(status));
736 goto done;
737 }
738 if (!NT_STATUS_IS_OK(d.out.result)) {
739 torture_comment(tctx, "samr_DeleteUser failed %s\n", nt_errstr(d.out.result));
740 goto done;
741 }
742
743 }
744
745 ret = true;
746
747 done:
748 talloc_free(mem_ctx);
749 return ret;
750 }
751
752 /*
753 * Do a Samba3-style join
754 */
755
756 static bool join3(struct torture_context *tctx,
757 struct smbcli_state *cli,
758 bool use_level25,
759 struct cli_credentials *admin_creds,
760 struct cli_credentials *wks_creds)
761 {
762 TALLOC_CTX *mem_ctx;
763 NTSTATUS status;
764 char *dom_name;
765 struct dcerpc_pipe *samr_pipe;
766 struct dcerpc_binding_handle *samr_handle;
767 struct policy_handle *wks_handle;
768 bool ret = false;
769 NTTIME last_password_change;
770
771 if ((mem_ctx = talloc_init("join3")) == NULL) {
772 torture_comment(tctx, "talloc_init failed\n");
773 return false;
774 }
775
776 ret = get_usr_handle(
777 tctx, cli, mem_ctx, admin_creds,
778 DCERPC_AUTH_TYPE_NTLMSSP,
779 DCERPC_AUTH_LEVEL_PRIVACY,
780 talloc_asprintf(mem_ctx, "%s$",
781 cli_credentials_get_workstation(wks_creds)),
782 &dom_name, &samr_pipe, &wks_handle, NULL);
783 if (ret == false) {
784 torture_comment(tctx, "get_wks_handle failed\n");
785 goto done;
786 }
787 samr_handle = samr_pipe->binding_handle;
788 ret = false;
789 {
790 struct samr_QueryUserInfo q;
791 union samr_UserInfo *info;
792
793 q.in.user_handle = wks_handle;
794 q.in.level = 21;
795 q.out.info = &info;
796
797 status = dcerpc_samr_QueryUserInfo_r(samr_handle, mem_ctx, &q);
798 if (!NT_STATUS_IS_OK(status)) {
799 torture_warning(tctx, "QueryUserInfo failed: %s\n",
800 nt_errstr(status));
801 goto done;
802 }
803 if (!NT_STATUS_IS_OK(q.out.result)) {
804 torture_warning(tctx, "QueryUserInfo failed: %s\n",
805 nt_errstr(q.out.result));
806 goto done;
807 }
808
809
810 last_password_change = info->info21.last_password_change;
811 }
812
813 cli_credentials_set_domain(wks_creds, dom_name, CRED_SPECIFIED);
814
815 if (use_level25) {
816 struct samr_SetUserInfo2 sui2;
817 union samr_UserInfo u_info;
818 struct samr_UserInfo21 *i21 = &u_info.info25.info;
819 DATA_BLOB session_key;
820 DATA_BLOB confounded_session_key = data_blob_talloc(
821 mem_ctx, NULL, 16);
822 MD5_CTX ctx;
823 uint8_t confounder[16];
824
825 ZERO_STRUCT(u_info);
826
827 i21->full_name.string = talloc_asprintf(
828 mem_ctx, "%s$",
829 cli_credentials_get_workstation(wks_creds));
830 i21->acct_flags = ACB_WSTRUST;
831 i21->fields_present = SAMR_FIELD_FULL_NAME |
832 SAMR_FIELD_ACCT_FLAGS | SAMR_FIELD_NT_PASSWORD_PRESENT;
833 /* this would break the test result expectations
834 i21->fields_present |= SAMR_FIELD_EXPIRED_FLAG;
835 i21->password_expired = 1;
836 */
837
838 encode_pw_buffer(u_info.info25.password.data,
839 cli_credentials_get_password(wks_creds),
840 STR_UNICODE);
841 status = dcerpc_fetch_session_key(samr_pipe, &session_key);
842 if (!NT_STATUS_IS_OK(status)) {
843 torture_comment(tctx, "dcerpc_fetch_session_key failed: %s\n",
844 nt_errstr(status));
845 goto done;
846 }
847 generate_random_buffer((uint8_t *)confounder, 16);
848
849 MD5Init(&ctx);
850 MD5Update(&ctx, confounder, 16);
851 MD5Update(&ctx, session_key.data, session_key.length);
852 MD5Final(confounded_session_key.data, &ctx);
853
854 arcfour_crypt_blob(u_info.info25.password.data, 516,
855 &confounded_session_key);
856 memcpy(&u_info.info25.password.data[516], confounder, 16);
857
858 sui2.in.user_handle = wks_handle;
859 sui2.in.level = 25;
860 sui2.in.info = &u_info;
861
862 status = dcerpc_samr_SetUserInfo2_r(samr_handle, mem_ctx, &sui2);
863 if (!NT_STATUS_IS_OK(status)) {
864 torture_comment(tctx, "samr_SetUserInfo2(25) failed: %s\n",
865 nt_errstr(status));
866 goto done;
867 }
868 if (!NT_STATUS_IS_OK(sui2.out.result)) {
869 torture_comment(tctx, "samr_SetUserInfo2(25) failed: %s\n",
870 nt_errstr(sui2.out.result));
871 goto done;
872 }
873 } else {
874 struct samr_SetUserInfo2 sui2;
875 struct samr_SetUserInfo sui;
876 union samr_UserInfo u_info;
877 DATA_BLOB session_key;
878
879 encode_pw_buffer(u_info.info24.password.data,
880 cli_credentials_get_password(wks_creds),
881 STR_UNICODE);
882 /* just to make this test pass */
883 u_info.info24.password_expired = 1;
884
885 status = dcerpc_fetch_session_key(samr_pipe, &session_key);
886 if (!NT_STATUS_IS_OK(status)) {
887 torture_comment(tctx, "dcerpc_fetch_session_key failed\n");
888 goto done;
889 }
890 arcfour_crypt_blob(u_info.info24.password.data, 516,
891 &session_key);
892 sui2.in.user_handle = wks_handle;
893 sui2.in.info = &u_info;
894 sui2.in.level = 24;
895
896 status = dcerpc_samr_SetUserInfo2_r(samr_handle, mem_ctx, &sui2);
897 if (!NT_STATUS_IS_OK(status)) {
898 torture_comment(tctx, "samr_SetUserInfo(24) failed: %s\n",
899 nt_errstr(status));
900 goto done;
901 }
902 if (!NT_STATUS_IS_OK(sui2.out.result)) {
903 torture_comment(tctx, "samr_SetUserInfo(24) failed: %s\n",
904 nt_errstr(sui2.out.result));
905 goto done;
906 }
907
908 u_info.info16.acct_flags = ACB_WSTRUST;
909 sui.in.user_handle = wks_handle;
910 sui.in.info = &u_info;
911 sui.in.level = 16;
912
913 status = dcerpc_samr_SetUserInfo_r(samr_handle, mem_ctx, &sui);
914 if (!NT_STATUS_IS_OK(status) || !NT_STATUS_IS_OK(sui.out.result)) {
915 torture_comment(tctx, "samr_SetUserInfo(16) failed\n");
916 goto done;
917 }
918 }
919
920 {
921 struct samr_QueryUserInfo q;
922 union samr_UserInfo *info;
923
924 q.in.user_handle = wks_handle;
925 q.in.level = 21;
926 q.out.info = &info;
927
928 status = dcerpc_samr_QueryUserInfo_r(samr_handle, mem_ctx, &q);
929 if (!NT_STATUS_IS_OK(status)) {
930 torture_warning(tctx, "QueryUserInfo failed: %s\n",
931 nt_errstr(status));
932 goto done;
933 }
934 if (!NT_STATUS_IS_OK(q.out.result)) {
935 torture_warning(tctx, "QueryUserInfo failed: %s\n",
936 nt_errstr(q.out.result));
937 goto done;
938 }
939
940 if (use_level25) {
941 if (last_password_change
942 == info->info21.last_password_change) {
943 torture_warning(tctx, "last_password_change unchanged "
944 "during join, level25 must change "
945 "it\n");
946 goto done;
947 }
948 }
949 else {
950 if (last_password_change
951 != info->info21.last_password_change) {
952 torture_warning(tctx, "last_password_change changed "
953 "during join, level24 doesn't "
954 "change it\n");
955 goto done;
956 }
957 }
958 }
959
960 ret = true;
961
962 done:
963 talloc_free(mem_ctx);
964 return ret;
965 }
966
967 /*
968 * Do a ReqChallenge/Auth2 and get the wks creds
969 */
970
971 static bool auth2(struct torture_context *tctx,
972 struct smbcli_state *cli,
973 struct cli_credentials *wks_cred)
974 {
975 TALLOC_CTX *mem_ctx;
976 struct dcerpc_pipe *net_pipe;
977 struct dcerpc_binding_handle *net_handle;
978 bool result = false;
979 NTSTATUS status;
980 struct netr_ServerReqChallenge r;
981 struct netr_Credential netr_cli_creds;
982 struct netr_Credential netr_srv_creds;
983 uint32_t negotiate_flags;
984 struct netr_ServerAuthenticate2 a;
985 struct netlogon_creds_CredentialState *creds_state;
986 struct netr_Credential netr_cred;
987 struct samr_Password mach_pw;
988
989 mem_ctx = talloc_new(NULL);
990 if (mem_ctx == NULL) {
991 torture_comment(tctx, "talloc_new failed\n");
992 return false;
993 }
994
995 status = pipe_bind_smb(tctx, mem_ctx, cli->tree, "\\netlogon",
996 &ndr_table_netlogon, &net_pipe);
997 torture_assert_ntstatus_ok_goto(tctx, status, result, done,
998 "pipe_bind_smb failed");
999 net_handle = net_pipe->binding_handle;
1000
1001 r.in.computer_name = cli_credentials_get_workstation(wks_cred);
1002 r.in.server_name = talloc_asprintf(
1003 mem_ctx, "\\\\%s", dcerpc_server_name(net_pipe));
1004 if (r.in.server_name == NULL) {
1005 torture_comment(tctx, "talloc_asprintf failed\n");
1006 goto done;
1007 }
1008 generate_random_buffer(netr_cli_creds.data,
1009 sizeof(netr_cli_creds.data));
1010 r.in.credentials = &netr_cli_creds;
1011 r.out.return_credentials = &netr_srv_creds;
1012
1013 status = dcerpc_netr_ServerReqChallenge_r(net_handle, mem_ctx, &r);
1014 if (!NT_STATUS_IS_OK(status)) {
1015 torture_comment(tctx, "netr_ServerReqChallenge failed: %s\n",
1016 nt_errstr(status));
1017 goto done;
1018 }
1019 if (!NT_STATUS_IS_OK(r.out.result)) {
1020 torture_comment(tctx, "netr_ServerReqChallenge failed: %s\n",
1021 nt_errstr(r.out.result));
1022 goto done;
1023 }
1024
1025 negotiate_flags = NETLOGON_NEG_AUTH2_FLAGS;
1026 E_md4hash(cli_credentials_get_password(wks_cred), mach_pw.hash);
1027
1028 a.in.server_name = talloc_asprintf(
1029 mem_ctx, "\\\\%s", dcerpc_server_name(net_pipe));
1030 a.in.account_name = talloc_asprintf(
1031 mem_ctx, "%s$", cli_credentials_get_workstation(wks_cred));
1032 a.in.computer_name = cli_credentials_get_workstation(wks_cred);
1033 a.in.secure_channel_type = SEC_CHAN_WKSTA;
1034 a.in.negotiate_flags = &negotiate_flags;
1035 a.out.negotiate_flags = &negotiate_flags;
1036 a.in.credentials = &netr_cred;
1037 a.out.return_credentials = &netr_cred;
1038
1039 creds_state = netlogon_creds_client_init(mem_ctx,
1040 a.in.account_name,
1041 a.in.computer_name,
1042 a.in.secure_channel_type,
1043 r.in.credentials,
1044 r.out.return_credentials, &mach_pw,
1045 &netr_cred, negotiate_flags);
1046 torture_assert(tctx, (creds_state != NULL), "memory allocation failed");
1047
1048 status = dcerpc_netr_ServerAuthenticate2_r(net_handle, mem_ctx, &a);
1049 if (!NT_STATUS_IS_OK(status)) {
1050 torture_comment(tctx, "netr_ServerServerAuthenticate2 failed: %s\n",
1051 nt_errstr(status));
1052 goto done;
1053 }
1054 if (!NT_STATUS_IS_OK(a.out.result)) {
1055 torture_comment(tctx, "netr_ServerServerAuthenticate2 failed: %s\n",
1056 nt_errstr(a.out.result));
1057 goto done;
1058 }
1059
1060 if (!netlogon_creds_client_check(creds_state, a.out.return_credentials)) {
1061 torture_comment(tctx, "creds_client_check failed\n");
1062 goto done;
1063 }
1064
1065 cli_credentials_set_netlogon_creds(wks_cred, creds_state);
1066
1067 result = true;
1068
1069 done:
1070 talloc_free(mem_ctx);
1071 return result;
1072 }
1073
1074 /*
1075 * Do a couple of schannel protected Netlogon ops: Interactive and Network
1076 * login, and change the wks password
1077 */
1078
1079 static bool schan(struct torture_context *tctx,
1080 struct smbcli_state *cli,
1081 struct cli_credentials *wks_creds,
1082 struct cli_credentials *user_creds)
1083 {
1084 TALLOC_CTX *mem_ctx;
1085 NTSTATUS status;
1086 bool ret = false;
1087 struct dcerpc_pipe *net_pipe;
1088 struct dcerpc_binding_handle *net_handle;
1089 int i;
1090
1091 mem_ctx = talloc_new(NULL);
1092 if (mem_ctx == NULL) {
1093 torture_comment(tctx, "talloc_new failed\n");
1094 return false;
1095 }
1096
1097 net_pipe = dcerpc_pipe_init(mem_ctx, tctx->ev);
1098 if (net_pipe == NULL) {
1099 torture_comment(tctx, "dcerpc_pipe_init failed\n");
1100 goto done;
1101 }
1102 net_handle = net_pipe->binding_handle;
1103
1104 status = dcerpc_pipe_open_smb(net_pipe, cli->tree, "\\netlogon");
1105 if (!NT_STATUS_IS_OK(status)) {
1106 torture_comment(tctx, "dcerpc_pipe_open_smb failed: %s\n",
1107 nt_errstr(status));
1108 goto done;
1109 }
1110
1111 #if 0
1112 net_pipe->conn->flags |= DCERPC_DEBUG_PRINT_IN |
1113 DCERPC_DEBUG_PRINT_OUT;
1114 #endif
1115 #if 1
1116 net_pipe->conn->flags |= (DCERPC_SIGN | DCERPC_SEAL);
1117 status = dcerpc_bind_auth(net_pipe, &ndr_table_netlogon,
1118 wks_creds, lpcfg_gensec_settings(tctx->lp_ctx, tctx->lp_ctx), DCERPC_AUTH_TYPE_SCHANNEL,
1119 DCERPC_AUTH_LEVEL_PRIVACY,
1120 NULL);
1121 #else
1122 status = dcerpc_bind_auth_none(net_pipe, &ndr_table_netlogon);
1123 #endif
1124 if (!NT_STATUS_IS_OK(status)) {
1125 torture_comment(tctx, "schannel bind failed: %s\n", nt_errstr(status));
1126 goto done;
1127 }
1128
1129
1130 for (i=2; i<4; i++) {
1131 int flags;
1132 DATA_BLOB chal, nt_resp, lm_resp, names_blob;
1133 struct netlogon_creds_CredentialState *creds_state;
1134 struct netr_Authenticator netr_auth, netr_auth2;
1135 struct netr_NetworkInfo ninfo;
1136 struct netr_PasswordInfo pinfo;
1137 struct netr_LogonSamLogon r;
1138 union netr_LogonLevel logon;
1139 union netr_Validation validation;
1140 uint8_t authoritative;
1141 struct netr_Authenticator return_authenticator;
1142
1143 flags = CLI_CRED_LANMAN_AUTH | CLI_CRED_NTLM_AUTH |
1144 CLI_CRED_NTLMv2_AUTH;
1145
1146 chal = data_blob_talloc(mem_ctx, NULL, 8);
1147 if (chal.data == NULL) {
1148 torture_comment(tctx, "data_blob_talloc failed\n");
1149 goto done;
1150 }
1151
1152 generate_random_buffer(chal.data, chal.length);
1153 names_blob = NTLMv2_generate_names_blob(
1154 mem_ctx,
1155 cli_credentials_get_workstation(user_creds),
1156 cli_credentials_get_domain(user_creds));
1157 status = cli_credentials_get_ntlm_response(
1158 user_creds, mem_ctx, &flags, chal, names_blob,
1159 &lm_resp, &nt_resp, NULL, NULL);
1160 if (!NT_STATUS_IS_OK(status)) {
1161 torture_comment(tctx, "cli_credentials_get_ntlm_response failed:"
1162 " %s\n", nt_errstr(status));
1163 goto done;
1164 }
1165
1166 creds_state = cli_credentials_get_netlogon_creds(wks_creds);
1167 netlogon_creds_client_authenticator(creds_state, &netr_auth);
1168
1169 ninfo.identity_info.account_name.string =
1170 cli_credentials_get_username(user_creds);
1171 ninfo.identity_info.domain_name.string =
1172 cli_credentials_get_domain(user_creds);
1173 ninfo.identity_info.parameter_control = 0;
1174 ninfo.identity_info.logon_id_low = 0;
1175 ninfo.identity_info.logon_id_high = 0;
1176 ninfo.identity_info.workstation.string =
1177 cli_credentials_get_workstation(user_creds);
1178 memcpy(ninfo.challenge, chal.data, sizeof(ninfo.challenge));
1179 ninfo.nt.length = nt_resp.length;
1180 ninfo.nt.data = nt_resp.data;
1181 ninfo.lm.length = lm_resp.length;
1182 ninfo.lm.data = lm_resp.data;
1183
1184 logon.network = &ninfo;
1185
1186 r.in.server_name = talloc_asprintf(
1187 mem_ctx, "\\\\%s", dcerpc_server_name(net_pipe));
1188 ZERO_STRUCT(netr_auth2);
1189 r.in.computer_name =
1190 cli_credentials_get_workstation(wks_creds);
1191 r.in.credential = &netr_auth;
1192 r.in.return_authenticator = &netr_auth2;
1193 r.in.logon_level = NetlogonNetworkInformation;
1194 r.in.validation_level = i;
1195 r.in.logon = &logon;
1196 r.out.validation = &validation;
1197 r.out.authoritative = &authoritative;
1198 r.out.return_authenticator = &return_authenticator;
1199
1200 status = dcerpc_netr_LogonSamLogon_r(net_handle, mem_ctx, &r);
1201 if (!NT_STATUS_IS_OK(status)) {
1202 torture_comment(tctx, "netr_LogonSamLogon failed: %s\n",
1203 nt_errstr(status));
1204 goto done;
1205 }
1206 if (!NT_STATUS_IS_OK(r.out.result)) {
1207 torture_comment(tctx, "netr_LogonSamLogon failed: %s\n",
1208 nt_errstr(r.out.result));
1209 goto done;
1210 }
1211
1212 if ((r.out.return_authenticator == NULL) ||
1213 (!netlogon_creds_client_check(creds_state,
1214 &r.out.return_authenticator->cred))) {
1215 torture_comment(tctx, "Credentials check failed!\n");
1216 goto done;
1217 }
1218
1219 netlogon_creds_client_authenticator(creds_state, &netr_auth);
1220
1221 pinfo.identity_info = ninfo.identity_info;
1222 ZERO_STRUCT(pinfo.lmpassword.hash);
1223 E_md4hash(cli_credentials_get_password(user_creds),
1224 pinfo.ntpassword.hash);
1225
1226 netlogon_creds_arcfour_crypt(creds_state, pinfo.ntpassword.hash, 16);
1227
1228 logon.password = &pinfo;
1229
1230 r.in.logon_level = NetlogonInteractiveInformation;
1231 r.in.logon = &logon;
1232 r.out.return_authenticator = &return_authenticator;
1233
1234 status = dcerpc_netr_LogonSamLogon_r(net_handle, mem_ctx, &r);
1235 if (!NT_STATUS_IS_OK(status)) {
1236 torture_comment(tctx, "netr_LogonSamLogon failed: %s\n",
1237 nt_errstr(status));
1238 goto done;
1239 }
1240 if (!NT_STATUS_IS_OK(r.out.result)) {
1241 torture_comment(tctx, "netr_LogonSamLogon failed: %s\n",
1242 nt_errstr(r.out.result));
1243 goto done;
1244 }
1245
1246 if ((r.out.return_authenticator == NULL) ||
1247 (!netlogon_creds_client_check(creds_state,
1248 &r.out.return_authenticator->cred))) {
1249 torture_comment(tctx, "Credentials check failed!\n");
1250 goto done;
1251 }
1252 }
1253
1254 {
1255 struct netr_ServerPasswordSet s;
1256 char *password = generate_random_password(wks_creds, 8, 255);
1257 struct netlogon_creds_CredentialState *creds_state;
1258 struct netr_Authenticator credential, return_authenticator;
1259 struct samr_Password new_password;
1260
1261 s.in.server_name = talloc_asprintf(
1262 mem_ctx, "\\\\%s", dcerpc_server_name(net_pipe));
1263 s.in.computer_name = cli_credentials_get_workstation(wks_creds);
1264 s.in.account_name = talloc_asprintf(
1265 mem_ctx, "%s$", s.in.computer_name);
1266 s.in.secure_channel_type = SEC_CHAN_WKSTA;
1267 s.in.credential = &credential;
1268 s.in.new_password = &new_password;
1269 s.out.return_authenticator = &return_authenticator;
1270
1271 E_md4hash(password, new_password.hash);
1272
1273 creds_state = cli_credentials_get_netlogon_creds(wks_creds);
1274 netlogon_creds_des_encrypt(creds_state, &new_password);
1275 netlogon_creds_client_authenticator(creds_state, &credential);
1276
1277 status = dcerpc_netr_ServerPasswordSet_r(net_handle, mem_ctx, &s);
1278 if (!NT_STATUS_IS_OK(status)) {
1279 torture_comment(tctx, "ServerPasswordSet - %s\n", nt_errstr(status));
1280 goto done;
1281 }
1282 if (!NT_STATUS_IS_OK(s.out.result)) {
1283 torture_comment(tctx, "ServerPasswordSet - %s\n", nt_errstr(s.out.result));
1284 goto done;
1285 }
1286
1287 if (!netlogon_creds_client_check(creds_state,
1288 &s.out.return_authenticator->cred)) {
1289 torture_comment(tctx, "Credential chaining failed\n");
1290 }
1291
1292 cli_credentials_set_password(wks_creds, password,
1293 CRED_SPECIFIED);
1294 }
1295
1296 ret = true;
1297 done:
1298 talloc_free(mem_ctx);
1299 return ret;
1300 }
1301
1302 /*
1303 * Delete the wks account again
1304 */
1305
1306 static bool leave(struct torture_context *tctx,
1307 struct smbcli_state *cli,
1308 struct cli_credentials *admin_creds,
1309 struct cli_credentials *wks_creds)
1310 {
1311 char *wks_name = talloc_asprintf(
1312 NULL, "%s$", cli_credentials_get_workstation(wks_creds));
1313 bool ret;
1314
1315 ret = delete_user(tctx, cli, admin_creds, wks_name);
1316 talloc_free(wks_name);
1317 return ret;
1318 }
1319
1320 /*
1321 * Test the Samba3 DC code a bit. Join, do some schan netlogon ops, leave
1322 */
1323
1324 static bool torture_netlogon_samba3(struct torture_context *torture)
1325 {
1326 NTSTATUS status;
1327 struct smbcli_state *cli;
1328 struct cli_credentials *anon_creds;
1329 struct cli_credentials *wks_creds;
1330 const char *wks_name;
1331 int i;
1332 struct smbcli_options options;
1333 struct smbcli_session_options session_options;
1334
1335 wks_name = torture_setting_string(torture, "wksname", NULL);
1336 if (wks_name == NULL) {
1337 wks_name = get_myname(torture);
1338 }
1339
1340 if (!(anon_creds = cli_credentials_init_anon(torture))) {
1341 torture_fail(torture, "create_anon_creds failed\n");
1342 }
1343
1344 lpcfg_smbcli_options(torture->lp_ctx, &options);
1345 lpcfg_smbcli_session_options(torture->lp_ctx, &session_options);
1346
1347 status = smbcli_full_connection(torture, &cli,
1348 torture_setting_string(torture, "host", NULL),
1349 lpcfg_smb_ports(torture->lp_ctx),
1350 "IPC$", NULL,
1351 lpcfg_socket_options(torture->lp_ctx),
1352 anon_creds,
1353 lpcfg_resolve_context(torture->lp_ctx),
1354 torture->ev, &options, &session_options,
1355 lpcfg_gensec_settings(torture, torture->lp_ctx));
1356 torture_assert_ntstatus_ok(torture, status, "smbcli_full_connection failed\n");
1357
1358 wks_creds = cli_credentials_init(torture);
1359 if (wks_creds == NULL) {
1360 torture_fail(torture, "cli_credentials_init failed\n");
1361 }
1362
1363 cli_credentials_set_conf(wks_creds, torture->lp_ctx);
1364 cli_credentials_set_secure_channel_type(wks_creds, SEC_CHAN_WKSTA);
1365 cli_credentials_set_username(wks_creds, wks_name, CRED_SPECIFIED);
1366 cli_credentials_set_workstation(wks_creds, wks_name, CRED_SPECIFIED);
1367 cli_credentials_set_password(wks_creds,
1368 generate_random_password(wks_creds, 8, 255),
1369 CRED_SPECIFIED);
1370
1371 torture_assert(torture,
1372 join3(torture, cli, false, cmdline_credentials, wks_creds),
1373 "join failed");
1374
1375 cli_credentials_set_domain(
1376 cmdline_credentials, cli_credentials_get_domain(wks_creds),
1377 CRED_SPECIFIED);
1378
1379 for (i=0; i<2; i++) {
1380
1381 /* Do this more than once, the routine "schan" changes
1382 * the workstation password using the netlogon
1383 * password change routine */
1384
1385 int j;
1386
1387 torture_assert(torture,
1388 auth2(torture, cli, wks_creds),
1389 "auth2 failed");
1390
1391 for (j=0; j<2; j++) {
1392 torture_assert(torture,
1393 schan(torture, cli, wks_creds, cmdline_credentials),
1394 "schan failed");
1395 }
1396 }
1397
1398 torture_assert(torture,
1399 leave(torture, cli, cmdline_credentials, wks_creds),
1400 "leave failed");
1401
1402 return true;
1403 }
1404
1405 /*
1406 * Do a simple join, testjoin and leave using specified smb and samr
1407 * credentials
1408 */
1409
1410 static bool test_join3(struct torture_context *tctx,
1411 bool use_level25,
1412 struct cli_credentials *smb_creds,
1413 struct cli_credentials *samr_creds,
1414 const char *wks_name)
1415 {
1416 NTSTATUS status;
1417 struct smbcli_state *cli;
1418 struct cli_credentials *wks_creds;
1419 struct smbcli_options options;
1420 struct smbcli_session_options session_options;
1421
1422 lpcfg_smbcli_options(tctx->lp_ctx, &options);
1423 lpcfg_smbcli_session_options(tctx->lp_ctx, &session_options);
1424
1425 status = smbcli_full_connection(tctx, &cli,
1426 torture_setting_string(tctx, "host", NULL),
1427 lpcfg_smb_ports(tctx->lp_ctx),
1428 "IPC$", NULL, lpcfg_socket_options(tctx->lp_ctx),
1429 smb_creds, lpcfg_resolve_context(tctx->lp_ctx),
1430 tctx->ev, &options, &session_options,
1431 lpcfg_gensec_settings(tctx, tctx->lp_ctx));
1432 torture_assert_ntstatus_ok(tctx, status,
1433 "smbcli_full_connection failed");
1434
1435 wks_creds = cli_credentials_init(cli);
1436 torture_assert(tctx, wks_creds, "cli_credentials_init failed");
1437
1438 cli_credentials_set_conf(wks_creds, tctx->lp_ctx);
1439 cli_credentials_set_secure_channel_type(wks_creds, SEC_CHAN_WKSTA);
1440 cli_credentials_set_username(wks_creds, wks_name, CRED_SPECIFIED);
1441 cli_credentials_set_workstation(wks_creds, wks_name, CRED_SPECIFIED);
1442 cli_credentials_set_password(wks_creds,
1443 generate_random_password(wks_creds, 8, 255),
1444 CRED_SPECIFIED);
1445
1446 torture_assert(tctx,
1447 join3(tctx, cli, use_level25, samr_creds, wks_creds),
1448 "join failed");
1449
1450 cli_credentials_set_domain(
1451 cmdline_credentials, cli_credentials_get_domain(wks_creds),
1452 CRED_SPECIFIED);
1453
1454 torture_assert(tctx,
1455 auth2(tctx, cli, wks_creds),
1456 "auth2 failed");
1457
1458 torture_assert(tctx,
1459 leave(tctx, cli, samr_creds, wks_creds),
1460 "leave failed");
1461
1462 talloc_free(cli);
1463
1464 return true;
1465 }
1466
1467 /*
1468 * Test the different session key variants. Do it by joining, this uses the
1469 * session key in the setpassword routine. Test the join by doing the auth2.
1470 */
1471
1472 static bool torture_samba3_sessionkey(struct torture_context *torture)
1473 {
1474 struct cli_credentials *anon_creds;
1475 const char *wks_name;
1476
1477 wks_name = torture_setting_string(torture, "wksname", get_myname(torture));
1478
1479 if (!(anon_creds = cli_credentials_init_anon(torture))) {
1480 torture_fail(torture, "create_anon_creds failed\n");
1481 }
1482
1483 cli_credentials_set_workstation(anon_creds, wks_name, CRED_SPECIFIED);
1484
1485
1486 if (!torture_setting_bool(torture, "samba3", false)) {
1487
1488 /* Samba3 in the build farm right now does this happily. Need
1489 * to fix :-) */
1490
1491 if (test_join3(torture, false, anon_creds, NULL, wks_name)) {
1492 torture_fail(torture, "join using anonymous bind on an anonymous smb "
1493 "connection succeeded -- HUH??\n");
1494 }
1495 }
1496
1497 torture_assert(torture,
1498 test_join3(torture, false, anon_creds, cmdline_credentials, wks_name),
1499 "join using ntlmssp bind on an anonymous smb connection failed");
1500
1501 torture_assert(torture,
1502 test_join3(torture, false, cmdline_credentials, NULL, wks_name),
1503 "join using anonymous bind on an authenticated smb connection failed");
1504
1505 torture_assert(torture,
1506 test_join3(torture, false, cmdline_credentials, cmdline_credentials, wks_name),
1507 "join using ntlmssp bind on an authenticated smb connection failed");
1508
1509 /*
1510 * The following two are tests for setuserinfolevel 25
1511 */
1512
1513 torture_assert(torture,
1514 test_join3(torture, true, anon_creds, cmdline_credentials, wks_name),
1515 "join using ntlmssp bind on an anonymous smb connection failed");
1516
1517 torture_assert(torture,
1518 test_join3(torture, true, cmdline_credentials, NULL, wks_name),
1519 "join using anonymous bind on an authenticated smb connection failed");
1520
1521 return true;
1522 }
1523
1524 /*
1525 * Sane wrapper around lsa_LookupNames
1526 */
1527
1528 static struct dom_sid *name2sid(struct torture_context *tctx,
1529 TALLOC_CTX *mem_ctx,
1530 struct dcerpc_pipe *p,
1531 const char *name,
1532 const char *domain)
1533 {
1534 struct lsa_ObjectAttribute attr;
1535 struct lsa_QosInfo qos;
1536 struct lsa_OpenPolicy2 r;
1537 struct lsa_Close c;
1538 NTSTATUS status;
1539 struct policy_handle handle;
1540 struct lsa_LookupNames l;
1541 struct lsa_TransSidArray sids;
1542 struct lsa_RefDomainList *domains = NULL;
1543 struct lsa_String lsa_name;
1544 uint32_t count = 0;
1545 struct dom_sid *result;
1546 TALLOC_CTX *tmp_ctx;
1547 struct dcerpc_binding_handle *b = p->binding_handle;
1548
1549 if (!(tmp_ctx = talloc_new(mem_ctx))) {
1550 return NULL;
1551 }
1552
1553 qos.len = 0;
1554 qos.impersonation_level = 2;
1555 qos.context_mode = 1;
1556 qos.effective_only = 0;
1557
1558 attr.len = 0;
1559 attr.root_dir = NULL;
1560 attr.object_name = NULL;
1561 attr.attributes = 0;
1562 attr.sec_desc = NULL;
1563 attr.sec_qos = &qos;
1564
1565 r.in.system_name = "\\";
1566 r.in.attr = &attr;
1567 r.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
1568 r.out.handle = &handle;
1569
1570 status = dcerpc_lsa_OpenPolicy2_r(b, tmp_ctx, &r);
1571 if (!NT_STATUS_IS_OK(status)) {
1572 torture_comment(tctx, "OpenPolicy2 failed - %s\n", nt_errstr(status));
1573 talloc_free(tmp_ctx);
1574 return NULL;
1575 }
1576 if (!NT_STATUS_IS_OK(r.out.result)) {
1577 torture_comment(tctx, "OpenPolicy2 failed - %s\n", nt_errstr(r.out.result));
1578 talloc_free(tmp_ctx);
1579 return NULL;
1580 }
1581
1582 sids.count = 0;
1583 sids.sids = NULL;
1584
1585 lsa_name.string = talloc_asprintf(tmp_ctx, "%s\\%s", domain, name);
1586
1587 l.in.handle = &handle;
1588 l.in.num_names = 1;
1589 l.in.names = &lsa_name;
1590 l.in.sids = &sids;
1591 l.in.level = 1;
1592 l.in.count = &count;
1593 l.out.count = &count;
1594 l.out.sids = &sids;
1595 l.out.domains = &domains;
1596
1597 status = dcerpc_lsa_LookupNames_r(b, tmp_ctx, &l);
1598 if (!NT_STATUS_IS_OK(status)) {
1599 torture_comment(tctx, "LookupNames of %s failed - %s\n", lsa_name.string,
1600 nt_errstr(status));
1601 talloc_free(tmp_ctx);
1602 return NULL;
1603 }
1604 if (!NT_STATUS_IS_OK(l.out.result)) {
1605 torture_comment(tctx, "LookupNames of %s failed - %s\n", lsa_name.string,
1606 nt_errstr(l.out.result));
1607 talloc_free(tmp_ctx);
1608 return NULL;
1609 }
1610
1611 result = dom_sid_add_rid(mem_ctx, domains->domains[0].sid,
1612 l.out.sids->sids[0].rid);
1613
1614 c.in.handle = &handle;
1615 c.out.handle = &handle;
1616
1617 status = dcerpc_lsa_Close_r(b, tmp_ctx, &c);
1618 if (!NT_STATUS_IS_OK(status)) {
1619 torture_comment(tctx, "dcerpc_lsa_Close failed - %s\n", nt_errstr(status));
1620 talloc_free(tmp_ctx);
1621 return NULL;
1622 }
1623 if (!NT_STATUS_IS_OK(c.out.result)) {
1624 torture_comment(tctx, "dcerpc_lsa_Close failed - %s\n", nt_errstr(c.out.result));
1625 talloc_free(tmp_ctx);
1626 return NULL;
1627 }
1628
1629 talloc_free(tmp_ctx);
1630 return result;
1631 }
1632
1633 /*
1634 * Find out the user SID on this connection
1635 */
1636
1637 static struct dom_sid *whoami(struct torture_context *tctx,
1638 TALLOC_CTX *mem_ctx,
1639 struct smbcli_tree *tree)
1640 {
1641 struct dcerpc_pipe *lsa;
1642 struct dcerpc_binding_handle *lsa_handle;
1643 struct lsa_GetUserName r;
1644 NTSTATUS status;
1645 struct lsa_String *authority_name_p = NULL;
1646 struct lsa_String *account_name_p = NULL;
1647 struct dom_sid *result;
1648
1649 status = pipe_bind_smb(tctx, mem_ctx, tree, "\\pipe\\lsarpc",
1650 &ndr_table_lsarpc, &lsa);
1651 if (!NT_STATUS_IS_OK(status)) {
1652 torture_warning(tctx, "Could not bind to LSA: %s\n",
1653 nt_errstr(status));
1654 return NULL;
1655 }
1656 lsa_handle = lsa->binding_handle;
1657
1658 r.in.system_name = "\\";
1659 r.in.account_name = &account_name_p;
1660 r.in.authority_name = &authority_name_p;
1661 r.out.account_name = &account_name_p;
1662
1663 status = dcerpc_lsa_GetUserName_r(lsa_handle, mem_ctx, &r);
1664
1665 authority_name_p = *r.out.authority_name;
1666
1667 if (!NT_STATUS_IS_OK(status)) {
1668 torture_warning(tctx, "GetUserName failed - %s\n",
1669 nt_errstr(status));
1670 talloc_free(lsa);
1671 return NULL;
1672 }
1673 if (!NT_STATUS_IS_OK(r.out.result)) {
1674 torture_warning(tctx, "GetUserName failed - %s\n",
1675 nt_errstr(r.out.result));
1676 talloc_free(lsa);
1677 return NULL;
1678 }
1679
1680 result = name2sid(tctx, mem_ctx, lsa, account_name_p->string,
1681 authority_name_p->string);
1682
1683 talloc_free(lsa);
1684 return result;
1685 }
1686
1687 static int destroy_tree(struct smbcli_tree *tree)
1688 {
1689 smb_tree_disconnect(tree);
1690 return 0;
1691 }
1692
1693 /*
1694 * Do a tcon, given a session
1695 */
1696
1697 static NTSTATUS secondary_tcon(struct torture_context *tctx,
1698 TALLOC_CTX *mem_ctx,
1699 struct smbcli_session *session,
1700 const char *sharename,
1701 struct smbcli_tree **res)
1702 {
1703 struct smbcli_tree *result;
1704 TALLOC_CTX *tmp_ctx;
1705 union smb_tcon tcon;
1706 NTSTATUS status;
1707
1708 if (!(tmp_ctx = talloc_new(mem_ctx))) {
1709 return NT_STATUS_NO_MEMORY;
1710 }
1711
1712 if (!(result = smbcli_tree_init(session, mem_ctx, false))) {
1713 talloc_free(tmp_ctx);
1714 return NT_STATUS_NO_MEMORY;
1715 }
1716
1717 tcon.generic.level = RAW_TCON_TCONX;
1718 tcon.tconx.in.flags = TCONX_FLAG_EXTENDED_RESPONSE;
1719 tcon.tconx.in.flags |= TCONX_FLAG_EXTENDED_SIGNATURES;
1720 tcon.tconx.in.password = data_blob(NULL, 0);
1721 tcon.tconx.in.path = sharename;
1722 tcon.tconx.in.device = "?????";
1723
1724 status = smb_raw_tcon(result, tmp_ctx, &tcon);
1725 if (!NT_STATUS_IS_OK(status)) {
1726 torture_warning(tctx, "smb_raw_tcon failed: %s\n",
1727 nt_errstr(status));
1728 talloc_free(tmp_ctx);
1729 return status;
1730 }
1731
1732 result->tid = tcon.tconx.out.tid;
1733
1734 if (tcon.tconx.out.options & SMB_EXTENDED_SIGNATURES) {
1735 smb1cli_session_protect_session_key(result->session->smbXcli);
1736 }
1737
1738 result = talloc_steal(mem_ctx, result);
1739 talloc_set_destructor(result, destroy_tree);
1740 talloc_free(tmp_ctx);
1741 *res = result;
1742 return NT_STATUS_OK;
1743 }
1744
1745 /*
1746 * Test the getusername behaviour
1747 */
1748
1749 static bool torture_samba3_rpc_getusername(struct torture_context *torture)
1750 {
1751 NTSTATUS status;
1752 struct smbcli_state *cli;
1753 bool ret = true;
1754 struct dom_sid *user_sid;
1755 struct dom_sid *created_sid;
1756 struct cli_credentials *anon_creds;
1757 struct cli_credentials *user_creds;
1758 char *domain_name;
1759 struct smbcli_options options;
1760 struct smbcli_session_options session_options;
1761
1762 lpcfg_smbcli_options(torture->lp_ctx, &options);
1763 lpcfg_smbcli_session_options(torture->lp_ctx, &session_options);
1764
1765 status = smbcli_full_connection(
1766 torture, &cli, torture_setting_string(torture, "host", NULL),
1767 lpcfg_smb_ports(torture->lp_ctx),
1768 "IPC$", NULL, lpcfg_socket_options(torture->lp_ctx), cmdline_credentials,
1769 lpcfg_resolve_context(torture->lp_ctx), torture->ev, &options,
1770 &session_options, lpcfg_gensec_settings(torture, torture->lp_ctx));
1771 torture_assert_ntstatus_ok(torture, status, "smbcli_full_connection failed\n");
1772
1773 if (!(user_sid = whoami(torture, torture, cli->tree))) {
1774 torture_fail(torture, "whoami on auth'ed connection failed\n");
1775 }
1776
1777 talloc_free(cli);
1778
1779 if (!(anon_creds = cli_credentials_init_anon(torture))) {
1780 torture_fail(torture, "create_anon_creds failed\n");
1781 }
1782
1783 status = smbcli_full_connection(
1784 torture, &cli, torture_setting_string(torture, "host", NULL),
1785 lpcfg_smb_ports(torture->lp_ctx), "IPC$", NULL,
1786 lpcfg_socket_options(torture->lp_ctx), anon_creds,
1787 lpcfg_resolve_context(torture->lp_ctx),
1788 torture->ev, &options, &session_options,
1789 lpcfg_gensec_settings(torture, torture->lp_ctx));
1790 torture_assert_ntstatus_ok(torture, status, "anon smbcli_full_connection failed\n");
1791
1792 if (!(user_sid = whoami(torture, torture, cli->tree))) {
1793 torture_fail(torture, "whoami on anon connection failed\n");
1794 }
1795
1796 torture_assert_sid_equal(torture, user_sid, dom_sid_parse_talloc(torture, "s-1-5-7"),
1797 "Anon lsa_GetUserName returned unexpected SID");
1798
1799 if (!(user_creds = cli_credentials_init(torture))) {
1800 torture_fail(torture, "cli_credentials_init failed\n");
1801 }
1802
1803 cli_credentials_set_conf(user_creds, torture->lp_ctx);
1804 cli_credentials_set_username(user_creds, "torture_username",
1805 CRED_SPECIFIED);
1806 cli_credentials_set_password(user_creds,
1807 generate_random_password(user_creds, 8, 255),
1808 CRED_SPECIFIED);
1809
1810 if (!create_user(torture, torture, cli, cmdline_credentials,
1811 cli_credentials_get_username(user_creds),
1812 cli_credentials_get_password(user_creds),
1813 &domain_name, &created_sid)) {
1814 torture_fail(torture, "create_user failed\n");
1815 }
1816
1817 cli_credentials_set_domain(user_creds, domain_name,
1818 CRED_SPECIFIED);
1819
1820 {
1821 struct smbcli_session *session2;
1822 struct smb_composite_sesssetup setup;
1823 struct smbcli_tree *tree;
1824
1825 session2 = smbcli_session_init(cli->transport, torture, false, session_options);
1826 if (session2 == NULL) {
1827 torture_fail(torture, "smbcli_session_init failed\n");
1828 }
1829
1830 setup.in.sesskey = cli->transport->negotiate.sesskey;
1831 setup.in.capabilities = cli->transport->negotiate.capabilities;
1832 setup.in.workgroup = "";
1833 setup.in.credentials = user_creds;
1834 setup.in.gensec_settings = lpcfg_gensec_settings(torture, torture->lp_ctx);
1835
1836 status = smb_composite_sesssetup(session2, &setup);
1837 torture_assert_ntstatus_ok(torture, status, "session setup with new user failed");
1838
1839 session2->vuid = setup.out.vuid;
1840
1841 if (!NT_STATUS_IS_OK(secondary_tcon(torture, torture, session2,
1842 "IPC$", &tree))) {
1843 torture_fail(torture, "secondary_tcon failed\n");
1844 }
1845
1846 if (!(user_sid = whoami(torture, torture, tree))) {
1847 torture_fail_goto(torture, del, "whoami on user connection failed\n");
1848 ret = false;
1849 goto del;
1850 }
1851
1852 talloc_free(tree);
1853 }
1854
1855 torture_comment(torture, "Created %s, found %s\n",
1856 dom_sid_string(torture, created_sid),
1857 dom_sid_string(torture, user_sid));
1858
1859 if (!dom_sid_equal(created_sid, user_sid)) {
1860 ret = false;
1861 }
1862
1863 del:
1864 if (!delete_user(torture, cli,
1865 cmdline_credentials,
1866 cli_credentials_get_username(user_creds))) {
1867 torture_fail(torture, "delete_user failed\n");
1868 }
1869
1870 return ret;
1871 }
1872
1873 static bool test_NetShareGetInfo(struct torture_context *tctx,
1874 struct dcerpc_pipe *p,
1875 const char *sharename)
1876 {
1877 NTSTATUS status;
1878 struct srvsvc_NetShareGetInfo r;
1879 union srvsvc_NetShareInfo info;
1880 uint32_t levels[] = { 0, 1, 2, 501, 502, 1004, 1005, 1006, 1007, 1501 };
1881 int i;
1882 bool ret = true;
1883 struct dcerpc_binding_handle *b = p->binding_handle;
1884
1885 r.in.server_unc = talloc_asprintf(tctx, "\\\\%s",
1886 dcerpc_server_name(p));
1887 r.in.share_name = sharename;
1888 r.out.info = &info;
1889
1890 for (i=0;i<ARRAY_SIZE(levels);i++) {
1891 r.in.level = levels[i];
1892
1893 torture_comment(tctx, "Testing NetShareGetInfo level %u on share '%s'\n",
1894 r.in.level, r.in.share_name);
1895
1896 status = dcerpc_srvsvc_NetShareGetInfo_r(b, tctx, &r);
1897 if (!NT_STATUS_IS_OK(status)) {
1898 torture_warning(tctx, "NetShareGetInfo level %u on share '%s' failed"
1899 " - %s\n", r.in.level, r.in.share_name,
1900 nt_errstr(status));
1901 ret = false;
1902 continue;
1903 }
1904 if (!W_ERROR_IS_OK(r.out.result)) {
1905 torture_warning(tctx, "NetShareGetInfo level %u on share '%s' failed "
1906 "- %s\n", r.in.level, r.in.share_name,
1907 win_errstr(r.out.result));
1908 ret = false;
1909 continue;
1910 }
1911 }
1912
1913 return ret;
1914 }
1915
1916 static bool test_NetShareEnum(struct torture_context *tctx,
1917 struct dcerpc_pipe *p,
1918 const char **one_sharename)
1919 {
1920 NTSTATUS status;
1921 struct srvsvc_NetShareEnum r;
1922 struct srvsvc_NetShareInfoCtr info_ctr;
1923 struct srvsvc_NetShareCtr0 c0;
1924 struct srvsvc_NetShareCtr1 c1;
1925 struct srvsvc_NetShareCtr2 c2;
1926 struct srvsvc_NetShareCtr501 c501;
1927 struct srvsvc_NetShareCtr502 c502;
1928 struct srvsvc_NetShareCtr1004 c1004;
1929 struct srvsvc_NetShareCtr1005 c1005;
1930 struct srvsvc_NetShareCtr1006 c1006;
1931 struct srvsvc_NetShareCtr1007 c1007;
1932 uint32_t totalentries = 0;
1933 uint32_t levels[] = { 0, 1, 2, 501, 502, 1004, 1005, 1006, 1007 };
1934 int i;
1935 bool ret = true;
1936 struct dcerpc_binding_handle *b = p->binding_handle;
1937
1938 ZERO_STRUCT(info_ctr);
1939
1940 r.in.server_unc = talloc_asprintf(tctx,"\\\\%s",dcerpc_server_name(p));
1941 r.in.info_ctr = &info_ctr;
1942 r.in.max_buffer = (uint32_t)-1;
1943 r.in.resume_handle = NULL;
1944 r.out.totalentries = &totalentries;
1945 r.out.info_ctr = &info_ctr;
1946
1947 for (i=0;i<ARRAY_SIZE(levels);i++) {
1948 info_ctr.level = levels[i];
1949
1950 switch (info_ctr.level) {
1951 case 0:
1952 ZERO_STRUCT(c0);
1953 info_ctr.ctr.ctr0 = &c0;
1954 break;
1955 case 1:
1956 ZERO_STRUCT(c1);
1957 info_ctr.ctr.ctr1 = &c1;
1958 break;
1959 case 2:
1960 ZERO_STRUCT(c2);
1961 info_ctr.ctr.ctr2 = &c2;
1962 break;
1963 case 501:
1964 ZERO_STRUCT(c501);
1965 info_ctr.ctr.ctr501 = &c501;
1966 break;
1967 case 502:
1968 ZERO_STRUCT(c502);
1969 info_ctr.ctr.ctr502 = &c502;
1970 break;
1971 case 1004:
1972 ZERO_STRUCT(c1004);
1973 info_ctr.ctr.ctr1004 = &c1004;
1974 break;
1975 case 1005:
1976 ZERO_STRUCT(c1005);
1977 info_ctr.ctr.ctr1005 = &c1005;
1978 break;
1979 case 1006:
1980 ZERO_STRUCT(c1006);
1981 info_ctr.ctr.ctr1006 = &c1006;
1982 break;
1983 case 1007:
1984 ZERO_STRUCT(c1007);
1985 info_ctr.ctr.ctr1007 = &c1007;
1986 break;
1987 }
1988
1989 torture_comment(tctx, "Testing NetShareEnum level %u\n", info_ctr.level);
1990
1991 status = dcerpc_srvsvc_NetShareEnum_r(b, tctx, &r);
1992 if (!NT_STATUS_IS_OK(status)) {
1993 torture_warning(tctx, "NetShareEnum level %u failed - %s\n",
1994 info_ctr.level, nt_errstr(status));
1995 ret = false;
1996 continue;
1997 }
1998 if (!W_ERROR_IS_OK(r.out.result)) {
1999 torture_warning(tctx, "NetShareEnum level %u failed - %s\n",
2000 info_ctr.level, win_errstr(r.out.result));
2001 continue;
2002 }
2003 if (info_ctr.level == 0) {
2004 struct srvsvc_NetShareCtr0 *ctr = r.out.info_ctr->ctr.ctr0;
2005 if (ctr->count > 0) {
2006 *one_sharename = ctr->array[0].name;
2007 }
2008 }
2009 }
2010
2011 return ret;
2012 }
2013
2014 static bool torture_samba3_rpc_srvsvc(struct torture_context *torture)
2015 {
2016 struct dcerpc_pipe *p;
2017 const char *sharename = NULL;
2018 bool ret = true;
2019
2020 torture_assert_ntstatus_ok(torture,
2021 torture_rpc_connection(torture, &p, &ndr_table_srvsvc),
2022 "failed to open srvsvc");
2023
2024 ret &= test_NetShareEnum(torture, p, &sharename);
2025 if (sharename == NULL) {
2026 torture_comment(torture, "did not get sharename\n");
2027 } else {
2028 ret &= test_NetShareGetInfo(torture, p, sharename);
2029 }
2030
2031 return ret;
2032 }
2033
2034 /*
2035 * Do a ReqChallenge/Auth2 with a random wks name, make sure it returns
2036 * NT_STATUS_NO_SAM_ACCOUNT
2037 */
2038
2039 static bool torture_samba3_rpc_randomauth2(struct torture_context *torture)
2040 {
2041 TALLOC_CTX *mem_ctx;
2042 struct dcerpc_pipe *net_pipe;
2043 struct dcerpc_binding_handle *net_handle;
2044 char *wksname;
2045 bool result = false;
2046 NTSTATUS status;
2047 struct netr_ServerReqChallenge r;
2048 struct netr_Credential netr_cli_creds;
2049 struct netr_Credential netr_srv_creds;
2050 uint32_t negotiate_flags;
2051 struct netr_ServerAuthenticate2 a;
2052 struct netlogon_creds_CredentialState *creds_state;
2053 struct netr_Credential netr_cred;
2054 struct samr_Password mach_pw;
2055 struct smbcli_state *cli;
2056
2057 if (!(mem_ctx = talloc_new(torture))) {
2058 torture_comment(torture, "talloc_new failed\n");
2059 return false;
2060 }
2061
2062 if (!(wksname = generate_random_str_list(
2063 mem_ctx, 14, "ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789"))) {
2064 torture_comment(torture, "generate_random_str_list failed\n");
2065 goto done;
2066 }
2067
2068 if (!(torture_open_connection_share(
2069 mem_ctx, &cli,
2070 torture, torture_setting_string(torture, "host", NULL),
2071 "IPC$", torture->ev))) {
2072 torture_comment(torture, "IPC$ connection failed\n");
2073 goto done;
2074 }
2075
2076 status = pipe_bind_smb(torture, mem_ctx, cli->tree, "\\netlogon",
2077 &ndr_table_netlogon, &net_pipe);
2078 torture_assert_ntstatus_ok_goto(torture, status, result, done,
2079 "pipe_bind_smb failed");
2080 net_handle = net_pipe->binding_handle;
2081
2082 r.in.computer_name = wksname;
2083 r.in.server_name = talloc_asprintf(
2084 mem_ctx, "\\\\%s", dcerpc_server_name(net_pipe));
2085 if (r.in.server_name == NULL) {
2086 torture_comment(torture, "talloc_asprintf failed\n");
2087 goto done;
2088 }
2089 generate_random_buffer(netr_cli_creds.data,
2090 sizeof(netr_cli_creds.data));
2091 r.in.credentials = &netr_cli_creds;
2092 r.out.return_credentials = &netr_srv_creds;
2093
2094 status = dcerpc_netr_ServerReqChallenge_r(net_handle, mem_ctx, &r);
2095 if (!NT_STATUS_IS_OK(status)) {
2096 torture_comment(torture, "netr_ServerReqChallenge failed: %s\n",
2097 nt_errstr(status));
2098 goto done;
2099 }
2100 if (!NT_STATUS_IS_OK(r.out.result)) {
2101 torture_comment(torture, "netr_ServerReqChallenge failed: %s\n",
2102 nt_errstr(r.out.result));
2103 goto done;
2104 }
2105
2106 negotiate_flags = NETLOGON_NEG_AUTH2_FLAGS;
2107 E_md4hash("foobar", mach_pw.hash);
2108
2109 a.in.server_name = talloc_asprintf(
2110 mem_ctx, "\\\\%s", dcerpc_server_name(net_pipe));
2111 a.in.account_name = talloc_asprintf(
2112 mem_ctx, "%s$", wksname);
2113 a.in.computer_name = wksname;
2114 a.in.secure_channel_type = SEC_CHAN_WKSTA;
2115 a.in.negotiate_flags = &negotiate_flags;
2116 a.out.negotiate_flags = &negotiate_flags;
2117 a.in.credentials = &netr_cred;
2118 a.out.return_credentials = &netr_cred;
2119
2120 creds_state = netlogon_creds_client_init(mem_ctx,
2121 a.in.account_name,
2122 a.in.computer_name,
2123 a.in.secure_channel_type,
2124 r.in.credentials,
2125 r.out.return_credentials, &mach_pw,
2126 &netr_cred, negotiate_flags);
2127 torture_assert(torture, (creds_state != NULL), "memory allocation failed");
2128
2129 status = dcerpc_netr_ServerAuthenticate2_r(net_handle, mem_ctx, &a);
2130 if (!NT_STATUS_IS_OK(status)) {
2131 goto done;
2132 }
2133 if (!NT_STATUS_EQUAL(a.out.result, NT_STATUS_NO_TRUST_SAM_ACCOUNT)) {
2134 torture_comment(torture, "dcerpc_netr_ServerAuthenticate2 returned %s, "
2135 "expected NT_STATUS_NO_TRUST_SAM_ACCOUNT\n",
2136 nt_errstr(a.out.result));
2137 goto done;
2138 }
2139
2140 result = true;
2141 done:
2142 talloc_free(mem_ctx);
2143 return result;
2144 }
2145
2146 static struct security_descriptor *get_sharesec(struct torture_context *tctx,
2147 TALLOC_CTX *mem_ctx,
2148 struct smbcli_session *sess,
2149 const char *sharename)
2150 {
2151 struct smbcli_tree *tree;
2152 TALLOC_CTX *tmp_ctx;
2153 struct dcerpc_pipe *p;
2154 struct dcerpc_binding_handle *b;
2155 NTSTATUS status;
2156 struct srvsvc_NetShareGetInfo r;
2157 union srvsvc_NetShareInfo info;
2158 struct security_descriptor *result;
2159
2160 if (!(tmp_ctx = talloc_new(mem_ctx))) {
2161 torture_comment(tctx, "talloc_new failed\n");
2162 return NULL;
2163 }
2164
2165 if (!NT_STATUS_IS_OK(secondary_tcon(tctx, tmp_ctx, sess, "IPC$", &tree))) {
2166 torture_comment(tctx, "secondary_tcon failed\n");
2167 talloc_free(tmp_ctx);
2168 return NULL;
2169 }
2170
2171 status = pipe_bind_smb(tctx, mem_ctx, tree, "\\pipe\\srvsvc",
2172 &ndr_table_srvsvc, &p);
2173 if (!NT_STATUS_IS_OK(status)) {
2174 torture_warning(tctx, "could not bind to srvsvc pipe: %s\n",
2175 nt_errstr(status));
2176 talloc_free(tmp_ctx);
2177 return NULL;
2178 }
2179 b = p->binding_handle;
2180
2181 #if 0
2182 p->conn->flags |= DCERPC_DEBUG_PRINT_IN | DCERPC_DEBUG_PRINT_OUT;
2183 #endif
2184
2185 r.in.server_unc = talloc_asprintf(tmp_ctx, "\\\\%s",
2186 dcerpc_server_name(p));
2187 r.in.share_name = sharename;
2188 r.in.level = 502;
2189 r.out.info = &info;
2190
2191 status = dcerpc_srvsvc_NetShareGetInfo_r(b, tmp_ctx, &r);
2192 if (!NT_STATUS_IS_OK(status)) {
2193 torture_comment(tctx, "srvsvc_NetShareGetInfo failed: %s\n",
2194 nt_errstr(status));
2195 talloc_free(tmp_ctx);
2196 return NULL;
2197 }
2198 if (!W_ERROR_IS_OK(r.out.result)) {
2199 torture_comment(tctx, "srvsvc_NetShareGetInfo failed: %s\n",
2200 win_errstr(r.out.result));
2201 talloc_free(tmp_ctx);
2202 return NULL;
2203 }
2204
2205 result = talloc_steal(mem_ctx, info.info502->sd_buf.sd);
2206 talloc_free(tmp_ctx);
2207 return result;
2208 }
2209
2210 static NTSTATUS set_sharesec(struct torture_context *tctx,
2211 TALLOC_CTX *mem_ctx,
2212 struct smbcli_session *sess,
2213 const char *sharename,
2214 struct security_descriptor *sd)
2215 {
2216 struct smbcli_tree *tree;
2217 TALLOC_CTX *tmp_ctx;
2218 struct dcerpc_pipe *p;
2219 struct dcerpc_binding_handle *b;
2220 NTSTATUS status;
2221 struct sec_desc_buf i;
2222 struct srvsvc_NetShareSetInfo r;
2223 union srvsvc_NetShareInfo info;
2224 uint32_t error = 0;
2225
2226 if (!(tmp_ctx = talloc_new(mem_ctx))) {
2227 torture_comment(tctx, "talloc_new failed\n");
2228 return NT_STATUS_NO_MEMORY;
2229 }
2230
2231 if (!NT_STATUS_IS_OK(secondary_tcon(tctx, tmp_ctx, sess, "IPC$", &tree))) {
2232 torture_comment(tctx, "secondary_tcon failed\n");
2233 talloc_free(tmp_ctx);
2234 return NT_STATUS_UNSUCCESSFUL;
2235 }
2236
2237 status = pipe_bind_smb(tctx, mem_ctx, tree, "\\pipe\\srvsvc",
2238 &ndr_table_srvsvc, &p);
2239 if (!NT_STATUS_IS_OK(status)) {
2240 torture_warning(tctx, "could not bind to srvsvc pipe: %s\n",
2241 nt_errstr(status));
2242 talloc_free(tmp_ctx);
2243 return NT_STATUS_UNSUCCESSFUL;
2244 }
2245 b = p->binding_handle;
2246
2247 #if 0
2248 p->conn->flags |= DCERPC_DEBUG_PRINT_IN | DCERPC_DEBUG_PRINT_OUT;
2249 #endif
2250
2251 r.in.server_unc = talloc_asprintf(tmp_ctx, "\\\\%s",
2252 dcerpc_server_name(p));
2253 r.in.share_name = sharename;
2254 r.in.level = 1501;
2255 i.sd = sd;
2256 info.info1501 = &i;
2257 r.in.info = &info;
2258 r.in.parm_error = &error;
2259
2260 status = dcerpc_srvsvc_NetShareSetInfo_r(b, tmp_ctx, &r);
2261 if (!NT_STATUS_IS_OK(status)) {
2262 torture_comment(tctx, "srvsvc_NetShareSetInfo failed: %s\n",
2263 nt_errstr(status));
2264 }
2265 if (!W_ERROR_IS_OK(r.out.result)) {
2266 torture_comment(tctx, "srvsvc_NetShareSetInfo failed: %s\n",
2267 win_errstr(r.out.result));
2268 status = werror_to_ntstatus(r.out.result);
2269 }
2270 talloc_free(tmp_ctx);
2271 return status;
2272 }
2273
2274 bool try_tcon(struct torture_context *tctx,
2275 TALLOC_CTX *mem_ctx,
2276 struct security_descriptor *orig_sd,
2277 struct smbcli_session *session,
2278 const char *sharename, const struct dom_sid *user_sid,
2279 unsigned int access_mask, NTSTATUS expected_tcon,
2280 NTSTATUS expected_mkdir)
2281 {
2282 TALLOC_CTX *tmp_ctx;
2283 struct smbcli_tree *rmdir_tree, *tree;
2284 struct dom_sid *domain_sid;
2285 uint32_t rid;
2286 struct security_descriptor *sd;
2287 NTSTATUS status;
2288 bool ret = true;
2289
2290 if (!(tmp_ctx = talloc_new(mem_ctx))) {
2291 torture_comment(tctx, "talloc_new failed\n");
2292 return false;
2293 }
2294
2295 status = secondary_tcon(tctx, tmp_ctx, session, sharename, &rmdir_tree);
2296 if (!NT_STATUS_IS_OK(status)) {
2297 torture_comment(tctx, "first tcon to delete dir failed\n");
2298 talloc_free(tmp_ctx);
2299 return false;
2300 }
2301
2302 smbcli_rmdir(rmdir_tree, "sharesec_testdir");
2303
2304 if (!NT_STATUS_IS_OK(dom_sid_split_rid(tmp_ctx, user_sid,
2305 &domain_sid, &rid))) {
2306 torture_comment(tctx, "dom_sid_split_rid failed\n");
2307 talloc_free(tmp_ctx);
2308 return false;
2309 }
2310
2311 sd = security_descriptor_dacl_create(
2312 tmp_ctx, 0, "S-1-5-32-544",
2313 dom_sid_string(mem_ctx, dom_sid_add_rid(mem_ctx, domain_sid,
2314 DOMAIN_RID_USERS)),
2315 dom_sid_string(mem_ctx, user_sid),
2316 SEC_ACE_TYPE_ACCESS_ALLOWED, access_mask, 0, NULL);
2317 if (sd == NULL) {
2318 torture_comment(tctx, "security_descriptor_dacl_create failed\n");
2319 talloc_free(tmp_ctx);
2320 return false;
2321 }
2322
2323 status = set_sharesec(tctx, mem_ctx, session, sharename, sd);
2324 if (!NT_STATUS_IS_OK(status)) {
2325 torture_comment(tctx, "custom set_sharesec failed: %s\n",
2326 nt_errstr(status));
2327 talloc_free(tmp_ctx);
2328 return false;
2329 }
2330
2331 status = secondary_tcon(tctx, tmp_ctx, session, sharename, &tree);
2332 if (!NT_STATUS_EQUAL(status, expected_tcon)) {
2333 torture_comment(tctx, "Expected %s, got %s\n", nt_errstr(expected_tcon),
2334 nt_errstr(status));
2335 ret = false;
2336 goto done;
2337 }
2338
2339 if (!NT_STATUS_IS_OK(status)) {
2340 /* An expected non-access, no point in trying to write */
2341 goto done;
2342 }
2343
2344 status = smbcli_mkdir(tree, "sharesec_testdir");
2345 if (!NT_STATUS_EQUAL(status, expected_mkdir)) {
2346 torture_warning(tctx, "Expected %s, got %s\n",
2347 nt_errstr(expected_mkdir), nt_errstr(status));
2348 ret = false;
2349 }
2350
2351 done:
2352 smbcli_rmdir(rmdir_tree, "sharesec_testdir");
2353
2354 status = set_sharesec(tctx, mem_ctx, session, sharename, orig_sd);
2355 if (!NT_STATUS_IS_OK(status)) {
2356 torture_comment(tctx, "custom set_sharesec failed: %s\n",
2357 nt_errstr(status));
2358 talloc_free(tmp_ctx);
2359 return false;
2360 }
2361
2362 talloc_free(tmp_ctx);
2363 return ret;
2364 }
2365
2366 static bool torture_samba3_rpc_sharesec(struct torture_context *torture)
2367 {
2368 struct smbcli_state *cli = NULL;
2369 struct security_descriptor *sd = NULL;
2370 struct dom_sid *user_sid = NULL;
2371 const char *testuser_passwd = NULL;
2372 struct cli_credentials *test_credentials = NULL;
2373 struct smbcli_options options;
2374 struct smbcli_session_options session_options;
2375 NTSTATUS status;
2376 struct test_join *tj = NULL;
2377 struct dcerpc_pipe *lsa_pipe = NULL;
2378 const char *priv_array[1];
2379
2380 /* Create a new user. The normal user has SeBackup and SeRestore
2381 privs so we can't lock them out with a share security descriptor. */
2382 tj = torture_create_testuser(torture,
2383 "sharesec_user",
2384 torture_setting_string(torture, "workgroup", NULL),
2385 ACB_NORMAL,
2386 &testuser_passwd);
2387 if (!tj) {
2388 torture_fail(torture, "Creating sharesec_user failed\n");
2389 }
2390
2391 /* Give them SeDiskOperatorPrivilege but no other privs. */
2392 status = torture_rpc_connection(torture, &lsa_pipe, &ndr_table_lsarpc);
2393 if (!NT_STATUS_IS_OK(status)) {
2394 torture_delete_testuser(torture, tj, "sharesec_user");
2395 talloc_free(tj);
2396 torture_fail(torture, "Error connecting to LSA pipe");
2397 }
2398
2399 priv_array[0] = "SeDiskOperatorPrivilege";
2400 if (!torture_setup_privs(torture,
2401 lsa_pipe,
2402 1,
2403 priv_array,
2404 torture_join_user_sid(tj))) {
2405 talloc_free(lsa_pipe);
2406 torture_delete_testuser(torture, tj, "sharesec_user");
2407 talloc_free(tj);
2408 torture_fail(torture, "Failed to setup privs\n");
2409 }
2410 talloc_free(lsa_pipe);
2411
2412 test_credentials = cli_credentials_init(torture);
2413 cli_credentials_set_workstation(test_credentials, "localhost", CRED_SPECIFIED);
2414 cli_credentials_set_domain(test_credentials, lpcfg_workgroup(torture->lp_ctx),
2415 CRED_SPECIFIED);
2416 cli_credentials_set_username(test_credentials, "sharesec_user", CRED_SPECIFIED);
2417 cli_credentials_set_password(test_credentials, testuser_passwd, CRED_SPECIFIED);
2418
2419 ZERO_STRUCT(options);
2420 ZERO_STRUCT(session_options);
2421 lpcfg_smbcli_options(torture->lp_ctx, &options);
2422 lpcfg_smbcli_session_options(torture->lp_ctx, &session_options);
2423
2424 status = smbcli_full_connection(torture,
2425 &cli,
2426 torture_setting_string(torture, "host", NULL),
2427 lpcfg_smb_ports(torture->lp_ctx),
2428 "IPC$",
2429 NULL,
2430 lpcfg_socket_options(torture->lp_ctx),
2431 test_credentials,
2432 lpcfg_resolve_context(torture->lp_ctx),
2433 torture->ev,
2434 &options,
2435 &session_options,
2436 lpcfg_gensec_settings(torture, torture->lp_ctx));
2437 if (!NT_STATUS_IS_OK(status)) {
2438 talloc_free(cli);
2439 torture_delete_testuser(torture, tj, "sharesec_user");
2440 talloc_free(tj);
2441 torture_fail(torture, "Failed to open connection\n");
2442 }
2443
2444 if (!(user_sid = whoami(torture, torture, cli->tree))) {
2445 talloc_free(cli);
2446 torture_delete_testuser(torture, tj, "sharesec_user");
2447 talloc_free(tj);
2448 torture_fail(torture, "whoami failed\n");
2449 }
2450
2451 sd = get_sharesec(torture, torture, cli->session,
2452 torture_setting_string(torture, "share", NULL));
2453
2454 if (!try_tcon(torture, torture, sd, cli->session,
2455 torture_setting_string(torture, "share", NULL),
2456 user_sid, 0, NT_STATUS_ACCESS_DENIED, NT_STATUS_OK)) {
2457 talloc_free(cli);
2458 torture_delete_testuser(torture, tj, "sharesec_user");
2459 talloc_free(tj);
2460 torture_fail(torture, "failed to test tcon with 0 access_mask");
2461 }
2462
2463 if (!try_tcon(torture, torture, sd, cli->session,
2464 torture_setting_string(torture, "share", NULL),
2465 user_sid, SEC_FILE_READ_DATA, NT_STATUS_OK,
2466 NT_STATUS_MEDIA_WRITE_PROTECTED)) {
2467 talloc_free(cli);
2468 torture_delete_testuser(torture, tj, "sharesec_user");
2469 talloc_free(tj);
2470 torture_fail(torture, "failed to test tcon with SEC_FILE_READ_DATA access_mask");
2471 }
2472
2473 /* sharesec_user doesn't have any rights on the underlying file system.
2474 Go back to the normal user. */
2475
2476 talloc_free(cli);
2477 cli = NULL;
2478 torture_delete_testuser(torture, tj, "sharesec_user");
2479 talloc_free(tj);
2480 tj = NULL;
2481
2482 if (!(torture_open_connection_share(
2483 torture, &cli, torture, torture_setting_string(torture, "host", NULL),
2484 "IPC$", torture->ev))) {
2485 torture_fail(torture, "IPC$ connection failed\n");
2486 }
2487
2488 if (!(user_sid = whoami(torture, torture, cli->tree))) {
2489 torture_fail(torture, "whoami failed\n");
2490 }
2491 torture_assert(torture, try_tcon(
2492 torture, torture, sd, cli->session,
2493 torture_setting_string(torture, "share", NULL),
2494 user_sid, SEC_FILE_ALL, NT_STATUS_OK, NT_STATUS_OK),
2495 "failed to test tcon with SEC_FILE_ALL access_mask")
2496
2497 return true;
2498 }
2499
2500 static bool torture_samba3_rpc_lsa(struct torture_context *torture)
2501 {
2502 struct dcerpc_pipe *p;
2503 struct dcerpc_binding_handle *b;
2504 struct policy_handle lsa_handle;
2505
2506 torture_assert_ntstatus_ok(torture,
2507 torture_rpc_connection(torture, &p, &ndr_table_lsarpc),
2508 "failed to setup lsarpc");
2509
2510 b = p->binding_handle;
2511
2512 {
2513 struct lsa_ObjectAttribute attr;
2514 struct lsa_OpenPolicy2 o;
2515 o.in.system_name = talloc_asprintf(
2516 torture, "\\\\%s", dcerpc_server_name(p));
2517 ZERO_STRUCT(attr);
2518 o.in.attr = &attr;
2519 o.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
2520 o.out.handle = &lsa_handle;
2521
2522 torture_assert_ntstatus_ok(torture,
2523 dcerpc_lsa_OpenPolicy2_r(b, torture, &o),
2524 "dcerpc_lsa_OpenPolicy2 failed");
2525 torture_assert_ntstatus_ok(torture, o.out.result,
2526 "dcerpc_lsa_OpenPolicy2 failed");
2527 }
2528
2529 {
2530 int i;
2531 int levels[] = { 2,3,5,6 };
2532
2533 for (i=0; i<ARRAY_SIZE(levels); i++) {
2534 struct lsa_QueryInfoPolicy r;
2535 union lsa_PolicyInformation *info = NULL;
2536 r.in.handle = &lsa_handle;
2537 r.in.level = levels[i];
2538 r.out.info = &info;
2539
2540 torture_assert_ntstatus_ok(torture,
2541 dcerpc_lsa_QueryInfoPolicy_r(b, torture, &r),
2542 talloc_asprintf(torture, "dcerpc_lsa_QueryInfoPolicy level %d failed", levels[i]));
2543 torture_assert_ntstatus_ok(torture, r.out.result,
2544 talloc_asprintf(torture, "dcerpc_lsa_QueryInfoPolicy level %d failed", levels[i]));
2545 }
2546 }
2547
2548 return true;
2549 }
2550
2551 static NTSTATUS get_servername(TALLOC_CTX *mem_ctx, struct smbcli_tree *tree,
2552 char **name)
2553 {
2554 struct rap_WserverGetInfo r;
2555 NTSTATUS status;
2556 char servername[17];
2557 size_t converted_size;
2558
2559 r.in.level = 0;
2560 r.in.bufsize = 0xffff;
2561
2562 status = smbcli_rap_netservergetinfo(tree, mem_ctx, &r);
2563 if (!NT_STATUS_IS_OK(status)) {
2564 return status;
2565 }
2566
2567 memcpy(servername, r.out.info.info0.name, 16);
2568 servername[16] = '\0';
2569
2570 if (!pull_ascii_talloc(mem_ctx, name, servername, &converted_size)) {
2571 return NT_STATUS_NO_MEMORY;
2572 }
2573
2574 return NT_STATUS_OK;
2575 }
2576
2577 static bool rap_get_servername(struct torture_context *tctx,
2578 char **servername)
2579 {
2580 struct smbcli_state *cli;
2581
2582 torture_assert(tctx,
2583 torture_open_connection_share(tctx, &cli, tctx, torture_setting_string(tctx, "host", NULL),
2584 "IPC$", tctx->ev),
2585 "IPC$ connection failed");
2586
2587 torture_assert_ntstatus_ok(tctx,
2588 get_servername(tctx, cli->tree, servername),
2589 "get_servername failed");
2590
2591 talloc_free(cli);
2592
2593 return true;
2594 }
2595
2596 static bool find_printers(struct torture_context *tctx,
2597 struct dcerpc_pipe *p,
2598 const char ***printers,
2599 size_t *num_printers)
2600 {
2601 struct srvsvc_NetShareEnum r;
2602 struct srvsvc_NetShareInfoCtr info_ctr;
2603 struct srvsvc_NetShareCtr1 c1_in;
2604 struct srvsvc_NetShareCtr1 *c1;
2605 uint32_t totalentries = 0;
2606 int i;
2607 struct dcerpc_binding_handle *b = p->binding_handle;
2608
2609 ZERO_STRUCT(c1_in);
2610 info_ctr.level = 1;
2611 info_ctr.ctr.ctr1 = &c1_in;
2612
2613 r.in.server_unc = talloc_asprintf(
2614 tctx, "\\\\%s", dcerpc_server_name(p));
2615 r.in.info_ctr = &info_ctr;
2616 r.in.max_buffer = (uint32_t)-1;
2617 r.in.resume_handle = NULL;
2618 r.out.totalentries = &totalentries;
2619 r.out.info_ctr = &info_ctr;
2620
2621 torture_assert_ntstatus_ok(tctx,
2622 dcerpc_srvsvc_NetShareEnum_r(b, tctx, &r),
2623 "NetShareEnum level 1 failed");
2624 torture_assert_werr_ok(tctx, r.out.result,
2625 "NetShareEnum level 1 failed");
2626
2627 *printers = NULL;
2628 *num_printers = 0;
2629 c1 = r.out.info_ctr->ctr.ctr1;
2630 for (i=0; i<c1->count; i++) {
2631 if (c1->array[i].type != STYPE_PRINTQ) {
2632 continue;
2633 }
2634 if (!add_string_to_array(tctx, c1->array[i].name,
2635 printers, num_printers)) {
2636 return false;
2637 }
2638 }
2639
2640 return true;
2641 }
2642
2643 static bool enumprinters(struct torture_context *tctx,
2644 struct dcerpc_binding_handle *b,
2645 const char *servername, int level, int *num_printers)
2646 {
2647 struct spoolss_EnumPrinters r;
2648 DATA_BLOB blob;
2649 uint32_t needed;
2650 uint32_t count;
2651 union spoolss_PrinterInfo *info;
2652
2653 r.in.flags = PRINTER_ENUM_LOCAL;
2654 r.in.server = talloc_asprintf(tctx, "\\\\%s", servername);
2655 r.in.level = level;
2656 r.in.buffer = NULL;
2657 r.in.offered = 0;
2658 r.out.needed = &needed;
2659 r.out.count = &count;
2660 r.out.info = &info;
2661
2662 torture_assert_ntstatus_ok(tctx,
2663 dcerpc_spoolss_EnumPrinters_r(b, tctx, &r),
2664 "dcerpc_spoolss_EnumPrinters failed");
2665 torture_assert_werr_equal(tctx, r.out.result, WERR_INSUFFICIENT_BUFFER,
2666 "EnumPrinters unexpected return code should be WERR_INSUFFICIENT_BUFFER");
2667
2668 blob = data_blob_talloc_zero(tctx, needed);
2669 if (blob.data == NULL) {
2670 return false;
2671 }
2672
2673 r.in.buffer = &blob;
2674 r.in.offered = needed;
2675
2676 torture_assert_ntstatus_ok(tctx,
2677 dcerpc_spoolss_EnumPrinters_r(b, tctx, &r),
2678 "dcerpc_spoolss_EnumPrinters failed");
2679 torture_assert_werr_ok(tctx, r.out.result,
2680 "dcerpc_spoolss_EnumPrinters failed");
2681
2682 *num_printers = count;
2683
2684 return true;
2685 }
2686
2687 static bool getprinterinfo(struct torture_context *tctx,
2688 struct dcerpc_binding_handle *b,
2689 struct policy_handle *handle, int level,
2690 union spoolss_PrinterInfo **res)
2691 {
2692 struct spoolss_GetPrinter r;
2693 DATA_BLOB blob;
2694 uint32_t needed;
2695
2696 r.in.handle = handle;
2697 r.in.level = level;
2698 r.in.buffer = NULL;
2699 r.in.offered = 0;
2700 r.out.needed = &needed;
2701
2702 torture_assert_ntstatus_ok(tctx,
2703 dcerpc_spoolss_GetPrinter_r(b, tctx, &r),
2704 "dcerpc_spoolss_GetPrinter failed");
2705 torture_assert_werr_equal(tctx, r.out.result, WERR_INSUFFICIENT_BUFFER,
2706 "GetPrinter unexpected return code should be WERR_INSUFFICIENT_BUFFER");
2707
2708 r.in.handle = handle;
2709 r.in.level = level;
2710 blob = data_blob_talloc_zero(tctx, needed);
2711 if (blob.data == NULL) {
2712 return false;
2713 }
2714 r.in.buffer = &blob;
2715 r.in.offered = needed;
2716
2717 torture_assert_ntstatus_ok(tctx,
2718 dcerpc_spoolss_GetPrinter_r(b, tctx, &r),
2719 "dcerpc_spoolss_GetPrinter failed");
2720 torture_assert_werr_ok(tctx, r.out.result,
2721 "dcerpc_spoolss_GetPrinter failed");
2722
2723 if (res != NULL) {
2724 *res = talloc_steal(tctx, r.out.info);
2725 }
2726
2727 return true;
2728 }
2729
2730 static bool torture_samba3_rpc_spoolss(struct torture_context *torture)
2731 {
2732 struct dcerpc_pipe *p, *p2;
2733 struct dcerpc_binding_handle *b;
2734 struct policy_handle server_handle, printer_handle;
2735 const char **printers;
2736 size_t num_printers;
2737 struct spoolss_UserLevel1 userlevel1;
2738 char *servername;
2739
2740 torture_assert(torture,
2741 rap_get_servername(torture, &servername),
2742 "failed to rap servername");
2743
2744 torture_assert_ntstatus_ok(torture,
2745 torture_rpc_connection(torture, &p2, &ndr_table_srvsvc),
2746 "failed to setup srvsvc");
2747
2748 torture_assert(torture,
2749 find_printers(torture, p2, &printers, &num_printers),
2750 "failed to find printers via srvsvc");
2751
2752 talloc_free(p2);
2753
2754 if (num_printers == 0) {
2755 torture_skip(torture, "Did not find printers\n");
2756 return true;
2757 }
2758
2759 torture_assert_ntstatus_ok(torture,
2760 torture_rpc_connection(torture, &p, &ndr_table_spoolss),
2761 "failed to setup spoolss");
2762
2763 b = p->binding_handle;
2764
2765 ZERO_STRUCT(userlevel1);
2766 userlevel1.client = talloc_asprintf(
2767 torture, "\\\\%s", lpcfg_netbios_name(torture->lp_ctx));
2768 userlevel1.user = cli_credentials_get_username(cmdline_credentials);
2769 userlevel1.build = 2600;
2770 userlevel1.major = 3;
2771 userlevel1.minor = 0;
2772 userlevel1.processor = 0;
2773
2774 {
2775 struct spoolss_OpenPrinterEx r;
2776
2777 ZERO_STRUCT(r);
2778 r.in.printername = talloc_asprintf(torture, "\\\\%s",
2779 servername);
2780 r.in.datatype = NULL;
2781 r.in.access_mask = 0;
2782 r.in.userlevel_ctr.level = 1;
2783 r.in.userlevel_ctr.user_info.level1 = &userlevel1;
2784 r.out.handle = &server_handle;
2785
2786 torture_assert_ntstatus_ok(torture,
2787 dcerpc_spoolss_OpenPrinterEx_r(b, torture, &r),
2788 "dcerpc_spoolss_OpenPrinterEx failed");
2789 torture_assert_werr_ok(torture, r.out.result,
2790 "dcerpc_spoolss_OpenPrinterEx failed");
2791 }
2792
2793 {
2794 struct spoolss_ClosePrinter r;
2795
2796 r.in.handle = &server_handle;
2797 r.out.handle = &server_handle;
2798
2799 torture_assert_ntstatus_ok(torture,
2800 dcerpc_spoolss_ClosePrinter_r(b, torture, &r),
2801 "dcerpc_spoolss_ClosePrinter failed");
2802 torture_assert_werr_ok(torture, r.out.result,
2803 "dcerpc_spoolss_ClosePrinter failed");
2804 }
2805
2806 {
2807 struct spoolss_OpenPrinterEx r;
2808
2809 ZERO_STRUCT(r);
2810 r.in.printername = talloc_asprintf(
2811 torture, "\\\\%s\\%s", servername, printers[0]);
2812 r.in.datatype = NULL;
2813 r.in.access_mask = 0;
2814 r.in.userlevel_ctr.level = 1;
2815 r.in.userlevel_ctr.user_info.level1 = &userlevel1;
2816 r.out.handle = &printer_handle;
2817
2818 torture_assert_ntstatus_ok(torture,
2819 dcerpc_spoolss_OpenPrinterEx_r(b, torture, &r),
2820 "dcerpc_spoolss_OpenPrinterEx failed");
2821 torture_assert_werr_ok(torture, r.out.result,
2822 "dcerpc_spoolss_OpenPrinterEx failed");
2823 }
2824
2825 {
2826 int i;
2827
2828 for (i=0; i<8; i++) {
2829 torture_assert(torture,
2830 getprinterinfo(torture, b, &printer_handle, i, NULL),
2831 talloc_asprintf(torture, "getprinterinfo %d failed", i));
2832 }
2833 }
2834
2835 {
2836 struct spoolss_ClosePrinter r;
2837
2838 r.in.handle = &printer_handle;
2839 r.out.handle = &printer_handle;
2840
2841 torture_assert_ntstatus_ok(torture,
2842 dcerpc_spoolss_ClosePrinter_r(b, torture, &r),
2843 "dcerpc_spoolss_ClosePrinter failed");
2844 torture_assert_werr_ok(torture, r.out.result,
2845 "dcerpc_spoolss_ClosePrinter failed");
2846 }
2847
2848 {
2849 int num_enumerated;
2850
2851 torture_assert(torture,
2852 enumprinters(torture, b, servername, 1, &num_enumerated),
2853 "enumprinters failed");
2854
2855 torture_assert_int_equal(torture, num_printers, num_enumerated,
2856 "netshareenum / enumprinters lvl 1 numprinter mismatch");
2857 }
2858
2859 {
2860 int num_enumerated;
2861
2862 torture_assert(torture,
2863 enumprinters(torture, b, servername, 2, &num_enumerated),
2864 "enumprinters failed");
2865
2866 torture_assert_int_equal(torture, num_printers, num_enumerated,
2867 "netshareenum / enumprinters lvl 2 numprinter mismatch");
2868 }
2869
2870 return true;
2871 }
2872
2873 static bool torture_samba3_rpc_wkssvc(struct torture_context *torture)
2874 {
2875 struct dcerpc_pipe *p;
2876 struct dcerpc_binding_handle *b;
2877 char *servername;
2878
2879 torture_assert(torture,
2880 rap_get_servername(torture, &servername),
2881 "failed to rap servername");
2882
2883 torture_assert_ntstatus_ok(torture,
2884 torture_rpc_connection(torture, &p, &ndr_table_wkssvc),
2885 "failed to setup wkssvc");
2886
2887 b = p->binding_handle;
2888
2889 {
2890 struct wkssvc_NetWkstaInfo100 wks100;
2891 union wkssvc_NetWkstaInfo info;
2892 struct wkssvc_NetWkstaGetInfo r;
2893
2894 r.in.server_name = "\\foo";
2895 r.in.level = 100;
2896 info.info100 = &wks100;
2897 r.out.info = &info;
2898
2899 torture_assert_ntstatus_ok(torture,
2900 dcerpc_wkssvc_NetWkstaGetInfo_r(b, torture, &r),
2901 "dcerpc_wkssvc_NetWksGetInfo failed");
2902 torture_assert_werr_ok(torture, r.out.result,
2903 "dcerpc_wkssvc_NetWksGetInfo failed");
2904
2905 torture_assert_str_equal(torture, servername, r.out.info->info100->server_name,
2906 "servername RAP / DCERPC inconsistency");
2907 }
2908
2909 return true;
2910 }
2911
2912 static bool winreg_close(struct torture_context *tctx,
2913 struct dcerpc_binding_handle *b,
2914 struct policy_handle *handle)
2915 {
2916 struct winreg_CloseKey c;
2917
2918 c.in.handle = c.out.handle = handle;
2919
2920 torture_assert_ntstatus_ok(tctx,
2921 dcerpc_winreg_CloseKey_r(b, tctx, &c),
2922 "winreg_CloseKey failed");
2923 torture_assert_werr_ok(tctx, c.out.result,
2924 "winreg_CloseKey failed");
2925
2926 return true;
2927 }
2928
2929 static bool enumvalues(struct torture_context *tctx,
2930 struct dcerpc_binding_handle *b,
2931 struct policy_handle *handle)
2932 {
2933 uint32_t enum_index = 0;
2934
2935 while (1) {
2936 struct winreg_EnumValue r;
2937 struct winreg_ValNameBuf name;
2938 enum winreg_Type type = 0;
2939 uint8_t buf8[1024];
2940 NTSTATUS status;
2941 uint32_t size, length;
2942
2943 r.in.handle = handle;
2944 r.in.enum_index = enum_index;
2945 name.name = "";
2946 name.size = 1024;
2947 r.in.name = r.out.name = &name;
2948 size = 1024;
2949 length = 5;
2950 r.in.type = &type;
2951 r.in.value = buf8;
2952 r.in.size = &size;
2953 r.in.length = &length;
2954
2955 status = dcerpc_winreg_EnumValue_r(b, tctx, &r);
2956 if (!NT_STATUS_IS_OK(status) || !W_ERROR_IS_OK(r.out.result)) {
2957 return true;
2958 }
2959 enum_index += 1;
2960 }
2961 }
2962
2963 static bool enumkeys(struct torture_context *tctx,
2964 struct dcerpc_binding_handle *b,
2965 struct policy_handle *handle,
2966 int depth)
2967 {
2968 struct winreg_EnumKey r;
2969 struct winreg_StringBuf kclass, name;
2970 NTSTATUS status;
2971 NTTIME t = 0;
2972
2973 if (depth <= 0) {
2974 return true;
2975 }
2976
2977 kclass.name = "";
2978 kclass.size = 1024;
2979
2980 r.in.handle = handle;
2981 r.in.enum_index = 0;
2982 r.in.name = &name;
2983 r.in.keyclass = &kclass;
2984 r.out.name = &name;
2985 r.in.last_changed_time = &t;
2986
2987 do {
2988 struct winreg_OpenKey o;
2989 struct policy_handle key_handle;
2990 int i;
2991
2992 name.name = NULL;
2993 name.size = 1024;
2994
2995 status = dcerpc_winreg_EnumKey_r(b, tctx, &r);
2996 if (!NT_STATUS_IS_OK(status) || !W_ERROR_IS_OK(r.out.result)) {
2997 /* We're done enumerating */
2998 return true;
2999 }
3000
3001 for (i=0; i<10-depth; i++) {
3002 torture_comment(tctx, " ");
3003 }
3004 torture_comment(tctx, "%s\n", r.out.name->name);
3005
3006 o.in.parent_handle = handle;
3007 o.in.keyname.name = r.out.name->name;
3008 o.in.options = 0;
3009 o.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
3010 o.out.handle = &key_handle;
3011
3012 status = dcerpc_winreg_OpenKey_r(b, tctx, &o);
3013 if (NT_STATUS_IS_OK(status) && W_ERROR_IS_OK(o.out.result)) {
3014 enumkeys(tctx, b, &key_handle, depth-1);
3015 enumvalues(tctx, b, &key_handle);
3016 torture_assert(tctx, winreg_close(tctx, b, &key_handle), "");
3017 }
3018
3019 r.in.enum_index += 1;
3020 } while(true);
3021
3022 return true;
3023 }
3024
3025 typedef NTSTATUS (*winreg_open_fn)(struct dcerpc_binding_handle *, TALLOC_CTX *, void *);
3026
3027 static bool test_Open3(struct torture_context *tctx,
3028 struct dcerpc_binding_handle *b,
3029 const char *name, winreg_open_fn open_fn)
3030 {
3031 struct policy_handle handle;
3032 struct winreg_OpenHKLM r;
3033
3034 r.in.system_name = 0;
3035 r.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
3036 r.out.handle = &handle;
3037
3038 torture_assert_ntstatus_ok(tctx,
3039 open_fn(b, tctx, &r),
3040 talloc_asprintf(tctx, "%s failed", name));
3041 torture_assert_werr_ok(tctx, r.out.result,
3042 talloc_asprintf(tctx, "%s failed", name));
3043
3044 enumkeys(tctx, b, &handle, 4);
3045
3046 torture_assert(tctx,
3047 winreg_close(tctx, b, &handle),
3048 "dcerpc_CloseKey failed");
3049
3050 return true;
3051 }
3052
3053 static bool torture_samba3_rpc_winreg(struct torture_context *torture)
3054 {
3055 struct dcerpc_pipe *p;
3056 struct dcerpc_binding_handle *b;
3057 bool ret = true;
3058 struct {
3059 const char *name;
3060 winreg_open_fn fn;
3061 } open_fns[] = {
3062 {"OpenHKLM", (winreg_open_fn)dcerpc_winreg_OpenHKLM_r },
3063 {"OpenHKU", (winreg_open_fn)dcerpc_winreg_OpenHKU_r },
3064 {"OpenHKPD", (winreg_open_fn)dcerpc_winreg_OpenHKPD_r },
3065 {"OpenHKPT", (winreg_open_fn)dcerpc_winreg_OpenHKPT_r },
3066 {"OpenHKCR", (winreg_open_fn)dcerpc_winreg_OpenHKCR_r }};
3067 #if 0
3068 int i;
3069 #endif
3070
3071 torture_assert_ntstatus_ok(torture,
3072 torture_rpc_connection(torture, &p, &ndr_table_winreg),
3073 "failed to setup winreg");
3074
3075 b = p->binding_handle;
3076
3077 #if 1
3078 ret = test_Open3(torture, b, open_fns[0].name, open_fns[0].fn);
3079 #else
3080 for (i = 0; i < ARRAY_SIZE(open_fns); i++) {
3081 if (!test_Open3(torture, b, open_fns[i].name, open_fns[i].fn))
3082 ret = false;
3083 }
3084 #endif
3085 return ret;
3086 }
3087
3088 static bool get_shareinfo(struct torture_context *tctx,
3089 struct dcerpc_binding_handle *b,
3090 const char *servername,
3091 const char *share,
3092 struct srvsvc_NetShareInfo502 **info502)
3093 {
3094 struct srvsvc_NetShareGetInfo r;
3095 union srvsvc_NetShareInfo info;
3096
3097 r.in.server_unc = talloc_asprintf(tctx, "\\\\%s", servername);
3098 r.in.share_name = share;
3099 r.in.level = 502;
3100 r.out.info = &info;
3101
3102 torture_assert_ntstatus_ok(tctx,
3103 dcerpc_srvsvc_NetShareGetInfo_r(b, tctx, &r),
3104 "srvsvc_NetShareGetInfo failed");
3105 torture_assert_werr_ok(tctx, r.out.result,
3106 "srvsvc_NetShareGetInfo failed");
3107
3108 *info502 = talloc_move(tctx, &info.info502);
3109
3110 return true;
3111 }
3112
3113 /*
3114 * Get us a handle on HKLM\
3115 */
3116
3117 static bool get_hklm_handle(struct torture_context *tctx,
3118 struct dcerpc_binding_handle *b,
3119 struct policy_handle *handle)
3120 {
3121 struct winreg_OpenHKLM r;
3122 struct policy_handle result;
3123
3124 r.in.system_name = 0;
3125 r.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
3126 r.out.handle = &result;
3127
3128 torture_assert_ntstatus_ok(tctx,
3129 dcerpc_winreg_OpenHKLM_r(b, tctx, &r),
3130 "OpenHKLM failed");
3131 torture_assert_werr_ok(tctx, r.out.result,
3132 "OpenHKLM failed");
3133
3134 *handle = result;
3135
3136 return true;
3137 }
3138
3139 static bool torture_samba3_createshare(struct torture_context *tctx,
3140 struct dcerpc_binding_handle *b,
3141 const char *sharename)
3142 {
3143 struct policy_handle hklm;
3144 struct policy_handle new_handle;
3145 struct winreg_CreateKey c;
3146 struct winreg_CloseKey cl;
3147 enum winreg_CreateAction action_taken;
3148
3149 c.in.handle = &hklm;
3150 c.in.name.name = talloc_asprintf(
3151 tctx, "software\\samba\\smbconf\\%s", sharename);
3152 torture_assert(tctx, c.in.name.name, "talloc_asprintf failed");
3153
3154 c.in.keyclass.name = "";
3155 c.in.options = 0;
3156 c.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
3157 c.in.secdesc = NULL;
3158 c.in.action_taken = &action_taken;
3159 c.out.new_handle = &new_handle;
3160 c.out.action_taken = &action_taken;
3161
3162 torture_assert_ntstatus_ok(tctx,
3163 dcerpc_winreg_CreateKey_r(b, tctx, &c),
3164 "OpenKey failed");
3165 torture_assert_werr_ok(tctx, c.out.result,
3166 "OpenKey failed");
3167
3168 cl.in.handle = &new_handle;
3169 cl.out.handle = &new_handle;
3170
3171 torture_assert_ntstatus_ok(tctx,
3172 dcerpc_winreg_CloseKey_r(b, tctx, &cl),
3173 "CloseKey failed");
3174 torture_assert_werr_ok(tctx, cl.out.result,
3175 "CloseKey failed");
3176
3177 return true;
3178 }
3179
3180 static bool torture_samba3_deleteshare(struct torture_context *tctx,
3181 struct dcerpc_binding_handle *b,
3182 const char *sharename)
3183 {
3184 struct policy_handle hklm;
3185 struct winreg_DeleteKey d;
3186
3187 torture_assert(tctx,
3188 get_hklm_handle(tctx, b, &hklm),
3189 "get_hklm_handle failed");
3190
3191 d.in.handle = &hklm;
3192 d.in.key.name = talloc_asprintf(
3193 tctx, "software\\samba\\smbconf\\%s", sharename);
3194 torture_assert(tctx, d.in.key.name, "talloc_asprintf failed");
3195
3196 torture_assert_ntstatus_ok(tctx,
3197 dcerpc_winreg_DeleteKey_r(b, tctx, &d),
3198 "DeleteKey failed");
3199 torture_assert_werr_ok(tctx, d.out.result,
3200 "DeleteKey failed");
3201
3202 return true;
3203 }
3204
3205 static bool torture_samba3_setconfig(struct torture_context *tctx,
3206 struct dcerpc_binding_handle *b,
3207 const char *sharename,
3208 const char *parameter,
3209 const char *value)
3210 {
3211 struct policy_handle hklm, key_handle;
3212 struct winreg_OpenKey o;
3213 struct winreg_SetValue s;
3214 uint32_t type;
3215 DATA_BLOB val;
3216
3217 torture_assert(tctx,
3218 get_hklm_handle(tctx, b, &hklm),
3219 "get_hklm_handle failed");
3220
3221 o.in.parent_handle = &hklm;
3222 o.in.keyname.name = talloc_asprintf(
3223 tctx, "software\\samba\\smbconf\\%s", sharename);
3224 torture_assert(tctx, o.in.keyname.name, "talloc_asprintf failed");
3225
3226 o.in.options = 0;
3227 o.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
3228 o.out.handle = &key_handle;
3229
3230 torture_assert_ntstatus_ok(tctx,
3231 dcerpc_winreg_OpenKey_r(b, tctx, &o),
3232 "OpenKey failed");
3233 torture_assert_werr_ok(tctx, o.out.result,
3234 "OpenKey failed");
3235
3236 torture_assert(tctx,
3237 reg_string_to_val(tctx, "REG_SZ", value, &type, &val),
3238 "reg_string_to_val failed");
3239
3240 s.in.handle = &key_handle;
3241 s.in.name.name = parameter;
3242 s.in.type = type;
3243 s.in.data = val.data;
3244 s.in.size = val.length;
3245
3246 torture_assert_ntstatus_ok(tctx,
3247 dcerpc_winreg_SetValue_r(b, tctx, &s),
3248 "SetValue failed");
3249 torture_assert_werr_ok(tctx, s.out.result,
3250 "SetValue failed");
3251
3252 return true;
3253 }
3254
3255 static bool torture_samba3_regconfig(struct torture_context *torture)
3256 {
3257 struct srvsvc_NetShareInfo502 *i = NULL;
3258 const char *comment = "Dummer Kommentar";
3259 struct dcerpc_pipe *srvsvc_pipe, *winreg_pipe;
3260
3261 torture_assert_ntstatus_ok(torture,
3262 torture_rpc_connection(torture, &srvsvc_pipe, &ndr_table_srvsvc),
3263 "failed to setup srvsvc");
3264
3265 torture_assert_ntstatus_ok(torture,
3266 torture_rpc_connection(torture, &winreg_pipe, &ndr_table_winreg),
3267 "failed to setup winreg");
3268
3269 torture_assert(torture,
3270 torture_samba3_createshare(torture, winreg_pipe->binding_handle, "blubber"),
3271 "torture_samba3_createshare failed");
3272
3273 torture_assert(torture,
3274 torture_samba3_setconfig(torture, winreg_pipe->binding_handle, "blubber", "comment", comment),
3275 "torture_samba3_setconfig failed");
3276
3277 torture_assert(torture,
3278 get_shareinfo(torture, srvsvc_pipe->binding_handle, dcerpc_server_name(srvsvc_pipe), "blubber", &i),
3279 "get_shareinfo failed");
3280
3281 torture_assert_str_equal(torture, comment, i->comment,
3282 "got unexpected comment");
3283
3284 torture_assert(torture,
3285 torture_samba3_deleteshare(torture, winreg_pipe->binding_handle, "blubber"),
3286 "torture_samba3_deleteshare failed");
3287
3288 return true;
3289 }
3290
3291 /*
3292 * Test that even with a result of 0 rids the array is returned as a
3293 * non-NULL pointer. Yes, XP does notice.
3294 */
3295
3296 bool torture_samba3_getaliasmembership_0(struct torture_context *torture)
3297 {
3298 struct dcerpc_pipe *p;
3299 struct dcerpc_binding_handle *b;
3300 struct samr_Connect2 c;
3301 struct samr_OpenDomain o;
3302 struct dom_sid sid;
3303 struct lsa_SidPtr ptr;
3304 struct lsa_SidArray sids;
3305 struct samr_GetAliasMembership g;
3306 struct samr_Ids rids;
3307 struct policy_handle samr, domain;
3308
3309 torture_assert_ntstatus_ok(torture,
3310 torture_rpc_connection(torture, &p, &ndr_table_samr),
3311 "failed to setup samr");
3312
3313 b = p->binding_handle;
3314
3315 c.in.system_name = NULL;
3316 c.in.access_mask = SAMR_ACCESS_LOOKUP_DOMAIN;
3317 c.out.connect_handle = &samr;
3318 torture_assert_ntstatus_ok(torture,
3319 dcerpc_samr_Connect2_r(b, torture, &c),
3320 "");
3321 torture_assert_ntstatus_ok(torture, c.out.result,
3322 "");
3323 dom_sid_parse("S-1-5-32", &sid);
3324 o.in.connect_handle = &samr;
3325 o.in.access_mask = SAMR_DOMAIN_ACCESS_LOOKUP_ALIAS;
3326 o.in.sid = &sid;
3327 o.out.domain_handle = &domain;
3328 torture_assert_ntstatus_ok(torture,
3329 dcerpc_samr_OpenDomain_r(b, torture, &o),
3330 "");
3331 torture_assert_ntstatus_ok(torture, o.out.result,
3332 "");
3333 dom_sid_parse("S-1-2-3-4-5", &sid);
3334 ptr.sid = &sid;
3335 sids.num_sids = 1;
3336 sids.sids = &ptr;
3337 g.in.domain_handle = &domain;
3338 g.in.sids = &sids;
3339 g.out.rids = &rids;
3340 torture_assert_ntstatus_ok(torture,
3341 dcerpc_samr_GetAliasMembership_r(b, torture, &g),
3342 "");
3343 torture_assert_ntstatus_ok(torture, g.out.result,
3344 "");
3345 if (rids.ids == NULL) {
3346 /* This is the piece to test here */
3347 torture_fail(torture,
3348 "torture_samba3_getaliasmembership_0: "
3349 "Server returns NULL rids array\n");
3350 }
3351
3352 return true;
3353 }
3354
3355 /**
3356 * Test smb reauthentication while rpc pipe is in use.
3357 */
3358 static bool torture_rpc_smb_reauth1(struct torture_context *torture)
3359 {
3360 TALLOC_CTX *mem_ctx;
3361 NTSTATUS status;
3362 bool ret = false;
3363 struct smbcli_state *cli;
3364 struct smbcli_options options;
3365 struct smbcli_session_options session_options;
3366
3367 struct dcerpc_pipe *lsa_pipe;
3368 struct dcerpc_binding_handle *lsa_handle;
3369 struct lsa_GetUserName r;
3370 struct lsa_String *authority_name_p = NULL;
3371 char *authority_name_saved = NULL;
3372 struct lsa_String *account_name_p = NULL;
3373 char *account_name_saved = NULL;
3374 struct cli_credentials *anon_creds = NULL;
3375 struct smb_composite_sesssetup io;
3376
3377 mem_ctx = talloc_init("torture_samba3_reauth");
3378 torture_assert(torture, (mem_ctx != NULL), "talloc_init failed");
3379
3380 lpcfg_smbcli_options(torture->lp_ctx, &options);
3381 lpcfg_smbcli_session_options(torture->lp_ctx, &session_options);
3382
3383 status = smbcli_full_connection(mem_ctx, &cli,
3384 torture_setting_string(torture, "host", NULL),
3385 lpcfg_smb_ports(torture->lp_ctx),
3386 "IPC$", NULL,
3387 lpcfg_socket_options(torture->lp_ctx),
3388 cmdline_credentials,
3389 lpcfg_resolve_context(torture->lp_ctx),
3390 torture->ev, &options, &session_options,
3391 lpcfg_gensec_settings(torture, torture->lp_ctx));
3392 torture_assert_ntstatus_ok_goto(torture, status, ret, done,
3393 "smbcli_full_connection failed");
3394
3395 status = pipe_bind_smb(torture, mem_ctx, cli->tree, "\\lsarpc",
3396 &ndr_table_lsarpc, &lsa_pipe);
3397 torture_assert_ntstatus_ok_goto(torture, status, ret, done,
3398 "pipe_bind_smb failed");
3399 lsa_handle = lsa_pipe->binding_handle;
3400
3401 /* lsa getusername */
3402
3403 ZERO_STRUCT(r);
3404 r.in.system_name = "\\";
3405 r.in.account_name = &account_name_p;
3406 r.in.authority_name = &authority_name_p;
3407 r.out.account_name = &account_name_p;
3408
3409 status = dcerpc_lsa_GetUserName_r(lsa_handle, mem_ctx, &r);
3410
3411 authority_name_p = *r.out.authority_name;
3412
3413 torture_assert_ntstatus_ok_goto(torture, status, ret, done,
3414 "GetUserName failed");
3415 torture_assert_ntstatus_ok_goto(torture, r.out.result, ret, done,
3416 "GetUserName failed");
3417
3418 torture_comment(torture, "lsa_GetUserName gave '%s\\%s'\n",
3419 authority_name_p->string,
3420 account_name_p->string);
3421
3422 account_name_saved = talloc_strdup(mem_ctx, account_name_p->string);
3423 torture_assert_goto(torture, (account_name_saved != NULL), ret, done,
3424 "talloc failed");
3425 authority_name_saved = talloc_strdup(mem_ctx, authority_name_p->string);
3426 torture_assert_goto(torture, (authority_name_saved != NULL), ret, done,
3427 "talloc failed");
3428
3429 /* smb re-authenticate as anonymous */
3430
3431 anon_creds = cli_credentials_init_anon(mem_ctx);
3432
3433 ZERO_STRUCT(io);
3434 io.in.sesskey = cli->transport->negotiate.sesskey;
3435 io.in.capabilities = cli->transport->negotiate.capabilities;
3436 io.in.credentials = anon_creds;
3437 io.in.workgroup = lpcfg_workgroup(torture->lp_ctx);
3438 io.in.gensec_settings = lpcfg_gensec_settings(torture, torture->lp_ctx);
3439
3440 status = smb_composite_sesssetup(cli->session, &io);
3441 torture_assert_ntstatus_ok_goto(torture, status, ret, done,
3442 "session reauth to anon failed");
3443
3444 /* re-do lsa getusername after reauth */
3445
3446 TALLOC_FREE(authority_name_p);
3447 TALLOC_FREE(account_name_p);
3448 ZERO_STRUCT(r);
3449 r.in.system_name = "\\";
3450 r.in.account_name = &account_name_p;
3451 r.in.authority_name = &authority_name_p;
3452 r.out.account_name = &account_name_p;
3453
3454 status = dcerpc_lsa_GetUserName_r(lsa_handle, mem_ctx, &r);
3455
3456 authority_name_p = *r.out.authority_name;
3457
3458 torture_assert_ntstatus_ok_goto(torture, status, ret, done,
3459 "GetUserName failed");
3460 torture_assert_ntstatus_ok_goto(torture, r.out.result, ret, done,
3461 "GetUserName failed");
3462
3463 torture_assert_goto(torture, (strcmp(authority_name_p->string, authority_name_saved) == 0),
3464 ret, done, "authority_name not equal after reauth to anon");
3465 torture_assert_goto(torture, (strcmp(account_name_p->string, account_name_saved) == 0),
3466 ret, done, "account_name not equal after reauth to anon");
3467
3468 /* smb re-auth again to the original user */
3469
3470 ZERO_STRUCT(io);
3471 io.in.sesskey = cli->transport->negotiate.sesskey;
3472 io.in.capabilities = cli->transport->negotiate.capabilities;
3473 io.in.credentials = cmdline_credentials;
3474 io.in.workgroup = lpcfg_workgroup(torture->lp_ctx);
3475 io.in.gensec_settings = lpcfg_gensec_settings(torture, torture->lp_ctx);
3476
3477 status = smb_composite_sesssetup(cli->session, &io);
3478 torture_assert_ntstatus_ok_goto(torture, status, ret, done,
3479 "session reauth to anon failed");
3480
3481 /* re-do lsa getusername */
3482
3483 TALLOC_FREE(authority_name_p);
3484 TALLOC_FREE(account_name_p);
3485 ZERO_STRUCT(r);
3486 r.in.system_name = "\\";
3487 r.in.account_name = &account_name_p;
3488 r.in.authority_name = &authority_name_p;
3489 r.out.account_name = &account_name_p;
3490
3491 status = dcerpc_lsa_GetUserName_r(lsa_handle, mem_ctx, &r);
3492
3493 authority_name_p = *r.out.authority_name;
3494
3495 torture_assert_ntstatus_ok_goto(torture, status, ret, done,
3496 "GetUserName failed");
3497 torture_assert_ntstatus_ok_goto(torture, r.out.result, ret, done,
3498 "GetUserName failed");
3499
3500 torture_assert_goto(torture, (strcmp(authority_name_p->string, authority_name_saved) == 0),
3501 ret, done, "authority_name not equal after reauth to anon");
3502 torture_assert_goto(torture, (strcmp(account_name_p->string, account_name_saved) == 0),
3503 ret, done, "account_name not equal after reauth to anon");
3504
3505 ret = true;
3506
3507 done:
3508 talloc_free(mem_ctx);
3509 return ret;
3510 }
3511
3512 /**
3513 * Test smb reauthentication while rpc pipe is in use.
3514 * Open a second lsa bind after reauth to anon.
3515 * Do lsa getusername on that second bind.
3516 */
3517 static bool torture_rpc_smb_reauth2(struct torture_context *torture)
3518 {
3519 TALLOC_CTX *mem_ctx;
3520 NTSTATUS status;
3521 bool ret = false;
3522 struct smbcli_state *cli;
3523 struct smbcli_options options;
3524 struct smbcli_session_options session_options;
3525
3526 struct dcerpc_pipe *lsa_pipe;
3527 struct dcerpc_binding_handle *lsa_handle;
3528 struct lsa_GetUserName r;
3529 struct lsa_String *authority_name_p = NULL;
3530 char *authority_name_saved = NULL;
3531 struct lsa_String *account_name_p = NULL;
3532 char *account_name_saved = NULL;
3533 struct cli_credentials *anon_creds = NULL;
3534 struct smb_composite_sesssetup io;
3535
3536 mem_ctx = talloc_init("torture_samba3_reauth");
3537 torture_assert(torture, (mem_ctx != NULL), "talloc_init failed");
3538
3539 lpcfg_smbcli_options(torture->lp_ctx, &options);
3540 lpcfg_smbcli_session_options(torture->lp_ctx, &session_options);
3541
3542 status = smbcli_full_connection(mem_ctx, &cli,
3543 torture_setting_string(torture, "host", NULL),
3544 lpcfg_smb_ports(torture->lp_ctx),
3545 "IPC$", NULL,
3546 lpcfg_socket_options(torture->lp_ctx),
3547 cmdline_credentials,
3548 lpcfg_resolve_context(torture->lp_ctx),
3549 torture->ev, &options, &session_options,
3550 lpcfg_gensec_settings(torture, torture->lp_ctx));
3551 torture_assert_ntstatus_ok_goto(torture, status, ret, done,
3552 "smbcli_full_connection failed");
3553
3554 /* smb re-authenticate as anonymous */
3555
3556 anon_creds = cli_credentials_init_anon(mem_ctx);
3557
3558 ZERO_STRUCT(io);
3559 io.in.sesskey = cli->transport->negotiate.sesskey;
3560 io.in.capabilities = cli->transport->negotiate.capabilities;
3561 io.in.credentials = anon_creds;
3562 io.in.workgroup = lpcfg_workgroup(torture->lp_ctx);
3563 io.in.gensec_settings = lpcfg_gensec_settings(torture, torture->lp_ctx);
3564
3565 status = smb_composite_sesssetup(cli->session, &io);
3566 torture_assert_ntstatus_ok_goto(torture, status, ret, done,
3567 "session reauth to anon failed");
3568
3569 /* open the lsa pipe */
3570
3571 status = pipe_bind_smb(torture, mem_ctx, cli->tree, "\\lsarpc",
3572 &ndr_table_lsarpc, &lsa_pipe);
3573 torture_assert_ntstatus_ok_goto(torture, status, ret, done,
3574 "pipe_bind_smb failed");
3575 lsa_handle = lsa_pipe->binding_handle;
3576
3577 /* lsa getusername */
3578
3579 ZERO_STRUCT(r);
3580 r.in.system_name = "\\";
3581 r.in.account_name = &account_name_p;
3582 r.in.authority_name = &authority_name_p;
3583 r.out.account_name = &account_name_p;
3584
3585 status = dcerpc_lsa_GetUserName_r(lsa_handle, mem_ctx, &r);
3586
3587 authority_name_p = *r.out.authority_name;
3588
3589 torture_assert_ntstatus_ok_goto(torture, status, ret, done,
3590 "GetUserName failed");
3591 torture_assert_ntstatus_ok_goto(torture, r.out.result, ret, done,
3592 "GetUserName failed");
3593
3594 torture_comment(torture, "lsa_GetUserName gave '%s\\%s'\n",
3595 authority_name_p->string,
3596 account_name_p->string);
3597
3598 account_name_saved = talloc_strdup(mem_ctx, account_name_p->string);
3599 torture_assert_goto(torture, (account_name_saved != NULL), ret, done,
3600 "talloc failed");
3601 authority_name_saved = talloc_strdup(mem_ctx, authority_name_p->string);
3602 torture_assert_goto(torture, (authority_name_saved != NULL), ret, done,
3603 "talloc failed");
3604
3605 /* smb re-auth again to the original user */
3606
3607 ZERO_STRUCT(io);
3608 io.in.sesskey = cli->transport->negotiate.sesskey;
3609 io.in.capabilities = cli->transport->negotiate.capabilities;
3610 io.in.credentials = cmdline_credentials;
3611 io.in.workgroup = lpcfg_workgroup(torture->lp_ctx);
3612 io.in.gensec_settings = lpcfg_gensec_settings(torture, torture->lp_ctx);
3613
3614 status = smb_composite_sesssetup(cli->session, &io);
3615 torture_assert_ntstatus_ok_goto(torture, status, ret, done,
3616 "session reauth to anon failed");
3617
3618 /* re-do lsa getusername after reauth */
3619
3620 TALLOC_FREE(authority_name_p);
3621 TALLOC_FREE(account_name_p);
3622 ZERO_STRUCT(r);
3623 r.in.system_name = "\\";
3624 r.in.account_name = &account_name_p;
3625 r.in.authority_name = &authority_name_p;
3626 r.out.account_name = &account_name_p;
3627
3628 status = dcerpc_lsa_GetUserName_r(lsa_handle, mem_ctx, &r);
3629
3630 authority_name_p = *r.out.authority_name;
3631
3632 torture_assert_ntstatus_ok_goto(torture, status, ret, done,
3633 "GetUserName failed");
3634 torture_assert_ntstatus_ok_goto(torture, r.out.result, ret, done,
3635 "GetUserName failed");
3636
3637 torture_assert_goto(torture, (strcmp(authority_name_p->string, authority_name_saved) == 0),
3638 ret, done, "authority_name not equal after reauth to anon");
3639 torture_assert_goto(torture, (strcmp(account_name_p->string, account_name_saved) == 0),
3640 ret, done, "account_name not equal after reauth to anon");
3641
3642 ret = true;
3643
3644 done:
3645 talloc_free(mem_ctx);
3646 return ret;
3647 }
3648
3649 /**
3650 * Test smb2 reauthentication while rpc pipe is in use.
3651 */
3652 static bool torture_rpc_smb2_reauth1(struct torture_context *torture)
3653 {
3654 TALLOC_CTX *mem_ctx;
3655 NTSTATUS status;
3656 bool ret = false;
3657 struct smbcli_options options;
3658
3659 struct dcerpc_pipe *lsa_pipe;
3660 struct dcerpc_binding_handle *lsa_handle;
3661 struct lsa_GetUserName r;
3662 struct lsa_String *authority_name_p = NULL;
3663 char *authority_name_saved = NULL;
3664 struct lsa_String *account_name_p = NULL;
3665 char *account_name_saved = NULL;
3666 struct cli_credentials *anon_creds = NULL;
3667 const char *host = torture_setting_string(torture, "host", NULL);
3668 struct smb2_tree *tree;
3669
3670 mem_ctx = talloc_init("torture_samba3_reauth");
3671 torture_assert(torture, (mem_ctx != NULL), "talloc_init failed");
3672
3673 lpcfg_smbcli_options(torture->lp_ctx, &options);
3674
3675 status = smb2_connect(mem_ctx,
3676 host,
3677 lpcfg_smb_ports(torture->lp_ctx),
3678 "IPC$",
3679 lpcfg_resolve_context(torture->lp_ctx),
3680 cmdline_credentials,
3681 &tree,
3682 torture->ev,
3683 &options,
3684 lpcfg_socket_options(torture->lp_ctx),
3685 lpcfg_gensec_settings(torture, torture->lp_ctx)
3686 );
3687 torture_assert_ntstatus_ok_goto(torture, status, ret, done,
3688 "smb2_connect failed");
3689
3690 lsa_pipe = dcerpc_pipe_init(mem_ctx, torture->ev);
3691 torture_assert_goto(torture, (lsa_pipe != NULL), ret, done,
3692 "dcerpc_pipe_init failed");
3693 lsa_handle = lsa_pipe->binding_handle;
3694
3695 status = dcerpc_pipe_open_smb2(lsa_pipe, tree, "lsarpc");
3696 torture_assert_ntstatus_ok_goto(torture, status, ret, done,
3697 "dcerpc_pipe_open_smb2 failed");
3698
3699 status = dcerpc_bind_auth_none(lsa_pipe, &ndr_table_lsarpc);
3700 torture_assert_ntstatus_ok_goto(torture, status, ret, done,
3701 "dcerpc_bind_auth_none failed");
3702
3703 /* lsa getusername */
3704
3705 ZERO_STRUCT(r);
3706 r.in.system_name = "\\";
3707 r.in.account_name = &account_name_p;
3708 r.in.authority_name = &authority_name_p;
3709 r.out.account_name = &account_name_p;
3710
3711 status = dcerpc_lsa_GetUserName_r(lsa_handle, mem_ctx, &r);
3712
3713 authority_name_p = *r.out.authority_name;
3714
3715 torture_assert_ntstatus_ok_goto(torture, status, ret, done,
3716 "GetUserName failed");
3717 torture_assert_ntstatus_ok_goto(torture, r.out.result, ret, done,
3718 "GetUserName failed");
3719
3720 torture_comment(torture, "lsa_GetUserName gave '%s\\%s'\n",
3721 authority_name_p->string,
3722 account_name_p->string);
3723
3724 account_name_saved = talloc_strdup(mem_ctx, account_name_p->string);
3725 torture_assert_goto(torture, (account_name_saved != NULL), ret, done,
3726 "talloc failed");
3727 authority_name_saved = talloc_strdup(mem_ctx, authority_name_p->string);
3728 torture_assert_goto(torture, (authority_name_saved != NULL), ret, done,
3729 "talloc failed");
3730
3731 /* smb re-authenticate as anonymous */
3732
3733 anon_creds = cli_credentials_init_anon(mem_ctx);
3734
3735 status = smb2_session_setup_spnego(tree->session,
3736 anon_creds,
3737 0 /* previous_session_id */);
3738 torture_assert_ntstatus_ok_goto(torture, status, ret, done,
3739 "session reauth to anon failed");
3740
3741 /* re-do lsa getusername after reauth */
3742
3743 TALLOC_FREE(authority_name_p);
3744 TALLOC_FREE(account_name_p);
3745 ZERO_STRUCT(r);
3746 r.in.system_name = "\\";
3747 r.in.account_name = &account_name_p;
3748 r.in.authority_name = &authority_name_p;
3749 r.out.account_name = &account_name_p;
3750
3751 status = dcerpc_lsa_GetUserName_r(lsa_handle, mem_ctx, &r);
3752
3753 authority_name_p = *r.out.authority_name;
3754
3755 torture_assert_ntstatus_ok_goto(torture, status, ret, done,
3756 "GetUserName failed");
3757 torture_assert_ntstatus_ok_goto(torture, r.out.result, ret, done,
3758 "GetUserName failed");
3759
3760 torture_assert_goto(torture, (strcmp(authority_name_p->string, authority_name_saved) == 0),
3761 ret, done, "authority_name not equal after reauth to anon");
3762 torture_assert_goto(torture, (strcmp(account_name_p->string, account_name_saved) == 0),
3763 ret, done, "account_name not equal after reauth to anon");
3764
3765 /* smb re-auth again to the original user */
3766
3767 status = smb2_session_setup_spnego(tree->session,
3768 cmdline_credentials,
3769 0 /* previous_session_id */);
3770 torture_assert_ntstatus_ok_goto(torture, status, ret, done,
3771 "session reauth to anon failed");
3772
3773 /* re-do lsa getusername */
3774
3775 TALLOC_FREE(authority_name_p);
3776 TALLOC_FREE(account_name_p);
3777 ZERO_STRUCT(r);
3778 r.in.system_name = "\\";
3779 r.in.account_name = &account_name_p;
3780 r.in.authority_name = &authority_name_p;
3781 r.out.account_name = &account_name_p;
3782
3783 status = dcerpc_lsa_GetUserName_r(lsa_handle, mem_ctx, &r);
3784
3785 authority_name_p = *r.out.authority_name;
3786
3787 torture_assert_ntstatus_ok_goto(torture, status, ret, done,
3788 "GetUserName failed");
3789 torture_assert_ntstatus_ok_goto(torture, r.out.result, ret, done,
3790 "GetUserName failed");
3791
3792 torture_assert_goto(torture, (strcmp(authority_name_p->string, authority_name_saved) == 0),
3793 ret, done, "authority_name not equal after reauth to anon");
3794 torture_assert_goto(torture, (strcmp(account_name_p->string, account_name_saved) == 0),
3795 ret, done, "account_name not equal after reauth to anon");
3796
3797 ret = true;
3798
3799 done:
3800 talloc_free(mem_ctx);
3801 return ret;
3802 }
3803
3804 /**
3805 * Test smb2 reauthentication while rpc pipe is in use.
3806 * Open a second lsa bind after reauth to anon.
3807 * Do lsa getusername on that second bind.
3808 */
3809 static bool torture_rpc_smb2_reauth2(struct torture_context *torture)
3810 {
3811 TALLOC_CTX *mem_ctx;
3812 NTSTATUS status;
3813 bool ret = false;
3814 struct smbcli_options options;
3815
3816 struct dcerpc_pipe *lsa_pipe;
3817 struct dcerpc_binding_handle *lsa_handle;
3818 struct lsa_GetUserName r;
3819 struct lsa_String *authority_name_p = NULL;
3820 char *authority_name_saved = NULL;
3821 struct lsa_String *account_name_p = NULL;
3822 char *account_name_saved = NULL;
3823 struct cli_credentials *anon_creds = NULL;
3824 const char *host = torture_setting_string(torture, "host", NULL);
3825 struct smb2_tree *tree;
3826
3827 mem_ctx = talloc_init("torture_samba3_reauth");
3828 torture_assert(torture, (mem_ctx != NULL), "talloc_init failed");
3829
3830 lpcfg_smbcli_options(torture->lp_ctx, &options);
3831
3832 status = smb2_connect(mem_ctx,
3833 host,
3834 lpcfg_smb_ports(torture->lp_ctx),
3835 "IPC$",
3836 lpcfg_resolve_context(torture->lp_ctx),
3837 cmdline_credentials,
3838 &tree,
3839 torture->ev,
3840 &options,
3841 lpcfg_socket_options(torture->lp_ctx),
3842 lpcfg_gensec_settings(torture, torture->lp_ctx)
3843 );
3844 torture_assert_ntstatus_ok_goto(torture, status, ret, done,
3845 "smb2_connect failed");
3846
3847 /* smb re-authenticate as anonymous */
3848
3849 anon_creds = cli_credentials_init_anon(mem_ctx);
3850
3851 status = smb2_session_setup_spnego(tree->session,
3852 anon_creds,
3853 0 /* previous_session_id */);
3854 torture_assert_ntstatus_ok_goto(torture, status, ret, done,
3855 "session reauth to anon failed");
3856
3857 /* open the lsa pipe */
3858
3859 lsa_pipe = dcerpc_pipe_init(mem_ctx, torture->ev);
3860 torture_assert_goto(torture, (lsa_pipe != NULL), ret, done,
3861 "dcerpc_pipe_init failed");
3862 lsa_handle = lsa_pipe->binding_handle;
3863
3864 status = dcerpc_pipe_open_smb2(lsa_pipe, tree, "lsarpc");
3865 torture_assert_ntstatus_ok_goto(torture, status, ret, done,
3866 "dcerpc_pipe_open_smb2 failed");
3867
3868 status = dcerpc_bind_auth_none(lsa_pipe, &ndr_table_lsarpc);
3869 torture_assert_ntstatus_ok_goto(torture, status, ret, done,
3870 "dcerpc_bind_auth_none failed");
3871
3872 /* lsa getusername */
3873
3874 ZERO_STRUCT(r);
3875 r.in.system_name = "\\";
3876 r.in.account_name = &account_name_p;
3877 r.in.authority_name = &authority_name_p;
3878 r.out.account_name = &account_name_p;
3879
3880 status = dcerpc_lsa_GetUserName_r(lsa_handle, mem_ctx, &r);
3881
3882 authority_name_p = *r.out.authority_name;
3883
3884 torture_assert_ntstatus_ok_goto(torture, status, ret, done,
3885 "GetUserName failed");
3886 torture_assert_ntstatus_ok_goto(torture, r.out.result, ret, done,
3887 "GetUserName failed");
3888
3889 torture_comment(torture, "lsa_GetUserName gave '%s\\%s'\n",
3890 authority_name_p->string,
3891 account_name_p->string);
3892
3893 account_name_saved = talloc_strdup(mem_ctx, account_name_p->string);
3894 torture_assert_goto(torture, (account_name_saved != NULL), ret, done,
3895 "talloc failed");
3896 authority_name_saved = talloc_strdup(mem_ctx, authority_name_p->string);
3897 torture_assert_goto(torture, (authority_name_saved != NULL), ret, done,
3898 "talloc failed");
3899
3900 /* smb re-auth again to the original user */
3901
3902 status = smb2_session_setup_spnego(tree->session,
3903 cmdline_credentials,
3904 0 /* previous_session_id */);
3905 torture_assert_ntstatus_ok_goto(torture, status, ret, done,
3906 "session reauth to anon failed");
3907
3908 /* re-do lsa getusername */
3909
3910 TALLOC_FREE(authority_name_p);
3911 TALLOC_FREE(account_name_p);
3912 ZERO_STRUCT(r);
3913 r.in.system_name = "\\";
3914 r.in.account_name = &account_name_p;
3915 r.in.authority_name = &authority_name_p;
3916 r.out.account_name = &account_name_p;
3917
3918 status = dcerpc_lsa_GetUserName_r(lsa_handle, mem_ctx, &r);
3919
3920 authority_name_p = *r.out.authority_name;
3921
3922 torture_assert_ntstatus_ok_goto(torture, status, ret, done,
3923 "GetUserName failed");
3924 torture_assert_ntstatus_ok_goto(torture, r.out.result, ret, done,
3925 "GetUserName failed");
3926
3927 torture_assert_goto(torture, (strcmp(authority_name_p->string, authority_name_saved) == 0),
3928 ret, done, "authority_name not equal after reauth to anon");
3929 torture_assert_goto(torture, (strcmp(account_name_p->string, account_name_saved) == 0),
3930 ret, done, "account_name not equal after reauth to anon");
3931
3932 ret = true;
3933
3934 done:
3935 talloc_free(mem_ctx);
3936 return ret;
3937 }
3938
3939 static bool torture_rpc_smb1_pipe_name(struct torture_context *torture)
3940 {
3941 TALLOC_CTX *mem_ctx;
3942 NTSTATUS status;
3943 bool ret = false;
3944 struct smbcli_state *cli;
3945 struct smbcli_options options;
3946 struct smbcli_session_options session_options;
3947 union smb_open io;
3948 union smb_close cl;
3949 uint16_t fnum;
3950
3951 mem_ctx = talloc_init("torture_samba3_smb1_pipe_name");
3952 torture_assert(torture, (mem_ctx != NULL), "talloc_init failed");
3953
3954 lpcfg_smbcli_options(torture->lp_ctx, &options);
3955 lpcfg_smbcli_session_options(torture->lp_ctx, &session_options);
3956
3957 status = smbcli_full_connection(mem_ctx, &cli,
3958 torture_setting_string(torture, "host", NULL),
3959 lpcfg_smb_ports(torture->lp_ctx),
3960 "IPC$", NULL,
3961 lpcfg_socket_options(torture->lp_ctx),
3962 cmdline_credentials,
3963 lpcfg_resolve_context(torture->lp_ctx),
3964 torture->ev, &options, &session_options,
3965 lpcfg_gensec_settings(torture, torture->lp_ctx));
3966 torture_assert_ntstatus_ok_goto(torture, status, ret, done,
3967 "smbcli_full_connection failed");
3968
3969 ZERO_STRUCT(io);
3970 io.generic.level = RAW_OPEN_NTCREATEX;
3971 io.ntcreatex.in.access_mask = DESIRED_ACCESS_PIPE;
3972 io.ntcreatex.in.share_access = NTCREATEX_SHARE_ACCESS_READ|
3973 NTCREATEX_SHARE_ACCESS_WRITE;
3974 io.ntcreatex.in.open_disposition = NTCREATEX_DISP_OPEN;
3975 io.ntcreatex.in.impersonation = NTCREATEX_IMPERSONATION_IMPERSONATION;
3976 io.ntcreatex.in.security_flags = 0;
3977
3978 io.ntcreatex.in.fname = "__none__";
3979 status = smb_raw_open(cli->tree, torture, &io);
3980 torture_assert_ntstatus_equal_goto(torture, status, NT_STATUS_OBJECT_NAME_NOT_FOUND,
3981 ret, done,
3982 "smb_raw_open for '__none__'");
3983
3984 io.ntcreatex.in.fname = "pipe\\srvsvc";
3985 status = smb_raw_open(cli->tree, torture, &io);
3986 torture_assert_ntstatus_equal_goto(torture, status, NT_STATUS_OBJECT_NAME_NOT_FOUND,
3987 ret, done,
3988 "smb_raw_open for 'pipe\\srvsvc'");
3989
3990 io.ntcreatex.in.fname = "\\pipe\\srvsvc";
3991 status = smb_raw_open(cli->tree, torture, &io);
3992 torture_assert_ntstatus_equal_goto(torture, status, NT_STATUS_OBJECT_NAME_NOT_FOUND,
3993 ret, done,
3994 "smb_raw_open for '\\pipe\\srvsvc'");
3995
3996 io.ntcreatex.in.fname = "srvsvc";
3997 status = smb_raw_open(cli->tree, torture, &io);
3998 torture_assert_ntstatus_ok_goto(torture, status, ret, done,
3999 "smb2_create failed for 'srvsvc'");
4000 fnum = io.ntcreatex.out.file.fnum;
4001 ZERO_STRUCT(cl);
4002 cl.generic.level = RAW_CLOSE_CLOSE;
4003 cl.close.in.file.fnum = fnum;
4004 status = smb_raw_close(cli->tree, &cl);
4005 torture_assert_ntstatus_ok_goto(torture, status, ret, done,
4006 "smb_raw_close failed");
4007
4008 io.ntcreatex.in.fname = "\\srvsvc";
4009 status = smb_raw_open(cli->tree, torture, &io);
4010 torture_assert_ntstatus_ok_goto(torture, status, ret, done,
4011 "smb2_create failed for '\\srvsvc'");
4012 fnum = io.ntcreatex.out.file.fnum;
4013 ZERO_STRUCT(cl);
4014 cl.generic.level = RAW_CLOSE_CLOSE;
4015 cl.close.in.file.fnum = fnum;
4016 status = smb_raw_close(cli->tree, &cl);
4017 torture_assert_ntstatus_ok_goto(torture, status, ret, done,
4018 "smb_raw_close failed");
4019
4020 io.ntcreatex.in.fname = "\\\\\\\\\\srvsvc";
4021 status = smb_raw_open(cli->tree, torture, &io);
4022 torture_assert_ntstatus_ok_goto(torture, status, ret, done,
4023 "smb2_create failed for '\\\\\\\\\\srvsvc'");
4024 fnum = io.ntcreatex.out.file.fnum;
4025 ZERO_STRUCT(cl);
4026 cl.generic.level = RAW_CLOSE_CLOSE;
4027 cl.close.in.file.fnum = fnum;
4028 status = smb_raw_close(cli->tree, &cl);
4029 torture_assert_ntstatus_ok_goto(torture, status, ret, done,
4030 "smb_raw_close failed");
4031
4032 ZERO_STRUCT(io);
4033 io.generic.level = RAW_OPEN_NTTRANS_CREATE;
4034 io.nttrans.in.access_mask = DESIRED_ACCESS_PIPE;
4035 io.nttrans.in.share_access = NTCREATEX_SHARE_ACCESS_READ|
4036 NTCREATEX_SHARE_ACCESS_WRITE;
4037 io.nttrans.in.open_disposition = NTCREATEX_DISP_OPEN;
4038 io.nttrans.in.impersonation = NTCREATEX_IMPERSONATION_IMPERSONATION;
4039 io.nttrans.in.security_flags = 0;
4040
4041 io.nttrans.in.fname = "__none__";
4042 status = smb_raw_open(cli->tree, torture, &io);
4043 torture_assert_ntstatus_equal_goto(torture, status, NT_STATUS_OBJECT_NAME_NOT_FOUND,
4044 ret, done,
4045 "smb_raw_open for '__none__'");
4046
4047 io.nttrans.in.fname = "pipe\\srvsvc";
4048 status = smb_raw_open(cli->tree, torture, &io);
4049 torture_assert_ntstatus_equal_goto(torture, status, NT_STATUS_OBJECT_NAME_NOT_FOUND,
4050 ret, done,
4051 "smb_raw_open for 'pipe\\srvsvc'");
4052
4053 io.nttrans.in.fname = "\\pipe\\srvsvc";
4054 status = smb_raw_open(cli->tree, torture, &io);
4055 torture_assert_ntstatus_equal_goto(torture, status, NT_STATUS_OBJECT_NAME_NOT_FOUND,
4056 ret, done,
4057 "smb_raw_open for '\\pipe\\srvsvc'");
4058
4059 io.nttrans.in.fname = "srvsvc";
4060 status = smb_raw_open(cli->tree, torture, &io);
4061 torture_assert_ntstatus_ok_goto(torture, status, ret, done,
4062 "smb2_create failed for 'srvsvc'");
4063 fnum = io.nttrans.out.file.fnum;
4064 ZERO_STRUCT(cl);
4065 cl.generic.level = RAW_CLOSE_CLOSE;
4066 cl.close.in.file.fnum = fnum;
4067 status = smb_raw_close(cli->tree, &cl);
4068 torture_assert_ntstatus_ok_goto(torture, status, ret, done,
4069 "smb_raw_close failed");
4070
4071 io.nttrans.in.fname = "\\srvsvc";
4072 status = smb_raw_open(cli->tree, torture, &io);
4073 torture_assert_ntstatus_ok_goto(torture, status, ret, done,
4074 "smb2_create failed for '\\srvsvc'");
4075 fnum = io.nttrans.out.file.fnum;
4076 ZERO_STRUCT(cl);
4077 cl.generic.level = RAW_CLOSE_CLOSE;
4078 cl.close.in.file.fnum = fnum;
4079 status = smb_raw_close(cli->tree, &cl);
4080 torture_assert_ntstatus_ok_goto(torture, status, ret, done,
4081 "smb_raw_close failed");
4082
4083 io.nttrans.in.fname = "\\\\\\\\\\srvsvc";
4084 status = smb_raw_open(cli->tree, torture, &io);
4085 torture_assert_ntstatus_ok_goto(torture, status, ret, done,
4086 "smb2_create failed for '\\\\\\\\\\srvsvc'");
4087 fnum = io.nttrans.out.file.fnum;
4088 ZERO_STRUCT(cl);
4089 cl.generic.level = RAW_CLOSE_CLOSE;
4090 cl.close.in.file.fnum = fnum;
4091 status = smb_raw_close(cli->tree, &cl);
4092 torture_assert_ntstatus_ok_goto(torture, status, ret, done,
4093 "smb_raw_close failed");
4094
4095 ZERO_STRUCT(io);
4096 io.generic.level = RAW_OPEN_OPENX;
4097 io.openx.in.open_mode = OPENX_MODE_ACCESS_RDWR;
4098 io.openx.in.open_func = OPENX_OPEN_FUNC_OPEN;
4099
4100 io.openx.in.fname = "__none__";
4101 status = smb_raw_open(cli->tree, torture, &io);
4102 torture_assert_ntstatus_equal_goto(torture, status, NT_STATUS_OBJECT_PATH_SYNTAX_BAD,
4103 ret, done,
4104 "smb_raw_open for '__none__'");
4105
4106 io.openx.in.fname = "srvsvc";
4107 status = smb_raw_open(cli->tree, torture, &io);
4108 torture_assert_ntstatus_equal_goto(torture, status, NT_STATUS_OBJECT_PATH_SYNTAX_BAD,
4109 ret, done,
4110 "smb_raw_open for 'srvsvc'");
4111
4112 io.openx.in.fname = "\\srvsvc";
4113 status = smb_raw_open(cli->tree, torture, &io);
4114 torture_assert_ntstatus_equal_goto(torture, status, NT_STATUS_OBJECT_PATH_SYNTAX_BAD,
4115 ret, done,
4116 "smb_raw_open for '\\srvsvc'");
4117
4118 io.openx.in.fname = "\\pipesrvsvc";
4119 status = smb_raw_open(cli->tree, torture, &io);
4120 torture_assert_ntstatus_equal_goto(torture, status, NT_STATUS_OBJECT_PATH_SYNTAX_BAD,
4121 ret, done,
4122 "smb_raw_open for '\\pipesrvsvc'");
4123
4124 io.openx.in.fname = "pipe\\__none__";
4125 status = smb_raw_open(cli->tree, torture, &io);
4126 torture_assert_ntstatus_equal_goto(torture, status, NT_STATUS_OBJECT_NAME_NOT_FOUND,
4127 ret, done,
4128 "smb_raw_open for 'pipe\\__none__'");
4129
4130 io.openx.in.fname = "\\pipe\\__none__";
4131 status = smb_raw_open(cli->tree, torture, &io);
4132 torture_assert_ntstatus_equal_goto(torture, status, NT_STATUS_OBJECT_NAME_NOT_FOUND,
4133 ret, done,
4134 "smb_raw_open for '\\pipe\\__none__'");
4135
4136 io.openx.in.fname = "pipe\\srvsvc";
4137 status = smb_raw_open(cli->tree, torture, &io);
4138 torture_assert_ntstatus_ok_goto(torture, status, ret, done,
4139 "smb2_create failed for 'pipe\\srvsvc'");
4140 fnum = io.openx.out.file.fnum;
4141 ZERO_STRUCT(cl);
4142 cl.generic.level = RAW_CLOSE_CLOSE;
4143 cl.close.in.file.fnum = fnum;
4144 status = smb_raw_close(cli->tree, &cl);
4145 torture_assert_ntstatus_ok_goto(torture, status, ret, done,
4146 "smb_raw_close failed");
4147
4148 io.openx.in.fname = "\\pipe\\srvsvc";
4149 status = smb_raw_open(cli->tree, torture, &io);
4150 torture_assert_ntstatus_ok_goto(torture, status, ret, done,
4151 "smb2_create failed for '\\pipe\\srvsvc'");
4152 fnum = io.openx.out.file.fnum;
4153 ZERO_STRUCT(cl);
4154 cl.generic.level = RAW_CLOSE_CLOSE;
4155 cl.close.in.file.fnum = fnum;
4156 status = smb_raw_close(cli->tree, &cl);
4157 torture_assert_ntstatus_ok_goto(torture, status, ret, done,
4158 "smb_raw_close failed");
4159
4160 io.openx.in.fname = "\\\\\\\\\\pipe\\srvsvc";
4161 status = smb_raw_open(cli->tree, torture, &io);
4162 torture_assert_ntstatus_ok_goto(torture, status, ret, done,
4163 "smb2_create failed for '\\\\\\\\\\pipe\\srvsvc'");
4164 fnum = io.openx.out.file.fnum;
4165 ZERO_STRUCT(cl);
4166 cl.generic.level = RAW_CLOSE_CLOSE;
4167 cl.close.in.file.fnum = fnum;
4168 status = smb_raw_close(cli->tree, &cl);
4169 torture_assert_ntstatus_ok_goto(torture, status, ret, done,
4170 "smb_raw_close failed");
4171
4172 io.openx.in.fname = "\\\\\\\\\\pipe\\\\\\\\\\srvsvc";
4173 status = smb_raw_open(cli->tree, torture, &io);
4174 torture_assert_ntstatus_ok_goto(torture, status, ret, done,
4175 "smb2_create failed for '\\\\\\\\\\pipe\\\\\\\\\\srvsvc'");
4176 fnum = io.openx.out.file.fnum;
4177 ZERO_STRUCT(cl);
4178 cl.generic.level = RAW_CLOSE_CLOSE;
4179 cl.close.in.file.fnum = fnum;
4180 status = smb_raw_close(cli->tree, &cl);
4181 torture_assert_ntstatus_ok_goto(torture, status, ret, done,
4182 "smb_raw_close failed");
4183 ret = true;
4184
4185 done:
4186 talloc_free(mem_ctx);
4187 return ret;
4188 }
4189
4190 static bool torture_rpc_smb2_pipe_name(struct torture_context *torture)
4191 {
4192 TALLOC_CTX *mem_ctx;
4193 NTSTATUS status;
4194 bool ret = false;
4195 struct smbcli_options options;
4196 const char *host = torture_setting_string(torture, "host", NULL);
4197 struct smb2_tree *tree;
4198 struct smb2_handle h;
4199 struct smb2_create io;
4200
4201 mem_ctx = talloc_init("torture_samba3_smb2_pipe_name");
4202 torture_assert(torture, (mem_ctx != NULL), "talloc_init failed");
4203
4204 lpcfg_smbcli_options(torture->lp_ctx, &options);
4205
4206 status = smb2_connect(mem_ctx,
4207 host,
4208 lpcfg_smb_ports(torture->lp_ctx),
4209 "IPC$",
4210 lpcfg_resolve_context(torture->lp_ctx),
4211 cmdline_credentials,
4212 &tree,
4213 torture->ev,
4214 &options,
4215 lpcfg_socket_options(torture->lp_ctx),
4216 lpcfg_gensec_settings(torture, torture->lp_ctx)
4217 );
4218 torture_assert_ntstatus_ok_goto(torture, status, ret, done,
4219 "smb2_connect failed");
4220
4221 ZERO_STRUCT(io);
4222 io.in.oplock_level = 0;
4223 io.in.desired_access = DESIRED_ACCESS_PIPE;
4224 io.in.impersonation_level = SMB2_IMPERSONATION_IMPERSONATION;
4225 io.in.file_attributes = 0;
4226 io.in.create_disposition = NTCREATEX_DISP_OPEN;
4227 io.in.share_access =
4228 NTCREATEX_SHARE_ACCESS_READ|
4229 NTCREATEX_SHARE_ACCESS_WRITE;
4230 io.in.create_options = 0;
4231
4232 io.in.fname = "__none__";
4233 status = smb2_create(tree, tree, &io);
4234 torture_assert_ntstatus_equal_goto(torture, status, NT_STATUS_OBJECT_NAME_NOT_FOUND,
4235 ret, done,
4236 "smb2_create for '__none__'");
4237
4238 io.in.fname = "\\srvsvc";
4239 status = smb2_create(tree, tree, &io);
4240 torture_assert_ntstatus_equal_goto(torture, status, NT_STATUS_OBJECT_NAME_NOT_FOUND,
4241 ret, done,
4242 "smb2_create for '\\srvsvc'");
4243
4244 io.in.fname = "\\pipe\\srvsvc";
4245 status = smb2_create(tree, tree, &io);
4246 torture_assert_ntstatus_equal_goto(torture, status, NT_STATUS_OBJECT_NAME_NOT_FOUND,
4247 ret, done,
4248 "smb2_create for '\\pipe\\srvsvc'");
4249
4250 io.in.fname = "pipe\\srvsvc";
4251 status = smb2_create(tree, tree, &io);
4252 torture_assert_ntstatus_equal_goto(torture, status, NT_STATUS_OBJECT_NAME_NOT_FOUND,
4253 ret, done,
4254 "smb2_create for 'pipe\\srvsvc'");
4255
4256 io.in.fname = "srvsvc";
4257 status = smb2_create(tree, tree, &io);
4258 torture_assert_ntstatus_ok_goto(torture, status, ret, done,
4259 "smb2_create failed for 'srvsvc'");
4260
4261 h = io.out.file.handle;
4262
4263 status = smb2_util_close(tree, h);
4264 torture_assert_ntstatus_ok_goto(torture, status, ret, done,
4265 "smb2_util_close failed");
4266
4267 ret = true;
4268 done:
4269 talloc_free(mem_ctx);
4270 return ret;
4271 }
4272
4273 /**
4274 * Test behaviour of a waiting read call on a pipe when
4275 * the pipe handle is closed:
4276 * - open a pipe via smb2
4277 * - trigger a read which hangs since there is nothing to read
4278 * - close the pipe file handle
4279 * - wait for the read to return and check the status
4280 * (STATUS_PIPE_BROKEN)
4281 */
4282 static bool torture_rpc_smb2_pipe_read_close(struct torture_context *torture)
4283 {
4284 TALLOC_CTX *mem_ctx;
4285 NTSTATUS status;
4286 bool ret = false;
4287 struct smbcli_options options;
4288 const char *host = torture_setting_string(torture, "host", NULL);
4289 struct smb2_tree *tree;
4290 struct smb2_handle h;
4291 struct smb2_request *smb2req;
4292 struct smb2_create io;
4293 struct smb2_read rd;
4294
4295 mem_ctx = talloc_init("torture_samba3_pipe_read_close");
4296 torture_assert(torture, (mem_ctx != NULL), "talloc_init failed");
4297
4298 lpcfg_smbcli_options(torture->lp_ctx, &options);
4299
4300 status = smb2_connect(mem_ctx,
4301 host,
4302 lpcfg_smb_ports(torture->lp_ctx),
4303 "IPC$",
4304 lpcfg_resolve_context(torture->lp_ctx),
4305 cmdline_credentials,
4306 &tree,
4307 torture->ev,
4308 &options,
4309 lpcfg_socket_options(torture->lp_ctx),
4310 lpcfg_gensec_settings(torture, torture->lp_ctx)
4311 );
4312 torture_assert_ntstatus_ok_goto(torture, status, ret, done,
4313 "smb2_connect failed");
4314
4315 ZERO_STRUCT(io);
4316 io.in.oplock_level = 0;
4317 io.in.desired_access = DESIRED_ACCESS_PIPE;
4318 io.in.impersonation_level = SMB2_IMPERSONATION_IMPERSONATION;
4319 io.in.file_attributes = 0;
4320 io.in.create_disposition = NTCREATEX_DISP_OPEN;
4321 io.in.share_access =
4322 NTCREATEX_SHARE_ACCESS_READ|
4323 NTCREATEX_SHARE_ACCESS_WRITE;
4324 io.in.create_options = 0;
4325 io.in.fname = "lsarpc";
4326
4327 status = smb2_create(tree, tree, &io);
4328 torture_assert_ntstatus_ok_goto(torture, status, ret, done,
4329 "smb2_create failed for 'lsarpc'");
4330
4331 h = io.out.file.handle;
4332
4333 ZERO_STRUCT(rd);
4334 rd.in.file.handle = h;
4335 rd.in.length = 1024;
4336 rd.in.offset = 0;
4337 rd.in.min_count = 0;
4338
4339 smb2req = smb2_read_send(tree, &rd);
4340 torture_assert_goto(torture, (smb2req != NULL), ret, done,
4341 "smb2_read_send failed");
4342
4343 status = smb2_util_close(tree, h);
4344 torture_assert_ntstatus_ok_goto(torture, status, ret, done,
4345 "smb2_util_close failed");
4346
4347 status = smb2_read_recv(smb2req, mem_ctx, &rd);
4348 torture_assert_ntstatus_equal_goto(torture, status, NT_STATUS_PIPE_BROKEN, ret, done,
4349 "smb2_read_recv: unexpected return code");
4350
4351 ret = true;
4352 done:
4353 talloc_free(mem_ctx);
4354 return ret;
4355 }
4356
4357 /**
4358 * Test behaviour of a waiting read call on a pipe when
4359 * the tree is disconnected.
4360 * - open a pipe via smb2
4361 * - trigger a read which hangs since there is nothing to read
4362 * - do a tree disconnect
4363 * - wait for the read to return and check the status
4364 * (STATUS_PIPE_BROKEN)
4365 */
4366 static bool torture_rpc_smb2_pipe_read_tdis(struct torture_context *torture)
4367 {
4368 TALLOC_CTX *mem_ctx;
4369 NTSTATUS status;
4370 bool ret = false;
4371 struct smbcli_options options;
4372 const char *host = torture_setting_string(torture, "host", NULL);
4373 struct smb2_tree *tree;
4374 struct smb2_handle h;
4375 struct smb2_request *smb2req;
4376 struct smb2_create io;
4377 struct smb2_read rd;
4378
4379 mem_ctx = talloc_init("torture_samba3_pipe_read_tdis");
4380 torture_assert(torture, (mem_ctx != NULL), "talloc_init failed");
4381
4382 lpcfg_smbcli_options(torture->lp_ctx, &options);
4383
4384 status = smb2_connect(mem_ctx,
4385 host,
4386 lpcfg_smb_ports(torture->lp_ctx),
4387 "IPC$",
4388 lpcfg_resolve_context(torture->lp_ctx),
4389 cmdline_credentials,
4390 &tree,
4391 torture->ev,
4392 &options,
4393 lpcfg_socket_options(torture->lp_ctx),
4394 lpcfg_gensec_settings(torture, torture->lp_ctx)
4395 );
4396 torture_assert_ntstatus_ok_goto(torture, status, ret, done,
4397 "smb2_connect failed");
4398
4399 ZERO_STRUCT(io);
4400 io.in.oplock_level = 0;
4401 io.in.desired_access = DESIRED_ACCESS_PIPE;
4402 io.in.impersonation_level = SMB2_IMPERSONATION_IMPERSONATION;
4403 io.in.file_attributes = 0;
4404 io.in.create_disposition = NTCREATEX_DISP_OPEN;
4405 io.in.share_access =
4406 NTCREATEX_SHARE_ACCESS_READ|
4407 NTCREATEX_SHARE_ACCESS_WRITE;
4408 io.in.create_options = 0;
4409 io.in.fname = "lsarpc";
4410
4411 status = smb2_create(tree, tree, &io);
4412 torture_assert_ntstatus_ok_goto(torture, status, ret, done,
4413 "smb2_create failed for 'lsarpc'");
4414
4415 h = io.out.file.handle;
4416
4417 ZERO_STRUCT(rd);
4418 rd.in.file.handle = h;
4419 rd.in.length = 1024;
4420 rd.in.offset = 0;
4421 rd.in.min_count = 0;
4422
4423 smb2req = smb2_read_send(tree, &rd);
4424 torture_assert_goto(torture, (smb2req != NULL), ret, done,
4425 "smb2_read_send failed");
4426
4427 status = smb2_tdis(tree);
4428 torture_assert_ntstatus_ok_goto(torture, status, ret, done,
4429 "smb2_tdis failed");
4430
4431 status = smb2_read_recv(smb2req, mem_ctx, &rd);
4432 torture_assert_ntstatus_equal_goto(torture, status, NT_STATUS_PIPE_BROKEN, ret, done,
4433 "smb2_read_recv: unexpected return code");
4434
4435 ret = true;
4436 done:
4437 talloc_free(mem_ctx);
4438 return ret;
4439 }
4440
4441 /**
4442 * Test behaviour of a waiting read call on a pipe when
4443 * the user logs off
4444 * - open a pipe via smb2
4445 * - trigger a read which hangs since there is nothing to read
4446 * - do a logoff
4447 * - wait for the read to return and check the status
4448 * (STATUS_PIPE_BROKEN)
4449 */
4450 static bool torture_rpc_smb2_pipe_read_logoff(struct torture_context *torture)
4451 {
4452 TALLOC_CTX *mem_ctx;
4453 NTSTATUS status;
4454 bool ret = false;
4455 struct smbcli_options options;
4456 const char *host = torture_setting_string(torture, "host", NULL);
4457 struct smb2_tree *tree;
4458 struct smb2_handle h;
4459 struct smb2_request *smb2req;
4460 struct smb2_create io;
4461 struct smb2_read rd;
4462
4463 mem_ctx = talloc_init("torture_samba3_pipe_read_tdis");
4464 torture_assert(torture, (mem_ctx != NULL), "talloc_init failed");
4465
4466 lpcfg_smbcli_options(torture->lp_ctx, &options);
4467
4468 status = smb2_connect(mem_ctx,
4469 host,
4470 lpcfg_smb_ports(torture->lp_ctx),
4471 "IPC$",
4472 lpcfg_resolve_context(torture->lp_ctx),
4473 cmdline_credentials,
4474 &tree,
4475 torture->ev,
4476 &options,
4477 lpcfg_socket_options(torture->lp_ctx),
4478 lpcfg_gensec_settings(torture, torture->lp_ctx)
4479 );
4480 torture_assert_ntstatus_ok_goto(torture, status, ret, done,
4481 "smb2_connect failed");
4482
4483 ZERO_STRUCT(io);
4484 io.in.oplock_level = 0;
4485 io.in.desired_access = DESIRED_ACCESS_PIPE;
4486 io.in.impersonation_level = SMB2_IMPERSONATION_IMPERSONATION;
4487 io.in.file_attributes = 0;
4488 io.in.create_disposition = NTCREATEX_DISP_OPEN;
4489 io.in.share_access =
4490 NTCREATEX_SHARE_ACCESS_READ|
4491 NTCREATEX_SHARE_ACCESS_WRITE;
4492 io.in.create_options = 0;
4493 io.in.fname = "lsarpc";
4494
4495 status = smb2_create(tree, tree, &io);
4496 torture_assert_ntstatus_ok_goto(torture, status, ret, done,
4497 "smb2_create failed for 'lsarpc'");
4498
4499 h = io.out.file.handle;
4500
4501 ZERO_STRUCT(rd);
4502 rd.in.file.handle = h;
4503 rd.in.length = 1024;
4504 rd.in.offset = 0;
4505 rd.in.min_count = 0;
4506
4507 smb2req = smb2_read_send(tree, &rd);
4508 torture_assert_goto(torture, (smb2req != NULL), ret, done,
4509 "smb2_read_send failed");
4510
4511 status = smb2_logoff(tree->session);
4512 torture_assert_ntstatus_ok_goto(torture, status, ret, done,
4513 "smb2_logoff failed");
4514
4515 status = smb2_read_recv(smb2req, mem_ctx, &rd);
4516 torture_assert_ntstatus_equal_goto(torture, status, NT_STATUS_PIPE_BROKEN, ret, done,
4517 "smb2_read_recv: unexpected return code");
4518
4519 ret = true;
4520 done:
4521 talloc_free(mem_ctx);
4522 return ret;
4523 }
4524
4525
4526 struct torture_suite *torture_rpc_samba3(TALLOC_CTX *mem_ctx)
4527 {
4528 struct torture_suite *suite = torture_suite_create(mem_ctx, "samba3");
4529
4530 torture_suite_add_simple_test(suite, "bind", torture_bind_samba3);
4531 torture_suite_add_simple_test(suite, "netlogon", torture_netlogon_samba3);
4532 torture_suite_add_simple_test(suite, "sessionkey", torture_samba3_sessionkey);
4533 torture_suite_add_simple_test(suite, "srvsvc", torture_samba3_rpc_srvsvc);
4534 torture_suite_add_simple_test(suite, "sharesec", torture_samba3_rpc_sharesec);
4535 torture_suite_add_simple_test(suite, "getusername", torture_samba3_rpc_getusername);
4536 torture_suite_add_simple_test(suite, "randomauth2", torture_samba3_rpc_randomauth2);
4537 torture_suite_add_simple_test(suite, "lsa", torture_samba3_rpc_lsa);
4538 torture_suite_add_simple_test(suite, "spoolss", torture_samba3_rpc_spoolss);
4539 torture_suite_add_simple_test(suite, "wkssvc", torture_samba3_rpc_wkssvc);
4540 torture_suite_add_simple_test(suite, "winreg", torture_samba3_rpc_winreg);
4541 torture_suite_add_simple_test(suite, "getaliasmembership-0", torture_samba3_getaliasmembership_0);
4542 torture_suite_add_simple_test(suite, "regconfig", torture_samba3_regconfig);
4543 torture_suite_add_simple_test(suite, "smb-reauth1", torture_rpc_smb_reauth1);
4544 torture_suite_add_simple_test(suite, "smb-reauth2", torture_rpc_smb_reauth2);
4545 torture_suite_add_simple_test(suite, "smb2-reauth1", torture_rpc_smb2_reauth1);
4546 torture_suite_add_simple_test(suite, "smb2-reauth2", torture_rpc_smb2_reauth2);
4547 torture_suite_add_simple_test(suite, "smb1-pipe-name", torture_rpc_smb1_pipe_name);
4548 torture_suite_add_simple_test(suite, "smb2-pipe-name", torture_rpc_smb2_pipe_name);
4549 torture_suite_add_simple_test(suite, "smb2-pipe-read-close", torture_rpc_smb2_pipe_read_close);
4550 torture_suite_add_simple_test(suite, "smb2-pipe-read-tdis", torture_rpc_smb2_pipe_read_tdis);
4551 torture_suite_add_simple_test(suite, "smb2-pipe-read-logoff", torture_rpc_smb2_pipe_read_logoff);
4552
4553 suite->description = talloc_strdup(suite, "samba3 DCERPC interface tests");
4554
4555 return suite;
4556 }
Samba GIT mirror