?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
s4-smbtorture: Fix order of assert args in test_TestPrivateFunctionsDomain() in RPC...
[Samba.git] / source4 / torture / rpc / samr.c
blob4025372732484b24e7b8ffd0a0835fa6e072ba37
1 /*
2 Unix SMB/CIFS implementation.
3 test suite for samr rpc operations
4
5 Copyright (C) Andrew Tridgell 2003
6 Copyright (C) Andrew Bartlett <abartlet@samba.org> 2003
7
8 This program is free software; you can redistribute it and/or modify
9 it under the terms of the GNU General Public License as published by
10 the Free Software Foundation; either version 3 of the License, or
11 (at your option) any later version.
12
13 This program is distributed in the hope that it will be useful,
14 but WITHOUT ANY WARRANTY; without even the implied warranty of
15 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
16 GNU General Public License for more details.
17
18 You should have received a copy of the GNU General Public License
19 along with this program. If not, see <http://www.gnu.org/licenses/>.
20 */
21
22 #include "includes.h"
23 #include "torture/torture.h"
24 #include "system/time.h"
25 #include "librpc/gen_ndr/lsa.h"
26 #include "librpc/gen_ndr/ndr_netlogon.h"
27 #include "librpc/gen_ndr/ndr_netlogon_c.h"
28 #include "librpc/gen_ndr/ndr_samr_c.h"
29 #include "../lib/crypto/crypto.h"
30 #include "libcli/auth/libcli_auth.h"
31 #include "libcli/security/security.h"
32 #include "torture/rpc/rpc.h"
33 #include "param/param.h"
34
35 #include <unistd.h>
36
37 #define TEST_ACCOUNT_NAME "samrtorturetest"
38 #define TEST_ACCOUNT_NAME_PWD "samrpwdlastset"
39 #define TEST_ALIASNAME "samrtorturetestalias"
40 #define TEST_GROUPNAME "samrtorturetestgroup"
41 #define TEST_MACHINENAME "samrtestmach$"
42 #define TEST_DOMAINNAME "samrtestdom$"
43
44 enum torture_samr_choice {
45 TORTURE_SAMR_PASSWORDS,
46 TORTURE_SAMR_PASSWORDS_PWDLASTSET,
47 TORTURE_SAMR_USER_ATTRIBUTES,
48 TORTURE_SAMR_OTHER
49 };
50
51 static bool test_QueryUserInfo(struct dcerpc_pipe *p,
52 struct torture_context *tctx,
53 struct policy_handle *handle);
54
55 static bool test_QueryUserInfo2(struct dcerpc_pipe *p,
56 struct torture_context *tctx,
57 struct policy_handle *handle);
58
59 static bool test_QueryAliasInfo(struct dcerpc_pipe *p,
60 struct torture_context *tctx,
61 struct policy_handle *handle);
62
63 static bool test_ChangePassword(struct dcerpc_pipe *p,
64 struct torture_context *tctx,
65 const char *acct_name,
66 struct policy_handle *domain_handle, char **password);
67
68 static void init_lsa_String(struct lsa_String *string, const char *s)
69 {
70 string->string = s;
71 }
72
73 static void init_lsa_BinaryString(struct lsa_BinaryString *string, const char *s, uint32_t length)
74 {
75 string->length = length;
76 string->size = length;
77 string->array = (uint16_t *)discard_const(s);
78 }
79
80 bool test_samr_handle_Close(struct dcerpc_pipe *p, struct torture_context *tctx,
81 struct policy_handle *handle)
82 {
83 NTSTATUS status;
84 struct samr_Close r;
85
86 r.in.handle = handle;
87 r.out.handle = handle;
88
89 status = dcerpc_samr_Close(p, tctx, &r);
90 torture_assert_ntstatus_ok(tctx, status, "Close");
91
92 return true;
93 }
94
95 static bool test_Shutdown(struct dcerpc_pipe *p, struct torture_context *tctx,
96 struct policy_handle *handle)
97 {
98 NTSTATUS status;
99 struct samr_Shutdown r;
100
101 if (!torture_setting_bool(tctx, "dangerous", false)) {
102 torture_skip(tctx, "samr_Shutdown disabled - enable dangerous tests to use\n");
103 return true;
104 }
105
106 r.in.connect_handle = handle;
107
108 torture_comment(tctx, "testing samr_Shutdown\n");
109
110 status = dcerpc_samr_Shutdown(p, tctx, &r);
111 torture_assert_ntstatus_ok(tctx, status, "samr_Shutdown");
112
113 return true;
114 }
115
116 static bool test_SetDsrmPassword(struct dcerpc_pipe *p, struct torture_context *tctx,
117 struct policy_handle *handle)
118 {
119 NTSTATUS status;
120 struct samr_SetDsrmPassword r;
121 struct lsa_String string;
122 struct samr_Password hash;
123
124 if (!torture_setting_bool(tctx, "dangerous", false)) {
125 torture_skip(tctx, "samr_SetDsrmPassword disabled - enable dangerous tests to use");
126 }
127
128 E_md4hash("TeSTDSRM123", hash.hash);
129
130 init_lsa_String(&string, "Administrator");
131
132 r.in.name = &string;
133 r.in.unknown = 0;
134 r.in.hash = &hash;
135
136 torture_comment(tctx, "testing samr_SetDsrmPassword\n");
137
138 status = dcerpc_samr_SetDsrmPassword(p, tctx, &r);
139 torture_assert_ntstatus_equal(tctx, status, NT_STATUS_NOT_SUPPORTED, "samr_SetDsrmPassword");
140
141 return true;
142 }
143
144
145 static bool test_QuerySecurity(struct dcerpc_pipe *p,
146 struct torture_context *tctx,
147 struct policy_handle *handle)
148 {
149 NTSTATUS status;
150 struct samr_QuerySecurity r;
151 struct samr_SetSecurity s;
152 struct sec_desc_buf *sdbuf = NULL;
153
154 r.in.handle = handle;
155 r.in.sec_info = 7;
156 r.out.sdbuf = &sdbuf;
157
158 status = dcerpc_samr_QuerySecurity(p, tctx, &r);
159 torture_assert_ntstatus_ok(tctx, status, "QuerySecurity");
160
161 torture_assert(tctx, sdbuf != NULL, "sdbuf is NULL");
162
163 s.in.handle = handle;
164 s.in.sec_info = 7;
165 s.in.sdbuf = sdbuf;
166
167 if (torture_setting_bool(tctx, "samba4", false)) {
168 torture_skip(tctx, "skipping SetSecurity test against Samba4\n");
169 }
170
171 status = dcerpc_samr_SetSecurity(p, tctx, &s);
172 torture_assert_ntstatus_ok(tctx, status, "SetSecurity");
173
174 status = dcerpc_samr_QuerySecurity(p, tctx, &r);
175 torture_assert_ntstatus_ok(tctx, status, "QuerySecurity");
176
177 return true;
178 }
179
180
181 static bool test_SetUserInfo(struct dcerpc_pipe *p, struct torture_context *tctx,
182 struct policy_handle *handle, uint32_t base_acct_flags,
183 const char *base_account_name)
184 {
185 NTSTATUS status;
186 struct samr_SetUserInfo s;
187 struct samr_SetUserInfo2 s2;
188 struct samr_QueryUserInfo q;
189 struct samr_QueryUserInfo q0;
190 union samr_UserInfo u;
191 union samr_UserInfo *info;
192 bool ret = true;
193 const char *test_account_name;
194
195 uint32_t user_extra_flags = 0;
196
197 if (!torture_setting_bool(tctx, "samba3", false)) {
198 if (base_acct_flags == ACB_NORMAL) {
199 /* When created, accounts are expired by default */
200 user_extra_flags = ACB_PW_EXPIRED;
201 }
202 }
203
204 s.in.user_handle = handle;
205 s.in.info = &u;
206
207 s2.in.user_handle = handle;
208 s2.in.info = &u;
209
210 q.in.user_handle = handle;
211 q.out.info = &info;
212 q0 = q;
213
214 #define TESTCALL(call, r) \
215 status = dcerpc_samr_ ##call(p, tctx, &r); \
216 if (!NT_STATUS_IS_OK(status)) { \
217 torture_comment(tctx, #call " level %u failed - %s (%s)\n", \
218 r.in.level, nt_errstr(status), __location__); \
219 ret = false; \
220 break; \
221 }
222
223 #define STRING_EQUAL(s1, s2, field) \
224 if ((s1 && !s2) || (s2 && !s1) || strcmp(s1, s2)) { \
225 torture_comment(tctx, "Failed to set %s to '%s' (%s)\n", \
226 #field, s2, __location__); \
227 ret = false; \
228 break; \
229 }
230
231 #define MEM_EQUAL(s1, s2, length, field) \
232 if ((s1 && !s2) || (s2 && !s1) || memcmp(s1, s2, length)) { \
233 torture_comment(tctx, "Failed to set %s to '%s' (%s)\n", \
234 #field, (const char *)s2, __location__); \
235 ret = false; \
236 break; \
237 }
238
239 #define INT_EQUAL(i1, i2, field) \
240 if (i1 != i2) { \
241 torture_comment(tctx, "Failed to set %s to 0x%llx - got 0x%llx (%s)\n", \
242 #field, (unsigned long long)i2, (unsigned long long)i1, __location__); \
243 ret = false; \
244 break; \
245 }
246
247 #define TEST_USERINFO_STRING(lvl1, field1, lvl2, field2, value, fpval) do { \
248 torture_comment(tctx, "field test %d/%s vs %d/%s\n", lvl1, #field1, lvl2, #field2); \
249 q.in.level = lvl1; \
250 TESTCALL(QueryUserInfo, q) \
251 s.in.level = lvl1; \
252 s2.in.level = lvl1; \
253 u = *info; \
254 if (lvl1 == 21) { \
255 ZERO_STRUCT(u.info21); \
256 u.info21.fields_present = fpval; \
257 } \
258 init_lsa_String(&u.info ## lvl1.field1, value); \
259 TESTCALL(SetUserInfo, s) \
260 TESTCALL(SetUserInfo2, s2) \
261 init_lsa_String(&u.info ## lvl1.field1, ""); \
262 TESTCALL(QueryUserInfo, q); \
263 u = *info; \
264 STRING_EQUAL(u.info ## lvl1.field1.string, value, field1); \
265 q.in.level = lvl2; \
266 TESTCALL(QueryUserInfo, q) \
267 u = *info; \
268 STRING_EQUAL(u.info ## lvl2.field2.string, value, field2); \
269 } while (0)
270
271 #define TEST_USERINFO_BINARYSTRING(lvl1, field1, lvl2, field2, value, fpval) do { \
272 torture_comment(tctx, "field test %d/%s vs %d/%s\n", lvl1, #field1, lvl2, #field2); \
273 q.in.level = lvl1; \
274 TESTCALL(QueryUserInfo, q) \
275 s.in.level = lvl1; \
276 s2.in.level = lvl1; \
277 u = *info; \
278 if (lvl1 == 21) { \
279 ZERO_STRUCT(u.info21); \
280 u.info21.fields_present = fpval; \
281 } \
282 init_lsa_BinaryString(&u.info ## lvl1.field1, value, strlen(value)); \
283 TESTCALL(SetUserInfo, s) \
284 TESTCALL(SetUserInfo2, s2) \
285 init_lsa_BinaryString(&u.info ## lvl1.field1, "", 1); \
286 TESTCALL(QueryUserInfo, q); \
287 u = *info; \
288 MEM_EQUAL(u.info ## lvl1.field1.array, value, strlen(value), field1); \
289 q.in.level = lvl2; \
290 TESTCALL(QueryUserInfo, q) \
291 u = *info; \
292 MEM_EQUAL(u.info ## lvl2.field2.array, value, strlen(value), field2); \
293 } while (0)
294
295 #define TEST_USERINFO_INT_EXP(lvl1, field1, lvl2, field2, value, exp_value, fpval) do { \
296 torture_comment(tctx, "field test %d/%s vs %d/%s\n", lvl1, #field1, lvl2, #field2); \
297 q.in.level = lvl1; \
298 TESTCALL(QueryUserInfo, q) \
299 s.in.level = lvl1; \
300 s2.in.level = lvl1; \
301 u = *info; \
302 if (lvl1 == 21) { \
303 uint8_t *bits = u.info21.logon_hours.bits; \
304 ZERO_STRUCT(u.info21); \
305 if (fpval == SAMR_FIELD_LOGON_HOURS) { \
306 u.info21.logon_hours.units_per_week = 168; \
307 u.info21.logon_hours.bits = bits; \
308 } \
309 u.info21.fields_present = fpval; \
310 } \
311 u.info ## lvl1.field1 = value; \
312 TESTCALL(SetUserInfo, s) \
313 TESTCALL(SetUserInfo2, s2) \
314 u.info ## lvl1.field1 = 0; \
315 TESTCALL(QueryUserInfo, q); \
316 u = *info; \
317 INT_EQUAL(u.info ## lvl1.field1, exp_value, field1); \
318 q.in.level = lvl2; \
319 TESTCALL(QueryUserInfo, q) \
320 u = *info; \
321 INT_EQUAL(u.info ## lvl2.field2, exp_value, field1); \
322 } while (0)
323
324 #define TEST_USERINFO_INT(lvl1, field1, lvl2, field2, value, fpval) do { \
325 TEST_USERINFO_INT_EXP(lvl1, field1, lvl2, field2, value, value, fpval); \
326 } while (0)
327
328 q0.in.level = 12;
329 do { TESTCALL(QueryUserInfo, q0) } while (0);
330
331 /* Samba 3 cannot store comment fields atm. - gd */
332 if (!torture_setting_bool(tctx, "samba3", false)) {
333 TEST_USERINFO_STRING(2, comment, 1, comment, "xx2-1 comment", 0);
334 TEST_USERINFO_STRING(2, comment, 21, comment, "xx2-21 comment", 0);
335 TEST_USERINFO_STRING(21, comment, 21, comment, "xx21-21 comment",
336 SAMR_FIELD_COMMENT);
337 }
338
339 test_account_name = talloc_asprintf(tctx, "%sxx7-1", base_account_name);
340 TEST_USERINFO_STRING(7, account_name, 1, account_name, base_account_name, 0);
341 test_account_name = talloc_asprintf(tctx, "%sxx7-3", base_account_name);
342 TEST_USERINFO_STRING(7, account_name, 3, account_name, base_account_name, 0);
343 test_account_name = talloc_asprintf(tctx, "%sxx7-5", base_account_name);
344 TEST_USERINFO_STRING(7, account_name, 5, account_name, base_account_name, 0);
345 test_account_name = talloc_asprintf(tctx, "%sxx7-6", base_account_name);
346 TEST_USERINFO_STRING(7, account_name, 6, account_name, base_account_name, 0);
347 test_account_name = talloc_asprintf(tctx, "%sxx7-7", base_account_name);
348 TEST_USERINFO_STRING(7, account_name, 7, account_name, base_account_name, 0);
349 test_account_name = talloc_asprintf(tctx, "%sxx7-21", base_account_name);
350 TEST_USERINFO_STRING(7, account_name, 21, account_name, base_account_name, 0);
351 test_account_name = base_account_name;
352 TEST_USERINFO_STRING(21, account_name, 21, account_name, base_account_name,
353 SAMR_FIELD_ACCOUNT_NAME);
354
355 TEST_USERINFO_STRING(6, full_name, 1, full_name, "xx6-1 full_name", 0);
356 TEST_USERINFO_STRING(6, full_name, 3, full_name, "xx6-3 full_name", 0);
357 TEST_USERINFO_STRING(6, full_name, 5, full_name, "xx6-5 full_name", 0);
358 TEST_USERINFO_STRING(6, full_name, 6, full_name, "xx6-6 full_name", 0);
359 TEST_USERINFO_STRING(6, full_name, 8, full_name, "xx6-8 full_name", 0);
360 TEST_USERINFO_STRING(6, full_name, 21, full_name, "xx6-21 full_name", 0);
361 TEST_USERINFO_STRING(8, full_name, 21, full_name, "xx8-21 full_name", 0);
362 TEST_USERINFO_STRING(21, full_name, 21, full_name, "xx21-21 full_name",
363 SAMR_FIELD_FULL_NAME);
364
365 TEST_USERINFO_STRING(6, full_name, 1, full_name, "", 0);
366 TEST_USERINFO_STRING(6, full_name, 3, full_name, "", 0);
367 TEST_USERINFO_STRING(6, full_name, 5, full_name, "", 0);
368 TEST_USERINFO_STRING(6, full_name, 6, full_name, "", 0);
369 TEST_USERINFO_STRING(6, full_name, 8, full_name, "", 0);
370 TEST_USERINFO_STRING(6, full_name, 21, full_name, "", 0);
371 TEST_USERINFO_STRING(8, full_name, 21, full_name, "", 0);
372 TEST_USERINFO_STRING(21, full_name, 21, full_name, "",
373 SAMR_FIELD_FULL_NAME);
374
375 TEST_USERINFO_STRING(11, logon_script, 3, logon_script, "xx11-3 logon_script", 0);
376 TEST_USERINFO_STRING(11, logon_script, 5, logon_script, "xx11-5 logon_script", 0);
377 TEST_USERINFO_STRING(11, logon_script, 21, logon_script, "xx11-21 logon_script", 0);
378 TEST_USERINFO_STRING(21, logon_script, 21, logon_script, "xx21-21 logon_script",
379 SAMR_FIELD_LOGON_SCRIPT);
380
381 TEST_USERINFO_STRING(12, profile_path, 3, profile_path, "xx12-3 profile_path", 0);
382 TEST_USERINFO_STRING(12, profile_path, 5, profile_path, "xx12-5 profile_path", 0);
383 TEST_USERINFO_STRING(12, profile_path, 21, profile_path, "xx12-21 profile_path", 0);
384 TEST_USERINFO_STRING(21, profile_path, 21, profile_path, "xx21-21 profile_path",
385 SAMR_FIELD_PROFILE_PATH);
386
387 TEST_USERINFO_STRING(10, home_directory, 3, home_directory, "xx10-3 home_directory", 0);
388 TEST_USERINFO_STRING(10, home_directory, 5, home_directory, "xx10-5 home_directory", 0);
389 TEST_USERINFO_STRING(10, home_directory, 21, home_directory, "xx10-21 home_directory", 0);
390 TEST_USERINFO_STRING(21, home_directory, 21, home_directory, "xx21-21 home_directory",
391 SAMR_FIELD_HOME_DIRECTORY);
392 TEST_USERINFO_STRING(21, home_directory, 10, home_directory, "xx21-10 home_directory",
393 SAMR_FIELD_HOME_DIRECTORY);
394
395 TEST_USERINFO_STRING(10, home_drive, 3, home_drive, "xx10-3 home_drive", 0);
396 TEST_USERINFO_STRING(10, home_drive, 5, home_drive, "xx10-5 home_drive", 0);
397 TEST_USERINFO_STRING(10, home_drive, 21, home_drive, "xx10-21 home_drive", 0);
398 TEST_USERINFO_STRING(21, home_drive, 21, home_drive, "xx21-21 home_drive",
399 SAMR_FIELD_HOME_DRIVE);
400 TEST_USERINFO_STRING(21, home_drive, 10, home_drive, "xx21-10 home_drive",
401 SAMR_FIELD_HOME_DRIVE);
402
403 TEST_USERINFO_STRING(13, description, 1, description, "xx13-1 description", 0);
404 TEST_USERINFO_STRING(13, description, 5, description, "xx13-5 description", 0);
405 TEST_USERINFO_STRING(13, description, 21, description, "xx13-21 description", 0);
406 TEST_USERINFO_STRING(21, description, 21, description, "xx21-21 description",
407 SAMR_FIELD_DESCRIPTION);
408
409 TEST_USERINFO_STRING(14, workstations, 3, workstations, "14workstation3", 0);
410 TEST_USERINFO_STRING(14, workstations, 5, workstations, "14workstation4", 0);
411 TEST_USERINFO_STRING(14, workstations, 21, workstations, "14workstation21", 0);
412 TEST_USERINFO_STRING(21, workstations, 21, workstations, "21workstation21",
413 SAMR_FIELD_WORKSTATIONS);
414 TEST_USERINFO_STRING(21, workstations, 3, workstations, "21workstation3",
415 SAMR_FIELD_WORKSTATIONS);
416 TEST_USERINFO_STRING(21, workstations, 5, workstations, "21workstation5",
417 SAMR_FIELD_WORKSTATIONS);
418 TEST_USERINFO_STRING(21, workstations, 14, workstations, "21workstation14",
419 SAMR_FIELD_WORKSTATIONS);
420
421 TEST_USERINFO_BINARYSTRING(20, parameters, 21, parameters, "xx20-21 parameters", 0);
422 TEST_USERINFO_BINARYSTRING(21, parameters, 21, parameters, "xx21-21 parameters",
423 SAMR_FIELD_PARAMETERS);
424 TEST_USERINFO_BINARYSTRING(21, parameters, 20, parameters, "xx21-20 parameters",
425 SAMR_FIELD_PARAMETERS);
426 /* also empty user parameters are allowed */
427 TEST_USERINFO_BINARYSTRING(20, parameters, 21, parameters, "", 0);
428 TEST_USERINFO_BINARYSTRING(21, parameters, 21, parameters, "",
429 SAMR_FIELD_PARAMETERS);
430 TEST_USERINFO_BINARYSTRING(21, parameters, 20, parameters, "",
431 SAMR_FIELD_PARAMETERS);
432
433 /* Samba 3 cannot store country_code and copy_page atm. - gd */
434 if (!torture_setting_bool(tctx, "samba3", false)) {
435 TEST_USERINFO_INT(2, country_code, 2, country_code, __LINE__, 0);
436 TEST_USERINFO_INT(2, country_code, 21, country_code, __LINE__, 0);
437 TEST_USERINFO_INT(21, country_code, 21, country_code, __LINE__,
438 SAMR_FIELD_COUNTRY_CODE);
439 TEST_USERINFO_INT(21, country_code, 2, country_code, __LINE__,
440 SAMR_FIELD_COUNTRY_CODE);
441
442 TEST_USERINFO_INT(2, code_page, 21, code_page, __LINE__, 0);
443 TEST_USERINFO_INT(21, code_page, 21, code_page, __LINE__,
444 SAMR_FIELD_CODE_PAGE);
445 TEST_USERINFO_INT(21, code_page, 2, code_page, __LINE__,
446 SAMR_FIELD_CODE_PAGE);
447 }
448
449 if (!torture_setting_bool(tctx, "samba3", false)) {
450 TEST_USERINFO_INT(17, acct_expiry, 21, acct_expiry, __LINE__, 0);
451 TEST_USERINFO_INT(17, acct_expiry, 5, acct_expiry, __LINE__, 0);
452 TEST_USERINFO_INT(21, acct_expiry, 21, acct_expiry, __LINE__,
453 SAMR_FIELD_ACCT_EXPIRY);
454 TEST_USERINFO_INT(21, acct_expiry, 5, acct_expiry, __LINE__,
455 SAMR_FIELD_ACCT_EXPIRY);
456 TEST_USERINFO_INT(21, acct_expiry, 17, acct_expiry, __LINE__,
457 SAMR_FIELD_ACCT_EXPIRY);
458 } else {
459 /* Samba 3 can only store seconds / time_t in passdb - gd */
460 NTTIME nt;
461 unix_to_nt_time(&nt, time(NULL) + __LINE__);
462 TEST_USERINFO_INT(17, acct_expiry, 21, acct_expiry, nt, 0);
463 unix_to_nt_time(&nt, time(NULL) + __LINE__);
464 TEST_USERINFO_INT(17, acct_expiry, 5, acct_expiry, nt, 0);
465 unix_to_nt_time(&nt, time(NULL) + __LINE__);
466 TEST_USERINFO_INT(21, acct_expiry, 21, acct_expiry, nt, SAMR_FIELD_ACCT_EXPIRY);
467 unix_to_nt_time(&nt, time(NULL) + __LINE__);
468 TEST_USERINFO_INT(21, acct_expiry, 5, acct_expiry, nt, SAMR_FIELD_ACCT_EXPIRY);
469 unix_to_nt_time(&nt, time(NULL) + __LINE__);
470 TEST_USERINFO_INT(21, acct_expiry, 17, acct_expiry, nt, SAMR_FIELD_ACCT_EXPIRY);
471 }
472
473 TEST_USERINFO_INT(4, logon_hours.bits[3], 3, logon_hours.bits[3], 1, 0);
474 TEST_USERINFO_INT(4, logon_hours.bits[3], 5, logon_hours.bits[3], 2, 0);
475 TEST_USERINFO_INT(4, logon_hours.bits[3], 21, logon_hours.bits[3], 3, 0);
476 TEST_USERINFO_INT(21, logon_hours.bits[3], 21, logon_hours.bits[3], 4,
477 SAMR_FIELD_LOGON_HOURS);
478
479 TEST_USERINFO_INT_EXP(16, acct_flags, 5, acct_flags,
480 (base_acct_flags | ACB_DISABLED | ACB_HOMDIRREQ),
481 (base_acct_flags | ACB_DISABLED | ACB_HOMDIRREQ | user_extra_flags),
482 0);
483 TEST_USERINFO_INT_EXP(16, acct_flags, 5, acct_flags,
484 (base_acct_flags | ACB_DISABLED),
485 (base_acct_flags | ACB_DISABLED | user_extra_flags),
486 0);
487
488 /* Setting PWNOEXP clears the magic ACB_PW_EXPIRED flag */
489 TEST_USERINFO_INT_EXP(16, acct_flags, 5, acct_flags,
490 (base_acct_flags | ACB_DISABLED | ACB_PWNOEXP),
491 (base_acct_flags | ACB_DISABLED | ACB_PWNOEXP),
492 0);
493 TEST_USERINFO_INT_EXP(16, acct_flags, 21, acct_flags,
494 (base_acct_flags | ACB_DISABLED | ACB_HOMDIRREQ),
495 (base_acct_flags | ACB_DISABLED | ACB_HOMDIRREQ | user_extra_flags),
496 0);
497
498
499 /* The 'autolock' flag doesn't stick - check this */
500 TEST_USERINFO_INT_EXP(16, acct_flags, 21, acct_flags,
501 (base_acct_flags | ACB_DISABLED | ACB_AUTOLOCK),
502 (base_acct_flags | ACB_DISABLED | user_extra_flags),
503 0);
504 #if 0
505 /* Removing the 'disabled' flag doesn't stick - check this */
506 TEST_USERINFO_INT_EXP(16, acct_flags, 21, acct_flags,
507 (base_acct_flags),
508 (base_acct_flags | ACB_DISABLED | user_extra_flags),
509 0);
510 #endif
511
512 /* Samba3 cannot store these atm */
513 if (!torture_setting_bool(tctx, "samba3", false)) {
514 /* The 'store plaintext' flag does stick */
515 TEST_USERINFO_INT_EXP(16, acct_flags, 21, acct_flags,
516 (base_acct_flags | ACB_DISABLED | ACB_ENC_TXT_PWD_ALLOWED),
517 (base_acct_flags | ACB_DISABLED | ACB_ENC_TXT_PWD_ALLOWED | user_extra_flags),
518 0);
519 /* The 'use DES' flag does stick */
520 TEST_USERINFO_INT_EXP(16, acct_flags, 21, acct_flags,
521 (base_acct_flags | ACB_DISABLED | ACB_USE_DES_KEY_ONLY),
522 (base_acct_flags | ACB_DISABLED | ACB_USE_DES_KEY_ONLY | user_extra_flags),
523 0);
524 /* The 'don't require kerberos pre-authentication flag does stick */
525 TEST_USERINFO_INT_EXP(16, acct_flags, 21, acct_flags,
526 (base_acct_flags | ACB_DISABLED | ACB_DONT_REQUIRE_PREAUTH),
527 (base_acct_flags | ACB_DISABLED | ACB_DONT_REQUIRE_PREAUTH | user_extra_flags),
528 0);
529 /* The 'no kerberos PAC required' flag sticks */
530 TEST_USERINFO_INT_EXP(16, acct_flags, 21, acct_flags,
531 (base_acct_flags | ACB_DISABLED | ACB_NO_AUTH_DATA_REQD),
532 (base_acct_flags | ACB_DISABLED | ACB_NO_AUTH_DATA_REQD | user_extra_flags),
533 0);
534 }
535 TEST_USERINFO_INT_EXP(21, acct_flags, 21, acct_flags,
536 (base_acct_flags | ACB_DISABLED),
537 (base_acct_flags | ACB_DISABLED | user_extra_flags),
538 SAMR_FIELD_ACCT_FLAGS);
539
540 #if 0
541 /* these fail with win2003 - it appears you can't set the primary gid?
542 the set succeeds, but the gid isn't changed. Very weird! */
543 TEST_USERINFO_INT(9, primary_gid, 1, primary_gid, 513);
544 TEST_USERINFO_INT(9, primary_gid, 3, primary_gid, 513);
545 TEST_USERINFO_INT(9, primary_gid, 5, primary_gid, 513);
546 TEST_USERINFO_INT(9, primary_gid, 21, primary_gid, 513);
547 #endif
548
549 return ret;
550 }
551
552 /*
553 generate a random password for password change tests
554 */
555 static char *samr_rand_pass_silent(TALLOC_CTX *mem_ctx, int min_len)
556 {
557 size_t len = MAX(8, min_len) + (random() % 6);
558 char *s = generate_random_str(mem_ctx, len);
559 return s;
560 }
561
562 static char *samr_rand_pass(TALLOC_CTX *mem_ctx, int min_len)
563 {
564 char *s = samr_rand_pass_silent(mem_ctx, min_len);
565 printf("Generated password '%s'\n", s);
566 return s;
567
568 }
569
570 /*
571 generate a random password for password change tests
572 */
573 static DATA_BLOB samr_very_rand_pass(TALLOC_CTX *mem_ctx, int len)
574 {
575 int i;
576 DATA_BLOB password = data_blob_talloc(mem_ctx, NULL, len * 2 /* number of unicode chars */);
577 generate_random_buffer(password.data, password.length);
578
579 for (i=0; i < len; i++) {
580 if (((uint16_t *)password.data)[i] == 0) {
581 ((uint16_t *)password.data)[i] = 1;
582 }
583 }
584
585 return password;
586 }
587
588 /*
589 generate a random password for password change tests (fixed length)
590 */
591 static char *samr_rand_pass_fixed_len(TALLOC_CTX *mem_ctx, int len)
592 {
593 char *s = generate_random_str(mem_ctx, len);
594 printf("Generated password '%s'\n", s);
595 return s;
596 }
597
598 static bool test_SetUserPass(struct dcerpc_pipe *p, struct torture_context *tctx,
599 struct policy_handle *handle, char **password)
600 {
601 NTSTATUS status;
602 struct samr_SetUserInfo s;
603 union samr_UserInfo u;
604 bool ret = true;
605 DATA_BLOB session_key;
606 char *newpass;
607 struct samr_GetUserPwInfo pwp;
608 struct samr_PwInfo info;
609 int policy_min_pw_len = 0;
610 pwp.in.user_handle = handle;
611 pwp.out.info = &info;
612
613 status = dcerpc_samr_GetUserPwInfo(p, tctx, &pwp);
614 if (NT_STATUS_IS_OK(status)) {
615 policy_min_pw_len = pwp.out.info->min_password_length;
616 }
617 newpass = samr_rand_pass(tctx, policy_min_pw_len);
618
619 s.in.user_handle = handle;
620 s.in.info = &u;
621 s.in.level = 24;
622
623 encode_pw_buffer(u.info24.password.data, newpass, STR_UNICODE);
624 u.info24.password_expired = 0;
625
626 status = dcerpc_fetch_session_key(p, &session_key);
627 if (!NT_STATUS_IS_OK(status)) {
628 printf("SetUserInfo level %u - no session key - %s\n",
629 s.in.level, nt_errstr(status));
630 return false;
631 }
632
633 arcfour_crypt_blob(u.info24.password.data, 516, &session_key);
634
635 torture_comment(tctx, "Testing SetUserInfo level 24 (set password)\n");
636
637 status = dcerpc_samr_SetUserInfo(p, tctx, &s);
638 if (!NT_STATUS_IS_OK(status)) {
639 printf("SetUserInfo level %u failed - %s\n",
640 s.in.level, nt_errstr(status));
641 ret = false;
642 } else {
643 *password = newpass;
644 }
645
646 return ret;
647 }
648
649
650 static bool test_SetUserPass_23(struct dcerpc_pipe *p, struct torture_context *tctx,
651 struct policy_handle *handle, uint32_t fields_present,
652 char **password)
653 {
654 NTSTATUS status;
655 struct samr_SetUserInfo s;
656 union samr_UserInfo u;
657 bool ret = true;
658 DATA_BLOB session_key;
659 char *newpass;
660 struct samr_GetUserPwInfo pwp;
661 struct samr_PwInfo info;
662 int policy_min_pw_len = 0;
663 pwp.in.user_handle = handle;
664 pwp.out.info = &info;
665
666 status = dcerpc_samr_GetUserPwInfo(p, tctx, &pwp);
667 if (NT_STATUS_IS_OK(status)) {
668 policy_min_pw_len = pwp.out.info->min_password_length;
669 }
670 newpass = samr_rand_pass(tctx, policy_min_pw_len);
671
672 s.in.user_handle = handle;
673 s.in.info = &u;
674 s.in.level = 23;
675
676 ZERO_STRUCT(u);
677
678 u.info23.info.fields_present = fields_present;
679
680 encode_pw_buffer(u.info23.password.data, newpass, STR_UNICODE);
681
682 status = dcerpc_fetch_session_key(p, &session_key);
683 if (!NT_STATUS_IS_OK(status)) {
684 printf("SetUserInfo level %u - no session key - %s\n",
685 s.in.level, nt_errstr(status));
686 return false;
687 }
688
689 arcfour_crypt_blob(u.info23.password.data, 516, &session_key);
690
691 torture_comment(tctx, "Testing SetUserInfo level 23 (set password)\n");
692
693 status = dcerpc_samr_SetUserInfo(p, tctx, &s);
694 if (!NT_STATUS_IS_OK(status)) {
695 printf("SetUserInfo level %u failed - %s\n",
696 s.in.level, nt_errstr(status));
697 ret = false;
698 } else {
699 *password = newpass;
700 }
701
702 encode_pw_buffer(u.info23.password.data, newpass, STR_UNICODE);
703
704 status = dcerpc_fetch_session_key(p, &session_key);
705 if (!NT_STATUS_IS_OK(status)) {
706 printf("SetUserInfo level %u - no session key - %s\n",
707 s.in.level, nt_errstr(status));
708 return false;
709 }
710
711 /* This should break the key nicely */
712 session_key.length--;
713 arcfour_crypt_blob(u.info23.password.data, 516, &session_key);
714
715 torture_comment(tctx, "Testing SetUserInfo level 23 (set password) with wrong password\n");
716
717 status = dcerpc_samr_SetUserInfo(p, tctx, &s);
718 if (!NT_STATUS_EQUAL(status, NT_STATUS_WRONG_PASSWORD)) {
719 printf("SetUserInfo level %u should have failed with WRONG_PASSWORD- %s\n",
720 s.in.level, nt_errstr(status));
721 ret = false;
722 }
723
724 return ret;
725 }
726
727
728 static bool test_SetUserPassEx(struct dcerpc_pipe *p, struct torture_context *tctx,
729 struct policy_handle *handle, bool makeshort,
730 char **password)
731 {
732 NTSTATUS status;
733 struct samr_SetUserInfo s;
734 union samr_UserInfo u;
735 bool ret = true;
736 DATA_BLOB session_key;
737 DATA_BLOB confounded_session_key = data_blob_talloc(tctx, NULL, 16);
738 uint8_t confounder[16];
739 char *newpass;
740 struct MD5Context ctx;
741 struct samr_GetUserPwInfo pwp;
742 struct samr_PwInfo info;
743 int policy_min_pw_len = 0;
744 pwp.in.user_handle = handle;
745 pwp.out.info = &info;
746
747 status = dcerpc_samr_GetUserPwInfo(p, tctx, &pwp);
748 if (NT_STATUS_IS_OK(status)) {
749 policy_min_pw_len = pwp.out.info->min_password_length;
750 }
751 if (makeshort && policy_min_pw_len) {
752 newpass = samr_rand_pass_fixed_len(tctx, policy_min_pw_len - 1);
753 } else {
754 newpass = samr_rand_pass(tctx, policy_min_pw_len);
755 }
756
757 s.in.user_handle = handle;
758 s.in.info = &u;
759 s.in.level = 26;
760
761 encode_pw_buffer(u.info26.password.data, newpass, STR_UNICODE);
762 u.info26.password_expired = 0;
763
764 status = dcerpc_fetch_session_key(p, &session_key);
765 if (!NT_STATUS_IS_OK(status)) {
766 printf("SetUserInfo level %u - no session key - %s\n",
767 s.in.level, nt_errstr(status));
768 return false;
769 }
770
771 generate_random_buffer((uint8_t *)confounder, 16);
772
773 MD5Init(&ctx);
774 MD5Update(&ctx, confounder, 16);
775 MD5Update(&ctx, session_key.data, session_key.length);
776 MD5Final(confounded_session_key.data, &ctx);
777
778 arcfour_crypt_blob(u.info26.password.data, 516, &confounded_session_key);
779 memcpy(&u.info26.password.data[516], confounder, 16);
780
781 torture_comment(tctx, "Testing SetUserInfo level 26 (set password ex)\n");
782
783 status = dcerpc_samr_SetUserInfo(p, tctx, &s);
784 if (!NT_STATUS_IS_OK(status)) {
785 printf("SetUserInfo level %u failed - %s\n",
786 s.in.level, nt_errstr(status));
787 ret = false;
788 } else {
789 *password = newpass;
790 }
791
792 /* This should break the key nicely */
793 confounded_session_key.data[0]++;
794
795 arcfour_crypt_blob(u.info26.password.data, 516, &confounded_session_key);
796 memcpy(&u.info26.password.data[516], confounder, 16);
797
798 torture_comment(tctx, "Testing SetUserInfo level 26 (set password ex) with wrong session key\n");
799
800 status = dcerpc_samr_SetUserInfo(p, tctx, &s);
801 if (!NT_STATUS_EQUAL(status, NT_STATUS_WRONG_PASSWORD)) {
802 printf("SetUserInfo level %u should have failed with WRONG_PASSWORD: %s\n",
803 s.in.level, nt_errstr(status));
804 ret = false;
805 } else {
806 *password = newpass;
807 }
808
809 return ret;
810 }
811
812 static bool test_SetUserPass_25(struct dcerpc_pipe *p, struct torture_context *tctx,
813 struct policy_handle *handle, uint32_t fields_present,
814 char **password)
815 {
816 NTSTATUS status;
817 struct samr_SetUserInfo s;
818 union samr_UserInfo u;
819 bool ret = true;
820 DATA_BLOB session_key;
821 DATA_BLOB confounded_session_key = data_blob_talloc(tctx, NULL, 16);
822 struct MD5Context ctx;
823 uint8_t confounder[16];
824 char *newpass;
825 struct samr_GetUserPwInfo pwp;
826 struct samr_PwInfo info;
827 int policy_min_pw_len = 0;
828 pwp.in.user_handle = handle;
829 pwp.out.info = &info;
830
831 status = dcerpc_samr_GetUserPwInfo(p, tctx, &pwp);
832 if (NT_STATUS_IS_OK(status)) {
833 policy_min_pw_len = pwp.out.info->min_password_length;
834 }
835 newpass = samr_rand_pass(tctx, policy_min_pw_len);
836
837 s.in.user_handle = handle;
838 s.in.info = &u;
839 s.in.level = 25;
840
841 ZERO_STRUCT(u);
842
843 u.info25.info.fields_present = fields_present;
844
845 encode_pw_buffer(u.info25.password.data, newpass, STR_UNICODE);
846
847 status = dcerpc_fetch_session_key(p, &session_key);
848 if (!NT_STATUS_IS_OK(status)) {
849 printf("SetUserInfo level %u - no session key - %s\n",
850 s.in.level, nt_errstr(status));
851 return false;
852 }
853
854 generate_random_buffer((uint8_t *)confounder, 16);
855
856 MD5Init(&ctx);
857 MD5Update(&ctx, confounder, 16);
858 MD5Update(&ctx, session_key.data, session_key.length);
859 MD5Final(confounded_session_key.data, &ctx);
860
861 arcfour_crypt_blob(u.info25.password.data, 516, &confounded_session_key);
862 memcpy(&u.info25.password.data[516], confounder, 16);
863
864 torture_comment(tctx, "Testing SetUserInfo level 25 (set password ex)\n");
865
866 status = dcerpc_samr_SetUserInfo(p, tctx, &s);
867 if (!NT_STATUS_IS_OK(status)) {
868 printf("SetUserInfo level %u failed - %s\n",
869 s.in.level, nt_errstr(status));
870 ret = false;
871 } else {
872 *password = newpass;
873 }
874
875 /* This should break the key nicely */
876 confounded_session_key.data[0]++;
877
878 arcfour_crypt_blob(u.info25.password.data, 516, &confounded_session_key);
879 memcpy(&u.info25.password.data[516], confounder, 16);
880
881 torture_comment(tctx, "Testing SetUserInfo level 25 (set password ex) with wrong session key\n");
882
883 status = dcerpc_samr_SetUserInfo(p, tctx, &s);
884 if (!NT_STATUS_EQUAL(status, NT_STATUS_WRONG_PASSWORD)) {
885 printf("SetUserInfo level %u should have failed with WRONG_PASSWORD- %s\n",
886 s.in.level, nt_errstr(status));
887 ret = false;
888 }
889
890 return ret;
891 }
892
893 static bool test_SetUserPass_18(struct dcerpc_pipe *p, struct torture_context *tctx,
894 struct policy_handle *handle, char **password)
895 {
896 NTSTATUS status;
897 struct samr_SetUserInfo s;
898 union samr_UserInfo u;
899 bool ret = true;
900 DATA_BLOB session_key;
901 char *newpass;
902 struct samr_GetUserPwInfo pwp;
903 struct samr_PwInfo info;
904 int policy_min_pw_len = 0;
905 uint8_t lm_hash[16], nt_hash[16];
906
907 pwp.in.user_handle = handle;
908 pwp.out.info = &info;
909
910 status = dcerpc_samr_GetUserPwInfo(p, tctx, &pwp);
911 if (NT_STATUS_IS_OK(status)) {
912 policy_min_pw_len = pwp.out.info->min_password_length;
913 }
914 newpass = samr_rand_pass(tctx, policy_min_pw_len);
915
916 s.in.user_handle = handle;
917 s.in.info = &u;
918 s.in.level = 18;
919
920 ZERO_STRUCT(u);
921
922 u.info18.nt_pwd_active = true;
923 u.info18.lm_pwd_active = true;
924
925 E_md4hash(newpass, nt_hash);
926 E_deshash(newpass, lm_hash);
927
928 status = dcerpc_fetch_session_key(p, &session_key);
929 if (!NT_STATUS_IS_OK(status)) {
930 printf("SetUserInfo level %u - no session key - %s\n",
931 s.in.level, nt_errstr(status));
932 return false;
933 }
934
935 {
936 DATA_BLOB in,out;
937 in = data_blob_const(nt_hash, 16);
938 out = data_blob_talloc_zero(tctx, 16);
939 sess_crypt_blob(&out, &in, &session_key, true);
940 memcpy(u.info18.nt_pwd.hash, out.data, out.length);
941 }
942 {
943 DATA_BLOB in,out;
944 in = data_blob_const(lm_hash, 16);
945 out = data_blob_talloc_zero(tctx, 16);
946 sess_crypt_blob(&out, &in, &session_key, true);
947 memcpy(u.info18.lm_pwd.hash, out.data, out.length);
948 }
949
950 torture_comment(tctx, "Testing SetUserInfo level 18 (set password hash)\n");
951
952 status = dcerpc_samr_SetUserInfo(p, tctx, &s);
953 if (!NT_STATUS_IS_OK(status)) {
954 printf("SetUserInfo level %u failed - %s\n",
955 s.in.level, nt_errstr(status));
956 ret = false;
957 } else {
958 *password = newpass;
959 }
960
961 return ret;
962 }
963
964 static bool test_SetUserPass_21(struct dcerpc_pipe *p, struct torture_context *tctx,
965 struct policy_handle *handle, uint32_t fields_present,
966 char **password)
967 {
968 NTSTATUS status;
969 struct samr_SetUserInfo s;
970 union samr_UserInfo u;
971 bool ret = true;
972 DATA_BLOB session_key;
973 char *newpass;
974 struct samr_GetUserPwInfo pwp;
975 struct samr_PwInfo info;
976 int policy_min_pw_len = 0;
977 uint8_t lm_hash[16], nt_hash[16];
978
979 pwp.in.user_handle = handle;
980 pwp.out.info = &info;
981
982 status = dcerpc_samr_GetUserPwInfo(p, tctx, &pwp);
983 if (NT_STATUS_IS_OK(status)) {
984 policy_min_pw_len = pwp.out.info->min_password_length;
985 }
986 newpass = samr_rand_pass(tctx, policy_min_pw_len);
987
988 s.in.user_handle = handle;
989 s.in.info = &u;
990 s.in.level = 21;
991
992 E_md4hash(newpass, nt_hash);
993 E_deshash(newpass, lm_hash);
994
995 ZERO_STRUCT(u);
996
997 u.info21.fields_present = fields_present;
998
999 if (fields_present & SAMR_FIELD_LM_PASSWORD_PRESENT) {
1000 u.info21.lm_owf_password.length = 16;
1001 u.info21.lm_owf_password.size = 16;
1002 u.info21.lm_owf_password.array = (uint16_t *)lm_hash;
1003 u.info21.lm_password_set = true;
1004 }
1005
1006 if (fields_present & SAMR_FIELD_NT_PASSWORD_PRESENT) {
1007 u.info21.nt_owf_password.length = 16;
1008 u.info21.nt_owf_password.size = 16;
1009 u.info21.nt_owf_password.array = (uint16_t *)nt_hash;
1010 u.info21.nt_password_set = true;
1011 }
1012
1013 status = dcerpc_fetch_session_key(p, &session_key);
1014 if (!NT_STATUS_IS_OK(status)) {
1015 printf("SetUserInfo level %u - no session key - %s\n",
1016 s.in.level, nt_errstr(status));
1017 return false;
1018 }
1019
1020 if (fields_present & SAMR_FIELD_LM_PASSWORD_PRESENT) {
1021 DATA_BLOB in,out;
1022 in = data_blob_const(u.info21.lm_owf_password.array,
1023 u.info21.lm_owf_password.length);
1024 out = data_blob_talloc_zero(tctx, 16);
1025 sess_crypt_blob(&out, &in, &session_key, true);
1026 u.info21.lm_owf_password.array = (uint16_t *)out.data;
1027 }
1028
1029 if (fields_present & SAMR_FIELD_NT_PASSWORD_PRESENT) {
1030 DATA_BLOB in,out;
1031 in = data_blob_const(u.info21.nt_owf_password.array,
1032 u.info21.nt_owf_password.length);
1033 out = data_blob_talloc_zero(tctx, 16);
1034 sess_crypt_blob(&out, &in, &session_key, true);
1035 u.info21.nt_owf_password.array = (uint16_t *)out.data;
1036 }
1037
1038 torture_comment(tctx, "Testing SetUserInfo level 21 (set password hash)\n");
1039
1040 status = dcerpc_samr_SetUserInfo(p, tctx, &s);
1041 if (!NT_STATUS_IS_OK(status)) {
1042 printf("SetUserInfo level %u failed - %s\n",
1043 s.in.level, nt_errstr(status));
1044 ret = false;
1045 } else {
1046 *password = newpass;
1047 }
1048
1049 /* try invalid length */
1050 if (fields_present & SAMR_FIELD_NT_PASSWORD_PRESENT) {
1051
1052 u.info21.nt_owf_password.length++;
1053
1054 status = dcerpc_samr_SetUserInfo(p, tctx, &s);
1055
1056 if (!NT_STATUS_EQUAL(status, NT_STATUS_INVALID_PARAMETER)) {
1057 printf("SetUserInfo level %u should have failed with NT_STATUS_INVALID_PARAMETER - %s\n",
1058 s.in.level, nt_errstr(status));
1059 ret = false;
1060 }
1061 }
1062
1063 if (fields_present & SAMR_FIELD_LM_PASSWORD_PRESENT) {
1064
1065 u.info21.lm_owf_password.length++;
1066
1067 status = dcerpc_samr_SetUserInfo(p, tctx, &s);
1068
1069 if (!NT_STATUS_EQUAL(status, NT_STATUS_INVALID_PARAMETER)) {
1070 printf("SetUserInfo level %u should have failed with NT_STATUS_INVALID_PARAMETER - %s\n",
1071 s.in.level, nt_errstr(status));
1072 ret = false;
1073 }
1074 }
1075
1076 return ret;
1077 }
1078
1079 static bool test_SetUserPass_level_ex(struct dcerpc_pipe *p,
1080 struct torture_context *tctx,
1081 struct policy_handle *handle,
1082 uint16_t level,
1083 uint32_t fields_present,
1084 char **password, uint8_t password_expired,
1085 bool use_setinfo2,
1086 bool *matched_expected_error)
1087 {
1088 NTSTATUS status;
1089 NTSTATUS expected_error = NT_STATUS_OK;
1090 struct samr_SetUserInfo s;
1091 struct samr_SetUserInfo2 s2;
1092 union samr_UserInfo u;
1093 bool ret = true;
1094 DATA_BLOB session_key;
1095 DATA_BLOB confounded_session_key = data_blob_talloc(tctx, NULL, 16);
1096 struct MD5Context ctx;
1097 uint8_t confounder[16];
1098 char *newpass;
1099 struct samr_GetUserPwInfo pwp;
1100 struct samr_PwInfo info;
1101 int policy_min_pw_len = 0;
1102 const char *comment = NULL;
1103 uint8_t lm_hash[16], nt_hash[16];
1104
1105 pwp.in.user_handle = handle;
1106 pwp.out.info = &info;
1107
1108 status = dcerpc_samr_GetUserPwInfo(p, tctx, &pwp);
1109 if (NT_STATUS_IS_OK(status)) {
1110 policy_min_pw_len = pwp.out.info->min_password_length;
1111 }
1112 newpass = samr_rand_pass_silent(tctx, policy_min_pw_len);
1113
1114 if (use_setinfo2) {
1115 s2.in.user_handle = handle;
1116 s2.in.info = &u;
1117 s2.in.level = level;
1118 } else {
1119 s.in.user_handle = handle;
1120 s.in.info = &u;
1121 s.in.level = level;
1122 }
1123
1124 if (fields_present & SAMR_FIELD_COMMENT) {
1125 comment = talloc_asprintf(tctx, "comment: %ld\n", time(NULL));
1126 }
1127
1128 ZERO_STRUCT(u);
1129
1130 switch (level) {
1131 case 18:
1132 E_md4hash(newpass, nt_hash);
1133 E_deshash(newpass, lm_hash);
1134
1135 u.info18.nt_pwd_active = true;
1136 u.info18.lm_pwd_active = true;
1137 u.info18.password_expired = password_expired;
1138
1139 memcpy(u.info18.lm_pwd.hash, lm_hash, 16);
1140 memcpy(u.info18.nt_pwd.hash, nt_hash, 16);
1141
1142 break;
1143 case 21:
1144 E_md4hash(newpass, nt_hash);
1145 E_deshash(newpass, lm_hash);
1146
1147 u.info21.fields_present = fields_present;
1148 u.info21.password_expired = password_expired;
1149 u.info21.comment.string = comment;
1150
1151 if (fields_present & SAMR_FIELD_LM_PASSWORD_PRESENT) {
1152 u.info21.lm_owf_password.length = 16;
1153 u.info21.lm_owf_password.size = 16;
1154 u.info21.lm_owf_password.array = (uint16_t *)lm_hash;
1155 u.info21.lm_password_set = true;
1156 }
1157
1158 if (fields_present & SAMR_FIELD_NT_PASSWORD_PRESENT) {
1159 u.info21.nt_owf_password.length = 16;
1160 u.info21.nt_owf_password.size = 16;
1161 u.info21.nt_owf_password.array = (uint16_t *)nt_hash;
1162 u.info21.nt_password_set = true;
1163 }
1164
1165 break;
1166 case 23:
1167 u.info23.info.fields_present = fields_present;
1168 u.info23.info.password_expired = password_expired;
1169 u.info23.info.comment.string = comment;
1170
1171 encode_pw_buffer(u.info23.password.data, newpass, STR_UNICODE);
1172
1173 break;
1174 case 24:
1175 u.info24.password_expired = password_expired;
1176
1177 encode_pw_buffer(u.info24.password.data, newpass, STR_UNICODE);
1178
1179 break;
1180 case 25:
1181 u.info25.info.fields_present = fields_present;
1182 u.info25.info.password_expired = password_expired;
1183 u.info25.info.comment.string = comment;
1184
1185 encode_pw_buffer(u.info25.password.data, newpass, STR_UNICODE);
1186
1187 break;
1188 case 26:
1189 u.info26.password_expired = password_expired;
1190
1191 encode_pw_buffer(u.info26.password.data, newpass, STR_UNICODE);
1192
1193 break;
1194 }
1195
1196 status = dcerpc_fetch_session_key(p, &session_key);
1197 if (!NT_STATUS_IS_OK(status)) {
1198 printf("SetUserInfo level %u - no session key - %s\n",
1199 s.in.level, nt_errstr(status));
1200 return false;
1201 }
1202
1203 generate_random_buffer((uint8_t *)confounder, 16);
1204
1205 MD5Init(&ctx);
1206 MD5Update(&ctx, confounder, 16);
1207 MD5Update(&ctx, session_key.data, session_key.length);
1208 MD5Final(confounded_session_key.data, &ctx);
1209
1210 switch (level) {
1211 case 18:
1212 {
1213 DATA_BLOB in,out;
1214 in = data_blob_const(u.info18.nt_pwd.hash, 16);
1215 out = data_blob_talloc_zero(tctx, 16);
1216 sess_crypt_blob(&out, &in, &session_key, true);
1217 memcpy(u.info18.nt_pwd.hash, out.data, out.length);
1218 }
1219 {
1220 DATA_BLOB in,out;
1221 in = data_blob_const(u.info18.lm_pwd.hash, 16);
1222 out = data_blob_talloc_zero(tctx, 16);
1223 sess_crypt_blob(&out, &in, &session_key, true);
1224 memcpy(u.info18.lm_pwd.hash, out.data, out.length);
1225 }
1226
1227 break;
1228 case 21:
1229 if (fields_present & SAMR_FIELD_LM_PASSWORD_PRESENT) {
1230 DATA_BLOB in,out;
1231 in = data_blob_const(u.info21.lm_owf_password.array,
1232 u.info21.lm_owf_password.length);
1233 out = data_blob_talloc_zero(tctx, 16);
1234 sess_crypt_blob(&out, &in, &session_key, true);
1235 u.info21.lm_owf_password.array = (uint16_t *)out.data;
1236 }
1237 if (fields_present & SAMR_FIELD_NT_PASSWORD_PRESENT) {
1238 DATA_BLOB in,out;
1239 in = data_blob_const(u.info21.nt_owf_password.array,
1240 u.info21.nt_owf_password.length);
1241 out = data_blob_talloc_zero(tctx, 16);
1242 sess_crypt_blob(&out, &in, &session_key, true);
1243 u.info21.nt_owf_password.array = (uint16_t *)out.data;
1244 }
1245 break;
1246 case 23:
1247 arcfour_crypt_blob(u.info23.password.data, 516, &session_key);
1248 break;
1249 case 24:
1250 arcfour_crypt_blob(u.info24.password.data, 516, &session_key);
1251 break;
1252 case 25:
1253 arcfour_crypt_blob(u.info25.password.data, 516, &confounded_session_key);
1254 memcpy(&u.info25.password.data[516], confounder, 16);
1255 break;
1256 case 26:
1257 arcfour_crypt_blob(u.info26.password.data, 516, &confounded_session_key);
1258 memcpy(&u.info26.password.data[516], confounder, 16);
1259 break;
1260 }
1261
1262 if (use_setinfo2) {
1263 status = dcerpc_samr_SetUserInfo2(p, tctx, &s2);
1264 } else {
1265 status = dcerpc_samr_SetUserInfo(p, tctx, &s);
1266 }
1267
1268 if (!NT_STATUS_IS_OK(status)) {
1269 if (fields_present == 0) {
1270 expected_error = NT_STATUS_INVALID_PARAMETER;
1271 }
1272 if (fields_present & SAMR_FIELD_LAST_PWD_CHANGE) {
1273 expected_error = NT_STATUS_ACCESS_DENIED;
1274 }
1275 }
1276
1277 if (!NT_STATUS_IS_OK(expected_error)) {
1278 if (use_setinfo2) {
1279 torture_assert_ntstatus_equal(tctx,
1280 s2.out.result,
1281 expected_error, "SetUserInfo2 failed");
1282 } else {
1283 torture_assert_ntstatus_equal(tctx,
1284 s.out.result,
1285 expected_error, "SetUserInfo failed");
1286 }
1287 *matched_expected_error = true;
1288 return true;
1289 }
1290
1291 if (!NT_STATUS_IS_OK(status)) {
1292 printf("SetUserInfo%s level %u failed - %s\n",
1293 use_setinfo2 ? "2":"", level, nt_errstr(status));
1294 ret = false;
1295 } else {
1296 *password = newpass;
1297 }
1298
1299 return ret;
1300 }
1301
1302 static bool test_SetAliasInfo(struct dcerpc_pipe *p, struct torture_context *tctx,
1303 struct policy_handle *handle)
1304 {
1305 NTSTATUS status;
1306 struct samr_SetAliasInfo r;
1307 struct samr_QueryAliasInfo q;
1308 union samr_AliasInfo *info;
1309 uint16_t levels[] = {2, 3};
1310 int i;
1311 bool ret = true;
1312
1313 /* Ignoring switch level 1, as that includes the number of members for the alias
1314 * and setting this to a wrong value might have negative consequences
1315 */
1316
1317 for (i=0;i<ARRAY_SIZE(levels);i++) {
1318 torture_comment(tctx, "Testing SetAliasInfo level %u\n", levels[i]);
1319
1320 r.in.alias_handle = handle;
1321 r.in.level = levels[i];
1322 r.in.info = talloc(tctx, union samr_AliasInfo);
1323 switch (r.in.level) {
1324 case ALIASINFONAME: init_lsa_String(&r.in.info->name,TEST_ALIASNAME); break;
1325 case ALIASINFODESCRIPTION: init_lsa_String(&r.in.info->description,
1326 "Test Description, should test I18N as well"); break;
1327 case ALIASINFOALL: printf("ALIASINFOALL ignored\n"); break;
1328 }
1329
1330 status = dcerpc_samr_SetAliasInfo(p, tctx, &r);
1331 if (!NT_STATUS_IS_OK(status)) {
1332 printf("SetAliasInfo level %u failed - %s\n",
1333 levels[i], nt_errstr(status));
1334 ret = false;
1335 }
1336
1337 q.in.alias_handle = handle;
1338 q.in.level = levels[i];
1339 q.out.info = &info;
1340
1341 status = dcerpc_samr_QueryAliasInfo(p, tctx, &q);
1342 if (!NT_STATUS_IS_OK(status)) {
1343 printf("QueryAliasInfo level %u failed - %s\n",
1344 levels[i], nt_errstr(status));
1345 ret = false;
1346 }
1347 }
1348
1349 return ret;
1350 }
1351
1352 static bool test_GetGroupsForUser(struct dcerpc_pipe *p, struct torture_context *tctx,
1353 struct policy_handle *user_handle)
1354 {
1355 struct samr_GetGroupsForUser r;
1356 struct samr_RidWithAttributeArray *rids = NULL;
1357 NTSTATUS status;
1358
1359 torture_comment(tctx, "testing GetGroupsForUser\n");
1360
1361 r.in.user_handle = user_handle;
1362 r.out.rids = &rids;
1363
1364 status = dcerpc_samr_GetGroupsForUser(p, tctx, &r);
1365 torture_assert_ntstatus_ok(tctx, status, "GetGroupsForUser");
1366
1367 return true;
1368
1369 }
1370
1371 static bool test_GetDomPwInfo(struct dcerpc_pipe *p, struct torture_context *tctx,
1372 struct lsa_String *domain_name)
1373 {
1374 NTSTATUS status;
1375 struct samr_GetDomPwInfo r;
1376 struct samr_PwInfo info;
1377
1378 r.in.domain_name = domain_name;
1379 r.out.info = &info;
1380
1381 torture_comment(tctx, "Testing GetDomPwInfo with name %s\n", r.in.domain_name->string);
1382
1383 status = dcerpc_samr_GetDomPwInfo(p, tctx, &r);
1384 torture_assert_ntstatus_ok(tctx, status, "GetDomPwInfo");
1385
1386 r.in.domain_name->string = talloc_asprintf(tctx, "\\\\%s", dcerpc_server_name(p));
1387 torture_comment(tctx, "Testing GetDomPwInfo with name %s\n", r.in.domain_name->string);
1388
1389 status = dcerpc_samr_GetDomPwInfo(p, tctx, &r);
1390 torture_assert_ntstatus_ok(tctx, status, "GetDomPwInfo");
1391
1392 r.in.domain_name->string = "\\\\__NONAME__";
1393 torture_comment(tctx, "Testing GetDomPwInfo with name %s\n", r.in.domain_name->string);
1394
1395 status = dcerpc_samr_GetDomPwInfo(p, tctx, &r);
1396 torture_assert_ntstatus_ok(tctx, status, "GetDomPwInfo");
1397
1398 r.in.domain_name->string = "\\\\Builtin";
1399 torture_comment(tctx, "Testing GetDomPwInfo with name %s\n", r.in.domain_name->string);
1400
1401 status = dcerpc_samr_GetDomPwInfo(p, tctx, &r);
1402 torture_assert_ntstatus_ok(tctx, status, "GetDomPwInfo");
1403
1404 return true;
1405 }
1406
1407 static bool test_GetUserPwInfo(struct dcerpc_pipe *p, struct torture_context *tctx,
1408 struct policy_handle *handle)
1409 {
1410 NTSTATUS status;
1411 struct samr_GetUserPwInfo r;
1412 struct samr_PwInfo info;
1413
1414 torture_comment(tctx, "Testing GetUserPwInfo\n");
1415
1416 r.in.user_handle = handle;
1417 r.out.info = &info;
1418
1419 status = dcerpc_samr_GetUserPwInfo(p, tctx, &r);
1420 torture_assert_ntstatus_ok(tctx, status, "GetUserPwInfo");
1421
1422 return true;
1423 }
1424
1425 static NTSTATUS test_LookupName(struct dcerpc_pipe *p, struct torture_context *tctx,
1426 struct policy_handle *domain_handle, const char *name,
1427 uint32_t *rid)
1428 {
1429 NTSTATUS status;
1430 struct samr_LookupNames n;
1431 struct lsa_String sname[2];
1432 struct samr_Ids rids, types;
1433
1434 init_lsa_String(&sname[0], name);
1435
1436 n.in.domain_handle = domain_handle;
1437 n.in.num_names = 1;
1438 n.in.names = sname;
1439 n.out.rids = &rids;
1440 n.out.types = &types;
1441 status = dcerpc_samr_LookupNames(p, tctx, &n);
1442 if (NT_STATUS_IS_OK(status)) {
1443 *rid = n.out.rids->ids[0];
1444 } else {
1445 return status;
1446 }
1447
1448 init_lsa_String(&sname[1], "xxNONAMExx");
1449 n.in.num_names = 2;
1450 status = dcerpc_samr_LookupNames(p, tctx, &n);
1451 if (!NT_STATUS_EQUAL(status, STATUS_SOME_UNMAPPED)) {
1452 printf("LookupNames[2] failed - %s\n", nt_errstr(status));
1453 if (NT_STATUS_IS_OK(status)) {
1454 return NT_STATUS_UNSUCCESSFUL;
1455 }
1456 return status;
1457 }
1458
1459 n.in.num_names = 0;
1460 status = dcerpc_samr_LookupNames(p, tctx, &n);
1461 if (!NT_STATUS_IS_OK(status)) {
1462 printf("LookupNames[0] failed - %s\n", nt_errstr(status));
1463 return status;
1464 }
1465
1466 init_lsa_String(&sname[0], "xxNONAMExx");
1467 n.in.num_names = 1;
1468 status = dcerpc_samr_LookupNames(p, tctx, &n);
1469 if (!NT_STATUS_EQUAL(status, NT_STATUS_NONE_MAPPED)) {
1470 printf("LookupNames[1 bad name] failed - %s\n", nt_errstr(status));
1471 if (NT_STATUS_IS_OK(status)) {
1472 return NT_STATUS_UNSUCCESSFUL;
1473 }
1474 return status;
1475 }
1476
1477 init_lsa_String(&sname[0], "xxNONAMExx");
1478 init_lsa_String(&sname[1], "xxNONAME2xx");
1479 n.in.num_names = 2;
1480 status = dcerpc_samr_LookupNames(p, tctx, &n);
1481 if (!NT_STATUS_EQUAL(status, NT_STATUS_NONE_MAPPED)) {
1482 printf("LookupNames[2 bad names] failed - %s\n", nt_errstr(status));
1483 if (NT_STATUS_IS_OK(status)) {
1484 return NT_STATUS_UNSUCCESSFUL;
1485 }
1486 return status;
1487 }
1488
1489 return NT_STATUS_OK;
1490 }
1491
1492 static NTSTATUS test_OpenUser_byname(struct dcerpc_pipe *p,
1493 struct torture_context *tctx,
1494 struct policy_handle *domain_handle,
1495 const char *name, struct policy_handle *user_handle)
1496 {
1497 NTSTATUS status;
1498 struct samr_OpenUser r;
1499 uint32_t rid;
1500
1501 status = test_LookupName(p, tctx, domain_handle, name, &rid);
1502 if (!NT_STATUS_IS_OK(status)) {
1503 return status;
1504 }
1505
1506 r.in.domain_handle = domain_handle;
1507 r.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
1508 r.in.rid = rid;
1509 r.out.user_handle = user_handle;
1510 status = dcerpc_samr_OpenUser(p, tctx, &r);
1511 if (!NT_STATUS_IS_OK(status)) {
1512 printf("OpenUser_byname(%s -> %d) failed - %s\n", name, rid, nt_errstr(status));
1513 }
1514
1515 return status;
1516 }
1517
1518 #if 0
1519 static bool test_ChangePasswordNT3(struct dcerpc_pipe *p,
1520 struct torture_context *tctx,
1521 struct policy_handle *handle)
1522 {
1523 NTSTATUS status;
1524 struct samr_ChangePasswordUser r;
1525 bool ret = true;
1526 struct samr_Password hash1, hash2, hash3, hash4, hash5, hash6;
1527 struct policy_handle user_handle;
1528 char *oldpass = "test";
1529 char *newpass = "test2";
1530 uint8_t old_nt_hash[16], new_nt_hash[16];
1531 uint8_t old_lm_hash[16], new_lm_hash[16];
1532
1533 status = test_OpenUser_byname(p, tctx, handle, "testuser", &user_handle);
1534 if (!NT_STATUS_IS_OK(status)) {
1535 return false;
1536 }
1537
1538 printf("Testing ChangePasswordUser for user 'testuser'\n");
1539
1540 printf("old password: %s\n", oldpass);
1541 printf("new password: %s\n", newpass);
1542
1543 E_md4hash(oldpass, old_nt_hash);
1544 E_md4hash(newpass, new_nt_hash);
1545 E_deshash(oldpass, old_lm_hash);
1546 E_deshash(newpass, new_lm_hash);
1547
1548 E_old_pw_hash(new_lm_hash, old_lm_hash, hash1.hash);
1549 E_old_pw_hash(old_lm_hash, new_lm_hash, hash2.hash);
1550 E_old_pw_hash(new_nt_hash, old_nt_hash, hash3.hash);
1551 E_old_pw_hash(old_nt_hash, new_nt_hash, hash4.hash);
1552 E_old_pw_hash(old_lm_hash, new_nt_hash, hash5.hash);
1553 E_old_pw_hash(old_nt_hash, new_lm_hash, hash6.hash);
1554
1555 r.in.handle = &user_handle;
1556 r.in.lm_present = 1;
1557 r.in.old_lm_crypted = &hash1;
1558 r.in.new_lm_crypted = &hash2;
1559 r.in.nt_present = 1;
1560 r.in.old_nt_crypted = &hash3;
1561 r.in.new_nt_crypted = &hash4;
1562 r.in.cross1_present = 1;
1563 r.in.nt_cross = &hash5;
1564 r.in.cross2_present = 1;
1565 r.in.lm_cross = &hash6;
1566
1567 status = dcerpc_samr_ChangePasswordUser(p, tctx, &r);
1568 if (!NT_STATUS_IS_OK(status)) {
1569 printf("ChangePasswordUser failed - %s\n", nt_errstr(status));
1570 ret = false;
1571 }
1572
1573 if (!test_samr_handle_Close(p, tctx, &user_handle)) {
1574 ret = false;
1575 }
1576
1577 return ret;
1578 }
1579 #endif
1580
1581 static bool test_ChangePasswordUser(struct dcerpc_pipe *p, struct torture_context *tctx,
1582 const char *acct_name,
1583 struct policy_handle *handle, char **password)
1584 {
1585 NTSTATUS status;
1586 struct samr_ChangePasswordUser r;
1587 bool ret = true;
1588 struct samr_Password hash1, hash2, hash3, hash4, hash5, hash6;
1589 struct policy_handle user_handle;
1590 char *oldpass;
1591 uint8_t old_nt_hash[16], new_nt_hash[16];
1592 uint8_t old_lm_hash[16], new_lm_hash[16];
1593 bool changed = true;
1594
1595 char *newpass;
1596 struct samr_GetUserPwInfo pwp;
1597 struct samr_PwInfo info;
1598 int policy_min_pw_len = 0;
1599
1600 status = test_OpenUser_byname(p, tctx, handle, acct_name, &user_handle);
1601 if (!NT_STATUS_IS_OK(status)) {
1602 return false;
1603 }
1604 pwp.in.user_handle = &user_handle;
1605 pwp.out.info = &info;
1606
1607 status = dcerpc_samr_GetUserPwInfo(p, tctx, &pwp);
1608 if (NT_STATUS_IS_OK(status)) {
1609 policy_min_pw_len = pwp.out.info->min_password_length;
1610 }
1611 newpass = samr_rand_pass(tctx, policy_min_pw_len);
1612
1613 torture_comment(tctx, "Testing ChangePasswordUser\n");
1614
1615 torture_assert(tctx, *password != NULL,
1616 "Failing ChangePasswordUser as old password was NULL. Previous test failed?");
1617
1618 oldpass = *password;
1619
1620 E_md4hash(oldpass, old_nt_hash);
1621 E_md4hash(newpass, new_nt_hash);
1622 E_deshash(oldpass, old_lm_hash);
1623 E_deshash(newpass, new_lm_hash);
1624
1625 E_old_pw_hash(new_lm_hash, old_lm_hash, hash1.hash);
1626 E_old_pw_hash(old_lm_hash, new_lm_hash, hash2.hash);
1627 E_old_pw_hash(new_nt_hash, old_nt_hash, hash3.hash);
1628 E_old_pw_hash(old_nt_hash, new_nt_hash, hash4.hash);
1629 E_old_pw_hash(old_lm_hash, new_nt_hash, hash5.hash);
1630 E_old_pw_hash(old_nt_hash, new_lm_hash, hash6.hash);
1631
1632 r.in.user_handle = &user_handle;
1633 r.in.lm_present = 1;
1634 /* Break the LM hash */
1635 hash1.hash[0]++;
1636 r.in.old_lm_crypted = &hash1;
1637 r.in.new_lm_crypted = &hash2;
1638 r.in.nt_present = 1;
1639 r.in.old_nt_crypted = &hash3;
1640 r.in.new_nt_crypted = &hash4;
1641 r.in.cross1_present = 1;
1642 r.in.nt_cross = &hash5;
1643 r.in.cross2_present = 1;
1644 r.in.lm_cross = &hash6;
1645
1646 status = dcerpc_samr_ChangePasswordUser(p, tctx, &r);
1647 torture_assert_ntstatus_equal(tctx, status, NT_STATUS_WRONG_PASSWORD,
1648 "ChangePasswordUser failed: expected NT_STATUS_WRONG_PASSWORD because we broke the LM hash");
1649
1650 /* Unbreak the LM hash */
1651 hash1.hash[0]--;
1652
1653 r.in.user_handle = &user_handle;
1654 r.in.lm_present = 1;
1655 r.in.old_lm_crypted = &hash1;
1656 r.in.new_lm_crypted = &hash2;
1657 /* Break the NT hash */
1658 hash3.hash[0]--;
1659 r.in.nt_present = 1;
1660 r.in.old_nt_crypted = &hash3;
1661 r.in.new_nt_crypted = &hash4;
1662 r.in.cross1_present = 1;
1663 r.in.nt_cross = &hash5;
1664 r.in.cross2_present = 1;
1665 r.in.lm_cross = &hash6;
1666
1667 status = dcerpc_samr_ChangePasswordUser(p, tctx, &r);
1668 torture_assert_ntstatus_equal(tctx, status, NT_STATUS_WRONG_PASSWORD,
1669 "expected NT_STATUS_WRONG_PASSWORD because we broke the NT hash");
1670
1671 /* Unbreak the NT hash */
1672 hash3.hash[0]--;
1673
1674 r.in.user_handle = &user_handle;
1675 r.in.lm_present = 1;
1676 r.in.old_lm_crypted = &hash1;
1677 r.in.new_lm_crypted = &hash2;
1678 r.in.nt_present = 1;
1679 r.in.old_nt_crypted = &hash3;
1680 r.in.new_nt_crypted = &hash4;
1681 r.in.cross1_present = 1;
1682 r.in.nt_cross = &hash5;
1683 r.in.cross2_present = 1;
1684 /* Break the LM cross */
1685 hash6.hash[0]++;
1686 r.in.lm_cross = &hash6;
1687
1688 status = dcerpc_samr_ChangePasswordUser(p, tctx, &r);
1689 if (!NT_STATUS_EQUAL(status, NT_STATUS_WRONG_PASSWORD)) {
1690 printf("ChangePasswordUser failed: expected NT_STATUS_WRONG_PASSWORD because we broke the LM cross-hash, got %s\n", nt_errstr(status));
1691 ret = false;
1692 }
1693
1694 /* Unbreak the LM cross */
1695 hash6.hash[0]--;
1696
1697 r.in.user_handle = &user_handle;
1698 r.in.lm_present = 1;
1699 r.in.old_lm_crypted = &hash1;
1700 r.in.new_lm_crypted = &hash2;
1701 r.in.nt_present = 1;
1702 r.in.old_nt_crypted = &hash3;
1703 r.in.new_nt_crypted = &hash4;
1704 r.in.cross1_present = 1;
1705 /* Break the NT cross */
1706 hash5.hash[0]++;
1707 r.in.nt_cross = &hash5;
1708 r.in.cross2_present = 1;
1709 r.in.lm_cross = &hash6;
1710
1711 status = dcerpc_samr_ChangePasswordUser(p, tctx, &r);
1712 if (!NT_STATUS_EQUAL(status, NT_STATUS_WRONG_PASSWORD)) {
1713 printf("ChangePasswordUser failed: expected NT_STATUS_WRONG_PASSWORD because we broke the NT cross-hash, got %s\n", nt_errstr(status));
1714 ret = false;
1715 }
1716
1717 /* Unbreak the NT cross */
1718 hash5.hash[0]--;
1719
1720
1721 /* Reset the hashes to not broken values */
1722 E_old_pw_hash(new_lm_hash, old_lm_hash, hash1.hash);
1723 E_old_pw_hash(old_lm_hash, new_lm_hash, hash2.hash);
1724 E_old_pw_hash(new_nt_hash, old_nt_hash, hash3.hash);
1725 E_old_pw_hash(old_nt_hash, new_nt_hash, hash4.hash);
1726 E_old_pw_hash(old_lm_hash, new_nt_hash, hash5.hash);
1727 E_old_pw_hash(old_nt_hash, new_lm_hash, hash6.hash);
1728
1729 r.in.user_handle = &user_handle;
1730 r.in.lm_present = 1;
1731 r.in.old_lm_crypted = &hash1;
1732 r.in.new_lm_crypted = &hash2;
1733 r.in.nt_present = 1;
1734 r.in.old_nt_crypted = &hash3;
1735 r.in.new_nt_crypted = &hash4;
1736 r.in.cross1_present = 1;
1737 r.in.nt_cross = &hash5;
1738 r.in.cross2_present = 0;
1739 r.in.lm_cross = NULL;
1740
1741 status = dcerpc_samr_ChangePasswordUser(p, tctx, &r);
1742 if (NT_STATUS_IS_OK(status)) {
1743 changed = true;
1744 *password = newpass;
1745 } else if (!NT_STATUS_EQUAL(NT_STATUS_PASSWORD_RESTRICTION, status)) {
1746 printf("ChangePasswordUser failed: expected NT_STATUS_OK, or at least NT_STATUS_PASSWORD_RESTRICTION, got %s\n", nt_errstr(status));
1747 ret = false;
1748 }
1749
1750 oldpass = newpass;
1751 newpass = samr_rand_pass(tctx, policy_min_pw_len);
1752
1753 E_md4hash(oldpass, old_nt_hash);
1754 E_md4hash(newpass, new_nt_hash);
1755 E_deshash(oldpass, old_lm_hash);
1756 E_deshash(newpass, new_lm_hash);
1757
1758
1759 /* Reset the hashes to not broken values */
1760 E_old_pw_hash(new_lm_hash, old_lm_hash, hash1.hash);
1761 E_old_pw_hash(old_lm_hash, new_lm_hash, hash2.hash);
1762 E_old_pw_hash(new_nt_hash, old_nt_hash, hash3.hash);
1763 E_old_pw_hash(old_nt_hash, new_nt_hash, hash4.hash);
1764 E_old_pw_hash(old_lm_hash, new_nt_hash, hash5.hash);
1765 E_old_pw_hash(old_nt_hash, new_lm_hash, hash6.hash);
1766
1767 r.in.user_handle = &user_handle;
1768 r.in.lm_present = 1;
1769 r.in.old_lm_crypted = &hash1;
1770 r.in.new_lm_crypted = &hash2;
1771 r.in.nt_present = 1;
1772 r.in.old_nt_crypted = &hash3;
1773 r.in.new_nt_crypted = &hash4;
1774 r.in.cross1_present = 0;
1775 r.in.nt_cross = NULL;
1776 r.in.cross2_present = 1;
1777 r.in.lm_cross = &hash6;
1778
1779 status = dcerpc_samr_ChangePasswordUser(p, tctx, &r);
1780 if (NT_STATUS_IS_OK(status)) {
1781 changed = true;
1782 *password = newpass;
1783 } else if (!NT_STATUS_EQUAL(NT_STATUS_PASSWORD_RESTRICTION, status)) {
1784 printf("ChangePasswordUser failed: expected NT_STATUS_NT_CROSS_ENCRYPTION_REQUIRED, got %s\n", nt_errstr(status));
1785 ret = false;
1786 }
1787
1788 oldpass = newpass;
1789 newpass = samr_rand_pass(tctx, policy_min_pw_len);
1790
1791 E_md4hash(oldpass, old_nt_hash);
1792 E_md4hash(newpass, new_nt_hash);
1793 E_deshash(oldpass, old_lm_hash);
1794 E_deshash(newpass, new_lm_hash);
1795
1796
1797 /* Reset the hashes to not broken values */
1798 E_old_pw_hash(new_lm_hash, old_lm_hash, hash1.hash);
1799 E_old_pw_hash(old_lm_hash, new_lm_hash, hash2.hash);
1800 E_old_pw_hash(new_nt_hash, old_nt_hash, hash3.hash);
1801 E_old_pw_hash(old_nt_hash, new_nt_hash, hash4.hash);
1802 E_old_pw_hash(old_lm_hash, new_nt_hash, hash5.hash);
1803 E_old_pw_hash(old_nt_hash, new_lm_hash, hash6.hash);
1804
1805 r.in.user_handle = &user_handle;
1806 r.in.lm_present = 1;
1807 r.in.old_lm_crypted = &hash1;
1808 r.in.new_lm_crypted = &hash2;
1809 r.in.nt_present = 1;
1810 r.in.old_nt_crypted = &hash3;
1811 r.in.new_nt_crypted = &hash4;
1812 r.in.cross1_present = 1;
1813 r.in.nt_cross = &hash5;
1814 r.in.cross2_present = 1;
1815 r.in.lm_cross = &hash6;
1816
1817 status = dcerpc_samr_ChangePasswordUser(p, tctx, &r);
1818 if (NT_STATUS_EQUAL(status, NT_STATUS_PASSWORD_RESTRICTION)) {
1819 printf("ChangePasswordUser returned: %s perhaps min password age? (not fatal)\n", nt_errstr(status));
1820 } else if (!NT_STATUS_IS_OK(status)) {
1821 printf("ChangePasswordUser failed - %s\n", nt_errstr(status));
1822 ret = false;
1823 } else {
1824 changed = true;
1825 *password = newpass;
1826 }
1827
1828 r.in.user_handle = &user_handle;
1829 r.in.lm_present = 1;
1830 r.in.old_lm_crypted = &hash1;
1831 r.in.new_lm_crypted = &hash2;
1832 r.in.nt_present = 1;
1833 r.in.old_nt_crypted = &hash3;
1834 r.in.new_nt_crypted = &hash4;
1835 r.in.cross1_present = 1;
1836 r.in.nt_cross = &hash5;
1837 r.in.cross2_present = 1;
1838 r.in.lm_cross = &hash6;
1839
1840 if (changed) {
1841 status = dcerpc_samr_ChangePasswordUser(p, tctx, &r);
1842 if (NT_STATUS_EQUAL(status, NT_STATUS_PASSWORD_RESTRICTION)) {
1843 printf("ChangePasswordUser returned: %s perhaps min password age? (not fatal)\n", nt_errstr(status));
1844 } else if (!NT_STATUS_EQUAL(status, NT_STATUS_WRONG_PASSWORD)) {
1845 printf("ChangePasswordUser failed: expected NT_STATUS_WRONG_PASSWORD because we already changed the password, got %s\n", nt_errstr(status));
1846 ret = false;
1847 }
1848 }
1849
1850
1851 if (!test_samr_handle_Close(p, tctx, &user_handle)) {
1852 ret = false;
1853 }
1854
1855 return ret;
1856 }
1857
1858
1859 static bool test_OemChangePasswordUser2(struct dcerpc_pipe *p, struct torture_context *tctx,
1860 const char *acct_name,
1861 struct policy_handle *handle, char **password)
1862 {
1863 NTSTATUS status;
1864 struct samr_OemChangePasswordUser2 r;
1865 bool ret = true;
1866 struct samr_Password lm_verifier;
1867 struct samr_CryptPassword lm_pass;
1868 struct lsa_AsciiString server, account, account_bad;
1869 char *oldpass;
1870 char *newpass;
1871 uint8_t old_lm_hash[16], new_lm_hash[16];
1872
1873 struct samr_GetDomPwInfo dom_pw_info;
1874 struct samr_PwInfo info;
1875 int policy_min_pw_len = 0;
1876
1877 struct lsa_String domain_name;
1878
1879 domain_name.string = "";
1880 dom_pw_info.in.domain_name = &domain_name;
1881 dom_pw_info.out.info = &info;
1882
1883 torture_comment(tctx, "Testing OemChangePasswordUser2\n");
1884
1885 torture_assert(tctx, *password != NULL,
1886 "Failing OemChangePasswordUser2 as old password was NULL. Previous test failed?");
1887
1888 oldpass = *password;
1889
1890 status = dcerpc_samr_GetDomPwInfo(p, tctx, &dom_pw_info);
1891 if (NT_STATUS_IS_OK(status)) {
1892 policy_min_pw_len = dom_pw_info.out.info->min_password_length;
1893 }
1894
1895 newpass = samr_rand_pass(tctx, policy_min_pw_len);
1896
1897 server.string = talloc_asprintf(tctx, "\\\\%s", dcerpc_server_name(p));
1898 account.string = acct_name;
1899
1900 E_deshash(oldpass, old_lm_hash);
1901 E_deshash(newpass, new_lm_hash);
1902
1903 encode_pw_buffer(lm_pass.data, newpass, STR_ASCII);
1904 arcfour_crypt(lm_pass.data, old_lm_hash, 516);
1905 E_old_pw_hash(new_lm_hash, old_lm_hash, lm_verifier.hash);
1906
1907 r.in.server = &server;
1908 r.in.account = &account;
1909 r.in.password = &lm_pass;
1910 r.in.hash = &lm_verifier;
1911
1912 /* Break the verification */
1913 lm_verifier.hash[0]++;
1914
1915 status = dcerpc_samr_OemChangePasswordUser2(p, tctx, &r);
1916
1917 if (!NT_STATUS_EQUAL(status, NT_STATUS_PASSWORD_RESTRICTION)
1918 && !NT_STATUS_EQUAL(status, NT_STATUS_WRONG_PASSWORD)) {
1919 printf("OemChangePasswordUser2 failed, should have returned WRONG_PASSWORD (or at least 'PASSWORD_RESTRICTON') for invalid password verifier - %s\n",
1920 nt_errstr(status));
1921 ret = false;
1922 }
1923
1924 encode_pw_buffer(lm_pass.data, newpass, STR_ASCII);
1925 /* Break the old password */
1926 old_lm_hash[0]++;
1927 arcfour_crypt(lm_pass.data, old_lm_hash, 516);
1928 /* unbreak it for the next operation */
1929 old_lm_hash[0]--;
1930 E_old_pw_hash(new_lm_hash, old_lm_hash, lm_verifier.hash);
1931
1932 r.in.server = &server;
1933 r.in.account = &account;
1934 r.in.password = &lm_pass;
1935 r.in.hash = &lm_verifier;
1936
1937 status = dcerpc_samr_OemChangePasswordUser2(p, tctx, &r);
1938
1939 if (!NT_STATUS_EQUAL(status, NT_STATUS_PASSWORD_RESTRICTION)
1940 && !NT_STATUS_EQUAL(status, NT_STATUS_WRONG_PASSWORD)) {
1941 printf("OemChangePasswordUser2 failed, should have returned WRONG_PASSWORD (or at least 'PASSWORD_RESTRICTON') for invalidly encrpted password - %s\n",
1942 nt_errstr(status));
1943 ret = false;
1944 }
1945
1946 encode_pw_buffer(lm_pass.data, newpass, STR_ASCII);
1947 arcfour_crypt(lm_pass.data, old_lm_hash, 516);
1948
1949 r.in.server = &server;
1950 r.in.account = &account;
1951 r.in.password = &lm_pass;
1952 r.in.hash = NULL;
1953
1954 status = dcerpc_samr_OemChangePasswordUser2(p, tctx, &r);
1955
1956 if (!NT_STATUS_EQUAL(status, NT_STATUS_PASSWORD_RESTRICTION)
1957 && !NT_STATUS_EQUAL(status, NT_STATUS_INVALID_PARAMETER)) {
1958 printf("OemChangePasswordUser2 failed, should have returned INVALID_PARAMETER (or at least 'PASSWORD_RESTRICTON') for no supplied validation hash - %s\n",
1959 nt_errstr(status));
1960 ret = false;
1961 }
1962
1963 /* This shouldn't be a valid name */
1964 account_bad.string = TEST_ACCOUNT_NAME "XX";
1965 r.in.account = &account_bad;
1966
1967 status = dcerpc_samr_OemChangePasswordUser2(p, tctx, &r);
1968
1969 if (!NT_STATUS_EQUAL(status, NT_STATUS_INVALID_PARAMETER)) {
1970 printf("OemChangePasswordUser2 failed, should have returned INVALID_PARAMETER for no supplied validation hash and invalid user - %s\n",
1971 nt_errstr(status));
1972 ret = false;
1973 }
1974
1975 /* This shouldn't be a valid name */
1976 account_bad.string = TEST_ACCOUNT_NAME "XX";
1977 r.in.account = &account_bad;
1978 r.in.password = &lm_pass;
1979 r.in.hash = &lm_verifier;
1980
1981 status = dcerpc_samr_OemChangePasswordUser2(p, tctx, &r);
1982
1983 if (!NT_STATUS_EQUAL(status, NT_STATUS_WRONG_PASSWORD)) {
1984 printf("OemChangePasswordUser2 failed, should have returned WRONG_PASSWORD for invalid user - %s\n",
1985 nt_errstr(status));
1986 ret = false;
1987 }
1988
1989 /* This shouldn't be a valid name */
1990 account_bad.string = TEST_ACCOUNT_NAME "XX";
1991 r.in.account = &account_bad;
1992 r.in.password = NULL;
1993 r.in.hash = &lm_verifier;
1994
1995 status = dcerpc_samr_OemChangePasswordUser2(p, tctx, &r);
1996
1997 if (!NT_STATUS_EQUAL(status, NT_STATUS_INVALID_PARAMETER)) {
1998 printf("OemChangePasswordUser2 failed, should have returned INVALID_PARAMETER for no supplied password and invalid user - %s\n",
1999 nt_errstr(status));
2000 ret = false;
2001 }
2002
2003 E_deshash(oldpass, old_lm_hash);
2004 E_deshash(newpass, new_lm_hash);
2005
2006 encode_pw_buffer(lm_pass.data, newpass, STR_ASCII);
2007 arcfour_crypt(lm_pass.data, old_lm_hash, 516);
2008 E_old_pw_hash(new_lm_hash, old_lm_hash, lm_verifier.hash);
2009
2010 r.in.server = &server;
2011 r.in.account = &account;
2012 r.in.password = &lm_pass;
2013 r.in.hash = &lm_verifier;
2014
2015 status = dcerpc_samr_OemChangePasswordUser2(p, tctx, &r);
2016 if (NT_STATUS_EQUAL(status, NT_STATUS_PASSWORD_RESTRICTION)) {
2017 printf("OemChangePasswordUser2 returned: %s perhaps min password age? (not fatal)\n", nt_errstr(status));
2018 } else if (!NT_STATUS_IS_OK(status)) {
2019 printf("OemChangePasswordUser2 failed - %s\n", nt_errstr(status));
2020 ret = false;
2021 } else {
2022 *password = newpass;
2023 }
2024
2025 return ret;
2026 }
2027
2028
2029 static bool test_ChangePasswordUser2(struct dcerpc_pipe *p, struct torture_context *tctx,
2030 const char *acct_name,
2031 char **password,
2032 char *newpass, bool allow_password_restriction)
2033 {
2034 NTSTATUS status;
2035 struct samr_ChangePasswordUser2 r;
2036 bool ret = true;
2037 struct lsa_String server, account;
2038 struct samr_CryptPassword nt_pass, lm_pass;
2039 struct samr_Password nt_verifier, lm_verifier;
2040 char *oldpass;
2041 uint8_t old_nt_hash[16], new_nt_hash[16];
2042 uint8_t old_lm_hash[16], new_lm_hash[16];
2043
2044 struct samr_GetDomPwInfo dom_pw_info;
2045 struct samr_PwInfo info;
2046
2047 struct lsa_String domain_name;
2048
2049 domain_name.string = "";
2050 dom_pw_info.in.domain_name = &domain_name;
2051 dom_pw_info.out.info = &info;
2052
2053 torture_comment(tctx, "Testing ChangePasswordUser2 on %s\n", acct_name);
2054
2055 torture_assert(tctx, *password != NULL,
2056 "Failing ChangePasswordUser2 as old password was NULL. Previous test failed?");
2057 oldpass = *password;
2058
2059 if (!newpass) {
2060 int policy_min_pw_len = 0;
2061 status = dcerpc_samr_GetDomPwInfo(p, tctx, &dom_pw_info);
2062 if (NT_STATUS_IS_OK(status)) {
2063 policy_min_pw_len = dom_pw_info.out.info->min_password_length;
2064 }
2065
2066 newpass = samr_rand_pass(tctx, policy_min_pw_len);
2067 }
2068
2069 server.string = talloc_asprintf(tctx, "\\\\%s", dcerpc_server_name(p));
2070 init_lsa_String(&account, acct_name);
2071
2072 E_md4hash(oldpass, old_nt_hash);
2073 E_md4hash(newpass, new_nt_hash);
2074
2075 E_deshash(oldpass, old_lm_hash);
2076 E_deshash(newpass, new_lm_hash);
2077
2078 encode_pw_buffer(lm_pass.data, newpass, STR_ASCII|STR_TERMINATE);
2079 arcfour_crypt(lm_pass.data, old_lm_hash, 516);
2080 E_old_pw_hash(new_nt_hash, old_lm_hash, lm_verifier.hash);
2081
2082 encode_pw_buffer(nt_pass.data, newpass, STR_UNICODE);
2083 arcfour_crypt(nt_pass.data, old_nt_hash, 516);
2084 E_old_pw_hash(new_nt_hash, old_nt_hash, nt_verifier.hash);
2085
2086 r.in.server = &server;
2087 r.in.account = &account;
2088 r.in.nt_password = &nt_pass;
2089 r.in.nt_verifier = &nt_verifier;
2090 r.in.lm_change = 1;
2091 r.in.lm_password = &lm_pass;
2092 r.in.lm_verifier = &lm_verifier;
2093
2094 status = dcerpc_samr_ChangePasswordUser2(p, tctx, &r);
2095 if (allow_password_restriction && NT_STATUS_EQUAL(status, NT_STATUS_PASSWORD_RESTRICTION)) {
2096 printf("ChangePasswordUser2 returned: %s perhaps min password age? (not fatal)\n", nt_errstr(status));
2097 } else if (!NT_STATUS_IS_OK(status)) {
2098 printf("ChangePasswordUser2 failed - %s\n", nt_errstr(status));
2099 ret = false;
2100 } else {
2101 *password = newpass;
2102 }
2103
2104 return ret;
2105 }
2106
2107
2108 bool test_ChangePasswordUser3(struct dcerpc_pipe *p, struct torture_context *tctx,
2109 const char *account_string,
2110 int policy_min_pw_len,
2111 char **password,
2112 const char *newpass,
2113 NTTIME last_password_change,
2114 bool handle_reject_reason)
2115 {
2116 NTSTATUS status;
2117 struct samr_ChangePasswordUser3 r;
2118 bool ret = true;
2119 struct lsa_String server, account, account_bad;
2120 struct samr_CryptPassword nt_pass, lm_pass;
2121 struct samr_Password nt_verifier, lm_verifier;
2122 char *oldpass;
2123 uint8_t old_nt_hash[16], new_nt_hash[16];
2124 uint8_t old_lm_hash[16], new_lm_hash[16];
2125 NTTIME t;
2126 struct samr_DomInfo1 *dominfo = NULL;
2127 struct samr_ChangeReject *reject = NULL;
2128
2129 torture_comment(tctx, "Testing ChangePasswordUser3\n");
2130
2131 if (newpass == NULL) {
2132 do {
2133 if (policy_min_pw_len == 0) {
2134 newpass = samr_rand_pass(tctx, policy_min_pw_len);
2135 } else {
2136 newpass = samr_rand_pass_fixed_len(tctx, policy_min_pw_len);
2137 }
2138 } while (check_password_quality(newpass) == false);
2139 } else {
2140 torture_comment(tctx, "Using password '%s'\n", newpass);
2141 }
2142
2143 torture_assert(tctx, *password != NULL,
2144 "Failing ChangePasswordUser3 as old password was NULL. Previous test failed?");
2145
2146 oldpass = *password;
2147 server.string = talloc_asprintf(tctx, "\\\\%s", dcerpc_server_name(p));
2148 init_lsa_String(&account, account_string);
2149
2150 E_md4hash(oldpass, old_nt_hash);
2151 E_md4hash(newpass, new_nt_hash);
2152
2153 E_deshash(oldpass, old_lm_hash);
2154 E_deshash(newpass, new_lm_hash);
2155
2156 encode_pw_buffer(lm_pass.data, newpass, STR_UNICODE);
2157 arcfour_crypt(lm_pass.data, old_nt_hash, 516);
2158 E_old_pw_hash(new_nt_hash, old_lm_hash, lm_verifier.hash);
2159
2160 encode_pw_buffer(nt_pass.data, newpass, STR_UNICODE);
2161 arcfour_crypt(nt_pass.data, old_nt_hash, 516);
2162 E_old_pw_hash(new_nt_hash, old_nt_hash, nt_verifier.hash);
2163
2164 /* Break the verification */
2165 nt_verifier.hash[0]++;
2166
2167 r.in.server = &server;
2168 r.in.account = &account;
2169 r.in.nt_password = &nt_pass;
2170 r.in.nt_verifier = &nt_verifier;
2171 r.in.lm_change = 1;
2172 r.in.lm_password = &lm_pass;
2173 r.in.lm_verifier = &lm_verifier;
2174 r.in.password3 = NULL;
2175 r.out.dominfo = &dominfo;
2176 r.out.reject = &reject;
2177
2178 status = dcerpc_samr_ChangePasswordUser3(p, tctx, &r);
2179 if (!NT_STATUS_EQUAL(status, NT_STATUS_PASSWORD_RESTRICTION) &&
2180 (!NT_STATUS_EQUAL(status, NT_STATUS_WRONG_PASSWORD))) {
2181 printf("ChangePasswordUser3 failed, should have returned WRONG_PASSWORD (or at least 'PASSWORD_RESTRICTON') for invalid password verifier - %s\n",
2182 nt_errstr(status));
2183 ret = false;
2184 }
2185
2186 encode_pw_buffer(lm_pass.data, newpass, STR_UNICODE);
2187 arcfour_crypt(lm_pass.data, old_nt_hash, 516);
2188 E_old_pw_hash(new_nt_hash, old_lm_hash, lm_verifier.hash);
2189
2190 encode_pw_buffer(nt_pass.data, newpass, STR_UNICODE);
2191 /* Break the NT hash */
2192 old_nt_hash[0]++;
2193 arcfour_crypt(nt_pass.data, old_nt_hash, 516);
2194 /* Unbreak it again */
2195 old_nt_hash[0]--;
2196 E_old_pw_hash(new_nt_hash, old_nt_hash, nt_verifier.hash);
2197
2198 r.in.server = &server;
2199 r.in.account = &account;
2200 r.in.nt_password = &nt_pass;
2201 r.in.nt_verifier = &nt_verifier;
2202 r.in.lm_change = 1;
2203 r.in.lm_password = &lm_pass;
2204 r.in.lm_verifier = &lm_verifier;
2205 r.in.password3 = NULL;
2206 r.out.dominfo = &dominfo;
2207 r.out.reject = &reject;
2208
2209 status = dcerpc_samr_ChangePasswordUser3(p, tctx, &r);
2210 if (!NT_STATUS_EQUAL(status, NT_STATUS_PASSWORD_RESTRICTION) &&
2211 (!NT_STATUS_EQUAL(status, NT_STATUS_WRONG_PASSWORD))) {
2212 printf("ChangePasswordUser3 failed, should have returned WRONG_PASSWORD (or at least 'PASSWORD_RESTRICTON') for invalidly encrpted password - %s\n",
2213 nt_errstr(status));
2214 ret = false;
2215 }
2216
2217 /* This shouldn't be a valid name */
2218 init_lsa_String(&account_bad, talloc_asprintf(tctx, "%sXX", account_string));
2219
2220 r.in.account = &account_bad;
2221 status = dcerpc_samr_ChangePasswordUser3(p, tctx, &r);
2222 if (!NT_STATUS_EQUAL(status, NT_STATUS_WRONG_PASSWORD)) {
2223 printf("ChangePasswordUser3 failed, should have returned WRONG_PASSWORD for invalid username - %s\n",
2224 nt_errstr(status));
2225 ret = false;
2226 }
2227
2228 E_md4hash(oldpass, old_nt_hash);
2229 E_md4hash(newpass, new_nt_hash);
2230
2231 E_deshash(oldpass, old_lm_hash);
2232 E_deshash(newpass, new_lm_hash);
2233
2234 encode_pw_buffer(lm_pass.data, newpass, STR_UNICODE);
2235 arcfour_crypt(lm_pass.data, old_nt_hash, 516);
2236 E_old_pw_hash(new_nt_hash, old_lm_hash, lm_verifier.hash);
2237
2238 encode_pw_buffer(nt_pass.data, newpass, STR_UNICODE);
2239 arcfour_crypt(nt_pass.data, old_nt_hash, 516);
2240 E_old_pw_hash(new_nt_hash, old_nt_hash, nt_verifier.hash);
2241
2242 r.in.server = &server;
2243 r.in.account = &account;
2244 r.in.nt_password = &nt_pass;
2245 r.in.nt_verifier = &nt_verifier;
2246 r.in.lm_change = 1;
2247 r.in.lm_password = &lm_pass;
2248 r.in.lm_verifier = &lm_verifier;
2249 r.in.password3 = NULL;
2250 r.out.dominfo = &dominfo;
2251 r.out.reject = &reject;
2252
2253 unix_to_nt_time(&t, time(NULL));
2254
2255 status = dcerpc_samr_ChangePasswordUser3(p, tctx, &r);
2256
2257 if (NT_STATUS_EQUAL(status, NT_STATUS_PASSWORD_RESTRICTION)
2258 && dominfo
2259 && reject
2260 && handle_reject_reason
2261 && (!null_nttime(last_password_change) || !dominfo->min_password_age)) {
2262 if (dominfo->password_properties & DOMAIN_REFUSE_PASSWORD_CHANGE ) {
2263
2264 if (reject && (reject->reason != SAMR_REJECT_OTHER)) {
2265 printf("expected SAMR_REJECT_OTHER (%d), got %d\n",
2266 SAMR_REJECT_OTHER, reject->reason);
2267 return false;
2268 }
2269 }
2270
2271 /* We tested the order of precendence which is as follows:
2272
2273 * pwd min_age
2274 * pwd length
2275 * pwd complexity
2276 * pwd history
2277
2278 Guenther */
2279
2280 if ((dominfo->min_password_age > 0) && !null_nttime(last_password_change) &&
2281 (last_password_change + dominfo->min_password_age > t)) {
2282
2283 if (reject->reason != SAMR_REJECT_OTHER) {
2284 printf("expected SAMR_REJECT_OTHER (%d), got %d\n",
2285 SAMR_REJECT_OTHER, reject->reason);
2286 return false;
2287 }
2288
2289 } else if ((dominfo->min_password_length > 0) &&
2290 (strlen(newpass) < dominfo->min_password_length)) {
2291
2292 if (reject->reason != SAMR_REJECT_TOO_SHORT) {
2293 printf("expected SAMR_REJECT_TOO_SHORT (%d), got %d\n",
2294 SAMR_REJECT_TOO_SHORT, reject->reason);
2295 return false;
2296 }
2297
2298 } else if ((dominfo->password_history_length > 0) &&
2299 strequal(oldpass, newpass)) {
2300
2301 if (reject->reason != SAMR_REJECT_IN_HISTORY) {
2302 printf("expected SAMR_REJECT_IN_HISTORY (%d), got %d\n",
2303 SAMR_REJECT_IN_HISTORY, reject->reason);
2304 return false;
2305 }
2306 } else if (dominfo->password_properties & DOMAIN_PASSWORD_COMPLEX) {
2307
2308 if (reject->reason != SAMR_REJECT_COMPLEXITY) {
2309 printf("expected SAMR_REJECT_COMPLEXITY (%d), got %d\n",
2310 SAMR_REJECT_COMPLEXITY, reject->reason);
2311 return false;
2312 }
2313
2314 }
2315
2316 if (reject->reason == SAMR_REJECT_TOO_SHORT) {
2317 /* retry with adjusted size */
2318 return test_ChangePasswordUser3(p, tctx, account_string,
2319 dominfo->min_password_length,
2320 password, NULL, 0, false);
2321
2322 }
2323
2324 } else if (NT_STATUS_EQUAL(status, NT_STATUS_PASSWORD_RESTRICTION)) {
2325 if (reject && reject->reason != SAMR_REJECT_OTHER) {
2326 printf("expected SAMR_REJECT_OTHER (%d), got %d\n",
2327 SAMR_REJECT_OTHER, reject->reason);
2328 return false;
2329 }
2330 /* Perhaps the server has a 'min password age' set? */
2331
2332 } else {
2333 torture_assert_ntstatus_ok(tctx, status, "ChangePasswordUser3");
2334 *password = talloc_strdup(tctx, newpass);
2335 }
2336
2337 return ret;
2338 }
2339
2340 bool test_ChangePasswordRandomBytes(struct dcerpc_pipe *p, struct torture_context *tctx,
2341 const char *account_string,
2342 struct policy_handle *handle,
2343 char **password)
2344 {
2345 NTSTATUS status;
2346 struct samr_ChangePasswordUser3 r;
2347 struct samr_SetUserInfo s;
2348 union samr_UserInfo u;
2349 DATA_BLOB session_key;
2350 DATA_BLOB confounded_session_key = data_blob_talloc(tctx, NULL, 16);
2351 uint8_t confounder[16];
2352 struct MD5Context ctx;
2353
2354 bool ret = true;
2355 struct lsa_String server, account;
2356 struct samr_CryptPassword nt_pass;
2357 struct samr_Password nt_verifier;
2358 DATA_BLOB new_random_pass;
2359 char *newpass;
2360 char *oldpass;
2361 uint8_t old_nt_hash[16], new_nt_hash[16];
2362 NTTIME t;
2363 struct samr_DomInfo1 *dominfo = NULL;
2364 struct samr_ChangeReject *reject = NULL;
2365
2366 new_random_pass = samr_very_rand_pass(tctx, 128);
2367
2368 torture_assert(tctx, *password != NULL,
2369 "Failing ChangePasswordUser3 as old password was NULL. Previous test failed?");
2370
2371 oldpass = *password;
2372 server.string = talloc_asprintf(tctx, "\\\\%s", dcerpc_server_name(p));
2373 init_lsa_String(&account, account_string);
2374
2375 s.in.user_handle = handle;
2376 s.in.info = &u;
2377 s.in.level = 25;
2378
2379 ZERO_STRUCT(u);
2380
2381 u.info25.info.fields_present = SAMR_FIELD_NT_PASSWORD_PRESENT;
2382
2383 set_pw_in_buffer(u.info25.password.data, &new_random_pass);
2384
2385 status = dcerpc_fetch_session_key(p, &session_key);
2386 if (!NT_STATUS_IS_OK(status)) {
2387 printf("SetUserInfo level %u - no session key - %s\n",
2388 s.in.level, nt_errstr(status));
2389 return false;
2390 }
2391
2392 generate_random_buffer((uint8_t *)confounder, 16);
2393
2394 MD5Init(&ctx);
2395 MD5Update(&ctx, confounder, 16);
2396 MD5Update(&ctx, session_key.data, session_key.length);
2397 MD5Final(confounded_session_key.data, &ctx);
2398
2399 arcfour_crypt_blob(u.info25.password.data, 516, &confounded_session_key);
2400 memcpy(&u.info25.password.data[516], confounder, 16);
2401
2402 torture_comment(tctx, "Testing SetUserInfo level 25 (set password ex) with a password made up of only random bytes\n");
2403
2404 status = dcerpc_samr_SetUserInfo(p, tctx, &s);
2405 if (!NT_STATUS_IS_OK(status)) {
2406 printf("SetUserInfo level %u failed - %s\n",
2407 s.in.level, nt_errstr(status));
2408 ret = false;
2409 }
2410
2411 torture_comment(tctx, "Testing ChangePasswordUser3 with a password made up of only random bytes\n");
2412
2413 mdfour(old_nt_hash, new_random_pass.data, new_random_pass.length);
2414
2415 new_random_pass = samr_very_rand_pass(tctx, 128);
2416
2417 mdfour(new_nt_hash, new_random_pass.data, new_random_pass.length);
2418
2419 set_pw_in_buffer(nt_pass.data, &new_random_pass);
2420 arcfour_crypt(nt_pass.data, old_nt_hash, 516);
2421 E_old_pw_hash(new_nt_hash, old_nt_hash, nt_verifier.hash);
2422
2423 r.in.server = &server;
2424 r.in.account = &account;
2425 r.in.nt_password = &nt_pass;
2426 r.in.nt_verifier = &nt_verifier;
2427 r.in.lm_change = 0;
2428 r.in.lm_password = NULL;
2429 r.in.lm_verifier = NULL;
2430 r.in.password3 = NULL;
2431 r.out.dominfo = &dominfo;
2432 r.out.reject = &reject;
2433
2434 unix_to_nt_time(&t, time(NULL));
2435
2436 status = dcerpc_samr_ChangePasswordUser3(p, tctx, &r);
2437
2438 if (NT_STATUS_EQUAL(status, NT_STATUS_PASSWORD_RESTRICTION)) {
2439 if (reject && reject->reason != SAMR_REJECT_OTHER) {
2440 printf("expected SAMR_REJECT_OTHER (%d), got %d\n",
2441 SAMR_REJECT_OTHER, reject->reason);
2442 return false;
2443 }
2444 /* Perhaps the server has a 'min password age' set? */
2445
2446 } else if (!NT_STATUS_IS_OK(status)) {
2447 printf("ChangePasswordUser3 failed - %s\n", nt_errstr(status));
2448 ret = false;
2449 }
2450
2451 newpass = samr_rand_pass(tctx, 128);
2452
2453 mdfour(old_nt_hash, new_random_pass.data, new_random_pass.length);
2454
2455 E_md4hash(newpass, new_nt_hash);
2456
2457 encode_pw_buffer(nt_pass.data, newpass, STR_UNICODE);
2458 arcfour_crypt(nt_pass.data, old_nt_hash, 516);
2459 E_old_pw_hash(new_nt_hash, old_nt_hash, nt_verifier.hash);
2460
2461 r.in.server = &server;
2462 r.in.account = &account;
2463 r.in.nt_password = &nt_pass;
2464 r.in.nt_verifier = &nt_verifier;
2465 r.in.lm_change = 0;
2466 r.in.lm_password = NULL;
2467 r.in.lm_verifier = NULL;
2468 r.in.password3 = NULL;
2469 r.out.dominfo = &dominfo;
2470 r.out.reject = &reject;
2471
2472 unix_to_nt_time(&t, time(NULL));
2473
2474 status = dcerpc_samr_ChangePasswordUser3(p, tctx, &r);
2475
2476 if (NT_STATUS_EQUAL(status, NT_STATUS_PASSWORD_RESTRICTION)) {
2477 if (reject && reject->reason != SAMR_REJECT_OTHER) {
2478 printf("expected SAMR_REJECT_OTHER (%d), got %d\n",
2479 SAMR_REJECT_OTHER, reject->reason);
2480 return false;
2481 }
2482 /* Perhaps the server has a 'min password age' set? */
2483
2484 } else {
2485 torture_assert_ntstatus_ok(tctx, status, "ChangePasswordUser3 (on second random password)");
2486 *password = talloc_strdup(tctx, newpass);
2487 }
2488
2489 return ret;
2490 }
2491
2492
2493 static bool test_GetMembersInAlias(struct dcerpc_pipe *p, struct torture_context *tctx,
2494 struct policy_handle *alias_handle)
2495 {
2496 struct samr_GetMembersInAlias r;
2497 struct lsa_SidArray sids;
2498 NTSTATUS status;
2499
2500 torture_comment(tctx, "Testing GetMembersInAlias\n");
2501
2502 r.in.alias_handle = alias_handle;
2503 r.out.sids = &sids;
2504
2505 status = dcerpc_samr_GetMembersInAlias(p, tctx, &r);
2506 torture_assert_ntstatus_ok(tctx, status, "GetMembersInAlias");
2507
2508 return true;
2509 }
2510
2511 static bool test_AddMemberToAlias(struct dcerpc_pipe *p, struct torture_context *tctx,
2512 struct policy_handle *alias_handle,
2513 const struct dom_sid *domain_sid)
2514 {
2515 struct samr_AddAliasMember r;
2516 struct samr_DeleteAliasMember d;
2517 NTSTATUS status;
2518 struct dom_sid *sid;
2519
2520 sid = dom_sid_add_rid(tctx, domain_sid, 512);
2521
2522 torture_comment(tctx, "testing AddAliasMember\n");
2523 r.in.alias_handle = alias_handle;
2524 r.in.sid = sid;
2525
2526 status = dcerpc_samr_AddAliasMember(p, tctx, &r);
2527 torture_assert_ntstatus_ok(tctx, status, "AddAliasMember");
2528
2529 d.in.alias_handle = alias_handle;
2530 d.in.sid = sid;
2531
2532 status = dcerpc_samr_DeleteAliasMember(p, tctx, &d);
2533 torture_assert_ntstatus_ok(tctx, status, "DelAliasMember");
2534
2535 return true;
2536 }
2537
2538 static bool test_AddMultipleMembersToAlias(struct dcerpc_pipe *p, struct torture_context *tctx,
2539 struct policy_handle *alias_handle)
2540 {
2541 struct samr_AddMultipleMembersToAlias a;
2542 struct samr_RemoveMultipleMembersFromAlias r;
2543 NTSTATUS status;
2544 struct lsa_SidArray sids;
2545
2546 torture_comment(tctx, "testing AddMultipleMembersToAlias\n");
2547 a.in.alias_handle = alias_handle;
2548 a.in.sids = &sids;
2549
2550 sids.num_sids = 3;
2551 sids.sids = talloc_array(tctx, struct lsa_SidPtr, 3);
2552
2553 sids.sids[0].sid = dom_sid_parse_talloc(tctx, "S-1-5-32-1-2-3-1");
2554 sids.sids[1].sid = dom_sid_parse_talloc(tctx, "S-1-5-32-1-2-3-2");
2555 sids.sids[2].sid = dom_sid_parse_talloc(tctx, "S-1-5-32-1-2-3-3");
2556
2557 status = dcerpc_samr_AddMultipleMembersToAlias(p, tctx, &a);
2558 torture_assert_ntstatus_ok(tctx, status, "AddMultipleMembersToAlias");
2559
2560
2561 torture_comment(tctx, "testing RemoveMultipleMembersFromAlias\n");
2562 r.in.alias_handle = alias_handle;
2563 r.in.sids = &sids;
2564
2565 status = dcerpc_samr_RemoveMultipleMembersFromAlias(p, tctx, &r);
2566 torture_assert_ntstatus_ok(tctx, status, "RemoveMultipleMembersFromAlias");
2567
2568 /* strange! removing twice doesn't give any error */
2569 status = dcerpc_samr_RemoveMultipleMembersFromAlias(p, tctx, &r);
2570 torture_assert_ntstatus_ok(tctx, status, "RemoveMultipleMembersFromAlias");
2571
2572 /* but removing an alias that isn't there does */
2573 sids.sids[2].sid = dom_sid_parse_talloc(tctx, "S-1-5-32-1-2-3-4");
2574
2575 status = dcerpc_samr_RemoveMultipleMembersFromAlias(p, tctx, &r);
2576 torture_assert_ntstatus_equal(tctx, status, NT_STATUS_OBJECT_NAME_NOT_FOUND, "RemoveMultipleMembersFromAlias");
2577
2578 return true;
2579 }
2580
2581 static bool test_TestPrivateFunctionsUser(struct dcerpc_pipe *p, struct torture_context *tctx,
2582 struct policy_handle *user_handle)
2583 {
2584 struct samr_TestPrivateFunctionsUser r;
2585 NTSTATUS status;
2586
2587 torture_comment(tctx, "Testing TestPrivateFunctionsUser\n");
2588
2589 r.in.user_handle = user_handle;
2590
2591 status = dcerpc_samr_TestPrivateFunctionsUser(p, tctx, &r);
2592 torture_assert_ntstatus_equal(tctx, status, NT_STATUS_NOT_IMPLEMENTED, "TestPrivateFunctionsUser");
2593
2594 return true;
2595 }
2596
2597 static bool test_QueryUserInfo_pwdlastset(struct dcerpc_pipe *p,
2598 struct torture_context *tctx,
2599 struct policy_handle *handle,
2600 bool use_info2,
2601 NTTIME *pwdlastset)
2602 {
2603 NTSTATUS status;
2604 uint16_t levels[] = { /* 3, */ 5, 21 };
2605 int i;
2606 NTTIME pwdlastset3 = 0;
2607 NTTIME pwdlastset5 = 0;
2608 NTTIME pwdlastset21 = 0;
2609
2610 torture_comment(tctx, "Testing QueryUserInfo%s level 5 and 21 call ",
2611 use_info2 ? "2":"");
2612
2613 for (i=0; i<ARRAY_SIZE(levels); i++) {
2614
2615 struct samr_QueryUserInfo r;
2616 struct samr_QueryUserInfo2 r2;
2617 union samr_UserInfo *info;
2618
2619 if (use_info2) {
2620 r2.in.user_handle = handle;
2621 r2.in.level = levels[i];
2622 r2.out.info = &info;
2623 status = dcerpc_samr_QueryUserInfo2(p, tctx, &r2);
2624
2625 } else {
2626 r.in.user_handle = handle;
2627 r.in.level = levels[i];
2628 r.out.info = &info;
2629 status = dcerpc_samr_QueryUserInfo(p, tctx, &r);
2630 }
2631
2632 if (!NT_STATUS_IS_OK(status) &&
2633 !NT_STATUS_EQUAL(status, NT_STATUS_INVALID_INFO_CLASS)) {
2634 printf("QueryUserInfo%s level %u failed - %s\n",
2635 use_info2 ? "2":"", levels[i], nt_errstr(status));
2636 return false;
2637 }
2638
2639 switch (levels[i]) {
2640 case 3:
2641 pwdlastset3 = info->info3.last_password_change;
2642 break;
2643 case 5:
2644 pwdlastset5 = info->info5.last_password_change;
2645 break;
2646 case 21:
2647 pwdlastset21 = info->info21.last_password_change;
2648 break;
2649 default:
2650 return false;
2651 }
2652 }
2653 /* torture_assert_int_equal(tctx, pwdlastset3, pwdlastset5,
2654 "pwdlastset mixup"); */
2655 torture_assert_int_equal(tctx, pwdlastset5, pwdlastset21,
2656 "pwdlastset mixup");
2657
2658 *pwdlastset = pwdlastset21;
2659
2660 torture_comment(tctx, "(pwdlastset: %lld)\n", *pwdlastset);
2661
2662 return true;
2663 }
2664
2665 static bool test_SamLogon_Creds(struct dcerpc_pipe *p, struct torture_context *tctx,
2666 struct cli_credentials *machine_credentials,
2667 struct cli_credentials *test_credentials,
2668 struct creds_CredentialState *creds,
2669 NTSTATUS expected_result)
2670 {
2671 NTSTATUS status;
2672 struct netr_LogonSamLogon r;
2673 struct netr_Authenticator auth, auth2;
2674 union netr_LogonLevel logon;
2675 union netr_Validation validation;
2676 uint8_t authoritative;
2677 struct netr_NetworkInfo ninfo;
2678 DATA_BLOB names_blob, chal, lm_resp, nt_resp;
2679 int flags = CLI_CRED_NTLM_AUTH;
2680
2681 if (lp_client_lanman_auth(tctx->lp_ctx)) {
2682 flags |= CLI_CRED_LANMAN_AUTH;
2683 }
2684
2685 if (lp_client_ntlmv2_auth(tctx->lp_ctx)) {
2686 flags |= CLI_CRED_NTLMv2_AUTH;
2687 }
2688
2689 cli_credentials_get_ntlm_username_domain(test_credentials, tctx,
2690 &ninfo.identity_info.account_name.string,
2691 &ninfo.identity_info.domain_name.string);
2692
2693 generate_random_buffer(ninfo.challenge,
2694 sizeof(ninfo.challenge));
2695 chal = data_blob_const(ninfo.challenge,
2696 sizeof(ninfo.challenge));
2697
2698 names_blob = NTLMv2_generate_names_blob(tctx, cli_credentials_get_workstation(machine_credentials),
2699 cli_credentials_get_domain(machine_credentials));
2700
2701 status = cli_credentials_get_ntlm_response(test_credentials, tctx,
2702 &flags,
2703 chal,
2704 names_blob,
2705 &lm_resp, &nt_resp,
2706 NULL, NULL);
2707 torture_assert_ntstatus_ok(tctx, status, "cli_credentials_get_ntlm_response failed");
2708
2709 ninfo.lm.data = lm_resp.data;
2710 ninfo.lm.length = lm_resp.length;
2711
2712 ninfo.nt.data = nt_resp.data;
2713 ninfo.nt.length = nt_resp.length;
2714
2715 ninfo.identity_info.parameter_control =
2716 MSV1_0_ALLOW_SERVER_TRUST_ACCOUNT |
2717 MSV1_0_ALLOW_WORKSTATION_TRUST_ACCOUNT;
2718 ninfo.identity_info.logon_id_low = 0;
2719 ninfo.identity_info.logon_id_high = 0;
2720 ninfo.identity_info.workstation.string = cli_credentials_get_workstation(machine_credentials);
2721
2722 logon.network = &ninfo;
2723
2724 r.in.server_name = talloc_asprintf(tctx, "\\\\%s", dcerpc_server_name(p));
2725 r.in.computer_name = cli_credentials_get_workstation(machine_credentials);
2726 r.in.credential = &auth;
2727 r.in.return_authenticator = &auth2;
2728 r.in.logon_level = 2;
2729 r.in.logon = &logon;
2730 r.out.validation = &validation;
2731 r.out.authoritative = &authoritative;
2732
2733 d_printf("Testing LogonSamLogon with name %s\n", ninfo.identity_info.account_name.string);
2734
2735 ZERO_STRUCT(auth2);
2736 creds_client_authenticator(creds, &auth);
2737
2738 r.in.validation_level = 2;
2739
2740 status = dcerpc_netr_LogonSamLogon(p, tctx, &r);
2741 if (!NT_STATUS_IS_OK(status)) {
2742 torture_assert_ntstatus_equal(tctx, status, expected_result, "LogonSamLogon failed");
2743 return true;
2744 } else {
2745 torture_assert_ntstatus_ok(tctx, status, "LogonSamLogon failed");
2746 }
2747
2748 torture_assert(tctx, creds_client_check(creds, &r.out.return_authenticator->cred),
2749 "Credential chaining failed");
2750
2751 return true;
2752 }
2753
2754 static bool test_SamLogon(struct torture_context *tctx,
2755 struct dcerpc_pipe *p,
2756 struct cli_credentials *machine_credentials,
2757 struct cli_credentials *test_credentials,
2758 NTSTATUS expected_result)
2759 {
2760 struct creds_CredentialState *creds;
2761
2762 if (!test_SetupCredentials(p, tctx, machine_credentials, &creds)) {
2763 return false;
2764 }
2765
2766 return test_SamLogon_Creds(p, tctx, machine_credentials, test_credentials,
2767 creds, expected_result);
2768 }
2769
2770 static bool test_SamLogon_with_creds(struct torture_context *tctx,
2771 struct dcerpc_pipe *p,
2772 struct cli_credentials *machine_creds,
2773 const char *acct_name,
2774 char *password,
2775 NTSTATUS expected_samlogon_result)
2776 {
2777 bool ret = true;
2778 struct cli_credentials *test_credentials;
2779
2780 test_credentials = cli_credentials_init(tctx);
2781
2782 cli_credentials_set_workstation(test_credentials,
2783 TEST_ACCOUNT_NAME_PWD, CRED_SPECIFIED);
2784 cli_credentials_set_domain(test_credentials,
2785 lp_workgroup(tctx->lp_ctx), CRED_SPECIFIED);
2786 cli_credentials_set_username(test_credentials,
2787 acct_name, CRED_SPECIFIED);
2788 cli_credentials_set_password(test_credentials,
2789 password, CRED_SPECIFIED);
2790 cli_credentials_set_secure_channel_type(test_credentials, SEC_CHAN_BDC);
2791
2792 printf("testing samlogon as %s@%s password: %s\n",
2793 acct_name, TEST_ACCOUNT_NAME_PWD, password);
2794
2795 if (!test_SamLogon(tctx, p, machine_creds, test_credentials,
2796 expected_samlogon_result)) {
2797 torture_warning(tctx, "new password did not work\n");
2798 ret = false;
2799 }
2800
2801 return ret;
2802 }
2803
2804 static bool test_SetPassword_level(struct dcerpc_pipe *p,
2805 struct dcerpc_pipe *np,
2806 struct torture_context *tctx,
2807 struct policy_handle *handle,
2808 uint16_t level,
2809 uint32_t fields_present,
2810 uint8_t password_expired,
2811 bool *matched_expected_error,
2812 bool use_setinfo2,
2813 const char *acct_name,
2814 char **password,
2815 struct cli_credentials *machine_creds,
2816 bool use_queryinfo2,
2817 NTTIME *pwdlastset,
2818 NTSTATUS expected_samlogon_result)
2819 {
2820 const char *fields = NULL;
2821 bool ret = true;
2822
2823 switch (level) {
2824 case 21:
2825 case 23:
2826 case 25:
2827 fields = talloc_asprintf(tctx, "(fields_present: 0x%08x)",
2828 fields_present);
2829 break;
2830 default:
2831 break;
2832 }
2833
2834 torture_comment(tctx, "Testing SetUserInfo%s level %d call "
2835 "(password_expired: %d) %s\n",
2836 use_setinfo2 ? "2":"", level, password_expired,
2837 fields ? fields : "");
2838
2839 if (!test_SetUserPass_level_ex(p, tctx, handle, level,
2840 fields_present,
2841 password,
2842 password_expired,
2843 use_setinfo2,
2844 matched_expected_error)) {
2845 ret = false;
2846 }
2847
2848 if (!test_QueryUserInfo_pwdlastset(p, tctx, handle,
2849 use_queryinfo2,
2850 pwdlastset)) {
2851 ret = false;
2852 }
2853
2854 if (*matched_expected_error == true) {
2855 return ret;
2856 }
2857
2858 if (!test_SamLogon_with_creds(tctx, np,
2859 machine_creds,
2860 acct_name,
2861 *password,
2862 expected_samlogon_result)) {
2863 ret = false;
2864 }
2865
2866 return ret;
2867 }
2868
2869 static bool test_SetPassword_pwdlastset(struct dcerpc_pipe *p,
2870 struct torture_context *tctx,
2871 uint32_t acct_flags,
2872 const char *acct_name,
2873 struct policy_handle *handle,
2874 char **password,
2875 struct cli_credentials *machine_credentials)
2876 {
2877 int s = 0, q = 0, f = 0, l = 0, z = 0;
2878 bool ret = true;
2879 int delay = 500000;
2880 bool set_levels[] = { false, true };
2881 bool query_levels[] = { false, true };
2882 uint32_t levels[] = { 18, 21, 23, 24, 25, 26 };
2883 uint32_t nonzeros[] = { 1, 24 };
2884 uint32_t fields_present[] = {
2885 0,
2886 SAMR_FIELD_EXPIRED_FLAG,
2887 SAMR_FIELD_LAST_PWD_CHANGE,
2888 SAMR_FIELD_EXPIRED_FLAG | SAMR_FIELD_LAST_PWD_CHANGE,
2889 SAMR_FIELD_COMMENT,
2890 SAMR_FIELD_NT_PASSWORD_PRESENT,
2891 SAMR_FIELD_NT_PASSWORD_PRESENT | SAMR_FIELD_LAST_PWD_CHANGE,
2892 SAMR_FIELD_NT_PASSWORD_PRESENT | SAMR_FIELD_LM_PASSWORD_PRESENT,
2893 SAMR_FIELD_NT_PASSWORD_PRESENT | SAMR_FIELD_LM_PASSWORD_PRESENT | SAMR_FIELD_LAST_PWD_CHANGE,
2894 SAMR_FIELD_NT_PASSWORD_PRESENT | SAMR_FIELD_EXPIRED_FLAG,
2895 SAMR_FIELD_NT_PASSWORD_PRESENT | SAMR_FIELD_LM_PASSWORD_PRESENT | SAMR_FIELD_EXPIRED_FLAG,
2896 SAMR_FIELD_NT_PASSWORD_PRESENT | SAMR_FIELD_LM_PASSWORD_PRESENT | SAMR_FIELD_LAST_PWD_CHANGE | SAMR_FIELD_EXPIRED_FLAG
2897 };
2898 NTSTATUS status;
2899 struct dcerpc_pipe *np = NULL;
2900
2901 if (torture_setting_bool(tctx, "samba3", false)) {
2902 delay = 1000000;
2903 printf("Samba3 has second granularity, setting delay to: %d\n",
2904 delay);
2905 }
2906
2907 status = torture_rpc_connection(tctx, &np, &ndr_table_netlogon);
2908 if (!NT_STATUS_IS_OK(status)) {
2909 return false;
2910 }
2911
2912 /* set to 1 to enable testing for all possible opcode
2913 (SetUserInfo, SetUserInfo2, QueryUserInfo, QueryUserInfo2)
2914 combinations */
2915 #if 0
2916 #define TEST_SET_LEVELS 1
2917 #define TEST_QUERY_LEVELS 1
2918 #endif
2919 for (l=0; l<ARRAY_SIZE(levels); l++) {
2920 for (z=0; z<ARRAY_SIZE(nonzeros); z++) {
2921 for (f=0; f<ARRAY_SIZE(fields_present); f++) {
2922 #ifdef TEST_SET_LEVELS
2923 for (s=0; s<ARRAY_SIZE(set_levels); s++) {
2924 #endif
2925 #ifdef TEST_QUERY_LEVELS
2926 for (q=0; q<ARRAY_SIZE(query_levels); q++) {
2927 #endif
2928 NTTIME pwdlastset_old = 0;
2929 NTTIME pwdlastset_new = 0;
2930 bool matched_expected_error = false;
2931 NTSTATUS expected_samlogon_result = NT_STATUS_ACCOUNT_DISABLED;
2932
2933 torture_comment(tctx, "------------------------------\n"
2934 "Testing pwdLastSet attribute for flags: 0x%08x "
2935 "(s: %d (l: %d), q: %d)\n",
2936 acct_flags, s, levels[l], q);
2937
2938 switch (levels[l]) {
2939 case 21:
2940 case 23:
2941 case 25:
2942 if (!((fields_present[f] & SAMR_FIELD_NT_PASSWORD_PRESENT) ||
2943 (fields_present[f] & SAMR_FIELD_LM_PASSWORD_PRESENT))) {
2944 expected_samlogon_result = NT_STATUS_WRONG_PASSWORD;
2945 }
2946 break;
2947 }
2948
2949
2950 /* set #1 */
2951
2952 /* set a password and force password change (pwdlastset 0) by
2953 * setting the password expired flag to a non-0 value */
2954
2955 if (!test_SetPassword_level(p, np, tctx, handle,
2956 levels[l],
2957 fields_present[f],
2958 nonzeros[z],
2959 &matched_expected_error,
2960 set_levels[s],
2961 acct_name,
2962 password,
2963 machine_credentials,
2964 query_levels[q],
2965 &pwdlastset_old,
2966 expected_samlogon_result)) {
2967 ret = false;
2968 }
2969
2970 if (matched_expected_error == true) {
2971 /* skipping on expected failure */
2972 continue;
2973 }
2974
2975 /* pwdlastset must be 0 afterwards, except for a level 21, 23 and 25
2976 * set without the SAMR_FIELD_EXPIRED_FLAG */
2977
2978 switch (levels[l]) {
2979 case 21:
2980 case 23:
2981 case 25:
2982 if ((pwdlastset_new != 0) &&
2983 !(fields_present[f] & SAMR_FIELD_EXPIRED_FLAG)) {
2984 torture_comment(tctx, "not considering a non-0 "
2985 "pwdLastSet as a an error as the "
2986 "SAMR_FIELD_EXPIRED_FLAG has not "
2987 "been set\n");
2988 break;
2989 }
2990 default:
2991 if (pwdlastset_new != 0) {
2992 torture_warning(tctx, "pwdLastSet test failed: "
2993 "expected pwdLastSet 0 but got %lld\n",
2994 pwdlastset_old);
2995 ret = false;
2996 }
2997 break;
2998 }
2999
3000 switch (levels[l]) {
3001 case 21:
3002 case 23:
3003 case 25:
3004 if (((fields_present[f] & SAMR_FIELD_NT_PASSWORD_PRESENT) ||
3005 (fields_present[f] & SAMR_FIELD_LM_PASSWORD_PRESENT)) &&
3006 (pwdlastset_old > 0) && (pwdlastset_new > 0) &&
3007 (pwdlastset_old >= pwdlastset_new)) {
3008 torture_warning(tctx, "pwdlastset not increasing\n");
3009 ret = false;
3010 }
3011 break;
3012 default:
3013 if ((pwdlastset_old > 0) && (pwdlastset_new > 0) &&
3014 (pwdlastset_old >= pwdlastset_new)) {
3015 torture_warning(tctx, "pwdlastset not increasing\n");
3016 ret = false;
3017 }
3018 break;
3019 }
3020
3021 usleep(delay);
3022
3023 /* set #2 */
3024
3025 /* set a password, pwdlastset needs to get updated (increased
3026 * value), password_expired value used here is 0 */
3027
3028 if (!test_SetPassword_level(p, np, tctx, handle,
3029 levels[l],
3030 fields_present[f],
3031 0,
3032 &matched_expected_error,
3033 set_levels[s],
3034 acct_name,
3035 password,
3036 machine_credentials,
3037 query_levels[q],
3038 &pwdlastset_new,
3039 expected_samlogon_result)) {
3040 ret = false;
3041 }
3042
3043 /* when a password has been changed, pwdlastset must not be 0 afterwards
3044 * and must be larger then the old value */
3045
3046 switch (levels[l]) {
3047 case 21:
3048 case 23:
3049 case 25:
3050
3051 /* SAMR_FIELD_EXPIRED_FLAG has not been set and no
3052 * password has been changed, old and new pwdlastset
3053 * need to be the same value */
3054
3055 if (!(fields_present[f] & SAMR_FIELD_EXPIRED_FLAG) &&
3056 !((fields_present[f] & SAMR_FIELD_NT_PASSWORD_PRESENT) ||
3057 (fields_present[f] & SAMR_FIELD_LM_PASSWORD_PRESENT)))
3058 {
3059 torture_assert_int_equal(tctx, pwdlastset_old,
3060 pwdlastset_new, "pwdlastset must be equal");
3061 break;
3062 }
3063 default:
3064 if (pwdlastset_old >= pwdlastset_new) {
3065 torture_warning(tctx, "pwdLastSet test failed: "
3066 "expected last pwdlastset (%lld) < new pwdlastset (%lld)\n",
3067 pwdlastset_old, pwdlastset_new);
3068 ret = false;
3069 }
3070 if (pwdlastset_new == 0) {
3071 torture_warning(tctx, "pwdLastSet test failed: "
3072 "expected non-0 pwdlastset, got: %lld\n",
3073 pwdlastset_new);
3074 ret = false;
3075 }
3076 }
3077
3078 switch (levels[l]) {
3079 case 21:
3080 case 23:
3081 case 25:
3082 if (((fields_present[f] & SAMR_FIELD_NT_PASSWORD_PRESENT) ||
3083 (fields_present[f] & SAMR_FIELD_LM_PASSWORD_PRESENT)) &&
3084 (pwdlastset_old > 0) && (pwdlastset_new > 0) &&
3085 (pwdlastset_old >= pwdlastset_new)) {
3086 torture_warning(tctx, "pwdlastset not increasing\n");
3087 ret = false;
3088 }
3089 break;
3090 default:
3091 if ((pwdlastset_old > 0) && (pwdlastset_new > 0) &&
3092 (pwdlastset_old >= pwdlastset_new)) {
3093 torture_warning(tctx, "pwdlastset not increasing\n");
3094 ret = false;
3095 }
3096 break;
3097 }
3098
3099 pwdlastset_old = pwdlastset_new;
3100
3101 usleep(delay);
3102
3103 /* set #2b */
3104
3105 /* set a password, pwdlastset needs to get updated (increased
3106 * value), password_expired value used here is 0 */
3107
3108 if (!test_SetPassword_level(p, np, tctx, handle,
3109 levels[l],
3110 fields_present[f],
3111 0,
3112 &matched_expected_error,
3113 set_levels[s],
3114 acct_name,
3115 password,
3116 machine_credentials,
3117 query_levels[q],
3118 &pwdlastset_new,
3119 expected_samlogon_result)) {
3120 ret = false;
3121 }
3122
3123 /* when a password has been changed, pwdlastset must not be 0 afterwards
3124 * and must be larger then the old value */
3125
3126 switch (levels[l]) {
3127 case 21:
3128 case 23:
3129 case 25:
3130
3131 /* if no password has been changed, old and new pwdlastset
3132 * need to be the same value */
3133
3134 if (!((fields_present[f] & SAMR_FIELD_NT_PASSWORD_PRESENT) ||
3135 (fields_present[f] & SAMR_FIELD_LM_PASSWORD_PRESENT)))
3136 {
3137 torture_assert_int_equal(tctx, pwdlastset_old,
3138 pwdlastset_new, "pwdlastset must be equal");
3139 break;
3140 }
3141 default:
3142 if (pwdlastset_old >= pwdlastset_new) {
3143 torture_warning(tctx, "pwdLastSet test failed: "
3144 "expected last pwdlastset (%lld) < new pwdlastset (%lld)\n",
3145 pwdlastset_old, pwdlastset_new);
3146 ret = false;
3147 }
3148 if (pwdlastset_new == 0) {
3149 torture_warning(tctx, "pwdLastSet test failed: "
3150 "expected non-0 pwdlastset, got: %lld\n",
3151 pwdlastset_new);
3152 ret = false;
3153 }
3154 }
3155
3156 /* set #3 */
3157
3158 /* set a password and force password change (pwdlastset 0) by
3159 * setting the password expired flag to a non-0 value */
3160
3161 if (!test_SetPassword_level(p, np, tctx, handle,
3162 levels[l],
3163 fields_present[f],
3164 nonzeros[z],
3165 &matched_expected_error,
3166 set_levels[s],
3167 acct_name,
3168 password,
3169 machine_credentials,
3170 query_levels[q],
3171 &pwdlastset_new,
3172 expected_samlogon_result)) {
3173 ret = false;
3174 }
3175
3176 /* pwdlastset must be 0 afterwards, except for a level 21, 23 and 25
3177 * set without the SAMR_FIELD_EXPIRED_FLAG */
3178
3179 switch (levels[l]) {
3180 case 21:
3181 case 23:
3182 case 25:
3183 if ((pwdlastset_new != 0) &&
3184 !(fields_present[f] & SAMR_FIELD_EXPIRED_FLAG)) {
3185 torture_comment(tctx, "not considering a non-0 "
3186 "pwdLastSet as a an error as the "
3187 "SAMR_FIELD_EXPIRED_FLAG has not "
3188 "been set\n");
3189 break;
3190 }
3191
3192 /* SAMR_FIELD_EXPIRED_FLAG has not been set and no
3193 * password has been changed, old and new pwdlastset
3194 * need to be the same value */
3195
3196 if (!(fields_present[f] & SAMR_FIELD_EXPIRED_FLAG) &&
3197 !((fields_present[f] & SAMR_FIELD_NT_PASSWORD_PRESENT) ||
3198 (fields_present[f] & SAMR_FIELD_LM_PASSWORD_PRESENT)))
3199 {
3200 torture_assert_int_equal(tctx, pwdlastset_old,
3201 pwdlastset_new, "pwdlastset must be equal");
3202 break;
3203 }
3204 default:
3205
3206 if (pwdlastset_old == pwdlastset_new) {
3207 torture_warning(tctx, "pwdLastSet test failed: "
3208 "expected last pwdlastset (%lld) != new pwdlastset (%lld)\n",
3209 pwdlastset_old, pwdlastset_new);
3210 ret = false;
3211 }
3212
3213 if (pwdlastset_new != 0) {
3214 torture_warning(tctx, "pwdLastSet test failed: "
3215 "expected pwdLastSet 0, got %lld\n",
3216 pwdlastset_old);
3217 ret = false;
3218 }
3219 break;
3220 }
3221
3222 switch (levels[l]) {
3223 case 21:
3224 case 23:
3225 case 25:
3226 if (((fields_present[f] & SAMR_FIELD_NT_PASSWORD_PRESENT) ||
3227 (fields_present[f] & SAMR_FIELD_LM_PASSWORD_PRESENT)) &&
3228 (pwdlastset_old > 0) && (pwdlastset_new > 0) &&
3229 (pwdlastset_old >= pwdlastset_new)) {
3230 torture_warning(tctx, "pwdlastset not increasing\n");
3231 ret = false;
3232 }
3233 break;
3234 default:
3235 if ((pwdlastset_old > 0) && (pwdlastset_new > 0) &&
3236 (pwdlastset_old >= pwdlastset_new)) {
3237 torture_warning(tctx, "pwdlastset not increasing\n");
3238 ret = false;
3239 }
3240 break;
3241 }
3242
3243 /* if the level we are testing does not have a fields_present
3244 * field, skip all fields present tests by setting f to to
3245 * arraysize */
3246 switch (levels[l]) {
3247 case 18:
3248 case 24:
3249 case 26:
3250 f = ARRAY_SIZE(fields_present);
3251 break;
3252 }
3253
3254 #ifdef TEST_QUERY_LEVELS
3255 }
3256 #endif
3257 #ifdef TEST_SET_LEVELS
3258 }
3259 #endif
3260 } /* fields present */
3261 } /* nonzeros */
3262 } /* levels */
3263
3264 #undef TEST_SET_LEVELS
3265 #undef TEST_QUERY_LEVELS
3266
3267 return ret;
3268 }
3269
3270 static bool test_user_ops(struct dcerpc_pipe *p,
3271 struct torture_context *tctx,
3272 struct policy_handle *user_handle,
3273 struct policy_handle *domain_handle,
3274 uint32_t base_acct_flags,
3275 const char *base_acct_name, enum torture_samr_choice which_ops,
3276 struct cli_credentials *machine_credentials)
3277 {
3278 char *password = NULL;
3279 struct samr_QueryUserInfo q;
3280 union samr_UserInfo *info;
3281 NTSTATUS status;
3282
3283 bool ret = true;
3284 int i;
3285 uint32_t rid;
3286 const uint32_t password_fields[] = {
3287 SAMR_FIELD_NT_PASSWORD_PRESENT,
3288 SAMR_FIELD_LM_PASSWORD_PRESENT,
3289 SAMR_FIELD_NT_PASSWORD_PRESENT | SAMR_FIELD_LM_PASSWORD_PRESENT,
3290 0
3291 };
3292
3293 status = test_LookupName(p, tctx, domain_handle, base_acct_name, &rid);
3294 if (!NT_STATUS_IS_OK(status)) {
3295 ret = false;
3296 }
3297
3298 switch (which_ops) {
3299 case TORTURE_SAMR_USER_ATTRIBUTES:
3300 if (!test_QuerySecurity(p, tctx, user_handle)) {
3301 ret = false;
3302 }
3303
3304 if (!test_QueryUserInfo(p, tctx, user_handle)) {
3305 ret = false;
3306 }
3307
3308 if (!test_QueryUserInfo2(p, tctx, user_handle)) {
3309 ret = false;
3310 }
3311
3312 if (!test_SetUserInfo(p, tctx, user_handle, base_acct_flags,
3313 base_acct_name)) {
3314 ret = false;
3315 }
3316
3317 if (!test_GetUserPwInfo(p, tctx, user_handle)) {
3318 ret = false;
3319 }
3320
3321 if (!test_TestPrivateFunctionsUser(p, tctx, user_handle)) {
3322 ret = false;
3323 }
3324
3325 if (!test_SetUserPass(p, tctx, user_handle, &password)) {
3326 ret = false;
3327 }
3328 break;
3329 case TORTURE_SAMR_PASSWORDS:
3330 if (base_acct_flags & (ACB_WSTRUST|ACB_DOMTRUST|ACB_SVRTRUST)) {
3331 char simple_pass[9];
3332 char *v = generate_random_str(tctx, 1);
3333
3334 ZERO_STRUCT(simple_pass);
3335 memset(simple_pass, *v, sizeof(simple_pass) - 1);
3336
3337 printf("Testing machine account password policy rules\n");
3338
3339 /* Workstation trust accounts don't seem to need to honour password quality policy */
3340 if (!test_SetUserPassEx(p, tctx, user_handle, true, &password)) {
3341 ret = false;
3342 }
3343
3344 if (!test_ChangePasswordUser2(p, tctx, base_acct_name, &password, simple_pass, false)) {
3345 ret = false;
3346 }
3347
3348 /* reset again, to allow another 'user' password change */
3349 if (!test_SetUserPassEx(p, tctx, user_handle, true, &password)) {
3350 ret = false;
3351 }
3352
3353 /* Try a 'short' password */
3354 if (!test_ChangePasswordUser2(p, tctx, base_acct_name, &password, samr_rand_pass(tctx, 4), false)) {
3355 ret = false;
3356 }
3357
3358 /* Try a compleatly random password */
3359 if (!test_ChangePasswordRandomBytes(p, tctx, base_acct_name, user_handle, &password)) {
3360 ret = false;
3361 }
3362 }
3363
3364 for (i = 0; password_fields[i]; i++) {
3365 if (!test_SetUserPass_23(p, tctx, user_handle, password_fields[i], &password)) {
3366 ret = false;
3367 }
3368
3369 /* check it was set right */
3370 if (!test_ChangePasswordUser3(p, tctx, base_acct_name, 0, &password, NULL, 0, false)) {
3371 ret = false;
3372 }
3373 }
3374
3375 for (i = 0; password_fields[i]; i++) {
3376 if (!test_SetUserPass_25(p, tctx, user_handle, password_fields[i], &password)) {
3377 ret = false;
3378 }
3379
3380 /* check it was set right */
3381 if (!test_ChangePasswordUser3(p, tctx, base_acct_name, 0, &password, NULL, 0, false)) {
3382 ret = false;
3383 }
3384 }
3385
3386 if (!test_SetUserPassEx(p, tctx, user_handle, false, &password)) {
3387 ret = false;
3388 }
3389
3390 if (!test_ChangePassword(p, tctx, base_acct_name, domain_handle, &password)) {
3391 ret = false;
3392 }
3393
3394 if (torture_setting_bool(tctx, "samba4", false)) {
3395 printf("skipping Set Password level 18 and 21 against Samba4\n");
3396 } else {
3397
3398 if (!test_SetUserPass_18(p, tctx, user_handle, &password)) {
3399 ret = false;
3400 }
3401
3402 if (!test_ChangePasswordUser3(p, tctx, base_acct_name, 0, &password, NULL, 0, false)) {
3403 ret = false;
3404 }
3405
3406 for (i = 0; password_fields[i]; i++) {
3407
3408 if (password_fields[i] == SAMR_FIELD_LM_PASSWORD_PRESENT) {
3409 /* we need to skip as that would break
3410 * the ChangePasswordUser3 verify */
3411 continue;
3412 }
3413
3414 if (!test_SetUserPass_21(p, tctx, user_handle, password_fields[i], &password)) {
3415 ret = false;
3416 }
3417
3418 /* check it was set right */
3419 if (!test_ChangePasswordUser3(p, tctx, base_acct_name, 0, &password, NULL, 0, false)) {
3420 ret = false;
3421 }
3422 }
3423 }
3424
3425 q.in.user_handle = user_handle;
3426 q.in.level = 5;
3427 q.out.info = &info;
3428
3429 status = dcerpc_samr_QueryUserInfo(p, tctx, &q);
3430 if (!NT_STATUS_IS_OK(status)) {
3431 printf("QueryUserInfo level %u failed - %s\n",
3432 q.in.level, nt_errstr(status));
3433 ret = false;
3434 } else {
3435 uint32_t expected_flags = (base_acct_flags | ACB_PWNOTREQ | ACB_DISABLED);
3436 if ((info->info5.acct_flags) != expected_flags) {
3437 printf("QuerUserInfo level 5 failed, it returned 0x%08x when we expected flags of 0x%08x\n",
3438 info->info5.acct_flags,
3439 expected_flags);
3440 /* FIXME: GD */
3441 if (!torture_setting_bool(tctx, "samba3", false)) {
3442 ret = false;
3443 }
3444 }
3445 if (info->info5.rid != rid) {
3446 printf("QuerUserInfo level 5 failed, it returned %u when we expected rid of %u\n",
3447 info->info5.rid, rid);
3448
3449 }
3450 }
3451
3452 break;
3453
3454 case TORTURE_SAMR_PASSWORDS_PWDLASTSET:
3455
3456 /* test last password change timestamp behaviour */
3457 if (!test_SetPassword_pwdlastset(p, tctx, base_acct_flags,
3458 base_acct_name,
3459 user_handle, &password,
3460 machine_credentials)) {
3461 ret = false;
3462 }
3463
3464 if (ret == true) {
3465 torture_comment(tctx, "pwdLastSet test succeeded\n");
3466 } else {
3467 torture_warning(tctx, "pwdLastSet test failed\n");
3468 }
3469
3470 break;
3471
3472 case TORTURE_SAMR_OTHER:
3473 /* We just need the account to exist */
3474 break;
3475 }
3476 return ret;
3477 }
3478
3479 static bool test_alias_ops(struct dcerpc_pipe *p, struct torture_context *tctx,
3480 struct policy_handle *alias_handle,
3481 const struct dom_sid *domain_sid)
3482 {
3483 bool ret = true;
3484
3485 if (!test_QuerySecurity(p, tctx, alias_handle)) {
3486 ret = false;
3487 }
3488
3489 if (!test_QueryAliasInfo(p, tctx, alias_handle)) {
3490 ret = false;
3491 }
3492
3493 if (!test_SetAliasInfo(p, tctx, alias_handle)) {
3494 ret = false;
3495 }
3496
3497 if (!test_AddMemberToAlias(p, tctx, alias_handle, domain_sid)) {
3498 ret = false;
3499 }
3500
3501 if (torture_setting_bool(tctx, "samba4", false)) {
3502 printf("skipping MultipleMembers Alias tests against Samba4\n");
3503 return ret;
3504 }
3505
3506 if (!test_AddMultipleMembersToAlias(p, tctx, alias_handle)) {
3507 ret = false;
3508 }
3509
3510 return ret;
3511 }
3512
3513
3514 static bool test_DeleteUser(struct dcerpc_pipe *p, struct torture_context *tctx,
3515 struct policy_handle *user_handle)
3516 {
3517 struct samr_DeleteUser d;
3518 NTSTATUS status;
3519 torture_comment(tctx, "Testing DeleteUser\n");
3520
3521 d.in.user_handle = user_handle;
3522 d.out.user_handle = user_handle;
3523
3524 status = dcerpc_samr_DeleteUser(p, tctx, &d);
3525 torture_assert_ntstatus_ok(tctx, status, "DeleteUser");
3526
3527 return true;
3528 }
3529
3530 bool test_DeleteUser_byname(struct dcerpc_pipe *p,
3531 struct torture_context *tctx,
3532 struct policy_handle *handle, const char *name)
3533 {
3534 NTSTATUS status;
3535 struct samr_DeleteUser d;
3536 struct policy_handle user_handle;
3537 uint32_t rid;
3538
3539 status = test_LookupName(p, tctx, handle, name, &rid);
3540 if (!NT_STATUS_IS_OK(status)) {
3541 goto failed;
3542 }
3543
3544 status = test_OpenUser_byname(p, tctx, handle, name, &user_handle);
3545 if (!NT_STATUS_IS_OK(status)) {
3546 goto failed;
3547 }
3548
3549 d.in.user_handle = &user_handle;
3550 d.out.user_handle = &user_handle;
3551 status = dcerpc_samr_DeleteUser(p, tctx, &d);
3552 if (!NT_STATUS_IS_OK(status)) {
3553 goto failed;
3554 }
3555
3556 return true;
3557
3558 failed:
3559 printf("DeleteUser_byname(%s) failed - %s\n", name, nt_errstr(status));
3560 return false;
3561 }
3562
3563
3564 static bool test_DeleteGroup_byname(struct dcerpc_pipe *p,
3565 struct torture_context *tctx,
3566 struct policy_handle *handle, const char *name)
3567 {
3568 NTSTATUS status;
3569 struct samr_OpenGroup r;
3570 struct samr_DeleteDomainGroup d;
3571 struct policy_handle group_handle;
3572 uint32_t rid;
3573
3574 status = test_LookupName(p, tctx, handle, name, &rid);
3575 if (!NT_STATUS_IS_OK(status)) {
3576 goto failed;
3577 }
3578
3579 r.in.domain_handle = handle;
3580 r.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
3581 r.in.rid = rid;
3582 r.out.group_handle = &group_handle;
3583 status = dcerpc_samr_OpenGroup(p, tctx, &r);
3584 if (!NT_STATUS_IS_OK(status)) {
3585 goto failed;
3586 }
3587
3588 d.in.group_handle = &group_handle;
3589 d.out.group_handle = &group_handle;
3590 status = dcerpc_samr_DeleteDomainGroup(p, tctx, &d);
3591 if (!NT_STATUS_IS_OK(status)) {
3592 goto failed;
3593 }
3594
3595 return true;
3596
3597 failed:
3598 printf("DeleteGroup_byname(%s) failed - %s\n", name, nt_errstr(status));
3599 return false;
3600 }
3601
3602
3603 static bool test_DeleteAlias_byname(struct dcerpc_pipe *p,
3604 struct torture_context *tctx,
3605 struct policy_handle *domain_handle,
3606 const char *name)
3607 {
3608 NTSTATUS status;
3609 struct samr_OpenAlias r;
3610 struct samr_DeleteDomAlias d;
3611 struct policy_handle alias_handle;
3612 uint32_t rid;
3613
3614 printf("testing DeleteAlias_byname\n");
3615
3616 status = test_LookupName(p, tctx, domain_handle, name, &rid);
3617 if (!NT_STATUS_IS_OK(status)) {
3618 goto failed;
3619 }
3620
3621 r.in.domain_handle = domain_handle;
3622 r.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
3623 r.in.rid = rid;
3624 r.out.alias_handle = &alias_handle;
3625 status = dcerpc_samr_OpenAlias(p, tctx, &r);
3626 if (!NT_STATUS_IS_OK(status)) {
3627 goto failed;
3628 }
3629
3630 d.in.alias_handle = &alias_handle;
3631 d.out.alias_handle = &alias_handle;
3632 status = dcerpc_samr_DeleteDomAlias(p, tctx, &d);
3633 if (!NT_STATUS_IS_OK(status)) {
3634 goto failed;
3635 }
3636
3637 return true;
3638
3639 failed:
3640 printf("DeleteAlias_byname(%s) failed - %s\n", name, nt_errstr(status));
3641 return false;
3642 }
3643
3644 static bool test_DeleteAlias(struct dcerpc_pipe *p,
3645 struct torture_context *tctx,
3646 struct policy_handle *alias_handle)
3647 {
3648 struct samr_DeleteDomAlias d;
3649 NTSTATUS status;
3650 bool ret = true;
3651 printf("Testing DeleteAlias\n");
3652
3653 d.in.alias_handle = alias_handle;
3654 d.out.alias_handle = alias_handle;
3655
3656 status = dcerpc_samr_DeleteDomAlias(p, tctx, &d);
3657 if (!NT_STATUS_IS_OK(status)) {
3658 printf("DeleteAlias failed - %s\n", nt_errstr(status));
3659 ret = false;
3660 }
3661
3662 return ret;
3663 }
3664
3665 static bool test_CreateAlias(struct dcerpc_pipe *p, struct torture_context *tctx,
3666 struct policy_handle *domain_handle,
3667 struct policy_handle *alias_handle,
3668 const struct dom_sid *domain_sid)
3669 {
3670 NTSTATUS status;
3671 struct samr_CreateDomAlias r;
3672 struct lsa_String name;
3673 uint32_t rid;
3674 bool ret = true;
3675
3676 init_lsa_String(&name, TEST_ALIASNAME);
3677 r.in.domain_handle = domain_handle;
3678 r.in.alias_name = &name;
3679 r.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
3680 r.out.alias_handle = alias_handle;
3681 r.out.rid = &rid;
3682
3683 printf("Testing CreateAlias (%s)\n", r.in.alias_name->string);
3684
3685 status = dcerpc_samr_CreateDomAlias(p, tctx, &r);
3686
3687 if (dom_sid_equal(domain_sid, dom_sid_parse_talloc(tctx, SID_BUILTIN))) {
3688 if (NT_STATUS_EQUAL(status, NT_STATUS_ACCESS_DENIED)) {
3689 printf("Server correctly refused create of '%s'\n", r.in.alias_name->string);
3690 return true;
3691 } else {
3692 printf("Server should have refused create of '%s', got %s instead\n", r.in.alias_name->string,
3693 nt_errstr(status));
3694 return false;
3695 }
3696 }
3697
3698 if (NT_STATUS_EQUAL(status, NT_STATUS_ALIAS_EXISTS)) {
3699 if (!test_DeleteAlias_byname(p, tctx, domain_handle, r.in.alias_name->string)) {
3700 return false;
3701 }
3702 status = dcerpc_samr_CreateDomAlias(p, tctx, &r);
3703 }
3704
3705 if (!NT_STATUS_IS_OK(status)) {
3706 printf("CreateAlias failed - %s\n", nt_errstr(status));
3707 return false;
3708 }
3709
3710 if (!test_alias_ops(p, tctx, alias_handle, domain_sid)) {
3711 ret = false;
3712 }
3713
3714 return ret;
3715 }
3716
3717 static bool test_ChangePassword(struct dcerpc_pipe *p,
3718 struct torture_context *tctx,
3719 const char *acct_name,
3720 struct policy_handle *domain_handle, char **password)
3721 {
3722 bool ret = true;
3723
3724 if (!*password) {
3725 return false;
3726 }
3727
3728 if (!test_ChangePasswordUser(p, tctx, acct_name, domain_handle, password)) {
3729 ret = false;
3730 }
3731
3732 if (!test_ChangePasswordUser2(p, tctx, acct_name, password, 0, true)) {
3733 ret = false;
3734 }
3735
3736 if (!test_OemChangePasswordUser2(p, tctx, acct_name, domain_handle, password)) {
3737 ret = false;
3738 }
3739
3740 /* test what happens when setting the old password again */
3741 if (!test_ChangePasswordUser3(p, tctx, acct_name, 0, password, *password, 0, true)) {
3742 ret = false;
3743 }
3744
3745 {
3746 char simple_pass[9];
3747 char *v = generate_random_str(tctx, 1);
3748
3749 ZERO_STRUCT(simple_pass);
3750 memset(simple_pass, *v, sizeof(simple_pass) - 1);
3751
3752 /* test what happens when picking a simple password */
3753 if (!test_ChangePasswordUser3(p, tctx, acct_name, 0, password, simple_pass, 0, true)) {
3754 ret = false;
3755 }
3756 }
3757
3758 /* set samr_SetDomainInfo level 1 with min_length 5 */
3759 {
3760 struct samr_QueryDomainInfo r;
3761 union samr_DomainInfo *info = NULL;
3762 struct samr_SetDomainInfo s;
3763 uint16_t len_old, len;
3764 uint32_t pwd_prop_old;
3765 int64_t min_pwd_age_old;
3766 NTSTATUS status;
3767
3768 len = 5;
3769
3770 r.in.domain_handle = domain_handle;
3771 r.in.level = 1;
3772 r.out.info = &info;
3773
3774 printf("testing samr_QueryDomainInfo level 1\n");
3775 status = dcerpc_samr_QueryDomainInfo(p, tctx, &r);
3776 if (!NT_STATUS_IS_OK(status)) {
3777 return false;
3778 }
3779
3780 s.in.domain_handle = domain_handle;
3781 s.in.level = 1;
3782 s.in.info = info;
3783
3784 /* remember the old min length, so we can reset it */
3785 len_old = s.in.info->info1.min_password_length;
3786 s.in.info->info1.min_password_length = len;
3787 pwd_prop_old = s.in.info->info1.password_properties;
3788 /* turn off password complexity checks for this test */
3789 s.in.info->info1.password_properties &= ~DOMAIN_PASSWORD_COMPLEX;
3790
3791 min_pwd_age_old = s.in.info->info1.min_password_age;
3792 s.in.info->info1.min_password_age = 0;
3793
3794 printf("testing samr_SetDomainInfo level 1\n");
3795 status = dcerpc_samr_SetDomainInfo(p, tctx, &s);
3796 if (!NT_STATUS_IS_OK(status)) {
3797 return false;
3798 }
3799
3800 printf("calling test_ChangePasswordUser3 with too short password\n");
3801
3802 if (!test_ChangePasswordUser3(p, tctx, acct_name, len - 1, password, NULL, 0, true)) {
3803 ret = false;
3804 }
3805
3806 s.in.info->info1.min_password_length = len_old;
3807 s.in.info->info1.password_properties = pwd_prop_old;
3808 s.in.info->info1.min_password_age = min_pwd_age_old;
3809
3810 printf("testing samr_SetDomainInfo level 1\n");
3811 status = dcerpc_samr_SetDomainInfo(p, tctx, &s);
3812 if (!NT_STATUS_IS_OK(status)) {
3813 return false;
3814 }
3815
3816 }
3817
3818 {
3819 NTSTATUS status;
3820 struct samr_OpenUser r;
3821 struct samr_QueryUserInfo q;
3822 union samr_UserInfo *info;
3823 struct samr_LookupNames n;
3824 struct policy_handle user_handle;
3825 struct samr_Ids rids, types;
3826
3827 n.in.domain_handle = domain_handle;
3828 n.in.num_names = 1;
3829 n.in.names = talloc_array(tctx, struct lsa_String, 1);
3830 n.in.names[0].string = acct_name;
3831 n.out.rids = &rids;
3832 n.out.types = &types;
3833
3834 status = dcerpc_samr_LookupNames(p, tctx, &n);
3835 if (!NT_STATUS_IS_OK(status)) {
3836 printf("LookupNames failed - %s\n", nt_errstr(status));
3837 return false;
3838 }
3839
3840 r.in.domain_handle = domain_handle;
3841 r.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
3842 r.in.rid = n.out.rids->ids[0];
3843 r.out.user_handle = &user_handle;
3844
3845 status = dcerpc_samr_OpenUser(p, tctx, &r);
3846 if (!NT_STATUS_IS_OK(status)) {
3847 printf("OpenUser(%u) failed - %s\n", n.out.rids->ids[0], nt_errstr(status));
3848 return false;
3849 }
3850
3851 q.in.user_handle = &user_handle;
3852 q.in.level = 5;
3853 q.out.info = &info;
3854
3855 status = dcerpc_samr_QueryUserInfo(p, tctx, &q);
3856 if (!NT_STATUS_IS_OK(status)) {
3857 printf("QueryUserInfo failed - %s\n", nt_errstr(status));
3858 return false;
3859 }
3860
3861 printf("calling test_ChangePasswordUser3 with too early password change\n");
3862
3863 if (!test_ChangePasswordUser3(p, tctx, acct_name, 0, password, NULL,
3864 info->info5.last_password_change, true)) {
3865 ret = false;
3866 }
3867 }
3868
3869 /* we change passwords twice - this has the effect of verifying
3870 they were changed correctly for the final call */
3871 if (!test_ChangePasswordUser3(p, tctx, acct_name, 0, password, NULL, 0, true)) {
3872 ret = false;
3873 }
3874
3875 if (!test_ChangePasswordUser3(p, tctx, acct_name, 0, password, NULL, 0, true)) {
3876 ret = false;
3877 }
3878
3879 return ret;
3880 }
3881
3882 static bool test_CreateUser(struct dcerpc_pipe *p, struct torture_context *tctx,
3883 struct policy_handle *domain_handle,
3884 struct policy_handle *user_handle_out,
3885 struct dom_sid *domain_sid,
3886 enum torture_samr_choice which_ops,
3887 struct cli_credentials *machine_credentials)
3888 {
3889
3890 TALLOC_CTX *user_ctx;
3891
3892 NTSTATUS status;
3893 struct samr_CreateUser r;
3894 struct samr_QueryUserInfo q;
3895 union samr_UserInfo *info;
3896 struct samr_DeleteUser d;
3897 uint32_t rid;
3898
3899 /* This call creates a 'normal' account - check that it really does */
3900 const uint32_t acct_flags = ACB_NORMAL;
3901 struct lsa_String name;
3902 bool ret = true;
3903
3904 struct policy_handle user_handle;
3905 user_ctx = talloc_named(tctx, 0, "test_CreateUser2 per-user context");
3906 init_lsa_String(&name, TEST_ACCOUNT_NAME);
3907
3908 r.in.domain_handle = domain_handle;
3909 r.in.account_name = &name;
3910 r.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
3911 r.out.user_handle = &user_handle;
3912 r.out.rid = &rid;
3913
3914 printf("Testing CreateUser(%s)\n", r.in.account_name->string);
3915
3916 status = dcerpc_samr_CreateUser(p, user_ctx, &r);
3917
3918 if (dom_sid_equal(domain_sid, dom_sid_parse_talloc(tctx, SID_BUILTIN))) {
3919 if (NT_STATUS_EQUAL(status, NT_STATUS_ACCESS_DENIED) || NT_STATUS_EQUAL(status, NT_STATUS_INVALID_PARAMETER)) {
3920 printf("Server correctly refused create of '%s'\n", r.in.account_name->string);
3921 return true;
3922 } else {
3923 printf("Server should have refused create of '%s', got %s instead\n", r.in.account_name->string,
3924 nt_errstr(status));
3925 return false;
3926 }
3927 }
3928
3929 if (NT_STATUS_EQUAL(status, NT_STATUS_USER_EXISTS)) {
3930 if (!test_DeleteUser_byname(p, user_ctx, domain_handle, r.in.account_name->string)) {
3931 talloc_free(user_ctx);
3932 return false;
3933 }
3934 status = dcerpc_samr_CreateUser(p, user_ctx, &r);
3935 }
3936 if (!NT_STATUS_IS_OK(status)) {
3937 talloc_free(user_ctx);
3938 printf("CreateUser failed - %s\n", nt_errstr(status));
3939 return false;
3940 } else {
3941 q.in.user_handle = &user_handle;
3942 q.in.level = 16;
3943 q.out.info = &info;
3944
3945 status = dcerpc_samr_QueryUserInfo(p, user_ctx, &q);
3946 if (!NT_STATUS_IS_OK(status)) {
3947 printf("QueryUserInfo level %u failed - %s\n",
3948 q.in.level, nt_errstr(status));
3949 ret = false;
3950 } else {
3951 if ((info->info16.acct_flags & acct_flags) != acct_flags) {
3952 printf("QuerUserInfo level 16 failed, it returned 0x%08x when we expected flags of 0x%08x\n",
3953 info->info16.acct_flags,
3954 acct_flags);
3955 ret = false;
3956 }
3957 }
3958
3959 if (!test_user_ops(p, tctx, &user_handle, domain_handle,
3960 acct_flags, name.string, which_ops,
3961 machine_credentials)) {
3962 ret = false;
3963 }
3964
3965 if (user_handle_out) {
3966 *user_handle_out = user_handle;
3967 } else {
3968 printf("Testing DeleteUser (createuser test)\n");
3969
3970 d.in.user_handle = &user_handle;
3971 d.out.user_handle = &user_handle;
3972
3973 status = dcerpc_samr_DeleteUser(p, user_ctx, &d);
3974 if (!NT_STATUS_IS_OK(status)) {
3975 printf("DeleteUser failed - %s\n", nt_errstr(status));
3976 ret = false;
3977 }
3978 }
3979
3980 }
3981
3982 talloc_free(user_ctx);
3983
3984 return ret;
3985 }
3986
3987
3988 static bool test_CreateUser2(struct dcerpc_pipe *p, struct torture_context *tctx,
3989 struct policy_handle *domain_handle,
3990 struct dom_sid *domain_sid,
3991 enum torture_samr_choice which_ops,
3992 struct cli_credentials *machine_credentials)
3993 {
3994 NTSTATUS status;
3995 struct samr_CreateUser2 r;
3996 struct samr_QueryUserInfo q;
3997 union samr_UserInfo *info;
3998 struct samr_DeleteUser d;
3999 struct policy_handle user_handle;
4000 uint32_t rid;
4001 struct lsa_String name;
4002 bool ret = true;
4003 int i;
4004
4005 struct {
4006 uint32_t acct_flags;
4007 const char *account_name;
4008 NTSTATUS nt_status;
4009 } account_types[] = {
4010 { ACB_NORMAL, TEST_ACCOUNT_NAME, NT_STATUS_OK },
4011 { ACB_NORMAL | ACB_DISABLED, TEST_ACCOUNT_NAME, NT_STATUS_INVALID_PARAMETER },
4012 { ACB_NORMAL | ACB_PWNOEXP, TEST_ACCOUNT_NAME, NT_STATUS_INVALID_PARAMETER },
4013 { ACB_WSTRUST, TEST_MACHINENAME, NT_STATUS_OK },
4014 { ACB_WSTRUST | ACB_DISABLED, TEST_MACHINENAME, NT_STATUS_INVALID_PARAMETER },
4015 { ACB_WSTRUST | ACB_PWNOEXP, TEST_MACHINENAME, NT_STATUS_INVALID_PARAMETER },
4016 { ACB_SVRTRUST, TEST_MACHINENAME, NT_STATUS_OK },
4017 { ACB_SVRTRUST | ACB_DISABLED, TEST_MACHINENAME, NT_STATUS_INVALID_PARAMETER },
4018 { ACB_SVRTRUST | ACB_PWNOEXP, TEST_MACHINENAME, NT_STATUS_INVALID_PARAMETER },
4019 { ACB_DOMTRUST, TEST_DOMAINNAME, NT_STATUS_OK },
4020 { ACB_DOMTRUST | ACB_DISABLED, TEST_DOMAINNAME, NT_STATUS_INVALID_PARAMETER },
4021 { ACB_DOMTRUST | ACB_PWNOEXP, TEST_DOMAINNAME, NT_STATUS_INVALID_PARAMETER },
4022 { 0, TEST_ACCOUNT_NAME, NT_STATUS_INVALID_PARAMETER },
4023 { ACB_DISABLED, TEST_ACCOUNT_NAME, NT_STATUS_INVALID_PARAMETER },
4024 { 0, NULL, NT_STATUS_INVALID_PARAMETER }
4025 };
4026
4027 for (i = 0; account_types[i].account_name; i++) {
4028 TALLOC_CTX *user_ctx;
4029 uint32_t acct_flags = account_types[i].acct_flags;
4030 uint32_t access_granted;
4031 user_ctx = talloc_named(tctx, 0, "test_CreateUser2 per-user context");
4032 init_lsa_String(&name, account_types[i].account_name);
4033
4034 r.in.domain_handle = domain_handle;
4035 r.in.account_name = &name;
4036 r.in.acct_flags = acct_flags;
4037 r.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
4038 r.out.user_handle = &user_handle;
4039 r.out.access_granted = &access_granted;
4040 r.out.rid = &rid;
4041
4042 printf("Testing CreateUser2(%s, 0x%x)\n", r.in.account_name->string, acct_flags);
4043
4044 status = dcerpc_samr_CreateUser2(p, user_ctx, &r);
4045
4046 if (dom_sid_equal(domain_sid, dom_sid_parse_talloc(tctx, SID_BUILTIN))) {
4047 if (NT_STATUS_EQUAL(status, NT_STATUS_ACCESS_DENIED) || NT_STATUS_EQUAL(status, NT_STATUS_INVALID_PARAMETER)) {
4048 printf("Server correctly refused create of '%s'\n", r.in.account_name->string);
4049 continue;
4050 } else {
4051 printf("Server should have refused create of '%s', got %s instead\n", r.in.account_name->string,
4052 nt_errstr(status));
4053 ret = false;
4054 continue;
4055 }
4056 }
4057
4058 if (NT_STATUS_EQUAL(status, NT_STATUS_USER_EXISTS)) {
4059 if (!test_DeleteUser_byname(p, user_ctx, domain_handle, r.in.account_name->string)) {
4060 talloc_free(user_ctx);
4061 ret = false;
4062 continue;
4063 }
4064 status = dcerpc_samr_CreateUser2(p, user_ctx, &r);
4065
4066 }
4067 if (!NT_STATUS_EQUAL(status, account_types[i].nt_status)) {
4068 printf("CreateUser2 failed gave incorrect error return - %s (should be %s)\n",
4069 nt_errstr(status), nt_errstr(account_types[i].nt_status));
4070 ret = false;
4071 }
4072
4073 if (NT_STATUS_IS_OK(status)) {
4074 q.in.user_handle = &user_handle;
4075 q.in.level = 5;
4076 q.out.info = &info;
4077
4078 status = dcerpc_samr_QueryUserInfo(p, user_ctx, &q);
4079 if (!NT_STATUS_IS_OK(status)) {
4080 printf("QueryUserInfo level %u failed - %s\n",
4081 q.in.level, nt_errstr(status));
4082 ret = false;
4083 } else {
4084 uint32_t expected_flags = (acct_flags | ACB_PWNOTREQ | ACB_DISABLED);
4085 if (acct_flags == ACB_NORMAL) {
4086 expected_flags |= ACB_PW_EXPIRED;
4087 }
4088 if ((info->info5.acct_flags) != expected_flags) {
4089 printf("QuerUserInfo level 5 failed, it returned 0x%08x when we expected flags of 0x%08x\n",
4090 info->info5.acct_flags,
4091 expected_flags);
4092 ret = false;
4093 }
4094 switch (acct_flags) {
4095 case ACB_SVRTRUST:
4096 if (info->info5.primary_gid != DOMAIN_RID_DCS) {
4097 printf("QuerUserInfo level 5: DC should have had Primary Group %d, got %d\n",
4098 DOMAIN_RID_DCS, info->info5.primary_gid);
4099 ret = false;
4100 }
4101 break;
4102 case ACB_WSTRUST:
4103 if (info->info5.primary_gid != DOMAIN_RID_DOMAIN_MEMBERS) {
4104 printf("QuerUserInfo level 5: Domain Member should have had Primary Group %d, got %d\n",
4105 DOMAIN_RID_DOMAIN_MEMBERS, info->info5.primary_gid);
4106 ret = false;
4107 }
4108 break;
4109 case ACB_NORMAL:
4110 if (info->info5.primary_gid != DOMAIN_RID_USERS) {
4111 printf("QuerUserInfo level 5: Users should have had Primary Group %d, got %d\n",
4112 DOMAIN_RID_USERS, info->info5.primary_gid);
4113 ret = false;
4114 }
4115 break;
4116 }
4117 }
4118
4119 if (!test_user_ops(p, tctx, &user_handle, domain_handle,
4120 acct_flags, name.string, which_ops,
4121 machine_credentials)) {
4122 ret = false;
4123 }
4124
4125 printf("Testing DeleteUser (createuser2 test)\n");
4126
4127 d.in.user_handle = &user_handle;
4128 d.out.user_handle = &user_handle;
4129
4130 status = dcerpc_samr_DeleteUser(p, user_ctx, &d);
4131 if (!NT_STATUS_IS_OK(status)) {
4132 printf("DeleteUser failed - %s\n", nt_errstr(status));
4133 ret = false;
4134 }
4135 }
4136 talloc_free(user_ctx);
4137 }
4138
4139 return ret;
4140 }
4141
4142 static bool test_QueryAliasInfo(struct dcerpc_pipe *p,
4143 struct torture_context *tctx,
4144 struct policy_handle *handle)
4145 {
4146 NTSTATUS status;
4147 struct samr_QueryAliasInfo r;
4148 union samr_AliasInfo *info;
4149 uint16_t levels[] = {1, 2, 3};
4150 int i;
4151 bool ret = true;
4152
4153 for (i=0;i<ARRAY_SIZE(levels);i++) {
4154 printf("Testing QueryAliasInfo level %u\n", levels[i]);
4155
4156 r.in.alias_handle = handle;
4157 r.in.level = levels[i];
4158 r.out.info = &info;
4159
4160 status = dcerpc_samr_QueryAliasInfo(p, tctx, &r);
4161 if (!NT_STATUS_IS_OK(status)) {
4162 printf("QueryAliasInfo level %u failed - %s\n",
4163 levels[i], nt_errstr(status));
4164 ret = false;
4165 }
4166 }
4167
4168 return ret;
4169 }
4170
4171 static bool test_QueryGroupInfo(struct dcerpc_pipe *p,
4172 struct torture_context *tctx,
4173 struct policy_handle *handle)
4174 {
4175 NTSTATUS status;
4176 struct samr_QueryGroupInfo r;
4177 union samr_GroupInfo *info;
4178 uint16_t levels[] = {1, 2, 3, 4, 5};
4179 int i;
4180 bool ret = true;
4181
4182 for (i=0;i<ARRAY_SIZE(levels);i++) {
4183 printf("Testing QueryGroupInfo level %u\n", levels[i]);
4184
4185 r.in.group_handle = handle;
4186 r.in.level = levels[i];
4187 r.out.info = &info;
4188
4189 status = dcerpc_samr_QueryGroupInfo(p, tctx, &r);
4190 if (!NT_STATUS_IS_OK(status)) {
4191 printf("QueryGroupInfo level %u failed - %s\n",
4192 levels[i], nt_errstr(status));
4193 ret = false;
4194 }
4195 }
4196
4197 return ret;
4198 }
4199
4200 static bool test_QueryGroupMember(struct dcerpc_pipe *p,
4201 struct torture_context *tctx,
4202 struct policy_handle *handle)
4203 {
4204 NTSTATUS status;
4205 struct samr_QueryGroupMember r;
4206 struct samr_RidTypeArray *rids = NULL;
4207 bool ret = true;
4208
4209 printf("Testing QueryGroupMember\n");
4210
4211 r.in.group_handle = handle;
4212 r.out.rids = &rids;
4213
4214 status = dcerpc_samr_QueryGroupMember(p, tctx, &r);
4215 if (!NT_STATUS_IS_OK(status)) {
4216 printf("QueryGroupInfo failed - %s\n", nt_errstr(status));
4217 ret = false;
4218 }
4219
4220 return ret;
4221 }
4222
4223
4224 static bool test_SetGroupInfo(struct dcerpc_pipe *p,
4225 struct torture_context *tctx,
4226 struct policy_handle *handle)
4227 {
4228 NTSTATUS status;
4229 struct samr_QueryGroupInfo r;
4230 union samr_GroupInfo *info;
4231 struct samr_SetGroupInfo s;
4232 uint16_t levels[] = {1, 2, 3, 4};
4233 uint16_t set_ok[] = {0, 1, 1, 1};
4234 int i;
4235 bool ret = true;
4236
4237 for (i=0;i<ARRAY_SIZE(levels);i++) {
4238 printf("Testing QueryGroupInfo level %u\n", levels[i]);
4239
4240 r.in.group_handle = handle;
4241 r.in.level = levels[i];
4242 r.out.info = &info;
4243
4244 status = dcerpc_samr_QueryGroupInfo(p, tctx, &r);
4245 if (!NT_STATUS_IS_OK(status)) {
4246 printf("QueryGroupInfo level %u failed - %s\n",
4247 levels[i], nt_errstr(status));
4248 ret = false;
4249 }
4250
4251 printf("Testing SetGroupInfo level %u\n", levels[i]);
4252
4253 s.in.group_handle = handle;
4254 s.in.level = levels[i];
4255 s.in.info = *r.out.info;
4256
4257 #if 0
4258 /* disabled this, as it changes the name only from the point of view of samr,
4259 but leaves the name from the point of view of w2k3 internals (and ldap). This means
4260 the name is still reserved, so creating the old name fails, but deleting by the old name
4261 also fails */
4262 if (s.in.level == 2) {
4263 init_lsa_String(&s.in.info->string, "NewName");
4264 }
4265 #endif
4266
4267 if (s.in.level == 4) {
4268 init_lsa_String(&s.in.info->description, "test description");
4269 }
4270
4271 status = dcerpc_samr_SetGroupInfo(p, tctx, &s);
4272 if (set_ok[i]) {
4273 if (!NT_STATUS_IS_OK(status)) {
4274 printf("SetGroupInfo level %u failed - %s\n",
4275 r.in.level, nt_errstr(status));
4276 ret = false;
4277 continue;
4278 }
4279 } else {
4280 if (!NT_STATUS_EQUAL(NT_STATUS_INVALID_INFO_CLASS, status)) {
4281 printf("SetGroupInfo level %u gave %s - should have been NT_STATUS_INVALID_INFO_CLASS\n",
4282 r.in.level, nt_errstr(status));
4283 ret = false;
4284 continue;
4285 }
4286 }
4287 }
4288
4289 return ret;
4290 }
4291
4292 static bool test_QueryUserInfo(struct dcerpc_pipe *p,
4293 struct torture_context *tctx,
4294 struct policy_handle *handle)
4295 {
4296 NTSTATUS status;
4297 struct samr_QueryUserInfo r;
4298 union samr_UserInfo *info;
4299 uint16_t levels[] = {1, 2, 3, 4, 5, 6, 7, 8, 9, 10,
4300 11, 12, 13, 14, 16, 17, 20, 21};
4301 int i;
4302 bool ret = true;
4303
4304 for (i=0;i<ARRAY_SIZE(levels);i++) {
4305 printf("Testing QueryUserInfo level %u\n", levels[i]);
4306
4307 r.in.user_handle = handle;
4308 r.in.level = levels[i];
4309 r.out.info = &info;
4310
4311 status = dcerpc_samr_QueryUserInfo(p, tctx, &r);
4312 if (!NT_STATUS_IS_OK(status)) {
4313 printf("QueryUserInfo level %u failed - %s\n",
4314 levels[i], nt_errstr(status));
4315 ret = false;
4316 }
4317 }
4318
4319 return ret;
4320 }
4321
4322 static bool test_QueryUserInfo2(struct dcerpc_pipe *p,
4323 struct torture_context *tctx,
4324 struct policy_handle *handle)
4325 {
4326 NTSTATUS status;
4327 struct samr_QueryUserInfo2 r;
4328 union samr_UserInfo *info;
4329 uint16_t levels[] = {1, 2, 3, 4, 5, 6, 7, 8, 9, 10,
4330 11, 12, 13, 14, 16, 17, 20, 21};
4331 int i;
4332 bool ret = true;
4333
4334 for (i=0;i<ARRAY_SIZE(levels);i++) {
4335 printf("Testing QueryUserInfo2 level %u\n", levels[i]);
4336
4337 r.in.user_handle = handle;
4338 r.in.level = levels[i];
4339 r.out.info = &info;
4340
4341 status = dcerpc_samr_QueryUserInfo2(p, tctx, &r);
4342 if (!NT_STATUS_IS_OK(status)) {
4343 printf("QueryUserInfo2 level %u failed - %s\n",
4344 levels[i], nt_errstr(status));
4345 ret = false;
4346 }
4347 }
4348
4349 return ret;
4350 }
4351
4352 static bool test_OpenUser(struct dcerpc_pipe *p,
4353 struct torture_context *tctx,
4354 struct policy_handle *handle, uint32_t rid)
4355 {
4356 NTSTATUS status;
4357 struct samr_OpenUser r;
4358 struct policy_handle user_handle;
4359 bool ret = true;
4360
4361 printf("Testing OpenUser(%u)\n", rid);
4362
4363 r.in.domain_handle = handle;
4364 r.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
4365 r.in.rid = rid;
4366 r.out.user_handle = &user_handle;
4367
4368 status = dcerpc_samr_OpenUser(p, tctx, &r);
4369 if (!NT_STATUS_IS_OK(status)) {
4370 printf("OpenUser(%u) failed - %s\n", rid, nt_errstr(status));
4371 return false;
4372 }
4373
4374 if (!test_QuerySecurity(p, tctx, &user_handle)) {
4375 ret = false;
4376 }
4377
4378 if (!test_QueryUserInfo(p, tctx, &user_handle)) {
4379 ret = false;
4380 }
4381
4382 if (!test_QueryUserInfo2(p, tctx, &user_handle)) {
4383 ret = false;
4384 }
4385
4386 if (!test_GetUserPwInfo(p, tctx, &user_handle)) {
4387 ret = false;
4388 }
4389
4390 if (!test_GetGroupsForUser(p,tctx, &user_handle)) {
4391 ret = false;
4392 }
4393
4394 if (!test_samr_handle_Close(p, tctx, &user_handle)) {
4395 ret = false;
4396 }
4397
4398 return ret;
4399 }
4400
4401 static bool test_OpenGroup(struct dcerpc_pipe *p,
4402 struct torture_context *tctx,
4403 struct policy_handle *handle, uint32_t rid)
4404 {
4405 NTSTATUS status;
4406 struct samr_OpenGroup r;
4407 struct policy_handle group_handle;
4408 bool ret = true;
4409
4410 printf("Testing OpenGroup(%u)\n", rid);
4411
4412 r.in.domain_handle = handle;
4413 r.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
4414 r.in.rid = rid;
4415 r.out.group_handle = &group_handle;
4416
4417 status = dcerpc_samr_OpenGroup(p, tctx, &r);
4418 if (!NT_STATUS_IS_OK(status)) {
4419 printf("OpenGroup(%u) failed - %s\n", rid, nt_errstr(status));
4420 return false;
4421 }
4422
4423 if (!test_QuerySecurity(p, tctx, &group_handle)) {
4424 ret = false;
4425 }
4426
4427 if (!test_QueryGroupInfo(p, tctx, &group_handle)) {
4428 ret = false;
4429 }
4430
4431 if (!test_QueryGroupMember(p, tctx, &group_handle)) {
4432 ret = false;
4433 }
4434
4435 if (!test_samr_handle_Close(p, tctx, &group_handle)) {
4436 ret = false;
4437 }
4438
4439 return ret;
4440 }
4441
4442 static bool test_OpenAlias(struct dcerpc_pipe *p, struct torture_context *tctx,
4443 struct policy_handle *handle, uint32_t rid)
4444 {
4445 NTSTATUS status;
4446 struct samr_OpenAlias r;
4447 struct policy_handle alias_handle;
4448 bool ret = true;
4449
4450 torture_comment(tctx, "Testing OpenAlias(%u)\n", rid);
4451
4452 r.in.domain_handle = handle;
4453 r.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
4454 r.in.rid = rid;
4455 r.out.alias_handle = &alias_handle;
4456
4457 status = dcerpc_samr_OpenAlias(p, tctx, &r);
4458 if (!NT_STATUS_IS_OK(status)) {
4459 printf("OpenAlias(%u) failed - %s\n", rid, nt_errstr(status));
4460 return false;
4461 }
4462
4463 if (!test_QuerySecurity(p, tctx, &alias_handle)) {
4464 ret = false;
4465 }
4466
4467 if (!test_QueryAliasInfo(p, tctx, &alias_handle)) {
4468 ret = false;
4469 }
4470
4471 if (!test_GetMembersInAlias(p, tctx, &alias_handle)) {
4472 ret = false;
4473 }
4474
4475 if (!test_samr_handle_Close(p, tctx, &alias_handle)) {
4476 ret = false;
4477 }
4478
4479 return ret;
4480 }
4481
4482 static bool check_mask(struct dcerpc_pipe *p, struct torture_context *tctx,
4483 struct policy_handle *handle, uint32_t rid,
4484 uint32_t acct_flag_mask)
4485 {
4486 NTSTATUS status;
4487 struct samr_OpenUser r;
4488 struct samr_QueryUserInfo q;
4489 union samr_UserInfo *info;
4490 struct policy_handle user_handle;
4491 bool ret = true;
4492
4493 torture_comment(tctx, "Testing OpenUser(%u)\n", rid);
4494
4495 r.in.domain_handle = handle;
4496 r.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
4497 r.in.rid = rid;
4498 r.out.user_handle = &user_handle;
4499
4500 status = dcerpc_samr_OpenUser(p, tctx, &r);
4501 if (!NT_STATUS_IS_OK(status)) {
4502 printf("OpenUser(%u) failed - %s\n", rid, nt_errstr(status));
4503 return false;
4504 }
4505
4506 q.in.user_handle = &user_handle;
4507 q.in.level = 16;
4508 q.out.info = &info;
4509
4510 status = dcerpc_samr_QueryUserInfo(p, tctx, &q);
4511 if (!NT_STATUS_IS_OK(status)) {
4512 printf("QueryUserInfo level 16 failed - %s\n",
4513 nt_errstr(status));
4514 ret = false;
4515 } else {
4516 if ((acct_flag_mask & info->info16.acct_flags) == 0) {
4517 printf("Server failed to filter for 0x%x, allowed 0x%x (%d) on EnumDomainUsers\n",
4518 acct_flag_mask, info->info16.acct_flags, rid);
4519 ret = false;
4520 }
4521 }
4522
4523 if (!test_samr_handle_Close(p, tctx, &user_handle)) {
4524 ret = false;
4525 }
4526
4527 return ret;
4528 }
4529
4530 static bool test_EnumDomainUsers(struct dcerpc_pipe *p, struct torture_context *tctx,
4531 struct policy_handle *handle)
4532 {
4533 NTSTATUS status = STATUS_MORE_ENTRIES;
4534 struct samr_EnumDomainUsers r;
4535 uint32_t mask, resume_handle=0;
4536 int i, mask_idx;
4537 bool ret = true;
4538 struct samr_LookupNames n;
4539 struct samr_LookupRids lr ;
4540 struct lsa_Strings names;
4541 struct samr_Ids rids, types;
4542 struct samr_SamArray *sam = NULL;
4543 uint32_t num_entries = 0;
4544
4545 uint32_t masks[] = {ACB_NORMAL, ACB_DOMTRUST, ACB_WSTRUST,
4546 ACB_DISABLED, ACB_NORMAL | ACB_DISABLED,
4547 ACB_SVRTRUST | ACB_DOMTRUST | ACB_WSTRUST,
4548 ACB_PWNOEXP, 0};
4549
4550 printf("Testing EnumDomainUsers\n");
4551
4552 for (mask_idx=0;mask_idx<ARRAY_SIZE(masks);mask_idx++) {
4553 r.in.domain_handle = handle;
4554 r.in.resume_handle = &resume_handle;
4555 r.in.acct_flags = mask = masks[mask_idx];
4556 r.in.max_size = (uint32_t)-1;
4557 r.out.resume_handle = &resume_handle;
4558 r.out.num_entries = &num_entries;
4559 r.out.sam = &sam;
4560
4561 status = dcerpc_samr_EnumDomainUsers(p, tctx, &r);
4562 if (!NT_STATUS_EQUAL(status, STATUS_MORE_ENTRIES) &&
4563 !NT_STATUS_IS_OK(status)) {
4564 printf("EnumDomainUsers failed - %s\n", nt_errstr(status));
4565 return false;
4566 }
4567
4568 torture_assert(tctx, sam, "EnumDomainUsers failed: r.out.sam unexpectedly NULL");
4569
4570 if (sam->count == 0) {
4571 continue;
4572 }
4573
4574 for (i=0;i<sam->count;i++) {
4575 if (mask) {
4576 if (!check_mask(p, tctx, handle, sam->entries[i].idx, mask)) {
4577 ret = false;
4578 }
4579 } else if (!test_OpenUser(p, tctx, handle, sam->entries[i].idx)) {
4580 ret = false;
4581 }
4582 }
4583 }
4584
4585 printf("Testing LookupNames\n");
4586 n.in.domain_handle = handle;
4587 n.in.num_names = sam->count;
4588 n.in.names = talloc_array(tctx, struct lsa_String, sam->count);
4589 n.out.rids = &rids;
4590 n.out.types = &types;
4591 for (i=0;i<sam->count;i++) {
4592 n.in.names[i].string = sam->entries[i].name.string;
4593 }
4594 status = dcerpc_samr_LookupNames(p, tctx, &n);
4595 if (!NT_STATUS_IS_OK(status)) {
4596 printf("LookupNames failed - %s\n", nt_errstr(status));
4597 ret = false;
4598 }
4599
4600
4601 printf("Testing LookupRids\n");
4602 lr.in.domain_handle = handle;
4603 lr.in.num_rids = sam->count;
4604 lr.in.rids = talloc_array(tctx, uint32_t, sam->count);
4605 lr.out.names = &names;
4606 lr.out.types = &types;
4607 for (i=0;i<sam->count;i++) {
4608 lr.in.rids[i] = sam->entries[i].idx;
4609 }
4610 status = dcerpc_samr_LookupRids(p, tctx, &lr);
4611 torture_assert_ntstatus_ok(tctx, status, "LookupRids");
4612
4613 return ret;
4614 }
4615
4616 /*
4617 try blasting the server with a bunch of sync requests
4618 */
4619 static bool test_EnumDomainUsers_async(struct dcerpc_pipe *p, struct torture_context *tctx,
4620 struct policy_handle *handle)
4621 {
4622 NTSTATUS status;
4623 struct samr_EnumDomainUsers r;
4624 uint32_t resume_handle=0;
4625 int i;
4626 #define ASYNC_COUNT 100
4627 struct rpc_request *req[ASYNC_COUNT];
4628
4629 if (!torture_setting_bool(tctx, "dangerous", false)) {
4630 torture_skip(tctx, "samr async test disabled - enable dangerous tests to use\n");
4631 }
4632
4633 torture_comment(tctx, "Testing EnumDomainUsers_async\n");
4634
4635 r.in.domain_handle = handle;
4636 r.in.resume_handle = &resume_handle;
4637 r.in.acct_flags = 0;
4638 r.in.max_size = (uint32_t)-1;
4639 r.out.resume_handle = &resume_handle;
4640
4641 for (i=0;i<ASYNC_COUNT;i++) {
4642 req[i] = dcerpc_samr_EnumDomainUsers_send(p, tctx, &r);
4643 }
4644
4645 for (i=0;i<ASYNC_COUNT;i++) {
4646 status = dcerpc_ndr_request_recv(req[i]);
4647 if (!NT_STATUS_IS_OK(status)) {
4648 printf("EnumDomainUsers[%d] failed - %s\n",
4649 i, nt_errstr(status));
4650 return false;
4651 }
4652 }
4653
4654 torture_comment(tctx, "%d async requests OK\n", i);
4655
4656 return true;
4657 }
4658
4659 static bool test_EnumDomainGroups(struct dcerpc_pipe *p,
4660 struct torture_context *tctx,
4661 struct policy_handle *handle)
4662 {
4663 NTSTATUS status;
4664 struct samr_EnumDomainGroups r;
4665 uint32_t resume_handle=0;
4666 struct samr_SamArray *sam = NULL;
4667 uint32_t num_entries = 0;
4668 int i;
4669 bool ret = true;
4670
4671 printf("Testing EnumDomainGroups\n");
4672
4673 r.in.domain_handle = handle;
4674 r.in.resume_handle = &resume_handle;
4675 r.in.max_size = (uint32_t)-1;
4676 r.out.resume_handle = &resume_handle;
4677 r.out.num_entries = &num_entries;
4678 r.out.sam = &sam;
4679
4680 status = dcerpc_samr_EnumDomainGroups(p, tctx, &r);
4681 if (!NT_STATUS_IS_OK(status)) {
4682 printf("EnumDomainGroups failed - %s\n", nt_errstr(status));
4683 return false;
4684 }
4685
4686 if (!sam) {
4687 return false;
4688 }
4689
4690 for (i=0;i<sam->count;i++) {
4691 if (!test_OpenGroup(p, tctx, handle, sam->entries[i].idx)) {
4692 ret = false;
4693 }
4694 }
4695
4696 return ret;
4697 }
4698
4699 static bool test_EnumDomainAliases(struct dcerpc_pipe *p,
4700 struct torture_context *tctx,
4701 struct policy_handle *handle)
4702 {
4703 NTSTATUS status;
4704 struct samr_EnumDomainAliases r;
4705 uint32_t resume_handle=0;
4706 struct samr_SamArray *sam = NULL;
4707 uint32_t num_entries = 0;
4708 int i;
4709 bool ret = true;
4710
4711 printf("Testing EnumDomainAliases\n");
4712
4713 r.in.domain_handle = handle;
4714 r.in.resume_handle = &resume_handle;
4715 r.in.max_size = (uint32_t)-1;
4716 r.out.sam = &sam;
4717 r.out.num_entries = &num_entries;
4718 r.out.resume_handle = &resume_handle;
4719
4720 status = dcerpc_samr_EnumDomainAliases(p, tctx, &r);
4721 if (!NT_STATUS_IS_OK(status)) {
4722 printf("EnumDomainAliases failed - %s\n", nt_errstr(status));
4723 return false;
4724 }
4725
4726 if (!sam) {
4727 return false;
4728 }
4729
4730 for (i=0;i<sam->count;i++) {
4731 if (!test_OpenAlias(p, tctx, handle, sam->entries[i].idx)) {
4732 ret = false;
4733 }
4734 }
4735
4736 return ret;
4737 }
4738
4739 static bool test_GetDisplayEnumerationIndex(struct dcerpc_pipe *p,
4740 struct torture_context *tctx,
4741 struct policy_handle *handle)
4742 {
4743 NTSTATUS status;
4744 struct samr_GetDisplayEnumerationIndex r;
4745 bool ret = true;
4746 uint16_t levels[] = {1, 2, 3, 4, 5};
4747 uint16_t ok_lvl[] = {1, 1, 1, 0, 0};
4748 struct lsa_String name;
4749 uint32_t idx = 0;
4750 int i;
4751
4752 for (i=0;i<ARRAY_SIZE(levels);i++) {
4753 printf("Testing GetDisplayEnumerationIndex level %u\n", levels[i]);
4754
4755 init_lsa_String(&name, TEST_ACCOUNT_NAME);
4756
4757 r.in.domain_handle = handle;
4758 r.in.level = levels[i];
4759 r.in.name = &name;
4760 r.out.idx = &idx;
4761
4762 status = dcerpc_samr_GetDisplayEnumerationIndex(p, tctx, &r);
4763
4764 if (ok_lvl[i] &&
4765 !NT_STATUS_IS_OK(status) &&
4766 !NT_STATUS_EQUAL(NT_STATUS_NO_MORE_ENTRIES, status)) {
4767 printf("GetDisplayEnumerationIndex level %u failed - %s\n",
4768 levels[i], nt_errstr(status));
4769 ret = false;
4770 }
4771
4772 init_lsa_String(&name, "zzzzzzzz");
4773
4774 status = dcerpc_samr_GetDisplayEnumerationIndex(p, tctx, &r);
4775
4776 if (ok_lvl[i] && !NT_STATUS_EQUAL(NT_STATUS_NO_MORE_ENTRIES, status)) {
4777 printf("GetDisplayEnumerationIndex level %u failed - %s\n",
4778 levels[i], nt_errstr(status));
4779 ret = false;
4780 }
4781 }
4782
4783 return ret;
4784 }
4785
4786 static bool test_GetDisplayEnumerationIndex2(struct dcerpc_pipe *p,
4787 struct torture_context *tctx,
4788 struct policy_handle *handle)
4789 {
4790 NTSTATUS status;
4791 struct samr_GetDisplayEnumerationIndex2 r;
4792 bool ret = true;
4793 uint16_t levels[] = {1, 2, 3, 4, 5};
4794 uint16_t ok_lvl[] = {1, 1, 1, 0, 0};
4795 struct lsa_String name;
4796 uint32_t idx = 0;
4797 int i;
4798
4799 for (i=0;i<ARRAY_SIZE(levels);i++) {
4800 printf("Testing GetDisplayEnumerationIndex2 level %u\n", levels[i]);
4801
4802 init_lsa_String(&name, TEST_ACCOUNT_NAME);
4803
4804 r.in.domain_handle = handle;
4805 r.in.level = levels[i];
4806 r.in.name = &name;
4807 r.out.idx = &idx;
4808
4809 status = dcerpc_samr_GetDisplayEnumerationIndex2(p, tctx, &r);
4810 if (ok_lvl[i] &&
4811 !NT_STATUS_IS_OK(status) &&
4812 !NT_STATUS_EQUAL(NT_STATUS_NO_MORE_ENTRIES, status)) {
4813 printf("GetDisplayEnumerationIndex2 level %u failed - %s\n",
4814 levels[i], nt_errstr(status));
4815 ret = false;
4816 }
4817
4818 init_lsa_String(&name, "zzzzzzzz");
4819
4820 status = dcerpc_samr_GetDisplayEnumerationIndex2(p, tctx, &r);
4821 if (ok_lvl[i] && !NT_STATUS_EQUAL(NT_STATUS_NO_MORE_ENTRIES, status)) {
4822 printf("GetDisplayEnumerationIndex2 level %u failed - %s\n",
4823 levels[i], nt_errstr(status));
4824 ret = false;
4825 }
4826 }
4827
4828 return ret;
4829 }
4830
4831 #define STRING_EQUAL_QUERY(s1, s2, user) \
4832 if (s1.string == NULL && s2.string != NULL && s2.string[0] == '\0') { \
4833 /* odd, but valid */ \
4834 } else if ((s1.string && !s2.string) || (s2.string && !s1.string) || strcmp(s1.string, s2.string)) { \
4835 printf("%s mismatch for %s: %s != %s (%s)\n", \
4836 #s1, user.string, s1.string, s2.string, __location__); \
4837 ret = false; \
4838 }
4839 #define INT_EQUAL_QUERY(s1, s2, user) \
4840 if (s1 != s2) { \
4841 printf("%s mismatch for %s: 0x%llx != 0x%llx (%s)\n", \
4842 #s1, user.string, (unsigned long long)s1, (unsigned long long)s2, __location__); \
4843 ret = false; \
4844 }
4845
4846 static bool test_each_DisplayInfo_user(struct dcerpc_pipe *p,
4847 struct torture_context *tctx,
4848 struct samr_QueryDisplayInfo *querydisplayinfo,
4849 bool *seen_testuser)
4850 {
4851 struct samr_OpenUser r;
4852 struct samr_QueryUserInfo q;
4853 union samr_UserInfo *info;
4854 struct policy_handle user_handle;
4855 int i, ret = true;
4856 NTSTATUS status;
4857 r.in.domain_handle = querydisplayinfo->in.domain_handle;
4858 r.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
4859 for (i = 0; ; i++) {
4860 switch (querydisplayinfo->in.level) {
4861 case 1:
4862 if (i >= querydisplayinfo->out.info->info1.count) {
4863 return ret;
4864 }
4865 r.in.rid = querydisplayinfo->out.info->info1.entries[i].rid;
4866 break;
4867 case 2:
4868 if (i >= querydisplayinfo->out.info->info2.count) {
4869 return ret;
4870 }
4871 r.in.rid = querydisplayinfo->out.info->info2.entries[i].rid;
4872 break;
4873 case 3:
4874 /* Groups */
4875 case 4:
4876 case 5:
4877 /* Not interested in validating just the account name */
4878 return true;
4879 }
4880
4881 r.out.user_handle = &user_handle;
4882
4883 switch (querydisplayinfo->in.level) {
4884 case 1:
4885 case 2:
4886 status = dcerpc_samr_OpenUser(p, tctx, &r);
4887 if (!NT_STATUS_IS_OK(status)) {
4888 printf("OpenUser(%u) failed - %s\n", r.in.rid, nt_errstr(status));
4889 return false;
4890 }
4891 }
4892
4893 q.in.user_handle = &user_handle;
4894 q.in.level = 21;
4895 q.out.info = &info;
4896 status = dcerpc_samr_QueryUserInfo(p, tctx, &q);
4897 if (!NT_STATUS_IS_OK(status)) {
4898 printf("QueryUserInfo(%u) failed - %s\n", r.in.rid, nt_errstr(status));
4899 return false;
4900 }
4901
4902 switch (querydisplayinfo->in.level) {
4903 case 1:
4904 if (seen_testuser && strcmp(info->info21.account_name.string, TEST_ACCOUNT_NAME) == 0) {
4905 *seen_testuser = true;
4906 }
4907 STRING_EQUAL_QUERY(querydisplayinfo->out.info->info1.entries[i].full_name,
4908 info->info21.full_name, info->info21.account_name);
4909 STRING_EQUAL_QUERY(querydisplayinfo->out.info->info1.entries[i].account_name,
4910 info->info21.account_name, info->info21.account_name);
4911 STRING_EQUAL_QUERY(querydisplayinfo->out.info->info1.entries[i].description,
4912 info->info21.description, info->info21.account_name);
4913 INT_EQUAL_QUERY(querydisplayinfo->out.info->info1.entries[i].rid,
4914 info->info21.rid, info->info21.account_name);
4915 INT_EQUAL_QUERY(querydisplayinfo->out.info->info1.entries[i].acct_flags,
4916 info->info21.acct_flags, info->info21.account_name);
4917
4918 break;
4919 case 2:
4920 STRING_EQUAL_QUERY(querydisplayinfo->out.info->info2.entries[i].account_name,
4921 info->info21.account_name, info->info21.account_name);
4922 STRING_EQUAL_QUERY(querydisplayinfo->out.info->info2.entries[i].description,
4923 info->info21.description, info->info21.account_name);
4924 INT_EQUAL_QUERY(querydisplayinfo->out.info->info2.entries[i].rid,
4925 info->info21.rid, info->info21.account_name);
4926 INT_EQUAL_QUERY((querydisplayinfo->out.info->info2.entries[i].acct_flags & ~ACB_NORMAL),
4927 info->info21.acct_flags, info->info21.account_name);
4928
4929 if (!(querydisplayinfo->out.info->info2.entries[i].acct_flags & ACB_NORMAL)) {
4930 printf("Missing ACB_NORMAL in querydisplayinfo->out.info.info2.entries[i].acct_flags on %s\n",
4931 info->info21.account_name.string);
4932 }
4933
4934 if (!(info->info21.acct_flags & (ACB_WSTRUST | ACB_SVRTRUST))) {
4935 printf("Found non-trust account %s in trust account listing: 0x%x 0x%x\n",
4936 info->info21.account_name.string,
4937 querydisplayinfo->out.info->info2.entries[i].acct_flags,
4938 info->info21.acct_flags);
4939 return false;
4940 }
4941
4942 break;
4943 }
4944
4945 if (!test_samr_handle_Close(p, tctx, &user_handle)) {
4946 return false;
4947 }
4948 }
4949 return ret;
4950 }
4951
4952 static bool test_QueryDisplayInfo(struct dcerpc_pipe *p,
4953 struct torture_context *tctx,
4954 struct policy_handle *handle)
4955 {
4956 NTSTATUS status;
4957 struct samr_QueryDisplayInfo r;
4958 struct samr_QueryDomainInfo dom_info;
4959 union samr_DomainInfo *info = NULL;
4960 bool ret = true;
4961 uint16_t levels[] = {1, 2, 3, 4, 5};
4962 int i;
4963 bool seen_testuser = false;
4964 uint32_t total_size;
4965 uint32_t returned_size;
4966 union samr_DispInfo disp_info;
4967
4968
4969 for (i=0;i<ARRAY_SIZE(levels);i++) {
4970 printf("Testing QueryDisplayInfo level %u\n", levels[i]);
4971
4972 r.in.start_idx = 0;
4973 status = STATUS_MORE_ENTRIES;
4974 while (NT_STATUS_EQUAL(status, STATUS_MORE_ENTRIES)) {
4975 r.in.domain_handle = handle;
4976 r.in.level = levels[i];
4977 r.in.max_entries = 2;
4978 r.in.buf_size = (uint32_t)-1;
4979 r.out.total_size = &total_size;
4980 r.out.returned_size = &returned_size;
4981 r.out.info = &disp_info;
4982
4983 status = dcerpc_samr_QueryDisplayInfo(p, tctx, &r);
4984 if (!NT_STATUS_EQUAL(status, STATUS_MORE_ENTRIES) && !NT_STATUS_IS_OK(status)) {
4985 printf("QueryDisplayInfo level %u failed - %s\n",
4986 levels[i], nt_errstr(status));
4987 ret = false;
4988 }
4989 switch (r.in.level) {
4990 case 1:
4991 if (!test_each_DisplayInfo_user(p, tctx, &r, &seen_testuser)) {
4992 ret = false;
4993 }
4994 r.in.start_idx += r.out.info->info1.count;
4995 break;
4996 case 2:
4997 if (!test_each_DisplayInfo_user(p, tctx, &r, NULL)) {
4998 ret = false;
4999 }
5000 r.in.start_idx += r.out.info->info2.count;
5001 break;
5002 case 3:
5003 r.in.start_idx += r.out.info->info3.count;
5004 break;
5005 case 4:
5006 r.in.start_idx += r.out.info->info4.count;
5007 break;
5008 case 5:
5009 r.in.start_idx += r.out.info->info5.count;
5010 break;
5011 }
5012 }
5013 dom_info.in.domain_handle = handle;
5014 dom_info.in.level = 2;
5015 dom_info.out.info = &info;
5016
5017 /* Check number of users returned is correct */
5018 status = dcerpc_samr_QueryDomainInfo(p, tctx, &dom_info);
5019 if (!NT_STATUS_IS_OK(status)) {
5020 printf("QueryDomainInfo level %u failed - %s\n",
5021 r.in.level, nt_errstr(status));
5022 ret = false;
5023 break;
5024 }
5025 switch (r.in.level) {
5026 case 1:
5027 case 4:
5028 if (info->general.num_users < r.in.start_idx) {
5029 printf("QueryDomainInfo indicates that QueryDisplayInfo returned more users (%d/%d) than the domain %s is said to contain!\n",
5030 r.in.start_idx, info->general.num_groups,
5031 info->general.domain_name.string);
5032 ret = false;
5033 }
5034 if (!seen_testuser) {
5035 struct policy_handle user_handle;
5036 if (NT_STATUS_IS_OK(test_OpenUser_byname(p, tctx, handle, TEST_ACCOUNT_NAME, &user_handle))) {
5037 printf("Didn't find test user " TEST_ACCOUNT_NAME " in enumeration of %s\n",
5038 info->general.domain_name.string);
5039 ret = false;
5040 test_samr_handle_Close(p, tctx, &user_handle);
5041 }
5042 }
5043 break;
5044 case 3:
5045 case 5:
5046 if (info->general.num_groups != r.in.start_idx) {
5047 printf("QueryDomainInfo indicates that QueryDisplayInfo didn't return all (%d/%d) the groups in %s\n",
5048 r.in.start_idx, info->general.num_groups,
5049 info->general.domain_name.string);
5050 ret = false;
5051 }
5052
5053 break;
5054 }
5055
5056 }
5057
5058 return ret;
5059 }
5060
5061 static bool test_QueryDisplayInfo2(struct dcerpc_pipe *p,
5062 struct torture_context *tctx,
5063 struct policy_handle *handle)
5064 {
5065 NTSTATUS status;
5066 struct samr_QueryDisplayInfo2 r;
5067 bool ret = true;
5068 uint16_t levels[] = {1, 2, 3, 4, 5};
5069 int i;
5070 uint32_t total_size;
5071 uint32_t returned_size;
5072 union samr_DispInfo info;
5073
5074 for (i=0;i<ARRAY_SIZE(levels);i++) {
5075 printf("Testing QueryDisplayInfo2 level %u\n", levels[i]);
5076
5077 r.in.domain_handle = handle;
5078 r.in.level = levels[i];
5079 r.in.start_idx = 0;
5080 r.in.max_entries = 1000;
5081 r.in.buf_size = (uint32_t)-1;
5082 r.out.total_size = &total_size;
5083 r.out.returned_size = &returned_size;
5084 r.out.info = &info;
5085
5086 status = dcerpc_samr_QueryDisplayInfo2(p, tctx, &r);
5087 if (!NT_STATUS_IS_OK(status)) {
5088 printf("QueryDisplayInfo2 level %u failed - %s\n",
5089 levels[i], nt_errstr(status));
5090 ret = false;
5091 }
5092 }
5093
5094 return ret;
5095 }
5096
5097 static bool test_QueryDisplayInfo3(struct dcerpc_pipe *p, struct torture_context *tctx,
5098 struct policy_handle *handle)
5099 {
5100 NTSTATUS status;
5101 struct samr_QueryDisplayInfo3 r;
5102 bool ret = true;
5103 uint16_t levels[] = {1, 2, 3, 4, 5};
5104 int i;
5105 uint32_t total_size;
5106 uint32_t returned_size;
5107 union samr_DispInfo info;
5108
5109 for (i=0;i<ARRAY_SIZE(levels);i++) {
5110 torture_comment(tctx, "Testing QueryDisplayInfo3 level %u\n", levels[i]);
5111
5112 r.in.domain_handle = handle;
5113 r.in.level = levels[i];
5114 r.in.start_idx = 0;
5115 r.in.max_entries = 1000;
5116 r.in.buf_size = (uint32_t)-1;
5117 r.out.total_size = &total_size;
5118 r.out.returned_size = &returned_size;
5119 r.out.info = &info;
5120
5121 status = dcerpc_samr_QueryDisplayInfo3(p, tctx, &r);
5122 if (!NT_STATUS_IS_OK(status)) {
5123 printf("QueryDisplayInfo3 level %u failed - %s\n",
5124 levels[i], nt_errstr(status));
5125 ret = false;
5126 }
5127 }
5128
5129 return ret;
5130 }
5131
5132
5133 static bool test_QueryDisplayInfo_continue(struct dcerpc_pipe *p,
5134 struct torture_context *tctx,
5135 struct policy_handle *handle)
5136 {
5137 NTSTATUS status;
5138 struct samr_QueryDisplayInfo r;
5139 bool ret = true;
5140 uint32_t total_size;
5141 uint32_t returned_size;
5142 union samr_DispInfo info;
5143
5144 printf("Testing QueryDisplayInfo continuation\n");
5145
5146 r.in.domain_handle = handle;
5147 r.in.level = 1;
5148 r.in.start_idx = 0;
5149 r.in.max_entries = 1;
5150 r.in.buf_size = (uint32_t)-1;
5151 r.out.total_size = &total_size;
5152 r.out.returned_size = &returned_size;
5153 r.out.info = &info;
5154
5155 do {
5156 status = dcerpc_samr_QueryDisplayInfo(p, tctx, &r);
5157 if (NT_STATUS_IS_OK(status) && *r.out.returned_size != 0) {
5158 if (r.out.info->info1.entries[0].idx != r.in.start_idx + 1) {
5159 printf("expected idx %d but got %d\n",
5160 r.in.start_idx + 1,
5161 r.out.info->info1.entries[0].idx);
5162 break;
5163 }
5164 }
5165 if (!NT_STATUS_EQUAL(status, STATUS_MORE_ENTRIES) &&
5166 !NT_STATUS_IS_OK(status)) {
5167 printf("QueryDisplayInfo level %u failed - %s\n",
5168 r.in.level, nt_errstr(status));
5169 ret = false;
5170 break;
5171 }
5172 r.in.start_idx++;
5173 } while ((NT_STATUS_EQUAL(status, STATUS_MORE_ENTRIES) ||
5174 NT_STATUS_IS_OK(status)) &&
5175 *r.out.returned_size != 0);
5176
5177 return ret;
5178 }
5179
5180 static bool test_QueryDomainInfo(struct dcerpc_pipe *p, struct torture_context *tctx,
5181 struct policy_handle *handle)
5182 {
5183 NTSTATUS status;
5184 struct samr_QueryDomainInfo r;
5185 union samr_DomainInfo *info = NULL;
5186 struct samr_SetDomainInfo s;
5187 uint16_t levels[] = {1, 2, 3, 4, 5, 6, 7, 8, 9, 11, 12, 13};
5188 uint16_t set_ok[] = {1, 0, 1, 1, 0, 1, 1, 0, 1, 0, 1, 0};
5189 int i;
5190 bool ret = true;
5191 const char *domain_comment = talloc_asprintf(tctx,
5192 "Tortured by Samba4 RPC-SAMR: %s",
5193 timestring(tctx, time(NULL)));
5194
5195 s.in.domain_handle = handle;
5196 s.in.level = 4;
5197 s.in.info = talloc(tctx, union samr_DomainInfo);
5198
5199 s.in.info->oem.oem_information.string = domain_comment;
5200 status = dcerpc_samr_SetDomainInfo(p, tctx, &s);
5201 if (!NT_STATUS_IS_OK(status)) {
5202 printf("SetDomainInfo level %u (set comment) failed - %s\n",
5203 s.in.level, nt_errstr(status));
5204 return false;
5205 }
5206
5207 for (i=0;i<ARRAY_SIZE(levels);i++) {
5208 torture_comment(tctx, "Testing QueryDomainInfo level %u\n", levels[i]);
5209
5210 r.in.domain_handle = handle;
5211 r.in.level = levels[i];
5212 r.out.info = &info;
5213
5214 status = dcerpc_samr_QueryDomainInfo(p, tctx, &r);
5215 if (!NT_STATUS_IS_OK(status)) {
5216 printf("QueryDomainInfo level %u failed - %s\n",
5217 r.in.level, nt_errstr(status));
5218 ret = false;
5219 continue;
5220 }
5221
5222 switch (levels[i]) {
5223 case 2:
5224 if (strcmp(info->general.oem_information.string, domain_comment) != 0) {
5225 printf("QueryDomainInfo level %u returned different oem_information (comment) (%s, expected %s)\n",
5226 levels[i], info->general.oem_information.string, domain_comment);
5227 ret = false;
5228 }
5229 if (!info->general.primary.string) {
5230 printf("QueryDomainInfo level %u returned no PDC name\n",
5231 levels[i]);
5232 ret = false;
5233 } else if (info->general.role == SAMR_ROLE_DOMAIN_PDC) {
5234 if (dcerpc_server_name(p) && strcasecmp_m(dcerpc_server_name(p), info->general.primary.string) != 0) {
5235 printf("QueryDomainInfo level %u returned different PDC name (%s) compared to server name (%s), despite claiming to be the PDC\n",
5236 levels[i], info->general.primary.string, dcerpc_server_name(p));
5237 }
5238 }
5239 break;
5240 case 4:
5241 if (strcmp(info->oem.oem_information.string, domain_comment) != 0) {
5242 printf("QueryDomainInfo level %u returned different oem_information (comment) (%s, expected %s)\n",
5243 levels[i], info->oem.oem_information.string, domain_comment);
5244 ret = false;
5245 }
5246 break;
5247 case 6:
5248 if (!info->info6.primary.string) {
5249 printf("QueryDomainInfo level %u returned no PDC name\n",
5250 levels[i]);
5251 ret = false;
5252 }
5253 break;
5254 case 11:
5255 if (strcmp(info->general2.general.oem_information.string, domain_comment) != 0) {
5256 printf("QueryDomainInfo level %u returned different comment (%s, expected %s)\n",
5257 levels[i], info->general2.general.oem_information.string, domain_comment);
5258 ret = false;
5259 }
5260 break;
5261 }
5262
5263 torture_comment(tctx, "Testing SetDomainInfo level %u\n", levels[i]);
5264
5265 s.in.domain_handle = handle;
5266 s.in.level = levels[i];
5267 s.in.info = info;
5268
5269 status = dcerpc_samr_SetDomainInfo(p, tctx, &s);
5270 if (set_ok[i]) {
5271 if (!NT_STATUS_IS_OK(status)) {
5272 printf("SetDomainInfo level %u failed - %s\n",
5273 r.in.level, nt_errstr(status));
5274 ret = false;
5275 continue;
5276 }
5277 } else {
5278 if (!NT_STATUS_EQUAL(NT_STATUS_INVALID_INFO_CLASS, status)) {
5279 printf("SetDomainInfo level %u gave %s - should have been NT_STATUS_INVALID_INFO_CLASS\n",
5280 r.in.level, nt_errstr(status));
5281 ret = false;
5282 continue;
5283 }
5284 }
5285
5286 status = dcerpc_samr_QueryDomainInfo(p, tctx, &r);
5287 if (!NT_STATUS_IS_OK(status)) {
5288 printf("QueryDomainInfo level %u failed - %s\n",
5289 r.in.level, nt_errstr(status));
5290 ret = false;
5291 continue;
5292 }
5293 }
5294
5295 return ret;
5296 }
5297
5298
5299 static bool test_QueryDomainInfo2(struct dcerpc_pipe *p, struct torture_context *tctx,
5300 struct policy_handle *handle)
5301 {
5302 NTSTATUS status;
5303 struct samr_QueryDomainInfo2 r;
5304 union samr_DomainInfo *info = NULL;
5305 uint16_t levels[] = {1, 2, 3, 4, 5, 6, 7, 8, 9, 11, 12, 13};
5306 int i;
5307 bool ret = true;
5308
5309 for (i=0;i<ARRAY_SIZE(levels);i++) {
5310 printf("Testing QueryDomainInfo2 level %u\n", levels[i]);
5311
5312 r.in.domain_handle = handle;
5313 r.in.level = levels[i];
5314 r.out.info = &info;
5315
5316 status = dcerpc_samr_QueryDomainInfo2(p, tctx, &r);
5317 if (!NT_STATUS_IS_OK(status)) {
5318 printf("QueryDomainInfo2 level %u failed - %s\n",
5319 r.in.level, nt_errstr(status));
5320 ret = false;
5321 continue;
5322 }
5323 }
5324
5325 return true;
5326 }
5327
5328 /* Test whether querydispinfo level 5 and enumdomgroups return the same
5329 set of group names. */
5330 static bool test_GroupList(struct dcerpc_pipe *p, struct torture_context *tctx,
5331 struct policy_handle *handle)
5332 {
5333 struct samr_EnumDomainGroups q1;
5334 struct samr_QueryDisplayInfo q2;
5335 NTSTATUS status;
5336 uint32_t resume_handle=0;
5337 struct samr_SamArray *sam = NULL;
5338 uint32_t num_entries = 0;
5339 int i;
5340 bool ret = true;
5341 uint32_t total_size;
5342 uint32_t returned_size;
5343 union samr_DispInfo info;
5344
5345 int num_names = 0;
5346 const char **names = NULL;
5347
5348 torture_comment(tctx, "Testing coherency of querydispinfo vs enumdomgroups\n");
5349
5350 q1.in.domain_handle = handle;
5351 q1.in.resume_handle = &resume_handle;
5352 q1.in.max_size = 5;
5353 q1.out.resume_handle = &resume_handle;
5354 q1.out.num_entries = &num_entries;
5355 q1.out.sam = &sam;
5356
5357 status = STATUS_MORE_ENTRIES;
5358 while (NT_STATUS_EQUAL(status, STATUS_MORE_ENTRIES)) {
5359 status = dcerpc_samr_EnumDomainGroups(p, tctx, &q1);
5360
5361 if (!NT_STATUS_IS_OK(status) &&
5362 !NT_STATUS_EQUAL(status, STATUS_MORE_ENTRIES))
5363 break;
5364
5365 for (i=0; i<*q1.out.num_entries; i++) {
5366 add_string_to_array(tctx,
5367 sam->entries[i].name.string,
5368 &names, &num_names);
5369 }
5370 }
5371
5372 torture_assert_ntstatus_ok(tctx, status, "EnumDomainGroups");
5373
5374 torture_assert(tctx, sam, "EnumDomainGroups failed to return sam");
5375
5376 q2.in.domain_handle = handle;
5377 q2.in.level = 5;
5378 q2.in.start_idx = 0;
5379 q2.in.max_entries = 5;
5380 q2.in.buf_size = (uint32_t)-1;
5381 q2.out.total_size = &total_size;
5382 q2.out.returned_size = &returned_size;
5383 q2.out.info = &info;
5384
5385 status = STATUS_MORE_ENTRIES;
5386 while (NT_STATUS_EQUAL(status, STATUS_MORE_ENTRIES)) {
5387 status = dcerpc_samr_QueryDisplayInfo(p, tctx, &q2);
5388
5389 if (!NT_STATUS_IS_OK(status) &&
5390 !NT_STATUS_EQUAL(status, STATUS_MORE_ENTRIES))
5391 break;
5392
5393 for (i=0; i<q2.out.info->info5.count; i++) {
5394 int j;
5395 const char *name = q2.out.info->info5.entries[i].account_name.string;
5396 bool found = false;
5397 for (j=0; j<num_names; j++) {
5398 if (names[j] == NULL)
5399 continue;
5400 if (strequal(names[j], name)) {
5401 names[j] = NULL;
5402 found = true;
5403 break;
5404 }
5405 }
5406
5407 if (!found) {
5408 printf("QueryDisplayInfo gave name [%s] that EnumDomainGroups did not\n",
5409 name);
5410 ret = false;
5411 }
5412 }
5413 q2.in.start_idx += q2.out.info->info5.count;
5414 }
5415
5416 if (!NT_STATUS_IS_OK(status)) {
5417 printf("QueryDisplayInfo level 5 failed - %s\n",
5418 nt_errstr(status));
5419 ret = false;
5420 }
5421
5422 for (i=0; i<num_names; i++) {
5423 if (names[i] != NULL) {
5424 printf("EnumDomainGroups gave name [%s] that QueryDisplayInfo did not\n",
5425 names[i]);
5426 ret = false;
5427 }
5428 }
5429
5430 return ret;
5431 }
5432
5433 static bool test_DeleteDomainGroup(struct dcerpc_pipe *p, struct torture_context *tctx,
5434 struct policy_handle *group_handle)
5435 {
5436 struct samr_DeleteDomainGroup d;
5437 NTSTATUS status;
5438
5439 torture_comment(tctx, "Testing DeleteDomainGroup\n");
5440
5441 d.in.group_handle = group_handle;
5442 d.out.group_handle = group_handle;
5443
5444 status = dcerpc_samr_DeleteDomainGroup(p, tctx, &d);
5445 torture_assert_ntstatus_ok(tctx, status, "DeleteDomainGroup");
5446
5447 return true;
5448 }
5449
5450 static bool test_TestPrivateFunctionsDomain(struct dcerpc_pipe *p, struct torture_context *tctx,
5451 struct policy_handle *domain_handle)
5452 {
5453 struct samr_TestPrivateFunctionsDomain r;
5454 NTSTATUS status;
5455 bool ret = true;
5456
5457 torture_comment(tctx, "Testing TestPrivateFunctionsDomain\n");
5458
5459 r.in.domain_handle = domain_handle;
5460
5461 status = dcerpc_samr_TestPrivateFunctionsDomain(p, tctx, &r);
5462 torture_assert_ntstatus_equal(tctx, status, NT_STATUS_NOT_IMPLEMENTED, "TestPrivateFunctionsDomain");
5463
5464 return ret;
5465 }
5466
5467 static bool test_RidToSid(struct dcerpc_pipe *p, struct torture_context *tctx,
5468 struct dom_sid *domain_sid,
5469 struct policy_handle *domain_handle)
5470 {
5471 struct samr_RidToSid r;
5472 NTSTATUS status;
5473 bool ret = true;
5474 struct dom_sid *calc_sid, *out_sid;
5475 int rids[] = { 0, 42, 512, 10200 };
5476 int i;
5477
5478 for (i=0;i<ARRAY_SIZE(rids);i++) {
5479 torture_comment(tctx, "Testing RidToSid\n");
5480
5481 calc_sid = dom_sid_dup(tctx, domain_sid);
5482 r.in.domain_handle = domain_handle;
5483 r.in.rid = rids[i];
5484 r.out.sid = &out_sid;
5485
5486 status = dcerpc_samr_RidToSid(p, tctx, &r);
5487 if (!NT_STATUS_IS_OK(status)) {
5488 printf("RidToSid for %d failed - %s\n", rids[i], nt_errstr(status));
5489 ret = false;
5490 } else {
5491 calc_sid = dom_sid_add_rid(calc_sid, calc_sid, rids[i]);
5492
5493 if (!dom_sid_equal(calc_sid, out_sid)) {
5494 printf("RidToSid for %d failed - got %s, expected %s\n", rids[i],
5495 dom_sid_string(tctx, out_sid),
5496 dom_sid_string(tctx, calc_sid));
5497 ret = false;
5498 }
5499 }
5500 }
5501
5502 return ret;
5503 }
5504
5505 static bool test_GetBootKeyInformation(struct dcerpc_pipe *p, struct torture_context *tctx,
5506 struct policy_handle *domain_handle)
5507 {
5508 struct samr_GetBootKeyInformation r;
5509 NTSTATUS status;
5510 bool ret = true;
5511 uint32_t unknown = 0;
5512
5513 torture_comment(tctx, "Testing GetBootKeyInformation\n");
5514
5515 r.in.domain_handle = domain_handle;
5516 r.out.unknown = &unknown;
5517
5518 status = dcerpc_samr_GetBootKeyInformation(p, tctx, &r);
5519 if (!NT_STATUS_IS_OK(status)) {
5520 /* w2k3 seems to fail this sometimes and pass it sometimes */
5521 torture_comment(tctx, "GetBootKeyInformation (ignored) - %s\n", nt_errstr(status));
5522 }
5523
5524 return ret;
5525 }
5526
5527 static bool test_AddGroupMember(struct dcerpc_pipe *p, struct torture_context *tctx,
5528 struct policy_handle *domain_handle,
5529 struct policy_handle *group_handle)
5530 {
5531 NTSTATUS status;
5532 struct samr_AddGroupMember r;
5533 struct samr_DeleteGroupMember d;
5534 struct samr_QueryGroupMember q;
5535 struct samr_RidTypeArray *rids = NULL;
5536 struct samr_SetMemberAttributesOfGroup s;
5537 uint32_t rid;
5538
5539 status = test_LookupName(p, tctx, domain_handle, TEST_ACCOUNT_NAME, &rid);
5540 torture_assert_ntstatus_ok(tctx, status, "test_AddGroupMember looking up name " TEST_ACCOUNT_NAME);
5541
5542 r.in.group_handle = group_handle;
5543 r.in.rid = rid;
5544 r.in.flags = 0; /* ??? */
5545
5546 torture_comment(tctx, "Testing AddGroupMember and DeleteGroupMember\n");
5547
5548 d.in.group_handle = group_handle;
5549 d.in.rid = rid;
5550
5551 status = dcerpc_samr_DeleteGroupMember(p, tctx, &d);
5552 torture_assert_ntstatus_equal(tctx, NT_STATUS_MEMBER_NOT_IN_GROUP, status, "DeleteGroupMember");
5553
5554 status = dcerpc_samr_AddGroupMember(p, tctx, &r);
5555 torture_assert_ntstatus_ok(tctx, status, "AddGroupMember");
5556
5557 status = dcerpc_samr_AddGroupMember(p, tctx, &r);
5558 torture_assert_ntstatus_equal(tctx, NT_STATUS_MEMBER_IN_GROUP, status, "AddGroupMember");
5559
5560 if (torture_setting_bool(tctx, "samba4", false)) {
5561 torture_comment(tctx, "skipping SetMemberAttributesOfGroup test against Samba4\n");
5562 } else {
5563 /* this one is quite strange. I am using random inputs in the
5564 hope of triggering an error that might give us a clue */
5565
5566 s.in.group_handle = group_handle;
5567 s.in.unknown1 = random();
5568 s.in.unknown2 = random();
5569
5570 status = dcerpc_samr_SetMemberAttributesOfGroup(p, tctx, &s);
5571 torture_assert_ntstatus_ok(tctx, status, "SetMemberAttributesOfGroup");
5572 }
5573
5574 q.in.group_handle = group_handle;
5575 q.out.rids = &rids;
5576
5577 status = dcerpc_samr_QueryGroupMember(p, tctx, &q);
5578 torture_assert_ntstatus_ok(tctx, status, "QueryGroupMember");
5579
5580 status = dcerpc_samr_DeleteGroupMember(p, tctx, &d);
5581 torture_assert_ntstatus_ok(tctx, status, "DeleteGroupMember");
5582
5583 status = dcerpc_samr_AddGroupMember(p, tctx, &r);
5584 torture_assert_ntstatus_ok(tctx, status, "AddGroupMember");
5585
5586 return true;
5587 }
5588
5589
5590 static bool test_CreateDomainGroup(struct dcerpc_pipe *p,
5591 struct torture_context *tctx,
5592 struct policy_handle *domain_handle,
5593 struct policy_handle *group_handle,
5594 struct dom_sid *domain_sid)
5595 {
5596 NTSTATUS status;
5597 struct samr_CreateDomainGroup r;
5598 uint32_t rid;
5599 struct lsa_String name;
5600 bool ret = true;
5601
5602 init_lsa_String(&name, TEST_GROUPNAME);
5603
5604 r.in.domain_handle = domain_handle;
5605 r.in.name = &name;
5606 r.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
5607 r.out.group_handle = group_handle;
5608 r.out.rid = &rid;
5609
5610 printf("Testing CreateDomainGroup(%s)\n", r.in.name->string);
5611
5612 status = dcerpc_samr_CreateDomainGroup(p, tctx, &r);
5613
5614 if (dom_sid_equal(domain_sid, dom_sid_parse_talloc(tctx, SID_BUILTIN))) {
5615 if (NT_STATUS_EQUAL(status, NT_STATUS_ACCESS_DENIED)) {
5616 torture_comment(tctx, "Server correctly refused create of '%s'\n", r.in.name->string);
5617 return true;
5618 } else {
5619 printf("Server should have refused create of '%s', got %s instead\n", r.in.name->string,
5620 nt_errstr(status));
5621 return false;
5622 }
5623 }
5624
5625 if (NT_STATUS_EQUAL(status, NT_STATUS_GROUP_EXISTS)) {
5626 if (!test_DeleteGroup_byname(p, tctx, domain_handle, r.in.name->string)) {
5627 printf("CreateDomainGroup failed: Could not delete domain group %s - %s\n", r.in.name->string,
5628 nt_errstr(status));
5629 return false;
5630 }
5631 status = dcerpc_samr_CreateDomainGroup(p, tctx, &r);
5632 }
5633 if (NT_STATUS_EQUAL(status, NT_STATUS_USER_EXISTS)) {
5634 if (!test_DeleteUser_byname(p, tctx, domain_handle, r.in.name->string)) {
5635
5636 printf("CreateDomainGroup failed: Could not delete user %s - %s\n", r.in.name->string,
5637 nt_errstr(status));
5638 return false;
5639 }
5640 status = dcerpc_samr_CreateDomainGroup(p, tctx, &r);
5641 }
5642 torture_assert_ntstatus_ok(tctx, status, "CreateDomainGroup");
5643
5644 if (!test_AddGroupMember(p, tctx, domain_handle, group_handle)) {
5645 printf("CreateDomainGroup failed - %s\n", nt_errstr(status));
5646 ret = false;
5647 }
5648
5649 if (!test_SetGroupInfo(p, tctx, group_handle)) {
5650 ret = false;
5651 }
5652
5653 return ret;
5654 }
5655
5656
5657 /*
5658 its not totally clear what this does. It seems to accept any sid you like.
5659 */
5660 static bool test_RemoveMemberFromForeignDomain(struct dcerpc_pipe *p,
5661 struct torture_context *tctx,
5662 struct policy_handle *domain_handle)
5663 {
5664 NTSTATUS status;
5665 struct samr_RemoveMemberFromForeignDomain r;
5666
5667 r.in.domain_handle = domain_handle;
5668 r.in.sid = dom_sid_parse_talloc(tctx, "S-1-5-32-12-34-56-78");
5669
5670 status = dcerpc_samr_RemoveMemberFromForeignDomain(p, tctx, &r);
5671 torture_assert_ntstatus_ok(tctx, status, "RemoveMemberFromForeignDomain");
5672
5673 return true;
5674 }
5675
5676
5677
5678 static bool test_Connect(struct dcerpc_pipe *p, struct torture_context *tctx,
5679 struct policy_handle *handle);
5680
5681 static bool test_OpenDomain(struct dcerpc_pipe *p, struct torture_context *tctx,
5682 struct policy_handle *handle, struct dom_sid *sid,
5683 enum torture_samr_choice which_ops,
5684 struct cli_credentials *machine_credentials)
5685 {
5686 NTSTATUS status;
5687 struct samr_OpenDomain r;
5688 struct policy_handle domain_handle;
5689 struct policy_handle alias_handle;
5690 struct policy_handle user_handle;
5691 struct policy_handle group_handle;
5692 bool ret = true;
5693
5694 ZERO_STRUCT(alias_handle);
5695 ZERO_STRUCT(user_handle);
5696 ZERO_STRUCT(group_handle);
5697 ZERO_STRUCT(domain_handle);
5698
5699 torture_comment(tctx, "Testing OpenDomain of %s\n", dom_sid_string(tctx, sid));
5700
5701 r.in.connect_handle = handle;
5702 r.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
5703 r.in.sid = sid;
5704 r.out.domain_handle = &domain_handle;
5705
5706 status = dcerpc_samr_OpenDomain(p, tctx, &r);
5707 torture_assert_ntstatus_ok(tctx, status, "OpenDomain");
5708
5709 /* run the domain tests with the main handle closed - this tests
5710 the servers reference counting */
5711 ret &= test_samr_handle_Close(p, tctx, handle);
5712
5713 switch (which_ops) {
5714 case TORTURE_SAMR_USER_ATTRIBUTES:
5715 case TORTURE_SAMR_PASSWORDS:
5716 if (!torture_setting_bool(tctx, "samba3", false)) {
5717 ret &= test_CreateUser2(p, tctx, &domain_handle, sid, which_ops, NULL);
5718 }
5719 ret &= test_CreateUser(p, tctx, &domain_handle, &user_handle, sid, which_ops, NULL);
5720 /* This test needs 'complex' users to validate */
5721 ret &= test_QueryDisplayInfo(p, tctx, &domain_handle);
5722 if (!ret) {
5723 printf("Testing PASSWORDS or ATTRIBUTES on domain %s failed!\n", dom_sid_string(tctx, sid));
5724 }
5725 break;
5726 case TORTURE_SAMR_PASSWORDS_PWDLASTSET:
5727 if (!torture_setting_bool(tctx, "samba3", false)) {
5728 ret &= test_CreateUser2(p, tctx, &domain_handle, sid, which_ops, machine_credentials);
5729 }
5730 ret &= test_CreateUser(p, tctx, &domain_handle, &user_handle, sid, which_ops, machine_credentials);
5731 if (!ret) {
5732 printf("Testing PASSWORDS PWDLASTSET on domain %s failed!\n", dom_sid_string(tctx, sid));
5733 }
5734 break;
5735 case TORTURE_SAMR_OTHER:
5736 ret &= test_CreateUser(p, tctx, &domain_handle, &user_handle, sid, which_ops, NULL);
5737 if (!ret) {
5738 printf("Failed to CreateUser in SAMR-OTHER on domain %s!\n", dom_sid_string(tctx, sid));
5739 }
5740 ret &= test_QuerySecurity(p, tctx, &domain_handle);
5741 ret &= test_RemoveMemberFromForeignDomain(p, tctx, &domain_handle);
5742 ret &= test_CreateAlias(p, tctx, &domain_handle, &alias_handle, sid);
5743 ret &= test_CreateDomainGroup(p, tctx, &domain_handle, &group_handle, sid);
5744 ret &= test_QueryDomainInfo(p, tctx, &domain_handle);
5745 ret &= test_QueryDomainInfo2(p, tctx, &domain_handle);
5746 ret &= test_EnumDomainUsers(p, tctx, &domain_handle);
5747 ret &= test_EnumDomainUsers_async(p, tctx, &domain_handle);
5748 ret &= test_EnumDomainGroups(p, tctx, &domain_handle);
5749 ret &= test_EnumDomainAliases(p, tctx, &domain_handle);
5750 ret &= test_QueryDisplayInfo2(p, tctx, &domain_handle);
5751 ret &= test_QueryDisplayInfo3(p, tctx, &domain_handle);
5752 ret &= test_QueryDisplayInfo_continue(p, tctx, &domain_handle);
5753
5754 if (torture_setting_bool(tctx, "samba4", false)) {
5755 torture_comment(tctx, "skipping GetDisplayEnumerationIndex test against Samba4\n");
5756 } else {
5757 ret &= test_GetDisplayEnumerationIndex(p, tctx, &domain_handle);
5758 ret &= test_GetDisplayEnumerationIndex2(p, tctx, &domain_handle);
5759 }
5760 ret &= test_GroupList(p, tctx, &domain_handle);
5761 ret &= test_TestPrivateFunctionsDomain(p, tctx, &domain_handle);
5762 ret &= test_RidToSid(p, tctx, sid, &domain_handle);
5763 ret &= test_GetBootKeyInformation(p, tctx, &domain_handle);
5764 if (!ret) {
5765 torture_comment(tctx, "Testing SAMR-OTHER on domain %s failed!\n", dom_sid_string(tctx, sid));
5766 }
5767 break;
5768 }
5769
5770 if (!policy_handle_empty(&user_handle) &&
5771 !test_DeleteUser(p, tctx, &user_handle)) {
5772 ret = false;
5773 }
5774
5775 if (!policy_handle_empty(&alias_handle) &&
5776 !test_DeleteAlias(p, tctx, &alias_handle)) {
5777 ret = false;
5778 }
5779
5780 if (!policy_handle_empty(&group_handle) &&
5781 !test_DeleteDomainGroup(p, tctx, &group_handle)) {
5782 ret = false;
5783 }
5784
5785 ret &= test_samr_handle_Close(p, tctx, &domain_handle);
5786
5787 /* reconnect the main handle */
5788 ret &= test_Connect(p, tctx, handle);
5789
5790 if (!ret) {
5791 printf("Testing domain %s failed!\n", dom_sid_string(tctx, sid));
5792 }
5793
5794 return ret;
5795 }
5796
5797 static bool test_LookupDomain(struct dcerpc_pipe *p, struct torture_context *tctx,
5798 struct policy_handle *handle, const char *domain,
5799 enum torture_samr_choice which_ops,
5800 struct cli_credentials *machine_credentials)
5801 {
5802 NTSTATUS status;
5803 struct samr_LookupDomain r;
5804 struct dom_sid2 *sid = NULL;
5805 struct lsa_String n1;
5806 struct lsa_String n2;
5807 bool ret = true;
5808
5809 torture_comment(tctx, "Testing LookupDomain(%s)\n", domain);
5810
5811 /* check for correct error codes */
5812 r.in.connect_handle = handle;
5813 r.in.domain_name = &n2;
5814 r.out.sid = &sid;
5815 n2.string = NULL;
5816
5817 status = dcerpc_samr_LookupDomain(p, tctx, &r);
5818 torture_assert_ntstatus_equal(tctx, NT_STATUS_INVALID_PARAMETER, status, "LookupDomain expected NT_STATUS_INVALID_PARAMETER");
5819
5820 init_lsa_String(&n2, "xxNODOMAINxx");
5821
5822 status = dcerpc_samr_LookupDomain(p, tctx, &r);
5823 torture_assert_ntstatus_equal(tctx, NT_STATUS_NO_SUCH_DOMAIN, status, "LookupDomain expected NT_STATUS_NO_SUCH_DOMAIN");
5824
5825 r.in.connect_handle = handle;
5826
5827 init_lsa_String(&n1, domain);
5828 r.in.domain_name = &n1;
5829
5830 status = dcerpc_samr_LookupDomain(p, tctx, &r);
5831 torture_assert_ntstatus_ok(tctx, status, "LookupDomain");
5832
5833 if (!test_GetDomPwInfo(p, tctx, &n1)) {
5834 ret = false;
5835 }
5836
5837 if (!test_OpenDomain(p, tctx, handle, *r.out.sid, which_ops,
5838 machine_credentials)) {
5839 ret = false;
5840 }
5841
5842 return ret;
5843 }
5844
5845
5846 static bool test_EnumDomains(struct dcerpc_pipe *p, struct torture_context *tctx,
5847 struct policy_handle *handle, enum torture_samr_choice which_ops,
5848 struct cli_credentials *machine_credentials)
5849 {
5850 NTSTATUS status;
5851 struct samr_EnumDomains r;
5852 uint32_t resume_handle = 0;
5853 uint32_t num_entries = 0;
5854 struct samr_SamArray *sam = NULL;
5855 int i;
5856 bool ret = true;
5857
5858 r.in.connect_handle = handle;
5859 r.in.resume_handle = &resume_handle;
5860 r.in.buf_size = (uint32_t)-1;
5861 r.out.resume_handle = &resume_handle;
5862 r.out.num_entries = &num_entries;
5863 r.out.sam = &sam;
5864
5865 status = dcerpc_samr_EnumDomains(p, tctx, &r);
5866 torture_assert_ntstatus_ok(tctx, status, "EnumDomains");
5867
5868 if (!*r.out.sam) {
5869 return false;
5870 }
5871
5872 for (i=0;i<sam->count;i++) {
5873 if (!test_LookupDomain(p, tctx, handle,
5874 sam->entries[i].name.string, which_ops,
5875 machine_credentials)) {
5876 ret = false;
5877 }
5878 }
5879
5880 status = dcerpc_samr_EnumDomains(p, tctx, &r);
5881 torture_assert_ntstatus_ok(tctx, status, "EnumDomains");
5882
5883 return ret;
5884 }
5885
5886
5887 static bool test_Connect(struct dcerpc_pipe *p, struct torture_context *tctx,
5888 struct policy_handle *handle)
5889 {
5890 NTSTATUS status;
5891 struct samr_Connect r;
5892 struct samr_Connect2 r2;
5893 struct samr_Connect3 r3;
5894 struct samr_Connect4 r4;
5895 struct samr_Connect5 r5;
5896 union samr_ConnectInfo info;
5897 struct policy_handle h;
5898 uint32_t level_out = 0;
5899 bool ret = true, got_handle = false;
5900
5901 torture_comment(tctx, "testing samr_Connect\n");
5902
5903 r.in.system_name = 0;
5904 r.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
5905 r.out.connect_handle = &h;
5906
5907 status = dcerpc_samr_Connect(p, tctx, &r);
5908 if (!NT_STATUS_IS_OK(status)) {
5909 torture_comment(tctx, "Connect failed - %s\n", nt_errstr(status));
5910 ret = false;
5911 } else {
5912 got_handle = true;
5913 *handle = h;
5914 }
5915
5916 torture_comment(tctx, "testing samr_Connect2\n");
5917
5918 r2.in.system_name = NULL;
5919 r2.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
5920 r2.out.connect_handle = &h;
5921
5922 status = dcerpc_samr_Connect2(p, tctx, &r2);
5923 if (!NT_STATUS_IS_OK(status)) {
5924 torture_comment(tctx, "Connect2 failed - %s\n", nt_errstr(status));
5925 ret = false;
5926 } else {
5927 if (got_handle) {
5928 test_samr_handle_Close(p, tctx, handle);
5929 }
5930 got_handle = true;
5931 *handle = h;
5932 }
5933
5934 torture_comment(tctx, "testing samr_Connect3\n");
5935
5936 r3.in.system_name = NULL;
5937 r3.in.unknown = 0;
5938 r3.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
5939 r3.out.connect_handle = &h;
5940
5941 status = dcerpc_samr_Connect3(p, tctx, &r3);
5942 if (!NT_STATUS_IS_OK(status)) {
5943 printf("Connect3 failed - %s\n", nt_errstr(status));
5944 ret = false;
5945 } else {
5946 if (got_handle) {
5947 test_samr_handle_Close(p, tctx, handle);
5948 }
5949 got_handle = true;
5950 *handle = h;
5951 }
5952
5953 torture_comment(tctx, "testing samr_Connect4\n");
5954
5955 r4.in.system_name = "";
5956 r4.in.client_version = 0;
5957 r4.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
5958 r4.out.connect_handle = &h;
5959
5960 status = dcerpc_samr_Connect4(p, tctx, &r4);
5961 if (!NT_STATUS_IS_OK(status)) {
5962 printf("Connect4 failed - %s\n", nt_errstr(status));
5963 ret = false;
5964 } else {
5965 if (got_handle) {
5966 test_samr_handle_Close(p, tctx, handle);
5967 }
5968 got_handle = true;
5969 *handle = h;
5970 }
5971
5972 torture_comment(tctx, "testing samr_Connect5\n");
5973
5974 info.info1.client_version = 0;
5975 info.info1.unknown2 = 0;
5976
5977 r5.in.system_name = "";
5978 r5.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
5979 r5.in.level_in = 1;
5980 r5.out.level_out = &level_out;
5981 r5.in.info_in = &info;
5982 r5.out.info_out = &info;
5983 r5.out.connect_handle = &h;
5984
5985 status = dcerpc_samr_Connect5(p, tctx, &r5);
5986 if (!NT_STATUS_IS_OK(status)) {
5987 printf("Connect5 failed - %s\n", nt_errstr(status));
5988 ret = false;
5989 } else {
5990 if (got_handle) {
5991 test_samr_handle_Close(p, tctx, handle);
5992 }
5993 got_handle = true;
5994 *handle = h;
5995 }
5996
5997 return ret;
5998 }
5999
6000
6001 bool torture_rpc_samr(struct torture_context *torture)
6002 {
6003 NTSTATUS status;
6004 struct dcerpc_pipe *p;
6005 bool ret = true;
6006 struct policy_handle handle;
6007
6008 status = torture_rpc_connection(torture, &p, &ndr_table_samr);
6009 if (!NT_STATUS_IS_OK(status)) {
6010 return false;
6011 }
6012
6013 ret &= test_Connect(p, torture, &handle);
6014
6015 ret &= test_QuerySecurity(p, torture, &handle);
6016
6017 ret &= test_EnumDomains(p, torture, &handle, TORTURE_SAMR_OTHER, NULL);
6018
6019 ret &= test_SetDsrmPassword(p, torture, &handle);
6020
6021 ret &= test_Shutdown(p, torture, &handle);
6022
6023 ret &= test_samr_handle_Close(p, torture, &handle);
6024
6025 return ret;
6026 }
6027
6028
6029 bool torture_rpc_samr_users(struct torture_context *torture)
6030 {
6031 NTSTATUS status;
6032 struct dcerpc_pipe *p;
6033 bool ret = true;
6034 struct policy_handle handle;
6035
6036 status = torture_rpc_connection(torture, &p, &ndr_table_samr);
6037 if (!NT_STATUS_IS_OK(status)) {
6038 return false;
6039 }
6040
6041 ret &= test_Connect(p, torture, &handle);
6042
6043 if (!torture_setting_bool(torture, "samba3", false)) {
6044 ret &= test_QuerySecurity(p, torture, &handle);
6045 }
6046
6047 ret &= test_EnumDomains(p, torture, &handle, TORTURE_SAMR_USER_ATTRIBUTES, NULL);
6048
6049 ret &= test_SetDsrmPassword(p, torture, &handle);
6050
6051 ret &= test_Shutdown(p, torture, &handle);
6052
6053 ret &= test_samr_handle_Close(p, torture, &handle);
6054
6055 return ret;
6056 }
6057
6058
6059 bool torture_rpc_samr_passwords(struct torture_context *torture)
6060 {
6061 NTSTATUS status;
6062 struct dcerpc_pipe *p;
6063 bool ret = true;
6064 struct policy_handle handle;
6065
6066 status = torture_rpc_connection(torture, &p, &ndr_table_samr);
6067 if (!NT_STATUS_IS_OK(status)) {
6068 return false;
6069 }
6070
6071 ret &= test_Connect(p, torture, &handle);
6072
6073 ret &= test_EnumDomains(p, torture, &handle, TORTURE_SAMR_PASSWORDS, NULL);
6074
6075 ret &= test_samr_handle_Close(p, torture, &handle);
6076
6077 return ret;
6078 }
6079
6080 static bool torture_rpc_samr_pwdlastset(struct torture_context *torture,
6081 struct dcerpc_pipe *p2,
6082 struct cli_credentials *machine_credentials)
6083 {
6084 NTSTATUS status;
6085 struct dcerpc_pipe *p;
6086 bool ret = true;
6087 struct policy_handle handle;
6088
6089 status = torture_rpc_connection(torture, &p, &ndr_table_samr);
6090 if (!NT_STATUS_IS_OK(status)) {
6091 return false;
6092 }
6093
6094 ret &= test_Connect(p, torture, &handle);
6095
6096 ret &= test_EnumDomains(p, torture, &handle,
6097 TORTURE_SAMR_PASSWORDS_PWDLASTSET,
6098 machine_credentials);
6099
6100 ret &= test_samr_handle_Close(p, torture, &handle);
6101
6102 return ret;
6103 }
6104
6105 struct torture_suite *torture_rpc_samr_passwords_pwdlastset(struct torture_context *tctx)
6106 {
6107 struct torture_suite *suite = torture_suite_create(tctx, "SAMR-PASSWORDS-PWDLASTSET");
6108 struct torture_rpc_tcase *tcase;
6109
6110 tcase = torture_suite_add_machine_rpc_iface_tcase(suite, "samr",
6111 &ndr_table_samr,
6112 TEST_ACCOUNT_NAME_PWD);
6113
6114 torture_rpc_tcase_add_test_creds(tcase, "pwdLastSet",
6115 torture_rpc_samr_pwdlastset);
6116
6117 return suite;
6118 }
Samba GIT mirror