2 Unix SMB/CIFS implementation.
4 dcerpc torture tests, designed to walk Samba3 code paths
6 Copyright (C) Volker Lendecke 2006
8 This program is free software; you can redistribute it and/or modify
9 it under the terms of the GNU General Public License as published by
10 the Free Software Foundation; either version 2 of the License, or
11 (at your option) any later version.
13 This program is distributed in the hope that it will be useful,
14 but WITHOUT ANY WARRANTY; without even the implied warranty of
15 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
16 GNU General Public License for more details.
18 You should have received a copy of the GNU General Public License
19 along with this program; if not, write to the Free Software
20 Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
24 #include "libcli/raw/libcliraw.h"
25 #include "torture/torture.h"
26 #include "torture/util.h"
27 #include "librpc/gen_ndr/ndr_lsa.h"
28 #include "librpc/gen_ndr/ndr_lsa_c.h"
29 #include "librpc/gen_ndr/ndr_samr.h"
30 #include "librpc/gen_ndr/ndr_samr_c.h"
31 #include "librpc/gen_ndr/ndr_netlogon.h"
32 #include "librpc/gen_ndr/ndr_netlogon_c.h"
33 #include "librpc/gen_ndr/ndr_srvsvc.h"
34 #include "librpc/gen_ndr/ndr_srvsvc_c.h"
35 #include "librpc/gen_ndr/ndr_spoolss.h"
36 #include "librpc/gen_ndr/ndr_spoolss_c.h"
37 #include "lib/cmdline/popt_common.h"
38 #include "librpc/rpc/dcerpc.h"
39 #include "torture/rpc/rpc.h"
40 #include "libcli/libcli.h"
41 #include "libcli/composite/composite.h"
42 #include "libcli/smb_composite/smb_composite.h"
43 #include "libcli/auth/libcli_auth.h"
44 #include "libcli/auth/credentials.h"
45 #include "lib/crypto/crypto.h"
46 #include "libcli/security/proto.h"
48 static struct cli_credentials
*create_anon_creds(TALLOC_CTX
*mem_ctx
)
50 struct cli_credentials
*result
;
52 if (!(result
= cli_credentials_init(mem_ctx
))) {
56 cli_credentials_set_conf(result
);
57 cli_credentials_set_anonymous(result
);
63 * This tests a RPC call using an invalid vuid
66 BOOL
torture_bind_authcontext(struct torture_context
*torture
)
71 struct lsa_ObjectAttribute objectattr
;
72 struct lsa_OpenPolicy2 openpolicy
;
73 struct policy_handle handle
;
74 struct lsa_Close close_handle
;
75 struct smbcli_session
*tmp
;
76 struct smbcli_session
*session2
;
77 struct smbcli_state
*cli
;
78 struct dcerpc_pipe
*lsa_pipe
;
79 struct cli_credentials
*anon_creds
;
80 struct smb_composite_sesssetup setup
;
82 mem_ctx
= talloc_init("torture_bind_authcontext");
84 if (mem_ctx
== NULL
) {
85 d_printf("talloc_init failed\n");
89 status
= smbcli_full_connection(mem_ctx
, &cli
,
90 lp_parm_string(-1, "torture", "host"),
91 "IPC$", NULL
, cmdline_credentials
,
93 if (!NT_STATUS_IS_OK(status
)) {
94 d_printf("smbcli_full_connection failed: %s\n",
99 lsa_pipe
= dcerpc_pipe_init(mem_ctx
, cli
->transport
->socket
->event
.ctx
);
100 if (lsa_pipe
== NULL
) {
101 d_printf("dcerpc_pipe_init failed\n");
105 status
= dcerpc_pipe_open_smb(lsa_pipe
->conn
, cli
->tree
, "\\lsarpc");
106 if (!NT_STATUS_IS_OK(status
)) {
107 d_printf("dcerpc_pipe_open_smb failed: %s\n",
112 status
= dcerpc_bind_auth_none(lsa_pipe
, &dcerpc_table_lsarpc
);
113 if (!NT_STATUS_IS_OK(status
)) {
114 d_printf("dcerpc_bind_auth_none failed: %s\n",
119 openpolicy
.in
.system_name
=talloc_asprintf(
120 mem_ctx
, "\\\\%s", dcerpc_server_name(lsa_pipe
));
121 ZERO_STRUCT(objectattr
);
122 openpolicy
.in
.attr
= &objectattr
;
123 openpolicy
.in
.access_mask
= SEC_FLAG_MAXIMUM_ALLOWED
;
124 openpolicy
.out
.handle
= &handle
;
126 status
= dcerpc_lsa_OpenPolicy2(lsa_pipe
, mem_ctx
, &openpolicy
);
128 if (!NT_STATUS_IS_OK(status
)) {
129 d_printf("dcerpc_lsa_OpenPolicy2 failed: %s\n",
134 close_handle
.in
.handle
= &handle
;
135 close_handle
.out
.handle
= &handle
;
137 status
= dcerpc_lsa_Close(lsa_pipe
, mem_ctx
, &close_handle
);
138 if (!NT_STATUS_IS_OK(status
)) {
139 d_printf("dcerpc_lsa_Close failed: %s\n",
144 session2
= smbcli_session_init(cli
->transport
, mem_ctx
, False
);
145 if (session2
== NULL
) {
146 d_printf("smbcli_session_init failed\n");
150 if (!(anon_creds
= create_anon_creds(mem_ctx
))) {
151 d_printf("create_anon_creds failed\n");
155 setup
.in
.sesskey
= cli
->transport
->negotiate
.sesskey
;
156 setup
.in
.capabilities
= cli
->transport
->negotiate
.capabilities
;
157 setup
.in
.workgroup
= "";
158 setup
.in
.credentials
= anon_creds
;
160 status
= smb_composite_sesssetup(session2
, &setup
);
161 if (!NT_STATUS_IS_OK(status
)) {
162 d_printf("anon session setup failed: %s\n",
167 tmp
= cli
->tree
->session
;
168 cli
->tree
->session
= session2
;
170 status
= dcerpc_lsa_OpenPolicy2(lsa_pipe
, mem_ctx
, &openpolicy
);
172 cli
->tree
->session
= tmp
;
173 talloc_free(lsa_pipe
);
176 if (!NT_STATUS_EQUAL(status
, NT_STATUS_INVALID_HANDLE
)) {
177 d_printf("dcerpc_lsa_OpenPolicy2 with wrong vuid gave %s, "
178 "expected NT_STATUS_INVALID_HANDLE\n",
185 talloc_free(mem_ctx
);
190 * Bind to lsa using a specific auth method
193 static BOOL
bindtest(struct smbcli_state
*cli
,
194 struct cli_credentials
*credentials
,
195 uint8_t auth_type
, uint8_t auth_level
)
201 struct dcerpc_pipe
*lsa_pipe
;
202 struct lsa_ObjectAttribute objectattr
;
203 struct lsa_OpenPolicy2 openpolicy
;
204 struct lsa_QueryInfoPolicy query
;
205 struct policy_handle handle
;
206 struct lsa_Close close_handle
;
208 if ((mem_ctx
= talloc_init("bindtest")) == NULL
) {
209 d_printf("talloc_init failed\n");
213 lsa_pipe
= dcerpc_pipe_init(mem_ctx
,
214 cli
->transport
->socket
->event
.ctx
);
215 if (lsa_pipe
== NULL
) {
216 d_printf("dcerpc_pipe_init failed\n");
220 status
= dcerpc_pipe_open_smb(lsa_pipe
->conn
, cli
->tree
, "\\lsarpc");
221 if (!NT_STATUS_IS_OK(status
)) {
222 d_printf("dcerpc_pipe_open_smb failed: %s\n",
227 status
= dcerpc_bind_auth(lsa_pipe
, &dcerpc_table_lsarpc
,
228 credentials
, auth_type
, auth_level
,
230 if (!NT_STATUS_IS_OK(status
)) {
231 d_printf("dcerpc_bind_auth failed: %s\n", nt_errstr(status
));
235 openpolicy
.in
.system_name
=talloc_asprintf(
236 mem_ctx
, "\\\\%s", dcerpc_server_name(lsa_pipe
));
237 ZERO_STRUCT(objectattr
);
238 openpolicy
.in
.attr
= &objectattr
;
239 openpolicy
.in
.access_mask
= SEC_FLAG_MAXIMUM_ALLOWED
;
240 openpolicy
.out
.handle
= &handle
;
242 status
= dcerpc_lsa_OpenPolicy2(lsa_pipe
, mem_ctx
, &openpolicy
);
244 if (!NT_STATUS_IS_OK(status
)) {
245 d_printf("dcerpc_lsa_OpenPolicy2 failed: %s\n",
250 query
.in
.handle
= &handle
;
251 query
.in
.level
= LSA_POLICY_INFO_DOMAIN
;
253 status
= dcerpc_lsa_QueryInfoPolicy(lsa_pipe
, mem_ctx
, &query
);
254 if (!NT_STATUS_IS_OK(status
)) {
255 d_printf("dcerpc_lsa_QueryInfoPolicy failed: %s\n",
260 close_handle
.in
.handle
= &handle
;
261 close_handle
.out
.handle
= &handle
;
263 status
= dcerpc_lsa_Close(lsa_pipe
, mem_ctx
, &close_handle
);
264 if (!NT_STATUS_IS_OK(status
)) {
265 d_printf("dcerpc_lsa_Close failed: %s\n",
272 talloc_free(mem_ctx
);
277 * test authenticated RPC binds with the variants Samba3 does support
280 BOOL
torture_bind_samba3(struct torture_context
*torture
)
285 struct smbcli_state
*cli
;
287 mem_ctx
= talloc_init("torture_bind_authcontext");
289 if (mem_ctx
== NULL
) {
290 d_printf("talloc_init failed\n");
294 status
= smbcli_full_connection(mem_ctx
, &cli
,
295 lp_parm_string(-1, "torture", "host"),
296 "IPC$", NULL
, cmdline_credentials
,
298 if (!NT_STATUS_IS_OK(status
)) {
299 d_printf("smbcli_full_connection failed: %s\n",
306 ret
&= bindtest(cli
, cmdline_credentials
, DCERPC_AUTH_TYPE_NTLMSSP
,
307 DCERPC_AUTH_LEVEL_INTEGRITY
);
308 ret
&= bindtest(cli
, cmdline_credentials
, DCERPC_AUTH_TYPE_NTLMSSP
,
309 DCERPC_AUTH_LEVEL_PRIVACY
);
310 ret
&= bindtest(cli
, cmdline_credentials
, DCERPC_AUTH_TYPE_SPNEGO
,
311 DCERPC_AUTH_LEVEL_INTEGRITY
);
312 ret
&= bindtest(cli
, cmdline_credentials
, DCERPC_AUTH_TYPE_SPNEGO
,
313 DCERPC_AUTH_LEVEL_PRIVACY
);
316 talloc_free(mem_ctx
);
321 * Lookup or create a user and return all necessary info
324 static NTSTATUS
get_usr_handle(struct smbcli_state
*cli
,
326 struct cli_credentials
*admin_creds
,
329 const char *username
,
331 struct dcerpc_pipe
**result_pipe
,
332 struct policy_handle
**result_handle
,
333 struct dom_sid
**sid
)
335 struct dcerpc_pipe
*samr_pipe
;
337 struct policy_handle conn_handle
;
338 struct policy_handle domain_handle
;
339 struct policy_handle
*user_handle
;
340 struct samr_Connect2 conn
;
341 struct samr_EnumDomains enumdom
;
342 uint32_t resume_handle
= 0;
343 struct samr_LookupDomain l
;
345 struct lsa_String domain_name
;
346 struct lsa_String user_name
;
347 struct samr_OpenDomain o
;
348 struct samr_CreateUser2 c
;
349 uint32_t user_rid
,access_granted
;
351 samr_pipe
= dcerpc_pipe_init(mem_ctx
,
352 cli
->transport
->socket
->event
.ctx
);
353 if (samr_pipe
== NULL
) {
354 d_printf("dcerpc_pipe_init failed\n");
355 status
= NT_STATUS_NO_MEMORY
;
359 status
= dcerpc_pipe_open_smb(samr_pipe
->conn
, cli
->tree
, "\\samr");
360 if (!NT_STATUS_IS_OK(status
)) {
361 d_printf("dcerpc_pipe_open_smb failed: %s\n",
366 if (admin_creds
!= NULL
) {
367 status
= dcerpc_bind_auth(samr_pipe
, &dcerpc_table_samr
,
368 admin_creds
, auth_type
, auth_level
,
370 if (!NT_STATUS_IS_OK(status
)) {
371 d_printf("dcerpc_bind_auth failed: %s\n",
376 /* We must have an authenticated SMB connection */
377 status
= dcerpc_bind_auth_none(samr_pipe
, &dcerpc_table_samr
);
378 if (!NT_STATUS_IS_OK(status
)) {
379 d_printf("dcerpc_bind_auth_none failed: %s\n",
385 conn
.in
.system_name
= talloc_asprintf(
386 mem_ctx
, "\\\\%s", dcerpc_server_name(samr_pipe
));
387 conn
.in
.access_mask
= SEC_FLAG_MAXIMUM_ALLOWED
;
388 conn
.out
.connect_handle
= &conn_handle
;
390 status
= dcerpc_samr_Connect2(samr_pipe
, mem_ctx
, &conn
);
391 if (!NT_STATUS_IS_OK(status
)) {
392 d_printf("samr_Connect2 failed: %s\n", nt_errstr(status
));
396 enumdom
.in
.connect_handle
= &conn_handle
;
397 enumdom
.in
.resume_handle
= &resume_handle
;
398 enumdom
.in
.buf_size
= (uint32_t)-1;
399 enumdom
.out
.resume_handle
= &resume_handle
;
401 status
= dcerpc_samr_EnumDomains(samr_pipe
, mem_ctx
, &enumdom
);
402 if (!NT_STATUS_IS_OK(status
)) {
403 d_printf("samr_EnumDomains failed: %s\n", nt_errstr(status
));
407 if (enumdom
.out
.num_entries
!= 2) {
408 d_printf("samr_EnumDomains returned %d entries, expected 2\n",
409 enumdom
.out
.num_entries
);
410 status
= NT_STATUS_UNSUCCESSFUL
;
414 dom_idx
= strequal(enumdom
.out
.sam
->entries
[0].name
.string
,
417 l
.in
.connect_handle
= &conn_handle
;
418 domain_name
.string
= enumdom
.out
.sam
->entries
[0].name
.string
;
419 *domain
= talloc_strdup(mem_ctx
, domain_name
.string
);
420 l
.in
.domain_name
= &domain_name
;
422 status
= dcerpc_samr_LookupDomain(samr_pipe
, mem_ctx
, &l
);
423 if (!NT_STATUS_IS_OK(status
)) {
424 d_printf("samr_LookupDomain failed: %s\n", nt_errstr(status
));
428 o
.in
.connect_handle
= &conn_handle
;
429 o
.in
.access_mask
= SEC_FLAG_MAXIMUM_ALLOWED
;
430 o
.in
.sid
= l
.out
.sid
;
431 o
.out
.domain_handle
= &domain_handle
;
433 status
= dcerpc_samr_OpenDomain(samr_pipe
, mem_ctx
, &o
);
434 if (!NT_STATUS_IS_OK(status
)) {
435 d_printf("samr_OpenDomain failed: %s\n", nt_errstr(status
));
439 c
.in
.domain_handle
= &domain_handle
;
440 user_name
.string
= username
;
441 c
.in
.account_name
= &user_name
;
442 c
.in
.acct_flags
= ACB_NORMAL
;
443 c
.in
.access_mask
= SEC_FLAG_MAXIMUM_ALLOWED
;
444 user_handle
= talloc(mem_ctx
, struct policy_handle
);
445 c
.out
.user_handle
= user_handle
;
446 c
.out
.access_granted
= &access_granted
;
447 c
.out
.rid
= &user_rid
;
449 status
= dcerpc_samr_CreateUser2(samr_pipe
, mem_ctx
, &c
);
451 if (NT_STATUS_EQUAL(status
, NT_STATUS_USER_EXISTS
)) {
452 struct samr_LookupNames ln
;
453 struct samr_OpenUser ou
;
455 ln
.in
.domain_handle
= &domain_handle
;
457 ln
.in
.names
= &user_name
;
459 status
= dcerpc_samr_LookupNames(samr_pipe
, mem_ctx
, &ln
);
460 if (!NT_STATUS_IS_OK(status
)) {
461 d_printf("samr_LookupNames failed: %s\n",
466 ou
.in
.domain_handle
= &domain_handle
;
467 ou
.in
.access_mask
= SEC_FLAG_MAXIMUM_ALLOWED
;
468 user_rid
= ou
.in
.rid
= ln
.out
.rids
.ids
[0];
469 ou
.out
.user_handle
= user_handle
;
471 status
= dcerpc_samr_OpenUser(samr_pipe
, mem_ctx
, &ou
);
472 if (!NT_STATUS_IS_OK(status
)) {
473 d_printf("samr_OpenUser failed: %s\n",
479 if (!NT_STATUS_IS_OK(status
)) {
480 d_printf("samr_CreateUser failed: %s\n", nt_errstr(status
));
484 *result_pipe
= samr_pipe
;
485 *result_handle
= user_handle
;
487 *sid
= dom_sid_add_rid(mem_ctx
, l
.out
.sid
, user_rid
);
499 static BOOL
create_user(TALLOC_CTX
*mem_ctx
, struct smbcli_state
*cli
,
500 struct cli_credentials
*admin_creds
,
501 const char *username
, const char *password
,
503 struct dom_sid
**user_sid
)
507 struct dcerpc_pipe
*samr_pipe
;
508 struct policy_handle
*wks_handle
;
511 if (!(tmp_ctx
= talloc_new(mem_ctx
))) {
512 d_printf("talloc_init failed\n");
516 status
= get_usr_handle(cli
, tmp_ctx
, admin_creds
,
517 DCERPC_AUTH_TYPE_NTLMSSP
,
518 DCERPC_AUTH_LEVEL_INTEGRITY
,
519 username
, domain_name
, &samr_pipe
, &wks_handle
,
521 if (!NT_STATUS_IS_OK(status
)) {
522 d_printf("get_wks_handle failed: %s\n", nt_errstr(status
));
527 struct samr_SetUserInfo2 sui2
;
528 struct samr_SetUserInfo sui
;
529 struct samr_QueryUserInfo qui
;
530 union samr_UserInfo u_info
;
531 DATA_BLOB session_key
;
533 encode_pw_buffer(u_info
.info24
.password
.data
, password
,
535 u_info
.info24
.pw_len
= strlen_m(password
)*2;
537 status
= dcerpc_fetch_session_key(samr_pipe
, &session_key
);
538 if (!NT_STATUS_IS_OK(status
)) {
539 d_printf("dcerpc_fetch_session_key failed\n");
542 arcfour_crypt_blob(u_info
.info24
.password
.data
, 516,
544 sui2
.in
.user_handle
= wks_handle
;
545 sui2
.in
.info
= &u_info
;
548 status
= dcerpc_samr_SetUserInfo2(samr_pipe
, tmp_ctx
, &sui2
);
549 if (!NT_STATUS_IS_OK(status
)) {
550 d_printf("samr_SetUserInfo(24) failed: %s\n",
555 u_info
.info16
.acct_flags
= ACB_NORMAL
;
556 sui
.in
.user_handle
= wks_handle
;
557 sui
.in
.info
= &u_info
;
560 status
= dcerpc_samr_SetUserInfo(samr_pipe
, tmp_ctx
, &sui
);
561 if (!NT_STATUS_IS_OK(status
)) {
562 d_printf("samr_SetUserInfo(16) failed\n");
566 qui
.in
.user_handle
= wks_handle
;
569 status
= dcerpc_samr_QueryUserInfo(samr_pipe
, tmp_ctx
, &qui
);
570 if (!NT_STATUS_IS_OK(status
)) {
571 d_printf("samr_QueryUserInfo(21) failed\n");
575 qui
.out
.info
->info21
.allow_password_change
= 0;
576 qui
.out
.info
->info21
.force_password_change
= 0;
577 qui
.out
.info
->info21
.account_name
.string
= NULL
;
578 qui
.out
.info
->info21
.rid
= 0;
579 qui
.out
.info
->info21
.fields_present
= 0x81827fa; /* copy usrmgr.exe */
581 u_info
.info21
= qui
.out
.info
->info21
;
582 sui
.in
.user_handle
= wks_handle
;
583 sui
.in
.info
= &u_info
;
586 status
= dcerpc_samr_SetUserInfo(samr_pipe
, tmp_ctx
, &sui
);
587 if (!NT_STATUS_IS_OK(status
)) {
588 d_printf("samr_SetUserInfo(21) failed\n");
593 *domain_name
= talloc_steal(mem_ctx
, *domain_name
);
594 *user_sid
= talloc_steal(mem_ctx
, *user_sid
);
597 talloc_free(tmp_ctx
);
605 static BOOL
delete_user(struct smbcli_state
*cli
,
606 struct cli_credentials
*admin_creds
,
607 const char *username
)
612 struct dcerpc_pipe
*samr_pipe
;
613 struct policy_handle
*user_handle
;
616 if ((mem_ctx
= talloc_init("leave")) == NULL
) {
617 d_printf("talloc_init failed\n");
621 status
= get_usr_handle(cli
, mem_ctx
, admin_creds
,
622 DCERPC_AUTH_TYPE_NTLMSSP
,
623 DCERPC_AUTH_LEVEL_INTEGRITY
,
624 username
, &dom_name
, &samr_pipe
,
627 if (!NT_STATUS_IS_OK(status
)) {
628 d_printf("get_wks_handle failed: %s\n", nt_errstr(status
));
633 struct samr_DeleteUser d
;
635 d
.in
.user_handle
= user_handle
;
636 d
.out
.user_handle
= user_handle
;
638 status
= dcerpc_samr_DeleteUser(samr_pipe
, mem_ctx
, &d
);
639 if (!NT_STATUS_IS_OK(status
)) {
640 d_printf("samr_DeleteUser failed\n");
648 talloc_free(mem_ctx
);
653 * Do a Samba3-style join
656 static BOOL
join3(struct smbcli_state
*cli
,
658 struct cli_credentials
*admin_creds
,
659 struct cli_credentials
*wks_creds
)
664 struct dcerpc_pipe
*samr_pipe
;
665 struct policy_handle
*wks_handle
;
668 if ((mem_ctx
= talloc_init("join3")) == NULL
) {
669 d_printf("talloc_init failed\n");
673 status
= get_usr_handle(
674 cli
, mem_ctx
, admin_creds
,
675 DCERPC_AUTH_TYPE_NTLMSSP
,
676 DCERPC_AUTH_LEVEL_PRIVACY
,
677 talloc_asprintf(mem_ctx
, "%s$",
678 cli_credentials_get_workstation(wks_creds
)),
679 &dom_name
, &samr_pipe
, &wks_handle
, NULL
);
681 if (!NT_STATUS_IS_OK(status
)) {
682 d_printf("get_wks_handle failed: %s\n", nt_errstr(status
));
686 cli_credentials_set_domain(wks_creds
, dom_name
, CRED_SPECIFIED
);
689 struct samr_SetUserInfo2 sui2
;
690 union samr_UserInfo u_info
;
691 struct samr_UserInfo21
*i21
= &u_info
.info25
.info
;
692 DATA_BLOB session_key
;
693 DATA_BLOB confounded_session_key
= data_blob_talloc(
695 struct MD5Context ctx
;
696 uint8_t confounder
[16];
700 i21
->full_name
.string
= talloc_asprintf(
702 cli_credentials_get_workstation(wks_creds
));
703 i21
->acct_flags
= ACB_WSTRUST
;
704 i21
->fields_present
= SAMR_FIELD_FULL_NAME
|
705 SAMR_FIELD_ACCT_FLAGS
| SAMR_FIELD_PASSWORD
;
707 encode_pw_buffer(u_info
.info25
.password
.data
,
708 cli_credentials_get_password(wks_creds
),
710 status
= dcerpc_fetch_session_key(samr_pipe
, &session_key
);
711 if (!NT_STATUS_IS_OK(status
)) {
712 d_printf("dcerpc_fetch_session_key failed: %s\n",
716 generate_random_buffer((uint8_t *)confounder
, 16);
719 MD5Update(&ctx
, confounder
, 16);
720 MD5Update(&ctx
, session_key
.data
, session_key
.length
);
721 MD5Final(confounded_session_key
.data
, &ctx
);
723 arcfour_crypt_blob(u_info
.info25
.password
.data
, 516,
724 &confounded_session_key
);
725 memcpy(&u_info
.info25
.password
.data
[516], confounder
, 16);
727 sui2
.in
.user_handle
= wks_handle
;
729 sui2
.in
.info
= &u_info
;
731 status
= dcerpc_samr_SetUserInfo2(samr_pipe
, mem_ctx
, &sui2
);
732 if (!NT_STATUS_IS_OK(status
)) {
733 d_printf("samr_SetUserInfo2(25) failed: %s\n",
738 struct samr_SetUserInfo2 sui2
;
739 struct samr_SetUserInfo sui
;
740 union samr_UserInfo u_info
;
741 DATA_BLOB session_key
;
743 encode_pw_buffer(u_info
.info24
.password
.data
,
744 cli_credentials_get_password(wks_creds
),
746 u_info
.info24
.pw_len
=
747 strlen_m(cli_credentials_get_password(wks_creds
))*2;
749 status
= dcerpc_fetch_session_key(samr_pipe
, &session_key
);
750 if (!NT_STATUS_IS_OK(status
)) {
751 d_printf("dcerpc_fetch_session_key failed\n");
754 arcfour_crypt_blob(u_info
.info24
.password
.data
, 516,
756 sui2
.in
.user_handle
= wks_handle
;
757 sui2
.in
.info
= &u_info
;
760 status
= dcerpc_samr_SetUserInfo2(samr_pipe
, mem_ctx
, &sui2
);
761 if (!NT_STATUS_IS_OK(status
)) {
762 d_printf("samr_SetUserInfo(24) failed: %s\n",
767 u_info
.info16
.acct_flags
= ACB_WSTRUST
;
768 sui
.in
.user_handle
= wks_handle
;
769 sui
.in
.info
= &u_info
;
772 status
= dcerpc_samr_SetUserInfo(samr_pipe
, mem_ctx
, &sui
);
773 if (!NT_STATUS_IS_OK(status
)) {
774 d_printf("samr_SetUserInfo(16) failed\n");
782 talloc_free(mem_ctx
);
787 * Do a ReqChallenge/Auth2 and get the wks creds
790 static BOOL
auth2(struct smbcli_state
*cli
,
791 struct cli_credentials
*wks_cred
)
794 struct dcerpc_pipe
*net_pipe
;
797 struct netr_ServerReqChallenge r
;
798 struct netr_Credential netr_cli_creds
;
799 struct netr_Credential netr_srv_creds
;
800 uint32_t negotiate_flags
;
801 struct netr_ServerAuthenticate2 a
;
802 struct creds_CredentialState
*creds_state
;
803 struct netr_Credential netr_cred
;
804 struct samr_Password mach_pw
;
806 mem_ctx
= talloc_new(NULL
);
807 if (mem_ctx
== NULL
) {
808 d_printf("talloc_new failed\n");
812 net_pipe
= dcerpc_pipe_init(mem_ctx
,
813 cli
->transport
->socket
->event
.ctx
);
814 if (net_pipe
== NULL
) {
815 d_printf("dcerpc_pipe_init failed\n");
819 status
= dcerpc_pipe_open_smb(net_pipe
->conn
, cli
->tree
, "\\netlogon");
820 if (!NT_STATUS_IS_OK(status
)) {
821 d_printf("dcerpc_pipe_open_smb failed: %s\n",
826 status
= dcerpc_bind_auth_none(net_pipe
, &dcerpc_table_netlogon
);
827 if (!NT_STATUS_IS_OK(status
)) {
828 d_printf("dcerpc_bind_auth_none failed: %s\n",
833 r
.in
.computer_name
= cli_credentials_get_workstation(wks_cred
);
834 r
.in
.server_name
= talloc_asprintf(
835 mem_ctx
, "\\\\%s", dcerpc_server_name(net_pipe
));
836 if (r
.in
.server_name
== NULL
) {
837 d_printf("talloc_asprintf failed\n");
840 generate_random_buffer(netr_cli_creds
.data
,
841 sizeof(netr_cli_creds
.data
));
842 r
.in
.credentials
= &netr_cli_creds
;
843 r
.out
.credentials
= &netr_srv_creds
;
845 status
= dcerpc_netr_ServerReqChallenge(net_pipe
, mem_ctx
, &r
);
846 if (!NT_STATUS_IS_OK(status
)) {
847 d_printf("netr_ServerReqChallenge failed: %s\n",
852 negotiate_flags
= NETLOGON_NEG_AUTH2_FLAGS
;
853 E_md4hash(cli_credentials_get_password(wks_cred
), mach_pw
.hash
);
855 creds_state
= talloc(mem_ctx
, struct creds_CredentialState
);
856 creds_client_init(creds_state
, r
.in
.credentials
,
857 r
.out
.credentials
, &mach_pw
,
858 &netr_cred
, negotiate_flags
);
860 a
.in
.server_name
= talloc_asprintf(
861 mem_ctx
, "\\\\%s", dcerpc_server_name(net_pipe
));
862 a
.in
.account_name
= talloc_asprintf(
863 mem_ctx
, "%s$", cli_credentials_get_workstation(wks_cred
));
864 a
.in
.computer_name
= cli_credentials_get_workstation(wks_cred
);
865 a
.in
.secure_channel_type
= SEC_CHAN_WKSTA
;
866 a
.in
.negotiate_flags
= &negotiate_flags
;
867 a
.out
.negotiate_flags
= &negotiate_flags
;
868 a
.in
.credentials
= &netr_cred
;
869 a
.out
.credentials
= &netr_cred
;
871 status
= dcerpc_netr_ServerAuthenticate2(net_pipe
, mem_ctx
, &a
);
872 if (!NT_STATUS_IS_OK(status
)) {
873 d_printf("netr_ServerServerAuthenticate2 failed: %s\n",
878 if (!creds_client_check(creds_state
, a
.out
.credentials
)) {
879 d_printf("creds_client_check failed\n");
883 cli_credentials_set_netlogon_creds(wks_cred
, creds_state
);
888 talloc_free(mem_ctx
);
893 * Do a couple of schannel protected Netlogon ops: Interactive and Network
894 * login, and change the wks password
897 static BOOL
schan(struct smbcli_state
*cli
,
898 struct cli_credentials
*wks_creds
,
899 struct cli_credentials
*user_creds
)
904 struct dcerpc_pipe
*net_pipe
;
907 mem_ctx
= talloc_new(NULL
);
908 if (mem_ctx
== NULL
) {
909 d_printf("talloc_new failed\n");
913 net_pipe
= dcerpc_pipe_init(mem_ctx
,
914 cli
->transport
->socket
->event
.ctx
);
915 if (net_pipe
== NULL
) {
916 d_printf("dcerpc_pipe_init failed\n");
920 status
= dcerpc_pipe_open_smb(net_pipe
->conn
, cli
->tree
, "\\netlogon");
921 if (!NT_STATUS_IS_OK(status
)) {
922 d_printf("dcerpc_pipe_open_smb failed: %s\n",
928 net_pipe
->conn
->flags
|= DCERPC_DEBUG_PRINT_IN
|
929 DCERPC_DEBUG_PRINT_OUT
;
932 net_pipe
->conn
->flags
|= (DCERPC_SIGN
| DCERPC_SEAL
);
933 status
= dcerpc_bind_auth(net_pipe
, &dcerpc_table_netlogon
,
934 wks_creds
, DCERPC_AUTH_TYPE_SCHANNEL
,
935 DCERPC_AUTH_LEVEL_PRIVACY
,
938 status
= dcerpc_bind_auth_none(net_pipe
, &dcerpc_table_netlogon
);
940 if (!NT_STATUS_IS_OK(status
)) {
941 d_printf("schannel bind failed: %s\n", nt_errstr(status
));
946 for (i
=2; i
<4; i
++) {
948 DATA_BLOB chal
, nt_resp
, lm_resp
, names_blob
, session_key
;
949 struct creds_CredentialState
*creds_state
;
950 struct netr_Authenticator netr_auth
, netr_auth2
;
951 struct netr_NetworkInfo ninfo
;
952 struct netr_PasswordInfo pinfo
;
953 struct netr_LogonSamLogon r
;
955 flags
= CLI_CRED_LANMAN_AUTH
| CLI_CRED_NTLM_AUTH
|
956 CLI_CRED_NTLMv2_AUTH
;
958 chal
= data_blob_talloc(mem_ctx
, NULL
, 8);
959 if (chal
.data
== NULL
) {
960 d_printf("data_blob_talloc failed\n");
964 generate_random_buffer(chal
.data
, chal
.length
);
965 names_blob
= NTLMv2_generate_names_blob(
966 mem_ctx
, cli_credentials_get_workstation(user_creds
),
967 cli_credentials_get_domain(user_creds
));
968 status
= cli_credentials_get_ntlm_response(
969 user_creds
, mem_ctx
, &flags
, chal
, names_blob
,
970 &lm_resp
, &nt_resp
, NULL
, NULL
);
971 if (!NT_STATUS_IS_OK(status
)) {
972 d_printf("cli_credentials_get_ntlm_response failed:"
973 " %s\n", nt_errstr(status
));
977 creds_state
= cli_credentials_get_netlogon_creds(wks_creds
);
978 creds_client_authenticator(creds_state
, &netr_auth
);
980 ninfo
.identity_info
.account_name
.string
=
981 cli_credentials_get_username(user_creds
);
982 ninfo
.identity_info
.domain_name
.string
=
983 cli_credentials_get_domain(user_creds
);
984 ninfo
.identity_info
.parameter_control
= 0;
985 ninfo
.identity_info
.logon_id_low
= 0;
986 ninfo
.identity_info
.logon_id_high
= 0;
987 ninfo
.identity_info
.workstation
.string
=
988 cli_credentials_get_workstation(user_creds
);
989 memcpy(ninfo
.challenge
, chal
.data
, sizeof(ninfo
.challenge
));
990 ninfo
.nt
.length
= nt_resp
.length
;
991 ninfo
.nt
.data
= nt_resp
.data
;
992 ninfo
.lm
.length
= lm_resp
.length
;
993 ninfo
.lm
.data
= lm_resp
.data
;
995 r
.in
.server_name
= talloc_asprintf(
996 mem_ctx
, "\\\\%s", dcerpc_server_name(net_pipe
));
997 ZERO_STRUCT(netr_auth2
);
999 cli_credentials_get_workstation(wks_creds
);
1000 r
.in
.credential
= &netr_auth
;
1001 r
.in
.return_authenticator
= &netr_auth2
;
1002 r
.in
.logon_level
= 2;
1003 r
.in
.validation_level
= i
;
1004 r
.in
.logon
.network
= &ninfo
;
1005 r
.out
.return_authenticator
= NULL
;
1007 status
= dcerpc_netr_LogonSamLogon(net_pipe
, mem_ctx
, &r
);
1008 if (!NT_STATUS_IS_OK(status
)) {
1009 d_printf("netr_LogonSamLogon failed: %s\n",
1014 if ((r
.out
.return_authenticator
== NULL
) ||
1015 (!creds_client_check(creds_state
,
1016 &r
.out
.return_authenticator
->cred
))) {
1017 d_printf("Credentials check failed!\n");
1021 creds_client_authenticator(creds_state
, &netr_auth
);
1023 pinfo
.identity_info
= ninfo
.identity_info
;
1024 ZERO_STRUCT(pinfo
.lmpassword
.hash
);
1025 E_md4hash(cli_credentials_get_password(user_creds
),
1026 pinfo
.ntpassword
.hash
);
1027 session_key
= data_blob_talloc(mem_ctx
,
1028 creds_state
->session_key
, 16);
1029 arcfour_crypt_blob(pinfo
.ntpassword
.hash
,
1030 sizeof(pinfo
.ntpassword
.hash
),
1033 r
.in
.logon_level
= 1;
1034 r
.in
.logon
.password
= &pinfo
;
1035 r
.out
.return_authenticator
= NULL
;
1037 status
= dcerpc_netr_LogonSamLogon(net_pipe
, mem_ctx
, &r
);
1038 if (!NT_STATUS_IS_OK(status
)) {
1039 d_printf("netr_LogonSamLogon failed: %s\n",
1044 if ((r
.out
.return_authenticator
== NULL
) ||
1045 (!creds_client_check(creds_state
,
1046 &r
.out
.return_authenticator
->cred
))) {
1047 d_printf("Credentials check failed!\n");
1053 struct netr_ServerPasswordSet s
;
1054 char *password
= generate_random_str(wks_creds
, 8);
1055 struct creds_CredentialState
*creds_state
;
1057 s
.in
.server_name
= talloc_asprintf(
1058 mem_ctx
, "\\\\%s", dcerpc_server_name(net_pipe
));
1059 s
.in
.computer_name
= cli_credentials_get_workstation(wks_creds
);
1060 s
.in
.account_name
= talloc_asprintf(
1061 mem_ctx
, "%s$", s
.in
.computer_name
);
1062 s
.in
.secure_channel_type
= SEC_CHAN_WKSTA
;
1063 E_md4hash(password
, s
.in
.new_password
.hash
);
1065 creds_state
= cli_credentials_get_netlogon_creds(wks_creds
);
1066 creds_des_encrypt(creds_state
, &s
.in
.new_password
);
1067 creds_client_authenticator(creds_state
, &s
.in
.credential
);
1069 status
= dcerpc_netr_ServerPasswordSet(net_pipe
, mem_ctx
, &s
);
1070 if (!NT_STATUS_IS_OK(status
)) {
1071 printf("ServerPasswordSet - %s\n", nt_errstr(status
));
1075 if (!creds_client_check(creds_state
,
1076 &s
.out
.return_authenticator
.cred
)) {
1077 printf("Credential chaining failed\n");
1080 cli_credentials_set_password(wks_creds
, password
,
1086 talloc_free(mem_ctx
);
1091 * Delete the wks account again
1094 static BOOL
leave(struct smbcli_state
*cli
,
1095 struct cli_credentials
*admin_creds
,
1096 struct cli_credentials
*wks_creds
)
1098 char *wks_name
= talloc_asprintf(
1099 NULL
, "%s$", cli_credentials_get_workstation(wks_creds
));
1102 ret
= delete_user(cli
, admin_creds
, wks_name
);
1103 talloc_free(wks_name
);
1108 * Test the Samba3 DC code a bit. Join, do some schan netlogon ops, leave
1111 BOOL
torture_netlogon_samba3(struct torture_context
*torture
)
1113 TALLOC_CTX
*mem_ctx
;
1116 struct smbcli_state
*cli
;
1117 struct cli_credentials
*anon_creds
;
1118 struct cli_credentials
*wks_creds
;
1119 const char *wks_name
;
1122 wks_name
= lp_parm_string(-1, "torture", "wksname");
1123 if (wks_name
== NULL
) {
1124 wks_name
= get_myname();
1127 mem_ctx
= talloc_init("torture_bind_authcontext");
1129 if (mem_ctx
== NULL
) {
1130 d_printf("talloc_init failed\n");
1134 if (!(anon_creds
= create_anon_creds(mem_ctx
))) {
1135 d_printf("create_anon_creds failed\n");
1139 status
= smbcli_full_connection(mem_ctx
, &cli
,
1140 lp_parm_string(-1, "torture", "host"),
1141 "IPC$", NULL
, anon_creds
, NULL
);
1142 if (!NT_STATUS_IS_OK(status
)) {
1143 d_printf("smbcli_full_connection failed: %s\n",
1148 wks_creds
= cli_credentials_init(mem_ctx
);
1149 if (wks_creds
== NULL
) {
1150 d_printf("cli_credentials_init failed\n");
1154 cli_credentials_set_conf(wks_creds
);
1155 cli_credentials_set_secure_channel_type(wks_creds
, SEC_CHAN_WKSTA
);
1156 cli_credentials_set_username(wks_creds
, wks_name
, CRED_SPECIFIED
);
1157 cli_credentials_set_workstation(wks_creds
, wks_name
, CRED_SPECIFIED
);
1158 cli_credentials_set_password(wks_creds
,
1159 generate_random_str(wks_creds
, 8),
1162 if (!join3(cli
, False
, cmdline_credentials
, wks_creds
)) {
1163 d_printf("join failed\n");
1167 cli_credentials_set_domain(
1168 cmdline_credentials
, cli_credentials_get_domain(wks_creds
),
1171 for (i
=0; i
<2; i
++) {
1173 /* Do this more than once, the routine "schan" changes
1174 * the workstation password using the netlogon
1175 * password change routine */
1179 if (!auth2(cli
, wks_creds
)) {
1180 d_printf("auth2 failed\n");
1184 for (j
=0; j
<2; j
++) {
1185 if (!schan(cli
, wks_creds
, cmdline_credentials
)) {
1186 d_printf("schan failed\n");
1192 if (!leave(cli
, cmdline_credentials
, wks_creds
)) {
1193 d_printf("leave failed\n");
1200 talloc_free(mem_ctx
);
1205 * Do a simple join, testjoin and leave using specified smb and samr
1209 static BOOL
test_join3(TALLOC_CTX
*mem_ctx
,
1211 struct cli_credentials
*smb_creds
,
1212 struct cli_credentials
*samr_creds
,
1213 const char *wks_name
)
1217 struct smbcli_state
*cli
;
1218 struct cli_credentials
*wks_creds
;
1220 status
= smbcli_full_connection(mem_ctx
, &cli
,
1221 lp_parm_string(-1, "torture", "host"),
1222 "IPC$", NULL
, smb_creds
, NULL
);
1223 if (!NT_STATUS_IS_OK(status
)) {
1224 d_printf("smbcli_full_connection failed: %s\n",
1229 wks_creds
= cli_credentials_init(cli
);
1230 if (wks_creds
== NULL
) {
1231 d_printf("cli_credentials_init failed\n");
1235 cli_credentials_set_conf(wks_creds
);
1236 cli_credentials_set_secure_channel_type(wks_creds
, SEC_CHAN_WKSTA
);
1237 cli_credentials_set_username(wks_creds
, wks_name
, CRED_SPECIFIED
);
1238 cli_credentials_set_workstation(wks_creds
, wks_name
, CRED_SPECIFIED
);
1239 cli_credentials_set_password(wks_creds
,
1240 generate_random_str(wks_creds
, 8),
1243 if (!join3(cli
, use_level25
, samr_creds
, wks_creds
)) {
1244 d_printf("join failed\n");
1248 cli_credentials_set_domain(
1249 cmdline_credentials
, cli_credentials_get_domain(wks_creds
),
1252 if (!auth2(cli
, wks_creds
)) {
1253 d_printf("auth2 failed\n");
1257 if (!leave(cli
, samr_creds
, wks_creds
)) {
1258 d_printf("leave failed\n");
1271 * Test the different session key variants. Do it by joining, this uses the
1272 * session key in the setpassword routine. Test the join by doing the auth2.
1275 BOOL
torture_samba3_sessionkey(struct torture_context
*torture
)
1277 TALLOC_CTX
*mem_ctx
;
1279 struct cli_credentials
*anon_creds
;
1280 const char *wks_name
;
1282 wks_name
= lp_parm_string(-1, "torture", "wksname");
1283 if (wks_name
== NULL
) {
1284 wks_name
= get_myname();
1287 mem_ctx
= talloc_init("torture_samba3_sessionkey");
1289 if (mem_ctx
== NULL
) {
1290 d_printf("talloc_init failed\n");
1294 if (!(anon_creds
= create_anon_creds(mem_ctx
))) {
1295 d_printf("create_anon_creds failed\n");
1301 if (!lp_parm_bool(-1, "target", "samba3", False
)) {
1303 /* Samba3 in the build farm right now does this happily. Need
1306 if (test_join3(mem_ctx
, False
, anon_creds
, NULL
, wks_name
)) {
1307 d_printf("join using anonymous bind on an anonymous smb "
1308 "connection succeeded -- HUH??\n");
1313 if (!test_join3(mem_ctx
, False
, anon_creds
, cmdline_credentials
,
1315 d_printf("join using ntlmssp bind on an anonymous smb "
1316 "connection failed\n");
1320 if (!test_join3(mem_ctx
, False
, cmdline_credentials
, NULL
, wks_name
)) {
1321 d_printf("join using anonymous bind on an authenticated smb "
1322 "connection failed\n");
1326 if (!test_join3(mem_ctx
, False
, cmdline_credentials
,
1327 cmdline_credentials
,
1329 d_printf("join using ntlmssp bind on an authenticated smb "
1330 "connection failed\n");
1335 * The following two are tests for setuserinfolevel 25
1338 if (!test_join3(mem_ctx
, True
, anon_creds
, cmdline_credentials
,
1340 d_printf("join using ntlmssp bind on an anonymous smb "
1341 "connection failed\n");
1345 if (!test_join3(mem_ctx
, True
, cmdline_credentials
, NULL
, wks_name
)) {
1346 d_printf("join using anonymous bind on an authenticated smb "
1347 "connection failed\n");
1357 * open pipe and bind, given an IPC$ context
1360 static NTSTATUS
pipe_bind_smb(TALLOC_CTX
*mem_ctx
,
1361 struct smbcli_tree
*tree
,
1362 const char *pipe_name
,
1363 const struct dcerpc_interface_table
*iface
,
1364 struct dcerpc_pipe
**p
)
1366 struct dcerpc_pipe
*result
;
1369 if (!(result
= dcerpc_pipe_init(
1370 mem_ctx
, tree
->session
->transport
->socket
->event
.ctx
))) {
1371 return NT_STATUS_NO_MEMORY
;
1374 status
= dcerpc_pipe_open_smb(result
->conn
, tree
, pipe_name
);
1375 if (!NT_STATUS_IS_OK(status
)) {
1376 d_printf("dcerpc_pipe_open_smb failed: %s\n",
1378 talloc_free(result
);
1382 status
= dcerpc_bind_auth_none(result
, iface
);
1383 if (!NT_STATUS_IS_OK(status
)) {
1384 d_printf("schannel bind failed: %s\n", nt_errstr(status
));
1385 talloc_free(result
);
1390 return NT_STATUS_OK
;
1394 * Sane wrapper around lsa_LookupNames
1397 static struct dom_sid
*name2sid(TALLOC_CTX
*mem_ctx
,
1398 struct dcerpc_pipe
*p
,
1402 struct lsa_ObjectAttribute attr
;
1403 struct lsa_QosInfo qos
;
1404 struct lsa_OpenPolicy2 r
;
1407 struct policy_handle handle
;
1408 struct lsa_LookupNames l
;
1409 struct lsa_TransSidArray sids
;
1410 struct lsa_String lsa_name
;
1412 struct dom_sid
*result
;
1413 TALLOC_CTX
*tmp_ctx
;
1415 if (!(tmp_ctx
= talloc_new(mem_ctx
))) {
1420 qos
.impersonation_level
= 2;
1421 qos
.context_mode
= 1;
1422 qos
.effective_only
= 0;
1425 attr
.root_dir
= NULL
;
1426 attr
.object_name
= NULL
;
1427 attr
.attributes
= 0;
1428 attr
.sec_desc
= NULL
;
1429 attr
.sec_qos
= &qos
;
1431 r
.in
.system_name
= "\\";
1433 r
.in
.access_mask
= SEC_FLAG_MAXIMUM_ALLOWED
;
1434 r
.out
.handle
= &handle
;
1436 status
= dcerpc_lsa_OpenPolicy2(p
, tmp_ctx
, &r
);
1437 if (!NT_STATUS_IS_OK(status
)) {
1438 printf("OpenPolicy2 failed - %s\n", nt_errstr(status
));
1439 talloc_free(tmp_ctx
);
1446 lsa_name
.string
= talloc_asprintf(tmp_ctx
, "%s\\%s", domain
, name
);
1448 l
.in
.handle
= &handle
;
1450 l
.in
.names
= &lsa_name
;
1453 l
.in
.count
= &count
;
1454 l
.out
.count
= &count
;
1457 status
= dcerpc_lsa_LookupNames(p
, tmp_ctx
, &l
);
1458 if (!NT_STATUS_IS_OK(status
)) {
1459 printf("LookupNames failed - %s\n", nt_errstr(status
));
1460 talloc_free(tmp_ctx
);
1464 result
= dom_sid_add_rid(mem_ctx
, l
.out
.domains
->domains
[0].sid
,
1465 l
.out
.sids
->sids
[0].rid
);
1467 c
.in
.handle
= &handle
;
1468 c
.out
.handle
= &handle
;
1470 status
= dcerpc_lsa_Close(p
, tmp_ctx
, &c
);
1471 if (!NT_STATUS_IS_OK(status
)) {
1472 printf("dcerpc_lsa_Close failed - %s\n", nt_errstr(status
));
1473 talloc_free(tmp_ctx
);
1477 talloc_free(tmp_ctx
);
1482 * Find out the user SID on this connection
1485 static struct dom_sid
*whoami(TALLOC_CTX
*mem_ctx
, struct smbcli_tree
*tree
)
1487 struct dcerpc_pipe
*lsa
;
1488 struct lsa_GetUserName r
;
1490 struct lsa_StringPointer authority_name_p
;
1491 struct dom_sid
*result
;
1493 status
= pipe_bind_smb(mem_ctx
, tree
, "\\pipe\\lsarpc",
1494 &dcerpc_table_lsarpc
, &lsa
);
1495 if (!NT_STATUS_IS_OK(status
)) {
1496 d_printf("(%s) Could not bind to LSA: %s\n",
1497 __location__
, nt_errstr(status
));
1501 r
.in
.system_name
= "\\";
1502 r
.in
.account_name
= NULL
;
1503 authority_name_p
.string
= NULL
;
1504 r
.in
.authority_name
= &authority_name_p
;
1506 status
= dcerpc_lsa_GetUserName(lsa
, mem_ctx
, &r
);
1508 if (!NT_STATUS_IS_OK(status
)) {
1509 printf("(%s) GetUserName failed - %s\n",
1510 __location__
, nt_errstr(status
));
1515 result
= name2sid(mem_ctx
, lsa
, r
.out
.account_name
->string
,
1516 r
.out
.authority_name
->string
->string
);
1523 * Do a tcon, given a session
1526 NTSTATUS
secondary_tcon(TALLOC_CTX
*mem_ctx
,
1527 struct smbcli_session
*session
,
1528 const char *sharename
,
1529 struct smbcli_tree
**res
)
1531 struct smbcli_tree
*result
;
1532 TALLOC_CTX
*tmp_ctx
;
1533 union smb_tcon tcon
;
1536 if (!(tmp_ctx
= talloc_new(mem_ctx
))) {
1537 return NT_STATUS_NO_MEMORY
;
1540 if (!(result
= smbcli_tree_init(session
, mem_ctx
, False
))) {
1541 talloc_free(tmp_ctx
);
1542 return NT_STATUS_NO_MEMORY
;
1545 tcon
.generic
.level
= RAW_TCON_TCONX
;
1546 tcon
.tconx
.in
.flags
= 0;
1547 tcon
.tconx
.in
.password
= data_blob(NULL
, 0);
1548 tcon
.tconx
.in
.path
= sharename
;
1549 tcon
.tconx
.in
.device
= "?????";
1551 status
= smb_raw_tcon(result
, tmp_ctx
, &tcon
);
1552 if (!NT_STATUS_IS_OK(status
)) {
1553 d_printf("(%s) smb_raw_tcon failed: %s\n", __location__
,
1555 talloc_free(tmp_ctx
);
1559 result
->tid
= tcon
.tconx
.out
.tid
;
1560 result
= talloc_steal(mem_ctx
, result
);
1561 talloc_free(tmp_ctx
);
1563 return NT_STATUS_OK
;
1567 * Test the getusername behaviour
1570 BOOL
torture_samba3_rpc_getusername(struct torture_context
*torture
)
1573 struct smbcli_state
*cli
;
1574 TALLOC_CTX
*mem_ctx
;
1576 struct dom_sid
*user_sid
;
1577 struct dom_sid
*created_sid
;
1578 struct cli_credentials
*anon_creds
;
1579 struct cli_credentials
*user_creds
;
1582 if (!(mem_ctx
= talloc_new(torture
))) {
1586 status
= smbcli_full_connection(
1587 mem_ctx
, &cli
, lp_parm_string(-1, "torture", "host"),
1588 "IPC$", NULL
, cmdline_credentials
, NULL
);
1589 if (!NT_STATUS_IS_OK(status
)) {
1590 d_printf("(%s) smbcli_full_connection failed: %s\n",
1591 __location__
, nt_errstr(status
));
1596 if (!(user_sid
= whoami(mem_ctx
, cli
->tree
))) {
1597 d_printf("(%s) whoami on auth'ed connection failed\n",
1604 if (!(anon_creds
= create_anon_creds(mem_ctx
))) {
1605 d_printf("(%s) create_anon_creds failed\n", __location__
);
1610 status
= smbcli_full_connection(
1611 mem_ctx
, &cli
, lp_parm_string(-1, "torture", "host"),
1612 "IPC$", NULL
, anon_creds
, NULL
);
1613 if (!NT_STATUS_IS_OK(status
)) {
1614 d_printf("(%s) anon smbcli_full_connection failed: %s\n",
1615 __location__
, nt_errstr(status
));
1620 if (!(user_sid
= whoami(mem_ctx
, cli
->tree
))) {
1621 d_printf("(%s) whoami on anon connection failed\n",
1627 if (!dom_sid_equal(user_sid
,
1628 dom_sid_parse_talloc(mem_ctx
, "s-1-5-7"))) {
1629 d_printf("(%s) Anon lsa_GetUserName returned %s, expected "
1630 "S-1-5-7", __location__
,
1631 dom_sid_string(mem_ctx
, user_sid
));
1635 if (!(user_creds
= cli_credentials_init(mem_ctx
))) {
1636 d_printf("(%s) cli_credentials_init failed\n", __location__
);
1641 cli_credentials_set_conf(user_creds
);
1642 cli_credentials_set_username(user_creds
, "torture_username",
1644 cli_credentials_set_password(user_creds
,
1645 generate_random_str(user_creds
, 8),
1648 if (!create_user(mem_ctx
, cli
, cmdline_credentials
,
1649 cli_credentials_get_username(user_creds
),
1650 cli_credentials_get_password(user_creds
),
1651 &domain_name
, &created_sid
)) {
1652 d_printf("(%s) create_user failed\n", __location__
);
1657 cli_credentials_set_domain(user_creds
, domain_name
,
1661 struct smbcli_session
*session2
;
1662 struct smb_composite_sesssetup setup
;
1663 struct smbcli_tree
*tree
;
1665 session2
= smbcli_session_init(cli
->transport
, mem_ctx
, False
);
1666 if (session2
== NULL
) {
1667 d_printf("(%s) smbcli_session_init failed\n",
1672 setup
.in
.sesskey
= cli
->transport
->negotiate
.sesskey
;
1673 setup
.in
.capabilities
= cli
->transport
->negotiate
.capabilities
;
1674 setup
.in
.workgroup
= "";
1675 setup
.in
.credentials
= user_creds
;
1677 status
= smb_composite_sesssetup(session2
, &setup
);
1678 if (!NT_STATUS_IS_OK(status
)) {
1679 d_printf("(%s) session setup with new user failed: "
1680 "%s\n", __location__
, nt_errstr(status
));
1685 if (!NT_STATUS_IS_OK(secondary_tcon(mem_ctx
, session2
,
1687 d_printf("(%s) secondary_tcon failed\n",
1693 if (!(user_sid
= whoami(mem_ctx
, tree
))) {
1694 d_printf("(%s) whoami on user connection failed\n",
1703 d_printf("Created %s, found %s\n",
1704 dom_sid_string(mem_ctx
, created_sid
),
1705 dom_sid_string(mem_ctx
, user_sid
));
1707 if (!dom_sid_equal(created_sid
, user_sid
)) {
1712 if (!delete_user(cli
, cmdline_credentials
,
1713 cli_credentials_get_username(user_creds
))) {
1714 d_printf("(%s) delete_user failed\n", __location__
);
1719 talloc_free(mem_ctx
);
1723 static BOOL
test_NetShareGetInfo(struct dcerpc_pipe
*p
, TALLOC_CTX
*mem_ctx
,
1724 const char *sharename
)
1727 struct srvsvc_NetShareGetInfo r
;
1728 uint32_t levels
[] = { 0, 1, 2, 501, 502, 1004, 1005, 1006, 1007, 1501 };
1732 r
.in
.server_unc
= talloc_asprintf(mem_ctx
, "\\\\%s",
1733 dcerpc_server_name(p
));
1734 r
.in
.share_name
= sharename
;
1736 for (i
=0;i
<ARRAY_SIZE(levels
);i
++) {
1737 r
.in
.level
= levels
[i
];
1741 printf("testing NetShareGetInfo level %u on share '%s'\n",
1742 r
.in
.level
, r
.in
.share_name
);
1744 status
= dcerpc_srvsvc_NetShareGetInfo(p
, mem_ctx
, &r
);
1745 if (!NT_STATUS_IS_OK(status
)) {
1746 printf("NetShareGetInfo level %u on share '%s' failed"
1747 " - %s\n", r
.in
.level
, r
.in
.share_name
,
1752 if (!W_ERROR_IS_OK(r
.out
.result
)) {
1753 printf("NetShareGetInfo level %u on share '%s' failed "
1754 "- %s\n", r
.in
.level
, r
.in
.share_name
,
1755 win_errstr(r
.out
.result
));
1764 static BOOL
test_NetShareEnum(struct dcerpc_pipe
*p
, TALLOC_CTX
*mem_ctx
,
1765 const char **one_sharename
)
1768 struct srvsvc_NetShareEnum r
;
1769 struct srvsvc_NetShareCtr0 c0
;
1770 uint32_t levels
[] = { 0, 1, 2, 501, 502, 1004, 1005, 1006, 1007 };
1774 r
.in
.server_unc
= talloc_asprintf(mem_ctx
,"\\\\%s",dcerpc_server_name(p
));
1775 r
.in
.ctr
.ctr0
= &c0
;
1776 r
.in
.ctr
.ctr0
->count
= 0;
1777 r
.in
.ctr
.ctr0
->array
= NULL
;
1778 r
.in
.max_buffer
= (uint32_t)-1;
1779 r
.in
.resume_handle
= NULL
;
1781 for (i
=0;i
<ARRAY_SIZE(levels
);i
++) {
1782 r
.in
.level
= levels
[i
];
1786 printf("testing NetShareEnum level %u\n", r
.in
.level
);
1787 status
= dcerpc_srvsvc_NetShareEnum(p
, mem_ctx
, &r
);
1788 if (!NT_STATUS_IS_OK(status
)) {
1789 printf("NetShareEnum level %u failed - %s\n",
1790 r
.in
.level
, nt_errstr(status
));
1794 if (!W_ERROR_IS_OK(r
.out
.result
)) {
1795 printf("NetShareEnum level %u failed - %s\n",
1796 r
.in
.level
, win_errstr(r
.out
.result
));
1799 if (r
.in
.level
== 0) {
1800 struct srvsvc_NetShareCtr0
*ctr
= r
.out
.ctr
.ctr0
;
1801 if (ctr
->count
> 0) {
1802 *one_sharename
= ctr
->array
[0].name
;
1810 BOOL
torture_samba3_rpc_srvsvc(struct torture_context
*torture
)
1812 struct dcerpc_pipe
*p
;
1813 TALLOC_CTX
*mem_ctx
;
1815 const char *sharename
= NULL
;
1816 struct smbcli_state
*cli
;
1819 if (!(mem_ctx
= talloc_new(torture
))) {
1823 if (!(torture_open_connection_share(
1824 mem_ctx
, &cli
, lp_parm_string(-1, "torture", "host"),
1826 talloc_free(mem_ctx
);
1830 status
= pipe_bind_smb(mem_ctx
, cli
->tree
, "\\pipe\\srvsvc",
1831 &dcerpc_table_srvsvc
, &p
);
1832 if (!NT_STATUS_IS_OK(status
)) {
1833 d_printf("(%s) could not bind to srvsvc pipe: %s\n",
1834 __location__
, nt_errstr(status
));
1839 ret
&= test_NetShareEnum(p
, mem_ctx
, &sharename
);
1840 if (sharename
== NULL
) {
1841 printf("did not get sharename\n");
1843 ret
&= test_NetShareGetInfo(p
, mem_ctx
, sharename
);
1847 talloc_free(mem_ctx
);
1851 static struct security_descriptor
*get_sharesec(TALLOC_CTX
*mem_ctx
,
1852 struct smbcli_session
*sess
,
1853 const char *sharename
)
1855 struct smbcli_tree
*tree
;
1856 TALLOC_CTX
*tmp_ctx
;
1857 struct dcerpc_pipe
*p
;
1859 struct srvsvc_NetShareGetInfo r
;
1860 struct security_descriptor
*result
;
1862 if (!(tmp_ctx
= talloc_new(mem_ctx
))) {
1863 d_printf("talloc_new failed\n");
1867 if (!NT_STATUS_IS_OK(secondary_tcon(tmp_ctx
, sess
, "IPC$", &tree
))) {
1868 d_printf("secondary_tcon failed\n");
1869 talloc_free(tmp_ctx
);
1873 status
= pipe_bind_smb(mem_ctx
, tree
, "\\pipe\\srvsvc",
1874 &dcerpc_table_srvsvc
, &p
);
1875 if (!NT_STATUS_IS_OK(status
)) {
1876 d_printf("(%s) could not bind to srvsvc pipe: %s\n",
1877 __location__
, nt_errstr(status
));
1878 talloc_free(tmp_ctx
);
1883 p
->conn
->flags
|= DCERPC_DEBUG_PRINT_IN
| DCERPC_DEBUG_PRINT_OUT
;
1886 r
.in
.server_unc
= talloc_asprintf(tmp_ctx
, "\\\\%s",
1887 dcerpc_server_name(p
));
1888 r
.in
.share_name
= sharename
;
1891 status
= dcerpc_srvsvc_NetShareGetInfo(p
, tmp_ctx
, &r
);
1892 if (!NT_STATUS_IS_OK(status
)) {
1893 d_printf("srvsvc_NetShareGetInfo failed: %s\n",
1895 talloc_free(tmp_ctx
);
1899 result
= talloc_steal(mem_ctx
, r
.out
.info
.info502
->sd
);
1900 talloc_free(tmp_ctx
);
1904 static NTSTATUS
set_sharesec(TALLOC_CTX
*mem_ctx
,
1905 struct smbcli_session
*sess
,
1906 const char *sharename
,
1907 struct security_descriptor
*sd
)
1909 struct smbcli_tree
*tree
;
1910 TALLOC_CTX
*tmp_ctx
;
1911 struct dcerpc_pipe
*p
;
1913 struct sec_desc_buf i
;
1914 struct srvsvc_NetShareSetInfo r
;
1917 if (!(tmp_ctx
= talloc_new(mem_ctx
))) {
1918 d_printf("talloc_new failed\n");
1919 return NT_STATUS_NO_MEMORY
;
1922 if (!NT_STATUS_IS_OK(secondary_tcon(tmp_ctx
, sess
, "IPC$", &tree
))) {
1923 d_printf("secondary_tcon failed\n");
1924 talloc_free(tmp_ctx
);
1925 return NT_STATUS_UNSUCCESSFUL
;
1928 status
= pipe_bind_smb(mem_ctx
, tree
, "\\pipe\\srvsvc",
1929 &dcerpc_table_srvsvc
, &p
);
1930 if (!NT_STATUS_IS_OK(status
)) {
1931 d_printf("(%s) could not bind to srvsvc pipe: %s\n",
1932 __location__
, nt_errstr(status
));
1933 talloc_free(tmp_ctx
);
1934 return NT_STATUS_UNSUCCESSFUL
;
1938 p
->conn
->flags
|= DCERPC_DEBUG_PRINT_IN
| DCERPC_DEBUG_PRINT_OUT
;
1941 r
.in
.server_unc
= talloc_asprintf(tmp_ctx
, "\\\\%s",
1942 dcerpc_server_name(p
));
1943 r
.in
.share_name
= sharename
;
1946 r
.in
.info
.info1501
= &i
;
1947 r
.in
.parm_error
= &error
;
1949 status
= dcerpc_srvsvc_NetShareSetInfo(p
, tmp_ctx
, &r
);
1950 if (!NT_STATUS_IS_OK(status
)) {
1951 d_printf("srvsvc_NetShareGetInfo failed: %s\n",
1955 talloc_free(tmp_ctx
);
1959 BOOL
try_tcon(TALLOC_CTX
*mem_ctx
,
1960 struct security_descriptor
*orig_sd
,
1961 struct smbcli_session
*session
,
1962 const char *sharename
, const struct dom_sid
*user_sid
,
1963 unsigned int access_mask
, NTSTATUS expected_tcon
,
1964 NTSTATUS expected_mkdir
)
1966 TALLOC_CTX
*tmp_ctx
;
1967 struct smbcli_tree
*rmdir_tree
, *tree
;
1968 struct dom_sid
*domain_sid
;
1970 struct security_descriptor
*sd
;
1974 if (!(tmp_ctx
= talloc_new(mem_ctx
))) {
1975 d_printf("talloc_new failed\n");
1979 status
= secondary_tcon(tmp_ctx
, session
, sharename
, &rmdir_tree
);
1980 if (!NT_STATUS_IS_OK(status
)) {
1981 d_printf("first tcon to delete dir failed\n");
1982 talloc_free(tmp_ctx
);
1986 smbcli_rmdir(rmdir_tree
, "sharesec_testdir");
1988 if (!NT_STATUS_IS_OK(dom_sid_split_rid(tmp_ctx
, user_sid
,
1989 &domain_sid
, &rid
))) {
1990 d_printf("dom_sid_split_rid failed\n");
1991 talloc_free(tmp_ctx
);
1995 sd
= security_descriptor_create(
1996 tmp_ctx
, "S-1-5-32-544",
1997 dom_sid_string(mem_ctx
, dom_sid_add_rid(mem_ctx
, domain_sid
,
1999 dom_sid_string(mem_ctx
, user_sid
),
2000 SEC_ACE_TYPE_ACCESS_ALLOWED
, access_mask
, 0, NULL
);
2002 d_printf("security_descriptor_create failed\n");
2003 talloc_free(tmp_ctx
);
2007 status
= set_sharesec(mem_ctx
, session
, sharename
, sd
);
2008 if (!NT_STATUS_IS_OK(status
)) {
2009 d_printf("custom set_sharesec failed: %s\n",
2011 talloc_free(tmp_ctx
);
2015 status
= secondary_tcon(tmp_ctx
, session
, sharename
, &tree
);
2016 if (!NT_STATUS_EQUAL(status
, expected_tcon
)) {
2017 d_printf("Expected %s, got %s\n", nt_errstr(expected_tcon
),
2023 if (!NT_STATUS_IS_OK(status
)) {
2024 /* An expected non-access, no point in trying to write */
2028 status
= smbcli_mkdir(tree
, "sharesec_testdir");
2029 if (!NT_STATUS_EQUAL(status
, expected_mkdir
)) {
2030 d_printf("Expected %s, got %s\n", nt_errstr(expected_mkdir
),
2036 smbcli_rmdir(rmdir_tree
, "sharesec_testdir");
2038 status
= set_sharesec(mem_ctx
, session
, sharename
, orig_sd
);
2039 if (!NT_STATUS_IS_OK(status
)) {
2040 d_printf("custom set_sharesec failed: %s\n",
2042 talloc_free(tmp_ctx
);
2046 talloc_free(tmp_ctx
);
2050 BOOL
torture_samba3_rpc_sharesec(struct torture_context
*torture
)
2052 TALLOC_CTX
*mem_ctx
;
2054 struct smbcli_state
*cli
;
2055 struct security_descriptor
*sd
;
2056 struct dom_sid
*user_sid
;
2058 if (!(mem_ctx
= talloc_new(torture
))) {
2062 if (!(torture_open_connection_share(
2063 mem_ctx
, &cli
, lp_parm_string(-1, "torture", "host"),
2065 d_printf("IPC$ connection failed\n");
2066 talloc_free(mem_ctx
);
2070 if (!(user_sid
= whoami(mem_ctx
, cli
->tree
))) {
2071 d_printf("whoami failed\n");
2072 talloc_free(mem_ctx
);
2076 sd
= get_sharesec(mem_ctx
, cli
->session
, lp_parm_string(-1, "torture",
2079 ret
&= try_tcon(mem_ctx
, sd
, cli
->session
,
2080 lp_parm_string(-1, "torture", "share"),
2081 user_sid
, 0, NT_STATUS_ACCESS_DENIED
, NT_STATUS_OK
);
2083 ret
&= try_tcon(mem_ctx
, sd
, cli
->session
,
2084 lp_parm_string(-1, "torture", "share"),
2085 user_sid
, SEC_FILE_READ_DATA
, NT_STATUS_OK
,
2086 NT_STATUS_NETWORK_ACCESS_DENIED
);
2088 ret
&= try_tcon(mem_ctx
, sd
, cli
->session
,
2089 lp_parm_string(-1, "torture", "share"),
2090 user_sid
, SEC_FILE_ALL
, NT_STATUS_OK
, NT_STATUS_OK
);
2092 talloc_free(mem_ctx
);
2096 BOOL
torture_samba3_rpc_lsa(struct torture_context
*torture
)
2098 TALLOC_CTX
*mem_ctx
;
2100 struct smbcli_state
*cli
;
2101 struct dcerpc_pipe
*p
;
2102 struct policy_handle lsa_handle
;
2104 struct dom_sid
*domain_sid
;
2106 if (!(mem_ctx
= talloc_new(torture
))) {
2110 if (!(torture_open_connection_share(
2111 mem_ctx
, &cli
, lp_parm_string(-1, "torture", "host"),
2113 d_printf("IPC$ connection failed\n");
2114 talloc_free(mem_ctx
);
2118 status
= pipe_bind_smb(mem_ctx
, cli
->tree
, "\\lsarpc",
2119 &dcerpc_table_lsarpc
, &p
);
2120 if (!NT_STATUS_IS_OK(status
)) {
2121 d_printf("(%s) pipe_bind_smb failed: %s\n", __location__
,
2123 talloc_free(mem_ctx
);
2128 struct lsa_ObjectAttribute attr
;
2129 struct lsa_OpenPolicy2 o
;
2130 o
.in
.system_name
= talloc_asprintf(
2131 mem_ctx
, "\\\\%s", dcerpc_server_name(p
));
2134 o
.in
.access_mask
= SEC_FLAG_MAXIMUM_ALLOWED
;
2135 o
.out
.handle
= &lsa_handle
;
2136 status
= dcerpc_lsa_OpenPolicy2(p
, mem_ctx
, &o
);
2137 if (!NT_STATUS_IS_OK(status
)) {
2138 d_printf("(%s) dcerpc_lsa_OpenPolicy2 failed: %s\n",
2139 __location__
, nt_errstr(status
));
2140 talloc_free(mem_ctx
);
2146 p
->conn
->flags
|= DCERPC_DEBUG_PRINT_IN
| DCERPC_DEBUG_PRINT_OUT
;
2151 int levels
[] = { 2,3,5,6 };
2153 for (i
=0; i
<ARRAY_SIZE(levels
); i
++) {
2154 struct lsa_QueryInfoPolicy r
;
2155 r
.in
.handle
= &lsa_handle
;
2156 r
.in
.level
= levels
[i
];
2157 status
= dcerpc_lsa_QueryInfoPolicy(p
, mem_ctx
, &r
);
2158 if (!NT_STATUS_IS_OK(status
)) {
2159 d_printf("(%s) dcerpc_lsa_QueryInfoPolicy %d "
2160 "failed: %s\n", __location__
,
2161 levels
[i
], nt_errstr(status
));
2162 talloc_free(mem_ctx
);
2165 if (levels
[i
] == 5) {
2166 domain_sid
= r
.out
.info
->account_domain
.sid
;
2174 static NTSTATUS
find_printers(TALLOC_CTX
*ctx
, struct smbcli_tree
*tree
,
2175 const char ***printers
, int *num_printers
)
2177 TALLOC_CTX
*mem_ctx
;
2179 struct dcerpc_pipe
*p
;
2180 struct srvsvc_NetShareEnum r
;
2181 struct srvsvc_NetShareCtr1 c1_in
;
2182 struct srvsvc_NetShareCtr1
*c1
;
2185 mem_ctx
= talloc_new(ctx
);
2186 if (mem_ctx
== NULL
) {
2187 return NT_STATUS_NO_MEMORY
;
2190 status
= pipe_bind_smb(mem_ctx
, tree
, "\\srvsvc", &dcerpc_table_srvsvc
,
2192 if (!NT_STATUS_IS_OK(status
)) {
2193 d_printf("could not bind to srvsvc pipe\n");
2194 talloc_free(mem_ctx
);
2198 r
.in
.server_unc
= talloc_asprintf(
2199 mem_ctx
, "\\\\%s", dcerpc_server_name(p
));
2202 r
.in
.ctr
.ctr1
= &c1_in
;
2203 r
.in
.max_buffer
= (uint32_t)-1;
2204 r
.in
.resume_handle
= NULL
;
2206 status
= dcerpc_srvsvc_NetShareEnum(p
, mem_ctx
, &r
);
2207 if (!NT_STATUS_IS_OK(status
)) {
2208 d_printf("NetShareEnum level %u failed - %s\n",
2209 r
.in
.level
, nt_errstr(status
));
2210 talloc_free(mem_ctx
);
2216 c1
= r
.out
.ctr
.ctr1
;
2217 for (i
=0; i
<c1
->count
; i
++) {
2218 if (c1
->array
[i
].type
!= STYPE_PRINTQ
) {
2221 if (!add_string_to_array(ctx
, c1
->array
[i
].name
,
2222 printers
, num_printers
)) {
2224 return NT_STATUS_NO_MEMORY
;
2228 talloc_free(mem_ctx
);
2229 return NT_STATUS_OK
;
2232 static BOOL
enumprinters(TALLOC_CTX
*mem_ctx
, struct dcerpc_pipe
*pipe
,
2233 int level
, int *num_printers
)
2235 struct spoolss_EnumPrinters r
;
2239 r
.in
.flags
= PRINTER_ENUM_LOCAL
;
2240 r
.in
.server
= "\\\\localhost";
2245 status
= dcerpc_spoolss_EnumPrinters(pipe
, mem_ctx
, &r
);
2246 if (!NT_STATUS_IS_OK(status
)) {
2247 d_printf("(%s) dcerpc_spoolss_EnumPrinters failed: %s\n",
2248 __location__
, nt_errstr(status
));
2252 if (!W_ERROR_EQUAL(r
.out
.result
, WERR_INSUFFICIENT_BUFFER
)) {
2253 d_printf("(%s) EnumPrinters unexpected return code %s, should "
2254 "be WERR_INSUFFICIENT_BUFFER\n", __location__
,
2255 win_errstr(r
.out
.result
));
2259 blob
= data_blob_talloc(mem_ctx
, NULL
, r
.out
.needed
);
2260 if (blob
.data
== NULL
) {
2261 d_printf("(%s) data_blob_talloc failed\n", __location__
);
2265 r
.in
.buffer
= &blob
;
2266 r
.in
.offered
= r
.out
.needed
;
2268 status
= dcerpc_spoolss_EnumPrinters(pipe
, mem_ctx
, &r
);
2269 if (!NT_STATUS_IS_OK(status
) || !W_ERROR_IS_OK(r
.out
.result
)) {
2270 d_printf("(%s) dcerpc_spoolss_EnumPrinters failed: %s, "
2271 "%s\n", __location__
, nt_errstr(status
),
2272 win_errstr(r
.out
.result
));
2276 *num_printers
= r
.out
.count
;
2281 static NTSTATUS
getprinterinfo(TALLOC_CTX
*ctx
, struct dcerpc_pipe
*pipe
,
2282 struct policy_handle
*handle
, int level
,
2283 union spoolss_PrinterInfo
**res
)
2285 TALLOC_CTX
*mem_ctx
;
2286 struct spoolss_GetPrinter r
;
2290 mem_ctx
= talloc_new(ctx
);
2291 if (mem_ctx
== NULL
) {
2292 return NT_STATUS_NO_MEMORY
;
2295 r
.in
.handle
= handle
;
2300 status
= dcerpc_spoolss_GetPrinter(pipe
, mem_ctx
, &r
);
2301 if (!NT_STATUS_IS_OK(status
)) {
2302 d_printf("(%s) dcerpc_spoolss_GetPrinter failed: %s\n",
2303 __location__
, nt_errstr(status
));
2304 talloc_free(mem_ctx
);
2308 if (!W_ERROR_EQUAL(r
.out
.result
, WERR_INSUFFICIENT_BUFFER
)) {
2309 printf("GetPrinter unexpected return code %s, should "
2310 "be WERR_INSUFFICIENT_BUFFER\n",
2311 win_errstr(r
.out
.result
));
2312 talloc_free(mem_ctx
);
2313 return NT_STATUS_UNSUCCESSFUL
;
2316 r
.in
.handle
= handle
;
2318 blob
= data_blob_talloc(mem_ctx
, NULL
, r
.out
.needed
);
2319 if (blob
.data
== NULL
) {
2320 talloc_free(mem_ctx
);
2321 return NT_STATUS_NO_MEMORY
;
2323 memset(blob
.data
, 0, blob
.length
);
2324 r
.in
.buffer
= &blob
;
2325 r
.in
.offered
= r
.out
.needed
;
2327 status
= dcerpc_spoolss_GetPrinter(pipe
, mem_ctx
, &r
);
2328 if (!NT_STATUS_IS_OK(status
) || !W_ERROR_IS_OK(r
.out
.result
)) {
2329 d_printf("(%s) dcerpc_spoolss_GetPrinter failed: %s, "
2330 "%s\n", __location__
, nt_errstr(status
),
2331 win_errstr(r
.out
.result
));
2332 talloc_free(mem_ctx
);
2333 return NT_STATUS_IS_OK(status
) ?
2334 NT_STATUS_UNSUCCESSFUL
: status
;
2338 *res
= talloc_steal(ctx
, r
.out
.info
);
2341 talloc_free(mem_ctx
);
2342 return NT_STATUS_OK
;
2346 BOOL
torture_samba3_rpc_spoolss(struct torture_context
*torture
)
2348 TALLOC_CTX
*mem_ctx
;
2350 struct smbcli_state
*cli
;
2351 struct dcerpc_pipe
*p
;
2353 struct policy_handle server_handle
, printer_handle
;
2354 const char **printers
;
2356 struct spoolss_UserLevel1 userlevel1
;
2358 if (!(mem_ctx
= talloc_new(torture
))) {
2362 if (!(torture_open_connection_share(
2363 mem_ctx
, &cli
, lp_parm_string(-1, "torture", "host"),
2365 d_printf("IPC$ connection failed\n");
2366 talloc_free(mem_ctx
);
2370 if (!NT_STATUS_IS_OK(find_printers(mem_ctx
, cli
->tree
,
2371 &printers
, &num_printers
))) {
2372 talloc_free(mem_ctx
);
2376 if (num_printers
== 0) {
2377 d_printf("Did not find printers\n");
2378 talloc_free(mem_ctx
);
2382 status
= pipe_bind_smb(mem_ctx
, cli
->tree
, "\\spoolss",
2383 &dcerpc_table_spoolss
, &p
);
2384 if (!NT_STATUS_IS_OK(status
)) {
2385 d_printf("(%s) pipe_bind_smb failed: %s\n", __location__
,
2387 talloc_free(mem_ctx
);
2391 ZERO_STRUCT(userlevel1
);
2392 userlevel1
.client
= talloc_asprintf(
2393 mem_ctx
, "\\\\%s", lp_netbios_name());
2394 userlevel1
.user
= cli_credentials_get_username(cmdline_credentials
);
2395 userlevel1
.build
= 2600;
2396 userlevel1
.major
= 3;
2397 userlevel1
.minor
= 0;
2398 userlevel1
.processor
= 0;
2401 struct spoolss_OpenPrinterEx r
;
2404 r
.in
.printername
= "\\\\localhost";
2405 r
.in
.datatype
= NULL
;
2406 r
.in
.access_mask
= 0;
2408 r
.in
.userlevel
.level1
= &userlevel1
;
2409 r
.out
.handle
= &server_handle
;
2411 status
= dcerpc_spoolss_OpenPrinterEx(p
, mem_ctx
, &r
);
2412 if (!NT_STATUS_IS_OK(status
)) {
2413 d_printf("(%s) dcerpc_spoolss_OpenPrinterEx failed: "
2414 "%s\n", __location__
, nt_errstr(status
));
2415 talloc_free(mem_ctx
);
2418 if (!W_ERROR_IS_OK(r
.out
.result
)) {
2419 d_printf("(%s) dcerpc_spoolss_OpenPrinterEx failed: "
2420 "%s\n", __location__
,
2421 win_errstr(r
.out
.result
));
2422 talloc_free(mem_ctx
);
2428 struct spoolss_ClosePrinter r
;
2430 r
.in
.handle
= &server_handle
;
2431 r
.out
.handle
= &server_handle
;
2433 status
= dcerpc_spoolss_ClosePrinter(p
, mem_ctx
, &r
);
2434 if (!NT_STATUS_IS_OK(status
)) {
2435 d_printf("(%s) dcerpc_spoolss_ClosePrinter failed: "
2436 "%s\n", __location__
, nt_errstr(status
));
2437 talloc_free(mem_ctx
);
2440 if (!W_ERROR_IS_OK(r
.out
.result
)) {
2441 d_printf("(%s) dcerpc_spoolss_ClosePrinter failed: "
2442 "%s\n", __location__
,
2443 win_errstr(r
.out
.result
));
2444 talloc_free(mem_ctx
);
2450 struct spoolss_OpenPrinterEx r
;
2453 r
.in
.printername
= talloc_asprintf(
2454 mem_ctx
, "\\\\localhost\\%s", printers
[0]);
2455 r
.in
.datatype
= NULL
;
2456 r
.in
.access_mask
= 0;
2458 r
.in
.userlevel
.level1
= &userlevel1
;
2459 r
.out
.handle
= &printer_handle
;
2461 status
= dcerpc_spoolss_OpenPrinterEx(p
, mem_ctx
, &r
);
2462 if (!NT_STATUS_IS_OK(status
)) {
2463 d_printf("(%s) dcerpc_spoolss_OpenPrinterEx failed: "
2464 "%s\n", __location__
, nt_errstr(status
));
2465 talloc_free(mem_ctx
);
2468 if (!W_ERROR_IS_OK(r
.out
.result
)) {
2469 d_printf("(%s) dcerpc_spoolss_OpenPrinterEx failed: "
2470 "%s\n", __location__
,
2471 win_errstr(r
.out
.result
));
2472 talloc_free(mem_ctx
);
2480 for (i
=0; i
<8; i
++) {
2482 (lp_parm_bool(-1, "target", "samba3", False
))) {
2483 /* Samba3 does not yet do level 6 */
2486 status
= getprinterinfo(mem_ctx
, p
, &printer_handle
,
2488 if (!NT_STATUS_IS_OK(status
)) {
2489 d_printf("(%s) getprinterinfo %d failed: %s\n",
2490 __location__
, i
, nt_errstr(status
));
2497 struct spoolss_ClosePrinter r
;
2499 r
.in
.handle
= &printer_handle
;
2500 r
.out
.handle
= &printer_handle
;
2502 status
= dcerpc_spoolss_ClosePrinter(p
, mem_ctx
, &r
);
2503 if (!NT_STATUS_IS_OK(status
)) {
2504 d_printf("(%s) dcerpc_spoolss_ClosePrinter failed: "
2505 "%s\n", __location__
, nt_errstr(status
));
2506 talloc_free(mem_ctx
);
2513 if (!enumprinters(mem_ctx
, p
, 1, &num_enumerated
)) {
2514 d_printf("(%s) enumprinters failed\n", __location__
);
2515 talloc_free(mem_ctx
);
2518 if (num_printers
!= num_enumerated
) {
2519 d_printf("(%s) netshareenum gave %d printers, "
2520 "enumprinters lvl 1 gave %d\n", __location__
,
2521 num_printers
, num_enumerated
);
2522 talloc_free(mem_ctx
);
2529 if (!enumprinters(mem_ctx
, p
, 2, &num_enumerated
)) {
2530 d_printf("(%s) enumprinters failed\n", __location__
);
2531 talloc_free(mem_ctx
);
2534 if (num_printers
!= num_enumerated
) {
2535 d_printf("(%s) netshareenum gave %d printers, "
2536 "enumprinters lvl 2 gave %d\n", __location__
,
2537 num_printers
, num_enumerated
);
2538 talloc_free(mem_ctx
);
2543 talloc_free(mem_ctx
);