?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
Fix the developer O3 build
[Samba.git] / source4 / torture / rpc / samr.c
blob293b6722cc2ed424c3fec8595ba64252495ac96a
1 /*
2 Unix SMB/CIFS implementation.
3 test suite for samr rpc operations
4
5 Copyright (C) Andrew Tridgell 2003
6 Copyright (C) Andrew Bartlett <abartlet@samba.org> 2003
7 Copyright (C) Jelmer Vernooij 2005-2007
8 Copyright (C) Guenther Deschner 2008-2010
9
10 This program is free software; you can redistribute it and/or modify
11 it under the terms of the GNU General Public License as published by
12 the Free Software Foundation; either version 3 of the License, or
13 (at your option) any later version.
14
15 This program is distributed in the hope that it will be useful,
16 but WITHOUT ANY WARRANTY; without even the implied warranty of
17 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
18 GNU General Public License for more details.
19
20 You should have received a copy of the GNU General Public License
21 along with this program. If not, see <http://www.gnu.org/licenses/>.
22 */
23
24 #include "includes.h"
25 #include "torture/torture.h"
26 #include <tevent.h>
27 #include "system/time.h"
28 #include "system/network.h"
29 #include "librpc/gen_ndr/lsa.h"
30 #include "librpc/gen_ndr/ndr_netlogon.h"
31 #include "librpc/gen_ndr/ndr_netlogon_c.h"
32 #include "librpc/gen_ndr/ndr_samr_c.h"
33 #include "librpc/gen_ndr/ndr_lsa_c.h"
34 #include "../lib/crypto/crypto.h"
35 #include "libcli/auth/libcli_auth.h"
36 #include "libcli/security/security.h"
37 #include "torture/rpc/torture_rpc.h"
38 #include "param/param.h"
39 #include "auth/gensec/gensec.h"
40 #include "auth/gensec/gensec_proto.h"
41 #include "../libcli/auth/schannel.h"
42
43 #define TEST_ACCOUNT_NAME "samrtorturetest"
44 #define TEST_ACCOUNT_NAME_PWD "samrpwdlastset"
45 #define TEST_ALIASNAME "samrtorturetestalias"
46 #define TEST_GROUPNAME "samrtorturetestgroup"
47 #define TEST_MACHINENAME "samrtestmach$"
48 #define TEST_DOMAINNAME "samrtestdom$"
49
50 enum torture_samr_choice {
51 TORTURE_SAMR_PASSWORDS,
52 TORTURE_SAMR_PASSWORDS_PWDLASTSET,
53 TORTURE_SAMR_PASSWORDS_BADPWDCOUNT,
54 TORTURE_SAMR_PASSWORDS_LOCKOUT,
55 TORTURE_SAMR_USER_ATTRIBUTES,
56 TORTURE_SAMR_USER_PRIVILEGES,
57 TORTURE_SAMR_OTHER,
58 TORTURE_SAMR_MANY_ACCOUNTS,
59 TORTURE_SAMR_MANY_GROUPS,
60 TORTURE_SAMR_MANY_ALIASES
61 };
62
63 struct torture_samr_context {
64 struct policy_handle handle;
65 struct cli_credentials *machine_credentials;
66 enum torture_samr_choice choice;
67 uint32_t num_objects_large_dc;
68 };
69
70 static bool test_QueryUserInfo(struct dcerpc_binding_handle *b,
71 struct torture_context *tctx,
72 struct policy_handle *handle);
73
74 static bool test_QueryUserInfo2(struct dcerpc_binding_handle *b,
75 struct torture_context *tctx,
76 struct policy_handle *handle);
77
78 static bool test_QueryAliasInfo(struct dcerpc_binding_handle *b,
79 struct torture_context *tctx,
80 struct policy_handle *handle);
81
82 static bool test_ChangePassword(struct dcerpc_pipe *p,
83 struct torture_context *tctx,
84 const char *acct_name,
85 struct policy_handle *domain_handle, char **password);
86
87 static void init_lsa_String(struct lsa_String *string, const char *s)
88 {
89 string->string = s;
90 }
91
92 static void init_lsa_StringLarge(struct lsa_StringLarge *string, const char *s)
93 {
94 string->string = s;
95 }
96
97 static void init_lsa_BinaryString(struct lsa_BinaryString *string, const char *s, uint32_t length)
98 {
99 string->length = length;
100 string->size = length;
101 string->array = (uint16_t *)discard_const(s);
102 }
103
104 bool test_samr_handle_Close(struct dcerpc_binding_handle *b,
105 struct torture_context *tctx,
106 struct policy_handle *handle)
107 {
108 struct samr_Close r;
109
110 r.in.handle = handle;
111 r.out.handle = handle;
112
113 torture_assert_ntstatus_ok(tctx, dcerpc_samr_Close_r(b, tctx, &r),
114 "Close failed");
115 torture_assert_ntstatus_ok(tctx, r.out.result, "Close failed");
116
117 return true;
118 }
119
120 static bool test_Shutdown(struct dcerpc_binding_handle *b,
121 struct torture_context *tctx,
122 struct policy_handle *handle)
123 {
124 struct samr_Shutdown r;
125
126 if (!torture_setting_bool(tctx, "dangerous", false)) {
127 torture_skip(tctx, "samr_Shutdown disabled - enable dangerous tests to use\n");
128 return true;
129 }
130
131 r.in.connect_handle = handle;
132
133 torture_comment(tctx, "Testing samr_Shutdown\n");
134
135 torture_assert_ntstatus_ok(tctx, dcerpc_samr_Shutdown_r(b, tctx, &r),
136 "Shutdown failed");
137 torture_assert_ntstatus_ok(tctx, r.out.result, "Shutdown failed");
138
139 return true;
140 }
141
142 static bool test_SetDsrmPassword(struct dcerpc_binding_handle *b,
143 struct torture_context *tctx,
144 struct policy_handle *handle)
145 {
146 struct samr_SetDsrmPassword r;
147 struct lsa_String string;
148 struct samr_Password hash;
149
150 if (!torture_setting_bool(tctx, "dangerous", false)) {
151 torture_skip(tctx, "samr_SetDsrmPassword disabled - enable dangerous tests to use");
152 }
153
154 E_md4hash("TeSTDSRM123", hash.hash);
155
156 init_lsa_String(&string, "Administrator");
157
158 r.in.name = &string;
159 r.in.unknown = 0;
160 r.in.hash = &hash;
161
162 torture_comment(tctx, "Testing samr_SetDsrmPassword\n");
163
164 torture_assert_ntstatus_ok(tctx, dcerpc_samr_SetDsrmPassword_r(b, tctx, &r),
165 "SetDsrmPassword failed");
166 torture_assert_ntstatus_equal(tctx, r.out.result, NT_STATUS_NOT_SUPPORTED, "SetDsrmPassword failed");
167
168 return true;
169 }
170
171
172 static bool test_QuerySecurity(struct dcerpc_binding_handle *b,
173 struct torture_context *tctx,
174 struct policy_handle *handle)
175 {
176 struct samr_QuerySecurity r;
177 struct samr_SetSecurity s;
178 struct sec_desc_buf *sdbuf = NULL;
179
180 r.in.handle = handle;
181 r.in.sec_info = 7;
182 r.out.sdbuf = &sdbuf;
183
184 torture_assert_ntstatus_ok(tctx, dcerpc_samr_QuerySecurity_r(b, tctx, &r),
185 "QuerySecurity failed");
186 torture_assert_ntstatus_ok(tctx, r.out.result, "QuerySecurity failed");
187
188 torture_assert(tctx, sdbuf != NULL, "sdbuf is NULL");
189
190 s.in.handle = handle;
191 s.in.sec_info = 7;
192 s.in.sdbuf = sdbuf;
193
194 if (torture_setting_bool(tctx, "samba4", false)) {
195 torture_skip(tctx, "skipping SetSecurity test against Samba4\n");
196 }
197
198 torture_assert_ntstatus_ok(tctx, dcerpc_samr_SetSecurity_r(b, tctx, &s),
199 "SetSecurity failed");
200 torture_assert_ntstatus_ok(tctx, r.out.result, "SetSecurity failed");
201
202 torture_assert_ntstatus_ok(tctx, dcerpc_samr_QuerySecurity_r(b, tctx, &r),
203 "QuerySecurity failed");
204 torture_assert_ntstatus_ok(tctx, r.out.result, "QuerySecurity failed");
205
206 return true;
207 }
208
209
210 static bool test_SetUserInfo(struct dcerpc_binding_handle *b, struct torture_context *tctx,
211 struct policy_handle *handle, uint32_t base_acct_flags,
212 const char *base_account_name)
213 {
214 struct samr_SetUserInfo s;
215 struct samr_SetUserInfo2 s2;
216 struct samr_QueryUserInfo q;
217 struct samr_QueryUserInfo q0;
218 union samr_UserInfo u;
219 union samr_UserInfo *info;
220 bool ret = true;
221 const char *test_account_name;
222
223 uint32_t user_extra_flags = 0;
224
225 if (!torture_setting_bool(tctx, "samba3", false)) {
226 if (base_acct_flags == ACB_NORMAL) {
227 /* When created, accounts are expired by default */
228 user_extra_flags = ACB_PW_EXPIRED;
229 }
230 }
231
232 s.in.user_handle = handle;
233 s.in.info = &u;
234
235 s2.in.user_handle = handle;
236 s2.in.info = &u;
237
238 q.in.user_handle = handle;
239 q.out.info = &info;
240 q0 = q;
241
242 #define TESTCALL(call, r) \
243 torture_assert_ntstatus_ok(tctx, dcerpc_samr_ ##call## _r(b, tctx, &r),\
244 #call " failed"); \
245 if (!NT_STATUS_IS_OK(r.out.result)) { \
246 torture_result(tctx, TORTURE_FAIL, #call " level %u failed - %s (%s)\n", \
247 r.in.level, nt_errstr(r.out.result), __location__); \
248 ret = false; \
249 break; \
250 }
251
252 #define STRING_EQUAL(s1, s2, field) \
253 torture_assert_str_equal(tctx, s1, s2, "Failed to set " #field)
254
255 #define MEM_EQUAL(s1, s2, length, field) \
256 torture_assert_mem_equal(tctx, s1, s2, length, "Failed to set " #field)
257
258 #define INT_EQUAL(i1, i2, field) \
259 torture_assert_int_equal(tctx, i1, i2, "Failed to set " #field)
260
261 #define TEST_USERINFO_STRING(lvl1, field1, lvl2, field2, value, fpval) do { \
262 torture_comment(tctx, "field test %d/%s vs %d/%s\n", lvl1, #field1, lvl2, #field2); \
263 q.in.level = lvl1; \
264 TESTCALL(QueryUserInfo, q) \
265 s.in.level = lvl1; \
266 s2.in.level = lvl1; \
267 u = *info; \
268 if (lvl1 == 21) { \
269 ZERO_STRUCT(u.info21); \
270 u.info21.fields_present = fpval; \
271 } \
272 init_lsa_String(&u.info ## lvl1.field1, value); \
273 TESTCALL(SetUserInfo, s) \
274 TESTCALL(SetUserInfo2, s2) \
275 init_lsa_String(&u.info ## lvl1.field1, ""); \
276 TESTCALL(QueryUserInfo, q); \
277 u = *info; \
278 STRING_EQUAL(u.info ## lvl1.field1.string, value, field1); \
279 q.in.level = lvl2; \
280 TESTCALL(QueryUserInfo, q) \
281 u = *info; \
282 STRING_EQUAL(u.info ## lvl2.field2.string, value, field2); \
283 } while (0)
284
285 #define TEST_USERINFO_BINARYSTRING(lvl1, field1, lvl2, field2, value, fpval) do { \
286 torture_comment(tctx, "field test %d/%s vs %d/%s\n", lvl1, #field1, lvl2, #field2); \
287 q.in.level = lvl1; \
288 TESTCALL(QueryUserInfo, q) \
289 s.in.level = lvl1; \
290 s2.in.level = lvl1; \
291 u = *info; \
292 if (lvl1 == 21) { \
293 ZERO_STRUCT(u.info21); \
294 u.info21.fields_present = fpval; \
295 } \
296 init_lsa_BinaryString(&u.info ## lvl1.field1, value, strlen(value)); \
297 TESTCALL(SetUserInfo, s) \
298 TESTCALL(SetUserInfo2, s2) \
299 init_lsa_BinaryString(&u.info ## lvl1.field1, "", 1); \
300 TESTCALL(QueryUserInfo, q); \
301 u = *info; \
302 MEM_EQUAL(u.info ## lvl1.field1.array, value, strlen(value), field1); \
303 q.in.level = lvl2; \
304 TESTCALL(QueryUserInfo, q) \
305 u = *info; \
306 MEM_EQUAL(u.info ## lvl2.field2.array, value, strlen(value), field2); \
307 } while (0)
308
309 #define TEST_USERINFO_INT_EXP(lvl1, field1, lvl2, field2, value, exp_value, fpval) do { \
310 torture_comment(tctx, "field test %d/%s vs %d/%s\n", lvl1, #field1, lvl2, #field2); \
311 q.in.level = lvl1; \
312 TESTCALL(QueryUserInfo, q) \
313 s.in.level = lvl1; \
314 s2.in.level = lvl1; \
315 u = *info; \
316 if (lvl1 == 21) { \
317 uint8_t *bits = u.info21.logon_hours.bits; \
318 ZERO_STRUCT(u.info21); \
319 if (fpval == SAMR_FIELD_LOGON_HOURS) { \
320 u.info21.logon_hours.units_per_week = 168; \
321 u.info21.logon_hours.bits = bits; \
322 } \
323 u.info21.fields_present = fpval; \
324 } \
325 u.info ## lvl1.field1 = value; \
326 TESTCALL(SetUserInfo, s) \
327 TESTCALL(SetUserInfo2, s2) \
328 u.info ## lvl1.field1 = 0; \
329 TESTCALL(QueryUserInfo, q); \
330 u = *info; \
331 INT_EQUAL(u.info ## lvl1.field1, exp_value, field1); \
332 q.in.level = lvl2; \
333 TESTCALL(QueryUserInfo, q) \
334 u = *info; \
335 INT_EQUAL(u.info ## lvl2.field2, exp_value, field1); \
336 } while (0)
337
338 #define TEST_USERINFO_INT(lvl1, field1, lvl2, field2, value, fpval) do { \
339 TEST_USERINFO_INT_EXP(lvl1, field1, lvl2, field2, value, value, fpval); \
340 } while (0)
341
342 q0.in.level = 12;
343 do { TESTCALL(QueryUserInfo, q0) } while (0);
344
345 TEST_USERINFO_STRING(2, comment, 1, comment, "xx2-1 comment", 0);
346 TEST_USERINFO_STRING(2, comment, 21, comment, "xx2-21 comment", 0);
347 TEST_USERINFO_STRING(21, comment, 21, comment, "xx21-21 comment",
348 SAMR_FIELD_COMMENT);
349
350 test_account_name = talloc_asprintf(tctx, "%sxx7-1", base_account_name);
351 TEST_USERINFO_STRING(7, account_name, 1, account_name, test_account_name, 0);
352 test_account_name = talloc_asprintf(tctx, "%sxx7-3", base_account_name);
353 TEST_USERINFO_STRING(7, account_name, 3, account_name, test_account_name, 0);
354 test_account_name = talloc_asprintf(tctx, "%sxx7-5", base_account_name);
355 TEST_USERINFO_STRING(7, account_name, 5, account_name, test_account_name, 0);
356 test_account_name = talloc_asprintf(tctx, "%sxx7-6", base_account_name);
357 TEST_USERINFO_STRING(7, account_name, 6, account_name, test_account_name, 0);
358 test_account_name = talloc_asprintf(tctx, "%sxx7-7", base_account_name);
359 TEST_USERINFO_STRING(7, account_name, 7, account_name, test_account_name, 0);
360 test_account_name = talloc_asprintf(tctx, "%sxx7-21", base_account_name);
361 TEST_USERINFO_STRING(7, account_name, 21, account_name, test_account_name, 0);
362 test_account_name = base_account_name;
363 TEST_USERINFO_STRING(21, account_name, 21, account_name, test_account_name,
364 SAMR_FIELD_ACCOUNT_NAME);
365
366 TEST_USERINFO_STRING(6, full_name, 1, full_name, "xx6-1 full_name", 0);
367 TEST_USERINFO_STRING(6, full_name, 3, full_name, "xx6-3 full_name", 0);
368 TEST_USERINFO_STRING(6, full_name, 5, full_name, "xx6-5 full_name", 0);
369 TEST_USERINFO_STRING(6, full_name, 6, full_name, "xx6-6 full_name", 0);
370 TEST_USERINFO_STRING(6, full_name, 8, full_name, "xx6-8 full_name", 0);
371 TEST_USERINFO_STRING(6, full_name, 21, full_name, "xx6-21 full_name", 0);
372 TEST_USERINFO_STRING(8, full_name, 21, full_name, "xx8-21 full_name", 0);
373 TEST_USERINFO_STRING(21, full_name, 21, full_name, "xx21-21 full_name",
374 SAMR_FIELD_FULL_NAME);
375
376 TEST_USERINFO_STRING(6, full_name, 1, full_name, "", 0);
377 TEST_USERINFO_STRING(6, full_name, 3, full_name, "", 0);
378 TEST_USERINFO_STRING(6, full_name, 5, full_name, "", 0);
379 TEST_USERINFO_STRING(6, full_name, 6, full_name, "", 0);
380 TEST_USERINFO_STRING(6, full_name, 8, full_name, "", 0);
381 TEST_USERINFO_STRING(6, full_name, 21, full_name, "", 0);
382 TEST_USERINFO_STRING(8, full_name, 21, full_name, "", 0);
383 TEST_USERINFO_STRING(21, full_name, 21, full_name, "",
384 SAMR_FIELD_FULL_NAME);
385
386 TEST_USERINFO_STRING(11, logon_script, 3, logon_script, "xx11-3 logon_script", 0);
387 TEST_USERINFO_STRING(11, logon_script, 5, logon_script, "xx11-5 logon_script", 0);
388 TEST_USERINFO_STRING(11, logon_script, 21, logon_script, "xx11-21 logon_script", 0);
389 TEST_USERINFO_STRING(21, logon_script, 21, logon_script, "xx21-21 logon_script",
390 SAMR_FIELD_LOGON_SCRIPT);
391
392 TEST_USERINFO_STRING(12, profile_path, 3, profile_path, "xx12-3 profile_path", 0);
393 TEST_USERINFO_STRING(12, profile_path, 5, profile_path, "xx12-5 profile_path", 0);
394 TEST_USERINFO_STRING(12, profile_path, 21, profile_path, "xx12-21 profile_path", 0);
395 TEST_USERINFO_STRING(21, profile_path, 21, profile_path, "xx21-21 profile_path",
396 SAMR_FIELD_PROFILE_PATH);
397
398 TEST_USERINFO_STRING(10, home_directory, 3, home_directory, "xx10-3 home_directory", 0);
399 TEST_USERINFO_STRING(10, home_directory, 5, home_directory, "xx10-5 home_directory", 0);
400 TEST_USERINFO_STRING(10, home_directory, 21, home_directory, "xx10-21 home_directory", 0);
401 TEST_USERINFO_STRING(21, home_directory, 21, home_directory, "xx21-21 home_directory",
402 SAMR_FIELD_HOME_DIRECTORY);
403 TEST_USERINFO_STRING(21, home_directory, 10, home_directory, "xx21-10 home_directory",
404 SAMR_FIELD_HOME_DIRECTORY);
405
406 TEST_USERINFO_STRING(10, home_drive, 3, home_drive, "xx10-3 home_drive", 0);
407 TEST_USERINFO_STRING(10, home_drive, 5, home_drive, "xx10-5 home_drive", 0);
408 TEST_USERINFO_STRING(10, home_drive, 21, home_drive, "xx10-21 home_drive", 0);
409 TEST_USERINFO_STRING(21, home_drive, 21, home_drive, "xx21-21 home_drive",
410 SAMR_FIELD_HOME_DRIVE);
411 TEST_USERINFO_STRING(21, home_drive, 10, home_drive, "xx21-10 home_drive",
412 SAMR_FIELD_HOME_DRIVE);
413
414 TEST_USERINFO_STRING(13, description, 1, description, "xx13-1 description", 0);
415 TEST_USERINFO_STRING(13, description, 5, description, "xx13-5 description", 0);
416 TEST_USERINFO_STRING(13, description, 21, description, "xx13-21 description", 0);
417 TEST_USERINFO_STRING(21, description, 21, description, "xx21-21 description",
418 SAMR_FIELD_DESCRIPTION);
419
420 TEST_USERINFO_STRING(14, workstations, 3, workstations, "14workstation3", 0);
421 TEST_USERINFO_STRING(14, workstations, 5, workstations, "14workstation4", 0);
422 TEST_USERINFO_STRING(14, workstations, 21, workstations, "14workstation21", 0);
423 TEST_USERINFO_STRING(21, workstations, 21, workstations, "21workstation21",
424 SAMR_FIELD_WORKSTATIONS);
425 TEST_USERINFO_STRING(21, workstations, 3, workstations, "21workstation3",
426 SAMR_FIELD_WORKSTATIONS);
427 TEST_USERINFO_STRING(21, workstations, 5, workstations, "21workstation5",
428 SAMR_FIELD_WORKSTATIONS);
429 TEST_USERINFO_STRING(21, workstations, 14, workstations, "21workstation14",
430 SAMR_FIELD_WORKSTATIONS);
431
432 TEST_USERINFO_BINARYSTRING(20, parameters, 21, parameters, "xx20-21 parameters", 0);
433 TEST_USERINFO_BINARYSTRING(21, parameters, 21, parameters, "xx21-21 parameters",
434 SAMR_FIELD_PARAMETERS);
435 TEST_USERINFO_BINARYSTRING(21, parameters, 20, parameters, "xx21-20 parameters",
436 SAMR_FIELD_PARAMETERS);
437 /* also empty user parameters are allowed */
438 TEST_USERINFO_BINARYSTRING(20, parameters, 21, parameters, "", 0);
439 TEST_USERINFO_BINARYSTRING(21, parameters, 21, parameters, "",
440 SAMR_FIELD_PARAMETERS);
441 TEST_USERINFO_BINARYSTRING(21, parameters, 20, parameters, "",
442 SAMR_FIELD_PARAMETERS);
443
444 /* Samba 3 cannot store country_code and code_page atm. - gd */
445 if (!torture_setting_bool(tctx, "samba3", false)) {
446 TEST_USERINFO_INT(2, country_code, 2, country_code, __LINE__, 0);
447 TEST_USERINFO_INT(2, country_code, 21, country_code, __LINE__, 0);
448 TEST_USERINFO_INT(21, country_code, 21, country_code, __LINE__,
449 SAMR_FIELD_COUNTRY_CODE);
450 TEST_USERINFO_INT(21, country_code, 2, country_code, __LINE__,
451 SAMR_FIELD_COUNTRY_CODE);
452
453 TEST_USERINFO_INT(2, code_page, 21, code_page, __LINE__, 0);
454 TEST_USERINFO_INT(21, code_page, 21, code_page, __LINE__,
455 SAMR_FIELD_CODE_PAGE);
456 TEST_USERINFO_INT(21, code_page, 2, code_page, __LINE__,
457 SAMR_FIELD_CODE_PAGE);
458 }
459
460 if (!torture_setting_bool(tctx, "samba3", false)) {
461 TEST_USERINFO_INT(17, acct_expiry, 21, acct_expiry, __LINE__, 0);
462 TEST_USERINFO_INT(17, acct_expiry, 5, acct_expiry, __LINE__, 0);
463 TEST_USERINFO_INT(21, acct_expiry, 21, acct_expiry, __LINE__,
464 SAMR_FIELD_ACCT_EXPIRY);
465 TEST_USERINFO_INT(21, acct_expiry, 5, acct_expiry, __LINE__,
466 SAMR_FIELD_ACCT_EXPIRY);
467 TEST_USERINFO_INT(21, acct_expiry, 17, acct_expiry, __LINE__,
468 SAMR_FIELD_ACCT_EXPIRY);
469 } else {
470 /* Samba 3 can only store seconds / time_t in passdb - gd */
471 NTTIME nt;
472 unix_to_nt_time(&nt, time(NULL) + __LINE__);
473 TEST_USERINFO_INT(17, acct_expiry, 21, acct_expiry, nt, 0);
474 unix_to_nt_time(&nt, time(NULL) + __LINE__);
475 TEST_USERINFO_INT(17, acct_expiry, 5, acct_expiry, nt, 0);
476 unix_to_nt_time(&nt, time(NULL) + __LINE__);
477 TEST_USERINFO_INT(21, acct_expiry, 21, acct_expiry, nt, SAMR_FIELD_ACCT_EXPIRY);
478 unix_to_nt_time(&nt, time(NULL) + __LINE__);
479 TEST_USERINFO_INT(21, acct_expiry, 5, acct_expiry, nt, SAMR_FIELD_ACCT_EXPIRY);
480 unix_to_nt_time(&nt, time(NULL) + __LINE__);
481 TEST_USERINFO_INT(21, acct_expiry, 17, acct_expiry, nt, SAMR_FIELD_ACCT_EXPIRY);
482 }
483
484 TEST_USERINFO_INT(4, logon_hours.bits[3], 3, logon_hours.bits[3], 1, 0);
485 TEST_USERINFO_INT(4, logon_hours.bits[3], 5, logon_hours.bits[3], 2, 0);
486 TEST_USERINFO_INT(4, logon_hours.bits[3], 21, logon_hours.bits[3], 3, 0);
487 TEST_USERINFO_INT(21, logon_hours.bits[3], 21, logon_hours.bits[3], 4,
488 SAMR_FIELD_LOGON_HOURS);
489
490 TEST_USERINFO_INT_EXP(16, acct_flags, 5, acct_flags,
491 (base_acct_flags | ACB_DISABLED | ACB_HOMDIRREQ),
492 (base_acct_flags | ACB_DISABLED | ACB_HOMDIRREQ | user_extra_flags),
493 0);
494 TEST_USERINFO_INT_EXP(16, acct_flags, 5, acct_flags,
495 (base_acct_flags | ACB_DISABLED),
496 (base_acct_flags | ACB_DISABLED | user_extra_flags),
497 0);
498
499 /* Setting PWNOEXP clears the magic ACB_PW_EXPIRED flag */
500 TEST_USERINFO_INT_EXP(16, acct_flags, 5, acct_flags,
501 (base_acct_flags | ACB_DISABLED | ACB_PWNOEXP),
502 (base_acct_flags | ACB_DISABLED | ACB_PWNOEXP),
503 0);
504 TEST_USERINFO_INT_EXP(16, acct_flags, 21, acct_flags,
505 (base_acct_flags | ACB_DISABLED | ACB_HOMDIRREQ),
506 (base_acct_flags | ACB_DISABLED | ACB_HOMDIRREQ | user_extra_flags),
507 0);
508
509
510 /* The 'autolock' flag doesn't stick - check this */
511 TEST_USERINFO_INT_EXP(16, acct_flags, 21, acct_flags,
512 (base_acct_flags | ACB_DISABLED | ACB_AUTOLOCK),
513 (base_acct_flags | ACB_DISABLED | user_extra_flags),
514 0);
515 #if 0
516 /* Removing the 'disabled' flag doesn't stick - check this */
517 TEST_USERINFO_INT_EXP(16, acct_flags, 21, acct_flags,
518 (base_acct_flags),
519 (base_acct_flags | ACB_DISABLED | user_extra_flags),
520 0);
521 #endif
522
523 /* Samba3 cannot store these atm */
524 if (!torture_setting_bool(tctx, "samba3", false)) {
525 /* The 'store plaintext' flag does stick */
526 TEST_USERINFO_INT_EXP(16, acct_flags, 21, acct_flags,
527 (base_acct_flags | ACB_DISABLED | ACB_ENC_TXT_PWD_ALLOWED),
528 (base_acct_flags | ACB_DISABLED | ACB_ENC_TXT_PWD_ALLOWED | user_extra_flags),
529 0);
530 /* The 'use DES' flag does stick */
531 TEST_USERINFO_INT_EXP(16, acct_flags, 21, acct_flags,
532 (base_acct_flags | ACB_DISABLED | ACB_USE_DES_KEY_ONLY),
533 (base_acct_flags | ACB_DISABLED | ACB_USE_DES_KEY_ONLY | user_extra_flags),
534 0);
535 /* The 'don't require kerberos pre-authentication flag does stick */
536 TEST_USERINFO_INT_EXP(16, acct_flags, 21, acct_flags,
537 (base_acct_flags | ACB_DISABLED | ACB_DONT_REQUIRE_PREAUTH),
538 (base_acct_flags | ACB_DISABLED | ACB_DONT_REQUIRE_PREAUTH | user_extra_flags),
539 0);
540 /* The 'no kerberos PAC required' flag sticks */
541 TEST_USERINFO_INT_EXP(16, acct_flags, 21, acct_flags,
542 (base_acct_flags | ACB_DISABLED | ACB_NO_AUTH_DATA_REQD),
543 (base_acct_flags | ACB_DISABLED | ACB_NO_AUTH_DATA_REQD | user_extra_flags),
544 0);
545 }
546 TEST_USERINFO_INT_EXP(21, acct_flags, 21, acct_flags,
547 (base_acct_flags | ACB_DISABLED),
548 (base_acct_flags | ACB_DISABLED | user_extra_flags),
549 SAMR_FIELD_ACCT_FLAGS);
550
551 #if 0
552 /* these fail with win2003 - it appears you can't set the primary gid?
553 the set succeeds, but the gid isn't changed. Very weird! */
554 TEST_USERINFO_INT(9, primary_gid, 1, primary_gid, 513);
555 TEST_USERINFO_INT(9, primary_gid, 3, primary_gid, 513);
556 TEST_USERINFO_INT(9, primary_gid, 5, primary_gid, 513);
557 TEST_USERINFO_INT(9, primary_gid, 21, primary_gid, 513);
558 #endif
559
560 return ret;
561 }
562
563 /*
564 generate a random password for password change tests
565 */
566 static char *samr_rand_pass_silent(TALLOC_CTX *mem_ctx, int min_len)
567 {
568 size_t len = MAX(8, min_len);
569 char *s = generate_random_password(mem_ctx, len, len+6);
570 return s;
571 }
572
573 static char *samr_rand_pass(TALLOC_CTX *mem_ctx, int min_len)
574 {
575 char *s = samr_rand_pass_silent(mem_ctx, min_len);
576 printf("Generated password '%s'\n", s);
577 return s;
578
579 }
580
581 /*
582 generate a random password for password change tests
583 */
584 static DATA_BLOB samr_very_rand_pass(TALLOC_CTX *mem_ctx, int len)
585 {
586 int i;
587 DATA_BLOB password = data_blob_talloc(mem_ctx, NULL, len * 2 /* number of unicode chars */);
588 generate_random_buffer(password.data, password.length);
589
590 for (i=0; i < len; i++) {
591 if (((uint16_t *)password.data)[i] == 0) {
592 ((uint16_t *)password.data)[i] = 1;
593 }
594 }
595
596 return password;
597 }
598
599 /*
600 generate a random password for password change tests (fixed length)
601 */
602 static char *samr_rand_pass_fixed_len(TALLOC_CTX *mem_ctx, int len)
603 {
604 char *s = generate_random_password(mem_ctx, len, len);
605 printf("Generated password '%s'\n", s);
606 return s;
607 }
608
609 static bool test_SetUserPass(struct dcerpc_pipe *p, struct torture_context *tctx,
610 struct policy_handle *handle, char **password)
611 {
612 NTSTATUS status;
613 struct samr_SetUserInfo s;
614 union samr_UserInfo u;
615 bool ret = true;
616 DATA_BLOB session_key;
617 char *newpass;
618 struct dcerpc_binding_handle *b = p->binding_handle;
619 struct samr_GetUserPwInfo pwp;
620 struct samr_PwInfo info;
621 int policy_min_pw_len = 0;
622 pwp.in.user_handle = handle;
623 pwp.out.info = &info;
624
625 torture_assert_ntstatus_ok(tctx, dcerpc_samr_GetUserPwInfo_r(b, tctx, &pwp),
626 "GetUserPwInfo failed");
627 if (NT_STATUS_IS_OK(pwp.out.result)) {
628 policy_min_pw_len = pwp.out.info->min_password_length;
629 }
630 newpass = samr_rand_pass(tctx, policy_min_pw_len);
631
632 s.in.user_handle = handle;
633 s.in.info = &u;
634 s.in.level = 24;
635
636 encode_pw_buffer(u.info24.password.data, newpass, STR_UNICODE);
637 u.info24.password_expired = 0;
638
639 status = dcerpc_fetch_session_key(p, &session_key);
640 if (!NT_STATUS_IS_OK(status)) {
641 torture_result(tctx, TORTURE_FAIL, "SetUserInfo level %u - no session key - %s\n",
642 s.in.level, nt_errstr(status));
643 return false;
644 }
645
646 arcfour_crypt_blob(u.info24.password.data, 516, &session_key);
647
648 torture_comment(tctx, "Testing SetUserInfo level 24 (set password)\n");
649
650 torture_assert_ntstatus_ok(tctx, dcerpc_samr_SetUserInfo_r(b, tctx, &s),
651 "SetUserInfo failed");
652 torture_comment(tctx, "(%s:%s) new_password[%s] status[%s]\n",
653 __location__, __FUNCTION__,
654 newpass, nt_errstr(s.out.result));
655 if (!NT_STATUS_IS_OK(s.out.result)) {
656 torture_result(tctx, TORTURE_FAIL, "SetUserInfo level %u failed - %s\n",
657 s.in.level, nt_errstr(s.out.result));
658 ret = false;
659 } else {
660 *password = newpass;
661 }
662
663 return ret;
664 }
665
666
667 static bool test_SetUserPass_23(struct dcerpc_pipe *p, struct torture_context *tctx,
668 struct policy_handle *handle, uint32_t fields_present,
669 char **password)
670 {
671 NTSTATUS status;
672 struct samr_SetUserInfo s;
673 union samr_UserInfo u;
674 bool ret = true;
675 DATA_BLOB session_key;
676 struct dcerpc_binding_handle *b = p->binding_handle;
677 char *newpass;
678 struct samr_GetUserPwInfo pwp;
679 struct samr_PwInfo info;
680 int policy_min_pw_len = 0;
681 pwp.in.user_handle = handle;
682 pwp.out.info = &info;
683
684 torture_assert_ntstatus_ok(tctx, dcerpc_samr_GetUserPwInfo_r(b, tctx, &pwp),
685 "GetUserPwInfo failed");
686 if (NT_STATUS_IS_OK(pwp.out.result)) {
687 policy_min_pw_len = pwp.out.info->min_password_length;
688 }
689 newpass = samr_rand_pass(tctx, policy_min_pw_len);
690
691 s.in.user_handle = handle;
692 s.in.info = &u;
693 s.in.level = 23;
694
695 ZERO_STRUCT(u);
696
697 u.info23.info.fields_present = fields_present;
698
699 encode_pw_buffer(u.info23.password.data, newpass, STR_UNICODE);
700
701 status = dcerpc_fetch_session_key(p, &session_key);
702 if (!NT_STATUS_IS_OK(status)) {
703 torture_result(tctx, TORTURE_FAIL, "SetUserInfo level %u - no session key - %s\n",
704 s.in.level, nt_errstr(status));
705 return false;
706 }
707
708 arcfour_crypt_blob(u.info23.password.data, 516, &session_key);
709
710 torture_comment(tctx, "Testing SetUserInfo level 23 (set password)\n");
711
712 torture_assert_ntstatus_ok(tctx, dcerpc_samr_SetUserInfo_r(b, tctx, &s),
713 "SetUserInfo failed");
714 torture_comment(tctx, "(%s:%s) new_password[%s] status[%s]\n",
715 __location__, __FUNCTION__,
716 newpass, nt_errstr(s.out.result));
717 if (!NT_STATUS_IS_OK(s.out.result)) {
718 torture_result(tctx, TORTURE_FAIL, "SetUserInfo level %u failed - %s\n",
719 s.in.level, nt_errstr(s.out.result));
720 ret = false;
721 } else {
722 *password = newpass;
723 }
724
725 encode_pw_buffer(u.info23.password.data, newpass, STR_UNICODE);
726
727 status = dcerpc_fetch_session_key(p, &session_key);
728 if (!NT_STATUS_IS_OK(status)) {
729 torture_result(tctx, TORTURE_FAIL, "SetUserInfo level %u - no session key - %s\n",
730 s.in.level, nt_errstr(status));
731 return false;
732 }
733
734 /* This should break the key nicely */
735 session_key.length--;
736 arcfour_crypt_blob(u.info23.password.data, 516, &session_key);
737
738 torture_comment(tctx, "Testing SetUserInfo level 23 (set password) with wrong password\n");
739
740 torture_assert_ntstatus_ok(tctx, dcerpc_samr_SetUserInfo_r(b, tctx, &s),
741 "SetUserInfo failed");
742 torture_comment(tctx, "(%s:%s) new_password[%s] status[%s]\n",
743 __location__, __FUNCTION__,
744 newpass, nt_errstr(s.out.result));
745 if (!NT_STATUS_EQUAL(s.out.result, NT_STATUS_WRONG_PASSWORD)) {
746 torture_result(tctx, TORTURE_FAIL, "SetUserInfo level %u should have failed with WRONG_PASSWORD- %s\n",
747 s.in.level, nt_errstr(s.out.result));
748 ret = false;
749 }
750
751 return ret;
752 }
753
754
755 static bool test_SetUserPassEx(struct dcerpc_pipe *p, struct torture_context *tctx,
756 struct policy_handle *handle, bool makeshort,
757 char **password)
758 {
759 NTSTATUS status;
760 struct samr_SetUserInfo s;
761 union samr_UserInfo u;
762 bool ret = true;
763 DATA_BLOB session_key;
764 DATA_BLOB confounded_session_key = data_blob_talloc(tctx, NULL, 16);
765 uint8_t confounder[16];
766 char *newpass;
767 struct dcerpc_binding_handle *b = p->binding_handle;
768 MD5_CTX ctx;
769 struct samr_GetUserPwInfo pwp;
770 struct samr_PwInfo info;
771 int policy_min_pw_len = 0;
772 pwp.in.user_handle = handle;
773 pwp.out.info = &info;
774
775 torture_assert_ntstatus_ok(tctx, dcerpc_samr_GetUserPwInfo_r(b, tctx, &pwp),
776 "GetUserPwInfo failed");
777 if (NT_STATUS_IS_OK(pwp.out.result)) {
778 policy_min_pw_len = pwp.out.info->min_password_length;
779 }
780 if (makeshort && policy_min_pw_len) {
781 newpass = samr_rand_pass_fixed_len(tctx, policy_min_pw_len - 1);
782 } else {
783 newpass = samr_rand_pass(tctx, policy_min_pw_len);
784 }
785
786 s.in.user_handle = handle;
787 s.in.info = &u;
788 s.in.level = 26;
789
790 encode_pw_buffer(u.info26.password.data, newpass, STR_UNICODE);
791 u.info26.password_expired = 0;
792
793 status = dcerpc_fetch_session_key(p, &session_key);
794 if (!NT_STATUS_IS_OK(status)) {
795 torture_result(tctx, TORTURE_FAIL, "SetUserInfo level %u - no session key - %s\n",
796 s.in.level, nt_errstr(status));
797 return false;
798 }
799
800 generate_random_buffer((uint8_t *)confounder, 16);
801
802 MD5Init(&ctx);
803 MD5Update(&ctx, confounder, 16);
804 MD5Update(&ctx, session_key.data, session_key.length);
805 MD5Final(confounded_session_key.data, &ctx);
806
807 arcfour_crypt_blob(u.info26.password.data, 516, &confounded_session_key);
808 memcpy(&u.info26.password.data[516], confounder, 16);
809
810 torture_comment(tctx, "Testing SetUserInfo level 26 (set password ex)\n");
811
812 torture_assert_ntstatus_ok(tctx, dcerpc_samr_SetUserInfo_r(b, tctx, &s),
813 "SetUserInfo failed");
814 torture_comment(tctx, "(%s:%s) new_password[%s] status[%s]\n",
815 __location__, __FUNCTION__,
816 newpass, nt_errstr(s.out.result));
817 if (!NT_STATUS_IS_OK(s.out.result)) {
818 torture_result(tctx, TORTURE_FAIL, "SetUserInfo level %u failed - %s\n",
819 s.in.level, nt_errstr(s.out.result));
820 ret = false;
821 } else {
822 *password = newpass;
823 }
824
825 /* This should break the key nicely */
826 confounded_session_key.data[0]++;
827
828 arcfour_crypt_blob(u.info26.password.data, 516, &confounded_session_key);
829 memcpy(&u.info26.password.data[516], confounder, 16);
830
831 torture_comment(tctx, "Testing SetUserInfo level 26 (set password ex) with wrong session key\n");
832
833 torture_assert_ntstatus_ok(tctx, dcerpc_samr_SetUserInfo_r(b, tctx, &s),
834 "SetUserInfo failed");
835 torture_comment(tctx, "(%s:%s) new_password[%s] status[%s]\n",
836 __location__, __FUNCTION__,
837 newpass, nt_errstr(s.out.result));
838 if (!NT_STATUS_EQUAL(s.out.result, NT_STATUS_WRONG_PASSWORD)) {
839 torture_result(tctx, TORTURE_FAIL, "SetUserInfo level %u should have failed with WRONG_PASSWORD: %s\n",
840 s.in.level, nt_errstr(s.out.result));
841 ret = false;
842 } else {
843 *password = newpass;
844 }
845
846 return ret;
847 }
848
849 static bool test_SetUserPass_25(struct dcerpc_pipe *p, struct torture_context *tctx,
850 struct policy_handle *handle, uint32_t fields_present,
851 char **password)
852 {
853 NTSTATUS status;
854 struct samr_SetUserInfo s;
855 union samr_UserInfo u;
856 bool ret = true;
857 DATA_BLOB session_key;
858 DATA_BLOB confounded_session_key = data_blob_talloc(tctx, NULL, 16);
859 MD5_CTX ctx;
860 uint8_t confounder[16];
861 char *newpass;
862 struct dcerpc_binding_handle *b = p->binding_handle;
863 struct samr_GetUserPwInfo pwp;
864 struct samr_PwInfo info;
865 int policy_min_pw_len = 0;
866 pwp.in.user_handle = handle;
867 pwp.out.info = &info;
868
869 torture_assert_ntstatus_ok(tctx, dcerpc_samr_GetUserPwInfo_r(b, tctx, &pwp),
870 "GetUserPwInfo failed");
871 if (NT_STATUS_IS_OK(pwp.out.result)) {
872 policy_min_pw_len = pwp.out.info->min_password_length;
873 }
874 newpass = samr_rand_pass(tctx, policy_min_pw_len);
875
876 s.in.user_handle = handle;
877 s.in.info = &u;
878 s.in.level = 25;
879
880 ZERO_STRUCT(u);
881
882 u.info25.info.fields_present = fields_present;
883
884 encode_pw_buffer(u.info25.password.data, newpass, STR_UNICODE);
885
886 status = dcerpc_fetch_session_key(p, &session_key);
887 if (!NT_STATUS_IS_OK(status)) {
888 torture_result(tctx, TORTURE_FAIL, "SetUserInfo level %u - no session key - %s\n",
889 s.in.level, nt_errstr(status));
890 return false;
891 }
892
893 generate_random_buffer((uint8_t *)confounder, 16);
894
895 MD5Init(&ctx);
896 MD5Update(&ctx, confounder, 16);
897 MD5Update(&ctx, session_key.data, session_key.length);
898 MD5Final(confounded_session_key.data, &ctx);
899
900 arcfour_crypt_blob(u.info25.password.data, 516, &confounded_session_key);
901 memcpy(&u.info25.password.data[516], confounder, 16);
902
903 torture_comment(tctx, "Testing SetUserInfo level 25 (set password ex)\n");
904
905 torture_assert_ntstatus_ok(tctx, dcerpc_samr_SetUserInfo_r(b, tctx, &s),
906 "SetUserInfo failed");
907 torture_comment(tctx, "(%s:%s) new_password[%s] status[%s]\n",
908 __location__, __FUNCTION__,
909 newpass, nt_errstr(s.out.result));
910 if (!NT_STATUS_IS_OK(s.out.result)) {
911 torture_result(tctx, TORTURE_FAIL, "SetUserInfo level %u failed - %s\n",
912 s.in.level, nt_errstr(s.out.result));
913 ret = false;
914 } else {
915 *password = newpass;
916 }
917
918 /* This should break the key nicely */
919 confounded_session_key.data[0]++;
920
921 arcfour_crypt_blob(u.info25.password.data, 516, &confounded_session_key);
922 memcpy(&u.info25.password.data[516], confounder, 16);
923
924 torture_comment(tctx, "Testing SetUserInfo level 25 (set password ex) with wrong session key\n");
925
926 torture_assert_ntstatus_ok(tctx, dcerpc_samr_SetUserInfo_r(b, tctx, &s),
927 "SetUserInfo failed");
928 torture_comment(tctx, "(%s:%s) new_password[%s] status[%s]\n",
929 __location__, __FUNCTION__,
930 newpass, nt_errstr(s.out.result));
931 if (!NT_STATUS_EQUAL(s.out.result, NT_STATUS_WRONG_PASSWORD)) {
932 torture_result(tctx, TORTURE_FAIL, "SetUserInfo level %u should have failed with WRONG_PASSWORD- %s\n",
933 s.in.level, nt_errstr(s.out.result));
934 ret = false;
935 }
936
937 return ret;
938 }
939
940 static bool test_SetUserPass_18(struct dcerpc_pipe *p, struct torture_context *tctx,
941 struct policy_handle *handle, char **password)
942 {
943 NTSTATUS status;
944 struct samr_SetUserInfo s;
945 union samr_UserInfo u;
946 bool ret = true;
947 DATA_BLOB session_key;
948 char *newpass;
949 struct dcerpc_binding_handle *b = p->binding_handle;
950 struct samr_GetUserPwInfo pwp;
951 struct samr_PwInfo info;
952 int policy_min_pw_len = 0;
953 uint8_t lm_hash[16], nt_hash[16];
954
955 pwp.in.user_handle = handle;
956 pwp.out.info = &info;
957
958 torture_assert_ntstatus_ok(tctx, dcerpc_samr_GetUserPwInfo_r(b, tctx, &pwp),
959 "GetUserPwInfo failed");
960 if (NT_STATUS_IS_OK(pwp.out.result)) {
961 policy_min_pw_len = pwp.out.info->min_password_length;
962 }
963 newpass = samr_rand_pass(tctx, policy_min_pw_len);
964
965 s.in.user_handle = handle;
966 s.in.info = &u;
967 s.in.level = 18;
968
969 ZERO_STRUCT(u);
970
971 u.info18.nt_pwd_active = true;
972 u.info18.lm_pwd_active = true;
973
974 E_md4hash(newpass, nt_hash);
975 E_deshash(newpass, lm_hash);
976
977 status = dcerpc_fetch_session_key(p, &session_key);
978 if (!NT_STATUS_IS_OK(status)) {
979 torture_result(tctx, TORTURE_FAIL, "SetUserInfo level %u - no session key - %s\n",
980 s.in.level, nt_errstr(status));
981 return false;
982 }
983
984 {
985 DATA_BLOB in,out;
986 in = data_blob_const(nt_hash, 16);
987 out = data_blob_talloc_zero(tctx, 16);
988 sess_crypt_blob(&out, &in, &session_key, true);
989 memcpy(u.info18.nt_pwd.hash, out.data, out.length);
990 }
991 {
992 DATA_BLOB in,out;
993 in = data_blob_const(lm_hash, 16);
994 out = data_blob_talloc_zero(tctx, 16);
995 sess_crypt_blob(&out, &in, &session_key, true);
996 memcpy(u.info18.lm_pwd.hash, out.data, out.length);
997 }
998
999 torture_comment(tctx, "Testing SetUserInfo level 18 (set password hash)\n");
1000
1001 torture_assert_ntstatus_ok(tctx, dcerpc_samr_SetUserInfo_r(b, tctx, &s),
1002 "SetUserInfo failed");
1003 if (!NT_STATUS_IS_OK(s.out.result)) {
1004 torture_result(tctx, TORTURE_FAIL, "SetUserInfo level %u failed - %s\n",
1005 s.in.level, nt_errstr(s.out.result));
1006 ret = false;
1007 } else {
1008 *password = newpass;
1009 }
1010
1011 return ret;
1012 }
1013
1014 static bool test_SetUserPass_21(struct dcerpc_pipe *p, struct torture_context *tctx,
1015 struct policy_handle *handle, uint32_t fields_present,
1016 char **password)
1017 {
1018 NTSTATUS status;
1019 struct samr_SetUserInfo s;
1020 union samr_UserInfo u;
1021 bool ret = true;
1022 DATA_BLOB session_key;
1023 char *newpass;
1024 struct dcerpc_binding_handle *b = p->binding_handle;
1025 struct samr_GetUserPwInfo pwp;
1026 struct samr_PwInfo info;
1027 int policy_min_pw_len = 0;
1028 uint8_t lm_hash[16], nt_hash[16];
1029
1030 pwp.in.user_handle = handle;
1031 pwp.out.info = &info;
1032
1033 torture_assert_ntstatus_ok(tctx, dcerpc_samr_GetUserPwInfo_r(b, tctx, &pwp),
1034 "GetUserPwInfo failed");
1035 if (NT_STATUS_IS_OK(pwp.out.result)) {
1036 policy_min_pw_len = pwp.out.info->min_password_length;
1037 }
1038 newpass = samr_rand_pass(tctx, policy_min_pw_len);
1039
1040 s.in.user_handle = handle;
1041 s.in.info = &u;
1042 s.in.level = 21;
1043
1044 E_md4hash(newpass, nt_hash);
1045 E_deshash(newpass, lm_hash);
1046
1047 ZERO_STRUCT(u);
1048
1049 u.info21.fields_present = fields_present;
1050
1051 if (fields_present & SAMR_FIELD_LM_PASSWORD_PRESENT) {
1052 u.info21.lm_owf_password.length = 16;
1053 u.info21.lm_owf_password.size = 16;
1054 u.info21.lm_owf_password.array = (uint16_t *)lm_hash;
1055 u.info21.lm_password_set = true;
1056 }
1057
1058 if (fields_present & SAMR_FIELD_NT_PASSWORD_PRESENT) {
1059 u.info21.nt_owf_password.length = 16;
1060 u.info21.nt_owf_password.size = 16;
1061 u.info21.nt_owf_password.array = (uint16_t *)nt_hash;
1062 u.info21.nt_password_set = true;
1063 }
1064
1065 status = dcerpc_fetch_session_key(p, &session_key);
1066 if (!NT_STATUS_IS_OK(status)) {
1067 torture_result(tctx, TORTURE_FAIL, "SetUserInfo level %u - no session key - %s\n",
1068 s.in.level, nt_errstr(status));
1069 return false;
1070 }
1071
1072 if (fields_present & SAMR_FIELD_LM_PASSWORD_PRESENT) {
1073 DATA_BLOB in,out;
1074 in = data_blob_const(u.info21.lm_owf_password.array,
1075 u.info21.lm_owf_password.length);
1076 out = data_blob_talloc_zero(tctx, 16);
1077 sess_crypt_blob(&out, &in, &session_key, true);
1078 u.info21.lm_owf_password.array = (uint16_t *)out.data;
1079 }
1080
1081 if (fields_present & SAMR_FIELD_NT_PASSWORD_PRESENT) {
1082 DATA_BLOB in,out;
1083 in = data_blob_const(u.info21.nt_owf_password.array,
1084 u.info21.nt_owf_password.length);
1085 out = data_blob_talloc_zero(tctx, 16);
1086 sess_crypt_blob(&out, &in, &session_key, true);
1087 u.info21.nt_owf_password.array = (uint16_t *)out.data;
1088 }
1089
1090 torture_comment(tctx, "Testing SetUserInfo level 21 (set password hash)\n");
1091
1092 torture_assert_ntstatus_ok(tctx, dcerpc_samr_SetUserInfo_r(b, tctx, &s),
1093 "SetUserInfo failed");
1094 if (!NT_STATUS_IS_OK(s.out.result)) {
1095 torture_result(tctx, TORTURE_FAIL, "SetUserInfo level %u failed - %s\n",
1096 s.in.level, nt_errstr(s.out.result));
1097 ret = false;
1098 } else {
1099 *password = newpass;
1100 }
1101
1102 /* try invalid length */
1103 if (fields_present & SAMR_FIELD_NT_PASSWORD_PRESENT) {
1104
1105 u.info21.nt_owf_password.length++;
1106
1107 torture_assert_ntstatus_ok(tctx, dcerpc_samr_SetUserInfo_r(b, tctx, &s),
1108 "SetUserInfo failed");
1109 if (!NT_STATUS_EQUAL(s.out.result, NT_STATUS_INVALID_PARAMETER)) {
1110 torture_result(tctx, TORTURE_FAIL, "SetUserInfo level %u should have failed with NT_STATUS_INVALID_PARAMETER - %s\n",
1111 s.in.level, nt_errstr(s.out.result));
1112 ret = false;
1113 }
1114 }
1115
1116 if (fields_present & SAMR_FIELD_LM_PASSWORD_PRESENT) {
1117
1118 u.info21.lm_owf_password.length++;
1119
1120 torture_assert_ntstatus_ok(tctx, dcerpc_samr_SetUserInfo_r(b, tctx, &s),
1121 "SetUserInfo failed");
1122 if (!NT_STATUS_EQUAL(s.out.result, NT_STATUS_INVALID_PARAMETER)) {
1123 torture_result(tctx, TORTURE_FAIL, "SetUserInfo level %u should have failed with NT_STATUS_INVALID_PARAMETER - %s\n",
1124 s.in.level, nt_errstr(s.out.result));
1125 ret = false;
1126 }
1127 }
1128
1129 return ret;
1130 }
1131
1132 static bool test_SetUserPass_level_ex(struct dcerpc_pipe *p,
1133 struct torture_context *tctx,
1134 struct policy_handle *handle,
1135 uint16_t level,
1136 uint32_t fields_present,
1137 char **password, uint8_t password_expired,
1138 bool use_setinfo2,
1139 bool *matched_expected_error)
1140 {
1141 NTSTATUS status;
1142 NTSTATUS expected_error = NT_STATUS_OK;
1143 struct samr_SetUserInfo s;
1144 struct samr_SetUserInfo2 s2;
1145 union samr_UserInfo u;
1146 bool ret = true;
1147 DATA_BLOB session_key;
1148 DATA_BLOB confounded_session_key = data_blob_talloc(tctx, NULL, 16);
1149 MD5_CTX ctx;
1150 uint8_t confounder[16];
1151 char *newpass;
1152 struct dcerpc_binding_handle *b = p->binding_handle;
1153 struct samr_GetUserPwInfo pwp;
1154 struct samr_PwInfo info;
1155 int policy_min_pw_len = 0;
1156 const char *comment = NULL;
1157 uint8_t lm_hash[16], nt_hash[16];
1158
1159 pwp.in.user_handle = handle;
1160 pwp.out.info = &info;
1161
1162 torture_assert_ntstatus_ok(tctx, dcerpc_samr_GetUserPwInfo_r(b, tctx, &pwp),
1163 "GetUserPwInfo failed");
1164 if (NT_STATUS_IS_OK(pwp.out.result)) {
1165 policy_min_pw_len = pwp.out.info->min_password_length;
1166 }
1167 newpass = samr_rand_pass_silent(tctx, policy_min_pw_len);
1168
1169 if (use_setinfo2) {
1170 s2.in.user_handle = handle;
1171 s2.in.info = &u;
1172 s2.in.level = level;
1173 } else {
1174 s.in.user_handle = handle;
1175 s.in.info = &u;
1176 s.in.level = level;
1177 }
1178
1179 if (fields_present & SAMR_FIELD_COMMENT) {
1180 comment = talloc_asprintf(tctx, "comment: %ld\n", (long int) time(NULL));
1181 }
1182
1183 ZERO_STRUCT(u);
1184
1185 switch (level) {
1186 case 18:
1187 E_md4hash(newpass, nt_hash);
1188 E_deshash(newpass, lm_hash);
1189
1190 u.info18.nt_pwd_active = true;
1191 u.info18.lm_pwd_active = true;
1192 u.info18.password_expired = password_expired;
1193
1194 memcpy(u.info18.lm_pwd.hash, lm_hash, 16);
1195 memcpy(u.info18.nt_pwd.hash, nt_hash, 16);
1196
1197 break;
1198 case 21:
1199 E_md4hash(newpass, nt_hash);
1200 E_deshash(newpass, lm_hash);
1201
1202 u.info21.fields_present = fields_present;
1203 u.info21.password_expired = password_expired;
1204 u.info21.comment.string = comment;
1205
1206 if (fields_present & SAMR_FIELD_LM_PASSWORD_PRESENT) {
1207 u.info21.lm_owf_password.length = 16;
1208 u.info21.lm_owf_password.size = 16;
1209 u.info21.lm_owf_password.array = (uint16_t *)lm_hash;
1210 u.info21.lm_password_set = true;
1211 }
1212
1213 if (fields_present & SAMR_FIELD_NT_PASSWORD_PRESENT) {
1214 u.info21.nt_owf_password.length = 16;
1215 u.info21.nt_owf_password.size = 16;
1216 u.info21.nt_owf_password.array = (uint16_t *)nt_hash;
1217 u.info21.nt_password_set = true;
1218 }
1219
1220 break;
1221 case 23:
1222 u.info23.info.fields_present = fields_present;
1223 u.info23.info.password_expired = password_expired;
1224 u.info23.info.comment.string = comment;
1225
1226 encode_pw_buffer(u.info23.password.data, newpass, STR_UNICODE);
1227
1228 break;
1229 case 24:
1230 u.info24.password_expired = password_expired;
1231
1232 encode_pw_buffer(u.info24.password.data, newpass, STR_UNICODE);
1233
1234 break;
1235 case 25:
1236 u.info25.info.fields_present = fields_present;
1237 u.info25.info.password_expired = password_expired;
1238 u.info25.info.comment.string = comment;
1239
1240 encode_pw_buffer(u.info25.password.data, newpass, STR_UNICODE);
1241
1242 break;
1243 case 26:
1244 u.info26.password_expired = password_expired;
1245
1246 encode_pw_buffer(u.info26.password.data, newpass, STR_UNICODE);
1247
1248 break;
1249 }
1250
1251 status = dcerpc_fetch_session_key(p, &session_key);
1252 if (!NT_STATUS_IS_OK(status)) {
1253 torture_result(tctx, TORTURE_FAIL, "SetUserInfo level %u - no session key - %s\n",
1254 s.in.level, nt_errstr(status));
1255 return false;
1256 }
1257
1258 generate_random_buffer((uint8_t *)confounder, 16);
1259
1260 MD5Init(&ctx);
1261 MD5Update(&ctx, confounder, 16);
1262 MD5Update(&ctx, session_key.data, session_key.length);
1263 MD5Final(confounded_session_key.data, &ctx);
1264
1265 switch (level) {
1266 case 18:
1267 {
1268 DATA_BLOB in,out;
1269 in = data_blob_const(u.info18.nt_pwd.hash, 16);
1270 out = data_blob_talloc_zero(tctx, 16);
1271 sess_crypt_blob(&out, &in, &session_key, true);
1272 memcpy(u.info18.nt_pwd.hash, out.data, out.length);
1273 }
1274 {
1275 DATA_BLOB in,out;
1276 in = data_blob_const(u.info18.lm_pwd.hash, 16);
1277 out = data_blob_talloc_zero(tctx, 16);
1278 sess_crypt_blob(&out, &in, &session_key, true);
1279 memcpy(u.info18.lm_pwd.hash, out.data, out.length);
1280 }
1281
1282 break;
1283 case 21:
1284 if (fields_present & SAMR_FIELD_LM_PASSWORD_PRESENT) {
1285 DATA_BLOB in,out;
1286 in = data_blob_const(u.info21.lm_owf_password.array,
1287 u.info21.lm_owf_password.length);
1288 out = data_blob_talloc_zero(tctx, 16);
1289 sess_crypt_blob(&out, &in, &session_key, true);
1290 u.info21.lm_owf_password.array = (uint16_t *)out.data;
1291 }
1292 if (fields_present & SAMR_FIELD_NT_PASSWORD_PRESENT) {
1293 DATA_BLOB in,out;
1294 in = data_blob_const(u.info21.nt_owf_password.array,
1295 u.info21.nt_owf_password.length);
1296 out = data_blob_talloc_zero(tctx, 16);
1297 sess_crypt_blob(&out, &in, &session_key, true);
1298 u.info21.nt_owf_password.array = (uint16_t *)out.data;
1299 }
1300 break;
1301 case 23:
1302 arcfour_crypt_blob(u.info23.password.data, 516, &session_key);
1303 break;
1304 case 24:
1305 arcfour_crypt_blob(u.info24.password.data, 516, &session_key);
1306 break;
1307 case 25:
1308 arcfour_crypt_blob(u.info25.password.data, 516, &confounded_session_key);
1309 memcpy(&u.info25.password.data[516], confounder, 16);
1310 break;
1311 case 26:
1312 arcfour_crypt_blob(u.info26.password.data, 516, &confounded_session_key);
1313 memcpy(&u.info26.password.data[516], confounder, 16);
1314 break;
1315 }
1316
1317 if (use_setinfo2) {
1318 torture_assert_ntstatus_ok(tctx, dcerpc_samr_SetUserInfo2_r(b, tctx, &s2),
1319 "SetUserInfo2 failed");
1320 torture_comment(tctx, "(%s:%s) new_password[%s] status[%s]\n",
1321 __location__, __FUNCTION__,
1322 newpass, nt_errstr(s2.out.result));
1323 status = s2.out.result;
1324 } else {
1325 torture_assert_ntstatus_ok(tctx, dcerpc_samr_SetUserInfo_r(b, tctx, &s),
1326 "SetUserInfo failed");
1327 torture_comment(tctx, "(%s:%s) new_password[%s] status[%s]\n",
1328 __location__, __FUNCTION__,
1329 newpass, nt_errstr(s.out.result));
1330 status = s.out.result;
1331 }
1332
1333 if (!NT_STATUS_IS_OK(status)) {
1334 if (fields_present == 0) {
1335 expected_error = NT_STATUS_INVALID_PARAMETER;
1336 }
1337 if (fields_present & SAMR_FIELD_LAST_PWD_CHANGE) {
1338 expected_error = NT_STATUS_ACCESS_DENIED;
1339 }
1340 }
1341
1342 if (!NT_STATUS_IS_OK(expected_error)) {
1343 if (use_setinfo2) {
1344 torture_assert_ntstatus_equal(tctx,
1345 s2.out.result,
1346 expected_error, "SetUserInfo2 failed");
1347 } else {
1348 torture_assert_ntstatus_equal(tctx,
1349 s.out.result,
1350 expected_error, "SetUserInfo failed");
1351 }
1352 *matched_expected_error = true;
1353 return true;
1354 }
1355
1356 if (!NT_STATUS_IS_OK(status)) {
1357 torture_result(tctx, TORTURE_FAIL, "SetUserInfo%s level %u failed - %s\n",
1358 use_setinfo2 ? "2":"", level, nt_errstr(status));
1359 ret = false;
1360 } else {
1361 *password = newpass;
1362 }
1363
1364 return ret;
1365 }
1366
1367 static bool test_SetAliasInfo(struct dcerpc_binding_handle *b,
1368 struct torture_context *tctx,
1369 struct policy_handle *handle)
1370 {
1371 struct samr_SetAliasInfo r;
1372 struct samr_QueryAliasInfo q;
1373 union samr_AliasInfo *info;
1374 uint16_t levels[] = {2, 3};
1375 int i;
1376 bool ret = true;
1377
1378 /* Ignoring switch level 1, as that includes the number of members for the alias
1379 * and setting this to a wrong value might have negative consequences
1380 */
1381
1382 for (i=0;i<ARRAY_SIZE(levels);i++) {
1383 torture_comment(tctx, "Testing SetAliasInfo level %u\n", levels[i]);
1384
1385 r.in.alias_handle = handle;
1386 r.in.level = levels[i];
1387 r.in.info = talloc(tctx, union samr_AliasInfo);
1388 switch (r.in.level) {
1389 case ALIASINFONAME: init_lsa_String(&r.in.info->name,TEST_ALIASNAME); break;
1390 case ALIASINFODESCRIPTION: init_lsa_String(&r.in.info->description,
1391 "Test Description, should test I18N as well"); break;
1392 case ALIASINFOALL: torture_comment(tctx, "ALIASINFOALL ignored\n"); break;
1393 }
1394
1395 torture_assert_ntstatus_ok(tctx, dcerpc_samr_SetAliasInfo_r(b, tctx, &r),
1396 "SetAliasInfo failed");
1397 if (!NT_STATUS_IS_OK(r.out.result)) {
1398 torture_result(tctx, TORTURE_FAIL, "SetAliasInfo level %u failed - %s\n",
1399 levels[i], nt_errstr(r.out.result));
1400 ret = false;
1401 }
1402
1403 q.in.alias_handle = handle;
1404 q.in.level = levels[i];
1405 q.out.info = &info;
1406
1407 torture_assert_ntstatus_ok(tctx, dcerpc_samr_QueryAliasInfo_r(b, tctx, &q),
1408 "QueryAliasInfo failed");
1409 if (!NT_STATUS_IS_OK(q.out.result)) {
1410 torture_result(tctx, TORTURE_FAIL, "QueryAliasInfo level %u failed - %s\n",
1411 levels[i], nt_errstr(q.out.result));
1412 ret = false;
1413 }
1414 }
1415
1416 return ret;
1417 }
1418
1419 static bool test_GetGroupsForUser(struct dcerpc_binding_handle *b,
1420 struct torture_context *tctx,
1421 struct policy_handle *user_handle)
1422 {
1423 struct samr_GetGroupsForUser r;
1424 struct samr_RidWithAttributeArray *rids = NULL;
1425
1426 torture_comment(tctx, "Testing GetGroupsForUser\n");
1427
1428 r.in.user_handle = user_handle;
1429 r.out.rids = &rids;
1430
1431 torture_assert_ntstatus_ok(tctx, dcerpc_samr_GetGroupsForUser_r(b, tctx, &r),
1432 "GetGroupsForUser failed");
1433 torture_assert_ntstatus_ok(tctx, r.out.result, "GetGroupsForUser failed");
1434
1435 return true;
1436
1437 }
1438
1439 static bool test_GetDomPwInfo(struct dcerpc_pipe *p, struct torture_context *tctx,
1440 struct lsa_String *domain_name)
1441 {
1442 struct samr_GetDomPwInfo r;
1443 struct samr_PwInfo info;
1444 struct dcerpc_binding_handle *b = p->binding_handle;
1445
1446 r.in.domain_name = domain_name;
1447 r.out.info = &info;
1448
1449 torture_comment(tctx, "Testing GetDomPwInfo with name %s\n", r.in.domain_name->string);
1450
1451 torture_assert_ntstatus_ok(tctx, dcerpc_samr_GetDomPwInfo_r(b, tctx, &r),
1452 "GetDomPwInfo failed");
1453 torture_assert_ntstatus_ok(tctx, r.out.result, "GetDomPwInfo failed");
1454
1455 r.in.domain_name->string = talloc_asprintf(tctx, "\\\\%s", dcerpc_server_name(p));
1456 torture_comment(tctx, "Testing GetDomPwInfo with name %s\n", r.in.domain_name->string);
1457
1458 torture_assert_ntstatus_ok(tctx, dcerpc_samr_GetDomPwInfo_r(b, tctx, &r),
1459 "GetDomPwInfo failed");
1460 torture_assert_ntstatus_ok(tctx, r.out.result, "GetDomPwInfo failed");
1461
1462 r.in.domain_name->string = "\\\\__NONAME__";
1463 torture_comment(tctx, "Testing GetDomPwInfo with name %s\n", r.in.domain_name->string);
1464
1465 torture_assert_ntstatus_ok(tctx, dcerpc_samr_GetDomPwInfo_r(b, tctx, &r),
1466 "GetDomPwInfo failed");
1467 torture_assert_ntstatus_ok(tctx, r.out.result, "GetDomPwInfo failed");
1468
1469 r.in.domain_name->string = "\\\\Builtin";
1470 torture_comment(tctx, "Testing GetDomPwInfo with name %s\n", r.in.domain_name->string);
1471
1472 torture_assert_ntstatus_ok(tctx, dcerpc_samr_GetDomPwInfo_r(b, tctx, &r),
1473 "GetDomPwInfo failed");
1474 torture_assert_ntstatus_ok(tctx, r.out.result, "GetDomPwInfo failed");
1475
1476 return true;
1477 }
1478
1479 static bool test_GetUserPwInfo(struct dcerpc_binding_handle *b,
1480 struct torture_context *tctx,
1481 struct policy_handle *handle)
1482 {
1483 struct samr_GetUserPwInfo r;
1484 struct samr_PwInfo info;
1485
1486 torture_comment(tctx, "Testing GetUserPwInfo\n");
1487
1488 r.in.user_handle = handle;
1489 r.out.info = &info;
1490
1491 torture_assert_ntstatus_ok(tctx, dcerpc_samr_GetUserPwInfo_r(b, tctx, &r),
1492 "GetUserPwInfo failed");
1493 torture_assert_ntstatus_ok(tctx, r.out.result, "GetUserPwInfo");
1494
1495 return true;
1496 }
1497
1498 static NTSTATUS test_LookupName(struct dcerpc_binding_handle *b,
1499 struct torture_context *tctx,
1500 struct policy_handle *domain_handle, const char *name,
1501 uint32_t *rid)
1502 {
1503 NTSTATUS status;
1504 struct samr_LookupNames n;
1505 struct lsa_String sname[2];
1506 struct samr_Ids rids, types;
1507
1508 init_lsa_String(&sname[0], name);
1509
1510 n.in.domain_handle = domain_handle;
1511 n.in.num_names = 1;
1512 n.in.names = sname;
1513 n.out.rids = &rids;
1514 n.out.types = &types;
1515 status = dcerpc_samr_LookupNames_r(b, tctx, &n);
1516 if (!NT_STATUS_IS_OK(status)) {
1517 return status;
1518 }
1519 if (NT_STATUS_IS_OK(n.out.result)) {
1520 *rid = n.out.rids->ids[0];
1521 } else {
1522 return n.out.result;
1523 }
1524
1525 init_lsa_String(&sname[1], "xxNONAMExx");
1526 n.in.num_names = 2;
1527 status = dcerpc_samr_LookupNames_r(b, tctx, &n);
1528 if (!NT_STATUS_IS_OK(status)) {
1529 return status;
1530 }
1531 if (!NT_STATUS_EQUAL(n.out.result, STATUS_SOME_UNMAPPED)) {
1532 torture_result(tctx, TORTURE_FAIL, "LookupNames[2] failed - %s\n", nt_errstr(n.out.result));
1533 if (NT_STATUS_IS_OK(n.out.result)) {
1534 return NT_STATUS_UNSUCCESSFUL;
1535 }
1536 return n.out.result;
1537 }
1538
1539 n.in.num_names = 0;
1540 status = dcerpc_samr_LookupNames_r(b, tctx, &n);
1541 if (!NT_STATUS_IS_OK(status)) {
1542 return status;
1543 }
1544 if (!NT_STATUS_IS_OK(n.out.result)) {
1545 torture_result(tctx, TORTURE_FAIL, "LookupNames[0] failed - %s\n", nt_errstr(status));
1546 return n.out.result;
1547 }
1548
1549 init_lsa_String(&sname[0], "xxNONAMExx");
1550 n.in.num_names = 1;
1551 status = dcerpc_samr_LookupNames_r(b, tctx, &n);
1552 if (!NT_STATUS_IS_OK(status)) {
1553 return status;
1554 }
1555 if (!NT_STATUS_EQUAL(n.out.result, NT_STATUS_NONE_MAPPED)) {
1556 torture_result(tctx, TORTURE_FAIL, "LookupNames[1 bad name] failed - %s\n", nt_errstr(n.out.result));
1557 if (NT_STATUS_IS_OK(n.out.result)) {
1558 return NT_STATUS_UNSUCCESSFUL;
1559 }
1560 return n.out.result;
1561 }
1562
1563 init_lsa_String(&sname[0], "xxNONAMExx");
1564 init_lsa_String(&sname[1], "xxNONAME2xx");
1565 n.in.num_names = 2;
1566 status = dcerpc_samr_LookupNames_r(b, tctx, &n);
1567 if (!NT_STATUS_IS_OK(status)) {
1568 return status;
1569 }
1570 if (!NT_STATUS_EQUAL(n.out.result, NT_STATUS_NONE_MAPPED)) {
1571 torture_result(tctx, TORTURE_FAIL, "LookupNames[2 bad names] failed - %s\n", nt_errstr(n.out.result));
1572 if (NT_STATUS_IS_OK(n.out.result)) {
1573 return NT_STATUS_UNSUCCESSFUL;
1574 }
1575 return n.out.result;
1576 }
1577
1578 return NT_STATUS_OK;
1579 }
1580
1581 static NTSTATUS test_OpenUser_byname(struct dcerpc_binding_handle *b,
1582 struct torture_context *tctx,
1583 struct policy_handle *domain_handle,
1584 const char *name, struct policy_handle *user_handle)
1585 {
1586 NTSTATUS status;
1587 struct samr_OpenUser r;
1588 uint32_t rid;
1589
1590 status = test_LookupName(b, tctx, domain_handle, name, &rid);
1591 if (!NT_STATUS_IS_OK(status)) {
1592 return status;
1593 }
1594
1595 r.in.domain_handle = domain_handle;
1596 r.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
1597 r.in.rid = rid;
1598 r.out.user_handle = user_handle;
1599 status = dcerpc_samr_OpenUser_r(b, tctx, &r);
1600 if (!NT_STATUS_IS_OK(status)) {
1601 return status;
1602 }
1603 if (!NT_STATUS_IS_OK(r.out.result)) {
1604 torture_result(tctx, TORTURE_FAIL, "OpenUser_byname(%s -> %d) failed - %s\n", name, rid, nt_errstr(r.out.result));
1605 }
1606
1607 return r.out.result;
1608 }
1609
1610 #if 0
1611 static bool test_ChangePasswordNT3(struct dcerpc_pipe *p,
1612 struct torture_context *tctx,
1613 struct policy_handle *handle)
1614 {
1615 NTSTATUS status;
1616 struct samr_ChangePasswordUser r;
1617 bool ret = true;
1618 struct samr_Password hash1, hash2, hash3, hash4, hash5, hash6;
1619 struct policy_handle user_handle;
1620 char *oldpass = "test";
1621 char *newpass = "test2";
1622 uint8_t old_nt_hash[16], new_nt_hash[16];
1623 uint8_t old_lm_hash[16], new_lm_hash[16];
1624
1625 status = test_OpenUser_byname(p, tctx, handle, "testuser", &user_handle);
1626 if (!NT_STATUS_IS_OK(status)) {
1627 return false;
1628 }
1629
1630 torture_comment(tctx, "Testing ChangePasswordUser for user 'testuser'\n");
1631
1632 torture_comment(tctx, "old password: %s\n", oldpass);
1633 torture_comment(tctx, "new password: %s\n", newpass);
1634
1635 E_md4hash(oldpass, old_nt_hash);
1636 E_md4hash(newpass, new_nt_hash);
1637 E_deshash(oldpass, old_lm_hash);
1638 E_deshash(newpass, new_lm_hash);
1639
1640 E_old_pw_hash(new_lm_hash, old_lm_hash, hash1.hash);
1641 E_old_pw_hash(old_lm_hash, new_lm_hash, hash2.hash);
1642 E_old_pw_hash(new_nt_hash, old_nt_hash, hash3.hash);
1643 E_old_pw_hash(old_nt_hash, new_nt_hash, hash4.hash);
1644 E_old_pw_hash(old_lm_hash, new_nt_hash, hash5.hash);
1645 E_old_pw_hash(old_nt_hash, new_lm_hash, hash6.hash);
1646
1647 r.in.handle = &user_handle;
1648 r.in.lm_present = 1;
1649 r.in.old_lm_crypted = &hash1;
1650 r.in.new_lm_crypted = &hash2;
1651 r.in.nt_present = 1;
1652 r.in.old_nt_crypted = &hash3;
1653 r.in.new_nt_crypted = &hash4;
1654 r.in.cross1_present = 1;
1655 r.in.nt_cross = &hash5;
1656 r.in.cross2_present = 1;
1657 r.in.lm_cross = &hash6;
1658
1659 torture_assert_ntstatus_ok(tctx, dcerpc_samr_ChangePasswordUser_r(b, tctx, &r),
1660 "ChangePasswordUser failed");
1661 if (!NT_STATUS_IS_OK(r.out.result)) {
1662 torture_result(tctx, TORTURE_FAIL, "ChangePasswordUser failed - %s\n", nt_errstr(r.out.result));
1663 ret = false;
1664 }
1665
1666 if (!test_samr_handle_Close(p, tctx, &user_handle)) {
1667 ret = false;
1668 }
1669
1670 return ret;
1671 }
1672 #endif
1673
1674 static bool test_ChangePasswordUser(struct dcerpc_binding_handle *b,
1675 struct torture_context *tctx,
1676 const char *acct_name,
1677 struct policy_handle *handle, char **password)
1678 {
1679 NTSTATUS status;
1680 struct samr_ChangePasswordUser r;
1681 bool ret = true;
1682 struct samr_Password hash1, hash2, hash3, hash4, hash5, hash6;
1683 struct policy_handle user_handle;
1684 char *oldpass;
1685 uint8_t old_nt_hash[16], new_nt_hash[16];
1686 uint8_t old_lm_hash[16], new_lm_hash[16];
1687 bool changed = true;
1688
1689 char *newpass;
1690 struct samr_GetUserPwInfo pwp;
1691 struct samr_PwInfo info;
1692 int policy_min_pw_len = 0;
1693
1694 status = test_OpenUser_byname(b, tctx, handle, acct_name, &user_handle);
1695 if (!NT_STATUS_IS_OK(status)) {
1696 return false;
1697 }
1698 pwp.in.user_handle = &user_handle;
1699 pwp.out.info = &info;
1700
1701 torture_assert_ntstatus_ok(tctx, dcerpc_samr_GetUserPwInfo_r(b, tctx, &pwp),
1702 "GetUserPwInfo failed");
1703 if (NT_STATUS_IS_OK(pwp.out.result)) {
1704 policy_min_pw_len = pwp.out.info->min_password_length;
1705 }
1706 newpass = samr_rand_pass(tctx, policy_min_pw_len);
1707
1708 torture_comment(tctx, "Testing ChangePasswordUser\n");
1709
1710 torture_assert(tctx, *password != NULL,
1711 "Failing ChangePasswordUser as old password was NULL. Previous test failed?");
1712
1713 oldpass = *password;
1714
1715 E_md4hash(oldpass, old_nt_hash);
1716 E_md4hash(newpass, new_nt_hash);
1717 E_deshash(oldpass, old_lm_hash);
1718 E_deshash(newpass, new_lm_hash);
1719
1720 E_old_pw_hash(new_lm_hash, old_lm_hash, hash1.hash);
1721 E_old_pw_hash(old_lm_hash, new_lm_hash, hash2.hash);
1722 E_old_pw_hash(new_nt_hash, old_nt_hash, hash3.hash);
1723 E_old_pw_hash(old_nt_hash, new_nt_hash, hash4.hash);
1724 E_old_pw_hash(old_lm_hash, new_nt_hash, hash5.hash);
1725 E_old_pw_hash(old_nt_hash, new_lm_hash, hash6.hash);
1726
1727 r.in.user_handle = &user_handle;
1728 r.in.lm_present = 1;
1729 /* Break the NT hash */
1730 hash3.hash[0]++;
1731 r.in.old_lm_crypted = &hash1;
1732 r.in.new_lm_crypted = &hash2;
1733 r.in.nt_present = 1;
1734 r.in.old_nt_crypted = &hash3;
1735 r.in.new_nt_crypted = &hash4;
1736 r.in.cross1_present = 1;
1737 r.in.nt_cross = &hash5;
1738 r.in.cross2_present = 1;
1739 r.in.lm_cross = &hash6;
1740
1741 torture_assert_ntstatus_ok(tctx, dcerpc_samr_ChangePasswordUser_r(b, tctx, &r),
1742 "ChangePasswordUser failed");
1743 torture_comment(tctx, "(%s:%s) old_password[%s] new_password[%s] status[%s]\n",
1744 __location__, __FUNCTION__,
1745 oldpass, newpass, nt_errstr(r.out.result));
1746
1747 /* Do not proceed if this call has been removed */
1748 if (NT_STATUS_EQUAL(r.out.result, NT_STATUS_NOT_IMPLEMENTED)) {
1749 torture_skip(tctx, "ValidatePassword not supported by server\n");
1750 }
1751
1752 if (!NT_STATUS_EQUAL(r.out.result, NT_STATUS_PASSWORD_RESTRICTION)) {
1753 torture_assert_ntstatus_equal(tctx, r.out.result, NT_STATUS_WRONG_PASSWORD,
1754 "ChangePasswordUser failed: expected NT_STATUS_WRONG_PASSWORD because we broke the LM hash");
1755 }
1756
1757 /* Unbreak the NT hash */
1758 hash3.hash[0]--;
1759
1760 r.in.user_handle = &user_handle;
1761 r.in.lm_present = 1;
1762 r.in.old_lm_crypted = &hash1;
1763 r.in.new_lm_crypted = &hash2;
1764 /* Break the LM hash */
1765 hash1.hash[0]--;
1766 r.in.nt_present = 1;
1767 r.in.old_nt_crypted = &hash3;
1768 r.in.new_nt_crypted = &hash4;
1769 r.in.cross1_present = 1;
1770 r.in.nt_cross = &hash5;
1771 r.in.cross2_present = 1;
1772 r.in.lm_cross = &hash6;
1773
1774 torture_assert_ntstatus_ok(tctx, dcerpc_samr_ChangePasswordUser_r(b, tctx, &r),
1775 "ChangePasswordUser failed");
1776 torture_comment(tctx, "(%s:%s) old_password[%s] new_password[%s] status[%s]\n",
1777 __location__, __FUNCTION__,
1778 oldpass, newpass, nt_errstr(r.out.result));
1779 if (!NT_STATUS_EQUAL(r.out.result, NT_STATUS_PASSWORD_RESTRICTION)) {
1780 torture_assert_ntstatus_equal(tctx, r.out.result, NT_STATUS_WRONG_PASSWORD,
1781 "expected NT_STATUS_WRONG_PASSWORD because we broke the NT hash");
1782 }
1783
1784 /* Unbreak the NT hash */
1785 hash3.hash[0]--;
1786
1787 r.in.user_handle = &user_handle;
1788 r.in.lm_present = 1;
1789 r.in.old_lm_crypted = &hash1;
1790 r.in.new_lm_crypted = &hash2;
1791 r.in.nt_present = 1;
1792 r.in.old_nt_crypted = &hash3;
1793 r.in.new_nt_crypted = &hash4;
1794 r.in.cross1_present = 1;
1795 r.in.nt_cross = &hash5;
1796 r.in.cross2_present = 1;
1797 /* Break the LM cross */
1798 hash6.hash[0]++;
1799 r.in.lm_cross = &hash6;
1800
1801 torture_assert_ntstatus_ok(tctx, dcerpc_samr_ChangePasswordUser_r(b, tctx, &r),
1802 "ChangePasswordUser failed");
1803 torture_comment(tctx, "(%s:%s) old_password[%s] new_password[%s] status[%s]\n",
1804 __location__, __FUNCTION__,
1805 oldpass, newpass, nt_errstr(r.out.result));
1806 if (!NT_STATUS_EQUAL(r.out.result, NT_STATUS_WRONG_PASSWORD) &&
1807 !NT_STATUS_EQUAL(r.out.result, NT_STATUS_PASSWORD_RESTRICTION))
1808 {
1809 torture_result(tctx, TORTURE_FAIL, "ChangePasswordUser failed: expected NT_STATUS_WRONG_PASSWORD or NT_STATUS_PASSWORD_RESTRICTION because we broke the LM cross-hash, got %s\n", nt_errstr(r.out.result));
1810 ret = false;
1811 }
1812
1813 /* Unbreak the LM cross */
1814 hash6.hash[0]--;
1815
1816 r.in.user_handle = &user_handle;
1817 r.in.lm_present = 1;
1818 r.in.old_lm_crypted = &hash1;
1819 r.in.new_lm_crypted = &hash2;
1820 r.in.nt_present = 1;
1821 r.in.old_nt_crypted = &hash3;
1822 r.in.new_nt_crypted = &hash4;
1823 r.in.cross1_present = 1;
1824 /* Break the NT cross */
1825 hash5.hash[0]++;
1826 r.in.nt_cross = &hash5;
1827 r.in.cross2_present = 1;
1828 r.in.lm_cross = &hash6;
1829
1830 torture_assert_ntstatus_ok(tctx, dcerpc_samr_ChangePasswordUser_r(b, tctx, &r),
1831 "ChangePasswordUser failed");
1832 torture_comment(tctx, "(%s:%s) old_password[%s] new_password[%s] status[%s]\n",
1833 __location__, __FUNCTION__,
1834 oldpass, newpass, nt_errstr(r.out.result));
1835 if (!NT_STATUS_EQUAL(r.out.result, NT_STATUS_WRONG_PASSWORD) &&
1836 !NT_STATUS_EQUAL(r.out.result, NT_STATUS_PASSWORD_RESTRICTION))
1837 {
1838 torture_result(tctx, TORTURE_FAIL, "ChangePasswordUser failed: expected NT_STATUS_WRONG_PASSWORD or NT_STATUS_PASSWORD_RESTRICTION because we broke the NT cross-hash, got %s\n", nt_errstr(r.out.result));
1839 ret = false;
1840 }
1841
1842 /* Unbreak the NT cross */
1843 hash5.hash[0]--;
1844
1845
1846 /* Reset the hashes to not broken values */
1847 E_old_pw_hash(new_lm_hash, old_lm_hash, hash1.hash);
1848 E_old_pw_hash(old_lm_hash, new_lm_hash, hash2.hash);
1849 E_old_pw_hash(new_nt_hash, old_nt_hash, hash3.hash);
1850 E_old_pw_hash(old_nt_hash, new_nt_hash, hash4.hash);
1851 E_old_pw_hash(old_lm_hash, new_nt_hash, hash5.hash);
1852 E_old_pw_hash(old_nt_hash, new_lm_hash, hash6.hash);
1853
1854 r.in.user_handle = &user_handle;
1855 r.in.lm_present = 1;
1856 r.in.old_lm_crypted = &hash1;
1857 r.in.new_lm_crypted = &hash2;
1858 r.in.nt_present = 1;
1859 r.in.old_nt_crypted = &hash3;
1860 r.in.new_nt_crypted = &hash4;
1861 r.in.cross1_present = 1;
1862 r.in.nt_cross = &hash5;
1863 r.in.cross2_present = 0;
1864 r.in.lm_cross = NULL;
1865
1866 torture_assert_ntstatus_ok(tctx, dcerpc_samr_ChangePasswordUser_r(b, tctx, &r),
1867 "ChangePasswordUser failed");
1868 torture_comment(tctx, "(%s:%s) old_password[%s] new_password[%s] status[%s]\n",
1869 __location__, __FUNCTION__,
1870 oldpass, newpass, nt_errstr(r.out.result));
1871 if (NT_STATUS_IS_OK(r.out.result)) {
1872 changed = true;
1873 *password = newpass;
1874 } else if (!NT_STATUS_EQUAL(NT_STATUS_PASSWORD_RESTRICTION, r.out.result)) {
1875 torture_result(tctx, TORTURE_FAIL, "ChangePasswordUser failed: expected NT_STATUS_OK, or at least NT_STATUS_PASSWORD_RESTRICTION, got %s\n", nt_errstr(r.out.result));
1876 ret = false;
1877 }
1878
1879 oldpass = newpass;
1880 newpass = samr_rand_pass(tctx, policy_min_pw_len);
1881
1882 E_md4hash(oldpass, old_nt_hash);
1883 E_md4hash(newpass, new_nt_hash);
1884 E_deshash(oldpass, old_lm_hash);
1885 E_deshash(newpass, new_lm_hash);
1886
1887
1888 /* Reset the hashes to not broken values */
1889 E_old_pw_hash(new_lm_hash, old_lm_hash, hash1.hash);
1890 E_old_pw_hash(old_lm_hash, new_lm_hash, hash2.hash);
1891 E_old_pw_hash(new_nt_hash, old_nt_hash, hash3.hash);
1892 E_old_pw_hash(old_nt_hash, new_nt_hash, hash4.hash);
1893 E_old_pw_hash(old_lm_hash, new_nt_hash, hash5.hash);
1894 E_old_pw_hash(old_nt_hash, new_lm_hash, hash6.hash);
1895
1896 r.in.user_handle = &user_handle;
1897 r.in.lm_present = 1;
1898 r.in.old_lm_crypted = &hash1;
1899 r.in.new_lm_crypted = &hash2;
1900 r.in.nt_present = 1;
1901 r.in.old_nt_crypted = &hash3;
1902 r.in.new_nt_crypted = &hash4;
1903 r.in.cross1_present = 0;
1904 r.in.nt_cross = NULL;
1905 r.in.cross2_present = 1;
1906 r.in.lm_cross = &hash6;
1907
1908 torture_assert_ntstatus_ok(tctx, dcerpc_samr_ChangePasswordUser_r(b, tctx, &r),
1909 "ChangePasswordUser failed");
1910 torture_comment(tctx, "(%s:%s) old_password[%s] new_password[%s] status[%s]\n",
1911 __location__, __FUNCTION__,
1912 oldpass, newpass, nt_errstr(r.out.result));
1913 if (NT_STATUS_IS_OK(r.out.result)) {
1914 changed = true;
1915 *password = newpass;
1916 } else if (!NT_STATUS_EQUAL(NT_STATUS_PASSWORD_RESTRICTION, r.out.result)) {
1917 torture_result(tctx, TORTURE_FAIL, "ChangePasswordUser failed: expected NT_STATUS_OK, or at least NT_STATUS_PASSWORD_RESTRICTION, got %s\n", nt_errstr(r.out.result));
1918 ret = false;
1919 }
1920
1921 oldpass = newpass;
1922 newpass = samr_rand_pass(tctx, policy_min_pw_len);
1923
1924 E_md4hash(oldpass, old_nt_hash);
1925 E_md4hash(newpass, new_nt_hash);
1926 E_deshash(oldpass, old_lm_hash);
1927 E_deshash(newpass, new_lm_hash);
1928
1929
1930 /* Reset the hashes to not broken values */
1931 E_old_pw_hash(new_lm_hash, old_lm_hash, hash1.hash);
1932 E_old_pw_hash(old_lm_hash, new_lm_hash, hash2.hash);
1933 E_old_pw_hash(new_nt_hash, old_nt_hash, hash3.hash);
1934 E_old_pw_hash(old_nt_hash, new_nt_hash, hash4.hash);
1935 E_old_pw_hash(old_lm_hash, new_nt_hash, hash5.hash);
1936 E_old_pw_hash(old_nt_hash, new_lm_hash, hash6.hash);
1937
1938 r.in.user_handle = &user_handle;
1939 r.in.lm_present = 1;
1940 r.in.old_lm_crypted = &hash1;
1941 r.in.new_lm_crypted = &hash2;
1942 r.in.nt_present = 1;
1943 r.in.old_nt_crypted = &hash3;
1944 r.in.new_nt_crypted = &hash4;
1945 r.in.cross1_present = 1;
1946 r.in.nt_cross = &hash5;
1947 r.in.cross2_present = 1;
1948 r.in.lm_cross = &hash6;
1949
1950 torture_assert_ntstatus_ok(tctx, dcerpc_samr_ChangePasswordUser_r(b, tctx, &r),
1951 "ChangePasswordUser failed");
1952 torture_comment(tctx, "(%s:%s) old_password[%s] new_password[%s] status[%s]\n",
1953 __location__, __FUNCTION__,
1954 oldpass, newpass, nt_errstr(r.out.result));
1955 if (NT_STATUS_EQUAL(r.out.result, NT_STATUS_PASSWORD_RESTRICTION)) {
1956 torture_comment(tctx, "ChangePasswordUser returned: %s perhaps min password age? (not fatal)\n", nt_errstr(r.out.result));
1957 } else if (!NT_STATUS_IS_OK(r.out.result)) {
1958 torture_result(tctx, TORTURE_FAIL, "ChangePasswordUser failed - %s\n", nt_errstr(r.out.result));
1959 ret = false;
1960 } else {
1961 changed = true;
1962 *password = newpass;
1963 }
1964
1965 r.in.user_handle = &user_handle;
1966 r.in.lm_present = 1;
1967 r.in.old_lm_crypted = &hash1;
1968 r.in.new_lm_crypted = &hash2;
1969 r.in.nt_present = 1;
1970 r.in.old_nt_crypted = &hash3;
1971 r.in.new_nt_crypted = &hash4;
1972 r.in.cross1_present = 1;
1973 r.in.nt_cross = &hash5;
1974 r.in.cross2_present = 1;
1975 r.in.lm_cross = &hash6;
1976
1977 if (changed) {
1978 torture_assert_ntstatus_ok(tctx, dcerpc_samr_ChangePasswordUser_r(b, tctx, &r),
1979 "ChangePasswordUser failed");
1980 torture_comment(tctx, "(%s:%s) old_password[%s] new_password[%s] status[%s]\n",
1981 __location__, __FUNCTION__,
1982 oldpass, newpass, nt_errstr(r.out.result));
1983 if (NT_STATUS_EQUAL(r.out.result, NT_STATUS_PASSWORD_RESTRICTION)) {
1984 torture_comment(tctx, "ChangePasswordUser returned: %s perhaps min password age? (not fatal)\n", nt_errstr(r.out.result));
1985 } else if (!NT_STATUS_EQUAL(r.out.result, NT_STATUS_WRONG_PASSWORD)) {
1986 torture_result(tctx, TORTURE_FAIL, "ChangePasswordUser failed: expected NT_STATUS_WRONG_PASSWORD because we already changed the password, got %s\n", nt_errstr(r.out.result));
1987 ret = false;
1988 }
1989 }
1990
1991
1992 if (!test_samr_handle_Close(b, tctx, &user_handle)) {
1993 ret = false;
1994 }
1995
1996 return ret;
1997 }
1998
1999
2000 static bool test_OemChangePasswordUser2(struct dcerpc_pipe *p,
2001 struct torture_context *tctx,
2002 const char *acct_name,
2003 struct policy_handle *handle, char **password)
2004 {
2005 struct samr_OemChangePasswordUser2 r;
2006 bool ret = true;
2007 struct samr_Password lm_verifier;
2008 struct samr_CryptPassword lm_pass;
2009 struct lsa_AsciiString server, account, account_bad;
2010 char *oldpass;
2011 char *newpass;
2012 struct dcerpc_binding_handle *b = p->binding_handle;
2013 uint8_t old_lm_hash[16], new_lm_hash[16];
2014
2015 struct samr_GetDomPwInfo dom_pw_info;
2016 struct samr_PwInfo info;
2017 int policy_min_pw_len = 0;
2018
2019 struct lsa_String domain_name;
2020
2021 domain_name.string = "";
2022 dom_pw_info.in.domain_name = &domain_name;
2023 dom_pw_info.out.info = &info;
2024
2025 torture_comment(tctx, "Testing OemChangePasswordUser2\n");
2026
2027 torture_assert(tctx, *password != NULL,
2028 "Failing OemChangePasswordUser2 as old password was NULL. Previous test failed?");
2029
2030 oldpass = *password;
2031
2032 torture_assert_ntstatus_ok(tctx, dcerpc_samr_GetDomPwInfo_r(b, tctx, &dom_pw_info),
2033 "GetDomPwInfo failed");
2034 if (NT_STATUS_IS_OK(dom_pw_info.out.result)) {
2035 policy_min_pw_len = dom_pw_info.out.info->min_password_length;
2036 }
2037
2038 newpass = samr_rand_pass(tctx, policy_min_pw_len);
2039
2040 server.string = talloc_asprintf(tctx, "\\\\%s", dcerpc_server_name(p));
2041 account.string = acct_name;
2042
2043 E_deshash(oldpass, old_lm_hash);
2044 E_deshash(newpass, new_lm_hash);
2045
2046 encode_pw_buffer(lm_pass.data, newpass, STR_ASCII);
2047 arcfour_crypt(lm_pass.data, old_lm_hash, 516);
2048 E_old_pw_hash(new_lm_hash, old_lm_hash, lm_verifier.hash);
2049
2050 r.in.server = &server;
2051 r.in.account = &account;
2052 r.in.password = &lm_pass;
2053 r.in.hash = &lm_verifier;
2054
2055 /* Break the verification */
2056 lm_verifier.hash[0]++;
2057
2058 torture_assert_ntstatus_ok(tctx, dcerpc_samr_OemChangePasswordUser2_r(b, tctx, &r),
2059 "OemChangePasswordUser2 failed");
2060 torture_comment(tctx, "(%s:%s) old_password[%s] new_password[%s] status[%s]\n",
2061 __location__, __FUNCTION__,
2062 oldpass, newpass, nt_errstr(r.out.result));
2063
2064 if (!NT_STATUS_EQUAL(r.out.result, NT_STATUS_PASSWORD_RESTRICTION)
2065 && !NT_STATUS_EQUAL(r.out.result, NT_STATUS_WRONG_PASSWORD)) {
2066 torture_result(tctx, TORTURE_FAIL, "OemChangePasswordUser2 failed, should have returned WRONG_PASSWORD (or at least 'PASSWORD_RESTRICTON') for invalid password verifier - %s\n",
2067 nt_errstr(r.out.result));
2068 ret = false;
2069 }
2070
2071 encode_pw_buffer(lm_pass.data, newpass, STR_ASCII);
2072 /* Break the old password */
2073 old_lm_hash[0]++;
2074 arcfour_crypt(lm_pass.data, old_lm_hash, 516);
2075 /* unbreak it for the next operation */
2076 old_lm_hash[0]--;
2077 E_old_pw_hash(new_lm_hash, old_lm_hash, lm_verifier.hash);
2078
2079 r.in.server = &server;
2080 r.in.account = &account;
2081 r.in.password = &lm_pass;
2082 r.in.hash = &lm_verifier;
2083
2084 torture_assert_ntstatus_ok(tctx, dcerpc_samr_OemChangePasswordUser2_r(b, tctx, &r),
2085 "OemChangePasswordUser2 failed");
2086 torture_comment(tctx, "(%s:%s) old_password[%s] new_password[%s] status[%s]\n",
2087 __location__, __FUNCTION__,
2088 oldpass, newpass, nt_errstr(r.out.result));
2089
2090 if (!NT_STATUS_EQUAL(r.out.result, NT_STATUS_PASSWORD_RESTRICTION)
2091 && !NT_STATUS_EQUAL(r.out.result, NT_STATUS_WRONG_PASSWORD)) {
2092 torture_result(tctx, TORTURE_FAIL, "OemChangePasswordUser2 failed, should have returned WRONG_PASSWORD (or at least 'PASSWORD_RESTRICTON') for invalidly encrpted password - %s\n",
2093 nt_errstr(r.out.result));
2094 ret = false;
2095 }
2096
2097 encode_pw_buffer(lm_pass.data, newpass, STR_ASCII);
2098 arcfour_crypt(lm_pass.data, old_lm_hash, 516);
2099
2100 r.in.server = &server;
2101 r.in.account = &account;
2102 r.in.password = &lm_pass;
2103 r.in.hash = NULL;
2104
2105 torture_assert_ntstatus_ok(tctx, dcerpc_samr_OemChangePasswordUser2_r(b, tctx, &r),
2106 "OemChangePasswordUser2 failed");
2107 torture_comment(tctx, "(%s:%s) old_password[%s] new_password[%s] status[%s]\n",
2108 __location__, __FUNCTION__,
2109 oldpass, newpass, nt_errstr(r.out.result));
2110
2111 if (!NT_STATUS_EQUAL(r.out.result, NT_STATUS_PASSWORD_RESTRICTION)
2112 && !NT_STATUS_EQUAL(r.out.result, NT_STATUS_INVALID_PARAMETER)) {
2113 torture_result(tctx, TORTURE_FAIL, "OemChangePasswordUser2 failed, should have returned INVALID_PARAMETER (or at least 'PASSWORD_RESTRICTON') for no supplied validation hash - %s\n",
2114 nt_errstr(r.out.result));
2115 ret = false;
2116 }
2117
2118 /* This shouldn't be a valid name */
2119 account_bad.string = TEST_ACCOUNT_NAME "XX";
2120 r.in.account = &account_bad;
2121
2122 torture_assert_ntstatus_ok(tctx, dcerpc_samr_OemChangePasswordUser2_r(b, tctx, &r),
2123 "OemChangePasswordUser2 failed");
2124 torture_comment(tctx, "(%s:%s) old_password[%s] new_password[%s] status[%s]\n",
2125 __location__, __FUNCTION__,
2126 oldpass, newpass, nt_errstr(r.out.result));
2127
2128 if (!NT_STATUS_EQUAL(r.out.result, NT_STATUS_INVALID_PARAMETER)) {
2129 torture_result(tctx, TORTURE_FAIL, "OemChangePasswordUser2 failed, should have returned INVALID_PARAMETER for no supplied validation hash and invalid user - %s\n",
2130 nt_errstr(r.out.result));
2131 ret = false;
2132 }
2133
2134 /* This shouldn't be a valid name */
2135 account_bad.string = TEST_ACCOUNT_NAME "XX";
2136 r.in.account = &account_bad;
2137 r.in.password = &lm_pass;
2138 r.in.hash = &lm_verifier;
2139
2140 torture_assert_ntstatus_ok(tctx, dcerpc_samr_OemChangePasswordUser2_r(b, tctx, &r),
2141 "OemChangePasswordUser2 failed");
2142 torture_comment(tctx, "(%s:%s) old_password[%s] new_password[%s] status[%s]\n",
2143 __location__, __FUNCTION__,
2144 oldpass, newpass, nt_errstr(r.out.result));
2145
2146 if (!NT_STATUS_EQUAL(r.out.result, NT_STATUS_WRONG_PASSWORD)) {
2147 torture_result(tctx, TORTURE_FAIL, "OemChangePasswordUser2 failed, should have returned WRONG_PASSWORD for invalid user - %s\n",
2148 nt_errstr(r.out.result));
2149 ret = false;
2150 }
2151
2152 /* This shouldn't be a valid name */
2153 account_bad.string = TEST_ACCOUNT_NAME "XX";
2154 r.in.account = &account_bad;
2155 r.in.password = NULL;
2156 r.in.hash = &lm_verifier;
2157
2158 torture_assert_ntstatus_ok(tctx, dcerpc_samr_OemChangePasswordUser2_r(b, tctx, &r),
2159 "OemChangePasswordUser2 failed");
2160 torture_comment(tctx, "(%s:%s) old_password[%s] new_password[%s] status[%s]\n",
2161 __location__, __FUNCTION__,
2162 oldpass, newpass, nt_errstr(r.out.result));
2163
2164 if (!NT_STATUS_EQUAL(r.out.result, NT_STATUS_INVALID_PARAMETER)) {
2165 torture_result(tctx, TORTURE_FAIL, "OemChangePasswordUser2 failed, should have returned INVALID_PARAMETER for no supplied password and invalid user - %s\n",
2166 nt_errstr(r.out.result));
2167 ret = false;
2168 }
2169
2170 E_deshash(oldpass, old_lm_hash);
2171 E_deshash(newpass, new_lm_hash);
2172
2173 encode_pw_buffer(lm_pass.data, newpass, STR_ASCII);
2174 arcfour_crypt(lm_pass.data, old_lm_hash, 516);
2175 E_old_pw_hash(new_lm_hash, old_lm_hash, lm_verifier.hash);
2176
2177 r.in.server = &server;
2178 r.in.account = &account;
2179 r.in.password = &lm_pass;
2180 r.in.hash = &lm_verifier;
2181
2182 torture_assert_ntstatus_ok(tctx, dcerpc_samr_OemChangePasswordUser2_r(b, tctx, &r),
2183 "OemChangePasswordUser2 failed");
2184 torture_comment(tctx, "(%s:%s) old_password[%s] new_password[%s] status[%s]\n",
2185 __location__, __FUNCTION__,
2186 oldpass, newpass, nt_errstr(r.out.result));
2187
2188 if (NT_STATUS_EQUAL(r.out.result, NT_STATUS_PASSWORD_RESTRICTION)) {
2189 torture_comment(tctx, "OemChangePasswordUser2 returned: %s perhaps min password age? (not fatal)\n", nt_errstr(r.out.result));
2190 } else if (!NT_STATUS_IS_OK(r.out.result)) {
2191 torture_result(tctx, TORTURE_FAIL, "OemChangePasswordUser2 failed - %s\n", nt_errstr(r.out.result));
2192 ret = false;
2193 } else {
2194 *password = newpass;
2195 }
2196
2197 return ret;
2198 }
2199
2200
2201 static bool test_ChangePasswordUser2(struct dcerpc_pipe *p, struct torture_context *tctx,
2202 const char *acct_name,
2203 char **password,
2204 char *newpass, bool allow_password_restriction)
2205 {
2206 struct samr_ChangePasswordUser2 r;
2207 bool ret = true;
2208 struct lsa_String server, account;
2209 struct samr_CryptPassword nt_pass, lm_pass;
2210 struct samr_Password nt_verifier, lm_verifier;
2211 char *oldpass;
2212 struct dcerpc_binding_handle *b = p->binding_handle;
2213 uint8_t old_nt_hash[16], new_nt_hash[16];
2214 uint8_t old_lm_hash[16], new_lm_hash[16];
2215
2216 struct samr_GetDomPwInfo dom_pw_info;
2217 struct samr_PwInfo info;
2218
2219 struct lsa_String domain_name;
2220
2221 domain_name.string = "";
2222 dom_pw_info.in.domain_name = &domain_name;
2223 dom_pw_info.out.info = &info;
2224
2225 torture_comment(tctx, "Testing ChangePasswordUser2 on %s\n", acct_name);
2226
2227 torture_assert(tctx, *password != NULL,
2228 "Failing ChangePasswordUser2 as old password was NULL. Previous test failed?");
2229 oldpass = *password;
2230
2231 if (!newpass) {
2232 int policy_min_pw_len = 0;
2233 torture_assert_ntstatus_ok(tctx, dcerpc_samr_GetDomPwInfo_r(b, tctx, &dom_pw_info),
2234 "GetDomPwInfo failed");
2235 if (NT_STATUS_IS_OK(dom_pw_info.out.result)) {
2236 policy_min_pw_len = dom_pw_info.out.info->min_password_length;
2237 }
2238
2239 newpass = samr_rand_pass(tctx, policy_min_pw_len);
2240 }
2241
2242 server.string = talloc_asprintf(tctx, "\\\\%s", dcerpc_server_name(p));
2243 init_lsa_String(&account, acct_name);
2244
2245 E_md4hash(oldpass, old_nt_hash);
2246 E_md4hash(newpass, new_nt_hash);
2247
2248 E_deshash(oldpass, old_lm_hash);
2249 E_deshash(newpass, new_lm_hash);
2250
2251 encode_pw_buffer(lm_pass.data, newpass, STR_ASCII|STR_TERMINATE);
2252 arcfour_crypt(lm_pass.data, old_lm_hash, 516);
2253 E_old_pw_hash(new_nt_hash, old_lm_hash, lm_verifier.hash);
2254
2255 encode_pw_buffer(nt_pass.data, newpass, STR_UNICODE);
2256 arcfour_crypt(nt_pass.data, old_nt_hash, 516);
2257 E_old_pw_hash(new_nt_hash, old_nt_hash, nt_verifier.hash);
2258
2259 r.in.server = &server;
2260 r.in.account = &account;
2261 r.in.nt_password = &nt_pass;
2262 r.in.nt_verifier = &nt_verifier;
2263 r.in.lm_change = 1;
2264 r.in.lm_password = &lm_pass;
2265 r.in.lm_verifier = &lm_verifier;
2266
2267 torture_assert_ntstatus_ok(tctx, dcerpc_samr_ChangePasswordUser2_r(b, tctx, &r),
2268 "ChangePasswordUser2 failed");
2269 torture_comment(tctx, "(%s:%s) old_password[%s] new_password[%s] status[%s]\n",
2270 __location__, __FUNCTION__,
2271 oldpass, newpass, nt_errstr(r.out.result));
2272
2273 if (allow_password_restriction && NT_STATUS_EQUAL(r.out.result, NT_STATUS_PASSWORD_RESTRICTION)) {
2274 torture_comment(tctx, "ChangePasswordUser2 returned: %s perhaps min password age? (not fatal)\n", nt_errstr(r.out.result));
2275 } else if (!NT_STATUS_IS_OK(r.out.result)) {
2276 torture_result(tctx, TORTURE_FAIL, "ChangePasswordUser2 failed - %s\n", nt_errstr(r.out.result));
2277 ret = false;
2278 } else {
2279 *password = newpass;
2280 }
2281
2282 return ret;
2283 }
2284
2285
2286 static bool test_ChangePasswordUser2_ntstatus(struct dcerpc_pipe *p, struct torture_context *tctx,
2287 const char *acct_name,
2288 const char *password, NTSTATUS status)
2289 {
2290 struct samr_ChangePasswordUser2 r;
2291 struct lsa_String server, account;
2292 struct samr_CryptPassword nt_pass, lm_pass;
2293 struct samr_Password nt_verifier, lm_verifier;
2294 const char *oldpass;
2295 struct dcerpc_binding_handle *b = p->binding_handle;
2296 uint8_t old_nt_hash[16], new_nt_hash[16];
2297 uint8_t old_lm_hash[16], new_lm_hash[16];
2298
2299 struct samr_GetDomPwInfo dom_pw_info;
2300 struct samr_PwInfo info;
2301
2302 struct lsa_String domain_name;
2303 char *newpass;
2304 int policy_min_pw_len = 0;
2305
2306 domain_name.string = "";
2307 dom_pw_info.in.domain_name = &domain_name;
2308 dom_pw_info.out.info = &info;
2309
2310 torture_comment(tctx, "Testing ChangePasswordUser2 on %s\n", acct_name);
2311
2312 oldpass = password;
2313
2314 torture_assert_ntstatus_ok(tctx, dcerpc_samr_GetDomPwInfo_r(b, tctx, &dom_pw_info),
2315 "GetDomPwInfo failed");
2316 if (NT_STATUS_IS_OK(dom_pw_info.out.result)) {
2317 policy_min_pw_len = dom_pw_info.out.info->min_password_length;
2318 }
2319
2320 newpass = samr_rand_pass(tctx, policy_min_pw_len);
2321
2322 server.string = talloc_asprintf(tctx, "\\\\%s", dcerpc_server_name(p));
2323 init_lsa_String(&account, acct_name);
2324
2325 E_md4hash(oldpass, old_nt_hash);
2326 E_md4hash(newpass, new_nt_hash);
2327
2328 E_deshash(oldpass, old_lm_hash);
2329 E_deshash(newpass, new_lm_hash);
2330
2331 encode_pw_buffer(lm_pass.data, newpass, STR_ASCII|STR_TERMINATE);
2332 arcfour_crypt(lm_pass.data, old_lm_hash, 516);
2333 E_old_pw_hash(new_nt_hash, old_lm_hash, lm_verifier.hash);
2334
2335 encode_pw_buffer(nt_pass.data, newpass, STR_UNICODE);
2336 arcfour_crypt(nt_pass.data, old_nt_hash, 516);
2337 E_old_pw_hash(new_nt_hash, old_nt_hash, nt_verifier.hash);
2338
2339 r.in.server = &server;
2340 r.in.account = &account;
2341 r.in.nt_password = &nt_pass;
2342 r.in.nt_verifier = &nt_verifier;
2343 r.in.lm_change = 1;
2344 r.in.lm_password = &lm_pass;
2345 r.in.lm_verifier = &lm_verifier;
2346
2347 torture_assert_ntstatus_ok(tctx, dcerpc_samr_ChangePasswordUser2_r(b, tctx, &r),
2348 "ChangePasswordUser2 failed");
2349 torture_comment(tctx, "(%s:%s) old_password[%s] new_password[%s] status[%s]\n",
2350 __location__, __FUNCTION__,
2351 oldpass, newpass, nt_errstr(r.out.result));
2352
2353 if (NT_STATUS_EQUAL(r.out.result, NT_STATUS_PASSWORD_RESTRICTION)) {
2354 torture_comment(tctx, "ChangePasswordUser2 returned: %s perhaps min password age? (not fatal)\n", nt_errstr(r.out.result));
2355 } else {
2356 torture_assert_ntstatus_equal(tctx, r.out.result, status, "ChangePasswordUser2 returned unexpected value");
2357 }
2358
2359 return true;
2360 }
2361
2362
2363 bool test_ChangePasswordUser3(struct dcerpc_pipe *p, struct torture_context *tctx,
2364 const char *account_string,
2365 int policy_min_pw_len,
2366 char **password,
2367 const char *newpass,
2368 NTTIME last_password_change,
2369 bool handle_reject_reason)
2370 {
2371 struct samr_ChangePasswordUser3 r;
2372 bool ret = true;
2373 struct lsa_String server, account, account_bad;
2374 struct samr_CryptPassword nt_pass, lm_pass;
2375 struct samr_Password nt_verifier, lm_verifier;
2376 char *oldpass;
2377 struct dcerpc_binding_handle *b = p->binding_handle;
2378 uint8_t old_nt_hash[16], new_nt_hash[16];
2379 uint8_t old_lm_hash[16], new_lm_hash[16];
2380 NTTIME t;
2381 struct samr_DomInfo1 *dominfo = NULL;
2382 struct userPwdChangeFailureInformation *reject = NULL;
2383
2384 torture_comment(tctx, "Testing ChangePasswordUser3\n");
2385
2386 if (newpass == NULL) {
2387 do {
2388 if (policy_min_pw_len == 0) {
2389 newpass = samr_rand_pass(tctx, policy_min_pw_len);
2390 } else {
2391 newpass = samr_rand_pass_fixed_len(tctx, policy_min_pw_len);
2392 }
2393 } while (check_password_quality(newpass) == false);
2394 } else {
2395 torture_comment(tctx, "Using password '%s'\n", newpass);
2396 }
2397
2398 torture_assert(tctx, *password != NULL,
2399 "Failing ChangePasswordUser3 as old password was NULL. Previous test failed?");
2400
2401 oldpass = *password;
2402 server.string = talloc_asprintf(tctx, "\\\\%s", dcerpc_server_name(p));
2403 init_lsa_String(&account, account_string);
2404
2405 E_md4hash(oldpass, old_nt_hash);
2406 E_md4hash(newpass, new_nt_hash);
2407
2408 E_deshash(oldpass, old_lm_hash);
2409 E_deshash(newpass, new_lm_hash);
2410
2411 encode_pw_buffer(lm_pass.data, newpass, STR_UNICODE);
2412 arcfour_crypt(lm_pass.data, old_nt_hash, 516);
2413 E_old_pw_hash(new_nt_hash, old_lm_hash, lm_verifier.hash);
2414
2415 encode_pw_buffer(nt_pass.data, newpass, STR_UNICODE);
2416 arcfour_crypt(nt_pass.data, old_nt_hash, 516);
2417 E_old_pw_hash(new_nt_hash, old_nt_hash, nt_verifier.hash);
2418
2419 /* Break the verification */
2420 nt_verifier.hash[0]++;
2421
2422 r.in.server = &server;
2423 r.in.account = &account;
2424 r.in.nt_password = &nt_pass;
2425 r.in.nt_verifier = &nt_verifier;
2426 r.in.lm_change = 1;
2427 r.in.lm_password = &lm_pass;
2428 r.in.lm_verifier = &lm_verifier;
2429 r.in.password3 = NULL;
2430 r.out.dominfo = &dominfo;
2431 r.out.reject = &reject;
2432
2433 torture_assert_ntstatus_ok(tctx, dcerpc_samr_ChangePasswordUser3_r(b, tctx, &r),
2434 "ChangePasswordUser3 failed");
2435 torture_comment(tctx, "(%s:%s) old_password[%s] new_password[%s] status[%s]\n",
2436 __location__, __FUNCTION__,
2437 oldpass, newpass, nt_errstr(r.out.result));
2438 if (!NT_STATUS_EQUAL(r.out.result, NT_STATUS_PASSWORD_RESTRICTION) &&
2439 (!NT_STATUS_EQUAL(r.out.result, NT_STATUS_WRONG_PASSWORD))) {
2440 torture_result(tctx, TORTURE_FAIL, "ChangePasswordUser3 failed, should have returned WRONG_PASSWORD (or at least 'PASSWORD_RESTRICTON') for invalid password verifier - %s\n",
2441 nt_errstr(r.out.result));
2442 ret = false;
2443 }
2444
2445 encode_pw_buffer(lm_pass.data, newpass, STR_UNICODE);
2446 arcfour_crypt(lm_pass.data, old_nt_hash, 516);
2447 E_old_pw_hash(new_nt_hash, old_lm_hash, lm_verifier.hash);
2448
2449 encode_pw_buffer(nt_pass.data, newpass, STR_UNICODE);
2450 /* Break the NT hash */
2451 old_nt_hash[0]++;
2452 arcfour_crypt(nt_pass.data, old_nt_hash, 516);
2453 /* Unbreak it again */
2454 old_nt_hash[0]--;
2455 E_old_pw_hash(new_nt_hash, old_nt_hash, nt_verifier.hash);
2456
2457 r.in.server = &server;
2458 r.in.account = &account;
2459 r.in.nt_password = &nt_pass;
2460 r.in.nt_verifier = &nt_verifier;
2461 r.in.lm_change = 1;
2462 r.in.lm_password = &lm_pass;
2463 r.in.lm_verifier = &lm_verifier;
2464 r.in.password3 = NULL;
2465 r.out.dominfo = &dominfo;
2466 r.out.reject = &reject;
2467
2468 torture_assert_ntstatus_ok(tctx, dcerpc_samr_ChangePasswordUser3_r(b, tctx, &r),
2469 "ChangePasswordUser3 failed");
2470 torture_comment(tctx, "(%s:%s) old_password[%s] new_password[%s] status[%s]\n",
2471 __location__, __FUNCTION__,
2472 oldpass, newpass, nt_errstr(r.out.result));
2473 if (!NT_STATUS_EQUAL(r.out.result, NT_STATUS_PASSWORD_RESTRICTION) &&
2474 (!NT_STATUS_EQUAL(r.out.result, NT_STATUS_WRONG_PASSWORD))) {
2475 torture_result(tctx, TORTURE_FAIL, "ChangePasswordUser3 failed, should have returned WRONG_PASSWORD (or at least 'PASSWORD_RESTRICTON') for invalidly encrpted password - %s\n",
2476 nt_errstr(r.out.result));
2477 ret = false;
2478 }
2479
2480 /* This shouldn't be a valid name */
2481 init_lsa_String(&account_bad, talloc_asprintf(tctx, "%sXX", account_string));
2482
2483 r.in.account = &account_bad;
2484 torture_assert_ntstatus_ok(tctx, dcerpc_samr_ChangePasswordUser3_r(b, tctx, &r),
2485 "ChangePasswordUser3 failed");
2486 torture_comment(tctx, "(%s:%s) old_password[%s] new_password[%s] status[%s]\n",
2487 __location__, __FUNCTION__,
2488 oldpass, newpass, nt_errstr(r.out.result));
2489 if (!NT_STATUS_EQUAL(r.out.result, NT_STATUS_WRONG_PASSWORD)) {
2490 torture_result(tctx, TORTURE_FAIL, "ChangePasswordUser3 failed, should have returned WRONG_PASSWORD for invalid username - %s\n",
2491 nt_errstr(r.out.result));
2492 ret = false;
2493 }
2494
2495 E_md4hash(oldpass, old_nt_hash);
2496 E_md4hash(newpass, new_nt_hash);
2497
2498 E_deshash(oldpass, old_lm_hash);
2499 E_deshash(newpass, new_lm_hash);
2500
2501 encode_pw_buffer(lm_pass.data, newpass, STR_UNICODE);
2502 arcfour_crypt(lm_pass.data, old_nt_hash, 516);
2503 E_old_pw_hash(new_nt_hash, old_lm_hash, lm_verifier.hash);
2504
2505 encode_pw_buffer(nt_pass.data, newpass, STR_UNICODE);
2506 arcfour_crypt(nt_pass.data, old_nt_hash, 516);
2507 E_old_pw_hash(new_nt_hash, old_nt_hash, nt_verifier.hash);
2508
2509 r.in.server = &server;
2510 r.in.account = &account;
2511 r.in.nt_password = &nt_pass;
2512 r.in.nt_verifier = &nt_verifier;
2513 r.in.lm_change = 1;
2514 r.in.lm_password = &lm_pass;
2515 r.in.lm_verifier = &lm_verifier;
2516 r.in.password3 = NULL;
2517 r.out.dominfo = &dominfo;
2518 r.out.reject = &reject;
2519
2520 unix_to_nt_time(&t, time(NULL));
2521
2522 torture_assert_ntstatus_ok(tctx, dcerpc_samr_ChangePasswordUser3_r(b, tctx, &r),
2523 "ChangePasswordUser3 failed");
2524 torture_comment(tctx, "(%s:%s) old_password[%s] new_password[%s] status[%s]\n",
2525 __location__, __FUNCTION__,
2526 oldpass, newpass, nt_errstr(r.out.result));
2527
2528 torture_comment(tctx, "(%s): dominfo[%s], reject[%s], handle_reject_reason[%s], "
2529 "last_password_change[%s], dominfo->min_password_age[%lld]\n",
2530 __location__,
2531 (dominfo == NULL)? "NULL" : "present",
2532 reject ? "true" : "false",
2533 handle_reject_reason ? "true" : "false",
2534 null_nttime(last_password_change) ? "null" : "not null",
2535 dominfo ? (long long)dominfo->min_password_age : (long long)0);
2536
2537 if (NT_STATUS_EQUAL(r.out.result, NT_STATUS_PASSWORD_RESTRICTION)
2538 && dominfo
2539 && reject
2540 && handle_reject_reason
2541 && (!null_nttime(last_password_change) || !dominfo->min_password_age)) {
2542 if (dominfo->password_properties & DOMAIN_REFUSE_PASSWORD_CHANGE ) {
2543
2544 if (reject && (reject->extendedFailureReason != SAM_PWD_CHANGE_NO_ERROR)) {
2545 torture_result(tctx, TORTURE_FAIL, "expected SAM_PWD_CHANGE_NO_ERROR (%d), got %d\n",
2546 SAM_PWD_CHANGE_NO_ERROR, reject->extendedFailureReason);
2547 return false;
2548 }
2549 }
2550
2551 /* We tested the order of precendence which is as follows:
2552
2553 * pwd min_age
2554 * pwd length
2555 * pwd complexity
2556 * pwd history
2557
2558 Guenther */
2559
2560 if ((dominfo->min_password_age < 0) && !null_nttime(last_password_change) &&
2561 (last_password_change - dominfo->min_password_age > t)) {
2562
2563 if (reject->extendedFailureReason != SAM_PWD_CHANGE_NO_ERROR) {
2564 torture_result(tctx, TORTURE_FAIL, "expected SAM_PWD_CHANGE_NO_ERROR (%d), got %d\n",
2565 SAM_PWD_CHANGE_NO_ERROR, reject->extendedFailureReason);
2566 return false;
2567 }
2568
2569 } else if ((dominfo->min_password_length > 0) &&
2570 (strlen(newpass) < dominfo->min_password_length)) {
2571
2572 if (reject->extendedFailureReason != SAM_PWD_CHANGE_PASSWORD_TOO_SHORT) {
2573 torture_result(tctx, TORTURE_FAIL, "expected SAM_PWD_CHANGE_PASSWORD_TOO_SHORT (%d), got %d\n",
2574 SAM_PWD_CHANGE_PASSWORD_TOO_SHORT, reject->extendedFailureReason);
2575 return false;
2576 }
2577
2578 } else if ((dominfo->password_history_length > 0) &&
2579 strequal(oldpass, newpass)) {
2580
2581 if (reject->extendedFailureReason != SAM_PWD_CHANGE_PWD_IN_HISTORY) {
2582 torture_result(tctx, TORTURE_FAIL, "expected SAM_PWD_CHANGE_PWD_IN_HISTORY (%d), got %d\n",
2583 SAM_PWD_CHANGE_PWD_IN_HISTORY, reject->extendedFailureReason);
2584 return false;
2585 }
2586 } else if (dominfo->password_properties & DOMAIN_PASSWORD_COMPLEX) {
2587
2588 if (reject->extendedFailureReason != SAM_PWD_CHANGE_NOT_COMPLEX) {
2589 torture_result(tctx, TORTURE_FAIL, "expected SAM_PWD_CHANGE_NOT_COMPLEX (%d), got %d\n",
2590 SAM_PWD_CHANGE_NOT_COMPLEX, reject->extendedFailureReason);
2591 return false;
2592 }
2593
2594 }
2595
2596 if (reject->extendedFailureReason == SAM_PWD_CHANGE_PASSWORD_TOO_SHORT) {
2597 /* retry with adjusted size */
2598 return test_ChangePasswordUser3(p, tctx, account_string,
2599 dominfo->min_password_length,
2600 password, NULL, 0, false);
2601
2602 }
2603
2604 } else if (NT_STATUS_EQUAL(r.out.result, NT_STATUS_PASSWORD_RESTRICTION)) {
2605 if (reject && reject->extendedFailureReason != SAM_PWD_CHANGE_NO_ERROR) {
2606 torture_result(tctx, TORTURE_FAIL, "expected SAM_PWD_CHANGE_NO_ERROR (%d), got %d\n",
2607 SAM_PWD_CHANGE_NO_ERROR, reject->extendedFailureReason);
2608 return false;
2609 }
2610 /* Perhaps the server has a 'min password age' set? */
2611
2612 } else {
2613 torture_assert_ntstatus_ok(tctx, r.out.result, "ChangePasswordUser3");
2614
2615 *password = talloc_strdup(tctx, newpass);
2616 }
2617
2618 return ret;
2619 }
2620
2621 bool test_ChangePasswordRandomBytes(struct dcerpc_pipe *p, struct torture_context *tctx,
2622 const char *account_string,
2623 struct policy_handle *handle,
2624 char **password)
2625 {
2626 NTSTATUS status;
2627 struct samr_ChangePasswordUser3 r;
2628 struct samr_SetUserInfo s;
2629 union samr_UserInfo u;
2630 DATA_BLOB session_key;
2631 DATA_BLOB confounded_session_key = data_blob_talloc(tctx, NULL, 16);
2632 uint8_t confounder[16];
2633 MD5_CTX ctx;
2634
2635 bool ret = true;
2636 struct lsa_String server, account;
2637 struct samr_CryptPassword nt_pass;
2638 struct samr_Password nt_verifier;
2639 DATA_BLOB new_random_pass;
2640 char *newpass;
2641 char *oldpass;
2642 struct dcerpc_binding_handle *b = p->binding_handle;
2643 uint8_t old_nt_hash[16], new_nt_hash[16];
2644 NTTIME t;
2645 struct samr_DomInfo1 *dominfo = NULL;
2646 struct userPwdChangeFailureInformation *reject = NULL;
2647
2648 new_random_pass = samr_very_rand_pass(tctx, 128);
2649
2650 torture_assert(tctx, *password != NULL,
2651 "Failing ChangePasswordUser3 as old password was NULL. Previous test failed?");
2652
2653 oldpass = *password;
2654 server.string = talloc_asprintf(tctx, "\\\\%s", dcerpc_server_name(p));
2655 init_lsa_String(&account, account_string);
2656
2657 s.in.user_handle = handle;
2658 s.in.info = &u;
2659 s.in.level = 25;
2660
2661 ZERO_STRUCT(u);
2662
2663 u.info25.info.fields_present = SAMR_FIELD_NT_PASSWORD_PRESENT;
2664
2665 set_pw_in_buffer(u.info25.password.data, &new_random_pass);
2666
2667 status = dcerpc_fetch_session_key(p, &session_key);
2668 if (!NT_STATUS_IS_OK(status)) {
2669 torture_result(tctx, TORTURE_FAIL, "SetUserInfo level %u - no session key - %s\n",
2670 s.in.level, nt_errstr(status));
2671 return false;
2672 }
2673
2674 generate_random_buffer((uint8_t *)confounder, 16);
2675
2676 MD5Init(&ctx);
2677 MD5Update(&ctx, confounder, 16);
2678 MD5Update(&ctx, session_key.data, session_key.length);
2679 MD5Final(confounded_session_key.data, &ctx);
2680
2681 arcfour_crypt_blob(u.info25.password.data, 516, &confounded_session_key);
2682 memcpy(&u.info25.password.data[516], confounder, 16);
2683
2684 torture_comment(tctx, "Testing SetUserInfo level 25 (set password ex) with a password made up of only random bytes\n");
2685
2686 torture_assert_ntstatus_ok(tctx, dcerpc_samr_SetUserInfo_r(b, tctx, &s),
2687 "SetUserInfo failed");
2688 torture_comment(tctx, "(%s:%s) old_password[%s] new_password[%s] status[%s]\n",
2689 __location__, __FUNCTION__,
2690 oldpass, "RANDOM", nt_errstr(s.out.result));
2691 if (!NT_STATUS_IS_OK(s.out.result)) {
2692 torture_result(tctx, TORTURE_FAIL, "SetUserInfo level %u failed - %s\n",
2693 s.in.level, nt_errstr(s.out.result));
2694 ret = false;
2695 }
2696
2697 torture_comment(tctx, "Testing ChangePasswordUser3 with a password made up of only random bytes\n");
2698
2699 mdfour(old_nt_hash, new_random_pass.data, new_random_pass.length);
2700
2701 new_random_pass = samr_very_rand_pass(tctx, 128);
2702
2703 mdfour(new_nt_hash, new_random_pass.data, new_random_pass.length);
2704
2705 set_pw_in_buffer(nt_pass.data, &new_random_pass);
2706 arcfour_crypt(nt_pass.data, old_nt_hash, 516);
2707 E_old_pw_hash(new_nt_hash, old_nt_hash, nt_verifier.hash);
2708
2709 r.in.server = &server;
2710 r.in.account = &account;
2711 r.in.nt_password = &nt_pass;
2712 r.in.nt_verifier = &nt_verifier;
2713 r.in.lm_change = 0;
2714 r.in.lm_password = NULL;
2715 r.in.lm_verifier = NULL;
2716 r.in.password3 = NULL;
2717 r.out.dominfo = &dominfo;
2718 r.out.reject = &reject;
2719
2720 unix_to_nt_time(&t, time(NULL));
2721
2722 torture_assert_ntstatus_ok(tctx, dcerpc_samr_ChangePasswordUser3_r(b, tctx, &r),
2723 "ChangePasswordUser3 failed");
2724 torture_comment(tctx, "(%s:%s) old_password[%s] new_password[%s] status[%s]\n",
2725 __location__, __FUNCTION__,
2726 oldpass, "RANDOM", nt_errstr(r.out.result));
2727
2728 if (NT_STATUS_EQUAL(r.out.result, NT_STATUS_PASSWORD_RESTRICTION)) {
2729 if (reject && reject->extendedFailureReason != SAM_PWD_CHANGE_NO_ERROR) {
2730 torture_result(tctx, TORTURE_FAIL, "expected SAM_PWD_CHANGE_NO_ERROR (%d), got %d\n",
2731 SAM_PWD_CHANGE_NO_ERROR, reject->extendedFailureReason);
2732 return false;
2733 }
2734 /* Perhaps the server has a 'min password age' set? */
2735
2736 } else if (!NT_STATUS_IS_OK(r.out.result)) {
2737 torture_result(tctx, TORTURE_FAIL, "ChangePasswordUser3 failed - %s\n", nt_errstr(r.out.result));
2738 ret = false;
2739 }
2740
2741 newpass = samr_rand_pass(tctx, 128);
2742
2743 mdfour(old_nt_hash, new_random_pass.data, new_random_pass.length);
2744
2745 E_md4hash(newpass, new_nt_hash);
2746
2747 encode_pw_buffer(nt_pass.data, newpass, STR_UNICODE);
2748 arcfour_crypt(nt_pass.data, old_nt_hash, 516);
2749 E_old_pw_hash(new_nt_hash, old_nt_hash, nt_verifier.hash);
2750
2751 r.in.server = &server;
2752 r.in.account = &account;
2753 r.in.nt_password = &nt_pass;
2754 r.in.nt_verifier = &nt_verifier;
2755 r.in.lm_change = 0;
2756 r.in.lm_password = NULL;
2757 r.in.lm_verifier = NULL;
2758 r.in.password3 = NULL;
2759 r.out.dominfo = &dominfo;
2760 r.out.reject = &reject;
2761
2762 unix_to_nt_time(&t, time(NULL));
2763
2764 torture_assert_ntstatus_ok(tctx, dcerpc_samr_ChangePasswordUser3_r(b, tctx, &r),
2765 "ChangePasswordUser3 failed");
2766 torture_comment(tctx, "(%s:%s) old_password[%s] new_password[%s] status[%s]\n",
2767 __location__, __FUNCTION__,
2768 oldpass, newpass, nt_errstr(r.out.result));
2769
2770 if (NT_STATUS_EQUAL(r.out.result, NT_STATUS_PASSWORD_RESTRICTION)) {
2771 if (reject && reject->extendedFailureReason != SAM_PWD_CHANGE_NO_ERROR) {
2772 torture_result(tctx, TORTURE_FAIL, "expected SAM_PWD_CHANGE_NO_ERROR (%d), got %d\n",
2773 SAM_PWD_CHANGE_NO_ERROR, reject->extendedFailureReason);
2774 return false;
2775 }
2776 /* Perhaps the server has a 'min password age' set? */
2777
2778 } else {
2779 torture_assert_ntstatus_ok(tctx, r.out.result, "ChangePasswordUser3 (on second random password)");
2780 *password = talloc_strdup(tctx, newpass);
2781 }
2782
2783 return ret;
2784 }
2785
2786
2787 static bool test_GetMembersInAlias(struct dcerpc_binding_handle *b,
2788 struct torture_context *tctx,
2789 struct policy_handle *alias_handle)
2790 {
2791 struct samr_GetMembersInAlias r;
2792 struct lsa_SidArray sids;
2793
2794 torture_comment(tctx, "Testing GetMembersInAlias\n");
2795
2796 r.in.alias_handle = alias_handle;
2797 r.out.sids = &sids;
2798
2799 torture_assert_ntstatus_ok(tctx, dcerpc_samr_GetMembersInAlias_r(b, tctx, &r),
2800 "GetMembersInAlias failed");
2801 torture_assert_ntstatus_ok(tctx, r.out.result, "GetMembersInAlias failed");
2802
2803 return true;
2804 }
2805
2806 static bool test_AddMemberToAlias(struct dcerpc_binding_handle *b,
2807 struct torture_context *tctx,
2808 struct policy_handle *alias_handle,
2809 const struct dom_sid *domain_sid)
2810 {
2811 struct samr_AddAliasMember r;
2812 struct samr_DeleteAliasMember d;
2813 struct dom_sid *sid;
2814
2815 sid = dom_sid_add_rid(tctx, domain_sid, 512);
2816
2817 torture_comment(tctx, "Testing AddAliasMember\n");
2818 r.in.alias_handle = alias_handle;
2819 r.in.sid = sid;
2820
2821 torture_assert_ntstatus_ok(tctx, dcerpc_samr_AddAliasMember_r(b, tctx, &r),
2822 "AddAliasMember failed");
2823 torture_assert_ntstatus_ok(tctx, r.out.result, "AddAliasMember failed");
2824
2825 d.in.alias_handle = alias_handle;
2826 d.in.sid = sid;
2827
2828 torture_assert_ntstatus_ok(tctx, dcerpc_samr_DeleteAliasMember_r(b, tctx, &d),
2829 "DeleteAliasMember failed");
2830 torture_assert_ntstatus_ok(tctx, d.out.result, "DelAliasMember failed");
2831
2832 return true;
2833 }
2834
2835 static bool test_AddMultipleMembersToAlias(struct dcerpc_binding_handle *b,
2836 struct torture_context *tctx,
2837 struct policy_handle *alias_handle)
2838 {
2839 struct samr_AddMultipleMembersToAlias a;
2840 struct samr_RemoveMultipleMembersFromAlias r;
2841 struct lsa_SidArray sids;
2842
2843 torture_comment(tctx, "Testing AddMultipleMembersToAlias\n");
2844 a.in.alias_handle = alias_handle;
2845 a.in.sids = &sids;
2846
2847 sids.num_sids = 3;
2848 sids.sids = talloc_array(tctx, struct lsa_SidPtr, 3);
2849
2850 sids.sids[0].sid = dom_sid_parse_talloc(tctx, "S-1-5-32-1-2-3-1");
2851 sids.sids[1].sid = dom_sid_parse_talloc(tctx, "S-1-5-32-1-2-3-2");
2852 sids.sids[2].sid = dom_sid_parse_talloc(tctx, "S-1-5-32-1-2-3-3");
2853
2854 torture_assert_ntstatus_ok(tctx, dcerpc_samr_AddMultipleMembersToAlias_r(b, tctx, &a),
2855 "AddMultipleMembersToAlias failed");
2856 torture_assert_ntstatus_ok(tctx, a.out.result, "AddMultipleMembersToAlias");
2857
2858
2859 torture_comment(tctx, "Testing RemoveMultipleMembersFromAlias\n");
2860 r.in.alias_handle = alias_handle;
2861 r.in.sids = &sids;
2862
2863 torture_assert_ntstatus_ok(tctx, dcerpc_samr_RemoveMultipleMembersFromAlias_r(b, tctx, &r),
2864 "RemoveMultipleMembersFromAlias failed");
2865 torture_assert_ntstatus_ok(tctx, r.out.result, "RemoveMultipleMembersFromAlias failed");
2866
2867 /* strange! removing twice doesn't give any error */
2868 torture_assert_ntstatus_ok(tctx, dcerpc_samr_RemoveMultipleMembersFromAlias_r(b, tctx, &r),
2869 "RemoveMultipleMembersFromAlias failed");
2870 torture_assert_ntstatus_ok(tctx, r.out.result, "RemoveMultipleMembersFromAlias failed");
2871
2872 /* but removing an alias that isn't there does */
2873 sids.sids[2].sid = dom_sid_parse_talloc(tctx, "S-1-5-32-1-2-3-4");
2874
2875 torture_assert_ntstatus_ok(tctx, dcerpc_samr_RemoveMultipleMembersFromAlias_r(b, tctx, &r),
2876 "RemoveMultipleMembersFromAlias failed");
2877 torture_assert_ntstatus_equal(tctx, r.out.result, NT_STATUS_OBJECT_NAME_NOT_FOUND, "RemoveMultipleMembersFromAlias");
2878
2879 return true;
2880 }
2881
2882 static bool test_GetAliasMembership(struct dcerpc_binding_handle *b,
2883 struct torture_context *tctx,
2884 struct policy_handle *domain_handle)
2885 {
2886 struct samr_GetAliasMembership r;
2887 struct lsa_SidArray sids;
2888 struct samr_Ids rids;
2889
2890 torture_comment(tctx, "Testing GetAliasMembership\n");
2891
2892 r.in.domain_handle = domain_handle;
2893 r.in.sids = &sids;
2894 r.out.rids = &rids;
2895
2896 sids.num_sids = 0;
2897 sids.sids = talloc_zero_array(tctx, struct lsa_SidPtr, sids.num_sids);
2898
2899 torture_assert_ntstatus_ok(tctx, dcerpc_samr_GetAliasMembership_r(b, tctx, &r),
2900 "GetAliasMembership failed");
2901 torture_assert_ntstatus_ok(tctx, r.out.result,
2902 "samr_GetAliasMembership failed");
2903
2904 torture_assert_int_equal(tctx, sids.num_sids, rids.count,
2905 "protocol misbehaviour");
2906
2907 sids.num_sids = 1;
2908 sids.sids = talloc_zero_array(tctx, struct lsa_SidPtr, sids.num_sids);
2909 sids.sids[0].sid = dom_sid_parse_talloc(tctx, "S-1-5-32-1-2-3-1");
2910
2911 torture_assert_ntstatus_ok(tctx, dcerpc_samr_GetAliasMembership_r(b, tctx, &r),
2912 "samr_GetAliasMembership failed");
2913 torture_assert_ntstatus_ok(tctx, r.out.result,
2914 "samr_GetAliasMembership failed");
2915
2916 #if 0
2917 /* only true for w2k8 it seems
2918 * win7, xp, w2k3 will return a 0 length array pointer */
2919
2920 if (rids.ids && (rids.count == 0)) {
2921 torture_fail(tctx, "samr_GetAliasMembership returned 0 count and a rids array");
2922 }
2923 #endif
2924 if (!rids.ids && rids.count) {
2925 torture_fail(tctx, "samr_GetAliasMembership returned non-0 count but no rids");
2926 }
2927
2928 return true;
2929 }
2930
2931 static bool test_TestPrivateFunctionsUser(struct dcerpc_binding_handle *b,
2932 struct torture_context *tctx,
2933 struct policy_handle *user_handle)
2934 {
2935 struct samr_TestPrivateFunctionsUser r;
2936
2937 torture_comment(tctx, "Testing TestPrivateFunctionsUser\n");
2938
2939 r.in.user_handle = user_handle;
2940
2941 torture_assert_ntstatus_ok(tctx, dcerpc_samr_TestPrivateFunctionsUser_r(b, tctx, &r),
2942 "TestPrivateFunctionsUser failed");
2943 torture_assert_ntstatus_equal(tctx, r.out.result, NT_STATUS_NOT_IMPLEMENTED, "TestPrivateFunctionsUser");
2944
2945 return true;
2946 }
2947
2948 static bool test_QueryUserInfo_pwdlastset(struct dcerpc_binding_handle *b,
2949 struct torture_context *tctx,
2950 struct policy_handle *handle,
2951 bool use_info2,
2952 NTTIME *pwdlastset)
2953 {
2954 NTSTATUS status;
2955 uint16_t levels[] = { /* 3, */ 5, 21 };
2956 int i;
2957 /* NTTIME pwdlastset3 = 0; */
2958 NTTIME pwdlastset5 = 0;
2959 NTTIME pwdlastset21 = 0;
2960
2961 torture_comment(tctx, "Testing QueryUserInfo%s level 5 and 21 call ",
2962 use_info2 ? "2":"");
2963
2964 for (i=0; i<ARRAY_SIZE(levels); i++) {
2965
2966 struct samr_QueryUserInfo r;
2967 struct samr_QueryUserInfo2 r2;
2968 union samr_UserInfo *info;
2969
2970 if (use_info2) {
2971 r2.in.user_handle = handle;
2972 r2.in.level = levels[i];
2973 r2.out.info = &info;
2974 torture_assert_ntstatus_ok(tctx, dcerpc_samr_QueryUserInfo2_r(b, tctx, &r2),
2975 "QueryUserInfo2 failed");
2976 status = r2.out.result;
2977
2978 } else {
2979 r.in.user_handle = handle;
2980 r.in.level = levels[i];
2981 r.out.info = &info;
2982 torture_assert_ntstatus_ok(tctx, dcerpc_samr_QueryUserInfo_r(b, tctx, &r),
2983 "QueryUserInfo failed");
2984 status = r.out.result;
2985 }
2986
2987 if (!NT_STATUS_IS_OK(status) &&
2988 !NT_STATUS_EQUAL(status, NT_STATUS_INVALID_INFO_CLASS)) {
2989 torture_result(tctx, TORTURE_FAIL, "QueryUserInfo%s level %u failed - %s\n",
2990 use_info2 ? "2":"", levels[i], nt_errstr(status));
2991 return false;
2992 }
2993
2994 switch (levels[i]) {
2995 case 3:
2996 /* pwdlastset3 = info->info3.last_password_change; */
2997 break;
2998 case 5:
2999 pwdlastset5 = info->info5.last_password_change;
3000 break;
3001 case 21:
3002 pwdlastset21 = info->info21.last_password_change;
3003 break;
3004 default:
3005 return false;
3006 }
3007 }
3008 /* torture_assert_int_equal(tctx, pwdlastset3, pwdlastset5,
3009 "pwdlastset mixup"); */
3010 torture_assert_int_equal(tctx, pwdlastset5, pwdlastset21,
3011 "pwdlastset mixup");
3012
3013 *pwdlastset = pwdlastset21;
3014
3015 torture_comment(tctx, "(pwdlastset: %llu)\n",
3016 (unsigned long long) *pwdlastset);
3017
3018 return true;
3019 }
3020
3021 static bool test_SamLogon(struct torture_context *tctx,
3022 struct dcerpc_pipe *p,
3023 struct cli_credentials *machine_credentials,
3024 struct cli_credentials *test_credentials,
3025 NTSTATUS expected_result,
3026 bool interactive)
3027 {
3028 NTSTATUS status;
3029 struct netr_LogonSamLogonEx r;
3030 union netr_LogonLevel logon;
3031 union netr_Validation validation;
3032 uint8_t authoritative;
3033 struct netr_IdentityInfo identity;
3034 struct netr_NetworkInfo ninfo;
3035 struct netr_PasswordInfo pinfo;
3036 DATA_BLOB names_blob, chal, lm_resp, nt_resp;
3037 int flags = CLI_CRED_NTLM_AUTH;
3038 uint32_t samlogon_flags = 0;
3039 struct netlogon_creds_CredentialState *creds;
3040 struct netr_Authenticator a;
3041 struct dcerpc_binding_handle *b = p->binding_handle;
3042
3043 torture_assert(tctx, (creds = cli_credentials_get_netlogon_creds(machine_credentials)), "");
3044
3045 if (lpcfg_client_lanman_auth(tctx->lp_ctx)) {
3046 flags |= CLI_CRED_LANMAN_AUTH;
3047 }
3048
3049 if (lpcfg_client_ntlmv2_auth(tctx->lp_ctx)) {
3050 flags |= CLI_CRED_NTLMv2_AUTH;
3051 }
3052
3053 cli_credentials_get_ntlm_username_domain(test_credentials, tctx,
3054 &identity.account_name.string,
3055 &identity.domain_name.string);
3056
3057 identity.parameter_control =
3058 MSV1_0_ALLOW_SERVER_TRUST_ACCOUNT |
3059 MSV1_0_ALLOW_WORKSTATION_TRUST_ACCOUNT;
3060 identity.logon_id_low = 0;
3061 identity.logon_id_high = 0;
3062 identity.workstation.string = cli_credentials_get_workstation(test_credentials);
3063
3064 if (interactive) {
3065 netlogon_creds_client_authenticator(creds, &a);
3066
3067 if (!E_deshash(cli_credentials_get_password(test_credentials), pinfo.lmpassword.hash)) {
3068 ZERO_STRUCT(pinfo.lmpassword.hash);
3069 }
3070 E_md4hash(cli_credentials_get_password(test_credentials), pinfo.ntpassword.hash);
3071
3072 if (creds->negotiate_flags & NETLOGON_NEG_SUPPORTS_AES) {
3073 netlogon_creds_aes_encrypt(creds, pinfo.lmpassword.hash, 16);
3074 netlogon_creds_aes_encrypt(creds, pinfo.ntpassword.hash, 16);
3075 } else if (creds->negotiate_flags & NETLOGON_NEG_ARCFOUR) {
3076 netlogon_creds_arcfour_crypt(creds, pinfo.lmpassword.hash, 16);
3077 netlogon_creds_arcfour_crypt(creds, pinfo.ntpassword.hash, 16);
3078 } else {
3079 netlogon_creds_des_encrypt(creds, &pinfo.lmpassword);
3080 netlogon_creds_des_encrypt(creds, &pinfo.ntpassword);
3081 }
3082
3083 pinfo.identity_info = identity;
3084 logon.password = &pinfo;
3085
3086 r.in.logon_level = NetlogonInteractiveInformation;
3087 } else {
3088 generate_random_buffer(ninfo.challenge,
3089 sizeof(ninfo.challenge));
3090 chal = data_blob_const(ninfo.challenge,
3091 sizeof(ninfo.challenge));
3092
3093 names_blob = NTLMv2_generate_names_blob(tctx, cli_credentials_get_workstation(test_credentials),
3094 cli_credentials_get_domain(test_credentials));
3095
3096 status = cli_credentials_get_ntlm_response(test_credentials, tctx,
3097 &flags,
3098 chal,
3099 names_blob,
3100 &lm_resp, &nt_resp,
3101 NULL, NULL);
3102 torture_assert_ntstatus_ok(tctx, status, "cli_credentials_get_ntlm_response failed");
3103
3104 ninfo.lm.data = lm_resp.data;
3105 ninfo.lm.length = lm_resp.length;
3106
3107 ninfo.nt.data = nt_resp.data;
3108 ninfo.nt.length = nt_resp.length;
3109
3110 ninfo.identity_info = identity;
3111 logon.network = &ninfo;
3112
3113 r.in.logon_level = NetlogonNetworkInformation;
3114 }
3115
3116 r.in.server_name = talloc_asprintf(tctx, "\\\\%s", dcerpc_server_name(p));
3117 r.in.computer_name = cli_credentials_get_workstation(test_credentials);
3118 r.in.logon = &logon;
3119 r.in.flags = &samlogon_flags;
3120 r.out.flags = &samlogon_flags;
3121 r.out.validation = &validation;
3122 r.out.authoritative = &authoritative;
3123
3124 torture_comment(tctx, "Testing LogonSamLogon with name %s\n", identity.account_name.string);
3125
3126 r.in.validation_level = 6;
3127
3128 torture_assert_ntstatus_ok(tctx, dcerpc_netr_LogonSamLogonEx_r(b, tctx, &r),
3129 "netr_LogonSamLogonEx failed");
3130 if (NT_STATUS_EQUAL(r.out.result, NT_STATUS_INVALID_INFO_CLASS)) {
3131 r.in.validation_level = 3;
3132 torture_assert_ntstatus_ok(tctx, dcerpc_netr_LogonSamLogonEx_r(b, tctx, &r),
3133 "netr_LogonSamLogonEx failed");
3134 }
3135 if (!NT_STATUS_IS_OK(r.out.result)) {
3136 torture_assert_ntstatus_equal(tctx, r.out.result, expected_result, "LogonSamLogonEx failed");
3137 return true;
3138 } else {
3139 torture_assert_ntstatus_ok(tctx, r.out.result, "LogonSamLogonEx failed");
3140 }
3141
3142 return true;
3143 }
3144
3145 static bool test_SamLogon_with_creds(struct torture_context *tctx,
3146 struct dcerpc_pipe *p,
3147 struct cli_credentials *machine_creds,
3148 const char *acct_name,
3149 const char *password,
3150 NTSTATUS expected_samlogon_result,
3151 bool interactive)
3152 {
3153 bool ret = true;
3154 struct cli_credentials *test_credentials;
3155
3156 test_credentials = cli_credentials_init(tctx);
3157
3158 cli_credentials_set_workstation(test_credentials,
3159 cli_credentials_get_workstation(machine_creds), CRED_SPECIFIED);
3160 cli_credentials_set_domain(test_credentials,
3161 cli_credentials_get_domain(machine_creds), CRED_SPECIFIED);
3162 cli_credentials_set_username(test_credentials,
3163 acct_name, CRED_SPECIFIED);
3164 cli_credentials_set_password(test_credentials,
3165 password, CRED_SPECIFIED);
3166
3167 torture_comment(tctx, "Testing samlogon (%s) as %s password: %s\n",
3168 interactive ? "interactive" : "network", acct_name, password);
3169
3170 if (!test_SamLogon(tctx, p, machine_creds, test_credentials,
3171 expected_samlogon_result, interactive)) {
3172 torture_result(tctx, TORTURE_FAIL, "new password did not work\n");
3173 ret = false;
3174 }
3175
3176 return ret;
3177 }
3178
3179 static bool test_SetPassword_level(struct dcerpc_pipe *p,
3180 struct dcerpc_pipe *np,
3181 struct torture_context *tctx,
3182 struct policy_handle *handle,
3183 uint16_t level,
3184 uint32_t fields_present,
3185 uint8_t password_expired,
3186 bool *matched_expected_error,
3187 bool use_setinfo2,
3188 const char *acct_name,
3189 char **password,
3190 struct cli_credentials *machine_creds,
3191 bool use_queryinfo2,
3192 NTTIME *pwdlastset,
3193 NTSTATUS expected_samlogon_result)
3194 {
3195 const char *fields = NULL;
3196 bool ret = true;
3197 struct dcerpc_binding_handle *b = p->binding_handle;
3198
3199 switch (level) {
3200 case 21:
3201 case 23:
3202 case 25:
3203 fields = talloc_asprintf(tctx, "(fields_present: 0x%08x)",
3204 fields_present);
3205 break;
3206 default:
3207 break;
3208 }
3209
3210 torture_comment(tctx, "Testing SetUserInfo%s level %d call "
3211 "(password_expired: %d) %s\n",
3212 use_setinfo2 ? "2":"", level, password_expired,
3213 fields ? fields : "");
3214
3215 if (!test_SetUserPass_level_ex(p, tctx, handle, level,
3216 fields_present,
3217 password,
3218 password_expired,
3219 use_setinfo2,
3220 matched_expected_error)) {
3221 ret = false;
3222 }
3223
3224 if (!test_QueryUserInfo_pwdlastset(b, tctx, handle,
3225 use_queryinfo2,
3226 pwdlastset)) {
3227 ret = false;
3228 }
3229
3230 if (*matched_expected_error == true) {
3231 return ret;
3232 }
3233
3234 if (!test_SamLogon_with_creds(tctx, np,
3235 machine_creds,
3236 acct_name,
3237 *password,
3238 expected_samlogon_result,
3239 false)) {
3240 ret = false;
3241 }
3242
3243 return ret;
3244 }
3245
3246 static bool setup_schannel_netlogon_pipe(struct torture_context *tctx,
3247 struct cli_credentials *credentials,
3248 struct dcerpc_pipe **p)
3249 {
3250 struct dcerpc_binding *b;
3251 NTSTATUS status;
3252
3253 torture_assert_ntstatus_ok(tctx, torture_rpc_binding(tctx, &b),
3254 "failed to get rpc binding");
3255
3256 /* We have to use schannel, otherwise the SamLogonEx fails
3257 * with INTERNAL_ERROR */
3258
3259 status = dcerpc_binding_set_flags(b,
3260 DCERPC_SCHANNEL | DCERPC_SIGN |
3261 DCERPC_SCHANNEL_AUTO,
3262 DCERPC_AUTH_OPTIONS);
3263 torture_assert_ntstatus_ok(tctx, status, "set flags");
3264
3265 torture_assert_ntstatus_ok(tctx,
3266 dcerpc_pipe_connect_b(tctx, p, b, &ndr_table_netlogon,
3267 credentials, tctx->ev, tctx->lp_ctx),
3268 "failed to bind to netlogon");
3269
3270 return true;
3271 }
3272
3273 static bool test_SetPassword_pwdlastset(struct dcerpc_pipe *p,
3274 struct torture_context *tctx,
3275 uint32_t acct_flags,
3276 const char *acct_name,
3277 struct policy_handle *handle,
3278 char **password,
3279 struct cli_credentials *machine_credentials)
3280 {
3281 int s = 0, q = 0, f = 0, l = 0, z = 0;
3282 bool ret = true;
3283 int delay = 50000;
3284 bool set_levels[] = { false, true };
3285 bool query_levels[] = { false, true };
3286 uint32_t levels[] = { 18, 21, 26, 23, 24, 25 }; /* Second half only used when TEST_ALL_LEVELS defined */
3287 uint32_t nonzeros[] = { 1, 24 };
3288 uint32_t fields_present[] = {
3289 0,
3290 SAMR_FIELD_EXPIRED_FLAG,
3291 SAMR_FIELD_LAST_PWD_CHANGE,
3292 SAMR_FIELD_EXPIRED_FLAG | SAMR_FIELD_LAST_PWD_CHANGE,
3293 SAMR_FIELD_COMMENT,
3294 SAMR_FIELD_NT_PASSWORD_PRESENT,
3295 SAMR_FIELD_NT_PASSWORD_PRESENT | SAMR_FIELD_LAST_PWD_CHANGE,
3296 SAMR_FIELD_NT_PASSWORD_PRESENT | SAMR_FIELD_LM_PASSWORD_PRESENT,
3297 SAMR_FIELD_NT_PASSWORD_PRESENT | SAMR_FIELD_LM_PASSWORD_PRESENT | SAMR_FIELD_LAST_PWD_CHANGE,
3298 SAMR_FIELD_NT_PASSWORD_PRESENT | SAMR_FIELD_EXPIRED_FLAG,
3299 SAMR_FIELD_NT_PASSWORD_PRESENT | SAMR_FIELD_LM_PASSWORD_PRESENT | SAMR_FIELD_EXPIRED_FLAG,
3300 SAMR_FIELD_NT_PASSWORD_PRESENT | SAMR_FIELD_LM_PASSWORD_PRESENT | SAMR_FIELD_LAST_PWD_CHANGE | SAMR_FIELD_EXPIRED_FLAG
3301 };
3302 struct dcerpc_pipe *np = NULL;
3303
3304 if (torture_setting_bool(tctx, "samba3", false) ||
3305 torture_setting_bool(tctx, "samba4", false)) {
3306 delay = 999999;
3307 torture_comment(tctx, "Samba3 has second granularity, setting delay to: %d\n",
3308 delay);
3309 }
3310
3311 torture_assert(tctx, setup_schannel_netlogon_pipe(tctx, machine_credentials, &np), "");
3312
3313 /* set to 1 to enable testing for all possible opcode
3314 (SetUserInfo, SetUserInfo2, QueryUserInfo, QueryUserInfo2)
3315 combinations */
3316 #if 0
3317 #define TEST_ALL_LEVELS 1
3318 #define TEST_SET_LEVELS 1
3319 #define TEST_QUERY_LEVELS 1
3320 #endif
3321 #ifdef TEST_ALL_LEVELS
3322 for (l=0; l<ARRAY_SIZE(levels); l++) {
3323 #else
3324 for (l=0; l<(ARRAY_SIZE(levels))/2; l++) {
3325 #endif
3326 for (z=0; z<ARRAY_SIZE(nonzeros); z++) {
3327 for (f=0; f<ARRAY_SIZE(fields_present); f++) {
3328 #ifdef TEST_SET_LEVELS
3329 for (s=0; s<ARRAY_SIZE(set_levels); s++) {
3330 #endif
3331 #ifdef TEST_QUERY_LEVELS
3332 for (q=0; q<ARRAY_SIZE(query_levels); q++) {
3333 #endif
3334 NTTIME pwdlastset_old = 0;
3335 NTTIME pwdlastset_new = 0;
3336 bool matched_expected_error = false;
3337 NTSTATUS expected_samlogon_result = NT_STATUS_ACCOUNT_DISABLED;
3338
3339 torture_comment(tctx, "------------------------------\n"
3340 "Testing pwdLastSet attribute for flags: 0x%08x "
3341 "(s: %d (l: %d), q: %d)\n",
3342 acct_flags, s, levels[l], q);
3343
3344 switch (levels[l]) {
3345 case 21:
3346 case 23:
3347 case 25:
3348 if (!((fields_present[f] & SAMR_FIELD_NT_PASSWORD_PRESENT) ||
3349 (fields_present[f] & SAMR_FIELD_LM_PASSWORD_PRESENT))) {
3350 expected_samlogon_result = NT_STATUS_WRONG_PASSWORD;
3351 }
3352 break;
3353 }
3354
3355
3356 /* set #1 */
3357
3358 /* set a password and force password change (pwdlastset 0) by
3359 * setting the password expired flag to a non-0 value */
3360
3361 if (!test_SetPassword_level(p, np, tctx, handle,
3362 levels[l],
3363 fields_present[f],
3364 nonzeros[z],
3365 &matched_expected_error,
3366 set_levels[s],
3367 acct_name,
3368 password,
3369 machine_credentials,
3370 query_levels[q],
3371 &pwdlastset_new,
3372 expected_samlogon_result)) {
3373 ret = false;
3374 }
3375
3376 if (matched_expected_error == true) {
3377 /* skipping on expected failure */
3378 continue;
3379 }
3380
3381 /* pwdlastset must be 0 afterwards, except for a level 21, 23 and 25
3382 * set without the SAMR_FIELD_EXPIRED_FLAG */
3383
3384 switch (levels[l]) {
3385 case 21:
3386 case 23:
3387 case 25:
3388 if ((pwdlastset_new != 0) &&
3389 !(fields_present[f] & SAMR_FIELD_EXPIRED_FLAG)) {
3390 torture_comment(tctx, "not considering a non-0 "
3391 "pwdLastSet as a an error as the "
3392 "SAMR_FIELD_EXPIRED_FLAG has not "
3393 "been set\n");
3394 break;
3395 }
3396 break;
3397 default:
3398 if (pwdlastset_new != 0) {
3399 torture_result(tctx, TORTURE_FAIL, "pwdLastSet test failed: "
3400 "expected pwdLastSet 0 but got %llu\n",
3401 (unsigned long long) pwdlastset_old);
3402 ret = false;
3403 }
3404 break;
3405 }
3406
3407 switch (levels[l]) {
3408 case 21:
3409 case 23:
3410 case 25:
3411 if (((fields_present[f] & SAMR_FIELD_NT_PASSWORD_PRESENT) ||
3412 (fields_present[f] & SAMR_FIELD_LM_PASSWORD_PRESENT)) &&
3413 (pwdlastset_old > 0) && (pwdlastset_new > 0) &&
3414 (pwdlastset_old >= pwdlastset_new)) {
3415 torture_result(tctx, TORTURE_FAIL, "pwdlastset not increasing\n");
3416 ret = false;
3417 }
3418 break;
3419 }
3420
3421 pwdlastset_old = pwdlastset_new;
3422
3423 usleep(delay);
3424
3425 /* set #2 */
3426
3427 /* set a password, pwdlastset needs to get updated (increased
3428 * value), password_expired value used here is 0 */
3429
3430 if (!test_SetPassword_level(p, np, tctx, handle,
3431 levels[l],
3432 fields_present[f],
3433 0,
3434 &matched_expected_error,
3435 set_levels[s],
3436 acct_name,
3437 password,
3438 machine_credentials,
3439 query_levels[q],
3440 &pwdlastset_new,
3441 expected_samlogon_result)) {
3442 ret = false;
3443 }
3444
3445 /* when a password has been changed, pwdlastset must not be 0 afterwards
3446 * and must be larger then the old value */
3447
3448 switch (levels[l]) {
3449 case 21:
3450 case 23:
3451 case 25:
3452 /* SAMR_FIELD_EXPIRED_FLAG has not been set and no
3453 * password has been changed, old and new pwdlastset
3454 * need to be the same value */
3455
3456 if (!(fields_present[f] & SAMR_FIELD_EXPIRED_FLAG) &&
3457 !((fields_present[f] & SAMR_FIELD_NT_PASSWORD_PRESENT) ||
3458 (fields_present[f] & SAMR_FIELD_LM_PASSWORD_PRESENT)))
3459 {
3460 torture_assert_int_equal(tctx, pwdlastset_old,
3461 pwdlastset_new, "pwdlastset must be equal");
3462 break;
3463 }
3464 break;
3465 default:
3466 if (pwdlastset_old >= pwdlastset_new) {
3467 torture_result(tctx, TORTURE_FAIL, "pwdLastSet test failed: "
3468 "expected last pwdlastset (%llu) < new pwdlastset (%llu)\n",
3469 (unsigned long long) pwdlastset_old,
3470 (unsigned long long) pwdlastset_new);
3471 ret = false;
3472 }
3473 if (pwdlastset_new == 0) {
3474 torture_result(tctx, TORTURE_FAIL, "pwdLastSet test failed: "
3475 "expected non-0 pwdlastset, got: %llu\n",
3476 (unsigned long long) pwdlastset_new);
3477 ret = false;
3478 }
3479 break;
3480 }
3481
3482 switch (levels[l]) {
3483 case 21:
3484 case 23:
3485 case 25:
3486 if (((fields_present[f] & SAMR_FIELD_NT_PASSWORD_PRESENT) ||
3487 (fields_present[f] & SAMR_FIELD_LM_PASSWORD_PRESENT)) &&
3488 (pwdlastset_old > 0) && (pwdlastset_new > 0) &&
3489 (pwdlastset_old >= pwdlastset_new)) {
3490 torture_result(tctx, TORTURE_FAIL, "pwdlastset not increasing\n");
3491 ret = false;
3492 }
3493 break;
3494 }
3495
3496 pwdlastset_old = pwdlastset_new;
3497
3498 usleep(delay);
3499
3500 /* set #2b */
3501
3502 /* set a password, pwdlastset needs to get updated (increased
3503 * value), password_expired value used here is 0 */
3504
3505 if (!test_SetPassword_level(p, np, tctx, handle,
3506 levels[l],
3507 fields_present[f],
3508 0,
3509 &matched_expected_error,
3510 set_levels[s],
3511 acct_name,
3512 password,
3513 machine_credentials,
3514 query_levels[q],
3515 &pwdlastset_new,
3516 expected_samlogon_result)) {
3517 ret = false;
3518 }
3519
3520 /* when a password has been changed, pwdlastset must not be 0 afterwards
3521 * and must be larger then the old value */
3522
3523 switch (levels[l]) {
3524 case 21:
3525 case 23:
3526 case 25:
3527
3528 /* SAMR_FIELD_EXPIRED_FLAG has not been set and no
3529 * password has been changed, old and new pwdlastset
3530 * need to be the same value */
3531
3532 if (!(fields_present[f] & SAMR_FIELD_EXPIRED_FLAG) &&
3533 !((fields_present[f] & SAMR_FIELD_NT_PASSWORD_PRESENT) ||
3534 (fields_present[f] & SAMR_FIELD_LM_PASSWORD_PRESENT)))
3535 {
3536 torture_assert_int_equal(tctx, pwdlastset_old,
3537 pwdlastset_new, "pwdlastset must be equal");
3538 break;
3539 }
3540 break;
3541 default:
3542 if (pwdlastset_old >= pwdlastset_new) {
3543 torture_result(tctx, TORTURE_FAIL, "pwdLastSet test failed: "
3544 "expected last pwdlastset (%llu) < new pwdlastset (%llu)\n",
3545 (unsigned long long) pwdlastset_old,
3546 (unsigned long long) pwdlastset_new);
3547 ret = false;
3548 }
3549 if (pwdlastset_new == 0) {
3550 torture_result(tctx, TORTURE_FAIL, "pwdLastSet test failed: "
3551 "expected non-0 pwdlastset, got: %llu\n",
3552 (unsigned long long) pwdlastset_new);
3553 ret = false;
3554 }
3555 break;
3556 }
3557
3558 switch (levels[l]) {
3559 case 21:
3560 case 23:
3561 case 25:
3562 if (((fields_present[f] & SAMR_FIELD_NT_PASSWORD_PRESENT) ||
3563 (fields_present[f] & SAMR_FIELD_LM_PASSWORD_PRESENT)) &&
3564 (pwdlastset_old > 0) && (pwdlastset_new > 0) &&
3565 (pwdlastset_old >= pwdlastset_new)) {
3566 torture_result(tctx, TORTURE_FAIL, "pwdlastset not increasing\n");
3567 ret = false;
3568 }
3569 break;
3570 }
3571
3572 pwdlastset_old = pwdlastset_new;
3573
3574 usleep(delay);
3575
3576 /* set #3 */
3577
3578 /* set a password and force password change (pwdlastset 0) by
3579 * setting the password expired flag to a non-0 value */
3580
3581 if (!test_SetPassword_level(p, np, tctx, handle,
3582 levels[l],
3583 fields_present[f],
3584 nonzeros[z],
3585 &matched_expected_error,
3586 set_levels[s],
3587 acct_name,
3588 password,
3589 machine_credentials,
3590 query_levels[q],
3591 &pwdlastset_new,
3592 expected_samlogon_result)) {
3593 ret = false;
3594 }
3595
3596 /* pwdlastset must be 0 afterwards, except for a level 21, 23 and 25
3597 * set without the SAMR_FIELD_EXPIRED_FLAG */
3598
3599 switch (levels[l]) {
3600 case 21:
3601 case 23:
3602 case 25:
3603 if ((pwdlastset_new != 0) &&
3604 !(fields_present[f] & SAMR_FIELD_EXPIRED_FLAG)) {
3605 torture_comment(tctx, "not considering a non-0 "
3606 "pwdLastSet as a an error as the "
3607 "SAMR_FIELD_EXPIRED_FLAG has not "
3608 "been set\n");
3609 break;
3610 }
3611
3612 /* SAMR_FIELD_EXPIRED_FLAG has not been set and no
3613 * password has been changed, old and new pwdlastset
3614 * need to be the same value */
3615
3616 if (!(fields_present[f] & SAMR_FIELD_EXPIRED_FLAG) &&
3617 !((fields_present[f] & SAMR_FIELD_NT_PASSWORD_PRESENT) ||
3618 (fields_present[f] & SAMR_FIELD_LM_PASSWORD_PRESENT)))
3619 {
3620 torture_assert_int_equal(tctx, pwdlastset_old,
3621 pwdlastset_new, "pwdlastset must be equal");
3622 break;
3623 }
3624 break;
3625 default:
3626 if (pwdlastset_new != 0) {
3627 torture_result(tctx, TORTURE_FAIL, "pwdLastSet test failed: "
3628 "expected pwdLastSet 0, got %llu\n",
3629 (unsigned long long) pwdlastset_old);
3630 ret = false;
3631 }
3632 break;
3633 }
3634
3635 switch (levels[l]) {
3636 case 21:
3637 case 23:
3638 case 25:
3639 if (((fields_present[f] & SAMR_FIELD_NT_PASSWORD_PRESENT) ||
3640 (fields_present[f] & SAMR_FIELD_LM_PASSWORD_PRESENT)) &&
3641 (pwdlastset_old > 0) && (pwdlastset_new > 0) &&
3642 (pwdlastset_old >= pwdlastset_new)) {
3643 torture_result(tctx, TORTURE_FAIL, "pwdlastset not increasing\n");
3644 ret = false;
3645 }
3646 break;
3647 }
3648
3649 /* if the level we are testing does not have a fields_present
3650 * field, skip all fields present tests by setting f to to
3651 * arraysize */
3652 switch (levels[l]) {
3653 case 18:
3654 case 24:
3655 case 26:
3656 f = ARRAY_SIZE(fields_present);
3657 break;
3658 }
3659
3660 #ifdef TEST_QUERY_LEVELS
3661 }
3662 #endif
3663 #ifdef TEST_SET_LEVELS
3664 }
3665 #endif
3666 } /* fields present */
3667 } /* nonzeros */
3668 } /* levels */
3669
3670 #undef TEST_SET_LEVELS
3671 #undef TEST_QUERY_LEVELS
3672
3673 talloc_free(np);
3674
3675 return ret;
3676 }
3677
3678 static bool test_QueryUserInfo_badpwdcount(struct dcerpc_binding_handle *b,
3679 struct torture_context *tctx,
3680 struct policy_handle *handle,
3681 uint32_t *badpwdcount)
3682 {
3683 union samr_UserInfo *info;
3684 struct samr_QueryUserInfo r;
3685
3686 r.in.user_handle = handle;
3687 r.in.level = 3;
3688 r.out.info = &info;
3689
3690 torture_comment(tctx, "Testing QueryUserInfo level %d", r.in.level);
3691
3692 torture_assert_ntstatus_ok(tctx, dcerpc_samr_QueryUserInfo_r(b, tctx, &r),
3693 "failed to query userinfo");
3694 torture_assert_ntstatus_ok(tctx, r.out.result,
3695 "failed to query userinfo");
3696
3697 *badpwdcount = info->info3.bad_password_count;
3698
3699 torture_comment(tctx, " (bad password count: %d)\n", *badpwdcount);
3700
3701 return true;
3702 }
3703
3704 static bool test_SetUserInfo_acct_flags(struct dcerpc_binding_handle *b,
3705 struct torture_context *tctx,
3706 struct policy_handle *user_handle,
3707 uint32_t acct_flags)
3708 {
3709 struct samr_SetUserInfo r;
3710 union samr_UserInfo user_info;
3711
3712 torture_comment(tctx, "Testing SetUserInfo level 16\n");
3713
3714 user_info.info16.acct_flags = acct_flags;
3715
3716 r.in.user_handle = user_handle;
3717 r.in.level = 16;
3718 r.in.info = &user_info;
3719
3720 torture_assert_ntstatus_ok(tctx, dcerpc_samr_SetUserInfo_r(b, tctx, &r),
3721 "failed to set account flags");
3722 torture_assert_ntstatus_ok(tctx, r.out.result,
3723 "failed to set account flags");
3724
3725 return true;
3726 }
3727
3728 static bool test_reset_badpwdcount(struct dcerpc_pipe *p,
3729 struct torture_context *tctx,
3730 struct policy_handle *user_handle,
3731 uint32_t acct_flags,
3732 char **password)
3733 {
3734 struct dcerpc_binding_handle *b = p->binding_handle;
3735
3736 torture_assert(tctx, test_SetUserPass(p, tctx, user_handle, password),
3737 "failed to set password");
3738
3739 torture_comment(tctx, "Testing SetUserInfo level 16 (enable account)\n");
3740
3741 torture_assert(tctx,
3742 test_SetUserInfo_acct_flags(b, tctx, user_handle,
3743 acct_flags & ~ACB_DISABLED),
3744 "failed to enable user");
3745
3746 torture_assert(tctx, test_SetUserPass(p, tctx, user_handle, password),
3747 "failed to set password");
3748
3749 return true;
3750 }
3751
3752 static bool test_SetDomainInfo(struct dcerpc_binding_handle *b,
3753 struct torture_context *tctx,
3754 struct policy_handle *domain_handle,
3755 enum samr_DomainInfoClass level,
3756 union samr_DomainInfo *info)
3757 {
3758 struct samr_SetDomainInfo r;
3759
3760 r.in.domain_handle = domain_handle;
3761 r.in.level = level;
3762 r.in.info = info;
3763
3764 torture_assert_ntstatus_ok(tctx,
3765 dcerpc_samr_SetDomainInfo_r(b, tctx, &r),
3766 "failed to set domain info");
3767 torture_assert_ntstatus_ok(tctx, r.out.result,
3768 "failed to set domain info");
3769
3770 return true;
3771 }
3772
3773 static bool test_SetDomainInfo_ntstatus(struct dcerpc_binding_handle *b,
3774 struct torture_context *tctx,
3775 struct policy_handle *domain_handle,
3776 enum samr_DomainInfoClass level,
3777 union samr_DomainInfo *info,
3778 NTSTATUS expected)
3779 {
3780 struct samr_SetDomainInfo r;
3781
3782 r.in.domain_handle = domain_handle;
3783 r.in.level = level;
3784 r.in.info = info;
3785
3786 torture_assert_ntstatus_ok(tctx, dcerpc_samr_SetDomainInfo_r(b, tctx, &r),
3787 "SetDomainInfo failed");
3788 torture_assert_ntstatus_equal(tctx, r.out.result, expected, "");
3789
3790 return true;
3791 }
3792
3793 static bool test_QueryDomainInfo2_level(struct dcerpc_binding_handle *b,
3794 struct torture_context *tctx,
3795 struct policy_handle *domain_handle,
3796 enum samr_DomainInfoClass level,
3797 union samr_DomainInfo **q_info)
3798 {
3799 struct samr_QueryDomainInfo2 r;
3800
3801 r.in.domain_handle = domain_handle;
3802 r.in.level = level;
3803 r.out.info = q_info;
3804
3805 torture_assert_ntstatus_ok(tctx, dcerpc_samr_QueryDomainInfo2_r(b, tctx, &r),
3806 "failed to query domain info");
3807 torture_assert_ntstatus_ok(tctx, r.out.result,
3808 "failed to query domain info");
3809
3810 return true;
3811 }
3812
3813 static bool test_Password_badpwdcount(struct dcerpc_pipe *p,
3814 struct dcerpc_pipe *np,
3815 struct torture_context *tctx,
3816 uint32_t acct_flags,
3817 const char *acct_name,
3818 struct policy_handle *domain_handle,
3819 struct policy_handle *user_handle,
3820 char **password,
3821 struct cli_credentials *machine_credentials,
3822 const char *comment,
3823 bool disable,
3824 bool interactive,
3825 NTSTATUS expected_success_status,
3826 struct samr_DomInfo1 *info1,
3827 struct samr_DomInfo12 *info12)
3828 {
3829 union samr_DomainInfo info;
3830 char **passwords;
3831 int i;
3832 uint32_t badpwdcount, tmp;
3833 uint32_t password_history_length = 12;
3834 uint32_t lockout_threshold = 15;
3835 uint32_t lockout_seconds = 5;
3836 uint64_t delta_time_factor = 10 * 1000 * 1000;
3837 struct dcerpc_binding_handle *b = p->binding_handle;
3838
3839 if (torture_setting_bool(tctx, "samba3", false)) {
3840 lockout_seconds = 60;
3841 }
3842
3843 torture_comment(tctx, "\nTesting bad pwd count with: %s\n", comment);
3844
3845 torture_assert(tctx, password_history_length < lockout_threshold,
3846 "password history length needs to be smaller than account lockout threshold for this test");
3847
3848
3849 /* set policies */
3850
3851 info.info1 = *info1;
3852 info.info1.password_history_length = password_history_length;
3853 info.info1.min_password_age = 0;
3854
3855 torture_assert(tctx,
3856 test_SetDomainInfo(b, tctx, domain_handle,
3857 DomainPasswordInformation, &info),
3858 "failed to set password history length and min passwd age");
3859
3860 info.info12 = *info12;
3861 info.info12.lockout_threshold = lockout_threshold;
3862
3863 /* set lockout duration of 5 seconds */
3864 info.info12.lockout_duration = ~(lockout_seconds * delta_time_factor);
3865 info.info12.lockout_window = ~(lockout_seconds * delta_time_factor);
3866
3867 torture_assert(tctx,
3868 test_SetDomainInfo(b, tctx, domain_handle,
3869 DomainLockoutInformation, &info),
3870 "failed to set lockout threshold");
3871
3872 /* reset bad pwd count */
3873
3874 torture_assert(tctx,
3875 test_reset_badpwdcount(p, tctx, user_handle, acct_flags, password), "");
3876
3877
3878 /* enable or disable account */
3879 if (disable) {
3880 torture_assert(tctx,
3881 test_SetUserInfo_acct_flags(b, tctx, user_handle,
3882 acct_flags | ACB_DISABLED),
3883 "failed to disable user");
3884 } else {
3885 torture_assert(tctx,
3886 test_SetUserInfo_acct_flags(b, tctx, user_handle,
3887 acct_flags & ~ACB_DISABLED),
3888 "failed to enable user");
3889 }
3890
3891
3892 /* setup password history */
3893
3894 passwords = talloc_array(tctx, char *, password_history_length);
3895
3896 for (i=0; i < password_history_length; i++) {
3897
3898 torture_assert(tctx, test_SetUserPass(p, tctx, user_handle, password),
3899 "failed to set password");
3900 passwords[i] = talloc_strdup(tctx, *password);
3901
3902 if (!test_SamLogon_with_creds(tctx, np, machine_credentials,
3903 acct_name, passwords[i],
3904 expected_success_status, interactive)) {
3905 torture_fail(tctx, "failed to auth with latest password");
3906 }
3907
3908 torture_assert(tctx,
3909 test_QueryUserInfo_badpwdcount(b, tctx, user_handle, &badpwdcount), "");
3910
3911 torture_assert_int_equal(tctx, badpwdcount, 0, "expected badpwdcount to be 0");
3912 }
3913
3914
3915 /* test with wrong password */
3916
3917 if (!test_SamLogon_with_creds(tctx, np, machine_credentials,
3918 acct_name, "random_crap",
3919 NT_STATUS_WRONG_PASSWORD, interactive)) {
3920 torture_fail(tctx, "succeeded to authenticate with wrong password");
3921 }
3922
3923 torture_assert(tctx,
3924 test_QueryUserInfo_badpwdcount(b, tctx, user_handle, &badpwdcount), "");
3925
3926 torture_assert_int_equal(tctx, badpwdcount, 1, "expected badpwdcount to be 1");
3927
3928
3929 /* test with latest good password */
3930
3931 if (!test_SamLogon_with_creds(tctx, np, machine_credentials, acct_name,
3932 passwords[password_history_length-1],
3933 expected_success_status, interactive)) {
3934 torture_fail(tctx, "succeeded to authenticate with wrong password");
3935 }
3936
3937 torture_assert(tctx,
3938 test_QueryUserInfo_badpwdcount(b, tctx, user_handle, &badpwdcount), "");
3939
3940 if (disable) {
3941 torture_assert_int_equal(tctx, badpwdcount, 1, "expected badpwdcount to be 1");
3942 } else {
3943 /* only enabled accounts get the bad pwd count reset upon
3944 * successful logon */
3945 torture_assert_int_equal(tctx, badpwdcount, 0, "expected badpwdcount to be 0");
3946 }
3947
3948 tmp = badpwdcount;
3949
3950
3951 /* test password history */
3952
3953 for (i=0; i < password_history_length; i++) {
3954
3955 torture_comment(tctx, "Testing bad password count behavior with "
3956 "password #%d of #%d\n", i, password_history_length);
3957
3958 /* - network samlogon will succeed auth and not
3959 * increase badpwdcount for 2 last entries
3960 * - interactive samlogon only for the last one */
3961
3962 if (i == password_history_length - 1 ||
3963 (i == password_history_length - 2 && !interactive)) {
3964
3965 if (!test_SamLogon_with_creds(tctx, np, machine_credentials,
3966 acct_name, passwords[i],
3967 expected_success_status, interactive)) {
3968 torture_fail(tctx, talloc_asprintf(tctx, "did not successfully to obtain %s for %s login with old password (#%d of #%d in history)",
3969 nt_errstr(expected_success_status),
3970 interactive ? "interactive" : "network", i, password_history_length));
3971 }
3972
3973 torture_assert(tctx,
3974 test_QueryUserInfo_badpwdcount(b, tctx, user_handle, &badpwdcount), "");
3975
3976 if (disable) {
3977 /* torture_comment(tctx, "expecting bad pwd count to *NOT INCREASE* for pwd history entry %d\n", i); */
3978 torture_assert_int_equal(tctx, badpwdcount, tmp, "unexpected badpwdcount");
3979 } else {
3980 /* torture_comment(tctx, "expecting bad pwd count to be 0 for pwd history entry %d\n", i); */
3981 torture_assert_int_equal(tctx, badpwdcount, 0, "expected badpwdcount to be 0");
3982 }
3983
3984 tmp = badpwdcount;
3985
3986 continue;
3987 }
3988
3989 if (!test_SamLogon_with_creds(tctx, np, machine_credentials,
3990 acct_name, passwords[i],
3991 NT_STATUS_WRONG_PASSWORD, interactive)) {
3992 torture_fail(tctx, talloc_asprintf(tctx, "succeeded to authenticate with old password (#%d of #%d in history)", i, password_history_length));
3993 }
3994
3995 torture_assert(tctx,
3996 test_QueryUserInfo_badpwdcount(b, tctx, user_handle, &badpwdcount), "");
3997
3998 /* - network samlogon will fail auth but not increase
3999 * badpwdcount for 3rd last entry
4000 * - interactive samlogon for 3rd and 2nd last entry */
4001
4002 if (i == password_history_length - 3 ||
4003 (i == password_history_length - 2 && interactive)) {
4004 /* torture_comment(tctx, "expecting bad pwd count to *NOT INCREASE * by one for pwd history entry %d\n", i); */
4005 torture_assert_int_equal(tctx, badpwdcount, tmp, "unexpected badpwdcount");
4006 } else {
4007 /* torture_comment(tctx, "expecting bad pwd count to increase by one for pwd history entry %d\n", i); */
4008 torture_assert_int_equal(tctx, badpwdcount, tmp + 1, "unexpected badpwdcount");
4009 }
4010
4011 tmp = badpwdcount;
4012 }
4013
4014 return true;
4015 }
4016
4017 static bool test_Password_badpwdcount_wrap(struct dcerpc_pipe *p,
4018 struct torture_context *tctx,
4019 uint32_t acct_flags,
4020 const char *acct_name,
4021 struct policy_handle *domain_handle,
4022 struct policy_handle *user_handle,
4023 char **password,
4024 struct cli_credentials *machine_credentials)
4025 {
4026 union samr_DomainInfo *q_info, s_info;
4027 struct samr_DomInfo1 info1, _info1;
4028 struct samr_DomInfo12 info12, _info12;
4029 bool ret = true;
4030 struct dcerpc_binding_handle *b = p->binding_handle;
4031 struct dcerpc_pipe *np;
4032 int i;
4033
4034 struct {
4035 const char *comment;
4036 bool disabled;
4037 bool interactive;
4038 NTSTATUS expected_success_status;
4039 } creds[] = {
4040 {
4041 .comment = "network logon (disabled account)",
4042 .disabled = true,
4043 .interactive = false,
4044 .expected_success_status= NT_STATUS_ACCOUNT_DISABLED
4045 },
4046 {
4047 .comment = "network logon (enabled account)",
4048 .disabled = false,
4049 .interactive = false,
4050 .expected_success_status= NT_STATUS_OK
4051 },
4052 {
4053 .comment = "interactive logon (disabled account)",
4054 .disabled = true,
4055 .interactive = true,
4056 .expected_success_status= NT_STATUS_ACCOUNT_DISABLED
4057 },
4058 {
4059 .comment = "interactive logon (enabled account)",
4060 .disabled = false,
4061 .interactive = true,
4062 .expected_success_status= NT_STATUS_OK
4063 },
4064 };
4065
4066 torture_assert(tctx, setup_schannel_netlogon_pipe(tctx, machine_credentials, &np), "");
4067
4068 /* backup old policies */
4069
4070 torture_assert(tctx,
4071 test_QueryDomainInfo2_level(b, tctx, domain_handle,
4072 DomainPasswordInformation, &q_info),
4073 "failed to query domain info level 1");
4074
4075 info1 = q_info->info1;
4076 _info1 = info1;
4077
4078 torture_assert(tctx,
4079 test_QueryDomainInfo2_level(b, tctx, domain_handle,
4080 DomainLockoutInformation, &q_info),
4081 "failed to query domain info level 12");
4082
4083 info12 = q_info->info12;
4084 _info12 = info12;
4085
4086 /* run tests */
4087
4088 for (i=0; i < ARRAY_SIZE(creds); i++) {
4089
4090 /* skip trust tests for now */
4091 if (acct_flags & ACB_WSTRUST ||
4092 acct_flags & ACB_SVRTRUST ||
4093 acct_flags & ACB_DOMTRUST) {
4094 continue;
4095 }
4096
4097 if (!test_Password_badpwdcount(p, np, tctx, acct_flags, acct_name,
4098 domain_handle, user_handle, password,
4099 machine_credentials,
4100 creds[i].comment,
4101 creds[i].disabled,
4102 creds[i].interactive,
4103 creds[i].expected_success_status,
4104 &_info1, &_info12)) {
4105 torture_result(tctx, TORTURE_FAIL, "TEST #%d (%s) failed\n", i, creds[i].comment);
4106 ret = false;
4107 } else {
4108 torture_comment(tctx, "TEST #%d (%s) succeeded\n", i, creds[i].comment);
4109 }
4110 }
4111
4112 /* restore policies */
4113
4114 s_info.info1 = info1;
4115
4116 torture_assert(tctx,
4117 test_SetDomainInfo(b, tctx, domain_handle,
4118 DomainPasswordInformation, &s_info),
4119 "failed to set password information");
4120
4121 s_info.info12 = info12;
4122
4123 torture_assert(tctx,
4124 test_SetDomainInfo(b, tctx, domain_handle,
4125 DomainLockoutInformation, &s_info),
4126 "failed to set lockout information");
4127
4128 return ret;
4129 }
4130
4131 static bool test_QueryUserInfo_lockout(struct dcerpc_binding_handle *b,
4132 struct torture_context *tctx,
4133 struct policy_handle *domain_handle,
4134 const char *acct_name,
4135 uint16_t raw_bad_password_count,
4136 uint16_t effective_bad_password_count,
4137 uint32_t effective_acb_lockout)
4138 {
4139 struct policy_handle user_handle;
4140 union samr_UserInfo *i;
4141 struct samr_QueryUserInfo r;
4142
4143 NTSTATUS status = test_OpenUser_byname(b, tctx, domain_handle, acct_name, &user_handle);
4144 if (!NT_STATUS_IS_OK(status)) {
4145 return false;
4146 }
4147
4148 r.in.user_handle = &user_handle;
4149 r.in.level = 3;
4150 r.out.info = &i;
4151 torture_comment(tctx, "Testing QueryUserInfo level %d", r.in.level);
4152 torture_assert_ntstatus_ok(tctx, dcerpc_samr_QueryUserInfo_r(b, tctx, &r),
4153 "failed to query userinfo");
4154 torture_assert_ntstatus_ok(tctx, r.out.result,
4155 "failed to query userinfo");
4156 torture_comment(tctx, " (acct_flags: 0x%08x) (raw_bad_pwd_count: %u)\n",
4157 i->info3.acct_flags, i->info3.bad_password_count);
4158 torture_assert_int_equal(tctx, i->info3.bad_password_count,
4159 raw_bad_password_count,
4160 "raw badpwdcount");
4161 torture_assert_int_equal(tctx, i->info3.acct_flags & ACB_AUTOLOCK,
4162 effective_acb_lockout,
4163 "effective acb_lockout");
4164 TALLOC_FREE(i);
4165
4166 r.in.user_handle = &user_handle;
4167 r.in.level = 5;
4168 r.out.info = &i;
4169 torture_comment(tctx, "Testing QueryUserInfo level %d", r.in.level);
4170 torture_assert_ntstatus_ok(tctx, dcerpc_samr_QueryUserInfo_r(b, tctx, &r),
4171 "failed to query userinfo");
4172 torture_assert_ntstatus_ok(tctx, r.out.result,
4173 "failed to query userinfo");
4174 torture_comment(tctx, " (acct_flags: 0x%08x) (effective_bad_pwd_count: %u)\n",
4175 i->info5.acct_flags, i->info5.bad_password_count);
4176 torture_assert_int_equal(tctx, i->info5.bad_password_count,
4177 effective_bad_password_count,
4178 "effective badpwdcount");
4179 torture_assert_int_equal(tctx, i->info5.acct_flags & ACB_AUTOLOCK,
4180 effective_acb_lockout,
4181 "effective acb_lockout");
4182 TALLOC_FREE(i);
4183
4184 r.in.user_handle = &user_handle;
4185 r.in.level = 16;
4186 r.out.info = &i;
4187 torture_comment(tctx, "Testing QueryUserInfo level %d", r.in.level);
4188 torture_assert_ntstatus_ok(tctx, dcerpc_samr_QueryUserInfo_r(b, tctx, &r),
4189 "failed to query userinfo");
4190 torture_assert_ntstatus_ok(tctx, r.out.result,
4191 "failed to query userinfo");
4192 torture_comment(tctx, " (acct_flags: 0x%08x)\n",
4193 i->info16.acct_flags);
4194 torture_assert_int_equal(tctx, i->info16.acct_flags & ACB_AUTOLOCK,
4195 effective_acb_lockout,
4196 "effective acb_lockout");
4197 TALLOC_FREE(i);
4198
4199 r.in.user_handle = &user_handle;
4200 r.in.level = 21;
4201 r.out.info = &i;
4202 torture_comment(tctx, "Testing QueryUserInfo level %d", r.in.level);
4203 torture_assert_ntstatus_ok(tctx, dcerpc_samr_QueryUserInfo_r(b, tctx, &r),
4204 "failed to query userinfo");
4205 torture_assert_ntstatus_ok(tctx, r.out.result,
4206 "failed to query userinfo");
4207 torture_comment(tctx, " (acct_flags: 0x%08x) (effective_bad_pwd_count: %u)\n",
4208 i->info21.acct_flags, i->info21.bad_password_count);
4209 torture_assert_int_equal(tctx, i->info21.bad_password_count,
4210 effective_bad_password_count,
4211 "effective badpwdcount");
4212 torture_assert_int_equal(tctx, i->info21.acct_flags & ACB_AUTOLOCK,
4213 effective_acb_lockout,
4214 "effective acb_lockout");
4215 TALLOC_FREE(i);
4216
4217 if (!test_samr_handle_Close(b, tctx, &user_handle)) {
4218 return false;
4219 }
4220
4221 return true;
4222 }
4223
4224 static bool test_Password_lockout(struct dcerpc_pipe *p,
4225 struct dcerpc_pipe *np,
4226 struct torture_context *tctx,
4227 uint32_t acct_flags,
4228 const char *acct_name,
4229 struct policy_handle *domain_handle,
4230 struct policy_handle *user_handle,
4231 char **password,
4232 struct cli_credentials *machine_credentials,
4233 const char *comment,
4234 bool disable,
4235 bool interactive,
4236 uint32_t password_history_length,
4237 NTSTATUS expected_success_status,
4238 struct samr_DomInfo1 *info1,
4239 struct samr_DomInfo12 *info12)
4240 {
4241 union samr_DomainInfo info;
4242 uint64_t lockout_threshold = 1;
4243 uint32_t lockout_seconds = 5;
4244 uint64_t delta_time_factor = 10 * 1000 * 1000;
4245 struct dcerpc_binding_handle *b = p->binding_handle;
4246
4247 if (torture_setting_bool(tctx, "samba3", false)) {
4248 lockout_seconds = 60;
4249 }
4250
4251 torture_comment(tctx, "\nTesting account lockout: %s\n", comment);
4252
4253 /* set policies */
4254
4255 info.info1 = *info1;
4256
4257 torture_comment(tctx, "setting password history length to %d.\n", password_history_length);
4258 info.info1.password_history_length = password_history_length;
4259
4260 torture_comment(tctx, "setting min password again.\n");
4261 info.info1.min_password_age = 0;
4262
4263 torture_assert(tctx,
4264 test_SetDomainInfo(b, tctx, domain_handle,
4265 DomainPasswordInformation, &info),
4266 "failed to set password history length");
4267
4268 info.info12 = *info12;
4269 info.info12.lockout_threshold = lockout_threshold;
4270
4271 /* set lockout duration < lockout window: should fail */
4272 info.info12.lockout_duration = ~(lockout_seconds * delta_time_factor);
4273 info.info12.lockout_window = ~((lockout_seconds + 1) * delta_time_factor);
4274
4275 torture_assert(tctx,
4276 test_SetDomainInfo_ntstatus(b, tctx, domain_handle,
4277 DomainLockoutInformation, &info,
4278 NT_STATUS_INVALID_PARAMETER),
4279 "setting lockout duration < lockout window gave unexpected result");
4280
4281 info.info12.lockout_duration = 0;
4282 info.info12.lockout_window = 0;
4283
4284 torture_assert(tctx,
4285 test_SetDomainInfo(b, tctx, domain_handle,
4286 DomainLockoutInformation, &info),
4287 "failed to set lockout window and duration to 0");
4288
4289
4290 /* set lockout duration of 5 seconds */
4291 info.info12.lockout_duration = ~(lockout_seconds * delta_time_factor);
4292 info.info12.lockout_window = ~(lockout_seconds * delta_time_factor);
4293
4294 torture_assert(tctx,
4295 test_SetDomainInfo(b, tctx, domain_handle,
4296 DomainLockoutInformation, &info),
4297 "failed to set lockout window and duration to 5 seconds");
4298
4299 /* reset bad pwd count */
4300
4301 torture_assert(tctx,
4302 test_reset_badpwdcount(p, tctx, user_handle, acct_flags, password), "");
4303
4304
4305 /* enable or disable account */
4306
4307 if (disable) {
4308 torture_assert(tctx,
4309 test_SetUserInfo_acct_flags(b, tctx, user_handle,
4310 acct_flags | ACB_DISABLED),
4311 "failed to disable user");
4312 } else {
4313 torture_assert(tctx,
4314 test_SetUserInfo_acct_flags(b, tctx, user_handle,
4315 acct_flags & ~ACB_DISABLED),
4316 "failed to enable user");
4317 }
4318
4319
4320 /* test logon with right password */
4321
4322 if (!test_SamLogon_with_creds(tctx, np, machine_credentials,
4323 acct_name, *password,
4324 expected_success_status, interactive)) {
4325 torture_fail(tctx, "failed to auth with latest password");
4326 }
4327
4328 torture_assert(tctx,
4329 test_QueryUserInfo_lockout(b, tctx, domain_handle, acct_name,
4330 0, 0, 0),
4331 "expected account to not be locked");
4332
4333 /* test with wrong password ==> lockout */
4334
4335 if (!test_SamLogon_with_creds(tctx, np, machine_credentials,
4336 acct_name, "random_crap",
4337 NT_STATUS_WRONG_PASSWORD, interactive)) {
4338 torture_fail(tctx, "succeeded to authenticate with wrong password");
4339 }
4340
4341 /*
4342 * curiously, windows does _not_ return fresh values of
4343 * effective bad_password_count and ACB_AUTOLOCK.
4344 */
4345 torture_assert(tctx,
4346 test_QueryUserInfo_lockout(b, tctx, domain_handle, acct_name,
4347 1, 1, ACB_AUTOLOCK),
4348 "expected account to not be locked");
4349
4350 /* test with good password */
4351
4352 if (!test_SamLogon_with_creds(tctx, np, machine_credentials, acct_name,
4353 *password,
4354 NT_STATUS_ACCOUNT_LOCKED_OUT, interactive))
4355 {
4356 torture_fail(tctx, "authenticate did not return NT_STATUS_ACCOUNT_LOCKED_OUT");
4357 }
4358
4359 /* bad pwd count should not get updated */
4360 torture_assert(tctx,
4361 test_QueryUserInfo_lockout(b, tctx, domain_handle, acct_name,
4362 1, 1, ACB_AUTOLOCK),
4363 "expected account to be locked");
4364
4365 torture_assert(tctx,
4366 test_ChangePasswordUser2_ntstatus(p, tctx, acct_name, *password,
4367 NT_STATUS_ACCOUNT_LOCKED_OUT),
4368 "got wrong status from ChangePasswordUser2");
4369
4370 /* bad pwd count should not get updated */
4371 torture_assert(tctx,
4372 test_QueryUserInfo_lockout(b, tctx, domain_handle, acct_name,
4373 1, 1, ACB_AUTOLOCK),
4374 "expected account to be locked");
4375
4376 torture_assert(tctx,
4377 test_ChangePasswordUser2_ntstatus(p, tctx, acct_name, "random_crap", NT_STATUS_ACCOUNT_LOCKED_OUT),
4378 "got wrong status from ChangePasswordUser2");
4379
4380 /* bad pwd count should not get updated */
4381 torture_assert(tctx,
4382 test_QueryUserInfo_lockout(b, tctx, domain_handle, acct_name,
4383 1, 1, ACB_AUTOLOCK),
4384 "expected account to be locked");
4385
4386 /* with bad password */
4387
4388 if (!test_SamLogon_with_creds(tctx, np, machine_credentials,
4389 acct_name, "random_crap2",
4390 NT_STATUS_ACCOUNT_LOCKED_OUT, interactive))
4391 {
4392 torture_fail(tctx, "authenticate did not return NT_STATUS_ACCOUNT_LOCKED_OUT");
4393 }
4394
4395 /* bad pwd count should not get updated */
4396 torture_assert(tctx,
4397 test_QueryUserInfo_lockout(b, tctx, domain_handle, acct_name,
4398 1, 1, ACB_AUTOLOCK),
4399 "expected account to be locked");
4400
4401 /* let lockout duration expire ==> unlock */
4402
4403 torture_comment(tctx, "let lockout duration expire...\n");
4404 sleep(lockout_seconds + 1);
4405
4406 torture_assert(tctx,
4407 test_QueryUserInfo_lockout(b, tctx, domain_handle, acct_name,
4408 1, 0, 0),
4409 "expected account to not be locked");
4410
4411 if (!test_SamLogon_with_creds(tctx, np, machine_credentials, acct_name,
4412 *password,
4413 expected_success_status, interactive))
4414 {
4415 torture_fail(tctx, "failed to authenticate after lockout expired");
4416 }
4417
4418 if (NT_STATUS_IS_OK(expected_success_status)) {
4419 torture_assert(tctx,
4420 test_QueryUserInfo_lockout(b, tctx, domain_handle, acct_name,
4421 0, 0, 0),
4422 "expected account to not be locked");
4423 } else {
4424 torture_assert(tctx,
4425 test_QueryUserInfo_lockout(b, tctx, domain_handle, acct_name,
4426 1, 0, 0),
4427 "expected account to not be locked");
4428 }
4429
4430 torture_assert(tctx,
4431 test_ChangePasswordUser2_ntstatus(p, tctx, acct_name, "random_crap", NT_STATUS_WRONG_PASSWORD),
4432 "got wrong status from ChangePasswordUser2");
4433
4434 torture_assert(tctx,
4435 test_QueryUserInfo_lockout(b, tctx, domain_handle, acct_name,
4436 1, 1, ACB_AUTOLOCK),
4437 "expected account to be locked");
4438
4439 torture_assert(tctx,
4440 test_ChangePasswordUser2_ntstatus(p, tctx, acct_name, *password, NT_STATUS_ACCOUNT_LOCKED_OUT),
4441 "got wrong status from ChangePasswordUser2");
4442
4443 torture_assert(tctx,
4444 test_QueryUserInfo_lockout(b, tctx, domain_handle, acct_name,
4445 1, 1, ACB_AUTOLOCK),
4446 "expected account to be locked");
4447
4448 torture_assert(tctx,
4449 test_ChangePasswordUser2_ntstatus(p, tctx, acct_name, "random_crap", NT_STATUS_ACCOUNT_LOCKED_OUT),
4450 "got wrong status from ChangePasswordUser2");
4451
4452 torture_assert(tctx,
4453 test_QueryUserInfo_lockout(b, tctx, domain_handle, acct_name,
4454 1, 1, ACB_AUTOLOCK),
4455 "expected account to be locked");
4456
4457 /* let lockout duration expire ==> unlock */
4458
4459 torture_comment(tctx, "let lockout duration expire...\n");
4460 sleep(lockout_seconds + 1);
4461
4462 torture_assert(tctx,
4463 test_QueryUserInfo_lockout(b, tctx, domain_handle, acct_name,
4464 1, 0, 0),
4465 "expected account to not be locked");
4466
4467 if (!test_SamLogon_with_creds(tctx, np, machine_credentials, acct_name,
4468 *password,
4469 expected_success_status, interactive))
4470 {
4471 torture_fail(tctx, "failed to authenticate after lockout expired");
4472 }
4473
4474 if (NT_STATUS_IS_OK(expected_success_status)) {
4475 torture_assert(tctx,
4476 test_QueryUserInfo_lockout(b, tctx, domain_handle, acct_name,
4477 0, 0, 0),
4478 "expected account to not be locked");
4479 } else {
4480 torture_assert(tctx,
4481 test_QueryUserInfo_lockout(b, tctx, domain_handle, acct_name,
4482 1, 0, 0),
4483 "expected account to not be locked");
4484 }
4485
4486 /* Testing ChangePasswordUser behaviour with 3 attempts */
4487 info.info12.lockout_threshold = 3;
4488
4489 torture_assert(tctx,
4490 test_SetDomainInfo(b, tctx, domain_handle,
4491 DomainLockoutInformation, &info),
4492 "failed to set lockout threshold to 3");
4493
4494 if (NT_STATUS_IS_OK(expected_success_status)) {
4495 torture_assert(tctx,
4496 test_QueryUserInfo_lockout(b, tctx, domain_handle, acct_name,
4497 0, 0, 0),
4498 "expected account to not be locked");
4499 } else {
4500 torture_assert(tctx,
4501 test_QueryUserInfo_lockout(b, tctx, domain_handle, acct_name,
4502 1, 0, 0),
4503 "expected account to not be locked");
4504 }
4505
4506 torture_assert(tctx,
4507 test_ChangePasswordUser2_ntstatus(p, tctx, acct_name, "random_crap", NT_STATUS_WRONG_PASSWORD),
4508 "got wrong status from ChangePasswordUser2");
4509
4510 /* bad pwd count will get updated */
4511 torture_assert(tctx,
4512 test_QueryUserInfo_lockout(b, tctx, domain_handle, acct_name,
4513 1, 1, 0),
4514 "expected account to not be locked");
4515
4516 torture_assert(tctx,
4517 test_ChangePasswordUser2_ntstatus(p, tctx, acct_name, "random_crap", NT_STATUS_WRONG_PASSWORD),
4518 "got wrong status from ChangePasswordUser2");
4519
4520 /* bad pwd count will get updated */
4521 torture_assert(tctx,
4522 test_QueryUserInfo_lockout(b, tctx, domain_handle, acct_name,
4523 2, 2, 0),
4524 "expected account to not be locked");
4525
4526 torture_assert(tctx,
4527 test_ChangePasswordUser2_ntstatus(p, tctx, acct_name, "random_crap", NT_STATUS_WRONG_PASSWORD),
4528 "got wrong status from ChangePasswordUser2");
4529
4530 /* bad pwd count should get updated */
4531 torture_assert(tctx,
4532 test_QueryUserInfo_lockout(b, tctx, domain_handle, acct_name,
4533 3, 3, ACB_AUTOLOCK),
4534 "expected account to be locked");
4535
4536 torture_assert(tctx,
4537 test_ChangePasswordUser2_ntstatus(p, tctx, acct_name, *password, NT_STATUS_ACCOUNT_LOCKED_OUT),
4538 "got wrong status from ChangePasswordUser2");
4539
4540 /* bad pwd count should not get updated */
4541 torture_assert(tctx,
4542 test_QueryUserInfo_lockout(b, tctx, domain_handle, acct_name,
4543 3, 3, ACB_AUTOLOCK),
4544 "expected account to be locked");
4545
4546 /* let lockout duration expire ==> unlock */
4547
4548 torture_comment(tctx, "let lockout duration expire...\n");
4549 sleep(lockout_seconds + 1);
4550
4551 torture_assert(tctx,
4552 test_QueryUserInfo_lockout(b, tctx, domain_handle, acct_name,
4553 3, 0, 0),
4554 "expected account to not be locked");
4555
4556 torture_assert(tctx,
4557 test_ChangePasswordUser2(p, tctx, acct_name, password, NULL, false),
4558 "got wrong status from ChangePasswordUser2");
4559
4560 torture_assert(tctx,
4561 test_QueryUserInfo_lockout(b, tctx, domain_handle, acct_name,
4562 3, 0, 0),
4563 "expected account to not be locked");
4564
4565 /* Used to reset the badPwdCount for the other tests */
4566 if (!test_SamLogon_with_creds(tctx, np, machine_credentials, acct_name,
4567 *password,
4568 expected_success_status, interactive))
4569 {
4570 torture_fail(tctx, "failed to authenticate after lockout expired");
4571 }
4572
4573 if (NT_STATUS_IS_OK(expected_success_status)) {
4574 torture_assert(tctx,
4575 test_QueryUserInfo_lockout(b, tctx, domain_handle, acct_name,
4576 0, 0, 0),
4577 "expected account to not be locked");
4578 } else {
4579 torture_assert(tctx,
4580 test_QueryUserInfo_lockout(b, tctx, domain_handle, acct_name,
4581 3, 0, 0),
4582 "expected account to not be locked");
4583 }
4584
4585 return true;
4586 }
4587
4588 static bool test_Password_lockout_wrap(struct dcerpc_pipe *p,
4589 struct torture_context *tctx,
4590 uint32_t acct_flags,
4591 const char *acct_name,
4592 struct policy_handle *domain_handle,
4593 struct policy_handle *user_handle,
4594 char **password,
4595 struct cli_credentials *machine_credentials)
4596 {
4597 union samr_DomainInfo *q_info, s_info;
4598 struct samr_DomInfo1 info1, _info1;
4599 struct samr_DomInfo12 info12, _info12;
4600 bool ret = true;
4601 struct dcerpc_binding_handle *b = p->binding_handle;
4602 struct dcerpc_pipe *np;
4603 int i;
4604
4605 struct {
4606 const char *comment;
4607 bool disabled;
4608 bool interactive;
4609 uint32_t password_history_length;
4610 NTSTATUS expected_success_status;
4611 } creds[] = {
4612 {
4613 .comment = "network logon (disabled account)",
4614 .disabled = true,
4615 .interactive = false,
4616 .expected_success_status= NT_STATUS_ACCOUNT_DISABLED
4617 },
4618 {
4619 .comment = "network logon (enabled account)",
4620 .disabled = false,
4621 .interactive = false,
4622 .expected_success_status= NT_STATUS_OK
4623 },
4624 {
4625 .comment = "network logon (enabled account, history len = 1)",
4626 .disabled = false,
4627 .interactive = false,
4628 .expected_success_status= NT_STATUS_OK,
4629 .password_history_length = 1
4630 },
4631 {
4632 .comment = "interactive logon (disabled account)",
4633 .disabled = true,
4634 .interactive = true,
4635 .expected_success_status= NT_STATUS_ACCOUNT_DISABLED
4636 },
4637 {
4638 .comment = "interactive logon (enabled account)",
4639 .disabled = false,
4640 .interactive = true,
4641 .expected_success_status= NT_STATUS_OK
4642 },
4643 {
4644 .comment = "interactive logon (enabled account, history len = 1)",
4645 .disabled = false,
4646 .interactive = true,
4647 .expected_success_status= NT_STATUS_OK,
4648 .password_history_length = 1
4649 },
4650 };
4651
4652 torture_assert(tctx, setup_schannel_netlogon_pipe(tctx, machine_credentials, &np), "");
4653
4654 /* backup old policies */
4655
4656 torture_assert(tctx,
4657 test_QueryDomainInfo2_level(b, tctx, domain_handle,
4658 DomainPasswordInformation, &q_info),
4659 "failed to query domain info level 1");
4660
4661 info1 = q_info->info1;
4662 _info1 = info1;
4663
4664 torture_assert(tctx,
4665 test_QueryDomainInfo2_level(b, tctx, domain_handle,
4666 DomainLockoutInformation, &q_info),
4667 "failed to query domain info level 12");
4668
4669 info12 = q_info->info12;
4670 _info12 = info12;
4671
4672 /* run tests */
4673
4674 for (i=0; i < ARRAY_SIZE(creds); i++) {
4675 bool test_passed;
4676 /* skip trust tests for now */
4677 if (acct_flags & ACB_WSTRUST ||
4678 acct_flags & ACB_SVRTRUST ||
4679 acct_flags & ACB_DOMTRUST) {
4680 continue;
4681 }
4682
4683 test_passed = test_Password_lockout(p, np, tctx, acct_flags, acct_name,
4684 domain_handle, user_handle, password,
4685 machine_credentials,
4686 creds[i].comment,
4687 creds[i].disabled,
4688 creds[i].interactive,
4689 creds[i].password_history_length,
4690 creds[i].expected_success_status,
4691 &_info1, &_info12);
4692 ret &= test_passed;
4693 if (!test_passed) {
4694 torture_result(tctx, TORTURE_FAIL, "TEST #%d (%s) failed\n", i, creds[i].comment);
4695 break;
4696 } else {
4697 torture_comment(tctx, "TEST #%d (%s) succeeded\n", i, creds[i].comment);
4698 }
4699 }
4700
4701 /* restore policies */
4702
4703 s_info.info1 = info1;
4704
4705 torture_assert(tctx,
4706 test_SetDomainInfo(b, tctx, domain_handle,
4707 DomainPasswordInformation, &s_info),
4708 "failed to set password information");
4709
4710 s_info.info12 = info12;
4711
4712 torture_assert(tctx,
4713 test_SetDomainInfo(b, tctx, domain_handle,
4714 DomainLockoutInformation, &s_info),
4715 "failed to set lockout information");
4716
4717 return ret;
4718 }
4719
4720 static bool test_DeleteUser_with_privs(struct dcerpc_pipe *p,
4721 struct dcerpc_pipe *lp,
4722 struct torture_context *tctx,
4723 struct policy_handle *domain_handle,
4724 struct policy_handle *lsa_handle,
4725 struct policy_handle *user_handle,
4726 const struct dom_sid *domain_sid,
4727 uint32_t rid,
4728 struct cli_credentials *machine_credentials)
4729 {
4730 bool ret = true;
4731 struct dcerpc_binding_handle *b = p->binding_handle;
4732 struct dcerpc_binding_handle *lb = lp->binding_handle;
4733
4734 struct policy_handle lsa_acct_handle;
4735 struct dom_sid *user_sid;
4736
4737 user_sid = dom_sid_add_rid(tctx, domain_sid, rid);
4738
4739 {
4740 struct lsa_EnumAccountRights r;
4741 struct lsa_RightSet rights;
4742
4743 torture_comment(tctx, "Testing LSA EnumAccountRights\n");
4744
4745 r.in.handle = lsa_handle;
4746 r.in.sid = user_sid;
4747 r.out.rights = &rights;
4748
4749 torture_assert_ntstatus_ok(tctx, dcerpc_lsa_EnumAccountRights_r(lb, tctx, &r),
4750 "lsa_EnumAccountRights failed");
4751 torture_assert_ntstatus_equal(tctx, r.out.result, NT_STATUS_OBJECT_NAME_NOT_FOUND,
4752 "Expected enum rights for account to fail");
4753 }
4754
4755 {
4756 struct lsa_RightSet rights;
4757 struct lsa_StringLarge names[2];
4758 struct lsa_AddAccountRights r;
4759
4760 torture_comment(tctx, "Testing LSA AddAccountRights\n");
4761
4762 init_lsa_StringLarge(&names[0], "SeMachineAccountPrivilege");
4763 init_lsa_StringLarge(&names[1], NULL);
4764
4765 rights.count = 1;
4766 rights.names = names;
4767
4768 r.in.handle = lsa_handle;
4769 r.in.sid = user_sid;
4770 r.in.rights = &rights;
4771
4772 torture_assert_ntstatus_ok(tctx, dcerpc_lsa_AddAccountRights_r(lb, tctx, &r),
4773 "lsa_AddAccountRights failed");
4774 torture_assert_ntstatus_ok(tctx, r.out.result,
4775 "Failed to add privileges");
4776 }
4777
4778 {
4779 struct lsa_EnumAccounts r;
4780 uint32_t resume_handle = 0;
4781 struct lsa_SidArray lsa_sid_array;
4782 int i;
4783 bool found_sid = false;
4784
4785 torture_comment(tctx, "Testing LSA EnumAccounts\n");
4786
4787 r.in.handle = lsa_handle;
4788 r.in.num_entries = 0x1000;
4789 r.in.resume_handle = &resume_handle;
4790 r.out.sids = &lsa_sid_array;
4791 r.out.resume_handle = &resume_handle;
4792
4793 torture_assert_ntstatus_ok(tctx, dcerpc_lsa_EnumAccounts_r(lb, tctx, &r),
4794 "lsa_EnumAccounts failed");
4795 torture_assert_ntstatus_ok(tctx, r.out.result,
4796 "Failed to enum accounts");
4797
4798 for (i=0; i < lsa_sid_array.num_sids; i++) {
4799 if (dom_sid_equal(user_sid, lsa_sid_array.sids[i].sid)) {
4800 found_sid = true;
4801 }
4802 }
4803
4804 torture_assert(tctx, found_sid,
4805 "failed to list privileged account");
4806 }
4807
4808 {
4809 struct lsa_EnumAccountRights r;
4810 struct lsa_RightSet user_rights;
4811
4812 torture_comment(tctx, "Testing LSA EnumAccountRights\n");
4813
4814 r.in.handle = lsa_handle;
4815 r.in.sid = user_sid;
4816 r.out.rights = &user_rights;
4817
4818 torture_assert_ntstatus_ok(tctx, dcerpc_lsa_EnumAccountRights_r(lb, tctx, &r),
4819 "lsa_EnumAccountRights failed");
4820 torture_assert_ntstatus_ok(tctx, r.out.result,
4821 "Failed to enum rights for account");
4822
4823 if (user_rights.count < 1) {
4824 torture_result(tctx, TORTURE_FAIL, "failed to find newly added rights");
4825 return false;
4826 }
4827 }
4828
4829 {
4830 struct lsa_OpenAccount r;
4831
4832 torture_comment(tctx, "Testing LSA OpenAccount\n");
4833
4834 r.in.handle = lsa_handle;
4835 r.in.sid = user_sid;
4836 r.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
4837 r.out.acct_handle = &lsa_acct_handle;
4838
4839 torture_assert_ntstatus_ok(tctx, dcerpc_lsa_OpenAccount_r(lb, tctx, &r),
4840 "lsa_OpenAccount failed");
4841 torture_assert_ntstatus_ok(tctx, r.out.result,
4842 "Failed to open lsa account");
4843 }
4844
4845 {
4846 struct lsa_GetSystemAccessAccount r;
4847 uint32_t access_mask;
4848
4849 torture_comment(tctx, "Testing LSA GetSystemAccessAccount\n");
4850
4851 r.in.handle = &lsa_acct_handle;
4852 r.out.access_mask = &access_mask;
4853
4854 torture_assert_ntstatus_ok(tctx, dcerpc_lsa_GetSystemAccessAccount_r(lb, tctx, &r),
4855 "lsa_GetSystemAccessAccount failed");
4856 torture_assert_ntstatus_ok(tctx, r.out.result,
4857 "Failed to get lsa system access account");
4858 }
4859
4860 {
4861 struct lsa_Close r;
4862
4863 torture_comment(tctx, "Testing LSA Close\n");
4864
4865 r.in.handle = &lsa_acct_handle;
4866 r.out.handle = &lsa_acct_handle;
4867
4868 torture_assert_ntstatus_ok(tctx, dcerpc_lsa_Close_r(lb, tctx, &r),
4869 "lsa_Close failed");
4870 torture_assert_ntstatus_ok(tctx, r.out.result,
4871 "Failed to close lsa");
4872 }
4873
4874 {
4875 struct samr_DeleteUser r;
4876
4877 torture_comment(tctx, "Testing SAMR DeleteUser\n");
4878
4879 r.in.user_handle = user_handle;
4880 r.out.user_handle = user_handle;
4881
4882 torture_assert_ntstatus_ok(tctx, dcerpc_samr_DeleteUser_r(b, tctx, &r),
4883 "DeleteUser failed");
4884 torture_assert_ntstatus_ok(tctx, r.out.result,
4885 "DeleteUser failed");
4886 }
4887
4888 {
4889 struct lsa_EnumAccounts r;
4890 uint32_t resume_handle = 0;
4891 struct lsa_SidArray lsa_sid_array;
4892 int i;
4893 bool found_sid = false;
4894
4895 torture_comment(tctx, "Testing LSA EnumAccounts\n");
4896
4897 r.in.handle = lsa_handle;
4898 r.in.num_entries = 0x1000;
4899 r.in.resume_handle = &resume_handle;
4900 r.out.sids = &lsa_sid_array;
4901 r.out.resume_handle = &resume_handle;
4902
4903 torture_assert_ntstatus_ok(tctx, dcerpc_lsa_EnumAccounts_r(lb, tctx, &r),
4904 "lsa_EnumAccounts failed");
4905 torture_assert_ntstatus_ok(tctx, r.out.result,
4906 "Failed to enum accounts");
4907
4908 for (i=0; i < lsa_sid_array.num_sids; i++) {
4909 if (dom_sid_equal(user_sid, lsa_sid_array.sids[i].sid)) {
4910 found_sid = true;
4911 }
4912 }
4913
4914 torture_assert(tctx, found_sid,
4915 "failed to list privileged account");
4916 }
4917
4918 {
4919 struct lsa_EnumAccountRights r;
4920 struct lsa_RightSet user_rights;
4921
4922 torture_comment(tctx, "Testing LSA EnumAccountRights\n");
4923
4924 r.in.handle = lsa_handle;
4925 r.in.sid = user_sid;
4926 r.out.rights = &user_rights;
4927
4928 torture_assert_ntstatus_ok(tctx, dcerpc_lsa_EnumAccountRights_r(lb, tctx, &r),
4929 "lsa_EnumAccountRights failed");
4930 torture_assert_ntstatus_ok(tctx, r.out.result,
4931 "Failed to enum rights for account");
4932
4933 if (user_rights.count < 1) {
4934 torture_result(tctx, TORTURE_FAIL, "failed to find newly added rights");
4935 return false;
4936 }
4937 }
4938
4939 {
4940 struct lsa_OpenAccount r;
4941
4942 torture_comment(tctx, "Testing LSA OpenAccount\n");
4943
4944 r.in.handle = lsa_handle;
4945 r.in.sid = user_sid;
4946 r.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
4947 r.out.acct_handle = &lsa_acct_handle;
4948
4949 torture_assert_ntstatus_ok(tctx, dcerpc_lsa_OpenAccount_r(lb, tctx, &r),
4950 "lsa_OpenAccount failed");
4951 torture_assert_ntstatus_ok(tctx, r.out.result,
4952 "Failed to open lsa account");
4953 }
4954
4955 {
4956 struct lsa_GetSystemAccessAccount r;
4957 uint32_t access_mask;
4958
4959 torture_comment(tctx, "Testing LSA GetSystemAccessAccount\n");
4960
4961 r.in.handle = &lsa_acct_handle;
4962 r.out.access_mask = &access_mask;
4963
4964 torture_assert_ntstatus_ok(tctx, dcerpc_lsa_GetSystemAccessAccount_r(lb, tctx, &r),
4965 "lsa_GetSystemAccessAccount failed");
4966 torture_assert_ntstatus_ok(tctx, r.out.result,
4967 "Failed to get lsa system access account");
4968 }
4969
4970 {
4971 struct lsa_DeleteObject r;
4972
4973 torture_comment(tctx, "Testing LSA DeleteObject\n");
4974
4975 r.in.handle = &lsa_acct_handle;
4976 r.out.handle = &lsa_acct_handle;
4977
4978 torture_assert_ntstatus_ok(tctx, dcerpc_lsa_DeleteObject_r(lb, tctx, &r),
4979 "lsa_DeleteObject failed");
4980 torture_assert_ntstatus_ok(tctx, r.out.result,
4981 "Failed to delete object");
4982 }
4983
4984 {
4985 struct lsa_EnumAccounts r;
4986 uint32_t resume_handle = 0;
4987 struct lsa_SidArray lsa_sid_array;
4988 int i;
4989 bool found_sid = false;
4990
4991 torture_comment(tctx, "Testing LSA EnumAccounts\n");
4992
4993 r.in.handle = lsa_handle;
4994 r.in.num_entries = 0x1000;
4995 r.in.resume_handle = &resume_handle;
4996 r.out.sids = &lsa_sid_array;
4997 r.out.resume_handle = &resume_handle;
4998
4999 torture_assert_ntstatus_ok(tctx, dcerpc_lsa_EnumAccounts_r(lb, tctx, &r),
5000 "lsa_EnumAccounts failed");
5001 torture_assert_ntstatus_ok(tctx, r.out.result,
5002 "Failed to enum accounts");
5003
5004 for (i=0; i < lsa_sid_array.num_sids; i++) {
5005 if (dom_sid_equal(user_sid, lsa_sid_array.sids[i].sid)) {
5006 found_sid = true;
5007 }
5008 }
5009
5010 torture_assert(tctx, !found_sid,
5011 "should not have listed privileged account");
5012 }
5013
5014 {
5015 struct lsa_EnumAccountRights r;
5016 struct lsa_RightSet user_rights;
5017
5018 torture_comment(tctx, "Testing LSA EnumAccountRights\n");
5019
5020 r.in.handle = lsa_handle;
5021 r.in.sid = user_sid;
5022 r.out.rights = &user_rights;
5023
5024 torture_assert_ntstatus_ok(tctx, dcerpc_lsa_EnumAccountRights_r(lb, tctx, &r),
5025 "lsa_EnumAccountRights failed");
5026 torture_assert_ntstatus_equal(tctx, r.out.result, NT_STATUS_OBJECT_NAME_NOT_FOUND,
5027 "Failed to enum rights for account");
5028 }
5029
5030 return ret;
5031 }
5032
5033 static bool test_user_ops(struct dcerpc_pipe *p,
5034 struct torture_context *tctx,
5035 struct policy_handle *user_handle,
5036 struct policy_handle *domain_handle,
5037 const struct dom_sid *domain_sid,
5038 uint32_t base_acct_flags,
5039 const char *base_acct_name, enum torture_samr_choice which_ops,
5040 struct cli_credentials *machine_credentials)
5041 {
5042 char *password = NULL;
5043 struct samr_QueryUserInfo q;
5044 union samr_UserInfo *info;
5045 NTSTATUS status;
5046 struct dcerpc_binding_handle *b = p->binding_handle;
5047
5048 bool ret = true;
5049 int i;
5050 uint32_t rid;
5051 const uint32_t password_fields[] = {
5052 SAMR_FIELD_NT_PASSWORD_PRESENT,
5053 SAMR_FIELD_LM_PASSWORD_PRESENT,
5054 SAMR_FIELD_NT_PASSWORD_PRESENT | SAMR_FIELD_LM_PASSWORD_PRESENT,
5055 0
5056 };
5057
5058 status = test_LookupName(b, tctx, domain_handle, base_acct_name, &rid);
5059 if (!NT_STATUS_IS_OK(status)) {
5060 ret = false;
5061 }
5062
5063 switch (which_ops) {
5064 case TORTURE_SAMR_USER_ATTRIBUTES:
5065 if (!test_QuerySecurity(b, tctx, user_handle)) {
5066 ret = false;
5067 }
5068
5069 if (!test_QueryUserInfo(b, tctx, user_handle)) {
5070 ret = false;
5071 }
5072
5073 if (!test_QueryUserInfo2(b, tctx, user_handle)) {
5074 ret = false;
5075 }
5076
5077 if (!test_SetUserInfo(b, tctx, user_handle, base_acct_flags,
5078 base_acct_name)) {
5079 ret = false;
5080 }
5081
5082 if (!test_GetUserPwInfo(b, tctx, user_handle)) {
5083 ret = false;
5084 }
5085
5086 if (!test_TestPrivateFunctionsUser(b, tctx, user_handle)) {
5087 ret = false;
5088 }
5089
5090 if (!test_SetUserPass(p, tctx, user_handle, &password)) {
5091 ret = false;
5092 }
5093 break;
5094 case TORTURE_SAMR_PASSWORDS:
5095 if (base_acct_flags & (ACB_WSTRUST|ACB_DOMTRUST|ACB_SVRTRUST)) {
5096 char simple_pass[9];
5097 char *v = generate_random_str(tctx, 1);
5098
5099 ZERO_STRUCT(simple_pass);
5100 memset(simple_pass, *v, sizeof(simple_pass) - 1);
5101
5102 torture_comment(tctx, "Testing machine account password policy rules\n");
5103
5104 /* Workstation trust accounts don't seem to need to honour password quality policy */
5105 if (!test_SetUserPassEx(p, tctx, user_handle, true, &password)) {
5106 ret = false;
5107 }
5108
5109 if (!test_ChangePasswordUser2(p, tctx, base_acct_name, &password, simple_pass, false)) {
5110 ret = false;
5111 }
5112
5113 /* reset again, to allow another 'user' password change */
5114 if (!test_SetUserPassEx(p, tctx, user_handle, true, &password)) {
5115 ret = false;
5116 }
5117
5118 /* Try a 'short' password */
5119 if (!test_ChangePasswordUser2(p, tctx, base_acct_name, &password, samr_rand_pass(tctx, 4), false)) {
5120 ret = false;
5121 }
5122
5123 /* Try a compleatly random password */
5124 if (!test_ChangePasswordRandomBytes(p, tctx, base_acct_name, user_handle, &password)) {
5125 ret = false;
5126 }
5127 }
5128
5129 for (i = 0; password_fields[i]; i++) {
5130 if (!test_SetUserPass_23(p, tctx, user_handle, password_fields[i], &password)) {
5131 ret = false;
5132 }
5133
5134 /* check it was set right */
5135 if (!test_ChangePasswordUser3(p, tctx, base_acct_name, 0, &password, NULL, 0, false)) {
5136 ret = false;
5137 }
5138 }
5139
5140 for (i = 0; password_fields[i]; i++) {
5141 if (!test_SetUserPass_25(p, tctx, user_handle, password_fields[i], &password)) {
5142 ret = false;
5143 }
5144
5145 /* check it was set right */
5146 if (!test_ChangePasswordUser3(p, tctx, base_acct_name, 0, &password, NULL, 0, false)) {
5147 ret = false;
5148 }
5149 }
5150
5151 if (!test_SetUserPassEx(p, tctx, user_handle, false, &password)) {
5152 ret = false;
5153 }
5154
5155 if (!test_ChangePassword(p, tctx, base_acct_name, domain_handle, &password)) {
5156 ret = false;
5157 }
5158
5159 if (!test_SetUserPass_18(p, tctx, user_handle, &password)) {
5160 ret = false;
5161 }
5162
5163 if (!test_ChangePasswordUser3(p, tctx, base_acct_name, 0, &password, NULL, 0, false)) {
5164 ret = false;
5165 }
5166
5167 for (i = 0; password_fields[i]; i++) {
5168
5169 if (password_fields[i] == SAMR_FIELD_LM_PASSWORD_PRESENT) {
5170 /* we need to skip as that would break
5171 * the ChangePasswordUser3 verify */
5172 continue;
5173 }
5174
5175 if (!test_SetUserPass_21(p, tctx, user_handle, password_fields[i], &password)) {
5176 ret = false;
5177 }
5178
5179 /* check it was set right */
5180 if (!test_ChangePasswordUser3(p, tctx, base_acct_name, 0, &password, NULL, 0, false)) {
5181 ret = false;
5182 }
5183 }
5184
5185 q.in.user_handle = user_handle;
5186 q.in.level = 5;
5187 q.out.info = &info;
5188
5189 torture_assert_ntstatus_ok(tctx, dcerpc_samr_QueryUserInfo_r(b, tctx, &q),
5190 "QueryUserInfo failed");
5191 if (!NT_STATUS_IS_OK(q.out.result)) {
5192 torture_result(tctx, TORTURE_FAIL, "QueryUserInfo level %u failed - %s\n",
5193 q.in.level, nt_errstr(q.out.result));
5194 ret = false;
5195 } else {
5196 uint32_t expected_flags = (base_acct_flags | ACB_PWNOTREQ | ACB_DISABLED);
5197 if ((info->info5.acct_flags) != expected_flags) {
5198 /* FIXME: GD */
5199 if (!torture_setting_bool(tctx, "samba3", false)) {
5200 torture_result(tctx, TORTURE_FAIL, "QueryUserInfo level 5 failed, it returned 0x%08x when we expected flags of 0x%08x\n",
5201 info->info5.acct_flags,
5202 expected_flags);
5203 ret = false;
5204 }
5205 }
5206 if (info->info5.rid != rid) {
5207 torture_result(tctx, TORTURE_FAIL, "QueryUserInfo level 5 failed, it returned %u when we expected rid of %u\n",
5208 info->info5.rid, rid);
5209
5210 }
5211 }
5212
5213 break;
5214
5215 case TORTURE_SAMR_PASSWORDS_PWDLASTSET:
5216
5217 /* test last password change timestamp behaviour */
5218 torture_assert(tctx, test_SetPassword_pwdlastset(p, tctx, base_acct_flags,
5219 base_acct_name,
5220 user_handle, &password,
5221 machine_credentials),
5222 "pwdLastSet test failed\n");
5223 break;
5224
5225 case TORTURE_SAMR_PASSWORDS_BADPWDCOUNT:
5226
5227 /* test bad pwd count change behaviour */
5228 torture_assert(tctx, test_Password_badpwdcount_wrap(p, tctx, base_acct_flags,
5229 base_acct_name,
5230 domain_handle,
5231 user_handle, &password,
5232 machine_credentials),
5233 "badPwdCount test failed\n");
5234 break;
5235
5236 case TORTURE_SAMR_PASSWORDS_LOCKOUT:
5237
5238 torture_assert(tctx, test_Password_lockout_wrap(p, tctx, base_acct_flags,
5239 base_acct_name,
5240 domain_handle,
5241 user_handle, &password,
5242 machine_credentials),
5243 "Lockout test failed");
5244 break;
5245
5246
5247 case TORTURE_SAMR_USER_PRIVILEGES: {
5248
5249 struct dcerpc_pipe *lp;
5250 struct policy_handle *lsa_handle;
5251 struct dcerpc_binding_handle *lb;
5252
5253 status = torture_rpc_connection(tctx, &lp, &ndr_table_lsarpc);
5254 torture_assert_ntstatus_ok(tctx, status, "Failed to open LSA pipe");
5255 lb = lp->binding_handle;
5256
5257 if (!test_lsa_OpenPolicy2(lb, tctx, &lsa_handle)) {
5258 ret = false;
5259 }
5260
5261 if (!test_DeleteUser_with_privs(p, lp, tctx,
5262 domain_handle, lsa_handle, user_handle,
5263 domain_sid, rid,
5264 machine_credentials)) {
5265 ret = false;
5266 }
5267
5268 if (!test_lsa_Close(lb, tctx, lsa_handle)) {
5269 ret = false;
5270 }
5271
5272 if (!ret) {
5273 torture_result(tctx, TORTURE_FAIL, "privileged user delete test failed\n");
5274 }
5275
5276 break;
5277 }
5278 case TORTURE_SAMR_OTHER:
5279 case TORTURE_SAMR_MANY_ACCOUNTS:
5280 case TORTURE_SAMR_MANY_GROUPS:
5281 case TORTURE_SAMR_MANY_ALIASES:
5282 /* We just need the account to exist */
5283 break;
5284 }
5285 return ret;
5286 }
5287
5288 static bool test_alias_ops(struct dcerpc_binding_handle *b,
5289 struct torture_context *tctx,
5290 struct policy_handle *alias_handle,
5291 const struct dom_sid *domain_sid)
5292 {
5293 bool ret = true;
5294
5295 if (!torture_setting_bool(tctx, "samba3", false)) {
5296 if (!test_QuerySecurity(b, tctx, alias_handle)) {
5297 ret = false;
5298 }
5299 }
5300
5301 if (!test_QueryAliasInfo(b, tctx, alias_handle)) {
5302 ret = false;
5303 }
5304
5305 if (!test_SetAliasInfo(b, tctx, alias_handle)) {
5306 ret = false;
5307 }
5308
5309 if (!test_AddMemberToAlias(b, tctx, alias_handle, domain_sid)) {
5310 ret = false;
5311 }
5312
5313 if (torture_setting_bool(tctx, "samba3", false) ||
5314 torture_setting_bool(tctx, "samba4", false)) {
5315 torture_comment(tctx, "skipping MultipleMembers Alias tests against Samba\n");
5316 return ret;
5317 }
5318
5319 if (!test_AddMultipleMembersToAlias(b, tctx, alias_handle)) {
5320 ret = false;
5321 }
5322
5323 return ret;
5324 }
5325
5326
5327 static bool test_DeleteUser(struct dcerpc_binding_handle *b,
5328 struct torture_context *tctx,
5329 struct policy_handle *user_handle)
5330 {
5331 struct samr_DeleteUser d;
5332 torture_comment(tctx, "Testing DeleteUser\n");
5333
5334 d.in.user_handle = user_handle;
5335 d.out.user_handle = user_handle;
5336
5337 torture_assert_ntstatus_ok(tctx, dcerpc_samr_DeleteUser_r(b, tctx, &d),
5338 "DeleteUser failed");
5339 torture_assert_ntstatus_ok(tctx, d.out.result, "DeleteUser");
5340
5341 return true;
5342 }
5343
5344 bool test_DeleteUser_byname(struct dcerpc_binding_handle *b,
5345 struct torture_context *tctx,
5346 struct policy_handle *handle, const char *name)
5347 {
5348 NTSTATUS status;
5349 struct samr_DeleteUser d;
5350 struct policy_handle user_handle;
5351 uint32_t rid;
5352
5353 status = test_LookupName(b, tctx, handle, name, &rid);
5354 if (!NT_STATUS_IS_OK(status)) {
5355 goto failed;
5356 }
5357
5358 status = test_OpenUser_byname(b, tctx, handle, name, &user_handle);
5359 if (!NT_STATUS_IS_OK(status)) {
5360 goto failed;
5361 }
5362
5363 d.in.user_handle = &user_handle;
5364 d.out.user_handle = &user_handle;
5365 torture_assert_ntstatus_ok(tctx, dcerpc_samr_DeleteUser_r(b, tctx, &d),
5366 "DeleteUser failed");
5367 if (!NT_STATUS_IS_OK(d.out.result)) {
5368 status = d.out.result;
5369 goto failed;
5370 }
5371
5372 return true;
5373
5374 failed:
5375 torture_result(tctx, TORTURE_FAIL, "DeleteUser_byname(%s) failed - %s\n", name, nt_errstr(status));
5376 return false;
5377 }
5378
5379
5380 static bool test_DeleteGroup_byname(struct dcerpc_binding_handle *b,
5381 struct torture_context *tctx,
5382 struct policy_handle *handle, const char *name)
5383 {
5384 NTSTATUS status;
5385 struct samr_OpenGroup r;
5386 struct samr_DeleteDomainGroup d;
5387 struct policy_handle group_handle;
5388 uint32_t rid;
5389
5390 status = test_LookupName(b, tctx, handle, name, &rid);
5391 if (!NT_STATUS_IS_OK(status)) {
5392 goto failed;
5393 }
5394
5395 r.in.domain_handle = handle;
5396 r.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
5397 r.in.rid = rid;
5398 r.out.group_handle = &group_handle;
5399 torture_assert_ntstatus_ok(tctx, dcerpc_samr_OpenGroup_r(b, tctx, &r),
5400 "OpenGroup failed");
5401 if (!NT_STATUS_IS_OK(r.out.result)) {
5402 status = r.out.result;
5403 goto failed;
5404 }
5405
5406 d.in.group_handle = &group_handle;
5407 d.out.group_handle = &group_handle;
5408 torture_assert_ntstatus_ok(tctx, dcerpc_samr_DeleteDomainGroup_r(b, tctx, &d),
5409 "DeleteDomainGroup failed");
5410 if (!NT_STATUS_IS_OK(d.out.result)) {
5411 status = d.out.result;
5412 goto failed;
5413 }
5414
5415 return true;
5416
5417 failed:
5418 torture_result(tctx, TORTURE_FAIL, "DeleteGroup_byname(%s) failed - %s\n", name, nt_errstr(status));
5419 return false;
5420 }
5421
5422
5423 static bool test_DeleteAlias_byname(struct dcerpc_binding_handle *b,
5424 struct torture_context *tctx,
5425 struct policy_handle *domain_handle,
5426 const char *name)
5427 {
5428 NTSTATUS status;
5429 struct samr_OpenAlias r;
5430 struct samr_DeleteDomAlias d;
5431 struct policy_handle alias_handle;
5432 uint32_t rid;
5433
5434 torture_comment(tctx, "Testing DeleteAlias_byname\n");
5435
5436 status = test_LookupName(b, tctx, domain_handle, name, &rid);
5437 if (!NT_STATUS_IS_OK(status)) {
5438 goto failed;
5439 }
5440
5441 r.in.domain_handle = domain_handle;
5442 r.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
5443 r.in.rid = rid;
5444 r.out.alias_handle = &alias_handle;
5445 torture_assert_ntstatus_ok(tctx, dcerpc_samr_OpenAlias_r(b, tctx, &r),
5446 "OpenAlias failed");
5447 if (!NT_STATUS_IS_OK(r.out.result)) {
5448 status = r.out.result;
5449 goto failed;
5450 }
5451
5452 d.in.alias_handle = &alias_handle;
5453 d.out.alias_handle = &alias_handle;
5454 torture_assert_ntstatus_ok(tctx, dcerpc_samr_DeleteDomAlias_r(b, tctx, &d),
5455 "DeleteDomAlias failed");
5456 if (!NT_STATUS_IS_OK(d.out.result)) {
5457 status = d.out.result;
5458 goto failed;
5459 }
5460
5461 return true;
5462
5463 failed:
5464 torture_result(tctx, TORTURE_FAIL, "DeleteAlias_byname(%s) failed - %s\n", name, nt_errstr(status));
5465 return false;
5466 }
5467
5468 static bool test_DeleteAlias(struct dcerpc_binding_handle *b,
5469 struct torture_context *tctx,
5470 struct policy_handle *alias_handle)
5471 {
5472 struct samr_DeleteDomAlias d;
5473 bool ret = true;
5474
5475 torture_comment(tctx, "Testing DeleteAlias\n");
5476
5477 d.in.alias_handle = alias_handle;
5478 d.out.alias_handle = alias_handle;
5479
5480 torture_assert_ntstatus_ok(tctx, dcerpc_samr_DeleteDomAlias_r(b, tctx, &d),
5481 "DeleteDomAlias failed");
5482 if (!NT_STATUS_IS_OK(d.out.result)) {
5483 torture_result(tctx, TORTURE_FAIL, "DeleteAlias failed - %s\n", nt_errstr(d.out.result));
5484 ret = false;
5485 }
5486
5487 return ret;
5488 }
5489
5490 static bool test_CreateAlias(struct dcerpc_binding_handle *b,
5491 struct torture_context *tctx,
5492 struct policy_handle *domain_handle,
5493 const char *alias_name,
5494 struct policy_handle *alias_handle,
5495 const struct dom_sid *domain_sid,
5496 bool test_alias)
5497 {
5498 struct samr_CreateDomAlias r;
5499 struct lsa_String name;
5500 uint32_t rid;
5501 bool ret = true;
5502
5503 init_lsa_String(&name, alias_name);
5504 r.in.domain_handle = domain_handle;
5505 r.in.alias_name = &name;
5506 r.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
5507 r.out.alias_handle = alias_handle;
5508 r.out.rid = &rid;
5509
5510 torture_comment(tctx, "Testing CreateAlias (%s)\n", r.in.alias_name->string);
5511
5512 torture_assert_ntstatus_ok(tctx, dcerpc_samr_CreateDomAlias_r(b, tctx, &r),
5513 "CreateDomAlias failed");
5514
5515 if (dom_sid_equal(domain_sid, dom_sid_parse_talloc(tctx, SID_BUILTIN))) {
5516 if (NT_STATUS_EQUAL(r.out.result, NT_STATUS_ACCESS_DENIED)) {
5517 torture_comment(tctx, "Server correctly refused create of '%s'\n", r.in.alias_name->string);
5518 return true;
5519 } else {
5520 torture_result(tctx, TORTURE_FAIL, "Server should have refused create of '%s', got %s instead\n", r.in.alias_name->string,
5521 nt_errstr(r.out.result));
5522 return false;
5523 }
5524 }
5525
5526 if (NT_STATUS_EQUAL(r.out.result, NT_STATUS_ALIAS_EXISTS)) {
5527 if (!test_DeleteAlias_byname(b, tctx, domain_handle, r.in.alias_name->string)) {
5528 return false;
5529 }
5530 torture_assert_ntstatus_ok(tctx, dcerpc_samr_CreateDomAlias_r(b, tctx, &r),
5531 "CreateDomAlias failed");
5532 }
5533
5534 if (!NT_STATUS_IS_OK(r.out.result)) {
5535 torture_result(tctx, TORTURE_FAIL, "CreateAlias failed - %s\n", nt_errstr(r.out.result));
5536 return false;
5537 }
5538
5539 if (!test_alias) {
5540 return ret;
5541 }
5542
5543 if (!test_alias_ops(b, tctx, alias_handle, domain_sid)) {
5544 ret = false;
5545 }
5546
5547 return ret;
5548 }
5549
5550 static bool test_ChangePassword(struct dcerpc_pipe *p,
5551 struct torture_context *tctx,
5552 const char *acct_name,
5553 struct policy_handle *domain_handle, char **password)
5554 {
5555 bool ret = true;
5556 struct dcerpc_binding_handle *b = p->binding_handle;
5557
5558 if (!*password) {
5559 return false;
5560 }
5561
5562 if (!test_ChangePasswordUser(b, tctx, acct_name, domain_handle, password)) {
5563 ret = false;
5564 }
5565
5566 if (!test_ChangePasswordUser2(p, tctx, acct_name, password, 0, true)) {
5567 ret = false;
5568 }
5569
5570 if (!test_OemChangePasswordUser2(p, tctx, acct_name, domain_handle, password)) {
5571 ret = false;
5572 }
5573
5574 /* test what happens when setting the old password again */
5575 if (!test_ChangePasswordUser3(p, tctx, acct_name, 0, password, *password, 0, true)) {
5576 ret = false;
5577 }
5578
5579 {
5580 char simple_pass[9];
5581 char *v = generate_random_str(tctx, 1);
5582
5583 ZERO_STRUCT(simple_pass);
5584 memset(simple_pass, *v, sizeof(simple_pass) - 1);
5585
5586 /* test what happens when picking a simple password */
5587 if (!test_ChangePasswordUser3(p, tctx, acct_name, 0, password, simple_pass, 0, true)) {
5588 ret = false;
5589 }
5590 }
5591
5592 /* set samr_SetDomainInfo level 1 with min_length 5 */
5593 {
5594 struct samr_QueryDomainInfo r;
5595 union samr_DomainInfo *info = NULL;
5596 struct samr_SetDomainInfo s;
5597 uint16_t len_old, len;
5598 uint32_t pwd_prop_old;
5599 int64_t min_pwd_age_old;
5600
5601 len = 5;
5602
5603 r.in.domain_handle = domain_handle;
5604 r.in.level = 1;
5605 r.out.info = &info;
5606
5607 torture_comment(tctx, "Testing samr_QueryDomainInfo level 1\n");
5608 torture_assert_ntstatus_ok(tctx, dcerpc_samr_QueryDomainInfo_r(b, tctx, &r),
5609 "QueryDomainInfo failed");
5610 if (!NT_STATUS_IS_OK(r.out.result)) {
5611 return false;
5612 }
5613
5614 s.in.domain_handle = domain_handle;
5615 s.in.level = 1;
5616 s.in.info = info;
5617
5618 /* remember the old min length, so we can reset it */
5619 len_old = s.in.info->info1.min_password_length;
5620 s.in.info->info1.min_password_length = len;
5621 pwd_prop_old = s.in.info->info1.password_properties;
5622 /* turn off password complexity checks for this test */
5623 s.in.info->info1.password_properties &= ~DOMAIN_PASSWORD_COMPLEX;
5624
5625 min_pwd_age_old = s.in.info->info1.min_password_age;
5626 s.in.info->info1.min_password_age = 0;
5627
5628 torture_comment(tctx, "Testing samr_SetDomainInfo level 1\n");
5629 torture_assert_ntstatus_ok(tctx, dcerpc_samr_SetDomainInfo_r(b, tctx, &s),
5630 "SetDomainInfo failed");
5631 if (!NT_STATUS_IS_OK(s.out.result)) {
5632 return false;
5633 }
5634
5635 torture_comment(tctx, "calling test_ChangePasswordUser3 with too short password\n");
5636
5637 if (!test_ChangePasswordUser3(p, tctx, acct_name, len - 1, password, NULL, 0, true)) {
5638 ret = false;
5639 }
5640
5641 s.in.info->info1.min_password_length = len_old;
5642 s.in.info->info1.password_properties = pwd_prop_old;
5643 s.in.info->info1.min_password_age = min_pwd_age_old;
5644
5645 torture_comment(tctx, "Testing samr_SetDomainInfo level 1\n");
5646 torture_assert_ntstatus_ok(tctx, dcerpc_samr_SetDomainInfo_r(b, tctx, &s),
5647 "SetDomainInfo failed");
5648 if (!NT_STATUS_IS_OK(s.out.result)) {
5649 return false;
5650 }
5651
5652 }
5653
5654 {
5655 struct samr_OpenUser r;
5656 struct samr_QueryUserInfo q;
5657 union samr_UserInfo *info;
5658 struct samr_LookupNames n;
5659 struct policy_handle user_handle;
5660 struct samr_Ids rids, types;
5661
5662 n.in.domain_handle = domain_handle;
5663 n.in.num_names = 1;
5664 n.in.names = talloc_array(tctx, struct lsa_String, 1);
5665 n.in.names[0].string = acct_name;
5666 n.out.rids = &rids;
5667 n.out.types = &types;
5668
5669 torture_assert_ntstatus_ok(tctx, dcerpc_samr_LookupNames_r(b, tctx, &n),
5670 "LookupNames failed");
5671 if (!NT_STATUS_IS_OK(n.out.result)) {
5672 torture_result(tctx, TORTURE_FAIL, "LookupNames failed - %s\n", nt_errstr(n.out.result));
5673 return false;
5674 }
5675
5676 r.in.domain_handle = domain_handle;
5677 r.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
5678 r.in.rid = n.out.rids->ids[0];
5679 r.out.user_handle = &user_handle;
5680
5681 torture_assert_ntstatus_ok(tctx, dcerpc_samr_OpenUser_r(b, tctx, &r),
5682 "OpenUser failed");
5683 if (!NT_STATUS_IS_OK(r.out.result)) {
5684 torture_result(tctx, TORTURE_FAIL, "OpenUser(%u) failed - %s\n", n.out.rids->ids[0], nt_errstr(r.out.result));
5685 return false;
5686 }
5687
5688 q.in.user_handle = &user_handle;
5689 q.in.level = 5;
5690 q.out.info = &info;
5691
5692 torture_assert_ntstatus_ok(tctx, dcerpc_samr_QueryUserInfo_r(b, tctx, &q),
5693 "QueryUserInfo failed");
5694 if (!NT_STATUS_IS_OK(q.out.result)) {
5695 torture_result(tctx, TORTURE_FAIL, "QueryUserInfo failed - %s\n", nt_errstr(q.out.result));
5696 return false;
5697 }
5698
5699 torture_comment(tctx, "calling test_ChangePasswordUser3 with too early password change\n");
5700
5701 if (!test_ChangePasswordUser3(p, tctx, acct_name, 0, password, NULL,
5702 info->info5.last_password_change, true)) {
5703 ret = false;
5704 }
5705 }
5706
5707 /* we change passwords twice - this has the effect of verifying
5708 they were changed correctly for the final call */
5709 if (!test_ChangePasswordUser3(p, tctx, acct_name, 0, password, NULL, 0, true)) {
5710 ret = false;
5711 }
5712
5713 if (!test_ChangePasswordUser3(p, tctx, acct_name, 0, password, NULL, 0, true)) {
5714 ret = false;
5715 }
5716
5717 return ret;
5718 }
5719
5720 static bool test_CreateUser(struct dcerpc_pipe *p, struct torture_context *tctx,
5721 struct policy_handle *domain_handle,
5722 const char *user_name,
5723 struct policy_handle *user_handle_out,
5724 struct dom_sid *domain_sid,
5725 enum torture_samr_choice which_ops,
5726 struct cli_credentials *machine_credentials,
5727 bool test_user)
5728 {
5729
5730 TALLOC_CTX *user_ctx;
5731
5732 struct samr_CreateUser r;
5733 struct samr_QueryUserInfo q;
5734 union samr_UserInfo *info;
5735 struct samr_DeleteUser d;
5736 uint32_t rid;
5737
5738 /* This call creates a 'normal' account - check that it really does */
5739 const uint32_t acct_flags = ACB_NORMAL;
5740 struct lsa_String name;
5741 bool ret = true;
5742 struct dcerpc_binding_handle *b = p->binding_handle;
5743
5744 struct policy_handle user_handle;
5745 user_ctx = talloc_named(tctx, 0, "test_CreateUser2 per-user context");
5746 init_lsa_String(&name, user_name);
5747
5748 r.in.domain_handle = domain_handle;
5749 r.in.account_name = &name;
5750 r.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
5751 r.out.user_handle = &user_handle;
5752 r.out.rid = &rid;
5753
5754 torture_comment(tctx, "Testing CreateUser(%s)\n", r.in.account_name->string);
5755
5756 torture_assert_ntstatus_ok(tctx, dcerpc_samr_CreateUser_r(b, user_ctx, &r),
5757 "CreateUser failed");
5758
5759 if (dom_sid_equal(domain_sid, dom_sid_parse_talloc(tctx, SID_BUILTIN))) {
5760 if (NT_STATUS_EQUAL(r.out.result, NT_STATUS_ACCESS_DENIED) || NT_STATUS_EQUAL(r.out.result, NT_STATUS_INVALID_PARAMETER)) {
5761 torture_comment(tctx, "Server correctly refused create of '%s'\n", r.in.account_name->string);
5762 return true;
5763 } else {
5764 torture_result(tctx, TORTURE_FAIL, "Server should have refused create of '%s', got %s instead\n", r.in.account_name->string,
5765 nt_errstr(r.out.result));
5766 return false;
5767 }
5768 }
5769
5770 if (NT_STATUS_EQUAL(r.out.result, NT_STATUS_USER_EXISTS)) {
5771 if (!test_DeleteUser_byname(b, tctx, domain_handle, r.in.account_name->string)) {
5772 talloc_free(user_ctx);
5773 return false;
5774 }
5775 torture_assert_ntstatus_ok(tctx, dcerpc_samr_CreateUser_r(b, user_ctx, &r),
5776 "CreateUser failed");
5777 }
5778
5779 if (!NT_STATUS_IS_OK(r.out.result)) {
5780 talloc_free(user_ctx);
5781 torture_result(tctx, TORTURE_FAIL, "CreateUser failed - %s\n", nt_errstr(r.out.result));
5782 return false;
5783 }
5784
5785 if (!test_user) {
5786 if (user_handle_out) {
5787 *user_handle_out = user_handle;
5788 }
5789 return ret;
5790 }
5791
5792 {
5793 q.in.user_handle = &user_handle;
5794 q.in.level = 16;
5795 q.out.info = &info;
5796
5797 torture_assert_ntstatus_ok(tctx, dcerpc_samr_QueryUserInfo_r(b, user_ctx, &q),
5798 "QueryUserInfo failed");
5799 if (!NT_STATUS_IS_OK(q.out.result)) {
5800 torture_result(tctx, TORTURE_FAIL, "QueryUserInfo level %u failed - %s\n",
5801 q.in.level, nt_errstr(q.out.result));
5802 ret = false;
5803 } else {
5804 if ((info->info16.acct_flags & acct_flags) != acct_flags) {
5805 torture_result(tctx, TORTURE_FAIL, "QueryUserInfo level 16 failed, it returned 0x%08x when we expected flags of 0x%08x\n",
5806 info->info16.acct_flags,
5807 acct_flags);
5808 ret = false;
5809 }
5810 }
5811
5812 if (!test_user_ops(p, tctx, &user_handle, domain_handle,
5813 domain_sid, acct_flags, name.string, which_ops,
5814 machine_credentials)) {
5815 ret = false;
5816 }
5817
5818 if (user_handle_out) {
5819 *user_handle_out = user_handle;
5820 } else {
5821 torture_comment(tctx, "Testing DeleteUser (createuser test)\n");
5822
5823 d.in.user_handle = &user_handle;
5824 d.out.user_handle = &user_handle;
5825
5826 torture_assert_ntstatus_ok(tctx, dcerpc_samr_DeleteUser_r(b, user_ctx, &d),
5827 "DeleteUser failed");
5828 if (!NT_STATUS_IS_OK(d.out.result)) {
5829 torture_result(tctx, TORTURE_FAIL, "DeleteUser failed - %s\n", nt_errstr(d.out.result));
5830 ret = false;
5831 }
5832 }
5833
5834 }
5835
5836 talloc_free(user_ctx);
5837
5838 return ret;
5839 }
5840
5841
5842 static bool test_CreateUser2(struct dcerpc_pipe *p, struct torture_context *tctx,
5843 struct policy_handle *domain_handle,
5844 struct dom_sid *domain_sid,
5845 enum torture_samr_choice which_ops,
5846 struct cli_credentials *machine_credentials)
5847 {
5848 struct samr_CreateUser2 r;
5849 struct samr_QueryUserInfo q;
5850 union samr_UserInfo *info;
5851 struct samr_DeleteUser d;
5852 struct policy_handle user_handle;
5853 uint32_t rid;
5854 struct lsa_String name;
5855 bool ret = true;
5856 int i;
5857 struct dcerpc_binding_handle *b = p->binding_handle;
5858
5859 struct {
5860 uint32_t acct_flags;
5861 const char *account_name;
5862 NTSTATUS nt_status;
5863 } account_types[] = {
5864 { ACB_NORMAL, TEST_ACCOUNT_NAME, NT_STATUS_OK },
5865 { ACB_NORMAL | ACB_DISABLED, TEST_ACCOUNT_NAME, NT_STATUS_INVALID_PARAMETER },
5866 { ACB_NORMAL | ACB_PWNOEXP, TEST_ACCOUNT_NAME, NT_STATUS_INVALID_PARAMETER },
5867 { ACB_WSTRUST, TEST_MACHINENAME, NT_STATUS_OK },
5868 { ACB_WSTRUST | ACB_DISABLED, TEST_MACHINENAME, NT_STATUS_INVALID_PARAMETER },
5869 { ACB_WSTRUST | ACB_PWNOEXP, TEST_MACHINENAME, NT_STATUS_INVALID_PARAMETER },
5870 { ACB_SVRTRUST, TEST_MACHINENAME, NT_STATUS_OK },
5871 { ACB_SVRTRUST | ACB_DISABLED, TEST_MACHINENAME, NT_STATUS_INVALID_PARAMETER },
5872 { ACB_SVRTRUST | ACB_PWNOEXP, TEST_MACHINENAME, NT_STATUS_INVALID_PARAMETER },
5873 { ACB_DOMTRUST, TEST_DOMAINNAME, NT_STATUS_ACCESS_DENIED },
5874 { ACB_DOMTRUST | ACB_DISABLED, TEST_DOMAINNAME, NT_STATUS_INVALID_PARAMETER },
5875 { ACB_DOMTRUST | ACB_PWNOEXP, TEST_DOMAINNAME, NT_STATUS_INVALID_PARAMETER },
5876 { 0, TEST_ACCOUNT_NAME, NT_STATUS_INVALID_PARAMETER },
5877 { ACB_DISABLED, TEST_ACCOUNT_NAME, NT_STATUS_INVALID_PARAMETER },
5878 { 0, NULL, NT_STATUS_INVALID_PARAMETER }
5879 };
5880
5881 for (i = 0; account_types[i].account_name; i++) {
5882 TALLOC_CTX *user_ctx;
5883 uint32_t acct_flags = account_types[i].acct_flags;
5884 uint32_t access_granted;
5885 user_ctx = talloc_named(tctx, 0, "test_CreateUser2 per-user context");
5886 init_lsa_String(&name, account_types[i].account_name);
5887
5888 r.in.domain_handle = domain_handle;
5889 r.in.account_name = &name;
5890 r.in.acct_flags = acct_flags;
5891 r.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
5892 r.out.user_handle = &user_handle;
5893 r.out.access_granted = &access_granted;
5894 r.out.rid = &rid;
5895
5896 torture_comment(tctx, "Testing CreateUser2(%s, 0x%x)\n", r.in.account_name->string, acct_flags);
5897
5898 torture_assert_ntstatus_ok(tctx, dcerpc_samr_CreateUser2_r(b, user_ctx, &r),
5899 "CreateUser2 failed");
5900
5901 if (dom_sid_equal(domain_sid, dom_sid_parse_talloc(tctx, SID_BUILTIN))) {
5902 if (NT_STATUS_EQUAL(r.out.result, NT_STATUS_ACCESS_DENIED) || NT_STATUS_EQUAL(r.out.result, NT_STATUS_INVALID_PARAMETER)) {
5903 torture_comment(tctx, "Server correctly refused create of '%s'\n", r.in.account_name->string);
5904 continue;
5905 } else {
5906 torture_result(tctx, TORTURE_FAIL, "Server should have refused create of '%s', got %s instead\n", r.in.account_name->string,
5907 nt_errstr(r.out.result));
5908 ret = false;
5909 continue;
5910 }
5911 }
5912
5913 if (NT_STATUS_EQUAL(r.out.result, NT_STATUS_USER_EXISTS)) {
5914 if (!test_DeleteUser_byname(b, tctx, domain_handle, r.in.account_name->string)) {
5915 talloc_free(user_ctx);
5916 ret = false;
5917 continue;
5918 }
5919 torture_assert_ntstatus_ok(tctx, dcerpc_samr_CreateUser2_r(b, user_ctx, &r),
5920 "CreateUser2 failed");
5921
5922 }
5923 if (!NT_STATUS_EQUAL(r.out.result, account_types[i].nt_status)) {
5924 torture_result(tctx, TORTURE_FAIL, "CreateUser2 failed gave incorrect error return - %s (should be %s)\n",
5925 nt_errstr(r.out.result), nt_errstr(account_types[i].nt_status));
5926 ret = false;
5927 }
5928
5929 if (NT_STATUS_IS_OK(r.out.result)) {
5930 q.in.user_handle = &user_handle;
5931 q.in.level = 5;
5932 q.out.info = &info;
5933
5934 torture_assert_ntstatus_ok(tctx, dcerpc_samr_QueryUserInfo_r(b, user_ctx, &q),
5935 "QueryUserInfo failed");
5936 if (!NT_STATUS_IS_OK(q.out.result)) {
5937 torture_result(tctx, TORTURE_FAIL, "QueryUserInfo level %u failed - %s\n",
5938 q.in.level, nt_errstr(q.out.result));
5939 ret = false;
5940 } else {
5941 uint32_t expected_flags = (acct_flags | ACB_PWNOTREQ | ACB_DISABLED);
5942 if (acct_flags == ACB_NORMAL) {
5943 expected_flags |= ACB_PW_EXPIRED;
5944 }
5945 if ((info->info5.acct_flags) != expected_flags) {
5946 torture_result(tctx, TORTURE_FAIL, "QueryUserInfo level 5 failed, it returned 0x%08x when we expected flags of 0x%08x\n",
5947 info->info5.acct_flags,
5948 expected_flags);
5949 ret = false;
5950 }
5951 switch (acct_flags) {
5952 case ACB_SVRTRUST:
5953 if (info->info5.primary_gid != DOMAIN_RID_DCS) {
5954 torture_result(tctx, TORTURE_FAIL, "QueryUserInfo level 5: DC should have had Primary Group %d, got %d\n",
5955 DOMAIN_RID_DCS, info->info5.primary_gid);
5956 ret = false;
5957 }
5958 break;
5959 case ACB_WSTRUST:
5960 if (info->info5.primary_gid != DOMAIN_RID_DOMAIN_MEMBERS) {
5961 torture_result(tctx, TORTURE_FAIL, "QueryUserInfo level 5: Domain Member should have had Primary Group %d, got %d\n",
5962 DOMAIN_RID_DOMAIN_MEMBERS, info->info5.primary_gid);
5963 ret = false;
5964 }
5965 break;
5966 case ACB_NORMAL:
5967 if (info->info5.primary_gid != DOMAIN_RID_USERS) {
5968 torture_result(tctx, TORTURE_FAIL, "QueryUserInfo level 5: Users should have had Primary Group %d, got %d\n",
5969 DOMAIN_RID_USERS, info->info5.primary_gid);
5970 ret = false;
5971 }
5972 break;
5973 }
5974 }
5975
5976 if (!test_user_ops(p, tctx, &user_handle, domain_handle,
5977 domain_sid, acct_flags, name.string, which_ops,
5978 machine_credentials)) {
5979 ret = false;
5980 }
5981
5982 if (!ndr_policy_handle_empty(&user_handle)) {
5983 torture_comment(tctx, "Testing DeleteUser (createuser2 test)\n");
5984
5985 d.in.user_handle = &user_handle;
5986 d.out.user_handle = &user_handle;
5987
5988 torture_assert_ntstatus_ok(tctx, dcerpc_samr_DeleteUser_r(b, user_ctx, &d),
5989 "DeleteUser failed");
5990 if (!NT_STATUS_IS_OK(d.out.result)) {
5991 torture_result(tctx, TORTURE_FAIL, "DeleteUser failed - %s\n", nt_errstr(d.out.result));
5992 ret = false;
5993 }
5994 }
5995 }
5996 talloc_free(user_ctx);
5997 }
5998
5999 return ret;
6000 }
6001
6002 static bool test_QueryAliasInfo(struct dcerpc_binding_handle *b,
6003 struct torture_context *tctx,
6004 struct policy_handle *handle)
6005 {
6006 struct samr_QueryAliasInfo r;
6007 union samr_AliasInfo *info;
6008 uint16_t levels[] = {1, 2, 3};
6009 int i;
6010 bool ret = true;
6011
6012 for (i=0;i<ARRAY_SIZE(levels);i++) {
6013 torture_comment(tctx, "Testing QueryAliasInfo level %u\n", levels[i]);
6014
6015 r.in.alias_handle = handle;
6016 r.in.level = levels[i];
6017 r.out.info = &info;
6018
6019 torture_assert_ntstatus_ok(tctx, dcerpc_samr_QueryAliasInfo_r(b, tctx, &r),
6020 "QueryAliasInfo failed");
6021 if (!NT_STATUS_IS_OK(r.out.result)) {
6022 torture_result(tctx, TORTURE_FAIL, "QueryAliasInfo level %u failed - %s\n",
6023 levels[i], nt_errstr(r.out.result));
6024 ret = false;
6025 }
6026 }
6027
6028 return ret;
6029 }
6030
6031 static bool test_QueryGroupInfo(struct dcerpc_binding_handle *b,
6032 struct torture_context *tctx,
6033 struct policy_handle *handle)
6034 {
6035 struct samr_QueryGroupInfo r;
6036 union samr_GroupInfo *info;
6037 uint16_t levels[] = {1, 2, 3, 4, 5};
6038 int i;
6039 bool ret = true;
6040
6041 for (i=0;i<ARRAY_SIZE(levels);i++) {
6042 torture_comment(tctx, "Testing QueryGroupInfo level %u\n", levels[i]);
6043
6044 r.in.group_handle = handle;
6045 r.in.level = levels[i];
6046 r.out.info = &info;
6047
6048 torture_assert_ntstatus_ok(tctx, dcerpc_samr_QueryGroupInfo_r(b, tctx, &r),
6049 "QueryGroupInfo failed");
6050 if (!NT_STATUS_IS_OK(r.out.result)) {
6051 torture_result(tctx, TORTURE_FAIL, "QueryGroupInfo level %u failed - %s\n",
6052 levels[i], nt_errstr(r.out.result));
6053 ret = false;
6054 }
6055 }
6056
6057 return ret;
6058 }
6059
6060 static bool test_QueryGroupMember(struct dcerpc_binding_handle *b,
6061 struct torture_context *tctx,
6062 struct policy_handle *handle)
6063 {
6064 struct samr_QueryGroupMember r;
6065 struct samr_RidAttrArray *rids = NULL;
6066 bool ret = true;
6067
6068 torture_comment(tctx, "Testing QueryGroupMember\n");
6069
6070 r.in.group_handle = handle;
6071 r.out.rids = &rids;
6072
6073 torture_assert_ntstatus_ok(tctx, dcerpc_samr_QueryGroupMember_r(b, tctx, &r),
6074 "QueryGroupMember failed");
6075 if (!NT_STATUS_IS_OK(r.out.result)) {
6076 torture_result(tctx, TORTURE_FAIL, "QueryGroupMember failed - %s\n", nt_errstr(r.out.result));
6077 ret = false;
6078 }
6079
6080 return ret;
6081 }
6082
6083
6084 static bool test_SetGroupInfo(struct dcerpc_binding_handle *b,
6085 struct torture_context *tctx,
6086 struct policy_handle *handle)
6087 {
6088 struct samr_QueryGroupInfo r;
6089 union samr_GroupInfo *info;
6090 struct samr_SetGroupInfo s;
6091 uint16_t levels[] = {1, 2, 3, 4};
6092 uint16_t set_ok[] = {0, 1, 1, 1};
6093 int i;
6094 bool ret = true;
6095
6096 for (i=0;i<ARRAY_SIZE(levels);i++) {
6097 torture_comment(tctx, "Testing QueryGroupInfo level %u\n", levels[i]);
6098
6099 r.in.group_handle = handle;
6100 r.in.level = levels[i];
6101 r.out.info = &info;
6102
6103 torture_assert_ntstatus_ok(tctx, dcerpc_samr_QueryGroupInfo_r(b, tctx, &r),
6104 "QueryGroupInfo failed");
6105 if (!NT_STATUS_IS_OK(r.out.result)) {
6106 torture_result(tctx, TORTURE_FAIL, "QueryGroupInfo level %u failed - %s\n",
6107 levels[i], nt_errstr(r.out.result));
6108 ret = false;
6109 }
6110
6111 torture_comment(tctx, "Testing SetGroupInfo level %u\n", levels[i]);
6112
6113 s.in.group_handle = handle;
6114 s.in.level = levels[i];
6115 s.in.info = *r.out.info;
6116
6117 #if 0
6118 /* disabled this, as it changes the name only from the point of view of samr,
6119 but leaves the name from the point of view of w2k3 internals (and ldap). This means
6120 the name is still reserved, so creating the old name fails, but deleting by the old name
6121 also fails */
6122 if (s.in.level == 2) {
6123 init_lsa_String(&s.in.info->string, "NewName");
6124 }
6125 #endif
6126
6127 if (s.in.level == 4) {
6128 init_lsa_String(&s.in.info->description, "test description");
6129 }
6130
6131 torture_assert_ntstatus_ok(tctx, dcerpc_samr_SetGroupInfo_r(b, tctx, &s),
6132 "SetGroupInfo failed");
6133 if (set_ok[i]) {
6134 if (!NT_STATUS_IS_OK(s.out.result)) {
6135 torture_result(tctx, TORTURE_FAIL, "SetGroupInfo level %u failed - %s\n",
6136 r.in.level, nt_errstr(s.out.result));
6137 ret = false;
6138 continue;
6139 }
6140 } else {
6141 if (!NT_STATUS_EQUAL(NT_STATUS_INVALID_INFO_CLASS, s.out.result)) {
6142 torture_result(tctx, TORTURE_FAIL, "SetGroupInfo level %u gave %s - should have been NT_STATUS_INVALID_INFO_CLASS\n",
6143 r.in.level, nt_errstr(s.out.result));
6144 ret = false;
6145 continue;
6146 }
6147 }
6148 }
6149
6150 return ret;
6151 }
6152
6153 static bool test_QueryUserInfo(struct dcerpc_binding_handle *b,
6154 struct torture_context *tctx,
6155 struct policy_handle *handle)
6156 {
6157 struct samr_QueryUserInfo r;
6158 union samr_UserInfo *info;
6159 uint16_t levels[] = {1, 2, 3, 4, 5, 6, 7, 8, 9, 10,
6160 11, 12, 13, 14, 16, 17, 20, 21};
6161 int i;
6162 bool ret = true;
6163
6164 for (i=0;i<ARRAY_SIZE(levels);i++) {
6165 torture_comment(tctx, "Testing QueryUserInfo level %u\n", levels[i]);
6166
6167 r.in.user_handle = handle;
6168 r.in.level = levels[i];
6169 r.out.info = &info;
6170
6171 torture_assert_ntstatus_ok(tctx, dcerpc_samr_QueryUserInfo_r(b, tctx, &r),
6172 "QueryUserInfo failed");
6173 if (!NT_STATUS_IS_OK(r.out.result)) {
6174 torture_result(tctx, TORTURE_FAIL, "QueryUserInfo level %u failed - %s\n",
6175 levels[i], nt_errstr(r.out.result));
6176 ret = false;
6177 }
6178 }
6179
6180 return ret;
6181 }
6182
6183 static bool test_QueryUserInfo2(struct dcerpc_binding_handle *b,
6184 struct torture_context *tctx,
6185 struct policy_handle *handle)
6186 {
6187 struct samr_QueryUserInfo2 r;
6188 union samr_UserInfo *info;
6189 uint16_t levels[] = {1, 2, 3, 4, 5, 6, 7, 8, 9, 10,
6190 11, 12, 13, 14, 16, 17, 20, 21};
6191 int i;
6192 bool ret = true;
6193
6194 for (i=0;i<ARRAY_SIZE(levels);i++) {
6195 torture_comment(tctx, "Testing QueryUserInfo2 level %u\n", levels[i]);
6196
6197 r.in.user_handle = handle;
6198 r.in.level = levels[i];
6199 r.out.info = &info;
6200
6201 torture_assert_ntstatus_ok(tctx, dcerpc_samr_QueryUserInfo2_r(b, tctx, &r),
6202 "QueryUserInfo2 failed");
6203 if (!NT_STATUS_IS_OK(r.out.result)) {
6204 torture_result(tctx, TORTURE_FAIL, "QueryUserInfo2 level %u failed - %s\n",
6205 levels[i], nt_errstr(r.out.result));
6206 ret = false;
6207 }
6208 }
6209
6210 return ret;
6211 }
6212
6213 static bool test_OpenUser(struct dcerpc_binding_handle *b,
6214 struct torture_context *tctx,
6215 struct policy_handle *handle, uint32_t rid)
6216 {
6217 struct samr_OpenUser r;
6218 struct policy_handle user_handle;
6219 bool ret = true;
6220
6221 torture_comment(tctx, "Testing OpenUser(%u)\n", rid);
6222
6223 r.in.domain_handle = handle;
6224 r.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
6225 r.in.rid = rid;
6226 r.out.user_handle = &user_handle;
6227
6228 torture_assert_ntstatus_ok(tctx, dcerpc_samr_OpenUser_r(b, tctx, &r),
6229 "OpenUser failed");
6230 if (!NT_STATUS_IS_OK(r.out.result)) {
6231 torture_result(tctx, TORTURE_FAIL, "OpenUser(%u) failed - %s\n", rid, nt_errstr(r.out.result));
6232 return false;
6233 }
6234
6235 if (!test_QuerySecurity(b, tctx, &user_handle)) {
6236 ret = false;
6237 }
6238
6239 if (!test_QueryUserInfo(b, tctx, &user_handle)) {
6240 ret = false;
6241 }
6242
6243 if (!test_QueryUserInfo2(b, tctx, &user_handle)) {
6244 ret = false;
6245 }
6246
6247 if (!test_GetUserPwInfo(b, tctx, &user_handle)) {
6248 ret = false;
6249 }
6250
6251 if (!test_GetGroupsForUser(b, tctx, &user_handle)) {
6252 ret = false;
6253 }
6254
6255 if (!test_samr_handle_Close(b, tctx, &user_handle)) {
6256 ret = false;
6257 }
6258
6259 return ret;
6260 }
6261
6262 static bool test_OpenGroup(struct dcerpc_binding_handle *b,
6263 struct torture_context *tctx,
6264 struct policy_handle *handle, uint32_t rid)
6265 {
6266 struct samr_OpenGroup r;
6267 struct policy_handle group_handle;
6268 bool ret = true;
6269
6270 torture_comment(tctx, "Testing OpenGroup(%u)\n", rid);
6271
6272 r.in.domain_handle = handle;
6273 r.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
6274 r.in.rid = rid;
6275 r.out.group_handle = &group_handle;
6276
6277 torture_assert_ntstatus_ok(tctx, dcerpc_samr_OpenGroup_r(b, tctx, &r),
6278 "OpenGroup failed");
6279 if (!NT_STATUS_IS_OK(r.out.result)) {
6280 torture_result(tctx, TORTURE_FAIL, "OpenGroup(%u) failed - %s\n", rid, nt_errstr(r.out.result));
6281 return false;
6282 }
6283
6284 if (!torture_setting_bool(tctx, "samba3", false)) {
6285 if (!test_QuerySecurity(b, tctx, &group_handle)) {
6286 ret = false;
6287 }
6288 }
6289
6290 if (!test_QueryGroupInfo(b, tctx, &group_handle)) {
6291 ret = false;
6292 }
6293
6294 if (!test_QueryGroupMember(b, tctx, &group_handle)) {
6295 ret = false;
6296 }
6297
6298 if (!test_samr_handle_Close(b, tctx, &group_handle)) {
6299 ret = false;
6300 }
6301
6302 return ret;
6303 }
6304
6305 static bool test_OpenAlias(struct dcerpc_binding_handle *b,
6306 struct torture_context *tctx,
6307 struct policy_handle *handle, uint32_t rid)
6308 {
6309 struct samr_OpenAlias r;
6310 struct policy_handle alias_handle;
6311 bool ret = true;
6312
6313 torture_comment(tctx, "Testing OpenAlias(%u)\n", rid);
6314
6315 r.in.domain_handle = handle;
6316 r.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
6317 r.in.rid = rid;
6318 r.out.alias_handle = &alias_handle;
6319
6320 torture_assert_ntstatus_ok(tctx, dcerpc_samr_OpenAlias_r(b, tctx, &r),
6321 "OpenAlias failed");
6322 if (!NT_STATUS_IS_OK(r.out.result)) {
6323 torture_result(tctx, TORTURE_FAIL, "OpenAlias(%u) failed - %s\n", rid, nt_errstr(r.out.result));
6324 return false;
6325 }
6326
6327 if (!torture_setting_bool(tctx, "samba3", false)) {
6328 if (!test_QuerySecurity(b, tctx, &alias_handle)) {
6329 ret = false;
6330 }
6331 }
6332
6333 if (!test_QueryAliasInfo(b, tctx, &alias_handle)) {
6334 ret = false;
6335 }
6336
6337 if (!test_GetMembersInAlias(b, tctx, &alias_handle)) {
6338 ret = false;
6339 }
6340
6341 if (!test_samr_handle_Close(b, tctx, &alias_handle)) {
6342 ret = false;
6343 }
6344
6345 return ret;
6346 }
6347
6348 static bool check_mask(struct dcerpc_binding_handle *b,
6349 struct torture_context *tctx,
6350 struct policy_handle *handle, uint32_t rid,
6351 uint32_t acct_flag_mask)
6352 {
6353 struct samr_OpenUser r;
6354 struct samr_QueryUserInfo q;
6355 union samr_UserInfo *info;
6356 struct policy_handle user_handle;
6357 bool ret = true;
6358
6359 torture_comment(tctx, "Testing OpenUser(%u)\n", rid);
6360
6361 r.in.domain_handle = handle;
6362 r.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
6363 r.in.rid = rid;
6364 r.out.user_handle = &user_handle;
6365
6366 torture_assert_ntstatus_ok(tctx, dcerpc_samr_OpenUser_r(b, tctx, &r),
6367 "OpenUser failed");
6368 if (!NT_STATUS_IS_OK(r.out.result)) {
6369 torture_result(tctx, TORTURE_FAIL, "OpenUser(%u) failed - %s\n", rid, nt_errstr(r.out.result));
6370 return false;
6371 }
6372
6373 q.in.user_handle = &user_handle;
6374 q.in.level = 16;
6375 q.out.info = &info;
6376
6377 torture_assert_ntstatus_ok(tctx, dcerpc_samr_QueryUserInfo_r(b, tctx, &q),
6378 "QueryUserInfo failed");
6379 if (!NT_STATUS_IS_OK(q.out.result)) {
6380 torture_result(tctx, TORTURE_FAIL, "QueryUserInfo level 16 failed - %s\n",
6381 nt_errstr(q.out.result));
6382 ret = false;
6383 } else {
6384 if ((acct_flag_mask & info->info16.acct_flags) == 0) {
6385 torture_result(tctx, TORTURE_FAIL, "Server failed to filter for 0x%x, allowed 0x%x (%d) on EnumDomainUsers\n",
6386 acct_flag_mask, info->info16.acct_flags, rid);
6387 ret = false;
6388 }
6389 }
6390
6391 if (!test_samr_handle_Close(b, tctx, &user_handle)) {
6392 ret = false;
6393 }
6394
6395 return ret;
6396 }
6397
6398 static bool test_EnumDomainUsers_all(struct dcerpc_binding_handle *b,
6399 struct torture_context *tctx,
6400 struct policy_handle *handle)
6401 {
6402 struct samr_EnumDomainUsers r;
6403 uint32_t mask, resume_handle=0;
6404 int i, mask_idx;
6405 bool ret = true;
6406 struct samr_LookupNames n;
6407 struct samr_LookupRids lr ;
6408 struct lsa_Strings names;
6409 struct samr_Ids rids, types;
6410 struct samr_SamArray *sam = NULL;
6411 uint32_t num_entries = 0;
6412
6413 uint32_t masks[] = {ACB_NORMAL, ACB_DOMTRUST, ACB_WSTRUST,
6414 ACB_DISABLED, ACB_NORMAL | ACB_DISABLED,
6415 ACB_SVRTRUST | ACB_DOMTRUST | ACB_WSTRUST,
6416 ACB_PWNOEXP, 0};
6417
6418 torture_comment(tctx, "Testing EnumDomainUsers\n");
6419
6420 for (mask_idx=0;mask_idx<ARRAY_SIZE(masks);mask_idx++) {
6421 r.in.domain_handle = handle;
6422 r.in.resume_handle = &resume_handle;
6423 r.in.acct_flags = mask = masks[mask_idx];
6424 r.in.max_size = (uint32_t)-1;
6425 r.out.resume_handle = &resume_handle;
6426 r.out.num_entries = &num_entries;
6427 r.out.sam = &sam;
6428
6429 torture_assert_ntstatus_ok(tctx, dcerpc_samr_EnumDomainUsers_r(b, tctx, &r),
6430 "EnumDomainUsers failed");
6431 if (!NT_STATUS_EQUAL(r.out.result, STATUS_MORE_ENTRIES) &&
6432 !NT_STATUS_IS_OK(r.out.result)) {
6433 torture_result(tctx, TORTURE_FAIL, "EnumDomainUsers failed - %s\n", nt_errstr(r.out.result));
6434 return false;
6435 }
6436
6437 torture_assert(tctx, sam, "EnumDomainUsers failed: r.out.sam unexpectedly NULL");
6438
6439 if (sam->count == 0) {
6440 continue;
6441 }
6442
6443 for (i=0;i<sam->count;i++) {
6444 if (mask) {
6445 if (!check_mask(b, tctx, handle, sam->entries[i].idx, mask)) {
6446 ret = false;
6447 }
6448 } else if (!test_OpenUser(b, tctx, handle, sam->entries[i].idx)) {
6449 ret = false;
6450 }
6451 }
6452 }
6453
6454 torture_comment(tctx, "Testing LookupNames\n");
6455 n.in.domain_handle = handle;
6456 n.in.num_names = sam->count;
6457 n.in.names = talloc_array(tctx, struct lsa_String, sam->count);
6458 n.out.rids = &rids;
6459 n.out.types = &types;
6460 for (i=0;i<sam->count;i++) {
6461 n.in.names[i].string = sam->entries[i].name.string;
6462 }
6463 torture_assert_ntstatus_ok(tctx, dcerpc_samr_LookupNames_r(b, tctx, &n),
6464 "LookupNames failed");
6465 if (!NT_STATUS_IS_OK(n.out.result)) {
6466 torture_result(tctx, TORTURE_FAIL, "LookupNames failed - %s\n", nt_errstr(n.out.result));
6467 ret = false;
6468 }
6469
6470
6471 torture_comment(tctx, "Testing LookupRids\n");
6472 lr.in.domain_handle = handle;
6473 lr.in.num_rids = sam->count;
6474 lr.in.rids = talloc_array(tctx, uint32_t, sam->count);
6475 lr.out.names = &names;
6476 lr.out.types = &types;
6477 for (i=0;i<sam->count;i++) {
6478 lr.in.rids[i] = sam->entries[i].idx;
6479 }
6480 torture_assert_ntstatus_ok(tctx, dcerpc_samr_LookupRids_r(b, tctx, &lr),
6481 "LookupRids failed");
6482 torture_assert_ntstatus_ok(tctx, lr.out.result, "LookupRids");
6483
6484 return ret;
6485 }
6486
6487 /*
6488 try blasting the server with a bunch of sync requests
6489 */
6490 static bool test_EnumDomainUsers_async(struct dcerpc_pipe *p, struct torture_context *tctx,
6491 struct policy_handle *handle)
6492 {
6493 struct samr_EnumDomainUsers r;
6494 uint32_t resume_handle=0;
6495 int i;
6496 #define ASYNC_COUNT 100
6497 struct tevent_req *req[ASYNC_COUNT];
6498
6499 if (!torture_setting_bool(tctx, "dangerous", false)) {
6500 torture_skip(tctx, "samr async test disabled - enable dangerous tests to use\n");
6501 }
6502
6503 torture_comment(tctx, "Testing EnumDomainUsers_async\n");
6504
6505 r.in.domain_handle = handle;
6506 r.in.resume_handle = &resume_handle;
6507 r.in.acct_flags = 0;
6508 r.in.max_size = (uint32_t)-1;
6509 r.out.resume_handle = &resume_handle;
6510
6511 for (i=0;i<ASYNC_COUNT;i++) {
6512 req[i] = dcerpc_samr_EnumDomainUsers_r_send(tctx, tctx->ev, p->binding_handle, &r);
6513 }
6514
6515 for (i=0;i<ASYNC_COUNT;i++) {
6516 tevent_req_poll(req[i], tctx->ev);
6517 torture_assert_ntstatus_ok(tctx, dcerpc_samr_EnumDomainUsers_r_recv(req[i], tctx),
6518 talloc_asprintf(tctx, "EnumDomainUsers[%d] failed - %s\n",
6519 i, nt_errstr(r.out.result)));
6520 }
6521
6522 torture_comment(tctx, "%d async requests OK\n", i);
6523
6524 return true;
6525 }
6526
6527 static bool test_EnumDomainGroups_all(struct dcerpc_binding_handle *b,
6528 struct torture_context *tctx,
6529 struct policy_handle *handle)
6530 {
6531 struct samr_EnumDomainGroups r;
6532 uint32_t resume_handle=0;
6533 struct samr_SamArray *sam = NULL;
6534 uint32_t num_entries = 0;
6535 int i;
6536 bool ret = true;
6537 bool universal_group_found = false;
6538
6539 torture_comment(tctx, "Testing EnumDomainGroups\n");
6540
6541 r.in.domain_handle = handle;
6542 r.in.resume_handle = &resume_handle;
6543 r.in.max_size = (uint32_t)-1;
6544 r.out.resume_handle = &resume_handle;
6545 r.out.num_entries = &num_entries;
6546 r.out.sam = &sam;
6547
6548 torture_assert_ntstatus_ok(tctx, dcerpc_samr_EnumDomainGroups_r(b, tctx, &r),
6549 "EnumDomainGroups failed");
6550 if (!NT_STATUS_IS_OK(r.out.result)) {
6551 torture_result(tctx, TORTURE_FAIL, "EnumDomainGroups failed - %s\n", nt_errstr(r.out.result));
6552 return false;
6553 }
6554
6555 if (!sam) {
6556 return false;
6557 }
6558
6559 for (i=0;i<sam->count;i++) {
6560 if (!test_OpenGroup(b, tctx, handle, sam->entries[i].idx)) {
6561 ret = false;
6562 }
6563 if ((ret == true) && (strcasecmp(sam->entries[i].name.string,
6564 "Enterprise Admins") == 0)) {
6565 universal_group_found = true;
6566 }
6567 }
6568
6569 /* when we are running this on s4 we should get back at least the
6570 * "Enterprise Admins" universal group. If we don't get a group entry
6571 * at all we probably are performing the test on the builtin domain.
6572 * So ignore this case. */
6573 if (torture_setting_bool(tctx, "samba4", false)) {
6574 if ((sam->count > 0) && (!universal_group_found)) {
6575 ret = false;
6576 }
6577 }
6578
6579 return ret;
6580 }
6581
6582 static bool test_EnumDomainAliases_all(struct dcerpc_binding_handle *b,
6583 struct torture_context *tctx,
6584 struct policy_handle *handle)
6585 {
6586 struct samr_EnumDomainAliases r;
6587 uint32_t resume_handle=0;
6588 struct samr_SamArray *sam = NULL;
6589 uint32_t num_entries = 0;
6590 int i;
6591 bool ret = true;
6592
6593 torture_comment(tctx, "Testing EnumDomainAliases\n");
6594
6595 r.in.domain_handle = handle;
6596 r.in.resume_handle = &resume_handle;
6597 r.in.max_size = (uint32_t)-1;
6598 r.out.sam = &sam;
6599 r.out.num_entries = &num_entries;
6600 r.out.resume_handle = &resume_handle;
6601
6602 torture_assert_ntstatus_ok(tctx, dcerpc_samr_EnumDomainAliases_r(b, tctx, &r),
6603 "EnumDomainAliases failed");
6604 if (!NT_STATUS_IS_OK(r.out.result)) {
6605 torture_result(tctx, TORTURE_FAIL, "EnumDomainAliases failed - %s\n", nt_errstr(r.out.result));
6606 return false;
6607 }
6608
6609 if (!sam) {
6610 return false;
6611 }
6612
6613 for (i=0;i<sam->count;i++) {
6614 if (!test_OpenAlias(b, tctx, handle, sam->entries[i].idx)) {
6615 ret = false;
6616 }
6617 }
6618
6619 return ret;
6620 }
6621
6622 static bool test_GetDisplayEnumerationIndex(struct dcerpc_binding_handle *b,
6623 struct torture_context *tctx,
6624 struct policy_handle *handle)
6625 {
6626 struct samr_GetDisplayEnumerationIndex r;
6627 bool ret = true;
6628 uint16_t levels[] = {1, 2, 3, 4, 5};
6629 uint16_t ok_lvl[] = {1, 1, 1, 0, 0};
6630 struct lsa_String name;
6631 uint32_t idx = 0;
6632 int i;
6633
6634 for (i=0;i<ARRAY_SIZE(levels);i++) {
6635 torture_comment(tctx, "Testing GetDisplayEnumerationIndex level %u\n", levels[i]);
6636
6637 init_lsa_String(&name, TEST_ACCOUNT_NAME);
6638
6639 r.in.domain_handle = handle;
6640 r.in.level = levels[i];
6641 r.in.name = &name;
6642 r.out.idx = &idx;
6643
6644 torture_assert_ntstatus_ok(tctx, dcerpc_samr_GetDisplayEnumerationIndex_r(b, tctx, &r),
6645 "GetDisplayEnumerationIndex failed");
6646
6647 if (ok_lvl[i] &&
6648 !NT_STATUS_IS_OK(r.out.result) &&
6649 !NT_STATUS_EQUAL(NT_STATUS_NO_MORE_ENTRIES, r.out.result)) {
6650 torture_result(tctx, TORTURE_FAIL, "GetDisplayEnumerationIndex level %u failed - %s\n",
6651 levels[i], nt_errstr(r.out.result));
6652 ret = false;
6653 }
6654
6655 init_lsa_String(&name, "zzzzzzzz");
6656
6657 torture_assert_ntstatus_ok(tctx, dcerpc_samr_GetDisplayEnumerationIndex_r(b, tctx, &r),
6658 "GetDisplayEnumerationIndex failed");
6659
6660 if (ok_lvl[i] && !NT_STATUS_EQUAL(NT_STATUS_NO_MORE_ENTRIES, r.out.result)) {
6661 torture_result(tctx, TORTURE_FAIL, "GetDisplayEnumerationIndex level %u failed - %s\n",
6662 levels[i], nt_errstr(r.out.result));
6663 ret = false;
6664 }
6665 }
6666
6667 return ret;
6668 }
6669
6670 static bool test_GetDisplayEnumerationIndex2(struct dcerpc_binding_handle *b,
6671 struct torture_context *tctx,
6672 struct policy_handle *handle)
6673 {
6674 struct samr_GetDisplayEnumerationIndex2 r;
6675 bool ret = true;
6676 uint16_t levels[] = {1, 2, 3, 4, 5};
6677 uint16_t ok_lvl[] = {1, 1, 1, 0, 0};
6678 struct lsa_String name;
6679 uint32_t idx = 0;
6680 int i;
6681
6682 for (i=0;i<ARRAY_SIZE(levels);i++) {
6683 torture_comment(tctx, "Testing GetDisplayEnumerationIndex2 level %u\n", levels[i]);
6684
6685 init_lsa_String(&name, TEST_ACCOUNT_NAME);
6686
6687 r.in.domain_handle = handle;
6688 r.in.level = levels[i];
6689 r.in.name = &name;
6690 r.out.idx = &idx;
6691
6692 torture_assert_ntstatus_ok(tctx, dcerpc_samr_GetDisplayEnumerationIndex2_r(b, tctx, &r),
6693 "GetDisplayEnumerationIndex2 failed");
6694 if (ok_lvl[i] &&
6695 !NT_STATUS_IS_OK(r.out.result) &&
6696 !NT_STATUS_EQUAL(NT_STATUS_NO_MORE_ENTRIES, r.out.result)) {
6697 torture_result(tctx, TORTURE_FAIL, "GetDisplayEnumerationIndex2 level %u failed - %s\n",
6698 levels[i], nt_errstr(r.out.result));
6699 ret = false;
6700 }
6701
6702 init_lsa_String(&name, "zzzzzzzz");
6703
6704 torture_assert_ntstatus_ok(tctx, dcerpc_samr_GetDisplayEnumerationIndex2_r(b, tctx, &r),
6705 "GetDisplayEnumerationIndex2 failed");
6706 if (ok_lvl[i] && !NT_STATUS_EQUAL(NT_STATUS_NO_MORE_ENTRIES, r.out.result)) {
6707 torture_result(tctx, TORTURE_FAIL, "GetDisplayEnumerationIndex2 level %u failed - %s\n",
6708 levels[i], nt_errstr(r.out.result));
6709 ret = false;
6710 }
6711 }
6712
6713 return ret;
6714 }
6715
6716 #define STRING_EQUAL_QUERY(s1, s2, user) \
6717 if (s1.string == NULL && s2.string != NULL && s2.string[0] == '\0') { \
6718 /* odd, but valid */ \
6719 } else if ((s1.string && !s2.string) || (s2.string && !s1.string) || strcmp(s1.string, s2.string)) { \
6720 torture_result(tctx, TORTURE_FAIL, "%s mismatch for %s: %s != %s (%s)\n", \
6721 #s1, user.string, s1.string, s2.string, __location__); \
6722 ret = false; \
6723 }
6724 #define INT_EQUAL_QUERY(s1, s2, user) \
6725 if (s1 != s2) { \
6726 torture_result(tctx, TORTURE_FAIL, "%s mismatch for %s: 0x%llx != 0x%llx (%s)\n", \
6727 #s1, user.string, (unsigned long long)s1, (unsigned long long)s2, __location__); \
6728 ret = false; \
6729 }
6730
6731 static bool test_each_DisplayInfo_user(struct dcerpc_binding_handle *b,
6732 struct torture_context *tctx,
6733 struct samr_QueryDisplayInfo *querydisplayinfo,
6734 bool *seen_testuser)
6735 {
6736 struct samr_OpenUser r;
6737 struct samr_QueryUserInfo q;
6738 union samr_UserInfo *info;
6739 struct policy_handle user_handle;
6740 int i, ret = true;
6741 r.in.domain_handle = querydisplayinfo->in.domain_handle;
6742 r.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
6743 for (i = 0; ; i++) {
6744 switch (querydisplayinfo->in.level) {
6745 case 1:
6746 if (i >= querydisplayinfo->out.info->info1.count) {
6747 return ret;
6748 }
6749 r.in.rid = querydisplayinfo->out.info->info1.entries[i].rid;
6750 break;
6751 case 2:
6752 if (i >= querydisplayinfo->out.info->info2.count) {
6753 return ret;
6754 }
6755 r.in.rid = querydisplayinfo->out.info->info2.entries[i].rid;
6756 break;
6757 case 3:
6758 /* Groups */
6759 case 4:
6760 case 5:
6761 /* Not interested in validating just the account name */
6762 return true;
6763 }
6764
6765 r.out.user_handle = &user_handle;
6766
6767 switch (querydisplayinfo->in.level) {
6768 case 1:
6769 case 2:
6770 torture_assert_ntstatus_ok(tctx, dcerpc_samr_OpenUser_r(b, tctx, &r),
6771 "OpenUser failed");
6772 if (!NT_STATUS_IS_OK(r.out.result)) {
6773 torture_result(tctx, TORTURE_FAIL, "OpenUser(%u) failed - %s\n", r.in.rid, nt_errstr(r.out.result));
6774 return false;
6775 }
6776 }
6777
6778 q.in.user_handle = &user_handle;
6779 q.in.level = 21;
6780 q.out.info = &info;
6781 torture_assert_ntstatus_ok(tctx, dcerpc_samr_QueryUserInfo_r(b, tctx, &q),
6782 "QueryUserInfo failed");
6783 if (!NT_STATUS_IS_OK(r.out.result)) {
6784 torture_result(tctx, TORTURE_FAIL, "QueryUserInfo(%u) failed - %s\n", r.in.rid, nt_errstr(r.out.result));
6785 return false;
6786 }
6787
6788 switch (querydisplayinfo->in.level) {
6789 case 1:
6790 if (seen_testuser && strcmp(info->info21.account_name.string, TEST_ACCOUNT_NAME) == 0) {
6791 *seen_testuser = true;
6792 }
6793 STRING_EQUAL_QUERY(querydisplayinfo->out.info->info1.entries[i].full_name,
6794 info->info21.full_name, info->info21.account_name);
6795 STRING_EQUAL_QUERY(querydisplayinfo->out.info->info1.entries[i].account_name,
6796 info->info21.account_name, info->info21.account_name);
6797 STRING_EQUAL_QUERY(querydisplayinfo->out.info->info1.entries[i].description,
6798 info->info21.description, info->info21.account_name);
6799 INT_EQUAL_QUERY(querydisplayinfo->out.info->info1.entries[i].rid,
6800 info->info21.rid, info->info21.account_name);
6801 INT_EQUAL_QUERY(querydisplayinfo->out.info->info1.entries[i].acct_flags,
6802 info->info21.acct_flags, info->info21.account_name);
6803
6804 break;
6805 case 2:
6806 STRING_EQUAL_QUERY(querydisplayinfo->out.info->info2.entries[i].account_name,
6807 info->info21.account_name, info->info21.account_name);
6808 STRING_EQUAL_QUERY(querydisplayinfo->out.info->info2.entries[i].description,
6809 info->info21.description, info->info21.account_name);
6810 INT_EQUAL_QUERY(querydisplayinfo->out.info->info2.entries[i].rid,
6811 info->info21.rid, info->info21.account_name);
6812 INT_EQUAL_QUERY((querydisplayinfo->out.info->info2.entries[i].acct_flags & ~ACB_NORMAL),
6813 info->info21.acct_flags, info->info21.account_name);
6814
6815 if (!(querydisplayinfo->out.info->info2.entries[i].acct_flags & ACB_NORMAL)) {
6816 torture_result(tctx, TORTURE_FAIL, "Missing ACB_NORMAL in querydisplayinfo->out.info.info2.entries[i].acct_flags on %s\n",
6817 info->info21.account_name.string);
6818 }
6819
6820 if (!(info->info21.acct_flags & (ACB_WSTRUST | ACB_SVRTRUST))) {
6821 torture_result(tctx, TORTURE_FAIL, "Found non-trust account %s in trust account listing: 0x%x 0x%x\n",
6822 info->info21.account_name.string,
6823 querydisplayinfo->out.info->info2.entries[i].acct_flags,
6824 info->info21.acct_flags);
6825 return false;
6826 }
6827
6828 break;
6829 }
6830
6831 if (!test_samr_handle_Close(b, tctx, &user_handle)) {
6832 return false;
6833 }
6834 }
6835 return ret;
6836 }
6837
6838 static bool test_QueryDisplayInfo(struct dcerpc_binding_handle *b,
6839 struct torture_context *tctx,
6840 struct policy_handle *handle)
6841 {
6842 struct samr_QueryDisplayInfo r;
6843 struct samr_QueryDomainInfo dom_info;
6844 union samr_DomainInfo *info = NULL;
6845 bool ret = true;
6846 uint16_t levels[] = {1, 2, 3, 4, 5};
6847 int i;
6848 bool seen_testuser = false;
6849 uint32_t total_size;
6850 uint32_t returned_size;
6851 union samr_DispInfo disp_info;
6852
6853
6854 for (i=0;i<ARRAY_SIZE(levels);i++) {
6855 torture_comment(tctx, "Testing QueryDisplayInfo level %u\n", levels[i]);
6856
6857 r.in.start_idx = 0;
6858 r.out.result = STATUS_MORE_ENTRIES;
6859 while (NT_STATUS_EQUAL(r.out.result, STATUS_MORE_ENTRIES)) {
6860 r.in.domain_handle = handle;
6861 r.in.level = levels[i];
6862 r.in.max_entries = 2;
6863 r.in.buf_size = (uint32_t)-1;
6864 r.out.total_size = &total_size;
6865 r.out.returned_size = &returned_size;
6866 r.out.info = &disp_info;
6867
6868 torture_assert_ntstatus_ok(tctx, dcerpc_samr_QueryDisplayInfo_r(b, tctx, &r),
6869 "QueryDisplayInfo failed");
6870 if (!NT_STATUS_EQUAL(r.out.result, STATUS_MORE_ENTRIES) && !NT_STATUS_IS_OK(r.out.result)) {
6871 torture_result(tctx, TORTURE_FAIL, "QueryDisplayInfo level %u failed - %s\n",
6872 levels[i], nt_errstr(r.out.result));
6873 ret = false;
6874 }
6875 switch (r.in.level) {
6876 case 1:
6877 if (!test_each_DisplayInfo_user(b, tctx, &r, &seen_testuser)) {
6878 ret = false;
6879 }
6880 r.in.start_idx += r.out.info->info1.count;
6881 break;
6882 case 2:
6883 if (!test_each_DisplayInfo_user(b, tctx, &r, NULL)) {
6884 ret = false;
6885 }
6886 r.in.start_idx += r.out.info->info2.count;
6887 break;
6888 case 3:
6889 r.in.start_idx += r.out.info->info3.count;
6890 break;
6891 case 4:
6892 r.in.start_idx += r.out.info->info4.count;
6893 break;
6894 case 5:
6895 r.in.start_idx += r.out.info->info5.count;
6896 break;
6897 }
6898 }
6899 dom_info.in.domain_handle = handle;
6900 dom_info.in.level = 2;
6901 dom_info.out.info = &info;
6902
6903 /* Check number of users returned is correct */
6904 torture_assert_ntstatus_ok(tctx, dcerpc_samr_QueryDomainInfo_r(b, tctx, &dom_info),
6905 "QueryDomainInfo failed");
6906 if (!NT_STATUS_IS_OK(dom_info.out.result)) {
6907 torture_result(tctx, TORTURE_FAIL, "QueryDomainInfo level %u failed - %s\n",
6908 r.in.level, nt_errstr(dom_info.out.result));
6909 ret = false;
6910 break;
6911 }
6912 switch (r.in.level) {
6913 case 1:
6914 case 4:
6915 if (info->general.num_users < r.in.start_idx) {
6916 /* On AD deployments this numbers don't match
6917 * since QueryDisplayInfo returns universal and
6918 * global groups, QueryDomainInfo only global
6919 * ones. */
6920 if (torture_setting_bool(tctx, "samba3", false)) {
6921 torture_result(tctx, TORTURE_FAIL, "QueryDomainInfo indicates that QueryDisplayInfo returned more users (%d/%d) than the domain %s is said to contain!\n",
6922 r.in.start_idx, info->general.num_groups,
6923 info->general.domain_name.string);
6924 ret = false;
6925 }
6926 }
6927 if (!seen_testuser) {
6928 struct policy_handle user_handle;
6929 if (NT_STATUS_IS_OK(test_OpenUser_byname(b, tctx, handle, TEST_ACCOUNT_NAME, &user_handle))) {
6930 torture_result(tctx, TORTURE_FAIL, "Didn't find test user " TEST_ACCOUNT_NAME " in enumeration of %s\n",
6931 info->general.domain_name.string);
6932 ret = false;
6933 test_samr_handle_Close(b, tctx, &user_handle);
6934 }
6935 }
6936 break;
6937 case 3:
6938 case 5:
6939 if (info->general.num_groups != r.in.start_idx) {
6940 /* On AD deployments this numbers don't match
6941 * since QueryDisplayInfo returns universal and
6942 * global groups, QueryDomainInfo only global
6943 * ones. */
6944 if (torture_setting_bool(tctx, "samba3", false)) {
6945 torture_result(tctx, TORTURE_FAIL, "QueryDomainInfo indicates that QueryDisplayInfo didn't return all (%d/%d) the groups in %s\n",
6946 r.in.start_idx, info->general.num_groups,
6947 info->general.domain_name.string);
6948 ret = false;
6949 }
6950 }
6951
6952 break;
6953 }
6954
6955 }
6956
6957 return ret;
6958 }
6959
6960 static bool test_QueryDisplayInfo2(struct dcerpc_binding_handle *b,
6961 struct torture_context *tctx,
6962 struct policy_handle *handle)
6963 {
6964 struct samr_QueryDisplayInfo2 r;
6965 bool ret = true;
6966 uint16_t levels[] = {1, 2, 3, 4, 5};
6967 int i;
6968 uint32_t total_size;
6969 uint32_t returned_size;
6970 union samr_DispInfo info;
6971
6972 for (i=0;i<ARRAY_SIZE(levels);i++) {
6973 torture_comment(tctx, "Testing QueryDisplayInfo2 level %u\n", levels[i]);
6974
6975 r.in.domain_handle = handle;
6976 r.in.level = levels[i];
6977 r.in.start_idx = 0;
6978 r.in.max_entries = 1000;
6979 r.in.buf_size = (uint32_t)-1;
6980 r.out.total_size = &total_size;
6981 r.out.returned_size = &returned_size;
6982 r.out.info = &info;
6983
6984 torture_assert_ntstatus_ok(tctx, dcerpc_samr_QueryDisplayInfo2_r(b, tctx, &r),
6985 "QueryDisplayInfo2 failed");
6986 if (!NT_STATUS_IS_OK(r.out.result)) {
6987 torture_result(tctx, TORTURE_FAIL, "QueryDisplayInfo2 level %u failed - %s\n",
6988 levels[i], nt_errstr(r.out.result));
6989 ret = false;
6990 }
6991 }
6992
6993 return ret;
6994 }
6995
6996 static bool test_QueryDisplayInfo3(struct dcerpc_binding_handle *b,
6997 struct torture_context *tctx,
6998 struct policy_handle *handle)
6999 {
7000 struct samr_QueryDisplayInfo3 r;
7001 bool ret = true;
7002 uint16_t levels[] = {1, 2, 3, 4, 5};
7003 int i;
7004 uint32_t total_size;
7005 uint32_t returned_size;
7006 union samr_DispInfo info;
7007
7008 for (i=0;i<ARRAY_SIZE(levels);i++) {
7009 torture_comment(tctx, "Testing QueryDisplayInfo3 level %u\n", levels[i]);
7010
7011 r.in.domain_handle = handle;
7012 r.in.level = levels[i];
7013 r.in.start_idx = 0;
7014 r.in.max_entries = 1000;
7015 r.in.buf_size = (uint32_t)-1;
7016 r.out.total_size = &total_size;
7017 r.out.returned_size = &returned_size;
7018 r.out.info = &info;
7019
7020 torture_assert_ntstatus_ok(tctx, dcerpc_samr_QueryDisplayInfo3_r(b, tctx, &r),
7021 "QueryDisplayInfo3 failed");
7022 if (!NT_STATUS_IS_OK(r.out.result)) {
7023 torture_result(tctx, TORTURE_FAIL, "QueryDisplayInfo3 level %u failed - %s\n",
7024 levels[i], nt_errstr(r.out.result));
7025 ret = false;
7026 }
7027 }
7028
7029 return ret;
7030 }
7031
7032
7033 static bool test_QueryDisplayInfo_continue(struct dcerpc_binding_handle *b,
7034 struct torture_context *tctx,
7035 struct policy_handle *handle)
7036 {
7037 struct samr_QueryDisplayInfo r;
7038 bool ret = true;
7039 uint32_t total_size;
7040 uint32_t returned_size;
7041 union samr_DispInfo info;
7042
7043 torture_comment(tctx, "Testing QueryDisplayInfo continuation\n");
7044
7045 r.in.domain_handle = handle;
7046 r.in.level = 1;
7047 r.in.start_idx = 0;
7048 r.in.max_entries = 1;
7049 r.in.buf_size = (uint32_t)-1;
7050 r.out.total_size = &total_size;
7051 r.out.returned_size = &returned_size;
7052 r.out.info = &info;
7053
7054 do {
7055 torture_assert_ntstatus_ok(tctx, dcerpc_samr_QueryDisplayInfo_r(b, tctx, &r),
7056 "QueryDisplayInfo failed");
7057 if (NT_STATUS_IS_OK(r.out.result) && *r.out.returned_size != 0) {
7058 if (r.out.info->info1.entries[0].idx != r.in.start_idx + 1) {
7059 torture_result(tctx, TORTURE_FAIL, "expected idx %d but got %d\n",
7060 r.in.start_idx + 1,
7061 r.out.info->info1.entries[0].idx);
7062 break;
7063 }
7064 }
7065 if (!NT_STATUS_EQUAL(r.out.result, STATUS_MORE_ENTRIES) &&
7066 !NT_STATUS_IS_OK(r.out.result)) {
7067 torture_result(tctx, TORTURE_FAIL, "QueryDisplayInfo level %u failed - %s\n",
7068 r.in.level, nt_errstr(r.out.result));
7069 ret = false;
7070 break;
7071 }
7072 r.in.start_idx++;
7073 } while ((NT_STATUS_EQUAL(r.out.result, STATUS_MORE_ENTRIES) ||
7074 NT_STATUS_IS_OK(r.out.result)) &&
7075 *r.out.returned_size != 0);
7076
7077 return ret;
7078 }
7079
7080 static bool test_QueryDomainInfo(struct dcerpc_pipe *p,
7081 struct torture_context *tctx,
7082 struct policy_handle *handle)
7083 {
7084 struct samr_QueryDomainInfo r;
7085 union samr_DomainInfo *info = NULL;
7086 struct samr_SetDomainInfo s;
7087 uint16_t levels[] = {1, 2, 3, 4, 5, 6, 7, 8, 9, 11, 12, 13};
7088 uint16_t set_ok[] = {1, 0, 1, 1, 0, 1, 1, 0, 1, 0, 1, 0};
7089 int i;
7090 bool ret = true;
7091 struct dcerpc_binding_handle *b = p->binding_handle;
7092 const char *domain_comment = talloc_asprintf(tctx,
7093 "Tortured by Samba4 RPC-SAMR: %s",
7094 timestring(tctx, time(NULL)));
7095
7096 s.in.domain_handle = handle;
7097 s.in.level = 4;
7098 s.in.info = talloc(tctx, union samr_DomainInfo);
7099
7100 s.in.info->oem.oem_information.string = domain_comment;
7101 torture_assert_ntstatus_ok(tctx, dcerpc_samr_SetDomainInfo_r(b, tctx, &s),
7102 "SetDomainInfo failed");
7103 if (!NT_STATUS_IS_OK(s.out.result)) {
7104 torture_result(tctx, TORTURE_FAIL, "SetDomainInfo level %u (set comment) failed - %s\n",
7105 s.in.level, nt_errstr(s.out.result));
7106 return false;
7107 }
7108
7109 for (i=0;i<ARRAY_SIZE(levels);i++) {
7110 torture_comment(tctx, "Testing QueryDomainInfo level %u\n", levels[i]);
7111
7112 r.in.domain_handle = handle;
7113 r.in.level = levels[i];
7114 r.out.info = &info;
7115
7116 torture_assert_ntstatus_ok(tctx, dcerpc_samr_QueryDomainInfo_r(b, tctx, &r),
7117 "QueryDomainInfo failed");
7118 if (!NT_STATUS_IS_OK(r.out.result)) {
7119 torture_result(tctx, TORTURE_FAIL, "QueryDomainInfo level %u failed - %s\n",
7120 r.in.level, nt_errstr(r.out.result));
7121 ret = false;
7122 continue;
7123 }
7124
7125 switch (levels[i]) {
7126 case 2:
7127 if (strcmp(info->general.oem_information.string, domain_comment) != 0) {
7128 torture_result(tctx, TORTURE_FAIL, "QueryDomainInfo level %u returned different oem_information (comment) (%s, expected %s)\n",
7129 levels[i], info->general.oem_information.string, domain_comment);
7130 if (!torture_setting_bool(tctx, "samba3", false)) {
7131 ret = false;
7132 }
7133 }
7134 if (!info->general.primary.string) {
7135 torture_result(tctx, TORTURE_FAIL, "QueryDomainInfo level %u returned no PDC name\n",
7136 levels[i]);
7137 ret = false;
7138 } else if (info->general.role == SAMR_ROLE_DOMAIN_PDC) {
7139 if (dcerpc_server_name(p) && strcasecmp_m(dcerpc_server_name(p), info->general.primary.string) != 0) {
7140 if (torture_setting_bool(tctx, "samba3", false)) {
7141 torture_result(tctx, TORTURE_FAIL, "QueryDomainInfo level %u returned different PDC name (%s) compared to server name (%s), despite claiming to be the PDC\n",
7142 levels[i], info->general.primary.string, dcerpc_server_name(p));
7143 }
7144 }
7145 }
7146 break;
7147 case 4:
7148 if (strcmp(info->oem.oem_information.string, domain_comment) != 0) {
7149 torture_result(tctx, TORTURE_FAIL, "QueryDomainInfo level %u returned different oem_information (comment) (%s, expected %s)\n",
7150 levels[i], info->oem.oem_information.string, domain_comment);
7151 if (!torture_setting_bool(tctx, "samba3", false)) {
7152 ret = false;
7153 }
7154 }
7155 break;
7156 case 6:
7157 if (!info->info6.primary.string) {
7158 torture_result(tctx, TORTURE_FAIL, "QueryDomainInfo level %u returned no PDC name\n",
7159 levels[i]);
7160 ret = false;
7161 }
7162 break;
7163 case 11:
7164 if (strcmp(info->general2.general.oem_information.string, domain_comment) != 0) {
7165 torture_result(tctx, TORTURE_FAIL, "QueryDomainInfo level %u returned different comment (%s, expected %s)\n",
7166 levels[i], info->general2.general.oem_information.string, domain_comment);
7167 if (!torture_setting_bool(tctx, "samba3", false)) {
7168 ret = false;
7169 }
7170 }
7171 break;
7172 }
7173
7174 torture_comment(tctx, "Testing SetDomainInfo level %u\n", levels[i]);
7175
7176 s.in.domain_handle = handle;
7177 s.in.level = levels[i];
7178 s.in.info = info;
7179
7180 torture_assert_ntstatus_ok(tctx, dcerpc_samr_SetDomainInfo_r(b, tctx, &s),
7181 "SetDomainInfo failed");
7182 if (set_ok[i]) {
7183 if (!NT_STATUS_IS_OK(s.out.result)) {
7184 torture_result(tctx, TORTURE_FAIL, "SetDomainInfo level %u failed - %s\n",
7185 r.in.level, nt_errstr(s.out.result));
7186 ret = false;
7187 continue;
7188 }
7189 } else {
7190 if (!NT_STATUS_EQUAL(NT_STATUS_INVALID_INFO_CLASS, s.out.result)) {
7191 torture_result(tctx, TORTURE_FAIL, "SetDomainInfo level %u gave %s - should have been NT_STATUS_INVALID_INFO_CLASS\n",
7192 r.in.level, nt_errstr(s.out.result));
7193 ret = false;
7194 continue;
7195 }
7196 }
7197
7198 torture_assert_ntstatus_ok(tctx, dcerpc_samr_QueryDomainInfo_r(b, tctx, &r),
7199 "QueryDomainInfo failed");
7200 if (!NT_STATUS_IS_OK(r.out.result)) {
7201 torture_result(tctx, TORTURE_FAIL, "QueryDomainInfo level %u failed - %s\n",
7202 r.in.level, nt_errstr(r.out.result));
7203 ret = false;
7204 continue;
7205 }
7206 }
7207
7208 return ret;
7209 }
7210
7211
7212 static bool test_QueryDomainInfo2(struct dcerpc_binding_handle *b,
7213 struct torture_context *tctx,
7214 struct policy_handle *handle)
7215 {
7216 struct samr_QueryDomainInfo2 r;
7217 union samr_DomainInfo *info = NULL;
7218 uint16_t levels[] = {1, 2, 3, 4, 5, 6, 7, 8, 9, 11, 12, 13};
7219 int i;
7220 bool ret = true;
7221
7222 for (i=0;i<ARRAY_SIZE(levels);i++) {
7223 torture_comment(tctx, "Testing QueryDomainInfo2 level %u\n", levels[i]);
7224
7225 r.in.domain_handle = handle;
7226 r.in.level = levels[i];
7227 r.out.info = &info;
7228
7229 torture_assert_ntstatus_ok(tctx, dcerpc_samr_QueryDomainInfo2_r(b, tctx, &r),
7230 "QueryDomainInfo2 failed");
7231 if (!NT_STATUS_IS_OK(r.out.result)) {
7232 torture_result(tctx, TORTURE_FAIL, "QueryDomainInfo2 level %u failed - %s\n",
7233 r.in.level, nt_errstr(r.out.result));
7234 ret = false;
7235 continue;
7236 }
7237 }
7238
7239 return ret;
7240 }
7241
7242 /* Test whether querydispinfo level 5 and enumdomgroups return the same
7243 set of group names. */
7244 static bool test_GroupList(struct dcerpc_binding_handle *b,
7245 struct torture_context *tctx,
7246 struct dom_sid *domain_sid,
7247 struct policy_handle *handle)
7248 {
7249 struct samr_EnumDomainGroups q1;
7250 struct samr_QueryDisplayInfo q2;
7251 NTSTATUS status;
7252 uint32_t resume_handle=0;
7253 struct samr_SamArray *sam = NULL;
7254 uint32_t num_entries = 0;
7255 int i;
7256 bool ret = true;
7257 uint32_t total_size;
7258 uint32_t returned_size;
7259 union samr_DispInfo info;
7260
7261 size_t num_names = 0;
7262 const char **names = NULL;
7263
7264 bool builtin_domain = dom_sid_compare(domain_sid,
7265 &global_sid_Builtin) == 0;
7266
7267 torture_comment(tctx, "Testing coherency of querydispinfo vs enumdomgroups\n");
7268
7269 q1.in.domain_handle = handle;
7270 q1.in.resume_handle = &resume_handle;
7271 q1.in.max_size = 5;
7272 q1.out.resume_handle = &resume_handle;
7273 q1.out.num_entries = &num_entries;
7274 q1.out.sam = &sam;
7275
7276 status = STATUS_MORE_ENTRIES;
7277 while (NT_STATUS_EQUAL(status, STATUS_MORE_ENTRIES)) {
7278 torture_assert_ntstatus_ok(tctx, dcerpc_samr_EnumDomainGroups_r(b, tctx, &q1),
7279 "EnumDomainGroups failed");
7280 status = q1.out.result;
7281
7282 if (!NT_STATUS_IS_OK(status) &&
7283 !NT_STATUS_EQUAL(status, STATUS_MORE_ENTRIES))
7284 break;
7285
7286 for (i=0; i<*q1.out.num_entries; i++) {
7287 add_string_to_array(tctx,
7288 sam->entries[i].name.string,
7289 &names, &num_names);
7290 }
7291 }
7292
7293 torture_assert_ntstatus_ok(tctx, status, "EnumDomainGroups");
7294
7295 torture_assert(tctx, sam, "EnumDomainGroups failed to return sam");
7296
7297 if (builtin_domain) {
7298 torture_assert(tctx, num_names == 0,
7299 "EnumDomainGroups shouldn't return any group in the builtin domain!");
7300 }
7301
7302 q2.in.domain_handle = handle;
7303 q2.in.level = 5;
7304 q2.in.start_idx = 0;
7305 q2.in.max_entries = 5;
7306 q2.in.buf_size = (uint32_t)-1;
7307 q2.out.total_size = &total_size;
7308 q2.out.returned_size = &returned_size;
7309 q2.out.info = &info;
7310
7311 status = STATUS_MORE_ENTRIES;
7312 while (NT_STATUS_EQUAL(status, STATUS_MORE_ENTRIES)) {
7313 torture_assert_ntstatus_ok(tctx, dcerpc_samr_QueryDisplayInfo_r(b, tctx, &q2),
7314 "QueryDisplayInfo failed");
7315 status = q2.out.result;
7316 if (!NT_STATUS_IS_OK(status) &&
7317 !NT_STATUS_EQUAL(status, STATUS_MORE_ENTRIES))
7318 break;
7319
7320 for (i=0; i<q2.out.info->info5.count; i++) {
7321 int j;
7322 const char *name = q2.out.info->info5.entries[i].account_name.string;
7323 bool found = false;
7324 for (j=0; j<num_names; j++) {
7325 if (names[j] == NULL)
7326 continue;
7327 if (strequal(names[j], name)) {
7328 names[j] = NULL;
7329 found = true;
7330 break;
7331 }
7332 }
7333
7334 if ((!found) && (!builtin_domain)) {
7335 torture_result(tctx, TORTURE_FAIL, "QueryDisplayInfo gave name [%s] that EnumDomainGroups did not\n",
7336 name);
7337 ret = false;
7338 }
7339 }
7340 q2.in.start_idx += q2.out.info->info5.count;
7341 }
7342
7343 if (!NT_STATUS_IS_OK(status)) {
7344 torture_result(tctx, TORTURE_FAIL, "QueryDisplayInfo level 5 failed - %s\n",
7345 nt_errstr(status));
7346 ret = false;
7347 }
7348
7349 if (builtin_domain) {
7350 torture_assert(tctx, q2.in.start_idx != 0,
7351 "QueryDisplayInfo should return all domain groups also on the builtin domain handle!");
7352 }
7353
7354 for (i=0; i<num_names; i++) {
7355 if (names[i] != NULL) {
7356 torture_result(tctx, TORTURE_FAIL, "EnumDomainGroups gave name [%s] that QueryDisplayInfo did not\n",
7357 names[i]);
7358 ret = false;
7359 }
7360 }
7361
7362 return ret;
7363 }
7364
7365 static bool test_DeleteDomainGroup(struct dcerpc_binding_handle *b,
7366 struct torture_context *tctx,
7367 struct policy_handle *group_handle)
7368 {
7369 struct samr_DeleteDomainGroup d;
7370
7371 torture_comment(tctx, "Testing DeleteDomainGroup\n");
7372
7373 d.in.group_handle = group_handle;
7374 d.out.group_handle = group_handle;
7375
7376 torture_assert_ntstatus_ok(tctx, dcerpc_samr_DeleteDomainGroup_r(b, tctx, &d),
7377 "DeleteDomainGroup failed");
7378 torture_assert_ntstatus_ok(tctx, d.out.result, "DeleteDomainGroup");
7379
7380 return true;
7381 }
7382
7383 static bool test_TestPrivateFunctionsDomain(struct dcerpc_binding_handle *b,
7384 struct torture_context *tctx,
7385 struct policy_handle *domain_handle)
7386 {
7387 struct samr_TestPrivateFunctionsDomain r;
7388 bool ret = true;
7389
7390 torture_comment(tctx, "Testing TestPrivateFunctionsDomain\n");
7391
7392 r.in.domain_handle = domain_handle;
7393
7394 torture_assert_ntstatus_ok(tctx, dcerpc_samr_TestPrivateFunctionsDomain_r(b, tctx, &r),
7395 "TestPrivateFunctionsDomain failed");
7396 torture_assert_ntstatus_equal(tctx, r.out.result, NT_STATUS_NOT_IMPLEMENTED, "TestPrivateFunctionsDomain");
7397
7398 return ret;
7399 }
7400
7401 static bool test_RidToSid(struct dcerpc_binding_handle *b,
7402 struct torture_context *tctx,
7403 struct dom_sid *domain_sid,
7404 struct policy_handle *domain_handle)
7405 {
7406 struct samr_RidToSid r;
7407 bool ret = true;
7408 struct dom_sid *calc_sid, *out_sid;
7409 int rids[] = { 0, 42, 512, 10200 };
7410 int i;
7411
7412 for (i=0;i<ARRAY_SIZE(rids);i++) {
7413 torture_comment(tctx, "Testing RidToSid\n");
7414
7415 calc_sid = dom_sid_dup(tctx, domain_sid);
7416 r.in.domain_handle = domain_handle;
7417 r.in.rid = rids[i];
7418 r.out.sid = &out_sid;
7419
7420 torture_assert_ntstatus_ok(tctx, dcerpc_samr_RidToSid_r(b, tctx, &r),
7421 "RidToSid failed");
7422 if (!NT_STATUS_IS_OK(r.out.result)) {
7423 torture_result(tctx, TORTURE_FAIL, "RidToSid for %d failed - %s\n", rids[i], nt_errstr(r.out.result));
7424 ret = false;
7425 } else {
7426 calc_sid = dom_sid_add_rid(calc_sid, calc_sid, rids[i]);
7427
7428 if (!dom_sid_equal(calc_sid, out_sid)) {
7429 torture_result(tctx, TORTURE_FAIL, "RidToSid for %d failed - got %s, expected %s\n", rids[i],
7430 dom_sid_string(tctx, out_sid),
7431 dom_sid_string(tctx, calc_sid));
7432 ret = false;
7433 }
7434 }
7435 }
7436
7437 return ret;
7438 }
7439
7440 static bool test_GetBootKeyInformation(struct dcerpc_binding_handle *b,
7441 struct torture_context *tctx,
7442 struct policy_handle *domain_handle)
7443 {
7444 struct samr_GetBootKeyInformation r;
7445 bool ret = true;
7446 uint32_t unknown = 0;
7447 NTSTATUS status;
7448
7449 torture_comment(tctx, "Testing GetBootKeyInformation\n");
7450
7451 r.in.domain_handle = domain_handle;
7452 r.out.unknown = &unknown;
7453
7454 status = dcerpc_samr_GetBootKeyInformation_r(b, tctx, &r);
7455 if (NT_STATUS_IS_OK(status) && !NT_STATUS_IS_OK(r.out.result)) {
7456 status = r.out.result;
7457 }
7458 if (!NT_STATUS_IS_OK(status)) {
7459 /* w2k3 seems to fail this sometimes and pass it sometimes */
7460 torture_comment(tctx, "GetBootKeyInformation (ignored) - %s\n", nt_errstr(status));
7461 }
7462
7463 return ret;
7464 }
7465
7466 static bool test_AddGroupMember(struct dcerpc_binding_handle *b,
7467 struct torture_context *tctx,
7468 struct policy_handle *domain_handle,
7469 struct policy_handle *group_handle)
7470 {
7471 NTSTATUS status;
7472 struct samr_AddGroupMember r;
7473 struct samr_DeleteGroupMember d;
7474 struct samr_QueryGroupMember q;
7475 struct samr_RidAttrArray *rids = NULL;
7476 struct samr_SetMemberAttributesOfGroup s;
7477 uint32_t rid;
7478 bool found_member = false;
7479 int i;
7480
7481 status = test_LookupName(b, tctx, domain_handle, TEST_ACCOUNT_NAME, &rid);
7482 torture_assert_ntstatus_ok(tctx, status, "test_AddGroupMember looking up name " TEST_ACCOUNT_NAME);
7483
7484 r.in.group_handle = group_handle;
7485 r.in.rid = rid;
7486 r.in.flags = 0; /* ??? */
7487
7488 torture_comment(tctx, "Testing AddGroupMember, QueryGroupMember and DeleteGroupMember\n");
7489
7490 d.in.group_handle = group_handle;
7491 d.in.rid = rid;
7492
7493 torture_assert_ntstatus_ok(tctx, dcerpc_samr_DeleteGroupMember_r(b, tctx, &d),
7494 "DeleteGroupMember failed");
7495 torture_assert_ntstatus_equal(tctx, NT_STATUS_MEMBER_NOT_IN_GROUP, d.out.result, "DeleteGroupMember");
7496
7497 torture_assert_ntstatus_ok(tctx, dcerpc_samr_AddGroupMember_r(b, tctx, &r),
7498 "AddGroupMember failed");
7499 torture_assert_ntstatus_ok(tctx, r.out.result, "AddGroupMember");
7500
7501 torture_assert_ntstatus_ok(tctx, dcerpc_samr_AddGroupMember_r(b, tctx, &r),
7502 "AddGroupMember failed");
7503 torture_assert_ntstatus_equal(tctx, NT_STATUS_MEMBER_IN_GROUP, r.out.result, "AddGroupMember");
7504
7505 if (torture_setting_bool(tctx, "samba4", false) ||
7506 torture_setting_bool(tctx, "samba3", false)) {
7507 torture_comment(tctx, "skipping SetMemberAttributesOfGroup test against Samba\n");
7508 } else {
7509 /* this one is quite strange. I am using random inputs in the
7510 hope of triggering an error that might give us a clue */
7511
7512 s.in.group_handle = group_handle;
7513 s.in.unknown1 = random();
7514 s.in.unknown2 = random();
7515
7516 torture_assert_ntstatus_ok(tctx, dcerpc_samr_SetMemberAttributesOfGroup_r(b, tctx, &s),
7517 "SetMemberAttributesOfGroup failed");
7518 torture_assert_ntstatus_ok(tctx, s.out.result, "SetMemberAttributesOfGroup");
7519 }
7520
7521 q.in.group_handle = group_handle;
7522 q.out.rids = &rids;
7523
7524 torture_assert_ntstatus_ok(tctx, dcerpc_samr_QueryGroupMember_r(b, tctx, &q),
7525 "QueryGroupMember failed");
7526 torture_assert_ntstatus_ok(tctx, q.out.result, "QueryGroupMember");
7527 torture_assert(tctx, rids, "QueryGroupMember did not fill in rids structure");
7528
7529 for (i=0; i < rids->count; i++) {
7530 if (rids->rids[i] == rid) {
7531 found_member = true;
7532 }
7533 }
7534
7535 torture_assert(tctx, found_member, "QueryGroupMember did not list newly added member");
7536
7537 torture_assert_ntstatus_ok(tctx, dcerpc_samr_DeleteGroupMember_r(b, tctx, &d),
7538 "DeleteGroupMember failed");
7539 torture_assert_ntstatus_ok(tctx, d.out.result, "DeleteGroupMember");
7540
7541 rids = NULL;
7542 found_member = false;
7543
7544 torture_assert_ntstatus_ok(tctx, dcerpc_samr_QueryGroupMember_r(b, tctx, &q),
7545 "QueryGroupMember failed");
7546 torture_assert_ntstatus_ok(tctx, q.out.result, "QueryGroupMember");
7547 torture_assert(tctx, rids, "QueryGroupMember did not fill in rids structure");
7548
7549 for (i=0; i < rids->count; i++) {
7550 if (rids->rids[i] == rid) {
7551 found_member = true;
7552 }
7553 }
7554
7555 torture_assert(tctx, !found_member, "QueryGroupMember does still list removed member");
7556
7557 torture_assert_ntstatus_ok(tctx, dcerpc_samr_AddGroupMember_r(b, tctx, &r),
7558 "AddGroupMember failed");
7559 torture_assert_ntstatus_ok(tctx, r.out.result, "AddGroupMember");
7560
7561 return true;
7562 }
7563
7564
7565 static bool test_CreateDomainGroup(struct dcerpc_binding_handle *b,
7566 struct torture_context *tctx,
7567 struct policy_handle *domain_handle,
7568 const char *group_name,
7569 struct policy_handle *group_handle,
7570 struct dom_sid *domain_sid,
7571 bool test_group)
7572 {
7573 struct samr_CreateDomainGroup r;
7574 uint32_t rid;
7575 struct lsa_String name;
7576 bool ret = true;
7577
7578 init_lsa_String(&name, group_name);
7579
7580 r.in.domain_handle = domain_handle;
7581 r.in.name = &name;
7582 r.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
7583 r.out.group_handle = group_handle;
7584 r.out.rid = &rid;
7585
7586 torture_comment(tctx, "Testing CreateDomainGroup(%s)\n", r.in.name->string);
7587
7588 torture_assert_ntstatus_ok(tctx, dcerpc_samr_CreateDomainGroup_r(b, tctx, &r),
7589 "CreateDomainGroup failed");
7590
7591 if (dom_sid_equal(domain_sid, dom_sid_parse_talloc(tctx, SID_BUILTIN))) {
7592 if (NT_STATUS_EQUAL(r.out.result, NT_STATUS_ACCESS_DENIED)) {
7593 torture_comment(tctx, "Server correctly refused create of '%s'\n", r.in.name->string);
7594 return true;
7595 } else {
7596 torture_result(tctx, TORTURE_FAIL, "Server should have refused create of '%s', got %s instead\n", r.in.name->string,
7597 nt_errstr(r.out.result));
7598 return false;
7599 }
7600 }
7601
7602 if (NT_STATUS_EQUAL(r.out.result, NT_STATUS_GROUP_EXISTS)) {
7603 if (!test_DeleteGroup_byname(b, tctx, domain_handle, r.in.name->string)) {
7604 torture_result(tctx, TORTURE_FAIL, "CreateDomainGroup failed: Could not delete domain group %s - %s\n", r.in.name->string,
7605 nt_errstr(r.out.result));
7606 return false;
7607 }
7608 torture_assert_ntstatus_ok(tctx, dcerpc_samr_CreateDomainGroup_r(b, tctx, &r),
7609 "CreateDomainGroup failed");
7610 }
7611 if (NT_STATUS_EQUAL(r.out.result, NT_STATUS_USER_EXISTS)) {
7612 if (!test_DeleteUser_byname(b, tctx, domain_handle, r.in.name->string)) {
7613
7614 torture_result(tctx, TORTURE_FAIL, "CreateDomainGroup failed: Could not delete user %s - %s\n", r.in.name->string,
7615 nt_errstr(r.out.result));
7616 return false;
7617 }
7618 torture_assert_ntstatus_ok(tctx, dcerpc_samr_CreateDomainGroup_r(b, tctx, &r),
7619 "CreateDomainGroup failed");
7620 }
7621 torture_assert_ntstatus_ok(tctx, r.out.result, "CreateDomainGroup");
7622
7623 if (!test_group) {
7624 return ret;
7625 }
7626
7627 if (!test_AddGroupMember(b, tctx, domain_handle, group_handle)) {
7628 torture_result(tctx, TORTURE_FAIL, "CreateDomainGroup failed - %s\n", nt_errstr(r.out.result));
7629 ret = false;
7630 }
7631
7632 if (!test_SetGroupInfo(b, tctx, group_handle)) {
7633 ret = false;
7634 }
7635
7636 return ret;
7637 }
7638
7639
7640 /*
7641 its not totally clear what this does. It seems to accept any sid you like.
7642 */
7643 static bool test_RemoveMemberFromForeignDomain(struct dcerpc_binding_handle *b,
7644 struct torture_context *tctx,
7645 struct policy_handle *domain_handle)
7646 {
7647 struct samr_RemoveMemberFromForeignDomain r;
7648
7649 r.in.domain_handle = domain_handle;
7650 r.in.sid = dom_sid_parse_talloc(tctx, "S-1-5-32-12-34-56-78");
7651
7652 torture_assert_ntstatus_ok(tctx, dcerpc_samr_RemoveMemberFromForeignDomain_r(b, tctx, &r),
7653 "RemoveMemberFromForeignDomain failed");
7654 torture_assert_ntstatus_ok(tctx, r.out.result, "RemoveMemberFromForeignDomain");
7655
7656 return true;
7657 }
7658
7659 static bool test_EnumDomainUsers(struct dcerpc_binding_handle *b,
7660 struct torture_context *tctx,
7661 struct policy_handle *domain_handle,
7662 uint32_t *total_num_entries_p)
7663 {
7664 NTSTATUS status;
7665 struct samr_EnumDomainUsers r;
7666 uint32_t resume_handle = 0;
7667 uint32_t num_entries = 0;
7668 uint32_t total_num_entries = 0;
7669 struct samr_SamArray *sam;
7670
7671 r.in.domain_handle = domain_handle;
7672 r.in.acct_flags = 0;
7673 r.in.max_size = (uint32_t)-1;
7674 r.in.resume_handle = &resume_handle;
7675
7676 r.out.sam = &sam;
7677 r.out.num_entries = &num_entries;
7678 r.out.resume_handle = &resume_handle;
7679
7680 torture_comment(tctx, "Testing EnumDomainUsers\n");
7681
7682 do {
7683 torture_assert_ntstatus_ok(tctx, dcerpc_samr_EnumDomainUsers_r(b, tctx, &r),
7684 "EnumDomainUsers failed");
7685 if (NT_STATUS_IS_ERR(r.out.result)) {
7686 torture_assert_ntstatus_ok(tctx, r.out.result,
7687 "failed to enumerate users");
7688 }
7689 status = r.out.result;
7690
7691 total_num_entries += num_entries;
7692 } while (NT_STATUS_EQUAL(status, STATUS_MORE_ENTRIES));
7693
7694 if (total_num_entries_p) {
7695 *total_num_entries_p = total_num_entries;
7696 }
7697
7698 return true;
7699 }
7700
7701 static bool test_EnumDomainGroups(struct dcerpc_binding_handle *b,
7702 struct torture_context *tctx,
7703 struct policy_handle *domain_handle,
7704 uint32_t *total_num_entries_p)
7705 {
7706 NTSTATUS status;
7707 struct samr_EnumDomainGroups r;
7708 uint32_t resume_handle = 0;
7709 uint32_t num_entries = 0;
7710 uint32_t total_num_entries = 0;
7711 struct samr_SamArray *sam;
7712
7713 r.in.domain_handle = domain_handle;
7714 r.in.max_size = (uint32_t)-1;
7715 r.in.resume_handle = &resume_handle;
7716
7717 r.out.sam = &sam;
7718 r.out.num_entries = &num_entries;
7719 r.out.resume_handle = &resume_handle;
7720
7721 torture_comment(tctx, "Testing EnumDomainGroups\n");
7722
7723 do {
7724 torture_assert_ntstatus_ok(tctx, dcerpc_samr_EnumDomainGroups_r(b, tctx, &r),
7725 "EnumDomainGroups failed");
7726 if (NT_STATUS_IS_ERR(r.out.result)) {
7727 torture_assert_ntstatus_ok(tctx, r.out.result,
7728 "failed to enumerate groups");
7729 }
7730 status = r.out.result;
7731
7732 total_num_entries += num_entries;
7733 } while (NT_STATUS_EQUAL(status, STATUS_MORE_ENTRIES));
7734
7735 if (total_num_entries_p) {
7736 *total_num_entries_p = total_num_entries;
7737 }
7738
7739 return true;
7740 }
7741
7742 static bool test_EnumDomainAliases(struct dcerpc_binding_handle *b,
7743 struct torture_context *tctx,
7744 struct policy_handle *domain_handle,
7745 uint32_t *total_num_entries_p)
7746 {
7747 NTSTATUS status;
7748 struct samr_EnumDomainAliases r;
7749 uint32_t resume_handle = 0;
7750 uint32_t num_entries = 0;
7751 uint32_t total_num_entries = 0;
7752 struct samr_SamArray *sam;
7753
7754 r.in.domain_handle = domain_handle;
7755 r.in.max_size = (uint32_t)-1;
7756 r.in.resume_handle = &resume_handle;
7757
7758 r.out.sam = &sam;
7759 r.out.num_entries = &num_entries;
7760 r.out.resume_handle = &resume_handle;
7761
7762 torture_comment(tctx, "Testing EnumDomainAliases\n");
7763
7764 do {
7765 torture_assert_ntstatus_ok(tctx, dcerpc_samr_EnumDomainAliases_r(b, tctx, &r),
7766 "EnumDomainAliases failed");
7767 if (NT_STATUS_IS_ERR(r.out.result)) {
7768 torture_assert_ntstatus_ok(tctx, r.out.result,
7769 "failed to enumerate aliases");
7770 }
7771 status = r.out.result;
7772
7773 total_num_entries += num_entries;
7774 } while (NT_STATUS_EQUAL(status, STATUS_MORE_ENTRIES));
7775
7776 if (total_num_entries_p) {
7777 *total_num_entries_p = total_num_entries;
7778 }
7779
7780 return true;
7781 }
7782
7783 static bool test_QueryDisplayInfo_level(struct dcerpc_binding_handle *b,
7784 struct torture_context *tctx,
7785 struct policy_handle *handle,
7786 uint16_t level,
7787 uint32_t *total_num_entries_p)
7788 {
7789 NTSTATUS status;
7790 struct samr_QueryDisplayInfo r;
7791 uint32_t total_num_entries = 0;
7792
7793 r.in.domain_handle = handle;
7794 r.in.level = level;
7795 r.in.start_idx = 0;
7796 r.in.max_entries = (uint32_t)-1;
7797 r.in.buf_size = (uint32_t)-1;
7798
7799 torture_comment(tctx, "Testing QueryDisplayInfo\n");
7800
7801 do {
7802 uint32_t total_size;
7803 uint32_t returned_size;
7804 union samr_DispInfo info;
7805
7806 r.out.total_size = &total_size;
7807 r.out.returned_size = &returned_size;
7808 r.out.info = &info;
7809
7810 torture_assert_ntstatus_ok(tctx, dcerpc_samr_QueryDisplayInfo_r(b, tctx, &r),
7811 "failed to query displayinfo");
7812 if (NT_STATUS_IS_ERR(r.out.result)) {
7813 torture_assert_ntstatus_ok(tctx, r.out.result,
7814 "failed to query displayinfo");
7815 }
7816 status = r.out.result;
7817
7818 if (*r.out.returned_size == 0) {
7819 break;
7820 }
7821
7822 switch (r.in.level) {
7823 case 1:
7824 total_num_entries += info.info1.count;
7825 r.in.start_idx += info.info1.entries[info.info1.count - 1].idx + 1;
7826 break;
7827 case 2:
7828 total_num_entries += info.info2.count;
7829 r.in.start_idx += info.info2.entries[info.info2.count - 1].idx + 1;
7830 break;
7831 case 3:
7832 total_num_entries += info.info3.count;
7833 r.in.start_idx += info.info3.entries[info.info3.count - 1].idx + 1;
7834 break;
7835 case 4:
7836 total_num_entries += info.info4.count;
7837 r.in.start_idx += info.info4.entries[info.info4.count - 1].idx + 1;
7838 break;
7839 case 5:
7840 total_num_entries += info.info5.count;
7841 r.in.start_idx += info.info5.entries[info.info5.count - 1].idx + 1;
7842 break;
7843 default:
7844 return false;
7845 }
7846
7847 } while (NT_STATUS_EQUAL(status, STATUS_MORE_ENTRIES));
7848
7849 if (total_num_entries_p) {
7850 *total_num_entries_p = total_num_entries;
7851 }
7852
7853 return true;
7854 }
7855
7856 static bool test_ManyObjects(struct dcerpc_pipe *p,
7857 struct torture_context *tctx,
7858 struct policy_handle *domain_handle,
7859 struct dom_sid *domain_sid,
7860 struct torture_samr_context *ctx)
7861 {
7862 uint32_t num_total = ctx->num_objects_large_dc;
7863 uint32_t num_enum = 0;
7864 uint32_t num_disp = 0;
7865 uint32_t num_created = 0;
7866 uint32_t num_anounced = 0;
7867 uint32_t i;
7868 struct dcerpc_binding_handle *b = p->binding_handle;
7869
7870 struct policy_handle *handles = talloc_zero_array(tctx, struct policy_handle, num_total);
7871
7872 /* query */
7873
7874 {
7875 struct samr_QueryDomainInfo2 r;
7876 union samr_DomainInfo *info;
7877 r.in.domain_handle = domain_handle;
7878 r.in.level = 2;
7879 r.out.info = &info;
7880
7881 torture_assert_ntstatus_ok(tctx, dcerpc_samr_QueryDomainInfo2_r(b, tctx, &r),
7882 "QueryDomainInfo2 failed");
7883 torture_assert_ntstatus_ok(tctx, r.out.result,
7884 "failed to query domain info");
7885
7886 switch (ctx->choice) {
7887 case TORTURE_SAMR_MANY_ACCOUNTS:
7888 num_anounced = info->general.num_users;
7889 break;
7890 case TORTURE_SAMR_MANY_GROUPS:
7891 num_anounced = info->general.num_groups;
7892 break;
7893 case TORTURE_SAMR_MANY_ALIASES:
7894 num_anounced = info->general.num_aliases;
7895 break;
7896 default:
7897 return false;
7898 }
7899 }
7900
7901 /* create */
7902
7903 for (i=0; i < num_total; i++) {
7904
7905 const char *name = NULL;
7906
7907 switch (ctx->choice) {
7908 case TORTURE_SAMR_MANY_ACCOUNTS:
7909 name = talloc_asprintf(tctx, "%s%04d", TEST_ACCOUNT_NAME, i);
7910 torture_assert(tctx,
7911 test_CreateUser(p, tctx, domain_handle, name, &handles[i], domain_sid, 0, NULL, false),
7912 "failed to create user");
7913 break;
7914 case TORTURE_SAMR_MANY_GROUPS:
7915 name = talloc_asprintf(tctx, "%s%04d", TEST_GROUPNAME, i);
7916 torture_assert(tctx,
7917 test_CreateDomainGroup(b, tctx, domain_handle, name, &handles[i], domain_sid, false),
7918 "failed to create group");
7919 break;
7920 case TORTURE_SAMR_MANY_ALIASES:
7921 name = talloc_asprintf(tctx, "%s%04d", TEST_ALIASNAME, i);
7922 torture_assert(tctx,
7923 test_CreateAlias(b, tctx, domain_handle, name, &handles[i], domain_sid, false),
7924 "failed to create alias");
7925 break;
7926 default:
7927 return false;
7928 }
7929 if (!ndr_policy_handle_empty(&handles[i])) {
7930 num_created++;
7931 }
7932 }
7933
7934 /* enum */
7935
7936 switch (ctx->choice) {
7937 case TORTURE_SAMR_MANY_ACCOUNTS:
7938 torture_assert(tctx,
7939 test_EnumDomainUsers(b, tctx, domain_handle, &num_enum),
7940 "failed to enum users");
7941 break;
7942 case TORTURE_SAMR_MANY_GROUPS:
7943 torture_assert(tctx,
7944 test_EnumDomainGroups(b, tctx, domain_handle, &num_enum),
7945 "failed to enum groups");
7946 break;
7947 case TORTURE_SAMR_MANY_ALIASES:
7948 torture_assert(tctx,
7949 test_EnumDomainAliases(b, tctx, domain_handle, &num_enum),
7950 "failed to enum aliases");
7951 break;
7952 default:
7953 return false;
7954 }
7955
7956 /* dispinfo */
7957
7958 switch (ctx->choice) {
7959 case TORTURE_SAMR_MANY_ACCOUNTS:
7960 torture_assert(tctx,
7961 test_QueryDisplayInfo_level(b, tctx, domain_handle, 1, &num_disp),
7962 "failed to query display info");
7963 break;
7964 case TORTURE_SAMR_MANY_GROUPS:
7965 torture_assert(tctx,
7966 test_QueryDisplayInfo_level(b, tctx, domain_handle, 3, &num_disp),
7967 "failed to query display info");
7968 break;
7969 case TORTURE_SAMR_MANY_ALIASES:
7970 /* no aliases in dispinfo */
7971 break;
7972 default:
7973 return false;
7974 }
7975
7976 /* close or delete */
7977
7978 for (i=0; i < num_total; i++) {
7979
7980 if (ndr_policy_handle_empty(&handles[i])) {
7981 continue;
7982 }
7983
7984 if (torture_setting_bool(tctx, "samba3", false)) {
7985 torture_assert(tctx,
7986 test_samr_handle_Close(b, tctx, &handles[i]),
7987 "failed to close handle");
7988 } else {
7989 switch (ctx->choice) {
7990 case TORTURE_SAMR_MANY_ACCOUNTS:
7991 torture_assert(tctx,
7992 test_DeleteUser(b, tctx, &handles[i]),
7993 "failed to delete user");
7994 break;
7995 case TORTURE_SAMR_MANY_GROUPS:
7996 torture_assert(tctx,
7997 test_DeleteDomainGroup(b, tctx, &handles[i]),
7998 "failed to delete group");
7999 break;
8000 case TORTURE_SAMR_MANY_ALIASES:
8001 torture_assert(tctx,
8002 test_DeleteAlias(b, tctx, &handles[i]),
8003 "failed to delete alias");
8004 break;
8005 default:
8006 return false;
8007 }
8008 }
8009 }
8010
8011 talloc_free(handles);
8012
8013 if (ctx->choice == TORTURE_SAMR_MANY_ACCOUNTS && num_enum != num_anounced + num_created) {
8014 torture_comment(tctx,
8015 "unexpected number of results (%u) returned in enum call, expected %u\n",
8016 num_enum, num_anounced + num_created);
8017
8018 torture_comment(tctx,
8019 "unexpected number of results (%u) returned in dispinfo, call, expected %u\n",
8020 num_disp, num_anounced + num_created);
8021 }
8022
8023 return true;
8024 }
8025
8026 static bool test_Connect(struct dcerpc_binding_handle *b,
8027 struct torture_context *tctx,
8028 struct policy_handle *handle);
8029
8030 static bool test_OpenDomain(struct dcerpc_pipe *p, struct torture_context *tctx,
8031 struct torture_samr_context *ctx, struct dom_sid *sid)
8032 {
8033 struct samr_OpenDomain r;
8034 struct policy_handle domain_handle;
8035 struct policy_handle alias_handle;
8036 struct policy_handle user_handle;
8037 struct policy_handle group_handle;
8038 bool ret = true;
8039 struct dcerpc_binding_handle *b = p->binding_handle;
8040
8041 ZERO_STRUCT(alias_handle);
8042 ZERO_STRUCT(user_handle);
8043 ZERO_STRUCT(group_handle);
8044 ZERO_STRUCT(domain_handle);
8045
8046 torture_comment(tctx, "Testing OpenDomain of %s\n", dom_sid_string(tctx, sid));
8047
8048 r.in.connect_handle = &ctx->handle;
8049 r.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
8050 r.in.sid = sid;
8051 r.out.domain_handle = &domain_handle;
8052
8053 torture_assert_ntstatus_ok(tctx, dcerpc_samr_OpenDomain_r(b, tctx, &r),
8054 "OpenDomain failed");
8055 torture_assert_ntstatus_ok(tctx, r.out.result, "OpenDomain failed");
8056
8057 /* run the domain tests with the main handle closed - this tests
8058 the servers reference counting */
8059 torture_assert(tctx, test_samr_handle_Close(b, tctx, &ctx->handle), "Failed to close SAMR handle");
8060
8061 switch (ctx->choice) {
8062 case TORTURE_SAMR_PASSWORDS:
8063 case TORTURE_SAMR_USER_PRIVILEGES:
8064 if (!torture_setting_bool(tctx, "samba3", false)) {
8065 ret &= test_CreateUser2(p, tctx, &domain_handle, sid, ctx->choice, NULL);
8066 }
8067 ret &= test_CreateUser(p, tctx, &domain_handle, TEST_ACCOUNT_NAME, &user_handle, sid, ctx->choice, NULL, true);
8068 if (!ret) {
8069 torture_result(tctx, TORTURE_FAIL, "Testing PASSWORDS or PRIVILEGES on domain %s failed!\n", dom_sid_string(tctx, sid));
8070 }
8071 break;
8072 case TORTURE_SAMR_USER_ATTRIBUTES:
8073 if (!torture_setting_bool(tctx, "samba3", false)) {
8074 ret &= test_CreateUser2(p, tctx, &domain_handle, sid, ctx->choice, NULL);
8075 }
8076 ret &= test_CreateUser(p, tctx, &domain_handle, TEST_ACCOUNT_NAME, &user_handle, sid, ctx->choice, NULL, true);
8077 /* This test needs 'complex' users to validate */
8078 ret &= test_QueryDisplayInfo(b, tctx, &domain_handle);
8079 if (!ret) {
8080 torture_result(tctx, TORTURE_FAIL, "Testing ATTRIBUTES on domain %s failed!\n", dom_sid_string(tctx, sid));
8081 }
8082 break;
8083 case TORTURE_SAMR_PASSWORDS_PWDLASTSET:
8084 case TORTURE_SAMR_PASSWORDS_BADPWDCOUNT:
8085 case TORTURE_SAMR_PASSWORDS_LOCKOUT:
8086 if (!torture_setting_bool(tctx, "samba3", false)) {
8087 ret &= test_CreateUser2(p, tctx, &domain_handle, sid, ctx->choice, ctx->machine_credentials);
8088 }
8089 ret &= test_CreateUser(p, tctx, &domain_handle, TEST_ACCOUNT_NAME, &user_handle, sid, ctx->choice, ctx->machine_credentials, true);
8090 if (!ret) {
8091 torture_result(tctx, TORTURE_FAIL, "Testing PASSWORDS PWDLASTSET or BADPWDCOUNT on domain %s failed!\n", dom_sid_string(tctx, sid));
8092 }
8093 break;
8094 case TORTURE_SAMR_MANY_ACCOUNTS:
8095 case TORTURE_SAMR_MANY_GROUPS:
8096 case TORTURE_SAMR_MANY_ALIASES:
8097 ret &= test_ManyObjects(p, tctx, &domain_handle, sid, ctx);
8098 if (!ret) {
8099 torture_result(tctx, TORTURE_FAIL, "Testing MANY-{ACCOUNTS,GROUPS,ALIASES} on domain %s failed!\n", dom_sid_string(tctx, sid));
8100 }
8101 break;
8102 case TORTURE_SAMR_OTHER:
8103 ret &= test_CreateUser(p, tctx, &domain_handle, TEST_ACCOUNT_NAME, &user_handle, sid, ctx->choice, NULL, true);
8104 if (!ret) {
8105 torture_result(tctx, TORTURE_FAIL, "Failed to CreateUser in SAMR-OTHER on domain %s!\n", dom_sid_string(tctx, sid));
8106 }
8107 if (!torture_setting_bool(tctx, "samba3", false)) {
8108 ret &= test_QuerySecurity(b, tctx, &domain_handle);
8109 }
8110 ret &= test_RemoveMemberFromForeignDomain(b, tctx, &domain_handle);
8111 ret &= test_CreateAlias(b, tctx, &domain_handle, TEST_ALIASNAME, &alias_handle, sid, true);
8112 ret &= test_CreateDomainGroup(b, tctx, &domain_handle, TEST_GROUPNAME, &group_handle, sid, true);
8113 ret &= test_GetAliasMembership(b, tctx, &domain_handle);
8114 ret &= test_QueryDomainInfo(p, tctx, &domain_handle);
8115 ret &= test_QueryDomainInfo2(b, tctx, &domain_handle);
8116 ret &= test_EnumDomainUsers_all(b, tctx, &domain_handle);
8117 ret &= test_EnumDomainUsers_async(p, tctx, &domain_handle);
8118 ret &= test_EnumDomainGroups_all(b, tctx, &domain_handle);
8119 ret &= test_EnumDomainAliases_all(b, tctx, &domain_handle);
8120 ret &= test_QueryDisplayInfo2(b, tctx, &domain_handle);
8121 ret &= test_QueryDisplayInfo3(b, tctx, &domain_handle);
8122 ret &= test_QueryDisplayInfo_continue(b, tctx, &domain_handle);
8123
8124 if (torture_setting_bool(tctx, "samba4", false)) {
8125 torture_comment(tctx, "skipping GetDisplayEnumerationIndex test against Samba4\n");
8126 } else {
8127 ret &= test_GetDisplayEnumerationIndex(b, tctx, &domain_handle);
8128 ret &= test_GetDisplayEnumerationIndex2(b, tctx, &domain_handle);
8129 }
8130 ret &= test_GroupList(b, tctx, sid, &domain_handle);
8131 ret &= test_TestPrivateFunctionsDomain(b, tctx, &domain_handle);
8132 ret &= test_RidToSid(b, tctx, sid, &domain_handle);
8133 ret &= test_GetBootKeyInformation(b, tctx, &domain_handle);
8134 if (!ret) {
8135 torture_comment(tctx, "Testing SAMR-OTHER on domain %s failed!\n", dom_sid_string(tctx, sid));
8136 }
8137 break;
8138 }
8139
8140 if (!ndr_policy_handle_empty(&user_handle) &&
8141 !test_DeleteUser(b, tctx, &user_handle)) {
8142 ret = false;
8143 }
8144
8145 if (!ndr_policy_handle_empty(&alias_handle) &&
8146 !test_DeleteAlias(b, tctx, &alias_handle)) {
8147 ret = false;
8148 }
8149
8150 if (!ndr_policy_handle_empty(&group_handle) &&
8151 !test_DeleteDomainGroup(b, tctx, &group_handle)) {
8152 ret = false;
8153 }
8154
8155 torture_assert(tctx, test_samr_handle_Close(b, tctx, &domain_handle), "Failed to close SAMR domain handle");
8156
8157 torture_assert(tctx, test_Connect(b, tctx, &ctx->handle), "Faile to re-connect SAMR handle");
8158 /* reconnect the main handle */
8159
8160 if (!ret) {
8161 torture_result(tctx, TORTURE_FAIL, "Testing domain %s failed!\n", dom_sid_string(tctx, sid));
8162 }
8163
8164 return ret;
8165 }
8166
8167 static bool test_LookupDomain(struct dcerpc_pipe *p, struct torture_context *tctx,
8168 struct torture_samr_context *ctx, const char *domain)
8169 {
8170 struct samr_LookupDomain r;
8171 struct dom_sid2 *sid = NULL;
8172 struct lsa_String n1;
8173 struct lsa_String n2;
8174 bool ret = true;
8175 struct dcerpc_binding_handle *b = p->binding_handle;
8176
8177 torture_comment(tctx, "Testing LookupDomain(%s)\n", domain);
8178
8179 /* check for correct error codes */
8180 r.in.connect_handle = &ctx->handle;
8181 r.in.domain_name = &n2;
8182 r.out.sid = &sid;
8183 n2.string = NULL;
8184
8185 torture_assert_ntstatus_ok(tctx, dcerpc_samr_LookupDomain_r(b, tctx, &r),
8186 "LookupDomain failed");
8187 torture_assert_ntstatus_equal(tctx, NT_STATUS_INVALID_PARAMETER, r.out.result, "LookupDomain expected NT_STATUS_INVALID_PARAMETER");
8188
8189 init_lsa_String(&n2, "xxNODOMAINxx");
8190
8191 torture_assert_ntstatus_ok(tctx, dcerpc_samr_LookupDomain_r(b, tctx, &r),
8192 "LookupDomain failed");
8193 torture_assert_ntstatus_equal(tctx, NT_STATUS_NO_SUCH_DOMAIN, r.out.result, "LookupDomain expected NT_STATUS_NO_SUCH_DOMAIN");
8194
8195 r.in.connect_handle = &ctx->handle;
8196
8197 init_lsa_String(&n1, domain);
8198 r.in.domain_name = &n1;
8199
8200 torture_assert_ntstatus_ok(tctx, dcerpc_samr_LookupDomain_r(b, tctx, &r),
8201 "LookupDomain failed");
8202 torture_assert_ntstatus_ok(tctx, r.out.result, "LookupDomain");
8203
8204 if (!test_GetDomPwInfo(p, tctx, &n1)) {
8205 ret = false;
8206 }
8207
8208 if (!test_OpenDomain(p, tctx, ctx, *r.out.sid)) {
8209 ret = false;
8210 }
8211
8212 return ret;
8213 }
8214
8215
8216 static bool test_EnumDomains(struct dcerpc_pipe *p, struct torture_context *tctx,
8217 struct torture_samr_context *ctx)
8218 {
8219 struct samr_EnumDomains r;
8220 uint32_t resume_handle = 0;
8221 uint32_t num_entries = 0;
8222 struct samr_SamArray *sam = NULL;
8223 int i;
8224 bool ret = true;
8225 struct dcerpc_binding_handle *b = p->binding_handle;
8226
8227 r.in.connect_handle = &ctx->handle;
8228 r.in.resume_handle = &resume_handle;
8229 r.in.buf_size = (uint32_t)-1;
8230 r.out.resume_handle = &resume_handle;
8231 r.out.num_entries = &num_entries;
8232 r.out.sam = &sam;
8233
8234 torture_assert_ntstatus_ok(tctx, dcerpc_samr_EnumDomains_r(b, tctx, &r),
8235 "EnumDomains failed");
8236 torture_assert_ntstatus_ok(tctx, r.out.result, "EnumDomains failed");
8237
8238 if (!*r.out.sam) {
8239 return false;
8240 }
8241
8242 for (i=0;i<sam->count;i++) {
8243 if (!test_LookupDomain(p, tctx, ctx,
8244 sam->entries[i].name.string)) {
8245 ret = false;
8246 }
8247 }
8248
8249 torture_assert_ntstatus_ok(tctx, dcerpc_samr_EnumDomains_r(b, tctx, &r),
8250 "EnumDomains failed");
8251 torture_assert_ntstatus_ok(tctx, r.out.result, "EnumDomains failed");
8252
8253 return ret;
8254 }
8255
8256
8257 static bool test_Connect(struct dcerpc_binding_handle *b,
8258 struct torture_context *tctx,
8259 struct policy_handle *handle)
8260 {
8261 struct samr_Connect r;
8262 struct samr_Connect2 r2;
8263 struct samr_Connect3 r3;
8264 struct samr_Connect4 r4;
8265 struct samr_Connect5 r5;
8266 union samr_ConnectInfo info;
8267 struct policy_handle h;
8268 uint32_t level_out = 0;
8269 bool ret = true, got_handle = false;
8270
8271 torture_comment(tctx, "Testing samr_Connect\n");
8272
8273 r.in.system_name = NULL;
8274 r.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
8275 r.out.connect_handle = &h;
8276
8277 torture_assert_ntstatus_ok(tctx, dcerpc_samr_Connect_r(b, tctx, &r),
8278 "Connect failed");
8279 if (!NT_STATUS_IS_OK(r.out.result)) {
8280 torture_comment(tctx, "Connect failed - %s\n", nt_errstr(r.out.result));
8281 ret = false;
8282 } else {
8283 got_handle = true;
8284 *handle = h;
8285 }
8286
8287 torture_comment(tctx, "Testing samr_Connect2\n");
8288
8289 r2.in.system_name = NULL;
8290 r2.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
8291 r2.out.connect_handle = &h;
8292
8293 torture_assert_ntstatus_ok(tctx, dcerpc_samr_Connect2_r(b, tctx, &r2),
8294 "Connect2 failed");
8295 if (!NT_STATUS_IS_OK(r2.out.result)) {
8296 torture_comment(tctx, "Connect2 failed - %s\n", nt_errstr(r2.out.result));
8297 ret = false;
8298 } else {
8299 if (got_handle) {
8300 test_samr_handle_Close(b, tctx, handle);
8301 }
8302 got_handle = true;
8303 *handle = h;
8304 }
8305
8306 torture_comment(tctx, "Testing samr_Connect3\n");
8307
8308 r3.in.system_name = NULL;
8309 r3.in.unknown = 0;
8310 r3.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
8311 r3.out.connect_handle = &h;
8312
8313 torture_assert_ntstatus_ok(tctx, dcerpc_samr_Connect3_r(b, tctx, &r3),
8314 "Connect3 failed");
8315 if (!NT_STATUS_IS_OK(r3.out.result)) {
8316 torture_result(tctx, TORTURE_FAIL, "Connect3 failed - %s\n", nt_errstr(r3.out.result));
8317 ret = false;
8318 } else {
8319 if (got_handle) {
8320 test_samr_handle_Close(b, tctx, handle);
8321 }
8322 got_handle = true;
8323 *handle = h;
8324 }
8325
8326 torture_comment(tctx, "Testing samr_Connect4\n");
8327
8328 r4.in.system_name = "";
8329 r4.in.client_version = 0;
8330 r4.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
8331 r4.out.connect_handle = &h;
8332
8333 torture_assert_ntstatus_ok(tctx, dcerpc_samr_Connect4_r(b, tctx, &r4),
8334 "Connect4 failed");
8335 if (!NT_STATUS_IS_OK(r4.out.result)) {
8336 torture_result(tctx, TORTURE_FAIL, "Connect4 failed - %s\n", nt_errstr(r4.out.result));
8337 ret = false;
8338 } else {
8339 if (got_handle) {
8340 test_samr_handle_Close(b, tctx, handle);
8341 }
8342 got_handle = true;
8343 *handle = h;
8344 }
8345
8346 torture_comment(tctx, "Testing samr_Connect5\n");
8347
8348 info.info1.client_version = 0;
8349 info.info1.unknown2 = 0;
8350
8351 r5.in.system_name = "";
8352 r5.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
8353 r5.in.level_in = 1;
8354 r5.out.level_out = &level_out;
8355 r5.in.info_in = &info;
8356 r5.out.info_out = &info;
8357 r5.out.connect_handle = &h;
8358
8359 torture_assert_ntstatus_ok(tctx, dcerpc_samr_Connect5_r(b, tctx, &r5),
8360 "Connect5 failed");
8361 if (!NT_STATUS_IS_OK(r5.out.result)) {
8362 torture_result(tctx, TORTURE_FAIL, "Connect5 failed - %s\n", nt_errstr(r5.out.result));
8363 ret = false;
8364 } else {
8365 if (got_handle) {
8366 test_samr_handle_Close(b, tctx, handle);
8367 }
8368 got_handle = true;
8369 *handle = h;
8370 }
8371
8372 return ret;
8373 }
8374
8375
8376 static bool test_samr_ValidatePassword(struct torture_context *tctx,
8377 struct dcerpc_pipe *p)
8378 {
8379 struct samr_ValidatePassword r;
8380 union samr_ValidatePasswordReq req;
8381 union samr_ValidatePasswordRep *repp = NULL;
8382 NTSTATUS status;
8383 const char *passwords[] = { "penguin", "p@ssw0rd", "p@ssw0rd123$", NULL };
8384 int i;
8385 struct dcerpc_binding_handle *b = p->binding_handle;
8386
8387 torture_comment(tctx, "Testing samr_ValidatePassword\n");
8388
8389 if (p->conn->transport.transport != NCACN_IP_TCP) {
8390 torture_comment(tctx, "samr_ValidatePassword only should succeed over NCACN_IP_TCP!\n");
8391 }
8392
8393 ZERO_STRUCT(r);
8394 r.in.level = NetValidatePasswordReset;
8395 r.in.req = &req;
8396 r.out.rep = &repp;
8397
8398 ZERO_STRUCT(req);
8399 req.req3.account.string = "non-existent-account-aklsdji";
8400
8401 for (i=0; passwords[i]; i++) {
8402 req.req3.password.string = passwords[i];
8403
8404 status = dcerpc_samr_ValidatePassword_r(b, tctx, &r);
8405 if (NT_STATUS_EQUAL(status, NT_STATUS_RPC_PROCNUM_OUT_OF_RANGE)) {
8406 torture_skip(tctx, "ValidatePassword not supported by server\n");
8407 }
8408 torture_assert_ntstatus_ok(tctx, status,
8409 "samr_ValidatePassword failed");
8410 torture_assert_ntstatus_ok(tctx, r.out.result,
8411 "samr_ValidatePassword failed");
8412 torture_comment(tctx, "Server %s password '%s' with code %i\n",
8413 repp->ctr3.status==SAMR_VALIDATION_STATUS_SUCCESS?"allowed":"refused",
8414 req.req3.password.string, repp->ctr3.status);
8415 }
8416
8417 return true;
8418 }
8419
8420 bool torture_rpc_samr(struct torture_context *torture)
8421 {
8422 NTSTATUS status;
8423 struct dcerpc_pipe *p;
8424 bool ret = true;
8425 struct torture_samr_context *ctx;
8426 struct dcerpc_binding_handle *b;
8427
8428 status = torture_rpc_connection(torture, &p, &ndr_table_samr);
8429 if (!NT_STATUS_IS_OK(status)) {
8430 return false;
8431 }
8432 b = p->binding_handle;
8433
8434 ctx = talloc_zero(torture, struct torture_samr_context);
8435
8436 ctx->choice = TORTURE_SAMR_OTHER;
8437
8438 ret &= test_Connect(b, torture, &ctx->handle);
8439
8440 if (!torture_setting_bool(torture, "samba3", false)) {
8441 ret &= test_QuerySecurity(b, torture, &ctx->handle);
8442 }
8443
8444 ret &= test_EnumDomains(p, torture, ctx);
8445
8446 ret &= test_SetDsrmPassword(b, torture, &ctx->handle);
8447
8448 ret &= test_Shutdown(b, torture, &ctx->handle);
8449
8450 ret &= test_samr_handle_Close(b, torture, &ctx->handle);
8451
8452 return ret;
8453 }
8454
8455
8456 bool torture_rpc_samr_users(struct torture_context *torture)
8457 {
8458 NTSTATUS status;
8459 struct dcerpc_pipe *p;
8460 bool ret = true;
8461 struct torture_samr_context *ctx;
8462 struct dcerpc_binding_handle *b;
8463
8464 status = torture_rpc_connection(torture, &p, &ndr_table_samr);
8465 if (!NT_STATUS_IS_OK(status)) {
8466 return false;
8467 }
8468 b = p->binding_handle;
8469
8470 ctx = talloc_zero(torture, struct torture_samr_context);
8471
8472 ctx->choice = TORTURE_SAMR_USER_ATTRIBUTES;
8473
8474 ret &= test_Connect(b, torture, &ctx->handle);
8475
8476 if (!torture_setting_bool(torture, "samba3", false)) {
8477 ret &= test_QuerySecurity(b, torture, &ctx->handle);
8478 }
8479
8480 ret &= test_EnumDomains(p, torture, ctx);
8481
8482 ret &= test_SetDsrmPassword(b, torture, &ctx->handle);
8483
8484 ret &= test_Shutdown(b, torture, &ctx->handle);
8485
8486 ret &= test_samr_handle_Close(b, torture, &ctx->handle);
8487
8488 return ret;
8489 }
8490
8491
8492 bool torture_rpc_samr_passwords(struct torture_context *torture)
8493 {
8494 NTSTATUS status;
8495 struct dcerpc_pipe *p;
8496 bool ret = true;
8497 struct torture_samr_context *ctx;
8498 struct dcerpc_binding_handle *b;
8499
8500 status = torture_rpc_connection(torture, &p, &ndr_table_samr);
8501 if (!NT_STATUS_IS_OK(status)) {
8502 return false;
8503 }
8504 b = p->binding_handle;
8505
8506 ctx = talloc_zero(torture, struct torture_samr_context);
8507
8508 ctx->choice = TORTURE_SAMR_PASSWORDS;
8509
8510 ret &= test_Connect(b, torture, &ctx->handle);
8511
8512 ret &= test_EnumDomains(p, torture, ctx);
8513
8514 ret &= test_samr_handle_Close(b, torture, &ctx->handle);
8515
8516 return ret;
8517 }
8518
8519 static bool torture_rpc_samr_pwdlastset(struct torture_context *torture,
8520 struct dcerpc_pipe *p2,
8521 struct cli_credentials *machine_credentials)
8522 {
8523 NTSTATUS status;
8524 struct dcerpc_pipe *p;
8525 bool ret = true;
8526 struct torture_samr_context *ctx;
8527 struct dcerpc_binding_handle *b;
8528
8529 status = torture_rpc_connection(torture, &p, &ndr_table_samr);
8530 if (!NT_STATUS_IS_OK(status)) {
8531 return false;
8532 }
8533 b = p->binding_handle;
8534
8535 ctx = talloc_zero(torture, struct torture_samr_context);
8536
8537 ctx->choice = TORTURE_SAMR_PASSWORDS_PWDLASTSET;
8538 ctx->machine_credentials = machine_credentials;
8539
8540 ret &= test_Connect(b, torture, &ctx->handle);
8541
8542 ret &= test_EnumDomains(p, torture, ctx);
8543
8544 ret &= test_samr_handle_Close(b, torture, &ctx->handle);
8545
8546 return ret;
8547 }
8548
8549 struct torture_suite *torture_rpc_samr_passwords_pwdlastset(TALLOC_CTX *mem_ctx)
8550 {
8551 struct torture_suite *suite = torture_suite_create(mem_ctx, "samr.passwords.pwdlastset");
8552 struct torture_rpc_tcase *tcase;
8553
8554 tcase = torture_suite_add_machine_bdc_rpc_iface_tcase(suite, "samr",
8555 &ndr_table_samr,
8556 TEST_ACCOUNT_NAME_PWD);
8557
8558 torture_rpc_tcase_add_test_creds(tcase, "pwdLastSet",
8559 torture_rpc_samr_pwdlastset);
8560
8561 return suite;
8562 }
8563
8564 static bool torture_rpc_samr_users_privileges_delete_user(struct torture_context *torture,
8565 struct dcerpc_pipe *p2,
8566 struct cli_credentials *machine_credentials)
8567 {
8568 NTSTATUS status;
8569 struct dcerpc_pipe *p;
8570 bool ret = true;
8571 struct torture_samr_context *ctx;
8572 struct dcerpc_binding_handle *b;
8573
8574 status = torture_rpc_connection(torture, &p, &ndr_table_samr);
8575 if (!NT_STATUS_IS_OK(status)) {
8576 return false;
8577 }
8578 b = p->binding_handle;
8579
8580 ctx = talloc_zero(torture, struct torture_samr_context);
8581
8582 ctx->choice = TORTURE_SAMR_USER_PRIVILEGES;
8583 ctx->machine_credentials = machine_credentials;
8584
8585 ret &= test_Connect(b, torture, &ctx->handle);
8586
8587 ret &= test_EnumDomains(p, torture, ctx);
8588
8589 ret &= test_samr_handle_Close(b, torture, &ctx->handle);
8590
8591 return ret;
8592 }
8593
8594 struct torture_suite *torture_rpc_samr_user_privileges(TALLOC_CTX *mem_ctx)
8595 {
8596 struct torture_suite *suite = torture_suite_create(mem_ctx, "samr.users.privileges");
8597 struct torture_rpc_tcase *tcase;
8598
8599 tcase = torture_suite_add_machine_bdc_rpc_iface_tcase(suite, "samr",
8600 &ndr_table_samr,
8601 TEST_ACCOUNT_NAME_PWD);
8602
8603 torture_rpc_tcase_add_test_creds(tcase, "delete_privileged_user",
8604 torture_rpc_samr_users_privileges_delete_user);
8605
8606 return suite;
8607 }
8608
8609 static bool torture_rpc_samr_many_accounts(struct torture_context *torture,
8610 struct dcerpc_pipe *p2,
8611 void *data)
8612 {
8613 NTSTATUS status;
8614 struct dcerpc_pipe *p;
8615 bool ret = true;
8616 struct torture_samr_context *ctx =
8617 talloc_get_type_abort(data, struct torture_samr_context);
8618 struct dcerpc_binding_handle *b;
8619
8620 status = torture_rpc_connection(torture, &p, &ndr_table_samr);
8621 if (!NT_STATUS_IS_OK(status)) {
8622 return false;
8623 }
8624 b = p->binding_handle;
8625
8626 ctx->choice = TORTURE_SAMR_MANY_ACCOUNTS;
8627 ctx->num_objects_large_dc = torture_setting_int(torture, "large_dc",
8628 ctx->num_objects_large_dc);
8629
8630 ret &= test_Connect(b, torture, &ctx->handle);
8631
8632 ret &= test_EnumDomains(p, torture, ctx);
8633
8634 ret &= test_samr_handle_Close(b, torture, &ctx->handle);
8635
8636 return ret;
8637 }
8638
8639 static bool torture_rpc_samr_many_groups(struct torture_context *torture,
8640 struct dcerpc_pipe *p2,
8641 void *data)
8642 {
8643 NTSTATUS status;
8644 struct dcerpc_pipe *p;
8645 bool ret = true;
8646 struct torture_samr_context *ctx =
8647 talloc_get_type_abort(data, struct torture_samr_context);
8648 struct dcerpc_binding_handle *b;
8649
8650 status = torture_rpc_connection(torture, &p, &ndr_table_samr);
8651 if (!NT_STATUS_IS_OK(status)) {
8652 return false;
8653 }
8654 b = p->binding_handle;
8655
8656 ctx->choice = TORTURE_SAMR_MANY_GROUPS;
8657 ctx->num_objects_large_dc = torture_setting_int(torture, "large_dc",
8658 ctx->num_objects_large_dc);
8659
8660 ret &= test_Connect(b, torture, &ctx->handle);
8661
8662 ret &= test_EnumDomains(p, torture, ctx);
8663
8664 ret &= test_samr_handle_Close(b, torture, &ctx->handle);
8665
8666 return ret;
8667 }
8668
8669 static bool torture_rpc_samr_many_aliases(struct torture_context *torture,
8670 struct dcerpc_pipe *p2,
8671 void *data)
8672 {
8673 NTSTATUS status;
8674 struct dcerpc_pipe *p;
8675 bool ret = true;
8676 struct torture_samr_context *ctx =
8677 talloc_get_type_abort(data, struct torture_samr_context);
8678 struct dcerpc_binding_handle *b;
8679
8680 status = torture_rpc_connection(torture, &p, &ndr_table_samr);
8681 if (!NT_STATUS_IS_OK(status)) {
8682 return false;
8683 }
8684 b = p->binding_handle;
8685
8686 ctx->choice = TORTURE_SAMR_MANY_ALIASES;
8687 ctx->num_objects_large_dc = torture_setting_int(torture, "large_dc",
8688 ctx->num_objects_large_dc);
8689
8690 ret &= test_Connect(b, torture, &ctx->handle);
8691
8692 ret &= test_EnumDomains(p, torture, ctx);
8693
8694 ret &= test_samr_handle_Close(b, torture, &ctx->handle);
8695
8696 return ret;
8697 }
8698
8699 struct torture_suite *torture_rpc_samr_large_dc(TALLOC_CTX *mem_ctx)
8700 {
8701 struct torture_suite *suite = torture_suite_create(mem_ctx, "samr.large-dc");
8702 struct torture_rpc_tcase *tcase;
8703 struct torture_samr_context *ctx;
8704
8705 tcase = torture_suite_add_rpc_iface_tcase(suite, "samr", &ndr_table_samr);
8706
8707 ctx = talloc_zero(suite, struct torture_samr_context);
8708 ctx->num_objects_large_dc = 150;
8709
8710 torture_rpc_tcase_add_test_ex(tcase, "many_aliases",
8711 torture_rpc_samr_many_aliases, ctx);
8712 torture_rpc_tcase_add_test_ex(tcase, "many_groups",
8713 torture_rpc_samr_many_groups, ctx);
8714 torture_rpc_tcase_add_test_ex(tcase, "many_accounts",
8715 torture_rpc_samr_many_accounts, ctx);
8716
8717 return suite;
8718 }
8719
8720 static bool torture_rpc_samr_badpwdcount(struct torture_context *torture,
8721 struct dcerpc_pipe *p2,
8722 struct cli_credentials *machine_credentials)
8723 {
8724 NTSTATUS status;
8725 struct dcerpc_pipe *p;
8726 bool ret = true;
8727 struct torture_samr_context *ctx;
8728 struct dcerpc_binding_handle *b;
8729
8730 status = torture_rpc_connection(torture, &p, &ndr_table_samr);
8731 if (!NT_STATUS_IS_OK(status)) {
8732 return false;
8733 }
8734 b = p->binding_handle;
8735
8736 ctx = talloc_zero(torture, struct torture_samr_context);
8737
8738 ctx->choice = TORTURE_SAMR_PASSWORDS_BADPWDCOUNT;
8739 ctx->machine_credentials = machine_credentials;
8740
8741 ret &= test_Connect(b, torture, &ctx->handle);
8742
8743 ret &= test_EnumDomains(p, torture, ctx);
8744
8745 ret &= test_samr_handle_Close(b, torture, &ctx->handle);
8746
8747 return ret;
8748 }
8749
8750 struct torture_suite *torture_rpc_samr_passwords_badpwdcount(TALLOC_CTX *mem_ctx)
8751 {
8752 struct torture_suite *suite = torture_suite_create(mem_ctx, "samr.passwords.badpwdcount");
8753 struct torture_rpc_tcase *tcase;
8754
8755 tcase = torture_suite_add_machine_bdc_rpc_iface_tcase(suite, "samr",
8756 &ndr_table_samr,
8757 TEST_ACCOUNT_NAME_PWD);
8758
8759 torture_rpc_tcase_add_test_creds(tcase, "badPwdCount",
8760 torture_rpc_samr_badpwdcount);
8761
8762 return suite;
8763 }
8764
8765 static bool torture_rpc_samr_lockout(struct torture_context *torture,
8766 struct dcerpc_pipe *p2,
8767 struct cli_credentials *machine_credentials)
8768 {
8769 NTSTATUS status;
8770 struct dcerpc_pipe *p;
8771 bool ret = true;
8772 struct torture_samr_context *ctx;
8773 struct dcerpc_binding_handle *b;
8774
8775 status = torture_rpc_connection(torture, &p, &ndr_table_samr);
8776 if (!NT_STATUS_IS_OK(status)) {
8777 return false;
8778 }
8779 b = p->binding_handle;
8780
8781 ctx = talloc_zero(torture, struct torture_samr_context);
8782
8783 ctx->choice = TORTURE_SAMR_PASSWORDS_LOCKOUT;
8784 ctx->machine_credentials = machine_credentials;
8785
8786 ret &= test_Connect(b, torture, &ctx->handle);
8787
8788 ret &= test_EnumDomains(p, torture, ctx);
8789
8790 ret &= test_samr_handle_Close(b, torture, &ctx->handle);
8791
8792 return ret;
8793 }
8794
8795 struct torture_suite *torture_rpc_samr_passwords_lockout(TALLOC_CTX *mem_ctx)
8796 {
8797 struct torture_suite *suite = torture_suite_create(mem_ctx, "samr.passwords.lockout");
8798 struct torture_rpc_tcase *tcase;
8799
8800 tcase = torture_suite_add_machine_bdc_rpc_iface_tcase(suite, "samr",
8801 &ndr_table_samr,
8802 TEST_ACCOUNT_NAME_PWD);
8803
8804 torture_rpc_tcase_add_test_creds(tcase, "lockout",
8805 torture_rpc_samr_lockout);
8806
8807 return suite;
8808 }
8809
8810 struct torture_suite *torture_rpc_samr_passwords_validate(TALLOC_CTX *mem_ctx)
8811 {
8812 struct torture_suite *suite = torture_suite_create(mem_ctx, "samr.passwords.validate");
8813 struct torture_rpc_tcase *tcase;
8814
8815 tcase = torture_suite_add_rpc_iface_tcase(suite, "samr",
8816 &ndr_table_samr);
8817 torture_rpc_tcase_add_test(tcase, "validate",
8818 test_samr_ValidatePassword);
8819
8820 return suite;
8821 }
Samba GIT mirror