?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
s4-smbtorture: add a samr_GetAliasMembership test to RPC-SAMR.
[Samba/bb.git] / source4 / torture / rpc / samr.c
blob903d5382a2a7d04706b33d305572d7d5cac9d67f
1 /*
2 Unix SMB/CIFS implementation.
3 test suite for samr rpc operations
4
5 Copyright (C) Andrew Tridgell 2003
6 Copyright (C) Andrew Bartlett <abartlet@samba.org> 2003
7 Copyright (C) Guenther Deschner 2008,2009
8
9 This program is free software; you can redistribute it and/or modify
10 it under the terms of the GNU General Public License as published by
11 the Free Software Foundation; either version 3 of the License, or
12 (at your option) any later version.
13
14 This program is distributed in the hope that it will be useful,
15 but WITHOUT ANY WARRANTY; without even the implied warranty of
16 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
17 GNU General Public License for more details.
18
19 You should have received a copy of the GNU General Public License
20 along with this program. If not, see <http://www.gnu.org/licenses/>.
21 */
22
23 #include "includes.h"
24 #include "torture/torture.h"
25 #include "system/time.h"
26 #include "librpc/gen_ndr/lsa.h"
27 #include "librpc/gen_ndr/ndr_netlogon.h"
28 #include "librpc/gen_ndr/ndr_netlogon_c.h"
29 #include "librpc/gen_ndr/ndr_samr_c.h"
30 #include "librpc/gen_ndr/ndr_lsa_c.h"
31 #include "../lib/crypto/crypto.h"
32 #include "libcli/auth/libcli_auth.h"
33 #include "libcli/security/security.h"
34 #include "torture/rpc/rpc.h"
35 #include "param/param.h"
36
37 #include <unistd.h>
38
39 #define TEST_ACCOUNT_NAME "samrtorturetest"
40 #define TEST_ACCOUNT_NAME_PWD "samrpwdlastset"
41 #define TEST_ALIASNAME "samrtorturetestalias"
42 #define TEST_GROUPNAME "samrtorturetestgroup"
43 #define TEST_MACHINENAME "samrtestmach$"
44 #define TEST_DOMAINNAME "samrtestdom$"
45
46 enum torture_samr_choice {
47 TORTURE_SAMR_PASSWORDS,
48 TORTURE_SAMR_PASSWORDS_PWDLASTSET,
49 TORTURE_SAMR_USER_ATTRIBUTES,
50 TORTURE_SAMR_USER_PRIVILEGES,
51 TORTURE_SAMR_OTHER,
52 TORTURE_SAMR_MANY_ACCOUNTS,
53 TORTURE_SAMR_MANY_GROUPS,
54 TORTURE_SAMR_MANY_ALIASES
55 };
56
57 struct torture_samr_context {
58 struct policy_handle handle;
59 struct cli_credentials *machine_credentials;
60 enum torture_samr_choice choice;
61 uint32_t num_objects_large_dc;
62 };
63
64 static bool test_QueryUserInfo(struct dcerpc_pipe *p,
65 struct torture_context *tctx,
66 struct policy_handle *handle);
67
68 static bool test_QueryUserInfo2(struct dcerpc_pipe *p,
69 struct torture_context *tctx,
70 struct policy_handle *handle);
71
72 static bool test_QueryAliasInfo(struct dcerpc_pipe *p,
73 struct torture_context *tctx,
74 struct policy_handle *handle);
75
76 static bool test_ChangePassword(struct dcerpc_pipe *p,
77 struct torture_context *tctx,
78 const char *acct_name,
79 struct policy_handle *domain_handle, char **password);
80
81 static void init_lsa_String(struct lsa_String *string, const char *s)
82 {
83 string->string = s;
84 }
85
86 static void init_lsa_StringLarge(struct lsa_StringLarge *string, const char *s)
87 {
88 string->string = s;
89 }
90
91 static void init_lsa_BinaryString(struct lsa_BinaryString *string, const char *s, uint32_t length)
92 {
93 string->length = length;
94 string->size = length;
95 string->array = (uint16_t *)discard_const(s);
96 }
97
98 bool test_samr_handle_Close(struct dcerpc_pipe *p, struct torture_context *tctx,
99 struct policy_handle *handle)
100 {
101 NTSTATUS status;
102 struct samr_Close r;
103
104 r.in.handle = handle;
105 r.out.handle = handle;
106
107 status = dcerpc_samr_Close(p, tctx, &r);
108 torture_assert_ntstatus_ok(tctx, status, "Close");
109
110 return true;
111 }
112
113 static bool test_Shutdown(struct dcerpc_pipe *p, struct torture_context *tctx,
114 struct policy_handle *handle)
115 {
116 NTSTATUS status;
117 struct samr_Shutdown r;
118
119 if (!torture_setting_bool(tctx, "dangerous", false)) {
120 torture_skip(tctx, "samr_Shutdown disabled - enable dangerous tests to use\n");
121 return true;
122 }
123
124 r.in.connect_handle = handle;
125
126 torture_comment(tctx, "testing samr_Shutdown\n");
127
128 status = dcerpc_samr_Shutdown(p, tctx, &r);
129 torture_assert_ntstatus_ok(tctx, status, "samr_Shutdown");
130
131 return true;
132 }
133
134 static bool test_SetDsrmPassword(struct dcerpc_pipe *p, struct torture_context *tctx,
135 struct policy_handle *handle)
136 {
137 NTSTATUS status;
138 struct samr_SetDsrmPassword r;
139 struct lsa_String string;
140 struct samr_Password hash;
141
142 if (!torture_setting_bool(tctx, "dangerous", false)) {
143 torture_skip(tctx, "samr_SetDsrmPassword disabled - enable dangerous tests to use");
144 }
145
146 E_md4hash("TeSTDSRM123", hash.hash);
147
148 init_lsa_String(&string, "Administrator");
149
150 r.in.name = &string;
151 r.in.unknown = 0;
152 r.in.hash = &hash;
153
154 torture_comment(tctx, "testing samr_SetDsrmPassword\n");
155
156 status = dcerpc_samr_SetDsrmPassword(p, tctx, &r);
157 torture_assert_ntstatus_equal(tctx, status, NT_STATUS_NOT_SUPPORTED, "samr_SetDsrmPassword");
158
159 return true;
160 }
161
162
163 static bool test_QuerySecurity(struct dcerpc_pipe *p,
164 struct torture_context *tctx,
165 struct policy_handle *handle)
166 {
167 NTSTATUS status;
168 struct samr_QuerySecurity r;
169 struct samr_SetSecurity s;
170 struct sec_desc_buf *sdbuf = NULL;
171
172 r.in.handle = handle;
173 r.in.sec_info = 7;
174 r.out.sdbuf = &sdbuf;
175
176 status = dcerpc_samr_QuerySecurity(p, tctx, &r);
177 torture_assert_ntstatus_ok(tctx, status, "QuerySecurity");
178
179 torture_assert(tctx, sdbuf != NULL, "sdbuf is NULL");
180
181 s.in.handle = handle;
182 s.in.sec_info = 7;
183 s.in.sdbuf = sdbuf;
184
185 if (torture_setting_bool(tctx, "samba4", false)) {
186 torture_skip(tctx, "skipping SetSecurity test against Samba4\n");
187 }
188
189 status = dcerpc_samr_SetSecurity(p, tctx, &s);
190 torture_assert_ntstatus_ok(tctx, status, "SetSecurity");
191
192 status = dcerpc_samr_QuerySecurity(p, tctx, &r);
193 torture_assert_ntstatus_ok(tctx, status, "QuerySecurity");
194
195 return true;
196 }
197
198
199 static bool test_SetUserInfo(struct dcerpc_pipe *p, struct torture_context *tctx,
200 struct policy_handle *handle, uint32_t base_acct_flags,
201 const char *base_account_name)
202 {
203 NTSTATUS status;
204 struct samr_SetUserInfo s;
205 struct samr_SetUserInfo2 s2;
206 struct samr_QueryUserInfo q;
207 struct samr_QueryUserInfo q0;
208 union samr_UserInfo u;
209 union samr_UserInfo *info;
210 bool ret = true;
211 const char *test_account_name;
212
213 uint32_t user_extra_flags = 0;
214
215 if (!torture_setting_bool(tctx, "samba3", false)) {
216 if (base_acct_flags == ACB_NORMAL) {
217 /* When created, accounts are expired by default */
218 user_extra_flags = ACB_PW_EXPIRED;
219 }
220 }
221
222 s.in.user_handle = handle;
223 s.in.info = &u;
224
225 s2.in.user_handle = handle;
226 s2.in.info = &u;
227
228 q.in.user_handle = handle;
229 q.out.info = &info;
230 q0 = q;
231
232 #define TESTCALL(call, r) \
233 status = dcerpc_samr_ ##call(p, tctx, &r); \
234 if (!NT_STATUS_IS_OK(status)) { \
235 torture_comment(tctx, #call " level %u failed - %s (%s)\n", \
236 r.in.level, nt_errstr(status), __location__); \
237 ret = false; \
238 break; \
239 }
240
241 #define STRING_EQUAL(s1, s2, field) \
242 if ((s1 && !s2) || (s2 && !s1) || strcmp(s1, s2)) { \
243 torture_comment(tctx, "Failed to set %s to '%s' (%s)\n", \
244 #field, s2, __location__); \
245 ret = false; \
246 break; \
247 }
248
249 #define MEM_EQUAL(s1, s2, length, field) \
250 if ((s1 && !s2) || (s2 && !s1) || memcmp(s1, s2, length)) { \
251 torture_comment(tctx, "Failed to set %s to '%s' (%s)\n", \
252 #field, (const char *)s2, __location__); \
253 ret = false; \
254 break; \
255 }
256
257 #define INT_EQUAL(i1, i2, field) \
258 if (i1 != i2) { \
259 torture_comment(tctx, "Failed to set %s to 0x%llx - got 0x%llx (%s)\n", \
260 #field, (unsigned long long)i2, (unsigned long long)i1, __location__); \
261 ret = false; \
262 break; \
263 }
264
265 #define TEST_USERINFO_STRING(lvl1, field1, lvl2, field2, value, fpval) do { \
266 torture_comment(tctx, "field test %d/%s vs %d/%s\n", lvl1, #field1, lvl2, #field2); \
267 q.in.level = lvl1; \
268 TESTCALL(QueryUserInfo, q) \
269 s.in.level = lvl1; \
270 s2.in.level = lvl1; \
271 u = *info; \
272 if (lvl1 == 21) { \
273 ZERO_STRUCT(u.info21); \
274 u.info21.fields_present = fpval; \
275 } \
276 init_lsa_String(&u.info ## lvl1.field1, value); \
277 TESTCALL(SetUserInfo, s) \
278 TESTCALL(SetUserInfo2, s2) \
279 init_lsa_String(&u.info ## lvl1.field1, ""); \
280 TESTCALL(QueryUserInfo, q); \
281 u = *info; \
282 STRING_EQUAL(u.info ## lvl1.field1.string, value, field1); \
283 q.in.level = lvl2; \
284 TESTCALL(QueryUserInfo, q) \
285 u = *info; \
286 STRING_EQUAL(u.info ## lvl2.field2.string, value, field2); \
287 } while (0)
288
289 #define TEST_USERINFO_BINARYSTRING(lvl1, field1, lvl2, field2, value, fpval) do { \
290 torture_comment(tctx, "field test %d/%s vs %d/%s\n", lvl1, #field1, lvl2, #field2); \
291 q.in.level = lvl1; \
292 TESTCALL(QueryUserInfo, q) \
293 s.in.level = lvl1; \
294 s2.in.level = lvl1; \
295 u = *info; \
296 if (lvl1 == 21) { \
297 ZERO_STRUCT(u.info21); \
298 u.info21.fields_present = fpval; \
299 } \
300 init_lsa_BinaryString(&u.info ## lvl1.field1, value, strlen(value)); \
301 TESTCALL(SetUserInfo, s) \
302 TESTCALL(SetUserInfo2, s2) \
303 init_lsa_BinaryString(&u.info ## lvl1.field1, "", 1); \
304 TESTCALL(QueryUserInfo, q); \
305 u = *info; \
306 MEM_EQUAL(u.info ## lvl1.field1.array, value, strlen(value), field1); \
307 q.in.level = lvl2; \
308 TESTCALL(QueryUserInfo, q) \
309 u = *info; \
310 MEM_EQUAL(u.info ## lvl2.field2.array, value, strlen(value), field2); \
311 } while (0)
312
313 #define TEST_USERINFO_INT_EXP(lvl1, field1, lvl2, field2, value, exp_value, fpval) do { \
314 torture_comment(tctx, "field test %d/%s vs %d/%s\n", lvl1, #field1, lvl2, #field2); \
315 q.in.level = lvl1; \
316 TESTCALL(QueryUserInfo, q) \
317 s.in.level = lvl1; \
318 s2.in.level = lvl1; \
319 u = *info; \
320 if (lvl1 == 21) { \
321 uint8_t *bits = u.info21.logon_hours.bits; \
322 ZERO_STRUCT(u.info21); \
323 if (fpval == SAMR_FIELD_LOGON_HOURS) { \
324 u.info21.logon_hours.units_per_week = 168; \
325 u.info21.logon_hours.bits = bits; \
326 } \
327 u.info21.fields_present = fpval; \
328 } \
329 u.info ## lvl1.field1 = value; \
330 TESTCALL(SetUserInfo, s) \
331 TESTCALL(SetUserInfo2, s2) \
332 u.info ## lvl1.field1 = 0; \
333 TESTCALL(QueryUserInfo, q); \
334 u = *info; \
335 INT_EQUAL(u.info ## lvl1.field1, exp_value, field1); \
336 q.in.level = lvl2; \
337 TESTCALL(QueryUserInfo, q) \
338 u = *info; \
339 INT_EQUAL(u.info ## lvl2.field2, exp_value, field1); \
340 } while (0)
341
342 #define TEST_USERINFO_INT(lvl1, field1, lvl2, field2, value, fpval) do { \
343 TEST_USERINFO_INT_EXP(lvl1, field1, lvl2, field2, value, value, fpval); \
344 } while (0)
345
346 q0.in.level = 12;
347 do { TESTCALL(QueryUserInfo, q0) } while (0);
348
349 TEST_USERINFO_STRING(2, comment, 1, comment, "xx2-1 comment", 0);
350 TEST_USERINFO_STRING(2, comment, 21, comment, "xx2-21 comment", 0);
351 TEST_USERINFO_STRING(21, comment, 21, comment, "xx21-21 comment",
352 SAMR_FIELD_COMMENT);
353
354 test_account_name = talloc_asprintf(tctx, "%sxx7-1", base_account_name);
355 TEST_USERINFO_STRING(7, account_name, 1, account_name, base_account_name, 0);
356 test_account_name = talloc_asprintf(tctx, "%sxx7-3", base_account_name);
357 TEST_USERINFO_STRING(7, account_name, 3, account_name, base_account_name, 0);
358 test_account_name = talloc_asprintf(tctx, "%sxx7-5", base_account_name);
359 TEST_USERINFO_STRING(7, account_name, 5, account_name, base_account_name, 0);
360 test_account_name = talloc_asprintf(tctx, "%sxx7-6", base_account_name);
361 TEST_USERINFO_STRING(7, account_name, 6, account_name, base_account_name, 0);
362 test_account_name = talloc_asprintf(tctx, "%sxx7-7", base_account_name);
363 TEST_USERINFO_STRING(7, account_name, 7, account_name, base_account_name, 0);
364 test_account_name = talloc_asprintf(tctx, "%sxx7-21", base_account_name);
365 TEST_USERINFO_STRING(7, account_name, 21, account_name, base_account_name, 0);
366 test_account_name = base_account_name;
367 TEST_USERINFO_STRING(21, account_name, 21, account_name, base_account_name,
368 SAMR_FIELD_ACCOUNT_NAME);
369
370 TEST_USERINFO_STRING(6, full_name, 1, full_name, "xx6-1 full_name", 0);
371 TEST_USERINFO_STRING(6, full_name, 3, full_name, "xx6-3 full_name", 0);
372 TEST_USERINFO_STRING(6, full_name, 5, full_name, "xx6-5 full_name", 0);
373 TEST_USERINFO_STRING(6, full_name, 6, full_name, "xx6-6 full_name", 0);
374 TEST_USERINFO_STRING(6, full_name, 8, full_name, "xx6-8 full_name", 0);
375 TEST_USERINFO_STRING(6, full_name, 21, full_name, "xx6-21 full_name", 0);
376 TEST_USERINFO_STRING(8, full_name, 21, full_name, "xx8-21 full_name", 0);
377 TEST_USERINFO_STRING(21, full_name, 21, full_name, "xx21-21 full_name",
378 SAMR_FIELD_FULL_NAME);
379
380 TEST_USERINFO_STRING(6, full_name, 1, full_name, "", 0);
381 TEST_USERINFO_STRING(6, full_name, 3, full_name, "", 0);
382 TEST_USERINFO_STRING(6, full_name, 5, full_name, "", 0);
383 TEST_USERINFO_STRING(6, full_name, 6, full_name, "", 0);
384 TEST_USERINFO_STRING(6, full_name, 8, full_name, "", 0);
385 TEST_USERINFO_STRING(6, full_name, 21, full_name, "", 0);
386 TEST_USERINFO_STRING(8, full_name, 21, full_name, "", 0);
387 TEST_USERINFO_STRING(21, full_name, 21, full_name, "",
388 SAMR_FIELD_FULL_NAME);
389
390 TEST_USERINFO_STRING(11, logon_script, 3, logon_script, "xx11-3 logon_script", 0);
391 TEST_USERINFO_STRING(11, logon_script, 5, logon_script, "xx11-5 logon_script", 0);
392 TEST_USERINFO_STRING(11, logon_script, 21, logon_script, "xx11-21 logon_script", 0);
393 TEST_USERINFO_STRING(21, logon_script, 21, logon_script, "xx21-21 logon_script",
394 SAMR_FIELD_LOGON_SCRIPT);
395
396 TEST_USERINFO_STRING(12, profile_path, 3, profile_path, "xx12-3 profile_path", 0);
397 TEST_USERINFO_STRING(12, profile_path, 5, profile_path, "xx12-5 profile_path", 0);
398 TEST_USERINFO_STRING(12, profile_path, 21, profile_path, "xx12-21 profile_path", 0);
399 TEST_USERINFO_STRING(21, profile_path, 21, profile_path, "xx21-21 profile_path",
400 SAMR_FIELD_PROFILE_PATH);
401
402 TEST_USERINFO_STRING(10, home_directory, 3, home_directory, "xx10-3 home_directory", 0);
403 TEST_USERINFO_STRING(10, home_directory, 5, home_directory, "xx10-5 home_directory", 0);
404 TEST_USERINFO_STRING(10, home_directory, 21, home_directory, "xx10-21 home_directory", 0);
405 TEST_USERINFO_STRING(21, home_directory, 21, home_directory, "xx21-21 home_directory",
406 SAMR_FIELD_HOME_DIRECTORY);
407 TEST_USERINFO_STRING(21, home_directory, 10, home_directory, "xx21-10 home_directory",
408 SAMR_FIELD_HOME_DIRECTORY);
409
410 TEST_USERINFO_STRING(10, home_drive, 3, home_drive, "xx10-3 home_drive", 0);
411 TEST_USERINFO_STRING(10, home_drive, 5, home_drive, "xx10-5 home_drive", 0);
412 TEST_USERINFO_STRING(10, home_drive, 21, home_drive, "xx10-21 home_drive", 0);
413 TEST_USERINFO_STRING(21, home_drive, 21, home_drive, "xx21-21 home_drive",
414 SAMR_FIELD_HOME_DRIVE);
415 TEST_USERINFO_STRING(21, home_drive, 10, home_drive, "xx21-10 home_drive",
416 SAMR_FIELD_HOME_DRIVE);
417
418 TEST_USERINFO_STRING(13, description, 1, description, "xx13-1 description", 0);
419 TEST_USERINFO_STRING(13, description, 5, description, "xx13-5 description", 0);
420 TEST_USERINFO_STRING(13, description, 21, description, "xx13-21 description", 0);
421 TEST_USERINFO_STRING(21, description, 21, description, "xx21-21 description",
422 SAMR_FIELD_DESCRIPTION);
423
424 TEST_USERINFO_STRING(14, workstations, 3, workstations, "14workstation3", 0);
425 TEST_USERINFO_STRING(14, workstations, 5, workstations, "14workstation4", 0);
426 TEST_USERINFO_STRING(14, workstations, 21, workstations, "14workstation21", 0);
427 TEST_USERINFO_STRING(21, workstations, 21, workstations, "21workstation21",
428 SAMR_FIELD_WORKSTATIONS);
429 TEST_USERINFO_STRING(21, workstations, 3, workstations, "21workstation3",
430 SAMR_FIELD_WORKSTATIONS);
431 TEST_USERINFO_STRING(21, workstations, 5, workstations, "21workstation5",
432 SAMR_FIELD_WORKSTATIONS);
433 TEST_USERINFO_STRING(21, workstations, 14, workstations, "21workstation14",
434 SAMR_FIELD_WORKSTATIONS);
435
436 TEST_USERINFO_BINARYSTRING(20, parameters, 21, parameters, "xx20-21 parameters", 0);
437 TEST_USERINFO_BINARYSTRING(21, parameters, 21, parameters, "xx21-21 parameters",
438 SAMR_FIELD_PARAMETERS);
439 TEST_USERINFO_BINARYSTRING(21, parameters, 20, parameters, "xx21-20 parameters",
440 SAMR_FIELD_PARAMETERS);
441 /* also empty user parameters are allowed */
442 TEST_USERINFO_BINARYSTRING(20, parameters, 21, parameters, "", 0);
443 TEST_USERINFO_BINARYSTRING(21, parameters, 21, parameters, "",
444 SAMR_FIELD_PARAMETERS);
445 TEST_USERINFO_BINARYSTRING(21, parameters, 20, parameters, "",
446 SAMR_FIELD_PARAMETERS);
447
448 /* Samba 3 cannot store country_code and copy_page atm. - gd */
449 if (!torture_setting_bool(tctx, "samba3", false)) {
450 TEST_USERINFO_INT(2, country_code, 2, country_code, __LINE__, 0);
451 TEST_USERINFO_INT(2, country_code, 21, country_code, __LINE__, 0);
452 TEST_USERINFO_INT(21, country_code, 21, country_code, __LINE__,
453 SAMR_FIELD_COUNTRY_CODE);
454 TEST_USERINFO_INT(21, country_code, 2, country_code, __LINE__,
455 SAMR_FIELD_COUNTRY_CODE);
456
457 TEST_USERINFO_INT(2, code_page, 21, code_page, __LINE__, 0);
458 TEST_USERINFO_INT(21, code_page, 21, code_page, __LINE__,
459 SAMR_FIELD_CODE_PAGE);
460 TEST_USERINFO_INT(21, code_page, 2, code_page, __LINE__,
461 SAMR_FIELD_CODE_PAGE);
462 }
463
464 if (!torture_setting_bool(tctx, "samba3", false)) {
465 TEST_USERINFO_INT(17, acct_expiry, 21, acct_expiry, __LINE__, 0);
466 TEST_USERINFO_INT(17, acct_expiry, 5, acct_expiry, __LINE__, 0);
467 TEST_USERINFO_INT(21, acct_expiry, 21, acct_expiry, __LINE__,
468 SAMR_FIELD_ACCT_EXPIRY);
469 TEST_USERINFO_INT(21, acct_expiry, 5, acct_expiry, __LINE__,
470 SAMR_FIELD_ACCT_EXPIRY);
471 TEST_USERINFO_INT(21, acct_expiry, 17, acct_expiry, __LINE__,
472 SAMR_FIELD_ACCT_EXPIRY);
473 } else {
474 /* Samba 3 can only store seconds / time_t in passdb - gd */
475 NTTIME nt;
476 unix_to_nt_time(&nt, time(NULL) + __LINE__);
477 TEST_USERINFO_INT(17, acct_expiry, 21, acct_expiry, nt, 0);
478 unix_to_nt_time(&nt, time(NULL) + __LINE__);
479 TEST_USERINFO_INT(17, acct_expiry, 5, acct_expiry, nt, 0);
480 unix_to_nt_time(&nt, time(NULL) + __LINE__);
481 TEST_USERINFO_INT(21, acct_expiry, 21, acct_expiry, nt, SAMR_FIELD_ACCT_EXPIRY);
482 unix_to_nt_time(&nt, time(NULL) + __LINE__);
483 TEST_USERINFO_INT(21, acct_expiry, 5, acct_expiry, nt, SAMR_FIELD_ACCT_EXPIRY);
484 unix_to_nt_time(&nt, time(NULL) + __LINE__);
485 TEST_USERINFO_INT(21, acct_expiry, 17, acct_expiry, nt, SAMR_FIELD_ACCT_EXPIRY);
486 }
487
488 TEST_USERINFO_INT(4, logon_hours.bits[3], 3, logon_hours.bits[3], 1, 0);
489 TEST_USERINFO_INT(4, logon_hours.bits[3], 5, logon_hours.bits[3], 2, 0);
490 TEST_USERINFO_INT(4, logon_hours.bits[3], 21, logon_hours.bits[3], 3, 0);
491 TEST_USERINFO_INT(21, logon_hours.bits[3], 21, logon_hours.bits[3], 4,
492 SAMR_FIELD_LOGON_HOURS);
493
494 TEST_USERINFO_INT_EXP(16, acct_flags, 5, acct_flags,
495 (base_acct_flags | ACB_DISABLED | ACB_HOMDIRREQ),
496 (base_acct_flags | ACB_DISABLED | ACB_HOMDIRREQ | user_extra_flags),
497 0);
498 TEST_USERINFO_INT_EXP(16, acct_flags, 5, acct_flags,
499 (base_acct_flags | ACB_DISABLED),
500 (base_acct_flags | ACB_DISABLED | user_extra_flags),
501 0);
502
503 /* Setting PWNOEXP clears the magic ACB_PW_EXPIRED flag */
504 TEST_USERINFO_INT_EXP(16, acct_flags, 5, acct_flags,
505 (base_acct_flags | ACB_DISABLED | ACB_PWNOEXP),
506 (base_acct_flags | ACB_DISABLED | ACB_PWNOEXP),
507 0);
508 TEST_USERINFO_INT_EXP(16, acct_flags, 21, acct_flags,
509 (base_acct_flags | ACB_DISABLED | ACB_HOMDIRREQ),
510 (base_acct_flags | ACB_DISABLED | ACB_HOMDIRREQ | user_extra_flags),
511 0);
512
513
514 /* The 'autolock' flag doesn't stick - check this */
515 TEST_USERINFO_INT_EXP(16, acct_flags, 21, acct_flags,
516 (base_acct_flags | ACB_DISABLED | ACB_AUTOLOCK),
517 (base_acct_flags | ACB_DISABLED | user_extra_flags),
518 0);
519 #if 0
520 /* Removing the 'disabled' flag doesn't stick - check this */
521 TEST_USERINFO_INT_EXP(16, acct_flags, 21, acct_flags,
522 (base_acct_flags),
523 (base_acct_flags | ACB_DISABLED | user_extra_flags),
524 0);
525 #endif
526
527 /* Samba3 cannot store these atm */
528 if (!torture_setting_bool(tctx, "samba3", false)) {
529 /* The 'store plaintext' flag does stick */
530 TEST_USERINFO_INT_EXP(16, acct_flags, 21, acct_flags,
531 (base_acct_flags | ACB_DISABLED | ACB_ENC_TXT_PWD_ALLOWED),
532 (base_acct_flags | ACB_DISABLED | ACB_ENC_TXT_PWD_ALLOWED | user_extra_flags),
533 0);
534 /* The 'use DES' flag does stick */
535 TEST_USERINFO_INT_EXP(16, acct_flags, 21, acct_flags,
536 (base_acct_flags | ACB_DISABLED | ACB_USE_DES_KEY_ONLY),
537 (base_acct_flags | ACB_DISABLED | ACB_USE_DES_KEY_ONLY | user_extra_flags),
538 0);
539 /* The 'don't require kerberos pre-authentication flag does stick */
540 TEST_USERINFO_INT_EXP(16, acct_flags, 21, acct_flags,
541 (base_acct_flags | ACB_DISABLED | ACB_DONT_REQUIRE_PREAUTH),
542 (base_acct_flags | ACB_DISABLED | ACB_DONT_REQUIRE_PREAUTH | user_extra_flags),
543 0);
544 /* The 'no kerberos PAC required' flag sticks */
545 TEST_USERINFO_INT_EXP(16, acct_flags, 21, acct_flags,
546 (base_acct_flags | ACB_DISABLED | ACB_NO_AUTH_DATA_REQD),
547 (base_acct_flags | ACB_DISABLED | ACB_NO_AUTH_DATA_REQD | user_extra_flags),
548 0);
549 }
550 TEST_USERINFO_INT_EXP(21, acct_flags, 21, acct_flags,
551 (base_acct_flags | ACB_DISABLED),
552 (base_acct_flags | ACB_DISABLED | user_extra_flags),
553 SAMR_FIELD_ACCT_FLAGS);
554
555 #if 0
556 /* these fail with win2003 - it appears you can't set the primary gid?
557 the set succeeds, but the gid isn't changed. Very weird! */
558 TEST_USERINFO_INT(9, primary_gid, 1, primary_gid, 513);
559 TEST_USERINFO_INT(9, primary_gid, 3, primary_gid, 513);
560 TEST_USERINFO_INT(9, primary_gid, 5, primary_gid, 513);
561 TEST_USERINFO_INT(9, primary_gid, 21, primary_gid, 513);
562 #endif
563
564 return ret;
565 }
566
567 /*
568 generate a random password for password change tests
569 */
570 static char *samr_rand_pass_silent(TALLOC_CTX *mem_ctx, int min_len)
571 {
572 size_t len = MAX(8, min_len) + (random() % 6);
573 char *s = generate_random_str(mem_ctx, len);
574 return s;
575 }
576
577 static char *samr_rand_pass(TALLOC_CTX *mem_ctx, int min_len)
578 {
579 char *s = samr_rand_pass_silent(mem_ctx, min_len);
580 printf("Generated password '%s'\n", s);
581 return s;
582
583 }
584
585 /*
586 generate a random password for password change tests
587 */
588 static DATA_BLOB samr_very_rand_pass(TALLOC_CTX *mem_ctx, int len)
589 {
590 int i;
591 DATA_BLOB password = data_blob_talloc(mem_ctx, NULL, len * 2 /* number of unicode chars */);
592 generate_random_buffer(password.data, password.length);
593
594 for (i=0; i < len; i++) {
595 if (((uint16_t *)password.data)[i] == 0) {
596 ((uint16_t *)password.data)[i] = 1;
597 }
598 }
599
600 return password;
601 }
602
603 /*
604 generate a random password for password change tests (fixed length)
605 */
606 static char *samr_rand_pass_fixed_len(TALLOC_CTX *mem_ctx, int len)
607 {
608 char *s = generate_random_str(mem_ctx, len);
609 printf("Generated password '%s'\n", s);
610 return s;
611 }
612
613 static bool test_SetUserPass(struct dcerpc_pipe *p, struct torture_context *tctx,
614 struct policy_handle *handle, char **password)
615 {
616 NTSTATUS status;
617 struct samr_SetUserInfo s;
618 union samr_UserInfo u;
619 bool ret = true;
620 DATA_BLOB session_key;
621 char *newpass;
622 struct samr_GetUserPwInfo pwp;
623 struct samr_PwInfo info;
624 int policy_min_pw_len = 0;
625 pwp.in.user_handle = handle;
626 pwp.out.info = &info;
627
628 status = dcerpc_samr_GetUserPwInfo(p, tctx, &pwp);
629 if (NT_STATUS_IS_OK(status)) {
630 policy_min_pw_len = pwp.out.info->min_password_length;
631 }
632 newpass = samr_rand_pass(tctx, policy_min_pw_len);
633
634 s.in.user_handle = handle;
635 s.in.info = &u;
636 s.in.level = 24;
637
638 encode_pw_buffer(u.info24.password.data, newpass, STR_UNICODE);
639 u.info24.password_expired = 0;
640
641 status = dcerpc_fetch_session_key(p, &session_key);
642 if (!NT_STATUS_IS_OK(status)) {
643 torture_warning(tctx, "SetUserInfo level %u - no session key - %s\n",
644 s.in.level, nt_errstr(status));
645 return false;
646 }
647
648 arcfour_crypt_blob(u.info24.password.data, 516, &session_key);
649
650 torture_comment(tctx, "Testing SetUserInfo level 24 (set password)\n");
651
652 status = dcerpc_samr_SetUserInfo(p, tctx, &s);
653 if (!NT_STATUS_IS_OK(status)) {
654 torture_warning(tctx, "SetUserInfo level %u failed - %s\n",
655 s.in.level, nt_errstr(status));
656 ret = false;
657 } else {
658 *password = newpass;
659 }
660
661 return ret;
662 }
663
664
665 static bool test_SetUserPass_23(struct dcerpc_pipe *p, struct torture_context *tctx,
666 struct policy_handle *handle, uint32_t fields_present,
667 char **password)
668 {
669 NTSTATUS status;
670 struct samr_SetUserInfo s;
671 union samr_UserInfo u;
672 bool ret = true;
673 DATA_BLOB session_key;
674 char *newpass;
675 struct samr_GetUserPwInfo pwp;
676 struct samr_PwInfo info;
677 int policy_min_pw_len = 0;
678 pwp.in.user_handle = handle;
679 pwp.out.info = &info;
680
681 status = dcerpc_samr_GetUserPwInfo(p, tctx, &pwp);
682 if (NT_STATUS_IS_OK(status)) {
683 policy_min_pw_len = pwp.out.info->min_password_length;
684 }
685 newpass = samr_rand_pass(tctx, policy_min_pw_len);
686
687 s.in.user_handle = handle;
688 s.in.info = &u;
689 s.in.level = 23;
690
691 ZERO_STRUCT(u);
692
693 u.info23.info.fields_present = fields_present;
694
695 encode_pw_buffer(u.info23.password.data, newpass, STR_UNICODE);
696
697 status = dcerpc_fetch_session_key(p, &session_key);
698 if (!NT_STATUS_IS_OK(status)) {
699 torture_warning(tctx, "SetUserInfo level %u - no session key - %s\n",
700 s.in.level, nt_errstr(status));
701 return false;
702 }
703
704 arcfour_crypt_blob(u.info23.password.data, 516, &session_key);
705
706 torture_comment(tctx, "Testing SetUserInfo level 23 (set password)\n");
707
708 status = dcerpc_samr_SetUserInfo(p, tctx, &s);
709 if (!NT_STATUS_IS_OK(status)) {
710 torture_warning(tctx, "SetUserInfo level %u failed - %s\n",
711 s.in.level, nt_errstr(status));
712 ret = false;
713 } else {
714 *password = newpass;
715 }
716
717 encode_pw_buffer(u.info23.password.data, newpass, STR_UNICODE);
718
719 status = dcerpc_fetch_session_key(p, &session_key);
720 if (!NT_STATUS_IS_OK(status)) {
721 torture_warning(tctx, "SetUserInfo level %u - no session key - %s\n",
722 s.in.level, nt_errstr(status));
723 return false;
724 }
725
726 /* This should break the key nicely */
727 session_key.length--;
728 arcfour_crypt_blob(u.info23.password.data, 516, &session_key);
729
730 torture_comment(tctx, "Testing SetUserInfo level 23 (set password) with wrong password\n");
731
732 status = dcerpc_samr_SetUserInfo(p, tctx, &s);
733 if (!NT_STATUS_EQUAL(status, NT_STATUS_WRONG_PASSWORD)) {
734 torture_warning(tctx, "SetUserInfo level %u should have failed with WRONG_PASSWORD- %s\n",
735 s.in.level, nt_errstr(status));
736 ret = false;
737 }
738
739 return ret;
740 }
741
742
743 static bool test_SetUserPassEx(struct dcerpc_pipe *p, struct torture_context *tctx,
744 struct policy_handle *handle, bool makeshort,
745 char **password)
746 {
747 NTSTATUS status;
748 struct samr_SetUserInfo s;
749 union samr_UserInfo u;
750 bool ret = true;
751 DATA_BLOB session_key;
752 DATA_BLOB confounded_session_key = data_blob_talloc(tctx, NULL, 16);
753 uint8_t confounder[16];
754 char *newpass;
755 struct MD5Context ctx;
756 struct samr_GetUserPwInfo pwp;
757 struct samr_PwInfo info;
758 int policy_min_pw_len = 0;
759 pwp.in.user_handle = handle;
760 pwp.out.info = &info;
761
762 status = dcerpc_samr_GetUserPwInfo(p, tctx, &pwp);
763 if (NT_STATUS_IS_OK(status)) {
764 policy_min_pw_len = pwp.out.info->min_password_length;
765 }
766 if (makeshort && policy_min_pw_len) {
767 newpass = samr_rand_pass_fixed_len(tctx, policy_min_pw_len - 1);
768 } else {
769 newpass = samr_rand_pass(tctx, policy_min_pw_len);
770 }
771
772 s.in.user_handle = handle;
773 s.in.info = &u;
774 s.in.level = 26;
775
776 encode_pw_buffer(u.info26.password.data, newpass, STR_UNICODE);
777 u.info26.password_expired = 0;
778
779 status = dcerpc_fetch_session_key(p, &session_key);
780 if (!NT_STATUS_IS_OK(status)) {
781 torture_warning(tctx, "SetUserInfo level %u - no session key - %s\n",
782 s.in.level, nt_errstr(status));
783 return false;
784 }
785
786 generate_random_buffer((uint8_t *)confounder, 16);
787
788 MD5Init(&ctx);
789 MD5Update(&ctx, confounder, 16);
790 MD5Update(&ctx, session_key.data, session_key.length);
791 MD5Final(confounded_session_key.data, &ctx);
792
793 arcfour_crypt_blob(u.info26.password.data, 516, &confounded_session_key);
794 memcpy(&u.info26.password.data[516], confounder, 16);
795
796 torture_comment(tctx, "Testing SetUserInfo level 26 (set password ex)\n");
797
798 status = dcerpc_samr_SetUserInfo(p, tctx, &s);
799 if (!NT_STATUS_IS_OK(status)) {
800 torture_warning(tctx, "SetUserInfo level %u failed - %s\n",
801 s.in.level, nt_errstr(status));
802 ret = false;
803 } else {
804 *password = newpass;
805 }
806
807 /* This should break the key nicely */
808 confounded_session_key.data[0]++;
809
810 arcfour_crypt_blob(u.info26.password.data, 516, &confounded_session_key);
811 memcpy(&u.info26.password.data[516], confounder, 16);
812
813 torture_comment(tctx, "Testing SetUserInfo level 26 (set password ex) with wrong session key\n");
814
815 status = dcerpc_samr_SetUserInfo(p, tctx, &s);
816 if (!NT_STATUS_EQUAL(status, NT_STATUS_WRONG_PASSWORD)) {
817 torture_warning(tctx, "SetUserInfo level %u should have failed with WRONG_PASSWORD: %s\n",
818 s.in.level, nt_errstr(status));
819 ret = false;
820 } else {
821 *password = newpass;
822 }
823
824 return ret;
825 }
826
827 static bool test_SetUserPass_25(struct dcerpc_pipe *p, struct torture_context *tctx,
828 struct policy_handle *handle, uint32_t fields_present,
829 char **password)
830 {
831 NTSTATUS status;
832 struct samr_SetUserInfo s;
833 union samr_UserInfo u;
834 bool ret = true;
835 DATA_BLOB session_key;
836 DATA_BLOB confounded_session_key = data_blob_talloc(tctx, NULL, 16);
837 struct MD5Context ctx;
838 uint8_t confounder[16];
839 char *newpass;
840 struct samr_GetUserPwInfo pwp;
841 struct samr_PwInfo info;
842 int policy_min_pw_len = 0;
843 pwp.in.user_handle = handle;
844 pwp.out.info = &info;
845
846 status = dcerpc_samr_GetUserPwInfo(p, tctx, &pwp);
847 if (NT_STATUS_IS_OK(status)) {
848 policy_min_pw_len = pwp.out.info->min_password_length;
849 }
850 newpass = samr_rand_pass(tctx, policy_min_pw_len);
851
852 s.in.user_handle = handle;
853 s.in.info = &u;
854 s.in.level = 25;
855
856 ZERO_STRUCT(u);
857
858 u.info25.info.fields_present = fields_present;
859
860 encode_pw_buffer(u.info25.password.data, newpass, STR_UNICODE);
861
862 status = dcerpc_fetch_session_key(p, &session_key);
863 if (!NT_STATUS_IS_OK(status)) {
864 torture_warning(tctx, "SetUserInfo level %u - no session key - %s\n",
865 s.in.level, nt_errstr(status));
866 return false;
867 }
868
869 generate_random_buffer((uint8_t *)confounder, 16);
870
871 MD5Init(&ctx);
872 MD5Update(&ctx, confounder, 16);
873 MD5Update(&ctx, session_key.data, session_key.length);
874 MD5Final(confounded_session_key.data, &ctx);
875
876 arcfour_crypt_blob(u.info25.password.data, 516, &confounded_session_key);
877 memcpy(&u.info25.password.data[516], confounder, 16);
878
879 torture_comment(tctx, "Testing SetUserInfo level 25 (set password ex)\n");
880
881 status = dcerpc_samr_SetUserInfo(p, tctx, &s);
882 if (!NT_STATUS_IS_OK(status)) {
883 torture_warning(tctx, "SetUserInfo level %u failed - %s\n",
884 s.in.level, nt_errstr(status));
885 ret = false;
886 } else {
887 *password = newpass;
888 }
889
890 /* This should break the key nicely */
891 confounded_session_key.data[0]++;
892
893 arcfour_crypt_blob(u.info25.password.data, 516, &confounded_session_key);
894 memcpy(&u.info25.password.data[516], confounder, 16);
895
896 torture_comment(tctx, "Testing SetUserInfo level 25 (set password ex) with wrong session key\n");
897
898 status = dcerpc_samr_SetUserInfo(p, tctx, &s);
899 if (!NT_STATUS_EQUAL(status, NT_STATUS_WRONG_PASSWORD)) {
900 torture_warning(tctx, "SetUserInfo level %u should have failed with WRONG_PASSWORD- %s\n",
901 s.in.level, nt_errstr(status));
902 ret = false;
903 }
904
905 return ret;
906 }
907
908 static bool test_SetUserPass_18(struct dcerpc_pipe *p, struct torture_context *tctx,
909 struct policy_handle *handle, char **password)
910 {
911 NTSTATUS status;
912 struct samr_SetUserInfo s;
913 union samr_UserInfo u;
914 bool ret = true;
915 DATA_BLOB session_key;
916 char *newpass;
917 struct samr_GetUserPwInfo pwp;
918 struct samr_PwInfo info;
919 int policy_min_pw_len = 0;
920 uint8_t lm_hash[16], nt_hash[16];
921
922 pwp.in.user_handle = handle;
923 pwp.out.info = &info;
924
925 status = dcerpc_samr_GetUserPwInfo(p, tctx, &pwp);
926 if (NT_STATUS_IS_OK(status)) {
927 policy_min_pw_len = pwp.out.info->min_password_length;
928 }
929 newpass = samr_rand_pass(tctx, policy_min_pw_len);
930
931 s.in.user_handle = handle;
932 s.in.info = &u;
933 s.in.level = 18;
934
935 ZERO_STRUCT(u);
936
937 u.info18.nt_pwd_active = true;
938 u.info18.lm_pwd_active = true;
939
940 E_md4hash(newpass, nt_hash);
941 E_deshash(newpass, lm_hash);
942
943 status = dcerpc_fetch_session_key(p, &session_key);
944 if (!NT_STATUS_IS_OK(status)) {
945 torture_warning(tctx, "SetUserInfo level %u - no session key - %s\n",
946 s.in.level, nt_errstr(status));
947 return false;
948 }
949
950 {
951 DATA_BLOB in,out;
952 in = data_blob_const(nt_hash, 16);
953 out = data_blob_talloc_zero(tctx, 16);
954 sess_crypt_blob(&out, &in, &session_key, true);
955 memcpy(u.info18.nt_pwd.hash, out.data, out.length);
956 }
957 {
958 DATA_BLOB in,out;
959 in = data_blob_const(lm_hash, 16);
960 out = data_blob_talloc_zero(tctx, 16);
961 sess_crypt_blob(&out, &in, &session_key, true);
962 memcpy(u.info18.lm_pwd.hash, out.data, out.length);
963 }
964
965 torture_comment(tctx, "Testing SetUserInfo level 18 (set password hash)\n");
966
967 status = dcerpc_samr_SetUserInfo(p, tctx, &s);
968 if (!NT_STATUS_IS_OK(status)) {
969 torture_warning(tctx, "SetUserInfo level %u failed - %s\n",
970 s.in.level, nt_errstr(status));
971 ret = false;
972 } else {
973 *password = newpass;
974 }
975
976 return ret;
977 }
978
979 static bool test_SetUserPass_21(struct dcerpc_pipe *p, struct torture_context *tctx,
980 struct policy_handle *handle, uint32_t fields_present,
981 char **password)
982 {
983 NTSTATUS status;
984 struct samr_SetUserInfo s;
985 union samr_UserInfo u;
986 bool ret = true;
987 DATA_BLOB session_key;
988 char *newpass;
989 struct samr_GetUserPwInfo pwp;
990 struct samr_PwInfo info;
991 int policy_min_pw_len = 0;
992 uint8_t lm_hash[16], nt_hash[16];
993
994 pwp.in.user_handle = handle;
995 pwp.out.info = &info;
996
997 status = dcerpc_samr_GetUserPwInfo(p, tctx, &pwp);
998 if (NT_STATUS_IS_OK(status)) {
999 policy_min_pw_len = pwp.out.info->min_password_length;
1000 }
1001 newpass = samr_rand_pass(tctx, policy_min_pw_len);
1002
1003 s.in.user_handle = handle;
1004 s.in.info = &u;
1005 s.in.level = 21;
1006
1007 E_md4hash(newpass, nt_hash);
1008 E_deshash(newpass, lm_hash);
1009
1010 ZERO_STRUCT(u);
1011
1012 u.info21.fields_present = fields_present;
1013
1014 if (fields_present & SAMR_FIELD_LM_PASSWORD_PRESENT) {
1015 u.info21.lm_owf_password.length = 16;
1016 u.info21.lm_owf_password.size = 16;
1017 u.info21.lm_owf_password.array = (uint16_t *)lm_hash;
1018 u.info21.lm_password_set = true;
1019 }
1020
1021 if (fields_present & SAMR_FIELD_NT_PASSWORD_PRESENT) {
1022 u.info21.nt_owf_password.length = 16;
1023 u.info21.nt_owf_password.size = 16;
1024 u.info21.nt_owf_password.array = (uint16_t *)nt_hash;
1025 u.info21.nt_password_set = true;
1026 }
1027
1028 status = dcerpc_fetch_session_key(p, &session_key);
1029 if (!NT_STATUS_IS_OK(status)) {
1030 torture_warning(tctx, "SetUserInfo level %u - no session key - %s\n",
1031 s.in.level, nt_errstr(status));
1032 return false;
1033 }
1034
1035 if (fields_present & SAMR_FIELD_LM_PASSWORD_PRESENT) {
1036 DATA_BLOB in,out;
1037 in = data_blob_const(u.info21.lm_owf_password.array,
1038 u.info21.lm_owf_password.length);
1039 out = data_blob_talloc_zero(tctx, 16);
1040 sess_crypt_blob(&out, &in, &session_key, true);
1041 u.info21.lm_owf_password.array = (uint16_t *)out.data;
1042 }
1043
1044 if (fields_present & SAMR_FIELD_NT_PASSWORD_PRESENT) {
1045 DATA_BLOB in,out;
1046 in = data_blob_const(u.info21.nt_owf_password.array,
1047 u.info21.nt_owf_password.length);
1048 out = data_blob_talloc_zero(tctx, 16);
1049 sess_crypt_blob(&out, &in, &session_key, true);
1050 u.info21.nt_owf_password.array = (uint16_t *)out.data;
1051 }
1052
1053 torture_comment(tctx, "Testing SetUserInfo level 21 (set password hash)\n");
1054
1055 status = dcerpc_samr_SetUserInfo(p, tctx, &s);
1056 if (!NT_STATUS_IS_OK(status)) {
1057 torture_warning(tctx, "SetUserInfo level %u failed - %s\n",
1058 s.in.level, nt_errstr(status));
1059 ret = false;
1060 } else {
1061 *password = newpass;
1062 }
1063
1064 /* try invalid length */
1065 if (fields_present & SAMR_FIELD_NT_PASSWORD_PRESENT) {
1066
1067 u.info21.nt_owf_password.length++;
1068
1069 status = dcerpc_samr_SetUserInfo(p, tctx, &s);
1070
1071 if (!NT_STATUS_EQUAL(status, NT_STATUS_INVALID_PARAMETER)) {
1072 torture_warning(tctx, "SetUserInfo level %u should have failed with NT_STATUS_INVALID_PARAMETER - %s\n",
1073 s.in.level, nt_errstr(status));
1074 ret = false;
1075 }
1076 }
1077
1078 if (fields_present & SAMR_FIELD_LM_PASSWORD_PRESENT) {
1079
1080 u.info21.lm_owf_password.length++;
1081
1082 status = dcerpc_samr_SetUserInfo(p, tctx, &s);
1083
1084 if (!NT_STATUS_EQUAL(status, NT_STATUS_INVALID_PARAMETER)) {
1085 torture_warning(tctx, "SetUserInfo level %u should have failed with NT_STATUS_INVALID_PARAMETER - %s\n",
1086 s.in.level, nt_errstr(status));
1087 ret = false;
1088 }
1089 }
1090
1091 return ret;
1092 }
1093
1094 static bool test_SetUserPass_level_ex(struct dcerpc_pipe *p,
1095 struct torture_context *tctx,
1096 struct policy_handle *handle,
1097 uint16_t level,
1098 uint32_t fields_present,
1099 char **password, uint8_t password_expired,
1100 bool use_setinfo2,
1101 bool *matched_expected_error)
1102 {
1103 NTSTATUS status;
1104 NTSTATUS expected_error = NT_STATUS_OK;
1105 struct samr_SetUserInfo s;
1106 struct samr_SetUserInfo2 s2;
1107 union samr_UserInfo u;
1108 bool ret = true;
1109 DATA_BLOB session_key;
1110 DATA_BLOB confounded_session_key = data_blob_talloc(tctx, NULL, 16);
1111 struct MD5Context ctx;
1112 uint8_t confounder[16];
1113 char *newpass;
1114 struct samr_GetUserPwInfo pwp;
1115 struct samr_PwInfo info;
1116 int policy_min_pw_len = 0;
1117 const char *comment = NULL;
1118 uint8_t lm_hash[16], nt_hash[16];
1119
1120 pwp.in.user_handle = handle;
1121 pwp.out.info = &info;
1122
1123 status = dcerpc_samr_GetUserPwInfo(p, tctx, &pwp);
1124 if (NT_STATUS_IS_OK(status)) {
1125 policy_min_pw_len = pwp.out.info->min_password_length;
1126 }
1127 newpass = samr_rand_pass_silent(tctx, policy_min_pw_len);
1128
1129 if (use_setinfo2) {
1130 s2.in.user_handle = handle;
1131 s2.in.info = &u;
1132 s2.in.level = level;
1133 } else {
1134 s.in.user_handle = handle;
1135 s.in.info = &u;
1136 s.in.level = level;
1137 }
1138
1139 if (fields_present & SAMR_FIELD_COMMENT) {
1140 comment = talloc_asprintf(tctx, "comment: %ld\n", time(NULL));
1141 }
1142
1143 ZERO_STRUCT(u);
1144
1145 switch (level) {
1146 case 18:
1147 E_md4hash(newpass, nt_hash);
1148 E_deshash(newpass, lm_hash);
1149
1150 u.info18.nt_pwd_active = true;
1151 u.info18.lm_pwd_active = true;
1152 u.info18.password_expired = password_expired;
1153
1154 memcpy(u.info18.lm_pwd.hash, lm_hash, 16);
1155 memcpy(u.info18.nt_pwd.hash, nt_hash, 16);
1156
1157 break;
1158 case 21:
1159 E_md4hash(newpass, nt_hash);
1160 E_deshash(newpass, lm_hash);
1161
1162 u.info21.fields_present = fields_present;
1163 u.info21.password_expired = password_expired;
1164 u.info21.comment.string = comment;
1165
1166 if (fields_present & SAMR_FIELD_LM_PASSWORD_PRESENT) {
1167 u.info21.lm_owf_password.length = 16;
1168 u.info21.lm_owf_password.size = 16;
1169 u.info21.lm_owf_password.array = (uint16_t *)lm_hash;
1170 u.info21.lm_password_set = true;
1171 }
1172
1173 if (fields_present & SAMR_FIELD_NT_PASSWORD_PRESENT) {
1174 u.info21.nt_owf_password.length = 16;
1175 u.info21.nt_owf_password.size = 16;
1176 u.info21.nt_owf_password.array = (uint16_t *)nt_hash;
1177 u.info21.nt_password_set = true;
1178 }
1179
1180 break;
1181 case 23:
1182 u.info23.info.fields_present = fields_present;
1183 u.info23.info.password_expired = password_expired;
1184 u.info23.info.comment.string = comment;
1185
1186 encode_pw_buffer(u.info23.password.data, newpass, STR_UNICODE);
1187
1188 break;
1189 case 24:
1190 u.info24.password_expired = password_expired;
1191
1192 encode_pw_buffer(u.info24.password.data, newpass, STR_UNICODE);
1193
1194 break;
1195 case 25:
1196 u.info25.info.fields_present = fields_present;
1197 u.info25.info.password_expired = password_expired;
1198 u.info25.info.comment.string = comment;
1199
1200 encode_pw_buffer(u.info25.password.data, newpass, STR_UNICODE);
1201
1202 break;
1203 case 26:
1204 u.info26.password_expired = password_expired;
1205
1206 encode_pw_buffer(u.info26.password.data, newpass, STR_UNICODE);
1207
1208 break;
1209 }
1210
1211 status = dcerpc_fetch_session_key(p, &session_key);
1212 if (!NT_STATUS_IS_OK(status)) {
1213 torture_warning(tctx, "SetUserInfo level %u - no session key - %s\n",
1214 s.in.level, nt_errstr(status));
1215 return false;
1216 }
1217
1218 generate_random_buffer((uint8_t *)confounder, 16);
1219
1220 MD5Init(&ctx);
1221 MD5Update(&ctx, confounder, 16);
1222 MD5Update(&ctx, session_key.data, session_key.length);
1223 MD5Final(confounded_session_key.data, &ctx);
1224
1225 switch (level) {
1226 case 18:
1227 {
1228 DATA_BLOB in,out;
1229 in = data_blob_const(u.info18.nt_pwd.hash, 16);
1230 out = data_blob_talloc_zero(tctx, 16);
1231 sess_crypt_blob(&out, &in, &session_key, true);
1232 memcpy(u.info18.nt_pwd.hash, out.data, out.length);
1233 }
1234 {
1235 DATA_BLOB in,out;
1236 in = data_blob_const(u.info18.lm_pwd.hash, 16);
1237 out = data_blob_talloc_zero(tctx, 16);
1238 sess_crypt_blob(&out, &in, &session_key, true);
1239 memcpy(u.info18.lm_pwd.hash, out.data, out.length);
1240 }
1241
1242 break;
1243 case 21:
1244 if (fields_present & SAMR_FIELD_LM_PASSWORD_PRESENT) {
1245 DATA_BLOB in,out;
1246 in = data_blob_const(u.info21.lm_owf_password.array,
1247 u.info21.lm_owf_password.length);
1248 out = data_blob_talloc_zero(tctx, 16);
1249 sess_crypt_blob(&out, &in, &session_key, true);
1250 u.info21.lm_owf_password.array = (uint16_t *)out.data;
1251 }
1252 if (fields_present & SAMR_FIELD_NT_PASSWORD_PRESENT) {
1253 DATA_BLOB in,out;
1254 in = data_blob_const(u.info21.nt_owf_password.array,
1255 u.info21.nt_owf_password.length);
1256 out = data_blob_talloc_zero(tctx, 16);
1257 sess_crypt_blob(&out, &in, &session_key, true);
1258 u.info21.nt_owf_password.array = (uint16_t *)out.data;
1259 }
1260 break;
1261 case 23:
1262 arcfour_crypt_blob(u.info23.password.data, 516, &session_key);
1263 break;
1264 case 24:
1265 arcfour_crypt_blob(u.info24.password.data, 516, &session_key);
1266 break;
1267 case 25:
1268 arcfour_crypt_blob(u.info25.password.data, 516, &confounded_session_key);
1269 memcpy(&u.info25.password.data[516], confounder, 16);
1270 break;
1271 case 26:
1272 arcfour_crypt_blob(u.info26.password.data, 516, &confounded_session_key);
1273 memcpy(&u.info26.password.data[516], confounder, 16);
1274 break;
1275 }
1276
1277 if (use_setinfo2) {
1278 status = dcerpc_samr_SetUserInfo2(p, tctx, &s2);
1279 } else {
1280 status = dcerpc_samr_SetUserInfo(p, tctx, &s);
1281 }
1282
1283 if (!NT_STATUS_IS_OK(status)) {
1284 if (fields_present == 0) {
1285 expected_error = NT_STATUS_INVALID_PARAMETER;
1286 }
1287 if (fields_present & SAMR_FIELD_LAST_PWD_CHANGE) {
1288 expected_error = NT_STATUS_ACCESS_DENIED;
1289 }
1290 }
1291
1292 if (!NT_STATUS_IS_OK(expected_error)) {
1293 if (use_setinfo2) {
1294 torture_assert_ntstatus_equal(tctx,
1295 s2.out.result,
1296 expected_error, "SetUserInfo2 failed");
1297 } else {
1298 torture_assert_ntstatus_equal(tctx,
1299 s.out.result,
1300 expected_error, "SetUserInfo failed");
1301 }
1302 *matched_expected_error = true;
1303 return true;
1304 }
1305
1306 if (!NT_STATUS_IS_OK(status)) {
1307 torture_warning(tctx, "SetUserInfo%s level %u failed - %s\n",
1308 use_setinfo2 ? "2":"", level, nt_errstr(status));
1309 ret = false;
1310 } else {
1311 *password = newpass;
1312 }
1313
1314 return ret;
1315 }
1316
1317 static bool test_SetAliasInfo(struct dcerpc_pipe *p, struct torture_context *tctx,
1318 struct policy_handle *handle)
1319 {
1320 NTSTATUS status;
1321 struct samr_SetAliasInfo r;
1322 struct samr_QueryAliasInfo q;
1323 union samr_AliasInfo *info;
1324 uint16_t levels[] = {2, 3};
1325 int i;
1326 bool ret = true;
1327
1328 /* Ignoring switch level 1, as that includes the number of members for the alias
1329 * and setting this to a wrong value might have negative consequences
1330 */
1331
1332 for (i=0;i<ARRAY_SIZE(levels);i++) {
1333 torture_comment(tctx, "Testing SetAliasInfo level %u\n", levels[i]);
1334
1335 r.in.alias_handle = handle;
1336 r.in.level = levels[i];
1337 r.in.info = talloc(tctx, union samr_AliasInfo);
1338 switch (r.in.level) {
1339 case ALIASINFONAME: init_lsa_String(&r.in.info->name,TEST_ALIASNAME); break;
1340 case ALIASINFODESCRIPTION: init_lsa_String(&r.in.info->description,
1341 "Test Description, should test I18N as well"); break;
1342 case ALIASINFOALL: torture_comment(tctx, "ALIASINFOALL ignored\n"); break;
1343 }
1344
1345 status = dcerpc_samr_SetAliasInfo(p, tctx, &r);
1346 if (!NT_STATUS_IS_OK(status)) {
1347 torture_warning(tctx, "SetAliasInfo level %u failed - %s\n",
1348 levels[i], nt_errstr(status));
1349 ret = false;
1350 }
1351
1352 q.in.alias_handle = handle;
1353 q.in.level = levels[i];
1354 q.out.info = &info;
1355
1356 status = dcerpc_samr_QueryAliasInfo(p, tctx, &q);
1357 if (!NT_STATUS_IS_OK(status)) {
1358 torture_warning(tctx, "QueryAliasInfo level %u failed - %s\n",
1359 levels[i], nt_errstr(status));
1360 ret = false;
1361 }
1362 }
1363
1364 return ret;
1365 }
1366
1367 static bool test_GetGroupsForUser(struct dcerpc_pipe *p, struct torture_context *tctx,
1368 struct policy_handle *user_handle)
1369 {
1370 struct samr_GetGroupsForUser r;
1371 struct samr_RidWithAttributeArray *rids = NULL;
1372 NTSTATUS status;
1373
1374 torture_comment(tctx, "testing GetGroupsForUser\n");
1375
1376 r.in.user_handle = user_handle;
1377 r.out.rids = &rids;
1378
1379 status = dcerpc_samr_GetGroupsForUser(p, tctx, &r);
1380 torture_assert_ntstatus_ok(tctx, status, "GetGroupsForUser");
1381
1382 return true;
1383
1384 }
1385
1386 static bool test_GetDomPwInfo(struct dcerpc_pipe *p, struct torture_context *tctx,
1387 struct lsa_String *domain_name)
1388 {
1389 NTSTATUS status;
1390 struct samr_GetDomPwInfo r;
1391 struct samr_PwInfo info;
1392
1393 r.in.domain_name = domain_name;
1394 r.out.info = &info;
1395
1396 torture_comment(tctx, "Testing GetDomPwInfo with name %s\n", r.in.domain_name->string);
1397
1398 status = dcerpc_samr_GetDomPwInfo(p, tctx, &r);
1399 torture_assert_ntstatus_ok(tctx, status, "GetDomPwInfo");
1400
1401 r.in.domain_name->string = talloc_asprintf(tctx, "\\\\%s", dcerpc_server_name(p));
1402 torture_comment(tctx, "Testing GetDomPwInfo with name %s\n", r.in.domain_name->string);
1403
1404 status = dcerpc_samr_GetDomPwInfo(p, tctx, &r);
1405 torture_assert_ntstatus_ok(tctx, status, "GetDomPwInfo");
1406
1407 r.in.domain_name->string = "\\\\__NONAME__";
1408 torture_comment(tctx, "Testing GetDomPwInfo with name %s\n", r.in.domain_name->string);
1409
1410 status = dcerpc_samr_GetDomPwInfo(p, tctx, &r);
1411 torture_assert_ntstatus_ok(tctx, status, "GetDomPwInfo");
1412
1413 r.in.domain_name->string = "\\\\Builtin";
1414 torture_comment(tctx, "Testing GetDomPwInfo with name %s\n", r.in.domain_name->string);
1415
1416 status = dcerpc_samr_GetDomPwInfo(p, tctx, &r);
1417 torture_assert_ntstatus_ok(tctx, status, "GetDomPwInfo");
1418
1419 return true;
1420 }
1421
1422 static bool test_GetUserPwInfo(struct dcerpc_pipe *p, struct torture_context *tctx,
1423 struct policy_handle *handle)
1424 {
1425 NTSTATUS status;
1426 struct samr_GetUserPwInfo r;
1427 struct samr_PwInfo info;
1428
1429 torture_comment(tctx, "Testing GetUserPwInfo\n");
1430
1431 r.in.user_handle = handle;
1432 r.out.info = &info;
1433
1434 status = dcerpc_samr_GetUserPwInfo(p, tctx, &r);
1435 torture_assert_ntstatus_ok(tctx, status, "GetUserPwInfo");
1436
1437 return true;
1438 }
1439
1440 static NTSTATUS test_LookupName(struct dcerpc_pipe *p, struct torture_context *tctx,
1441 struct policy_handle *domain_handle, const char *name,
1442 uint32_t *rid)
1443 {
1444 NTSTATUS status;
1445 struct samr_LookupNames n;
1446 struct lsa_String sname[2];
1447 struct samr_Ids rids, types;
1448
1449 init_lsa_String(&sname[0], name);
1450
1451 n.in.domain_handle = domain_handle;
1452 n.in.num_names = 1;
1453 n.in.names = sname;
1454 n.out.rids = &rids;
1455 n.out.types = &types;
1456 status = dcerpc_samr_LookupNames(p, tctx, &n);
1457 if (NT_STATUS_IS_OK(status)) {
1458 *rid = n.out.rids->ids[0];
1459 } else {
1460 return status;
1461 }
1462
1463 init_lsa_String(&sname[1], "xxNONAMExx");
1464 n.in.num_names = 2;
1465 status = dcerpc_samr_LookupNames(p, tctx, &n);
1466 if (!NT_STATUS_EQUAL(status, STATUS_SOME_UNMAPPED)) {
1467 torture_warning(tctx, "LookupNames[2] failed - %s\n", nt_errstr(status));
1468 if (NT_STATUS_IS_OK(status)) {
1469 return NT_STATUS_UNSUCCESSFUL;
1470 }
1471 return status;
1472 }
1473
1474 n.in.num_names = 0;
1475 status = dcerpc_samr_LookupNames(p, tctx, &n);
1476 if (!NT_STATUS_IS_OK(status)) {
1477 torture_warning(tctx, "LookupNames[0] failed - %s\n", nt_errstr(status));
1478 return status;
1479 }
1480
1481 init_lsa_String(&sname[0], "xxNONAMExx");
1482 n.in.num_names = 1;
1483 status = dcerpc_samr_LookupNames(p, tctx, &n);
1484 if (!NT_STATUS_EQUAL(status, NT_STATUS_NONE_MAPPED)) {
1485 torture_warning(tctx, "LookupNames[1 bad name] failed - %s\n", nt_errstr(status));
1486 if (NT_STATUS_IS_OK(status)) {
1487 return NT_STATUS_UNSUCCESSFUL;
1488 }
1489 return status;
1490 }
1491
1492 init_lsa_String(&sname[0], "xxNONAMExx");
1493 init_lsa_String(&sname[1], "xxNONAME2xx");
1494 n.in.num_names = 2;
1495 status = dcerpc_samr_LookupNames(p, tctx, &n);
1496 if (!NT_STATUS_EQUAL(status, NT_STATUS_NONE_MAPPED)) {
1497 torture_warning(tctx, "LookupNames[2 bad names] failed - %s\n", nt_errstr(status));
1498 if (NT_STATUS_IS_OK(status)) {
1499 return NT_STATUS_UNSUCCESSFUL;
1500 }
1501 return status;
1502 }
1503
1504 return NT_STATUS_OK;
1505 }
1506
1507 static NTSTATUS test_OpenUser_byname(struct dcerpc_pipe *p,
1508 struct torture_context *tctx,
1509 struct policy_handle *domain_handle,
1510 const char *name, struct policy_handle *user_handle)
1511 {
1512 NTSTATUS status;
1513 struct samr_OpenUser r;
1514 uint32_t rid;
1515
1516 status = test_LookupName(p, tctx, domain_handle, name, &rid);
1517 if (!NT_STATUS_IS_OK(status)) {
1518 return status;
1519 }
1520
1521 r.in.domain_handle = domain_handle;
1522 r.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
1523 r.in.rid = rid;
1524 r.out.user_handle = user_handle;
1525 status = dcerpc_samr_OpenUser(p, tctx, &r);
1526 if (!NT_STATUS_IS_OK(status)) {
1527 torture_warning(tctx, "OpenUser_byname(%s -> %d) failed - %s\n", name, rid, nt_errstr(status));
1528 }
1529
1530 return status;
1531 }
1532
1533 #if 0
1534 static bool test_ChangePasswordNT3(struct dcerpc_pipe *p,
1535 struct torture_context *tctx,
1536 struct policy_handle *handle)
1537 {
1538 NTSTATUS status;
1539 struct samr_ChangePasswordUser r;
1540 bool ret = true;
1541 struct samr_Password hash1, hash2, hash3, hash4, hash5, hash6;
1542 struct policy_handle user_handle;
1543 char *oldpass = "test";
1544 char *newpass = "test2";
1545 uint8_t old_nt_hash[16], new_nt_hash[16];
1546 uint8_t old_lm_hash[16], new_lm_hash[16];
1547
1548 status = test_OpenUser_byname(p, tctx, handle, "testuser", &user_handle);
1549 if (!NT_STATUS_IS_OK(status)) {
1550 return false;
1551 }
1552
1553 torture_comment(tctx, "Testing ChangePasswordUser for user 'testuser'\n");
1554
1555 torture_comment(tctx, "old password: %s\n", oldpass);
1556 torture_comment(tctx, "new password: %s\n", newpass);
1557
1558 E_md4hash(oldpass, old_nt_hash);
1559 E_md4hash(newpass, new_nt_hash);
1560 E_deshash(oldpass, old_lm_hash);
1561 E_deshash(newpass, new_lm_hash);
1562
1563 E_old_pw_hash(new_lm_hash, old_lm_hash, hash1.hash);
1564 E_old_pw_hash(old_lm_hash, new_lm_hash, hash2.hash);
1565 E_old_pw_hash(new_nt_hash, old_nt_hash, hash3.hash);
1566 E_old_pw_hash(old_nt_hash, new_nt_hash, hash4.hash);
1567 E_old_pw_hash(old_lm_hash, new_nt_hash, hash5.hash);
1568 E_old_pw_hash(old_nt_hash, new_lm_hash, hash6.hash);
1569
1570 r.in.handle = &user_handle;
1571 r.in.lm_present = 1;
1572 r.in.old_lm_crypted = &hash1;
1573 r.in.new_lm_crypted = &hash2;
1574 r.in.nt_present = 1;
1575 r.in.old_nt_crypted = &hash3;
1576 r.in.new_nt_crypted = &hash4;
1577 r.in.cross1_present = 1;
1578 r.in.nt_cross = &hash5;
1579 r.in.cross2_present = 1;
1580 r.in.lm_cross = &hash6;
1581
1582 status = dcerpc_samr_ChangePasswordUser(p, tctx, &r);
1583 if (!NT_STATUS_IS_OK(status)) {
1584 torture_warning(tctx, "ChangePasswordUser failed - %s\n", nt_errstr(status));
1585 ret = false;
1586 }
1587
1588 if (!test_samr_handle_Close(p, tctx, &user_handle)) {
1589 ret = false;
1590 }
1591
1592 return ret;
1593 }
1594 #endif
1595
1596 static bool test_ChangePasswordUser(struct dcerpc_pipe *p, struct torture_context *tctx,
1597 const char *acct_name,
1598 struct policy_handle *handle, char **password)
1599 {
1600 NTSTATUS status;
1601 struct samr_ChangePasswordUser r;
1602 bool ret = true;
1603 struct samr_Password hash1, hash2, hash3, hash4, hash5, hash6;
1604 struct policy_handle user_handle;
1605 char *oldpass;
1606 uint8_t old_nt_hash[16], new_nt_hash[16];
1607 uint8_t old_lm_hash[16], new_lm_hash[16];
1608 bool changed = true;
1609
1610 char *newpass;
1611 struct samr_GetUserPwInfo pwp;
1612 struct samr_PwInfo info;
1613 int policy_min_pw_len = 0;
1614
1615 status = test_OpenUser_byname(p, tctx, handle, acct_name, &user_handle);
1616 if (!NT_STATUS_IS_OK(status)) {
1617 return false;
1618 }
1619 pwp.in.user_handle = &user_handle;
1620 pwp.out.info = &info;
1621
1622 status = dcerpc_samr_GetUserPwInfo(p, tctx, &pwp);
1623 if (NT_STATUS_IS_OK(status)) {
1624 policy_min_pw_len = pwp.out.info->min_password_length;
1625 }
1626 newpass = samr_rand_pass(tctx, policy_min_pw_len);
1627
1628 torture_comment(tctx, "Testing ChangePasswordUser\n");
1629
1630 torture_assert(tctx, *password != NULL,
1631 "Failing ChangePasswordUser as old password was NULL. Previous test failed?");
1632
1633 oldpass = *password;
1634
1635 E_md4hash(oldpass, old_nt_hash);
1636 E_md4hash(newpass, new_nt_hash);
1637 E_deshash(oldpass, old_lm_hash);
1638 E_deshash(newpass, new_lm_hash);
1639
1640 E_old_pw_hash(new_lm_hash, old_lm_hash, hash1.hash);
1641 E_old_pw_hash(old_lm_hash, new_lm_hash, hash2.hash);
1642 E_old_pw_hash(new_nt_hash, old_nt_hash, hash3.hash);
1643 E_old_pw_hash(old_nt_hash, new_nt_hash, hash4.hash);
1644 E_old_pw_hash(old_lm_hash, new_nt_hash, hash5.hash);
1645 E_old_pw_hash(old_nt_hash, new_lm_hash, hash6.hash);
1646
1647 r.in.user_handle = &user_handle;
1648 r.in.lm_present = 1;
1649 /* Break the LM hash */
1650 hash1.hash[0]++;
1651 r.in.old_lm_crypted = &hash1;
1652 r.in.new_lm_crypted = &hash2;
1653 r.in.nt_present = 1;
1654 r.in.old_nt_crypted = &hash3;
1655 r.in.new_nt_crypted = &hash4;
1656 r.in.cross1_present = 1;
1657 r.in.nt_cross = &hash5;
1658 r.in.cross2_present = 1;
1659 r.in.lm_cross = &hash6;
1660
1661 status = dcerpc_samr_ChangePasswordUser(p, tctx, &r);
1662 torture_assert_ntstatus_equal(tctx, status, NT_STATUS_WRONG_PASSWORD,
1663 "ChangePasswordUser failed: expected NT_STATUS_WRONG_PASSWORD because we broke the LM hash");
1664
1665 /* Unbreak the LM hash */
1666 hash1.hash[0]--;
1667
1668 r.in.user_handle = &user_handle;
1669 r.in.lm_present = 1;
1670 r.in.old_lm_crypted = &hash1;
1671 r.in.new_lm_crypted = &hash2;
1672 /* Break the NT hash */
1673 hash3.hash[0]--;
1674 r.in.nt_present = 1;
1675 r.in.old_nt_crypted = &hash3;
1676 r.in.new_nt_crypted = &hash4;
1677 r.in.cross1_present = 1;
1678 r.in.nt_cross = &hash5;
1679 r.in.cross2_present = 1;
1680 r.in.lm_cross = &hash6;
1681
1682 status = dcerpc_samr_ChangePasswordUser(p, tctx, &r);
1683 torture_assert_ntstatus_equal(tctx, status, NT_STATUS_WRONG_PASSWORD,
1684 "expected NT_STATUS_WRONG_PASSWORD because we broke the NT hash");
1685
1686 /* Unbreak the NT hash */
1687 hash3.hash[0]--;
1688
1689 r.in.user_handle = &user_handle;
1690 r.in.lm_present = 1;
1691 r.in.old_lm_crypted = &hash1;
1692 r.in.new_lm_crypted = &hash2;
1693 r.in.nt_present = 1;
1694 r.in.old_nt_crypted = &hash3;
1695 r.in.new_nt_crypted = &hash4;
1696 r.in.cross1_present = 1;
1697 r.in.nt_cross = &hash5;
1698 r.in.cross2_present = 1;
1699 /* Break the LM cross */
1700 hash6.hash[0]++;
1701 r.in.lm_cross = &hash6;
1702
1703 status = dcerpc_samr_ChangePasswordUser(p, tctx, &r);
1704 if (!NT_STATUS_EQUAL(status, NT_STATUS_WRONG_PASSWORD)) {
1705 torture_warning(tctx, "ChangePasswordUser failed: expected NT_STATUS_WRONG_PASSWORD because we broke the LM cross-hash, got %s\n", nt_errstr(status));
1706 ret = false;
1707 }
1708
1709 /* Unbreak the LM cross */
1710 hash6.hash[0]--;
1711
1712 r.in.user_handle = &user_handle;
1713 r.in.lm_present = 1;
1714 r.in.old_lm_crypted = &hash1;
1715 r.in.new_lm_crypted = &hash2;
1716 r.in.nt_present = 1;
1717 r.in.old_nt_crypted = &hash3;
1718 r.in.new_nt_crypted = &hash4;
1719 r.in.cross1_present = 1;
1720 /* Break the NT cross */
1721 hash5.hash[0]++;
1722 r.in.nt_cross = &hash5;
1723 r.in.cross2_present = 1;
1724 r.in.lm_cross = &hash6;
1725
1726 status = dcerpc_samr_ChangePasswordUser(p, tctx, &r);
1727 if (!NT_STATUS_EQUAL(status, NT_STATUS_WRONG_PASSWORD)) {
1728 torture_warning(tctx, "ChangePasswordUser failed: expected NT_STATUS_WRONG_PASSWORD because we broke the NT cross-hash, got %s\n", nt_errstr(status));
1729 ret = false;
1730 }
1731
1732 /* Unbreak the NT cross */
1733 hash5.hash[0]--;
1734
1735
1736 /* Reset the hashes to not broken values */
1737 E_old_pw_hash(new_lm_hash, old_lm_hash, hash1.hash);
1738 E_old_pw_hash(old_lm_hash, new_lm_hash, hash2.hash);
1739 E_old_pw_hash(new_nt_hash, old_nt_hash, hash3.hash);
1740 E_old_pw_hash(old_nt_hash, new_nt_hash, hash4.hash);
1741 E_old_pw_hash(old_lm_hash, new_nt_hash, hash5.hash);
1742 E_old_pw_hash(old_nt_hash, new_lm_hash, hash6.hash);
1743
1744 r.in.user_handle = &user_handle;
1745 r.in.lm_present = 1;
1746 r.in.old_lm_crypted = &hash1;
1747 r.in.new_lm_crypted = &hash2;
1748 r.in.nt_present = 1;
1749 r.in.old_nt_crypted = &hash3;
1750 r.in.new_nt_crypted = &hash4;
1751 r.in.cross1_present = 1;
1752 r.in.nt_cross = &hash5;
1753 r.in.cross2_present = 0;
1754 r.in.lm_cross = NULL;
1755
1756 status = dcerpc_samr_ChangePasswordUser(p, tctx, &r);
1757 if (NT_STATUS_IS_OK(status)) {
1758 changed = true;
1759 *password = newpass;
1760 } else if (!NT_STATUS_EQUAL(NT_STATUS_PASSWORD_RESTRICTION, status)) {
1761 torture_warning(tctx, "ChangePasswordUser failed: expected NT_STATUS_OK, or at least NT_STATUS_PASSWORD_RESTRICTION, got %s\n", nt_errstr(status));
1762 ret = false;
1763 }
1764
1765 oldpass = newpass;
1766 newpass = samr_rand_pass(tctx, policy_min_pw_len);
1767
1768 E_md4hash(oldpass, old_nt_hash);
1769 E_md4hash(newpass, new_nt_hash);
1770 E_deshash(oldpass, old_lm_hash);
1771 E_deshash(newpass, new_lm_hash);
1772
1773
1774 /* Reset the hashes to not broken values */
1775 E_old_pw_hash(new_lm_hash, old_lm_hash, hash1.hash);
1776 E_old_pw_hash(old_lm_hash, new_lm_hash, hash2.hash);
1777 E_old_pw_hash(new_nt_hash, old_nt_hash, hash3.hash);
1778 E_old_pw_hash(old_nt_hash, new_nt_hash, hash4.hash);
1779 E_old_pw_hash(old_lm_hash, new_nt_hash, hash5.hash);
1780 E_old_pw_hash(old_nt_hash, new_lm_hash, hash6.hash);
1781
1782 r.in.user_handle = &user_handle;
1783 r.in.lm_present = 1;
1784 r.in.old_lm_crypted = &hash1;
1785 r.in.new_lm_crypted = &hash2;
1786 r.in.nt_present = 1;
1787 r.in.old_nt_crypted = &hash3;
1788 r.in.new_nt_crypted = &hash4;
1789 r.in.cross1_present = 0;
1790 r.in.nt_cross = NULL;
1791 r.in.cross2_present = 1;
1792 r.in.lm_cross = &hash6;
1793
1794 status = dcerpc_samr_ChangePasswordUser(p, tctx, &r);
1795 if (NT_STATUS_IS_OK(status)) {
1796 changed = true;
1797 *password = newpass;
1798 } else if (!NT_STATUS_EQUAL(NT_STATUS_PASSWORD_RESTRICTION, status)) {
1799 torture_warning(tctx, "ChangePasswordUser failed: expected NT_STATUS_NT_CROSS_ENCRYPTION_REQUIRED, got %s\n", nt_errstr(status));
1800 ret = false;
1801 }
1802
1803 oldpass = newpass;
1804 newpass = samr_rand_pass(tctx, policy_min_pw_len);
1805
1806 E_md4hash(oldpass, old_nt_hash);
1807 E_md4hash(newpass, new_nt_hash);
1808 E_deshash(oldpass, old_lm_hash);
1809 E_deshash(newpass, new_lm_hash);
1810
1811
1812 /* Reset the hashes to not broken values */
1813 E_old_pw_hash(new_lm_hash, old_lm_hash, hash1.hash);
1814 E_old_pw_hash(old_lm_hash, new_lm_hash, hash2.hash);
1815 E_old_pw_hash(new_nt_hash, old_nt_hash, hash3.hash);
1816 E_old_pw_hash(old_nt_hash, new_nt_hash, hash4.hash);
1817 E_old_pw_hash(old_lm_hash, new_nt_hash, hash5.hash);
1818 E_old_pw_hash(old_nt_hash, new_lm_hash, hash6.hash);
1819
1820 r.in.user_handle = &user_handle;
1821 r.in.lm_present = 1;
1822 r.in.old_lm_crypted = &hash1;
1823 r.in.new_lm_crypted = &hash2;
1824 r.in.nt_present = 1;
1825 r.in.old_nt_crypted = &hash3;
1826 r.in.new_nt_crypted = &hash4;
1827 r.in.cross1_present = 1;
1828 r.in.nt_cross = &hash5;
1829 r.in.cross2_present = 1;
1830 r.in.lm_cross = &hash6;
1831
1832 status = dcerpc_samr_ChangePasswordUser(p, tctx, &r);
1833 if (NT_STATUS_EQUAL(status, NT_STATUS_PASSWORD_RESTRICTION)) {
1834 torture_comment(tctx, "ChangePasswordUser returned: %s perhaps min password age? (not fatal)\n", nt_errstr(status));
1835 } else if (!NT_STATUS_IS_OK(status)) {
1836 torture_warning(tctx, "ChangePasswordUser failed - %s\n", nt_errstr(status));
1837 ret = false;
1838 } else {
1839 changed = true;
1840 *password = newpass;
1841 }
1842
1843 r.in.user_handle = &user_handle;
1844 r.in.lm_present = 1;
1845 r.in.old_lm_crypted = &hash1;
1846 r.in.new_lm_crypted = &hash2;
1847 r.in.nt_present = 1;
1848 r.in.old_nt_crypted = &hash3;
1849 r.in.new_nt_crypted = &hash4;
1850 r.in.cross1_present = 1;
1851 r.in.nt_cross = &hash5;
1852 r.in.cross2_present = 1;
1853 r.in.lm_cross = &hash6;
1854
1855 if (changed) {
1856 status = dcerpc_samr_ChangePasswordUser(p, tctx, &r);
1857 if (NT_STATUS_EQUAL(status, NT_STATUS_PASSWORD_RESTRICTION)) {
1858 torture_comment(tctx, "ChangePasswordUser returned: %s perhaps min password age? (not fatal)\n", nt_errstr(status));
1859 } else if (!NT_STATUS_EQUAL(status, NT_STATUS_WRONG_PASSWORD)) {
1860 torture_warning(tctx, "ChangePasswordUser failed: expected NT_STATUS_WRONG_PASSWORD because we already changed the password, got %s\n", nt_errstr(status));
1861 ret = false;
1862 }
1863 }
1864
1865
1866 if (!test_samr_handle_Close(p, tctx, &user_handle)) {
1867 ret = false;
1868 }
1869
1870 return ret;
1871 }
1872
1873
1874 static bool test_OemChangePasswordUser2(struct dcerpc_pipe *p, struct torture_context *tctx,
1875 const char *acct_name,
1876 struct policy_handle *handle, char **password)
1877 {
1878 NTSTATUS status;
1879 struct samr_OemChangePasswordUser2 r;
1880 bool ret = true;
1881 struct samr_Password lm_verifier;
1882 struct samr_CryptPassword lm_pass;
1883 struct lsa_AsciiString server, account, account_bad;
1884 char *oldpass;
1885 char *newpass;
1886 uint8_t old_lm_hash[16], new_lm_hash[16];
1887
1888 struct samr_GetDomPwInfo dom_pw_info;
1889 struct samr_PwInfo info;
1890 int policy_min_pw_len = 0;
1891
1892 struct lsa_String domain_name;
1893
1894 domain_name.string = "";
1895 dom_pw_info.in.domain_name = &domain_name;
1896 dom_pw_info.out.info = &info;
1897
1898 torture_comment(tctx, "Testing OemChangePasswordUser2\n");
1899
1900 torture_assert(tctx, *password != NULL,
1901 "Failing OemChangePasswordUser2 as old password was NULL. Previous test failed?");
1902
1903 oldpass = *password;
1904
1905 status = dcerpc_samr_GetDomPwInfo(p, tctx, &dom_pw_info);
1906 if (NT_STATUS_IS_OK(status)) {
1907 policy_min_pw_len = dom_pw_info.out.info->min_password_length;
1908 }
1909
1910 newpass = samr_rand_pass(tctx, policy_min_pw_len);
1911
1912 server.string = talloc_asprintf(tctx, "\\\\%s", dcerpc_server_name(p));
1913 account.string = acct_name;
1914
1915 E_deshash(oldpass, old_lm_hash);
1916 E_deshash(newpass, new_lm_hash);
1917
1918 encode_pw_buffer(lm_pass.data, newpass, STR_ASCII);
1919 arcfour_crypt(lm_pass.data, old_lm_hash, 516);
1920 E_old_pw_hash(new_lm_hash, old_lm_hash, lm_verifier.hash);
1921
1922 r.in.server = &server;
1923 r.in.account = &account;
1924 r.in.password = &lm_pass;
1925 r.in.hash = &lm_verifier;
1926
1927 /* Break the verification */
1928 lm_verifier.hash[0]++;
1929
1930 status = dcerpc_samr_OemChangePasswordUser2(p, tctx, &r);
1931
1932 if (!NT_STATUS_EQUAL(status, NT_STATUS_PASSWORD_RESTRICTION)
1933 && !NT_STATUS_EQUAL(status, NT_STATUS_WRONG_PASSWORD)) {
1934 torture_warning(tctx, "OemChangePasswordUser2 failed, should have returned WRONG_PASSWORD (or at least 'PASSWORD_RESTRICTON') for invalid password verifier - %s\n",
1935 nt_errstr(status));
1936 ret = false;
1937 }
1938
1939 encode_pw_buffer(lm_pass.data, newpass, STR_ASCII);
1940 /* Break the old password */
1941 old_lm_hash[0]++;
1942 arcfour_crypt(lm_pass.data, old_lm_hash, 516);
1943 /* unbreak it for the next operation */
1944 old_lm_hash[0]--;
1945 E_old_pw_hash(new_lm_hash, old_lm_hash, lm_verifier.hash);
1946
1947 r.in.server = &server;
1948 r.in.account = &account;
1949 r.in.password = &lm_pass;
1950 r.in.hash = &lm_verifier;
1951
1952 status = dcerpc_samr_OemChangePasswordUser2(p, tctx, &r);
1953
1954 if (!NT_STATUS_EQUAL(status, NT_STATUS_PASSWORD_RESTRICTION)
1955 && !NT_STATUS_EQUAL(status, NT_STATUS_WRONG_PASSWORD)) {
1956 torture_warning(tctx, "OemChangePasswordUser2 failed, should have returned WRONG_PASSWORD (or at least 'PASSWORD_RESTRICTON') for invalidly encrpted password - %s\n",
1957 nt_errstr(status));
1958 ret = false;
1959 }
1960
1961 encode_pw_buffer(lm_pass.data, newpass, STR_ASCII);
1962 arcfour_crypt(lm_pass.data, old_lm_hash, 516);
1963
1964 r.in.server = &server;
1965 r.in.account = &account;
1966 r.in.password = &lm_pass;
1967 r.in.hash = NULL;
1968
1969 status = dcerpc_samr_OemChangePasswordUser2(p, tctx, &r);
1970
1971 if (!NT_STATUS_EQUAL(status, NT_STATUS_PASSWORD_RESTRICTION)
1972 && !NT_STATUS_EQUAL(status, NT_STATUS_INVALID_PARAMETER)) {
1973 torture_warning(tctx, "OemChangePasswordUser2 failed, should have returned INVALID_PARAMETER (or at least 'PASSWORD_RESTRICTON') for no supplied validation hash - %s\n",
1974 nt_errstr(status));
1975 ret = false;
1976 }
1977
1978 /* This shouldn't be a valid name */
1979 account_bad.string = TEST_ACCOUNT_NAME "XX";
1980 r.in.account = &account_bad;
1981
1982 status = dcerpc_samr_OemChangePasswordUser2(p, tctx, &r);
1983
1984 if (!NT_STATUS_EQUAL(status, NT_STATUS_INVALID_PARAMETER)) {
1985 torture_warning(tctx, "OemChangePasswordUser2 failed, should have returned INVALID_PARAMETER for no supplied validation hash and invalid user - %s\n",
1986 nt_errstr(status));
1987 ret = false;
1988 }
1989
1990 /* This shouldn't be a valid name */
1991 account_bad.string = TEST_ACCOUNT_NAME "XX";
1992 r.in.account = &account_bad;
1993 r.in.password = &lm_pass;
1994 r.in.hash = &lm_verifier;
1995
1996 status = dcerpc_samr_OemChangePasswordUser2(p, tctx, &r);
1997
1998 if (!NT_STATUS_EQUAL(status, NT_STATUS_WRONG_PASSWORD)) {
1999 torture_warning(tctx, "OemChangePasswordUser2 failed, should have returned WRONG_PASSWORD for invalid user - %s\n",
2000 nt_errstr(status));
2001 ret = false;
2002 }
2003
2004 /* This shouldn't be a valid name */
2005 account_bad.string = TEST_ACCOUNT_NAME "XX";
2006 r.in.account = &account_bad;
2007 r.in.password = NULL;
2008 r.in.hash = &lm_verifier;
2009
2010 status = dcerpc_samr_OemChangePasswordUser2(p, tctx, &r);
2011
2012 if (!NT_STATUS_EQUAL(status, NT_STATUS_INVALID_PARAMETER)) {
2013 torture_warning(tctx, "OemChangePasswordUser2 failed, should have returned INVALID_PARAMETER for no supplied password and invalid user - %s\n",
2014 nt_errstr(status));
2015 ret = false;
2016 }
2017
2018 E_deshash(oldpass, old_lm_hash);
2019 E_deshash(newpass, new_lm_hash);
2020
2021 encode_pw_buffer(lm_pass.data, newpass, STR_ASCII);
2022 arcfour_crypt(lm_pass.data, old_lm_hash, 516);
2023 E_old_pw_hash(new_lm_hash, old_lm_hash, lm_verifier.hash);
2024
2025 r.in.server = &server;
2026 r.in.account = &account;
2027 r.in.password = &lm_pass;
2028 r.in.hash = &lm_verifier;
2029
2030 status = dcerpc_samr_OemChangePasswordUser2(p, tctx, &r);
2031 if (NT_STATUS_EQUAL(status, NT_STATUS_PASSWORD_RESTRICTION)) {
2032 torture_comment(tctx, "OemChangePasswordUser2 returned: %s perhaps min password age? (not fatal)\n", nt_errstr(status));
2033 } else if (!NT_STATUS_IS_OK(status)) {
2034 torture_warning(tctx, "OemChangePasswordUser2 failed - %s\n", nt_errstr(status));
2035 ret = false;
2036 } else {
2037 *password = newpass;
2038 }
2039
2040 return ret;
2041 }
2042
2043
2044 static bool test_ChangePasswordUser2(struct dcerpc_pipe *p, struct torture_context *tctx,
2045 const char *acct_name,
2046 char **password,
2047 char *newpass, bool allow_password_restriction)
2048 {
2049 NTSTATUS status;
2050 struct samr_ChangePasswordUser2 r;
2051 bool ret = true;
2052 struct lsa_String server, account;
2053 struct samr_CryptPassword nt_pass, lm_pass;
2054 struct samr_Password nt_verifier, lm_verifier;
2055 char *oldpass;
2056 uint8_t old_nt_hash[16], new_nt_hash[16];
2057 uint8_t old_lm_hash[16], new_lm_hash[16];
2058
2059 struct samr_GetDomPwInfo dom_pw_info;
2060 struct samr_PwInfo info;
2061
2062 struct lsa_String domain_name;
2063
2064 domain_name.string = "";
2065 dom_pw_info.in.domain_name = &domain_name;
2066 dom_pw_info.out.info = &info;
2067
2068 torture_comment(tctx, "Testing ChangePasswordUser2 on %s\n", acct_name);
2069
2070 torture_assert(tctx, *password != NULL,
2071 "Failing ChangePasswordUser2 as old password was NULL. Previous test failed?");
2072 oldpass = *password;
2073
2074 if (!newpass) {
2075 int policy_min_pw_len = 0;
2076 status = dcerpc_samr_GetDomPwInfo(p, tctx, &dom_pw_info);
2077 if (NT_STATUS_IS_OK(status)) {
2078 policy_min_pw_len = dom_pw_info.out.info->min_password_length;
2079 }
2080
2081 newpass = samr_rand_pass(tctx, policy_min_pw_len);
2082 }
2083
2084 server.string = talloc_asprintf(tctx, "\\\\%s", dcerpc_server_name(p));
2085 init_lsa_String(&account, acct_name);
2086
2087 E_md4hash(oldpass, old_nt_hash);
2088 E_md4hash(newpass, new_nt_hash);
2089
2090 E_deshash(oldpass, old_lm_hash);
2091 E_deshash(newpass, new_lm_hash);
2092
2093 encode_pw_buffer(lm_pass.data, newpass, STR_ASCII|STR_TERMINATE);
2094 arcfour_crypt(lm_pass.data, old_lm_hash, 516);
2095 E_old_pw_hash(new_nt_hash, old_lm_hash, lm_verifier.hash);
2096
2097 encode_pw_buffer(nt_pass.data, newpass, STR_UNICODE);
2098 arcfour_crypt(nt_pass.data, old_nt_hash, 516);
2099 E_old_pw_hash(new_nt_hash, old_nt_hash, nt_verifier.hash);
2100
2101 r.in.server = &server;
2102 r.in.account = &account;
2103 r.in.nt_password = &nt_pass;
2104 r.in.nt_verifier = &nt_verifier;
2105 r.in.lm_change = 1;
2106 r.in.lm_password = &lm_pass;
2107 r.in.lm_verifier = &lm_verifier;
2108
2109 status = dcerpc_samr_ChangePasswordUser2(p, tctx, &r);
2110 if (allow_password_restriction && NT_STATUS_EQUAL(status, NT_STATUS_PASSWORD_RESTRICTION)) {
2111 torture_comment(tctx, "ChangePasswordUser2 returned: %s perhaps min password age? (not fatal)\n", nt_errstr(status));
2112 } else if (!NT_STATUS_IS_OK(status)) {
2113 torture_warning(tctx, "ChangePasswordUser2 failed - %s\n", nt_errstr(status));
2114 ret = false;
2115 } else {
2116 *password = newpass;
2117 }
2118
2119 return ret;
2120 }
2121
2122
2123 bool test_ChangePasswordUser3(struct dcerpc_pipe *p, struct torture_context *tctx,
2124 const char *account_string,
2125 int policy_min_pw_len,
2126 char **password,
2127 const char *newpass,
2128 NTTIME last_password_change,
2129 bool handle_reject_reason)
2130 {
2131 NTSTATUS status;
2132 struct samr_ChangePasswordUser3 r;
2133 bool ret = true;
2134 struct lsa_String server, account, account_bad;
2135 struct samr_CryptPassword nt_pass, lm_pass;
2136 struct samr_Password nt_verifier, lm_verifier;
2137 char *oldpass;
2138 uint8_t old_nt_hash[16], new_nt_hash[16];
2139 uint8_t old_lm_hash[16], new_lm_hash[16];
2140 NTTIME t;
2141 struct samr_DomInfo1 *dominfo = NULL;
2142 struct samr_ChangeReject *reject = NULL;
2143
2144 torture_comment(tctx, "Testing ChangePasswordUser3\n");
2145
2146 if (newpass == NULL) {
2147 do {
2148 if (policy_min_pw_len == 0) {
2149 newpass = samr_rand_pass(tctx, policy_min_pw_len);
2150 } else {
2151 newpass = samr_rand_pass_fixed_len(tctx, policy_min_pw_len);
2152 }
2153 } while (check_password_quality(newpass) == false);
2154 } else {
2155 torture_comment(tctx, "Using password '%s'\n", newpass);
2156 }
2157
2158 torture_assert(tctx, *password != NULL,
2159 "Failing ChangePasswordUser3 as old password was NULL. Previous test failed?");
2160
2161 oldpass = *password;
2162 server.string = talloc_asprintf(tctx, "\\\\%s", dcerpc_server_name(p));
2163 init_lsa_String(&account, account_string);
2164
2165 E_md4hash(oldpass, old_nt_hash);
2166 E_md4hash(newpass, new_nt_hash);
2167
2168 E_deshash(oldpass, old_lm_hash);
2169 E_deshash(newpass, new_lm_hash);
2170
2171 encode_pw_buffer(lm_pass.data, newpass, STR_UNICODE);
2172 arcfour_crypt(lm_pass.data, old_nt_hash, 516);
2173 E_old_pw_hash(new_nt_hash, old_lm_hash, lm_verifier.hash);
2174
2175 encode_pw_buffer(nt_pass.data, newpass, STR_UNICODE);
2176 arcfour_crypt(nt_pass.data, old_nt_hash, 516);
2177 E_old_pw_hash(new_nt_hash, old_nt_hash, nt_verifier.hash);
2178
2179 /* Break the verification */
2180 nt_verifier.hash[0]++;
2181
2182 r.in.server = &server;
2183 r.in.account = &account;
2184 r.in.nt_password = &nt_pass;
2185 r.in.nt_verifier = &nt_verifier;
2186 r.in.lm_change = 1;
2187 r.in.lm_password = &lm_pass;
2188 r.in.lm_verifier = &lm_verifier;
2189 r.in.password3 = NULL;
2190 r.out.dominfo = &dominfo;
2191 r.out.reject = &reject;
2192
2193 status = dcerpc_samr_ChangePasswordUser3(p, tctx, &r);
2194 if (!NT_STATUS_EQUAL(status, NT_STATUS_PASSWORD_RESTRICTION) &&
2195 (!NT_STATUS_EQUAL(status, NT_STATUS_WRONG_PASSWORD))) {
2196 torture_warning(tctx, "ChangePasswordUser3 failed, should have returned WRONG_PASSWORD (or at least 'PASSWORD_RESTRICTON') for invalid password verifier - %s\n",
2197 nt_errstr(status));
2198 ret = false;
2199 }
2200
2201 encode_pw_buffer(lm_pass.data, newpass, STR_UNICODE);
2202 arcfour_crypt(lm_pass.data, old_nt_hash, 516);
2203 E_old_pw_hash(new_nt_hash, old_lm_hash, lm_verifier.hash);
2204
2205 encode_pw_buffer(nt_pass.data, newpass, STR_UNICODE);
2206 /* Break the NT hash */
2207 old_nt_hash[0]++;
2208 arcfour_crypt(nt_pass.data, old_nt_hash, 516);
2209 /* Unbreak it again */
2210 old_nt_hash[0]--;
2211 E_old_pw_hash(new_nt_hash, old_nt_hash, nt_verifier.hash);
2212
2213 r.in.server = &server;
2214 r.in.account = &account;
2215 r.in.nt_password = &nt_pass;
2216 r.in.nt_verifier = &nt_verifier;
2217 r.in.lm_change = 1;
2218 r.in.lm_password = &lm_pass;
2219 r.in.lm_verifier = &lm_verifier;
2220 r.in.password3 = NULL;
2221 r.out.dominfo = &dominfo;
2222 r.out.reject = &reject;
2223
2224 status = dcerpc_samr_ChangePasswordUser3(p, tctx, &r);
2225 if (!NT_STATUS_EQUAL(status, NT_STATUS_PASSWORD_RESTRICTION) &&
2226 (!NT_STATUS_EQUAL(status, NT_STATUS_WRONG_PASSWORD))) {
2227 torture_warning(tctx, "ChangePasswordUser3 failed, should have returned WRONG_PASSWORD (or at least 'PASSWORD_RESTRICTON') for invalidly encrpted password - %s\n",
2228 nt_errstr(status));
2229 ret = false;
2230 }
2231
2232 /* This shouldn't be a valid name */
2233 init_lsa_String(&account_bad, talloc_asprintf(tctx, "%sXX", account_string));
2234
2235 r.in.account = &account_bad;
2236 status = dcerpc_samr_ChangePasswordUser3(p, tctx, &r);
2237 if (!NT_STATUS_EQUAL(status, NT_STATUS_WRONG_PASSWORD)) {
2238 torture_warning(tctx, "ChangePasswordUser3 failed, should have returned WRONG_PASSWORD for invalid username - %s\n",
2239 nt_errstr(status));
2240 ret = false;
2241 }
2242
2243 E_md4hash(oldpass, old_nt_hash);
2244 E_md4hash(newpass, new_nt_hash);
2245
2246 E_deshash(oldpass, old_lm_hash);
2247 E_deshash(newpass, new_lm_hash);
2248
2249 encode_pw_buffer(lm_pass.data, newpass, STR_UNICODE);
2250 arcfour_crypt(lm_pass.data, old_nt_hash, 516);
2251 E_old_pw_hash(new_nt_hash, old_lm_hash, lm_verifier.hash);
2252
2253 encode_pw_buffer(nt_pass.data, newpass, STR_UNICODE);
2254 arcfour_crypt(nt_pass.data, old_nt_hash, 516);
2255 E_old_pw_hash(new_nt_hash, old_nt_hash, nt_verifier.hash);
2256
2257 r.in.server = &server;
2258 r.in.account = &account;
2259 r.in.nt_password = &nt_pass;
2260 r.in.nt_verifier = &nt_verifier;
2261 r.in.lm_change = 1;
2262 r.in.lm_password = &lm_pass;
2263 r.in.lm_verifier = &lm_verifier;
2264 r.in.password3 = NULL;
2265 r.out.dominfo = &dominfo;
2266 r.out.reject = &reject;
2267
2268 unix_to_nt_time(&t, time(NULL));
2269
2270 status = dcerpc_samr_ChangePasswordUser3(p, tctx, &r);
2271
2272 if (NT_STATUS_EQUAL(status, NT_STATUS_PASSWORD_RESTRICTION)
2273 && dominfo
2274 && reject
2275 && handle_reject_reason
2276 && (!null_nttime(last_password_change) || !dominfo->min_password_age)) {
2277 if (dominfo->password_properties & DOMAIN_REFUSE_PASSWORD_CHANGE ) {
2278
2279 if (reject && (reject->reason != SAMR_REJECT_OTHER)) {
2280 torture_warning(tctx, "expected SAMR_REJECT_OTHER (%d), got %d\n",
2281 SAMR_REJECT_OTHER, reject->reason);
2282 return false;
2283 }
2284 }
2285
2286 /* We tested the order of precendence which is as follows:
2287
2288 * pwd min_age
2289 * pwd length
2290 * pwd complexity
2291 * pwd history
2292
2293 Guenther */
2294
2295 if ((dominfo->min_password_age > 0) && !null_nttime(last_password_change) &&
2296 (last_password_change + dominfo->min_password_age > t)) {
2297
2298 if (reject->reason != SAMR_REJECT_OTHER) {
2299 torture_warning(tctx, "expected SAMR_REJECT_OTHER (%d), got %d\n",
2300 SAMR_REJECT_OTHER, reject->reason);
2301 return false;
2302 }
2303
2304 } else if ((dominfo->min_password_length > 0) &&
2305 (strlen(newpass) < dominfo->min_password_length)) {
2306
2307 if (reject->reason != SAMR_REJECT_TOO_SHORT) {
2308 torture_warning(tctx, "expected SAMR_REJECT_TOO_SHORT (%d), got %d\n",
2309 SAMR_REJECT_TOO_SHORT, reject->reason);
2310 return false;
2311 }
2312
2313 } else if ((dominfo->password_history_length > 0) &&
2314 strequal(oldpass, newpass)) {
2315
2316 if (reject->reason != SAMR_REJECT_IN_HISTORY) {
2317 torture_warning(tctx, "expected SAMR_REJECT_IN_HISTORY (%d), got %d\n",
2318 SAMR_REJECT_IN_HISTORY, reject->reason);
2319 return false;
2320 }
2321 } else if (dominfo->password_properties & DOMAIN_PASSWORD_COMPLEX) {
2322
2323 if (reject->reason != SAMR_REJECT_COMPLEXITY) {
2324 torture_warning(tctx, "expected SAMR_REJECT_COMPLEXITY (%d), got %d\n",
2325 SAMR_REJECT_COMPLEXITY, reject->reason);
2326 return false;
2327 }
2328
2329 }
2330
2331 if (reject->reason == SAMR_REJECT_TOO_SHORT) {
2332 /* retry with adjusted size */
2333 return test_ChangePasswordUser3(p, tctx, account_string,
2334 dominfo->min_password_length,
2335 password, NULL, 0, false);
2336
2337 }
2338
2339 } else if (NT_STATUS_EQUAL(status, NT_STATUS_PASSWORD_RESTRICTION)) {
2340 if (reject && reject->reason != SAMR_REJECT_OTHER) {
2341 torture_warning(tctx, "expected SAMR_REJECT_OTHER (%d), got %d\n",
2342 SAMR_REJECT_OTHER, reject->reason);
2343 return false;
2344 }
2345 /* Perhaps the server has a 'min password age' set? */
2346
2347 } else {
2348 torture_assert_ntstatus_ok(tctx, status, "ChangePasswordUser3");
2349 *password = talloc_strdup(tctx, newpass);
2350 }
2351
2352 return ret;
2353 }
2354
2355 bool test_ChangePasswordRandomBytes(struct dcerpc_pipe *p, struct torture_context *tctx,
2356 const char *account_string,
2357 struct policy_handle *handle,
2358 char **password)
2359 {
2360 NTSTATUS status;
2361 struct samr_ChangePasswordUser3 r;
2362 struct samr_SetUserInfo s;
2363 union samr_UserInfo u;
2364 DATA_BLOB session_key;
2365 DATA_BLOB confounded_session_key = data_blob_talloc(tctx, NULL, 16);
2366 uint8_t confounder[16];
2367 struct MD5Context ctx;
2368
2369 bool ret = true;
2370 struct lsa_String server, account;
2371 struct samr_CryptPassword nt_pass;
2372 struct samr_Password nt_verifier;
2373 DATA_BLOB new_random_pass;
2374 char *newpass;
2375 char *oldpass;
2376 uint8_t old_nt_hash[16], new_nt_hash[16];
2377 NTTIME t;
2378 struct samr_DomInfo1 *dominfo = NULL;
2379 struct samr_ChangeReject *reject = NULL;
2380
2381 new_random_pass = samr_very_rand_pass(tctx, 128);
2382
2383 torture_assert(tctx, *password != NULL,
2384 "Failing ChangePasswordUser3 as old password was NULL. Previous test failed?");
2385
2386 oldpass = *password;
2387 server.string = talloc_asprintf(tctx, "\\\\%s", dcerpc_server_name(p));
2388 init_lsa_String(&account, account_string);
2389
2390 s.in.user_handle = handle;
2391 s.in.info = &u;
2392 s.in.level = 25;
2393
2394 ZERO_STRUCT(u);
2395
2396 u.info25.info.fields_present = SAMR_FIELD_NT_PASSWORD_PRESENT;
2397
2398 set_pw_in_buffer(u.info25.password.data, &new_random_pass);
2399
2400 status = dcerpc_fetch_session_key(p, &session_key);
2401 if (!NT_STATUS_IS_OK(status)) {
2402 torture_warning(tctx, "SetUserInfo level %u - no session key - %s\n",
2403 s.in.level, nt_errstr(status));
2404 return false;
2405 }
2406
2407 generate_random_buffer((uint8_t *)confounder, 16);
2408
2409 MD5Init(&ctx);
2410 MD5Update(&ctx, confounder, 16);
2411 MD5Update(&ctx, session_key.data, session_key.length);
2412 MD5Final(confounded_session_key.data, &ctx);
2413
2414 arcfour_crypt_blob(u.info25.password.data, 516, &confounded_session_key);
2415 memcpy(&u.info25.password.data[516], confounder, 16);
2416
2417 torture_comment(tctx, "Testing SetUserInfo level 25 (set password ex) with a password made up of only random bytes\n");
2418
2419 status = dcerpc_samr_SetUserInfo(p, tctx, &s);
2420 if (!NT_STATUS_IS_OK(status)) {
2421 torture_warning(tctx, "SetUserInfo level %u failed - %s\n",
2422 s.in.level, nt_errstr(status));
2423 ret = false;
2424 }
2425
2426 torture_comment(tctx, "Testing ChangePasswordUser3 with a password made up of only random bytes\n");
2427
2428 mdfour(old_nt_hash, new_random_pass.data, new_random_pass.length);
2429
2430 new_random_pass = samr_very_rand_pass(tctx, 128);
2431
2432 mdfour(new_nt_hash, new_random_pass.data, new_random_pass.length);
2433
2434 set_pw_in_buffer(nt_pass.data, &new_random_pass);
2435 arcfour_crypt(nt_pass.data, old_nt_hash, 516);
2436 E_old_pw_hash(new_nt_hash, old_nt_hash, nt_verifier.hash);
2437
2438 r.in.server = &server;
2439 r.in.account = &account;
2440 r.in.nt_password = &nt_pass;
2441 r.in.nt_verifier = &nt_verifier;
2442 r.in.lm_change = 0;
2443 r.in.lm_password = NULL;
2444 r.in.lm_verifier = NULL;
2445 r.in.password3 = NULL;
2446 r.out.dominfo = &dominfo;
2447 r.out.reject = &reject;
2448
2449 unix_to_nt_time(&t, time(NULL));
2450
2451 status = dcerpc_samr_ChangePasswordUser3(p, tctx, &r);
2452
2453 if (NT_STATUS_EQUAL(status, NT_STATUS_PASSWORD_RESTRICTION)) {
2454 if (reject && reject->reason != SAMR_REJECT_OTHER) {
2455 torture_warning(tctx, "expected SAMR_REJECT_OTHER (%d), got %d\n",
2456 SAMR_REJECT_OTHER, reject->reason);
2457 return false;
2458 }
2459 /* Perhaps the server has a 'min password age' set? */
2460
2461 } else if (!NT_STATUS_IS_OK(status)) {
2462 torture_warning(tctx, "ChangePasswordUser3 failed - %s\n", nt_errstr(status));
2463 ret = false;
2464 }
2465
2466 newpass = samr_rand_pass(tctx, 128);
2467
2468 mdfour(old_nt_hash, new_random_pass.data, new_random_pass.length);
2469
2470 E_md4hash(newpass, new_nt_hash);
2471
2472 encode_pw_buffer(nt_pass.data, newpass, STR_UNICODE);
2473 arcfour_crypt(nt_pass.data, old_nt_hash, 516);
2474 E_old_pw_hash(new_nt_hash, old_nt_hash, nt_verifier.hash);
2475
2476 r.in.server = &server;
2477 r.in.account = &account;
2478 r.in.nt_password = &nt_pass;
2479 r.in.nt_verifier = &nt_verifier;
2480 r.in.lm_change = 0;
2481 r.in.lm_password = NULL;
2482 r.in.lm_verifier = NULL;
2483 r.in.password3 = NULL;
2484 r.out.dominfo = &dominfo;
2485 r.out.reject = &reject;
2486
2487 unix_to_nt_time(&t, time(NULL));
2488
2489 status = dcerpc_samr_ChangePasswordUser3(p, tctx, &r);
2490
2491 if (NT_STATUS_EQUAL(status, NT_STATUS_PASSWORD_RESTRICTION)) {
2492 if (reject && reject->reason != SAMR_REJECT_OTHER) {
2493 torture_warning(tctx, "expected SAMR_REJECT_OTHER (%d), got %d\n",
2494 SAMR_REJECT_OTHER, reject->reason);
2495 return false;
2496 }
2497 /* Perhaps the server has a 'min password age' set? */
2498
2499 } else {
2500 torture_assert_ntstatus_ok(tctx, status, "ChangePasswordUser3 (on second random password)");
2501 *password = talloc_strdup(tctx, newpass);
2502 }
2503
2504 return ret;
2505 }
2506
2507
2508 static bool test_GetMembersInAlias(struct dcerpc_pipe *p, struct torture_context *tctx,
2509 struct policy_handle *alias_handle)
2510 {
2511 struct samr_GetMembersInAlias r;
2512 struct lsa_SidArray sids;
2513 NTSTATUS status;
2514
2515 torture_comment(tctx, "Testing GetMembersInAlias\n");
2516
2517 r.in.alias_handle = alias_handle;
2518 r.out.sids = &sids;
2519
2520 status = dcerpc_samr_GetMembersInAlias(p, tctx, &r);
2521 torture_assert_ntstatus_ok(tctx, status, "GetMembersInAlias");
2522
2523 return true;
2524 }
2525
2526 static bool test_AddMemberToAlias(struct dcerpc_pipe *p, struct torture_context *tctx,
2527 struct policy_handle *alias_handle,
2528 const struct dom_sid *domain_sid)
2529 {
2530 struct samr_AddAliasMember r;
2531 struct samr_DeleteAliasMember d;
2532 NTSTATUS status;
2533 struct dom_sid *sid;
2534
2535 sid = dom_sid_add_rid(tctx, domain_sid, 512);
2536
2537 torture_comment(tctx, "testing AddAliasMember\n");
2538 r.in.alias_handle = alias_handle;
2539 r.in.sid = sid;
2540
2541 status = dcerpc_samr_AddAliasMember(p, tctx, &r);
2542 torture_assert_ntstatus_ok(tctx, status, "AddAliasMember");
2543
2544 d.in.alias_handle = alias_handle;
2545 d.in.sid = sid;
2546
2547 status = dcerpc_samr_DeleteAliasMember(p, tctx, &d);
2548 torture_assert_ntstatus_ok(tctx, status, "DelAliasMember");
2549
2550 return true;
2551 }
2552
2553 static bool test_AddMultipleMembersToAlias(struct dcerpc_pipe *p, struct torture_context *tctx,
2554 struct policy_handle *alias_handle)
2555 {
2556 struct samr_AddMultipleMembersToAlias a;
2557 struct samr_RemoveMultipleMembersFromAlias r;
2558 NTSTATUS status;
2559 struct lsa_SidArray sids;
2560
2561 torture_comment(tctx, "testing AddMultipleMembersToAlias\n");
2562 a.in.alias_handle = alias_handle;
2563 a.in.sids = &sids;
2564
2565 sids.num_sids = 3;
2566 sids.sids = talloc_array(tctx, struct lsa_SidPtr, 3);
2567
2568 sids.sids[0].sid = dom_sid_parse_talloc(tctx, "S-1-5-32-1-2-3-1");
2569 sids.sids[1].sid = dom_sid_parse_talloc(tctx, "S-1-5-32-1-2-3-2");
2570 sids.sids[2].sid = dom_sid_parse_talloc(tctx, "S-1-5-32-1-2-3-3");
2571
2572 status = dcerpc_samr_AddMultipleMembersToAlias(p, tctx, &a);
2573 torture_assert_ntstatus_ok(tctx, status, "AddMultipleMembersToAlias");
2574
2575
2576 torture_comment(tctx, "testing RemoveMultipleMembersFromAlias\n");
2577 r.in.alias_handle = alias_handle;
2578 r.in.sids = &sids;
2579
2580 status = dcerpc_samr_RemoveMultipleMembersFromAlias(p, tctx, &r);
2581 torture_assert_ntstatus_ok(tctx, status, "RemoveMultipleMembersFromAlias");
2582
2583 /* strange! removing twice doesn't give any error */
2584 status = dcerpc_samr_RemoveMultipleMembersFromAlias(p, tctx, &r);
2585 torture_assert_ntstatus_ok(tctx, status, "RemoveMultipleMembersFromAlias");
2586
2587 /* but removing an alias that isn't there does */
2588 sids.sids[2].sid = dom_sid_parse_talloc(tctx, "S-1-5-32-1-2-3-4");
2589
2590 status = dcerpc_samr_RemoveMultipleMembersFromAlias(p, tctx, &r);
2591 torture_assert_ntstatus_equal(tctx, status, NT_STATUS_OBJECT_NAME_NOT_FOUND, "RemoveMultipleMembersFromAlias");
2592
2593 return true;
2594 }
2595
2596 static bool test_GetAliasMembership(struct dcerpc_pipe *p,
2597 struct torture_context *tctx,
2598 struct policy_handle *domain_handle)
2599 {
2600 struct samr_GetAliasMembership r;
2601 struct lsa_SidArray sids;
2602 struct samr_Ids rids;
2603 NTSTATUS status;
2604
2605 torture_comment(tctx, "Testing GetAliasMembership\n");
2606
2607 r.in.domain_handle = domain_handle;
2608 r.in.sids = &sids;
2609 r.out.rids = &rids;
2610
2611 sids.num_sids = 0;
2612 sids.sids = talloc_zero_array(tctx, struct lsa_SidPtr, sids.num_sids);
2613
2614 status = dcerpc_samr_GetAliasMembership(p, tctx, &r);
2615 torture_assert_ntstatus_ok(tctx, status,
2616 "samr_GetAliasMembership failed");
2617
2618 torture_assert_int_equal(tctx, sids.num_sids, rids.count,
2619 "protocol misbehaviour");
2620
2621 sids.num_sids = 1;
2622 sids.sids = talloc_zero_array(tctx, struct lsa_SidPtr, sids.num_sids);
2623 sids.sids[0].sid = dom_sid_parse_talloc(tctx, "S-1-5-32-1-2-3-1");
2624
2625 status = dcerpc_samr_GetAliasMembership(p, tctx, &r);
2626 torture_assert_ntstatus_ok(tctx, status,
2627 "samr_GetAliasMembership failed");
2628
2629 #if 0
2630 /* only true for w2k8 it seems
2631 * win7, xp, w2k3 will return a 0 length array pointer */
2632
2633 torture_assert(tctx, (rids.ids && !rids.count),
2634 "samr_GetAliasMembership protocol misbehaviour");
2635 #endif
2636 torture_assert(tctx, (!rids.ids && rids.count),
2637 "samr_GetAliasMembership protocol misbehaviour");
2638
2639 return true;
2640 }
2641
2642 static bool test_TestPrivateFunctionsUser(struct dcerpc_pipe *p, struct torture_context *tctx,
2643 struct policy_handle *user_handle)
2644 {
2645 struct samr_TestPrivateFunctionsUser r;
2646 NTSTATUS status;
2647
2648 torture_comment(tctx, "Testing TestPrivateFunctionsUser\n");
2649
2650 r.in.user_handle = user_handle;
2651
2652 status = dcerpc_samr_TestPrivateFunctionsUser(p, tctx, &r);
2653 torture_assert_ntstatus_equal(tctx, status, NT_STATUS_NOT_IMPLEMENTED, "TestPrivateFunctionsUser");
2654
2655 return true;
2656 }
2657
2658 static bool test_QueryUserInfo_pwdlastset(struct dcerpc_pipe *p,
2659 struct torture_context *tctx,
2660 struct policy_handle *handle,
2661 bool use_info2,
2662 NTTIME *pwdlastset)
2663 {
2664 NTSTATUS status;
2665 uint16_t levels[] = { /* 3, */ 5, 21 };
2666 int i;
2667 NTTIME pwdlastset3 = 0;
2668 NTTIME pwdlastset5 = 0;
2669 NTTIME pwdlastset21 = 0;
2670
2671 torture_comment(tctx, "Testing QueryUserInfo%s level 5 and 21 call ",
2672 use_info2 ? "2":"");
2673
2674 for (i=0; i<ARRAY_SIZE(levels); i++) {
2675
2676 struct samr_QueryUserInfo r;
2677 struct samr_QueryUserInfo2 r2;
2678 union samr_UserInfo *info;
2679
2680 if (use_info2) {
2681 r2.in.user_handle = handle;
2682 r2.in.level = levels[i];
2683 r2.out.info = &info;
2684 status = dcerpc_samr_QueryUserInfo2(p, tctx, &r2);
2685
2686 } else {
2687 r.in.user_handle = handle;
2688 r.in.level = levels[i];
2689 r.out.info = &info;
2690 status = dcerpc_samr_QueryUserInfo(p, tctx, &r);
2691 }
2692
2693 if (!NT_STATUS_IS_OK(status) &&
2694 !NT_STATUS_EQUAL(status, NT_STATUS_INVALID_INFO_CLASS)) {
2695 torture_warning(tctx, "QueryUserInfo%s level %u failed - %s\n",
2696 use_info2 ? "2":"", levels[i], nt_errstr(status));
2697 return false;
2698 }
2699
2700 switch (levels[i]) {
2701 case 3:
2702 pwdlastset3 = info->info3.last_password_change;
2703 break;
2704 case 5:
2705 pwdlastset5 = info->info5.last_password_change;
2706 break;
2707 case 21:
2708 pwdlastset21 = info->info21.last_password_change;
2709 break;
2710 default:
2711 return false;
2712 }
2713 }
2714 /* torture_assert_int_equal(tctx, pwdlastset3, pwdlastset5,
2715 "pwdlastset mixup"); */
2716 torture_assert_int_equal(tctx, pwdlastset5, pwdlastset21,
2717 "pwdlastset mixup");
2718
2719 *pwdlastset = pwdlastset21;
2720
2721 torture_comment(tctx, "(pwdlastset: %lld)\n", *pwdlastset);
2722
2723 return true;
2724 }
2725
2726 static bool test_SamLogon(struct torture_context *tctx,
2727 struct dcerpc_pipe *p,
2728 struct cli_credentials *test_credentials,
2729 NTSTATUS expected_result)
2730 {
2731 NTSTATUS status;
2732 struct netr_LogonSamLogonEx r;
2733 union netr_LogonLevel logon;
2734 union netr_Validation validation;
2735 uint8_t authoritative;
2736 struct netr_NetworkInfo ninfo;
2737 DATA_BLOB names_blob, chal, lm_resp, nt_resp;
2738 int flags = CLI_CRED_NTLM_AUTH;
2739 uint32_t samlogon_flags = 0;
2740
2741 if (lp_client_lanman_auth(tctx->lp_ctx)) {
2742 flags |= CLI_CRED_LANMAN_AUTH;
2743 }
2744
2745 if (lp_client_ntlmv2_auth(tctx->lp_ctx)) {
2746 flags |= CLI_CRED_NTLMv2_AUTH;
2747 }
2748
2749 cli_credentials_get_ntlm_username_domain(test_credentials, tctx,
2750 &ninfo.identity_info.account_name.string,
2751 &ninfo.identity_info.domain_name.string);
2752
2753 generate_random_buffer(ninfo.challenge,
2754 sizeof(ninfo.challenge));
2755 chal = data_blob_const(ninfo.challenge,
2756 sizeof(ninfo.challenge));
2757
2758 names_blob = NTLMv2_generate_names_blob(tctx, cli_credentials_get_workstation(test_credentials),
2759 cli_credentials_get_domain(test_credentials));
2760
2761 status = cli_credentials_get_ntlm_response(test_credentials, tctx,
2762 &flags,
2763 chal,
2764 names_blob,
2765 &lm_resp, &nt_resp,
2766 NULL, NULL);
2767 torture_assert_ntstatus_ok(tctx, status, "cli_credentials_get_ntlm_response failed");
2768
2769 ninfo.lm.data = lm_resp.data;
2770 ninfo.lm.length = lm_resp.length;
2771
2772 ninfo.nt.data = nt_resp.data;
2773 ninfo.nt.length = nt_resp.length;
2774
2775 ninfo.identity_info.parameter_control =
2776 MSV1_0_ALLOW_SERVER_TRUST_ACCOUNT |
2777 MSV1_0_ALLOW_WORKSTATION_TRUST_ACCOUNT;
2778 ninfo.identity_info.logon_id_low = 0;
2779 ninfo.identity_info.logon_id_high = 0;
2780 ninfo.identity_info.workstation.string = cli_credentials_get_workstation(test_credentials);
2781
2782 logon.network = &ninfo;
2783
2784 r.in.server_name = talloc_asprintf(tctx, "\\\\%s", dcerpc_server_name(p));
2785 r.in.computer_name = cli_credentials_get_workstation(test_credentials);
2786 r.in.logon_level = NetlogonNetworkInformation;
2787 r.in.logon = &logon;
2788 r.in.flags = &samlogon_flags;
2789 r.out.flags = &samlogon_flags;
2790 r.out.validation = &validation;
2791 r.out.authoritative = &authoritative;
2792
2793 torture_comment(tctx, "Testing LogonSamLogon with name %s\n", ninfo.identity_info.account_name.string);
2794
2795 r.in.validation_level = 6;
2796
2797 status = dcerpc_netr_LogonSamLogonEx(p, tctx, &r);
2798 if (NT_STATUS_EQUAL(status, NT_STATUS_INVALID_INFO_CLASS)) {
2799 r.in.validation_level = 3;
2800 status = dcerpc_netr_LogonSamLogonEx(p, tctx, &r);
2801 }
2802 if (!NT_STATUS_IS_OK(status)) {
2803 torture_assert_ntstatus_equal(tctx, status, expected_result, "LogonSamLogonEx failed");
2804 return true;
2805 } else {
2806 torture_assert_ntstatus_ok(tctx, status, "LogonSamLogonEx failed");
2807 }
2808
2809 return true;
2810 }
2811
2812 static bool test_SamLogon_with_creds(struct torture_context *tctx,
2813 struct dcerpc_pipe *p,
2814 struct cli_credentials *machine_creds,
2815 const char *acct_name,
2816 char *password,
2817 NTSTATUS expected_samlogon_result)
2818 {
2819 bool ret = true;
2820 struct cli_credentials *test_credentials;
2821
2822 test_credentials = cli_credentials_init(tctx);
2823
2824 cli_credentials_set_workstation(test_credentials,
2825 cli_credentials_get_workstation(machine_creds), CRED_SPECIFIED);
2826 cli_credentials_set_domain(test_credentials,
2827 cli_credentials_get_domain(machine_creds), CRED_SPECIFIED);
2828 cli_credentials_set_username(test_credentials,
2829 acct_name, CRED_SPECIFIED);
2830 cli_credentials_set_password(test_credentials,
2831 password, CRED_SPECIFIED);
2832
2833 torture_comment(tctx, "testing samlogon as %s password: %s\n",
2834 acct_name, password);
2835
2836 if (!test_SamLogon(tctx, p, test_credentials,
2837 expected_samlogon_result)) {
2838 torture_warning(tctx, "new password did not work\n");
2839 ret = false;
2840 }
2841
2842 return ret;
2843 }
2844
2845 static bool test_SetPassword_level(struct dcerpc_pipe *p,
2846 struct dcerpc_pipe *np,
2847 struct torture_context *tctx,
2848 struct policy_handle *handle,
2849 uint16_t level,
2850 uint32_t fields_present,
2851 uint8_t password_expired,
2852 bool *matched_expected_error,
2853 bool use_setinfo2,
2854 const char *acct_name,
2855 char **password,
2856 struct cli_credentials *machine_creds,
2857 bool use_queryinfo2,
2858 NTTIME *pwdlastset,
2859 NTSTATUS expected_samlogon_result)
2860 {
2861 const char *fields = NULL;
2862 bool ret = true;
2863
2864 switch (level) {
2865 case 21:
2866 case 23:
2867 case 25:
2868 fields = talloc_asprintf(tctx, "(fields_present: 0x%08x)",
2869 fields_present);
2870 break;
2871 default:
2872 break;
2873 }
2874
2875 torture_comment(tctx, "Testing SetUserInfo%s level %d call "
2876 "(password_expired: %d) %s\n",
2877 use_setinfo2 ? "2":"", level, password_expired,
2878 fields ? fields : "");
2879
2880 if (!test_SetUserPass_level_ex(p, tctx, handle, level,
2881 fields_present,
2882 password,
2883 password_expired,
2884 use_setinfo2,
2885 matched_expected_error)) {
2886 ret = false;
2887 }
2888
2889 if (!test_QueryUserInfo_pwdlastset(p, tctx, handle,
2890 use_queryinfo2,
2891 pwdlastset)) {
2892 ret = false;
2893 }
2894
2895 if (*matched_expected_error == true) {
2896 return ret;
2897 }
2898
2899 if (!test_SamLogon_with_creds(tctx, np,
2900 machine_creds,
2901 acct_name,
2902 *password,
2903 expected_samlogon_result)) {
2904 ret = false;
2905 }
2906
2907 return ret;
2908 }
2909
2910 static bool test_SetPassword_pwdlastset(struct dcerpc_pipe *p,
2911 struct torture_context *tctx,
2912 uint32_t acct_flags,
2913 const char *acct_name,
2914 struct policy_handle *handle,
2915 char **password,
2916 struct cli_credentials *machine_credentials)
2917 {
2918 int s = 0, q = 0, f = 0, l = 0, z = 0;
2919 struct dcerpc_binding *b;
2920 bool ret = true;
2921 int delay = 50000;
2922 bool set_levels[] = { false, true };
2923 bool query_levels[] = { false, true };
2924 uint32_t levels[] = { 18, 21, 26, 23, 24, 25 }; /* Second half only used when TEST_ALL_LEVELS defined */
2925 uint32_t nonzeros[] = { 1, 24 };
2926 uint32_t fields_present[] = {
2927 0,
2928 SAMR_FIELD_EXPIRED_FLAG,
2929 SAMR_FIELD_LAST_PWD_CHANGE,
2930 SAMR_FIELD_EXPIRED_FLAG | SAMR_FIELD_LAST_PWD_CHANGE,
2931 SAMR_FIELD_COMMENT,
2932 SAMR_FIELD_NT_PASSWORD_PRESENT,
2933 SAMR_FIELD_NT_PASSWORD_PRESENT | SAMR_FIELD_LAST_PWD_CHANGE,
2934 SAMR_FIELD_NT_PASSWORD_PRESENT | SAMR_FIELD_LM_PASSWORD_PRESENT,
2935 SAMR_FIELD_NT_PASSWORD_PRESENT | SAMR_FIELD_LM_PASSWORD_PRESENT | SAMR_FIELD_LAST_PWD_CHANGE,
2936 SAMR_FIELD_NT_PASSWORD_PRESENT | SAMR_FIELD_EXPIRED_FLAG,
2937 SAMR_FIELD_NT_PASSWORD_PRESENT | SAMR_FIELD_LM_PASSWORD_PRESENT | SAMR_FIELD_EXPIRED_FLAG,
2938 SAMR_FIELD_NT_PASSWORD_PRESENT | SAMR_FIELD_LM_PASSWORD_PRESENT | SAMR_FIELD_LAST_PWD_CHANGE | SAMR_FIELD_EXPIRED_FLAG
2939 };
2940 NTSTATUS status;
2941 struct dcerpc_pipe *np = NULL;
2942
2943 if (torture_setting_bool(tctx, "samba3", false)) {
2944 delay = 999999;
2945 torture_comment(tctx, "Samba3 has second granularity, setting delay to: %d\n",
2946 delay);
2947 }
2948
2949 status = torture_rpc_binding(tctx, &b);
2950 if (!NT_STATUS_IS_OK(status)) {
2951 ret = false;
2952 return ret;
2953 }
2954
2955 /* We have to use schannel, otherwise the SamLogonEx fails
2956 * with INTERNAL_ERROR */
2957
2958 b->flags &= ~DCERPC_AUTH_OPTIONS;
2959 b->flags |= DCERPC_SCHANNEL | DCERPC_SIGN | DCERPC_SCHANNEL_128;
2960
2961 status = dcerpc_pipe_connect_b(tctx, &np, b,
2962 &ndr_table_netlogon,
2963 machine_credentials, tctx->ev, tctx->lp_ctx);
2964
2965 if (!NT_STATUS_IS_OK(status)) {
2966 torture_warning(tctx, "RPC pipe connect as domain member failed: %s\n", nt_errstr(status));
2967 ret = false;
2968 return ret;
2969 }
2970
2971 /* set to 1 to enable testing for all possible opcode
2972 (SetUserInfo, SetUserInfo2, QueryUserInfo, QueryUserInfo2)
2973 combinations */
2974 #if 0
2975 #define TEST_ALL_LEVELS 1
2976 #define TEST_SET_LEVELS 1
2977 #define TEST_QUERY_LEVELS 1
2978 #endif
2979 #ifdef TEST_ALL_LEVELS
2980 for (l=0; l<ARRAY_SIZE(levels); l++) {
2981 #else
2982 for (l=0; l<(ARRAY_SIZE(levels))/2; l++) {
2983 #endif
2984 for (z=0; z<ARRAY_SIZE(nonzeros); z++) {
2985 for (f=0; f<ARRAY_SIZE(fields_present); f++) {
2986 #ifdef TEST_SET_LEVELS
2987 for (s=0; s<ARRAY_SIZE(set_levels); s++) {
2988 #endif
2989 #ifdef TEST_QUERY_LEVELS
2990 for (q=0; q<ARRAY_SIZE(query_levels); q++) {
2991 #endif
2992 NTTIME pwdlastset_old = 0;
2993 NTTIME pwdlastset_new = 0;
2994 bool matched_expected_error = false;
2995 NTSTATUS expected_samlogon_result = NT_STATUS_ACCOUNT_DISABLED;
2996
2997 torture_comment(tctx, "------------------------------\n"
2998 "Testing pwdLastSet attribute for flags: 0x%08x "
2999 "(s: %d (l: %d), q: %d)\n",
3000 acct_flags, s, levels[l], q);
3001
3002 switch (levels[l]) {
3003 case 21:
3004 case 23:
3005 case 25:
3006 if (!((fields_present[f] & SAMR_FIELD_NT_PASSWORD_PRESENT) ||
3007 (fields_present[f] & SAMR_FIELD_LM_PASSWORD_PRESENT))) {
3008 expected_samlogon_result = NT_STATUS_WRONG_PASSWORD;
3009 }
3010 break;
3011 }
3012
3013
3014 /* set #1 */
3015
3016 /* set a password and force password change (pwdlastset 0) by
3017 * setting the password expired flag to a non-0 value */
3018
3019 if (!test_SetPassword_level(p, np, tctx, handle,
3020 levels[l],
3021 fields_present[f],
3022 nonzeros[z],
3023 &matched_expected_error,
3024 set_levels[s],
3025 acct_name,
3026 password,
3027 machine_credentials,
3028 query_levels[q],
3029 &pwdlastset_old,
3030 expected_samlogon_result)) {
3031 ret = false;
3032 }
3033
3034 if (matched_expected_error == true) {
3035 /* skipping on expected failure */
3036 continue;
3037 }
3038
3039 /* pwdlastset must be 0 afterwards, except for a level 21, 23 and 25
3040 * set without the SAMR_FIELD_EXPIRED_FLAG */
3041
3042 switch (levels[l]) {
3043 case 21:
3044 case 23:
3045 case 25:
3046 if ((pwdlastset_new != 0) &&
3047 !(fields_present[f] & SAMR_FIELD_EXPIRED_FLAG)) {
3048 torture_comment(tctx, "not considering a non-0 "
3049 "pwdLastSet as a an error as the "
3050 "SAMR_FIELD_EXPIRED_FLAG has not "
3051 "been set\n");
3052 break;
3053 }
3054 default:
3055 if (pwdlastset_new != 0) {
3056 torture_warning(tctx, "pwdLastSet test failed: "
3057 "expected pwdLastSet 0 but got %lld\n",
3058 pwdlastset_old);
3059 ret = false;
3060 }
3061 break;
3062 }
3063
3064 switch (levels[l]) {
3065 case 21:
3066 case 23:
3067 case 25:
3068 if (((fields_present[f] & SAMR_FIELD_NT_PASSWORD_PRESENT) ||
3069 (fields_present[f] & SAMR_FIELD_LM_PASSWORD_PRESENT)) &&
3070 (pwdlastset_old > 0) && (pwdlastset_new > 0) &&
3071 (pwdlastset_old >= pwdlastset_new)) {
3072 torture_warning(tctx, "pwdlastset not increasing\n");
3073 ret = false;
3074 }
3075 break;
3076 default:
3077 if ((pwdlastset_old > 0) && (pwdlastset_new > 0) &&
3078 (pwdlastset_old >= pwdlastset_new)) {
3079 torture_warning(tctx, "pwdlastset not increasing\n");
3080 ret = false;
3081 }
3082 break;
3083 }
3084
3085 usleep(delay);
3086
3087 /* set #2 */
3088
3089 /* set a password, pwdlastset needs to get updated (increased
3090 * value), password_expired value used here is 0 */
3091
3092 if (!test_SetPassword_level(p, np, tctx, handle,
3093 levels[l],
3094 fields_present[f],
3095 0,
3096 &matched_expected_error,
3097 set_levels[s],
3098 acct_name,
3099 password,
3100 machine_credentials,
3101 query_levels[q],
3102 &pwdlastset_new,
3103 expected_samlogon_result)) {
3104 ret = false;
3105 }
3106
3107 /* when a password has been changed, pwdlastset must not be 0 afterwards
3108 * and must be larger then the old value */
3109
3110 switch (levels[l]) {
3111 case 21:
3112 case 23:
3113 case 25:
3114
3115 /* SAMR_FIELD_EXPIRED_FLAG has not been set and no
3116 * password has been changed, old and new pwdlastset
3117 * need to be the same value */
3118
3119 if (!(fields_present[f] & SAMR_FIELD_EXPIRED_FLAG) &&
3120 !((fields_present[f] & SAMR_FIELD_NT_PASSWORD_PRESENT) ||
3121 (fields_present[f] & SAMR_FIELD_LM_PASSWORD_PRESENT)))
3122 {
3123 torture_assert_int_equal(tctx, pwdlastset_old,
3124 pwdlastset_new, "pwdlastset must be equal");
3125 break;
3126 }
3127 default:
3128 if (pwdlastset_old >= pwdlastset_new) {
3129 torture_warning(tctx, "pwdLastSet test failed: "
3130 "expected last pwdlastset (%lld) < new pwdlastset (%lld)\n",
3131 pwdlastset_old, pwdlastset_new);
3132 ret = false;
3133 }
3134 if (pwdlastset_new == 0) {
3135 torture_warning(tctx, "pwdLastSet test failed: "
3136 "expected non-0 pwdlastset, got: %lld\n",
3137 pwdlastset_new);
3138 ret = false;
3139 }
3140 }
3141
3142 switch (levels[l]) {
3143 case 21:
3144 case 23:
3145 case 25:
3146 if (((fields_present[f] & SAMR_FIELD_NT_PASSWORD_PRESENT) ||
3147 (fields_present[f] & SAMR_FIELD_LM_PASSWORD_PRESENT)) &&
3148 (pwdlastset_old > 0) && (pwdlastset_new > 0) &&
3149 (pwdlastset_old >= pwdlastset_new)) {
3150 torture_warning(tctx, "pwdlastset not increasing\n");
3151 ret = false;
3152 }
3153 break;
3154 default:
3155 if ((pwdlastset_old > 0) && (pwdlastset_new > 0) &&
3156 (pwdlastset_old >= pwdlastset_new)) {
3157 torture_warning(tctx, "pwdlastset not increasing\n");
3158 ret = false;
3159 }
3160 break;
3161 }
3162
3163 pwdlastset_old = pwdlastset_new;
3164
3165 usleep(delay);
3166
3167 /* set #2b */
3168
3169 /* set a password, pwdlastset needs to get updated (increased
3170 * value), password_expired value used here is 0 */
3171
3172 if (!test_SetPassword_level(p, np, tctx, handle,
3173 levels[l],
3174 fields_present[f],
3175 0,
3176 &matched_expected_error,
3177 set_levels[s],
3178 acct_name,
3179 password,
3180 machine_credentials,
3181 query_levels[q],
3182 &pwdlastset_new,
3183 expected_samlogon_result)) {
3184 ret = false;
3185 }
3186
3187 /* when a password has been changed, pwdlastset must not be 0 afterwards
3188 * and must be larger then the old value */
3189
3190 switch (levels[l]) {
3191 case 21:
3192 case 23:
3193 case 25:
3194
3195 /* if no password has been changed, old and new pwdlastset
3196 * need to be the same value */
3197
3198 if (!((fields_present[f] & SAMR_FIELD_NT_PASSWORD_PRESENT) ||
3199 (fields_present[f] & SAMR_FIELD_LM_PASSWORD_PRESENT)))
3200 {
3201 torture_assert_int_equal(tctx, pwdlastset_old,
3202 pwdlastset_new, "pwdlastset must be equal");
3203 break;
3204 }
3205 default:
3206 if (pwdlastset_old >= pwdlastset_new) {
3207 torture_warning(tctx, "pwdLastSet test failed: "
3208 "expected last pwdlastset (%lld) < new pwdlastset (%lld)\n",
3209 pwdlastset_old, pwdlastset_new);
3210 ret = false;
3211 }
3212 if (pwdlastset_new == 0) {
3213 torture_warning(tctx, "pwdLastSet test failed: "
3214 "expected non-0 pwdlastset, got: %lld\n",
3215 pwdlastset_new);
3216 ret = false;
3217 }
3218 }
3219
3220 /* set #3 */
3221
3222 /* set a password and force password change (pwdlastset 0) by
3223 * setting the password expired flag to a non-0 value */
3224
3225 if (!test_SetPassword_level(p, np, tctx, handle,
3226 levels[l],
3227 fields_present[f],
3228 nonzeros[z],
3229 &matched_expected_error,
3230 set_levels[s],
3231 acct_name,
3232 password,
3233 machine_credentials,
3234 query_levels[q],
3235 &pwdlastset_new,
3236 expected_samlogon_result)) {
3237 ret = false;
3238 }
3239
3240 /* pwdlastset must be 0 afterwards, except for a level 21, 23 and 25
3241 * set without the SAMR_FIELD_EXPIRED_FLAG */
3242
3243 switch (levels[l]) {
3244 case 21:
3245 case 23:
3246 case 25:
3247 if ((pwdlastset_new != 0) &&
3248 !(fields_present[f] & SAMR_FIELD_EXPIRED_FLAG)) {
3249 torture_comment(tctx, "not considering a non-0 "
3250 "pwdLastSet as a an error as the "
3251 "SAMR_FIELD_EXPIRED_FLAG has not "
3252 "been set\n");
3253 break;
3254 }
3255
3256 /* SAMR_FIELD_EXPIRED_FLAG has not been set and no
3257 * password has been changed, old and new pwdlastset
3258 * need to be the same value */
3259
3260 if (!(fields_present[f] & SAMR_FIELD_EXPIRED_FLAG) &&
3261 !((fields_present[f] & SAMR_FIELD_NT_PASSWORD_PRESENT) ||
3262 (fields_present[f] & SAMR_FIELD_LM_PASSWORD_PRESENT)))
3263 {
3264 torture_assert_int_equal(tctx, pwdlastset_old,
3265 pwdlastset_new, "pwdlastset must be equal");
3266 break;
3267 }
3268 default:
3269
3270 if (pwdlastset_old == pwdlastset_new) {
3271 torture_warning(tctx, "pwdLastSet test failed: "
3272 "expected last pwdlastset (%lld) != new pwdlastset (%lld)\n",
3273 pwdlastset_old, pwdlastset_new);
3274 ret = false;
3275 }
3276
3277 if (pwdlastset_new != 0) {
3278 torture_warning(tctx, "pwdLastSet test failed: "
3279 "expected pwdLastSet 0, got %lld\n",
3280 pwdlastset_old);
3281 ret = false;
3282 }
3283 break;
3284 }
3285
3286 switch (levels[l]) {
3287 case 21:
3288 case 23:
3289 case 25:
3290 if (((fields_present[f] & SAMR_FIELD_NT_PASSWORD_PRESENT) ||
3291 (fields_present[f] & SAMR_FIELD_LM_PASSWORD_PRESENT)) &&
3292 (pwdlastset_old > 0) && (pwdlastset_new > 0) &&
3293 (pwdlastset_old >= pwdlastset_new)) {
3294 torture_warning(tctx, "pwdlastset not increasing\n");
3295 ret = false;
3296 }
3297 break;
3298 default:
3299 if ((pwdlastset_old > 0) && (pwdlastset_new > 0) &&
3300 (pwdlastset_old >= pwdlastset_new)) {
3301 torture_warning(tctx, "pwdlastset not increasing\n");
3302 ret = false;
3303 }
3304 break;
3305 }
3306
3307 /* if the level we are testing does not have a fields_present
3308 * field, skip all fields present tests by setting f to to
3309 * arraysize */
3310 switch (levels[l]) {
3311 case 18:
3312 case 24:
3313 case 26:
3314 f = ARRAY_SIZE(fields_present);
3315 break;
3316 }
3317
3318 #ifdef TEST_QUERY_LEVELS
3319 }
3320 #endif
3321 #ifdef TEST_SET_LEVELS
3322 }
3323 #endif
3324 } /* fields present */
3325 } /* nonzeros */
3326 } /* levels */
3327
3328 #undef TEST_SET_LEVELS
3329 #undef TEST_QUERY_LEVELS
3330
3331 talloc_free(np);
3332
3333 return ret;
3334 }
3335
3336 static bool test_DeleteUser_with_privs(struct dcerpc_pipe *p,
3337 struct dcerpc_pipe *lp,
3338 struct torture_context *tctx,
3339 struct policy_handle *domain_handle,
3340 struct policy_handle *lsa_handle,
3341 struct policy_handle *user_handle,
3342 const struct dom_sid *domain_sid,
3343 uint32_t rid,
3344 struct cli_credentials *machine_credentials)
3345 {
3346 NTSTATUS status;
3347 bool ret = true;
3348
3349 struct policy_handle lsa_acct_handle;
3350 struct dom_sid *user_sid;
3351
3352 user_sid = dom_sid_add_rid(tctx, domain_sid, rid);
3353
3354 {
3355 struct lsa_EnumAccountRights r;
3356 struct lsa_RightSet rights;
3357
3358 torture_comment(tctx, "Testing LSA EnumAccountRights\n");
3359
3360 r.in.handle = lsa_handle;
3361 r.in.sid = user_sid;
3362 r.out.rights = &rights;
3363
3364 status = dcerpc_lsa_EnumAccountRights(lp, tctx, &r);
3365 torture_assert_ntstatus_equal(tctx, status, NT_STATUS_OBJECT_NAME_NOT_FOUND,
3366 "Expected enum rights for account to fail");
3367 }
3368
3369 {
3370 struct lsa_RightSet rights;
3371 struct lsa_StringLarge names[2];
3372 struct lsa_AddAccountRights r;
3373
3374 torture_comment(tctx, "Testing LSA AddAccountRights\n");
3375
3376 init_lsa_StringLarge(&names[0], "SeMachineAccountPrivilege");
3377 init_lsa_StringLarge(&names[1], NULL);
3378
3379 rights.count = 1;
3380 rights.names = names;
3381
3382 r.in.handle = lsa_handle;
3383 r.in.sid = user_sid;
3384 r.in.rights = &rights;
3385
3386 status = dcerpc_lsa_AddAccountRights(lp, tctx, &r);
3387 torture_assert_ntstatus_ok(tctx, status,
3388 "Failed to add privileges");
3389 }
3390
3391 {
3392 struct lsa_EnumAccounts r;
3393 uint32_t resume_handle = 0;
3394 struct lsa_SidArray lsa_sid_array;
3395 int i;
3396 bool found_sid = false;
3397
3398 torture_comment(tctx, "Testing LSA EnumAccounts\n");
3399
3400 r.in.handle = lsa_handle;
3401 r.in.num_entries = 0x1000;
3402 r.in.resume_handle = &resume_handle;
3403 r.out.sids = &lsa_sid_array;
3404 r.out.resume_handle = &resume_handle;
3405
3406 status = dcerpc_lsa_EnumAccounts(lp, tctx, &r);
3407 torture_assert_ntstatus_ok(tctx, status,
3408 "Failed to enum accounts");
3409
3410 for (i=0; i < lsa_sid_array.num_sids; i++) {
3411 if (dom_sid_equal(user_sid, lsa_sid_array.sids[i].sid)) {
3412 found_sid = true;
3413 }
3414 }
3415
3416 torture_assert(tctx, found_sid,
3417 "failed to list privileged account");
3418 }
3419
3420 {
3421 struct lsa_EnumAccountRights r;
3422 struct lsa_RightSet user_rights;
3423
3424 torture_comment(tctx, "Testing LSA EnumAccountRights\n");
3425
3426 r.in.handle = lsa_handle;
3427 r.in.sid = user_sid;
3428 r.out.rights = &user_rights;
3429
3430 status = dcerpc_lsa_EnumAccountRights(lp, tctx, &r);
3431 torture_assert_ntstatus_ok(tctx, status,
3432 "Failed to enum rights for account");
3433
3434 if (user_rights.count < 1) {
3435 torture_warning(tctx, "failed to find newly added rights");
3436 return false;
3437 }
3438 }
3439
3440 {
3441 struct lsa_OpenAccount r;
3442
3443 torture_comment(tctx, "Testing LSA OpenAccount\n");
3444
3445 r.in.handle = lsa_handle;
3446 r.in.sid = user_sid;
3447 r.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
3448 r.out.acct_handle = &lsa_acct_handle;
3449
3450 status = dcerpc_lsa_OpenAccount(lp, tctx, &r);
3451 torture_assert_ntstatus_ok(tctx, status,
3452 "Failed to open lsa account");
3453 }
3454
3455 {
3456 struct lsa_GetSystemAccessAccount r;
3457 uint32_t access_mask;
3458
3459 torture_comment(tctx, "Testing LSA GetSystemAccessAccount\n");
3460
3461 r.in.handle = &lsa_acct_handle;
3462 r.out.access_mask = &access_mask;
3463
3464 status = dcerpc_lsa_GetSystemAccessAccount(lp, tctx, &r);
3465 torture_assert_ntstatus_ok(tctx, status,
3466 "Failed to get lsa system access account");
3467 }
3468
3469 {
3470 struct lsa_Close r;
3471
3472 torture_comment(tctx, "Testing LSA Close\n");
3473
3474 r.in.handle = &lsa_acct_handle;
3475 r.out.handle = &lsa_acct_handle;
3476
3477 status = dcerpc_lsa_Close(lp, tctx, &r);
3478 torture_assert_ntstatus_ok(tctx, status,
3479 "Failed to close lsa");
3480 }
3481
3482 {
3483 struct samr_DeleteUser r;
3484
3485 torture_comment(tctx, "Testing SAMR DeleteUser\n");
3486
3487 r.in.user_handle = user_handle;
3488 r.out.user_handle = user_handle;
3489
3490 status = dcerpc_samr_DeleteUser(p, tctx, &r);
3491 torture_assert_ntstatus_ok(tctx, status, "Delete User failed");
3492 }
3493
3494 {
3495 struct lsa_EnumAccounts r;
3496 uint32_t resume_handle = 0;
3497 struct lsa_SidArray lsa_sid_array;
3498 int i;
3499 bool found_sid = false;
3500
3501 torture_comment(tctx, "Testing LSA EnumAccounts\n");
3502
3503 r.in.handle = lsa_handle;
3504 r.in.num_entries = 0x1000;
3505 r.in.resume_handle = &resume_handle;
3506 r.out.sids = &lsa_sid_array;
3507 r.out.resume_handle = &resume_handle;
3508
3509 status = dcerpc_lsa_EnumAccounts(lp, tctx, &r);
3510 torture_assert_ntstatus_ok(tctx, status,
3511 "Failed to enum accounts");
3512
3513 for (i=0; i < lsa_sid_array.num_sids; i++) {
3514 if (dom_sid_equal(user_sid, lsa_sid_array.sids[i].sid)) {
3515 found_sid = true;
3516 }
3517 }
3518
3519 torture_assert(tctx, found_sid,
3520 "failed to list privileged account");
3521 }
3522
3523 {
3524 struct lsa_EnumAccountRights r;
3525 struct lsa_RightSet user_rights;
3526
3527 torture_comment(tctx, "Testing LSA EnumAccountRights\n");
3528
3529 r.in.handle = lsa_handle;
3530 r.in.sid = user_sid;
3531 r.out.rights = &user_rights;
3532
3533 status = dcerpc_lsa_EnumAccountRights(lp, tctx, &r);
3534 torture_assert_ntstatus_ok(tctx, status,
3535 "Failed to enum rights for account");
3536
3537 if (user_rights.count < 1) {
3538 torture_warning(tctx, "failed to find newly added rights");
3539 return false;
3540 }
3541 }
3542
3543 {
3544 struct lsa_OpenAccount r;
3545
3546 torture_comment(tctx, "Testing LSA OpenAccount\n");
3547
3548 r.in.handle = lsa_handle;
3549 r.in.sid = user_sid;
3550 r.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
3551 r.out.acct_handle = &lsa_acct_handle;
3552
3553 status = dcerpc_lsa_OpenAccount(lp, tctx, &r);
3554 torture_assert_ntstatus_ok(tctx, status,
3555 "Failed to open lsa account");
3556 }
3557
3558 {
3559 struct lsa_GetSystemAccessAccount r;
3560 uint32_t access_mask;
3561
3562 torture_comment(tctx, "Testing LSA GetSystemAccessAccount\n");
3563
3564 r.in.handle = &lsa_acct_handle;
3565 r.out.access_mask = &access_mask;
3566
3567 status = dcerpc_lsa_GetSystemAccessAccount(lp, tctx, &r);
3568 torture_assert_ntstatus_ok(tctx, status,
3569 "Failed to get lsa system access account");
3570 }
3571
3572 {
3573 struct lsa_DeleteObject r;
3574
3575 torture_comment(tctx, "Testing LSA DeleteObject\n");
3576
3577 r.in.handle = &lsa_acct_handle;
3578 r.out.handle = &lsa_acct_handle;
3579
3580 status = dcerpc_lsa_DeleteObject(lp, tctx, &r);
3581 torture_assert_ntstatus_ok(tctx, status,
3582 "Failed to delete object");
3583 }
3584
3585 {
3586 struct lsa_EnumAccounts r;
3587 uint32_t resume_handle = 0;
3588 struct lsa_SidArray lsa_sid_array;
3589 int i;
3590 bool found_sid = false;
3591
3592 torture_comment(tctx, "Testing LSA EnumAccounts\n");
3593
3594 r.in.handle = lsa_handle;
3595 r.in.num_entries = 0x1000;
3596 r.in.resume_handle = &resume_handle;
3597 r.out.sids = &lsa_sid_array;
3598 r.out.resume_handle = &resume_handle;
3599
3600 status = dcerpc_lsa_EnumAccounts(lp, tctx, &r);
3601 torture_assert_ntstatus_ok(tctx, status,
3602 "Failed to enum accounts");
3603
3604 for (i=0; i < lsa_sid_array.num_sids; i++) {
3605 if (dom_sid_equal(user_sid, lsa_sid_array.sids[i].sid)) {
3606 found_sid = true;
3607 }
3608 }
3609
3610 torture_assert(tctx, !found_sid,
3611 "should not have listed privileged account");
3612 }
3613
3614 {
3615 struct lsa_EnumAccountRights r;
3616 struct lsa_RightSet user_rights;
3617
3618 torture_comment(tctx, "Testing LSA EnumAccountRights\n");
3619
3620 r.in.handle = lsa_handle;
3621 r.in.sid = user_sid;
3622 r.out.rights = &user_rights;
3623
3624 status = dcerpc_lsa_EnumAccountRights(lp, tctx, &r);
3625 torture_assert_ntstatus_equal(tctx, status, NT_STATUS_OBJECT_NAME_NOT_FOUND,
3626 "Failed to enum rights for account");
3627 }
3628
3629 return ret;
3630 }
3631
3632 static bool test_user_ops(struct dcerpc_pipe *p,
3633 struct torture_context *tctx,
3634 struct policy_handle *user_handle,
3635 struct policy_handle *domain_handle,
3636 const struct dom_sid *domain_sid,
3637 uint32_t base_acct_flags,
3638 const char *base_acct_name, enum torture_samr_choice which_ops,
3639 struct cli_credentials *machine_credentials)
3640 {
3641 char *password = NULL;
3642 struct samr_QueryUserInfo q;
3643 union samr_UserInfo *info;
3644 NTSTATUS status;
3645
3646 bool ret = true;
3647 int i;
3648 uint32_t rid;
3649 const uint32_t password_fields[] = {
3650 SAMR_FIELD_NT_PASSWORD_PRESENT,
3651 SAMR_FIELD_LM_PASSWORD_PRESENT,
3652 SAMR_FIELD_NT_PASSWORD_PRESENT | SAMR_FIELD_LM_PASSWORD_PRESENT,
3653 0
3654 };
3655
3656 status = test_LookupName(p, tctx, domain_handle, base_acct_name, &rid);
3657 if (!NT_STATUS_IS_OK(status)) {
3658 ret = false;
3659 }
3660
3661 switch (which_ops) {
3662 case TORTURE_SAMR_USER_ATTRIBUTES:
3663 if (!test_QuerySecurity(p, tctx, user_handle)) {
3664 ret = false;
3665 }
3666
3667 if (!test_QueryUserInfo(p, tctx, user_handle)) {
3668 ret = false;
3669 }
3670
3671 if (!test_QueryUserInfo2(p, tctx, user_handle)) {
3672 ret = false;
3673 }
3674
3675 if (!test_SetUserInfo(p, tctx, user_handle, base_acct_flags,
3676 base_acct_name)) {
3677 ret = false;
3678 }
3679
3680 if (!test_GetUserPwInfo(p, tctx, user_handle)) {
3681 ret = false;
3682 }
3683
3684 if (!test_TestPrivateFunctionsUser(p, tctx, user_handle)) {
3685 ret = false;
3686 }
3687
3688 if (!test_SetUserPass(p, tctx, user_handle, &password)) {
3689 ret = false;
3690 }
3691 break;
3692 case TORTURE_SAMR_PASSWORDS:
3693 if (base_acct_flags & (ACB_WSTRUST|ACB_DOMTRUST|ACB_SVRTRUST)) {
3694 char simple_pass[9];
3695 char *v = generate_random_str(tctx, 1);
3696
3697 ZERO_STRUCT(simple_pass);
3698 memset(simple_pass, *v, sizeof(simple_pass) - 1);
3699
3700 torture_comment(tctx, "Testing machine account password policy rules\n");
3701
3702 /* Workstation trust accounts don't seem to need to honour password quality policy */
3703 if (!test_SetUserPassEx(p, tctx, user_handle, true, &password)) {
3704 ret = false;
3705 }
3706
3707 if (!test_ChangePasswordUser2(p, tctx, base_acct_name, &password, simple_pass, false)) {
3708 ret = false;
3709 }
3710
3711 /* reset again, to allow another 'user' password change */
3712 if (!test_SetUserPassEx(p, tctx, user_handle, true, &password)) {
3713 ret = false;
3714 }
3715
3716 /* Try a 'short' password */
3717 if (!test_ChangePasswordUser2(p, tctx, base_acct_name, &password, samr_rand_pass(tctx, 4), false)) {
3718 ret = false;
3719 }
3720
3721 /* Try a compleatly random password */
3722 if (!test_ChangePasswordRandomBytes(p, tctx, base_acct_name, user_handle, &password)) {
3723 ret = false;
3724 }
3725 }
3726
3727 for (i = 0; password_fields[i]; i++) {
3728 if (!test_SetUserPass_23(p, tctx, user_handle, password_fields[i], &password)) {
3729 ret = false;
3730 }
3731
3732 /* check it was set right */
3733 if (!test_ChangePasswordUser3(p, tctx, base_acct_name, 0, &password, NULL, 0, false)) {
3734 ret = false;
3735 }
3736 }
3737
3738 for (i = 0; password_fields[i]; i++) {
3739 if (!test_SetUserPass_25(p, tctx, user_handle, password_fields[i], &password)) {
3740 ret = false;
3741 }
3742
3743 /* check it was set right */
3744 if (!test_ChangePasswordUser3(p, tctx, base_acct_name, 0, &password, NULL, 0, false)) {
3745 ret = false;
3746 }
3747 }
3748
3749 if (!test_SetUserPassEx(p, tctx, user_handle, false, &password)) {
3750 ret = false;
3751 }
3752
3753 if (!test_ChangePassword(p, tctx, base_acct_name, domain_handle, &password)) {
3754 ret = false;
3755 }
3756
3757 if (torture_setting_bool(tctx, "samba4", false)) {
3758 torture_comment(tctx, "skipping Set Password level 18 and 21 against Samba4\n");
3759 } else {
3760
3761 if (!test_SetUserPass_18(p, tctx, user_handle, &password)) {
3762 ret = false;
3763 }
3764
3765 if (!test_ChangePasswordUser3(p, tctx, base_acct_name, 0, &password, NULL, 0, false)) {
3766 ret = false;
3767 }
3768
3769 for (i = 0; password_fields[i]; i++) {
3770
3771 if (password_fields[i] == SAMR_FIELD_LM_PASSWORD_PRESENT) {
3772 /* we need to skip as that would break
3773 * the ChangePasswordUser3 verify */
3774 continue;
3775 }
3776
3777 if (!test_SetUserPass_21(p, tctx, user_handle, password_fields[i], &password)) {
3778 ret = false;
3779 }
3780
3781 /* check it was set right */
3782 if (!test_ChangePasswordUser3(p, tctx, base_acct_name, 0, &password, NULL, 0, false)) {
3783 ret = false;
3784 }
3785 }
3786 }
3787
3788 q.in.user_handle = user_handle;
3789 q.in.level = 5;
3790 q.out.info = &info;
3791
3792 status = dcerpc_samr_QueryUserInfo(p, tctx, &q);
3793 if (!NT_STATUS_IS_OK(status)) {
3794 torture_warning(tctx, "QueryUserInfo level %u failed - %s\n",
3795 q.in.level, nt_errstr(status));
3796 ret = false;
3797 } else {
3798 uint32_t expected_flags = (base_acct_flags | ACB_PWNOTREQ | ACB_DISABLED);
3799 if ((info->info5.acct_flags) != expected_flags) {
3800 torture_warning(tctx, "QuerUserInfo level 5 failed, it returned 0x%08x when we expected flags of 0x%08x\n",
3801 info->info5.acct_flags,
3802 expected_flags);
3803 /* FIXME: GD */
3804 if (!torture_setting_bool(tctx, "samba3", false)) {
3805 ret = false;
3806 }
3807 }
3808 if (info->info5.rid != rid) {
3809 torture_warning(tctx, "QuerUserInfo level 5 failed, it returned %u when we expected rid of %u\n",
3810 info->info5.rid, rid);
3811
3812 }
3813 }
3814
3815 break;
3816
3817 case TORTURE_SAMR_PASSWORDS_PWDLASTSET:
3818
3819 /* test last password change timestamp behaviour */
3820 if (!test_SetPassword_pwdlastset(p, tctx, base_acct_flags,
3821 base_acct_name,
3822 user_handle, &password,
3823 machine_credentials)) {
3824 ret = false;
3825 }
3826
3827 if (ret == true) {
3828 torture_comment(tctx, "pwdLastSet test succeeded\n");
3829 } else {
3830 torture_warning(tctx, "pwdLastSet test failed\n");
3831 }
3832
3833 break;
3834
3835 case TORTURE_SAMR_USER_PRIVILEGES: {
3836
3837 struct dcerpc_pipe *lp;
3838 struct policy_handle *lsa_handle;
3839
3840 status = torture_rpc_connection(tctx, &lp, &ndr_table_lsarpc);
3841 torture_assert_ntstatus_ok(tctx, status, "Failed to open LSA pipe");
3842
3843 if (!test_lsa_OpenPolicy2(lp, tctx, &lsa_handle)) {
3844 ret = false;
3845 }
3846
3847 if (!test_DeleteUser_with_privs(p, lp, tctx,
3848 domain_handle, lsa_handle, user_handle,
3849 domain_sid, rid,
3850 machine_credentials)) {
3851 ret = false;
3852 }
3853
3854 if (!test_lsa_Close(lp, tctx, lsa_handle)) {
3855 ret = false;
3856 }
3857
3858 if (!ret) {
3859 torture_warning(tctx, "privileged user delete test failed\n");
3860 }
3861
3862 break;
3863 }
3864 case TORTURE_SAMR_OTHER:
3865 /* We just need the account to exist */
3866 break;
3867 }
3868 return ret;
3869 }
3870
3871 static bool test_alias_ops(struct dcerpc_pipe *p, struct torture_context *tctx,
3872 struct policy_handle *alias_handle,
3873 const struct dom_sid *domain_sid)
3874 {
3875 bool ret = true;
3876
3877 if (!torture_setting_bool(tctx, "samba3", false)) {
3878 if (!test_QuerySecurity(p, tctx, alias_handle)) {
3879 ret = false;
3880 }
3881 }
3882
3883 if (!test_QueryAliasInfo(p, tctx, alias_handle)) {
3884 ret = false;
3885 }
3886
3887 if (!test_SetAliasInfo(p, tctx, alias_handle)) {
3888 ret = false;
3889 }
3890
3891 if (!test_AddMemberToAlias(p, tctx, alias_handle, domain_sid)) {
3892 ret = false;
3893 }
3894
3895 if (torture_setting_bool(tctx, "samba3", false) ||
3896 torture_setting_bool(tctx, "samba4", false)) {
3897 torture_comment(tctx, "skipping MultipleMembers Alias tests against Samba\n");
3898 return ret;
3899 }
3900
3901 if (!test_AddMultipleMembersToAlias(p, tctx, alias_handle)) {
3902 ret = false;
3903 }
3904
3905 return ret;
3906 }
3907
3908
3909 static bool test_DeleteUser(struct dcerpc_pipe *p, struct torture_context *tctx,
3910 struct policy_handle *user_handle)
3911 {
3912 struct samr_DeleteUser d;
3913 NTSTATUS status;
3914 torture_comment(tctx, "Testing DeleteUser\n");
3915
3916 d.in.user_handle = user_handle;
3917 d.out.user_handle = user_handle;
3918
3919 status = dcerpc_samr_DeleteUser(p, tctx, &d);
3920 torture_assert_ntstatus_ok(tctx, status, "DeleteUser");
3921
3922 return true;
3923 }
3924
3925 bool test_DeleteUser_byname(struct dcerpc_pipe *p,
3926 struct torture_context *tctx,
3927 struct policy_handle *handle, const char *name)
3928 {
3929 NTSTATUS status;
3930 struct samr_DeleteUser d;
3931 struct policy_handle user_handle;
3932 uint32_t rid;
3933
3934 status = test_LookupName(p, tctx, handle, name, &rid);
3935 if (!NT_STATUS_IS_OK(status)) {
3936 goto failed;
3937 }
3938
3939 status = test_OpenUser_byname(p, tctx, handle, name, &user_handle);
3940 if (!NT_STATUS_IS_OK(status)) {
3941 goto failed;
3942 }
3943
3944 d.in.user_handle = &user_handle;
3945 d.out.user_handle = &user_handle;
3946 status = dcerpc_samr_DeleteUser(p, tctx, &d);
3947 if (!NT_STATUS_IS_OK(status)) {
3948 goto failed;
3949 }
3950
3951 return true;
3952
3953 failed:
3954 torture_warning(tctx, "DeleteUser_byname(%s) failed - %s\n", name, nt_errstr(status));
3955 return false;
3956 }
3957
3958
3959 static bool test_DeleteGroup_byname(struct dcerpc_pipe *p,
3960 struct torture_context *tctx,
3961 struct policy_handle *handle, const char *name)
3962 {
3963 NTSTATUS status;
3964 struct samr_OpenGroup r;
3965 struct samr_DeleteDomainGroup d;
3966 struct policy_handle group_handle;
3967 uint32_t rid;
3968
3969 status = test_LookupName(p, tctx, handle, name, &rid);
3970 if (!NT_STATUS_IS_OK(status)) {
3971 goto failed;
3972 }
3973
3974 r.in.domain_handle = handle;
3975 r.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
3976 r.in.rid = rid;
3977 r.out.group_handle = &group_handle;
3978 status = dcerpc_samr_OpenGroup(p, tctx, &r);
3979 if (!NT_STATUS_IS_OK(status)) {
3980 goto failed;
3981 }
3982
3983 d.in.group_handle = &group_handle;
3984 d.out.group_handle = &group_handle;
3985 status = dcerpc_samr_DeleteDomainGroup(p, tctx, &d);
3986 if (!NT_STATUS_IS_OK(status)) {
3987 goto failed;
3988 }
3989
3990 return true;
3991
3992 failed:
3993 torture_warning(tctx, "DeleteGroup_byname(%s) failed - %s\n", name, nt_errstr(status));
3994 return false;
3995 }
3996
3997
3998 static bool test_DeleteAlias_byname(struct dcerpc_pipe *p,
3999 struct torture_context *tctx,
4000 struct policy_handle *domain_handle,
4001 const char *name)
4002 {
4003 NTSTATUS status;
4004 struct samr_OpenAlias r;
4005 struct samr_DeleteDomAlias d;
4006 struct policy_handle alias_handle;
4007 uint32_t rid;
4008
4009 torture_comment(tctx, "testing DeleteAlias_byname\n");
4010
4011 status = test_LookupName(p, tctx, domain_handle, name, &rid);
4012 if (!NT_STATUS_IS_OK(status)) {
4013 goto failed;
4014 }
4015
4016 r.in.domain_handle = domain_handle;
4017 r.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
4018 r.in.rid = rid;
4019 r.out.alias_handle = &alias_handle;
4020 status = dcerpc_samr_OpenAlias(p, tctx, &r);
4021 if (!NT_STATUS_IS_OK(status)) {
4022 goto failed;
4023 }
4024
4025 d.in.alias_handle = &alias_handle;
4026 d.out.alias_handle = &alias_handle;
4027 status = dcerpc_samr_DeleteDomAlias(p, tctx, &d);
4028 if (!NT_STATUS_IS_OK(status)) {
4029 goto failed;
4030 }
4031
4032 return true;
4033
4034 failed:
4035 torture_warning(tctx, "DeleteAlias_byname(%s) failed - %s\n", name, nt_errstr(status));
4036 return false;
4037 }
4038
4039 static bool test_DeleteAlias(struct dcerpc_pipe *p,
4040 struct torture_context *tctx,
4041 struct policy_handle *alias_handle)
4042 {
4043 struct samr_DeleteDomAlias d;
4044 NTSTATUS status;
4045 bool ret = true;
4046
4047 torture_comment(tctx, "Testing DeleteAlias\n");
4048
4049 d.in.alias_handle = alias_handle;
4050 d.out.alias_handle = alias_handle;
4051
4052 status = dcerpc_samr_DeleteDomAlias(p, tctx, &d);
4053 if (!NT_STATUS_IS_OK(status)) {
4054 torture_warning(tctx, "DeleteAlias failed - %s\n", nt_errstr(status));
4055 ret = false;
4056 }
4057
4058 return ret;
4059 }
4060
4061 static bool test_CreateAlias(struct dcerpc_pipe *p, struct torture_context *tctx,
4062 struct policy_handle *domain_handle,
4063 const char *alias_name,
4064 struct policy_handle *alias_handle,
4065 const struct dom_sid *domain_sid,
4066 bool test_alias)
4067 {
4068 NTSTATUS status;
4069 struct samr_CreateDomAlias r;
4070 struct lsa_String name;
4071 uint32_t rid;
4072 bool ret = true;
4073
4074 init_lsa_String(&name, alias_name);
4075 r.in.domain_handle = domain_handle;
4076 r.in.alias_name = &name;
4077 r.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
4078 r.out.alias_handle = alias_handle;
4079 r.out.rid = &rid;
4080
4081 torture_comment(tctx, "Testing CreateAlias (%s)\n", r.in.alias_name->string);
4082
4083 status = dcerpc_samr_CreateDomAlias(p, tctx, &r);
4084
4085 if (dom_sid_equal(domain_sid, dom_sid_parse_talloc(tctx, SID_BUILTIN))) {
4086 if (NT_STATUS_EQUAL(status, NT_STATUS_ACCESS_DENIED)) {
4087 torture_comment(tctx, "Server correctly refused create of '%s'\n", r.in.alias_name->string);
4088 return true;
4089 } else {
4090 torture_warning(tctx, "Server should have refused create of '%s', got %s instead\n", r.in.alias_name->string,
4091 nt_errstr(status));
4092 return false;
4093 }
4094 }
4095
4096 if (NT_STATUS_EQUAL(status, NT_STATUS_ALIAS_EXISTS)) {
4097 if (!test_DeleteAlias_byname(p, tctx, domain_handle, r.in.alias_name->string)) {
4098 return false;
4099 }
4100 status = dcerpc_samr_CreateDomAlias(p, tctx, &r);
4101 }
4102
4103 if (!NT_STATUS_IS_OK(status)) {
4104 torture_warning(tctx, "CreateAlias failed - %s\n", nt_errstr(status));
4105 return false;
4106 }
4107
4108 if (!test_alias) {
4109 return ret;
4110 }
4111
4112 if (!test_alias_ops(p, tctx, alias_handle, domain_sid)) {
4113 ret = false;
4114 }
4115
4116 return ret;
4117 }
4118
4119 static bool test_ChangePassword(struct dcerpc_pipe *p,
4120 struct torture_context *tctx,
4121 const char *acct_name,
4122 struct policy_handle *domain_handle, char **password)
4123 {
4124 bool ret = true;
4125
4126 if (!*password) {
4127 return false;
4128 }
4129
4130 if (!test_ChangePasswordUser(p, tctx, acct_name, domain_handle, password)) {
4131 ret = false;
4132 }
4133
4134 if (!test_ChangePasswordUser2(p, tctx, acct_name, password, 0, true)) {
4135 ret = false;
4136 }
4137
4138 if (!test_OemChangePasswordUser2(p, tctx, acct_name, domain_handle, password)) {
4139 ret = false;
4140 }
4141
4142 /* test what happens when setting the old password again */
4143 if (!test_ChangePasswordUser3(p, tctx, acct_name, 0, password, *password, 0, true)) {
4144 ret = false;
4145 }
4146
4147 {
4148 char simple_pass[9];
4149 char *v = generate_random_str(tctx, 1);
4150
4151 ZERO_STRUCT(simple_pass);
4152 memset(simple_pass, *v, sizeof(simple_pass) - 1);
4153
4154 /* test what happens when picking a simple password */
4155 if (!test_ChangePasswordUser3(p, tctx, acct_name, 0, password, simple_pass, 0, true)) {
4156 ret = false;
4157 }
4158 }
4159
4160 /* set samr_SetDomainInfo level 1 with min_length 5 */
4161 {
4162 struct samr_QueryDomainInfo r;
4163 union samr_DomainInfo *info = NULL;
4164 struct samr_SetDomainInfo s;
4165 uint16_t len_old, len;
4166 uint32_t pwd_prop_old;
4167 int64_t min_pwd_age_old;
4168 NTSTATUS status;
4169
4170 len = 5;
4171
4172 r.in.domain_handle = domain_handle;
4173 r.in.level = 1;
4174 r.out.info = &info;
4175
4176 torture_comment(tctx, "testing samr_QueryDomainInfo level 1\n");
4177 status = dcerpc_samr_QueryDomainInfo(p, tctx, &r);
4178 if (!NT_STATUS_IS_OK(status)) {
4179 return false;
4180 }
4181
4182 s.in.domain_handle = domain_handle;
4183 s.in.level = 1;
4184 s.in.info = info;
4185
4186 /* remember the old min length, so we can reset it */
4187 len_old = s.in.info->info1.min_password_length;
4188 s.in.info->info1.min_password_length = len;
4189 pwd_prop_old = s.in.info->info1.password_properties;
4190 /* turn off password complexity checks for this test */
4191 s.in.info->info1.password_properties &= ~DOMAIN_PASSWORD_COMPLEX;
4192
4193 min_pwd_age_old = s.in.info->info1.min_password_age;
4194 s.in.info->info1.min_password_age = 0;
4195
4196 torture_comment(tctx, "testing samr_SetDomainInfo level 1\n");
4197 status = dcerpc_samr_SetDomainInfo(p, tctx, &s);
4198 if (!NT_STATUS_IS_OK(status)) {
4199 return false;
4200 }
4201
4202 torture_comment(tctx, "calling test_ChangePasswordUser3 with too short password\n");
4203
4204 if (!test_ChangePasswordUser3(p, tctx, acct_name, len - 1, password, NULL, 0, true)) {
4205 ret = false;
4206 }
4207
4208 s.in.info->info1.min_password_length = len_old;
4209 s.in.info->info1.password_properties = pwd_prop_old;
4210 s.in.info->info1.min_password_age = min_pwd_age_old;
4211
4212 torture_comment(tctx, "testing samr_SetDomainInfo level 1\n");
4213 status = dcerpc_samr_SetDomainInfo(p, tctx, &s);
4214 if (!NT_STATUS_IS_OK(status)) {
4215 return false;
4216 }
4217
4218 }
4219
4220 {
4221 NTSTATUS status;
4222 struct samr_OpenUser r;
4223 struct samr_QueryUserInfo q;
4224 union samr_UserInfo *info;
4225 struct samr_LookupNames n;
4226 struct policy_handle user_handle;
4227 struct samr_Ids rids, types;
4228
4229 n.in.domain_handle = domain_handle;
4230 n.in.num_names = 1;
4231 n.in.names = talloc_array(tctx, struct lsa_String, 1);
4232 n.in.names[0].string = acct_name;
4233 n.out.rids = &rids;
4234 n.out.types = &types;
4235
4236 status = dcerpc_samr_LookupNames(p, tctx, &n);
4237 if (!NT_STATUS_IS_OK(status)) {
4238 torture_warning(tctx, "LookupNames failed - %s\n", nt_errstr(status));
4239 return false;
4240 }
4241
4242 r.in.domain_handle = domain_handle;
4243 r.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
4244 r.in.rid = n.out.rids->ids[0];
4245 r.out.user_handle = &user_handle;
4246
4247 status = dcerpc_samr_OpenUser(p, tctx, &r);
4248 if (!NT_STATUS_IS_OK(status)) {
4249 torture_warning(tctx, "OpenUser(%u) failed - %s\n", n.out.rids->ids[0], nt_errstr(status));
4250 return false;
4251 }
4252
4253 q.in.user_handle = &user_handle;
4254 q.in.level = 5;
4255 q.out.info = &info;
4256
4257 status = dcerpc_samr_QueryUserInfo(p, tctx, &q);
4258 if (!NT_STATUS_IS_OK(status)) {
4259 torture_warning(tctx, "QueryUserInfo failed - %s\n", nt_errstr(status));
4260 return false;
4261 }
4262
4263 torture_comment(tctx, "calling test_ChangePasswordUser3 with too early password change\n");
4264
4265 if (!test_ChangePasswordUser3(p, tctx, acct_name, 0, password, NULL,
4266 info->info5.last_password_change, true)) {
4267 ret = false;
4268 }
4269 }
4270
4271 /* we change passwords twice - this has the effect of verifying
4272 they were changed correctly for the final call */
4273 if (!test_ChangePasswordUser3(p, tctx, acct_name, 0, password, NULL, 0, true)) {
4274 ret = false;
4275 }
4276
4277 if (!test_ChangePasswordUser3(p, tctx, acct_name, 0, password, NULL, 0, true)) {
4278 ret = false;
4279 }
4280
4281 return ret;
4282 }
4283
4284 static bool test_CreateUser(struct dcerpc_pipe *p, struct torture_context *tctx,
4285 struct policy_handle *domain_handle,
4286 const char *user_name,
4287 struct policy_handle *user_handle_out,
4288 struct dom_sid *domain_sid,
4289 enum torture_samr_choice which_ops,
4290 struct cli_credentials *machine_credentials,
4291 bool test_user)
4292 {
4293
4294 TALLOC_CTX *user_ctx;
4295
4296 NTSTATUS status;
4297 struct samr_CreateUser r;
4298 struct samr_QueryUserInfo q;
4299 union samr_UserInfo *info;
4300 struct samr_DeleteUser d;
4301 uint32_t rid;
4302
4303 /* This call creates a 'normal' account - check that it really does */
4304 const uint32_t acct_flags = ACB_NORMAL;
4305 struct lsa_String name;
4306 bool ret = true;
4307
4308 struct policy_handle user_handle;
4309 user_ctx = talloc_named(tctx, 0, "test_CreateUser2 per-user context");
4310 init_lsa_String(&name, user_name);
4311
4312 r.in.domain_handle = domain_handle;
4313 r.in.account_name = &name;
4314 r.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
4315 r.out.user_handle = &user_handle;
4316 r.out.rid = &rid;
4317
4318 torture_comment(tctx, "Testing CreateUser(%s)\n", r.in.account_name->string);
4319
4320 status = dcerpc_samr_CreateUser(p, user_ctx, &r);
4321
4322 if (dom_sid_equal(domain_sid, dom_sid_parse_talloc(tctx, SID_BUILTIN))) {
4323 if (NT_STATUS_EQUAL(status, NT_STATUS_ACCESS_DENIED) || NT_STATUS_EQUAL(status, NT_STATUS_INVALID_PARAMETER)) {
4324 torture_comment(tctx, "Server correctly refused create of '%s'\n", r.in.account_name->string);
4325 return true;
4326 } else {
4327 torture_warning(tctx, "Server should have refused create of '%s', got %s instead\n", r.in.account_name->string,
4328 nt_errstr(status));
4329 return false;
4330 }
4331 }
4332
4333 if (NT_STATUS_EQUAL(status, NT_STATUS_USER_EXISTS)) {
4334 if (!test_DeleteUser_byname(p, user_ctx, domain_handle, r.in.account_name->string)) {
4335 talloc_free(user_ctx);
4336 return false;
4337 }
4338 status = dcerpc_samr_CreateUser(p, user_ctx, &r);
4339 }
4340
4341 if (!NT_STATUS_IS_OK(status)) {
4342 talloc_free(user_ctx);
4343 torture_warning(tctx, "CreateUser failed - %s\n", nt_errstr(status));
4344 return false;
4345 }
4346
4347 if (!test_user) {
4348 if (user_handle_out) {
4349 *user_handle_out = user_handle;
4350 }
4351 return ret;
4352 }
4353
4354 {
4355 q.in.user_handle = &user_handle;
4356 q.in.level = 16;
4357 q.out.info = &info;
4358
4359 status = dcerpc_samr_QueryUserInfo(p, user_ctx, &q);
4360 if (!NT_STATUS_IS_OK(status)) {
4361 torture_warning(tctx, "QueryUserInfo level %u failed - %s\n",
4362 q.in.level, nt_errstr(status));
4363 ret = false;
4364 } else {
4365 if ((info->info16.acct_flags & acct_flags) != acct_flags) {
4366 torture_warning(tctx, "QuerUserInfo level 16 failed, it returned 0x%08x when we expected flags of 0x%08x\n",
4367 info->info16.acct_flags,
4368 acct_flags);
4369 ret = false;
4370 }
4371 }
4372
4373 if (!test_user_ops(p, tctx, &user_handle, domain_handle,
4374 domain_sid, acct_flags, name.string, which_ops,
4375 machine_credentials)) {
4376 ret = false;
4377 }
4378
4379 if (user_handle_out) {
4380 *user_handle_out = user_handle;
4381 } else {
4382 torture_comment(tctx, "Testing DeleteUser (createuser test)\n");
4383
4384 d.in.user_handle = &user_handle;
4385 d.out.user_handle = &user_handle;
4386
4387 status = dcerpc_samr_DeleteUser(p, user_ctx, &d);
4388 if (!NT_STATUS_IS_OK(status)) {
4389 torture_warning(tctx, "DeleteUser failed - %s\n", nt_errstr(status));
4390 ret = false;
4391 }
4392 }
4393
4394 }
4395
4396 talloc_free(user_ctx);
4397
4398 return ret;
4399 }
4400
4401
4402 static bool test_CreateUser2(struct dcerpc_pipe *p, struct torture_context *tctx,
4403 struct policy_handle *domain_handle,
4404 struct dom_sid *domain_sid,
4405 enum torture_samr_choice which_ops,
4406 struct cli_credentials *machine_credentials)
4407 {
4408 NTSTATUS status;
4409 struct samr_CreateUser2 r;
4410 struct samr_QueryUserInfo q;
4411 union samr_UserInfo *info;
4412 struct samr_DeleteUser d;
4413 struct policy_handle user_handle;
4414 uint32_t rid;
4415 struct lsa_String name;
4416 bool ret = true;
4417 int i;
4418
4419 struct {
4420 uint32_t acct_flags;
4421 const char *account_name;
4422 NTSTATUS nt_status;
4423 } account_types[] = {
4424 { ACB_NORMAL, TEST_ACCOUNT_NAME, NT_STATUS_OK },
4425 { ACB_NORMAL | ACB_DISABLED, TEST_ACCOUNT_NAME, NT_STATUS_INVALID_PARAMETER },
4426 { ACB_NORMAL | ACB_PWNOEXP, TEST_ACCOUNT_NAME, NT_STATUS_INVALID_PARAMETER },
4427 { ACB_WSTRUST, TEST_MACHINENAME, NT_STATUS_OK },
4428 { ACB_WSTRUST | ACB_DISABLED, TEST_MACHINENAME, NT_STATUS_INVALID_PARAMETER },
4429 { ACB_WSTRUST | ACB_PWNOEXP, TEST_MACHINENAME, NT_STATUS_INVALID_PARAMETER },
4430 { ACB_SVRTRUST, TEST_MACHINENAME, NT_STATUS_OK },
4431 { ACB_SVRTRUST | ACB_DISABLED, TEST_MACHINENAME, NT_STATUS_INVALID_PARAMETER },
4432 { ACB_SVRTRUST | ACB_PWNOEXP, TEST_MACHINENAME, NT_STATUS_INVALID_PARAMETER },
4433 { ACB_DOMTRUST, TEST_DOMAINNAME, NT_STATUS_ACCESS_DENIED },
4434 { ACB_DOMTRUST | ACB_DISABLED, TEST_DOMAINNAME, NT_STATUS_INVALID_PARAMETER },
4435 { ACB_DOMTRUST | ACB_PWNOEXP, TEST_DOMAINNAME, NT_STATUS_INVALID_PARAMETER },
4436 { 0, TEST_ACCOUNT_NAME, NT_STATUS_INVALID_PARAMETER },
4437 { ACB_DISABLED, TEST_ACCOUNT_NAME, NT_STATUS_INVALID_PARAMETER },
4438 { 0, NULL, NT_STATUS_INVALID_PARAMETER }
4439 };
4440
4441 for (i = 0; account_types[i].account_name; i++) {
4442 TALLOC_CTX *user_ctx;
4443 uint32_t acct_flags = account_types[i].acct_flags;
4444 uint32_t access_granted;
4445 user_ctx = talloc_named(tctx, 0, "test_CreateUser2 per-user context");
4446 init_lsa_String(&name, account_types[i].account_name);
4447
4448 r.in.domain_handle = domain_handle;
4449 r.in.account_name = &name;
4450 r.in.acct_flags = acct_flags;
4451 r.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
4452 r.out.user_handle = &user_handle;
4453 r.out.access_granted = &access_granted;
4454 r.out.rid = &rid;
4455
4456 torture_comment(tctx, "Testing CreateUser2(%s, 0x%x)\n", r.in.account_name->string, acct_flags);
4457
4458 status = dcerpc_samr_CreateUser2(p, user_ctx, &r);
4459
4460 if (dom_sid_equal(domain_sid, dom_sid_parse_talloc(tctx, SID_BUILTIN))) {
4461 if (NT_STATUS_EQUAL(status, NT_STATUS_ACCESS_DENIED) || NT_STATUS_EQUAL(status, NT_STATUS_INVALID_PARAMETER)) {
4462 torture_comment(tctx, "Server correctly refused create of '%s'\n", r.in.account_name->string);
4463 continue;
4464 } else {
4465 torture_warning(tctx, "Server should have refused create of '%s', got %s instead\n", r.in.account_name->string,
4466 nt_errstr(status));
4467 ret = false;
4468 continue;
4469 }
4470 }
4471
4472 if (NT_STATUS_EQUAL(status, NT_STATUS_USER_EXISTS)) {
4473 if (!test_DeleteUser_byname(p, user_ctx, domain_handle, r.in.account_name->string)) {
4474 talloc_free(user_ctx);
4475 ret = false;
4476 continue;
4477 }
4478 status = dcerpc_samr_CreateUser2(p, user_ctx, &r);
4479
4480 }
4481 if (!NT_STATUS_EQUAL(status, account_types[i].nt_status)) {
4482 torture_warning(tctx, "CreateUser2 failed gave incorrect error return - %s (should be %s)\n",
4483 nt_errstr(status), nt_errstr(account_types[i].nt_status));
4484 ret = false;
4485 }
4486
4487 if (NT_STATUS_IS_OK(status)) {
4488 q.in.user_handle = &user_handle;
4489 q.in.level = 5;
4490 q.out.info = &info;
4491
4492 status = dcerpc_samr_QueryUserInfo(p, user_ctx, &q);
4493 if (!NT_STATUS_IS_OK(status)) {
4494 torture_warning(tctx, "QueryUserInfo level %u failed - %s\n",
4495 q.in.level, nt_errstr(status));
4496 ret = false;
4497 } else {
4498 uint32_t expected_flags = (acct_flags | ACB_PWNOTREQ | ACB_DISABLED);
4499 if (acct_flags == ACB_NORMAL) {
4500 expected_flags |= ACB_PW_EXPIRED;
4501 }
4502 if ((info->info5.acct_flags) != expected_flags) {
4503 torture_warning(tctx, "QuerUserInfo level 5 failed, it returned 0x%08x when we expected flags of 0x%08x\n",
4504 info->info5.acct_flags,
4505 expected_flags);
4506 ret = false;
4507 }
4508 switch (acct_flags) {
4509 case ACB_SVRTRUST:
4510 if (info->info5.primary_gid != DOMAIN_RID_DCS) {
4511 torture_warning(tctx, "QuerUserInfo level 5: DC should have had Primary Group %d, got %d\n",
4512 DOMAIN_RID_DCS, info->info5.primary_gid);
4513 ret = false;
4514 }
4515 break;
4516 case ACB_WSTRUST:
4517 if (info->info5.primary_gid != DOMAIN_RID_DOMAIN_MEMBERS) {
4518 torture_warning(tctx, "QuerUserInfo level 5: Domain Member should have had Primary Group %d, got %d\n",
4519 DOMAIN_RID_DOMAIN_MEMBERS, info->info5.primary_gid);
4520 ret = false;
4521 }
4522 break;
4523 case ACB_NORMAL:
4524 if (info->info5.primary_gid != DOMAIN_RID_USERS) {
4525 torture_warning(tctx, "QuerUserInfo level 5: Users should have had Primary Group %d, got %d\n",
4526 DOMAIN_RID_USERS, info->info5.primary_gid);
4527 ret = false;
4528 }
4529 break;
4530 }
4531 }
4532
4533 if (!test_user_ops(p, tctx, &user_handle, domain_handle,
4534 domain_sid, acct_flags, name.string, which_ops,
4535 machine_credentials)) {
4536 ret = false;
4537 }
4538
4539 if (!policy_handle_empty(&user_handle)) {
4540 torture_comment(tctx, "Testing DeleteUser (createuser2 test)\n");
4541
4542 d.in.user_handle = &user_handle;
4543 d.out.user_handle = &user_handle;
4544
4545 status = dcerpc_samr_DeleteUser(p, user_ctx, &d);
4546 if (!NT_STATUS_IS_OK(status)) {
4547 torture_warning(tctx, "DeleteUser failed - %s\n", nt_errstr(status));
4548 ret = false;
4549 }
4550 }
4551 }
4552 talloc_free(user_ctx);
4553 }
4554
4555 return ret;
4556 }
4557
4558 static bool test_QueryAliasInfo(struct dcerpc_pipe *p,
4559 struct torture_context *tctx,
4560 struct policy_handle *handle)
4561 {
4562 NTSTATUS status;
4563 struct samr_QueryAliasInfo r;
4564 union samr_AliasInfo *info;
4565 uint16_t levels[] = {1, 2, 3};
4566 int i;
4567 bool ret = true;
4568
4569 for (i=0;i<ARRAY_SIZE(levels);i++) {
4570 torture_comment(tctx, "Testing QueryAliasInfo level %u\n", levels[i]);
4571
4572 r.in.alias_handle = handle;
4573 r.in.level = levels[i];
4574 r.out.info = &info;
4575
4576 status = dcerpc_samr_QueryAliasInfo(p, tctx, &r);
4577 if (!NT_STATUS_IS_OK(status)) {
4578 torture_warning(tctx, "QueryAliasInfo level %u failed - %s\n",
4579 levels[i], nt_errstr(status));
4580 ret = false;
4581 }
4582 }
4583
4584 return ret;
4585 }
4586
4587 static bool test_QueryGroupInfo(struct dcerpc_pipe *p,
4588 struct torture_context *tctx,
4589 struct policy_handle *handle)
4590 {
4591 NTSTATUS status;
4592 struct samr_QueryGroupInfo r;
4593 union samr_GroupInfo *info;
4594 uint16_t levels[] = {1, 2, 3, 4, 5};
4595 int i;
4596 bool ret = true;
4597
4598 for (i=0;i<ARRAY_SIZE(levels);i++) {
4599 torture_comment(tctx, "Testing QueryGroupInfo level %u\n", levels[i]);
4600
4601 r.in.group_handle = handle;
4602 r.in.level = levels[i];
4603 r.out.info = &info;
4604
4605 status = dcerpc_samr_QueryGroupInfo(p, tctx, &r);
4606 if (!NT_STATUS_IS_OK(status)) {
4607 torture_warning(tctx, "QueryGroupInfo level %u failed - %s\n",
4608 levels[i], nt_errstr(status));
4609 ret = false;
4610 }
4611 }
4612
4613 return ret;
4614 }
4615
4616 static bool test_QueryGroupMember(struct dcerpc_pipe *p,
4617 struct torture_context *tctx,
4618 struct policy_handle *handle)
4619 {
4620 NTSTATUS status;
4621 struct samr_QueryGroupMember r;
4622 struct samr_RidTypeArray *rids = NULL;
4623 bool ret = true;
4624
4625 torture_comment(tctx, "Testing QueryGroupMember\n");
4626
4627 r.in.group_handle = handle;
4628 r.out.rids = &rids;
4629
4630 status = dcerpc_samr_QueryGroupMember(p, tctx, &r);
4631 if (!NT_STATUS_IS_OK(status)) {
4632 torture_warning(tctx, "QueryGroupInfo failed - %s\n", nt_errstr(status));
4633 ret = false;
4634 }
4635
4636 return ret;
4637 }
4638
4639
4640 static bool test_SetGroupInfo(struct dcerpc_pipe *p,
4641 struct torture_context *tctx,
4642 struct policy_handle *handle)
4643 {
4644 NTSTATUS status;
4645 struct samr_QueryGroupInfo r;
4646 union samr_GroupInfo *info;
4647 struct samr_SetGroupInfo s;
4648 uint16_t levels[] = {1, 2, 3, 4};
4649 uint16_t set_ok[] = {0, 1, 1, 1};
4650 int i;
4651 bool ret = true;
4652
4653 for (i=0;i<ARRAY_SIZE(levels);i++) {
4654 torture_comment(tctx, "Testing QueryGroupInfo level %u\n", levels[i]);
4655
4656 r.in.group_handle = handle;
4657 r.in.level = levels[i];
4658 r.out.info = &info;
4659
4660 status = dcerpc_samr_QueryGroupInfo(p, tctx, &r);
4661 if (!NT_STATUS_IS_OK(status)) {
4662 torture_warning(tctx, "QueryGroupInfo level %u failed - %s\n",
4663 levels[i], nt_errstr(status));
4664 ret = false;
4665 }
4666
4667 torture_comment(tctx, "Testing SetGroupInfo level %u\n", levels[i]);
4668
4669 s.in.group_handle = handle;
4670 s.in.level = levels[i];
4671 s.in.info = *r.out.info;
4672
4673 #if 0
4674 /* disabled this, as it changes the name only from the point of view of samr,
4675 but leaves the name from the point of view of w2k3 internals (and ldap). This means
4676 the name is still reserved, so creating the old name fails, but deleting by the old name
4677 also fails */
4678 if (s.in.level == 2) {
4679 init_lsa_String(&s.in.info->string, "NewName");
4680 }
4681 #endif
4682
4683 if (s.in.level == 4) {
4684 init_lsa_String(&s.in.info->description, "test description");
4685 }
4686
4687 status = dcerpc_samr_SetGroupInfo(p, tctx, &s);
4688 if (set_ok[i]) {
4689 if (!NT_STATUS_IS_OK(status)) {
4690 torture_warning(tctx, "SetGroupInfo level %u failed - %s\n",
4691 r.in.level, nt_errstr(status));
4692 ret = false;
4693 continue;
4694 }
4695 } else {
4696 if (!NT_STATUS_EQUAL(NT_STATUS_INVALID_INFO_CLASS, status)) {
4697 torture_warning(tctx, "SetGroupInfo level %u gave %s - should have been NT_STATUS_INVALID_INFO_CLASS\n",
4698 r.in.level, nt_errstr(status));
4699 ret = false;
4700 continue;
4701 }
4702 }
4703 }
4704
4705 return ret;
4706 }
4707
4708 static bool test_QueryUserInfo(struct dcerpc_pipe *p,
4709 struct torture_context *tctx,
4710 struct policy_handle *handle)
4711 {
4712 NTSTATUS status;
4713 struct samr_QueryUserInfo r;
4714 union samr_UserInfo *info;
4715 uint16_t levels[] = {1, 2, 3, 4, 5, 6, 7, 8, 9, 10,
4716 11, 12, 13, 14, 16, 17, 20, 21};
4717 int i;
4718 bool ret = true;
4719
4720 for (i=0;i<ARRAY_SIZE(levels);i++) {
4721 torture_comment(tctx, "Testing QueryUserInfo level %u\n", levels[i]);
4722
4723 r.in.user_handle = handle;
4724 r.in.level = levels[i];
4725 r.out.info = &info;
4726
4727 status = dcerpc_samr_QueryUserInfo(p, tctx, &r);
4728 if (!NT_STATUS_IS_OK(status)) {
4729 torture_warning(tctx, "QueryUserInfo level %u failed - %s\n",
4730 levels[i], nt_errstr(status));
4731 ret = false;
4732 }
4733 }
4734
4735 return ret;
4736 }
4737
4738 static bool test_QueryUserInfo2(struct dcerpc_pipe *p,
4739 struct torture_context *tctx,
4740 struct policy_handle *handle)
4741 {
4742 NTSTATUS status;
4743 struct samr_QueryUserInfo2 r;
4744 union samr_UserInfo *info;
4745 uint16_t levels[] = {1, 2, 3, 4, 5, 6, 7, 8, 9, 10,
4746 11, 12, 13, 14, 16, 17, 20, 21};
4747 int i;
4748 bool ret = true;
4749
4750 for (i=0;i<ARRAY_SIZE(levels);i++) {
4751 torture_comment(tctx, "Testing QueryUserInfo2 level %u\n", levels[i]);
4752
4753 r.in.user_handle = handle;
4754 r.in.level = levels[i];
4755 r.out.info = &info;
4756
4757 status = dcerpc_samr_QueryUserInfo2(p, tctx, &r);
4758 if (!NT_STATUS_IS_OK(status)) {
4759 torture_warning(tctx, "QueryUserInfo2 level %u failed - %s\n",
4760 levels[i], nt_errstr(status));
4761 ret = false;
4762 }
4763 }
4764
4765 return ret;
4766 }
4767
4768 static bool test_OpenUser(struct dcerpc_pipe *p,
4769 struct torture_context *tctx,
4770 struct policy_handle *handle, uint32_t rid)
4771 {
4772 NTSTATUS status;
4773 struct samr_OpenUser r;
4774 struct policy_handle user_handle;
4775 bool ret = true;
4776
4777 torture_comment(tctx, "Testing OpenUser(%u)\n", rid);
4778
4779 r.in.domain_handle = handle;
4780 r.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
4781 r.in.rid = rid;
4782 r.out.user_handle = &user_handle;
4783
4784 status = dcerpc_samr_OpenUser(p, tctx, &r);
4785 if (!NT_STATUS_IS_OK(status)) {
4786 torture_warning(tctx, "OpenUser(%u) failed - %s\n", rid, nt_errstr(status));
4787 return false;
4788 }
4789
4790 if (!test_QuerySecurity(p, tctx, &user_handle)) {
4791 ret = false;
4792 }
4793
4794 if (!test_QueryUserInfo(p, tctx, &user_handle)) {
4795 ret = false;
4796 }
4797
4798 if (!test_QueryUserInfo2(p, tctx, &user_handle)) {
4799 ret = false;
4800 }
4801
4802 if (!test_GetUserPwInfo(p, tctx, &user_handle)) {
4803 ret = false;
4804 }
4805
4806 if (!test_GetGroupsForUser(p,tctx, &user_handle)) {
4807 ret = false;
4808 }
4809
4810 if (!test_samr_handle_Close(p, tctx, &user_handle)) {
4811 ret = false;
4812 }
4813
4814 return ret;
4815 }
4816
4817 static bool test_OpenGroup(struct dcerpc_pipe *p,
4818 struct torture_context *tctx,
4819 struct policy_handle *handle, uint32_t rid)
4820 {
4821 NTSTATUS status;
4822 struct samr_OpenGroup r;
4823 struct policy_handle group_handle;
4824 bool ret = true;
4825
4826 torture_comment(tctx, "Testing OpenGroup(%u)\n", rid);
4827
4828 r.in.domain_handle = handle;
4829 r.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
4830 r.in.rid = rid;
4831 r.out.group_handle = &group_handle;
4832
4833 status = dcerpc_samr_OpenGroup(p, tctx, &r);
4834 if (!NT_STATUS_IS_OK(status)) {
4835 torture_warning(tctx, "OpenGroup(%u) failed - %s\n", rid, nt_errstr(status));
4836 return false;
4837 }
4838
4839 if (!torture_setting_bool(tctx, "samba3", false)) {
4840 if (!test_QuerySecurity(p, tctx, &group_handle)) {
4841 ret = false;
4842 }
4843 }
4844
4845 if (!test_QueryGroupInfo(p, tctx, &group_handle)) {
4846 ret = false;
4847 }
4848
4849 if (!test_QueryGroupMember(p, tctx, &group_handle)) {
4850 ret = false;
4851 }
4852
4853 if (!test_samr_handle_Close(p, tctx, &group_handle)) {
4854 ret = false;
4855 }
4856
4857 return ret;
4858 }
4859
4860 static bool test_OpenAlias(struct dcerpc_pipe *p, struct torture_context *tctx,
4861 struct policy_handle *handle, uint32_t rid)
4862 {
4863 NTSTATUS status;
4864 struct samr_OpenAlias r;
4865 struct policy_handle alias_handle;
4866 bool ret = true;
4867
4868 torture_comment(tctx, "Testing OpenAlias(%u)\n", rid);
4869
4870 r.in.domain_handle = handle;
4871 r.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
4872 r.in.rid = rid;
4873 r.out.alias_handle = &alias_handle;
4874
4875 status = dcerpc_samr_OpenAlias(p, tctx, &r);
4876 if (!NT_STATUS_IS_OK(status)) {
4877 torture_warning(tctx, "OpenAlias(%u) failed - %s\n", rid, nt_errstr(status));
4878 return false;
4879 }
4880
4881 if (!torture_setting_bool(tctx, "samba3", false)) {
4882 if (!test_QuerySecurity(p, tctx, &alias_handle)) {
4883 ret = false;
4884 }
4885 }
4886
4887 if (!test_QueryAliasInfo(p, tctx, &alias_handle)) {
4888 ret = false;
4889 }
4890
4891 if (!test_GetMembersInAlias(p, tctx, &alias_handle)) {
4892 ret = false;
4893 }
4894
4895 if (!test_samr_handle_Close(p, tctx, &alias_handle)) {
4896 ret = false;
4897 }
4898
4899 return ret;
4900 }
4901
4902 static bool check_mask(struct dcerpc_pipe *p, struct torture_context *tctx,
4903 struct policy_handle *handle, uint32_t rid,
4904 uint32_t acct_flag_mask)
4905 {
4906 NTSTATUS status;
4907 struct samr_OpenUser r;
4908 struct samr_QueryUserInfo q;
4909 union samr_UserInfo *info;
4910 struct policy_handle user_handle;
4911 bool ret = true;
4912
4913 torture_comment(tctx, "Testing OpenUser(%u)\n", rid);
4914
4915 r.in.domain_handle = handle;
4916 r.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
4917 r.in.rid = rid;
4918 r.out.user_handle = &user_handle;
4919
4920 status = dcerpc_samr_OpenUser(p, tctx, &r);
4921 if (!NT_STATUS_IS_OK(status)) {
4922 torture_warning(tctx, "OpenUser(%u) failed - %s\n", rid, nt_errstr(status));
4923 return false;
4924 }
4925
4926 q.in.user_handle = &user_handle;
4927 q.in.level = 16;
4928 q.out.info = &info;
4929
4930 status = dcerpc_samr_QueryUserInfo(p, tctx, &q);
4931 if (!NT_STATUS_IS_OK(status)) {
4932 torture_warning(tctx, "QueryUserInfo level 16 failed - %s\n",
4933 nt_errstr(status));
4934 ret = false;
4935 } else {
4936 if ((acct_flag_mask & info->info16.acct_flags) == 0) {
4937 torture_warning(tctx, "Server failed to filter for 0x%x, allowed 0x%x (%d) on EnumDomainUsers\n",
4938 acct_flag_mask, info->info16.acct_flags, rid);
4939 ret = false;
4940 }
4941 }
4942
4943 if (!test_samr_handle_Close(p, tctx, &user_handle)) {
4944 ret = false;
4945 }
4946
4947 return ret;
4948 }
4949
4950 static bool test_EnumDomainUsers_all(struct dcerpc_pipe *p,
4951 struct torture_context *tctx,
4952 struct policy_handle *handle)
4953 {
4954 NTSTATUS status = STATUS_MORE_ENTRIES;
4955 struct samr_EnumDomainUsers r;
4956 uint32_t mask, resume_handle=0;
4957 int i, mask_idx;
4958 bool ret = true;
4959 struct samr_LookupNames n;
4960 struct samr_LookupRids lr ;
4961 struct lsa_Strings names;
4962 struct samr_Ids rids, types;
4963 struct samr_SamArray *sam = NULL;
4964 uint32_t num_entries = 0;
4965
4966 uint32_t masks[] = {ACB_NORMAL, ACB_DOMTRUST, ACB_WSTRUST,
4967 ACB_DISABLED, ACB_NORMAL | ACB_DISABLED,
4968 ACB_SVRTRUST | ACB_DOMTRUST | ACB_WSTRUST,
4969 ACB_PWNOEXP, 0};
4970
4971 torture_comment(tctx, "Testing EnumDomainUsers\n");
4972
4973 for (mask_idx=0;mask_idx<ARRAY_SIZE(masks);mask_idx++) {
4974 r.in.domain_handle = handle;
4975 r.in.resume_handle = &resume_handle;
4976 r.in.acct_flags = mask = masks[mask_idx];
4977 r.in.max_size = (uint32_t)-1;
4978 r.out.resume_handle = &resume_handle;
4979 r.out.num_entries = &num_entries;
4980 r.out.sam = &sam;
4981
4982 status = dcerpc_samr_EnumDomainUsers(p, tctx, &r);
4983 if (!NT_STATUS_EQUAL(status, STATUS_MORE_ENTRIES) &&
4984 !NT_STATUS_IS_OK(status)) {
4985 torture_warning(tctx, "EnumDomainUsers failed - %s\n", nt_errstr(status));
4986 return false;
4987 }
4988
4989 torture_assert(tctx, sam, "EnumDomainUsers failed: r.out.sam unexpectedly NULL");
4990
4991 if (sam->count == 0) {
4992 continue;
4993 }
4994
4995 for (i=0;i<sam->count;i++) {
4996 if (mask) {
4997 if (!check_mask(p, tctx, handle, sam->entries[i].idx, mask)) {
4998 ret = false;
4999 }
5000 } else if (!test_OpenUser(p, tctx, handle, sam->entries[i].idx)) {
5001 ret = false;
5002 }
5003 }
5004 }
5005
5006 torture_comment(tctx, "Testing LookupNames\n");
5007 n.in.domain_handle = handle;
5008 n.in.num_names = sam->count;
5009 n.in.names = talloc_array(tctx, struct lsa_String, sam->count);
5010 n.out.rids = &rids;
5011 n.out.types = &types;
5012 for (i=0;i<sam->count;i++) {
5013 n.in.names[i].string = sam->entries[i].name.string;
5014 }
5015 status = dcerpc_samr_LookupNames(p, tctx, &n);
5016 if (!NT_STATUS_IS_OK(status)) {
5017 torture_warning(tctx, "LookupNames failed - %s\n", nt_errstr(status));
5018 ret = false;
5019 }
5020
5021
5022 torture_comment(tctx, "Testing LookupRids\n");
5023 lr.in.domain_handle = handle;
5024 lr.in.num_rids = sam->count;
5025 lr.in.rids = talloc_array(tctx, uint32_t, sam->count);
5026 lr.out.names = &names;
5027 lr.out.types = &types;
5028 for (i=0;i<sam->count;i++) {
5029 lr.in.rids[i] = sam->entries[i].idx;
5030 }
5031 status = dcerpc_samr_LookupRids(p, tctx, &lr);
5032 torture_assert_ntstatus_ok(tctx, status, "LookupRids");
5033
5034 return ret;
5035 }
5036
5037 /*
5038 try blasting the server with a bunch of sync requests
5039 */
5040 static bool test_EnumDomainUsers_async(struct dcerpc_pipe *p, struct torture_context *tctx,
5041 struct policy_handle *handle)
5042 {
5043 NTSTATUS status;
5044 struct samr_EnumDomainUsers r;
5045 uint32_t resume_handle=0;
5046 int i;
5047 #define ASYNC_COUNT 100
5048 struct rpc_request *req[ASYNC_COUNT];
5049
5050 if (!torture_setting_bool(tctx, "dangerous", false)) {
5051 torture_skip(tctx, "samr async test disabled - enable dangerous tests to use\n");
5052 }
5053
5054 torture_comment(tctx, "Testing EnumDomainUsers_async\n");
5055
5056 r.in.domain_handle = handle;
5057 r.in.resume_handle = &resume_handle;
5058 r.in.acct_flags = 0;
5059 r.in.max_size = (uint32_t)-1;
5060 r.out.resume_handle = &resume_handle;
5061
5062 for (i=0;i<ASYNC_COUNT;i++) {
5063 req[i] = dcerpc_samr_EnumDomainUsers_send(p, tctx, &r);
5064 }
5065
5066 for (i=0;i<ASYNC_COUNT;i++) {
5067 status = dcerpc_ndr_request_recv(req[i]);
5068 if (!NT_STATUS_IS_OK(status)) {
5069 torture_warning(tctx, "EnumDomainUsers[%d] failed - %s\n",
5070 i, nt_errstr(status));
5071 return false;
5072 }
5073 }
5074
5075 torture_comment(tctx, "%d async requests OK\n", i);
5076
5077 return true;
5078 }
5079
5080 static bool test_EnumDomainGroups_all(struct dcerpc_pipe *p,
5081 struct torture_context *tctx,
5082 struct policy_handle *handle)
5083 {
5084 NTSTATUS status;
5085 struct samr_EnumDomainGroups r;
5086 uint32_t resume_handle=0;
5087 struct samr_SamArray *sam = NULL;
5088 uint32_t num_entries = 0;
5089 int i;
5090 bool ret = true;
5091
5092 torture_comment(tctx, "Testing EnumDomainGroups\n");
5093
5094 r.in.domain_handle = handle;
5095 r.in.resume_handle = &resume_handle;
5096 r.in.max_size = (uint32_t)-1;
5097 r.out.resume_handle = &resume_handle;
5098 r.out.num_entries = &num_entries;
5099 r.out.sam = &sam;
5100
5101 status = dcerpc_samr_EnumDomainGroups(p, tctx, &r);
5102 if (!NT_STATUS_IS_OK(status)) {
5103 torture_warning(tctx, "EnumDomainGroups failed - %s\n", nt_errstr(status));
5104 return false;
5105 }
5106
5107 if (!sam) {
5108 return false;
5109 }
5110
5111 for (i=0;i<sam->count;i++) {
5112 if (!test_OpenGroup(p, tctx, handle, sam->entries[i].idx)) {
5113 ret = false;
5114 }
5115 }
5116
5117 return ret;
5118 }
5119
5120 static bool test_EnumDomainAliases_all(struct dcerpc_pipe *p,
5121 struct torture_context *tctx,
5122 struct policy_handle *handle)
5123 {
5124 NTSTATUS status;
5125 struct samr_EnumDomainAliases r;
5126 uint32_t resume_handle=0;
5127 struct samr_SamArray *sam = NULL;
5128 uint32_t num_entries = 0;
5129 int i;
5130 bool ret = true;
5131
5132 torture_comment(tctx, "Testing EnumDomainAliases\n");
5133
5134 r.in.domain_handle = handle;
5135 r.in.resume_handle = &resume_handle;
5136 r.in.max_size = (uint32_t)-1;
5137 r.out.sam = &sam;
5138 r.out.num_entries = &num_entries;
5139 r.out.resume_handle = &resume_handle;
5140
5141 status = dcerpc_samr_EnumDomainAliases(p, tctx, &r);
5142 if (!NT_STATUS_IS_OK(status)) {
5143 torture_warning(tctx, "EnumDomainAliases failed - %s\n", nt_errstr(status));
5144 return false;
5145 }
5146
5147 if (!sam) {
5148 return false;
5149 }
5150
5151 for (i=0;i<sam->count;i++) {
5152 if (!test_OpenAlias(p, tctx, handle, sam->entries[i].idx)) {
5153 ret = false;
5154 }
5155 }
5156
5157 return ret;
5158 }
5159
5160 static bool test_GetDisplayEnumerationIndex(struct dcerpc_pipe *p,
5161 struct torture_context *tctx,
5162 struct policy_handle *handle)
5163 {
5164 NTSTATUS status;
5165 struct samr_GetDisplayEnumerationIndex r;
5166 bool ret = true;
5167 uint16_t levels[] = {1, 2, 3, 4, 5};
5168 uint16_t ok_lvl[] = {1, 1, 1, 0, 0};
5169 struct lsa_String name;
5170 uint32_t idx = 0;
5171 int i;
5172
5173 for (i=0;i<ARRAY_SIZE(levels);i++) {
5174 torture_comment(tctx, "Testing GetDisplayEnumerationIndex level %u\n", levels[i]);
5175
5176 init_lsa_String(&name, TEST_ACCOUNT_NAME);
5177
5178 r.in.domain_handle = handle;
5179 r.in.level = levels[i];
5180 r.in.name = &name;
5181 r.out.idx = &idx;
5182
5183 status = dcerpc_samr_GetDisplayEnumerationIndex(p, tctx, &r);
5184
5185 if (ok_lvl[i] &&
5186 !NT_STATUS_IS_OK(status) &&
5187 !NT_STATUS_EQUAL(NT_STATUS_NO_MORE_ENTRIES, status)) {
5188 torture_warning(tctx, "GetDisplayEnumerationIndex level %u failed - %s\n",
5189 levels[i], nt_errstr(status));
5190 ret = false;
5191 }
5192
5193 init_lsa_String(&name, "zzzzzzzz");
5194
5195 status = dcerpc_samr_GetDisplayEnumerationIndex(p, tctx, &r);
5196
5197 if (ok_lvl[i] && !NT_STATUS_EQUAL(NT_STATUS_NO_MORE_ENTRIES, status)) {
5198 torture_warning(tctx, "GetDisplayEnumerationIndex level %u failed - %s\n",
5199 levels[i], nt_errstr(status));
5200 ret = false;
5201 }
5202 }
5203
5204 return ret;
5205 }
5206
5207 static bool test_GetDisplayEnumerationIndex2(struct dcerpc_pipe *p,
5208 struct torture_context *tctx,
5209 struct policy_handle *handle)
5210 {
5211 NTSTATUS status;
5212 struct samr_GetDisplayEnumerationIndex2 r;
5213 bool ret = true;
5214 uint16_t levels[] = {1, 2, 3, 4, 5};
5215 uint16_t ok_lvl[] = {1, 1, 1, 0, 0};
5216 struct lsa_String name;
5217 uint32_t idx = 0;
5218 int i;
5219
5220 for (i=0;i<ARRAY_SIZE(levels);i++) {
5221 torture_comment(tctx, "Testing GetDisplayEnumerationIndex2 level %u\n", levels[i]);
5222
5223 init_lsa_String(&name, TEST_ACCOUNT_NAME);
5224
5225 r.in.domain_handle = handle;
5226 r.in.level = levels[i];
5227 r.in.name = &name;
5228 r.out.idx = &idx;
5229
5230 status = dcerpc_samr_GetDisplayEnumerationIndex2(p, tctx, &r);
5231 if (ok_lvl[i] &&
5232 !NT_STATUS_IS_OK(status) &&
5233 !NT_STATUS_EQUAL(NT_STATUS_NO_MORE_ENTRIES, status)) {
5234 torture_warning(tctx, "GetDisplayEnumerationIndex2 level %u failed - %s\n",
5235 levels[i], nt_errstr(status));
5236 ret = false;
5237 }
5238
5239 init_lsa_String(&name, "zzzzzzzz");
5240
5241 status = dcerpc_samr_GetDisplayEnumerationIndex2(p, tctx, &r);
5242 if (ok_lvl[i] && !NT_STATUS_EQUAL(NT_STATUS_NO_MORE_ENTRIES, status)) {
5243 torture_warning(tctx, "GetDisplayEnumerationIndex2 level %u failed - %s\n",
5244 levels[i], nt_errstr(status));
5245 ret = false;
5246 }
5247 }
5248
5249 return ret;
5250 }
5251
5252 #define STRING_EQUAL_QUERY(s1, s2, user) \
5253 if (s1.string == NULL && s2.string != NULL && s2.string[0] == '\0') { \
5254 /* odd, but valid */ \
5255 } else if ((s1.string && !s2.string) || (s2.string && !s1.string) || strcmp(s1.string, s2.string)) { \
5256 torture_warning(tctx, "%s mismatch for %s: %s != %s (%s)\n", \
5257 #s1, user.string, s1.string, s2.string, __location__); \
5258 ret = false; \
5259 }
5260 #define INT_EQUAL_QUERY(s1, s2, user) \
5261 if (s1 != s2) { \
5262 torture_warning(tctx, "%s mismatch for %s: 0x%llx != 0x%llx (%s)\n", \
5263 #s1, user.string, (unsigned long long)s1, (unsigned long long)s2, __location__); \
5264 ret = false; \
5265 }
5266
5267 static bool test_each_DisplayInfo_user(struct dcerpc_pipe *p,
5268 struct torture_context *tctx,
5269 struct samr_QueryDisplayInfo *querydisplayinfo,
5270 bool *seen_testuser)
5271 {
5272 struct samr_OpenUser r;
5273 struct samr_QueryUserInfo q;
5274 union samr_UserInfo *info;
5275 struct policy_handle user_handle;
5276 int i, ret = true;
5277 NTSTATUS status;
5278 r.in.domain_handle = querydisplayinfo->in.domain_handle;
5279 r.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
5280 for (i = 0; ; i++) {
5281 switch (querydisplayinfo->in.level) {
5282 case 1:
5283 if (i >= querydisplayinfo->out.info->info1.count) {
5284 return ret;
5285 }
5286 r.in.rid = querydisplayinfo->out.info->info1.entries[i].rid;
5287 break;
5288 case 2:
5289 if (i >= querydisplayinfo->out.info->info2.count) {
5290 return ret;
5291 }
5292 r.in.rid = querydisplayinfo->out.info->info2.entries[i].rid;
5293 break;
5294 case 3:
5295 /* Groups */
5296 case 4:
5297 case 5:
5298 /* Not interested in validating just the account name */
5299 return true;
5300 }
5301
5302 r.out.user_handle = &user_handle;
5303
5304 switch (querydisplayinfo->in.level) {
5305 case 1:
5306 case 2:
5307 status = dcerpc_samr_OpenUser(p, tctx, &r);
5308 if (!NT_STATUS_IS_OK(status)) {
5309 torture_warning(tctx, "OpenUser(%u) failed - %s\n", r.in.rid, nt_errstr(status));
5310 return false;
5311 }
5312 }
5313
5314 q.in.user_handle = &user_handle;
5315 q.in.level = 21;
5316 q.out.info = &info;
5317 status = dcerpc_samr_QueryUserInfo(p, tctx, &q);
5318 if (!NT_STATUS_IS_OK(status)) {
5319 torture_warning(tctx, "QueryUserInfo(%u) failed - %s\n", r.in.rid, nt_errstr(status));
5320 return false;
5321 }
5322
5323 switch (querydisplayinfo->in.level) {
5324 case 1:
5325 if (seen_testuser && strcmp(info->info21.account_name.string, TEST_ACCOUNT_NAME) == 0) {
5326 *seen_testuser = true;
5327 }
5328 STRING_EQUAL_QUERY(querydisplayinfo->out.info->info1.entries[i].full_name,
5329 info->info21.full_name, info->info21.account_name);
5330 STRING_EQUAL_QUERY(querydisplayinfo->out.info->info1.entries[i].account_name,
5331 info->info21.account_name, info->info21.account_name);
5332 STRING_EQUAL_QUERY(querydisplayinfo->out.info->info1.entries[i].description,
5333 info->info21.description, info->info21.account_name);
5334 INT_EQUAL_QUERY(querydisplayinfo->out.info->info1.entries[i].rid,
5335 info->info21.rid, info->info21.account_name);
5336 INT_EQUAL_QUERY(querydisplayinfo->out.info->info1.entries[i].acct_flags,
5337 info->info21.acct_flags, info->info21.account_name);
5338
5339 break;
5340 case 2:
5341 STRING_EQUAL_QUERY(querydisplayinfo->out.info->info2.entries[i].account_name,
5342 info->info21.account_name, info->info21.account_name);
5343 STRING_EQUAL_QUERY(querydisplayinfo->out.info->info2.entries[i].description,
5344 info->info21.description, info->info21.account_name);
5345 INT_EQUAL_QUERY(querydisplayinfo->out.info->info2.entries[i].rid,
5346 info->info21.rid, info->info21.account_name);
5347 INT_EQUAL_QUERY((querydisplayinfo->out.info->info2.entries[i].acct_flags & ~ACB_NORMAL),
5348 info->info21.acct_flags, info->info21.account_name);
5349
5350 if (!(querydisplayinfo->out.info->info2.entries[i].acct_flags & ACB_NORMAL)) {
5351 torture_warning(tctx, "Missing ACB_NORMAL in querydisplayinfo->out.info.info2.entries[i].acct_flags on %s\n",
5352 info->info21.account_name.string);
5353 }
5354
5355 if (!(info->info21.acct_flags & (ACB_WSTRUST | ACB_SVRTRUST))) {
5356 torture_warning(tctx, "Found non-trust account %s in trust account listing: 0x%x 0x%x\n",
5357 info->info21.account_name.string,
5358 querydisplayinfo->out.info->info2.entries[i].acct_flags,
5359 info->info21.acct_flags);
5360 return false;
5361 }
5362
5363 break;
5364 }
5365
5366 if (!test_samr_handle_Close(p, tctx, &user_handle)) {
5367 return false;
5368 }
5369 }
5370 return ret;
5371 }
5372
5373 static bool test_QueryDisplayInfo(struct dcerpc_pipe *p,
5374 struct torture_context *tctx,
5375 struct policy_handle *handle)
5376 {
5377 NTSTATUS status;
5378 struct samr_QueryDisplayInfo r;
5379 struct samr_QueryDomainInfo dom_info;
5380 union samr_DomainInfo *info = NULL;
5381 bool ret = true;
5382 uint16_t levels[] = {1, 2, 3, 4, 5};
5383 int i;
5384 bool seen_testuser = false;
5385 uint32_t total_size;
5386 uint32_t returned_size;
5387 union samr_DispInfo disp_info;
5388
5389
5390 for (i=0;i<ARRAY_SIZE(levels);i++) {
5391 torture_comment(tctx, "Testing QueryDisplayInfo level %u\n", levels[i]);
5392
5393 r.in.start_idx = 0;
5394 status = STATUS_MORE_ENTRIES;
5395 while (NT_STATUS_EQUAL(status, STATUS_MORE_ENTRIES)) {
5396 r.in.domain_handle = handle;
5397 r.in.level = levels[i];
5398 r.in.max_entries = 2;
5399 r.in.buf_size = (uint32_t)-1;
5400 r.out.total_size = &total_size;
5401 r.out.returned_size = &returned_size;
5402 r.out.info = &disp_info;
5403
5404 status = dcerpc_samr_QueryDisplayInfo(p, tctx, &r);
5405 if (!NT_STATUS_EQUAL(status, STATUS_MORE_ENTRIES) && !NT_STATUS_IS_OK(status)) {
5406 torture_warning(tctx, "QueryDisplayInfo level %u failed - %s\n",
5407 levels[i], nt_errstr(status));
5408 ret = false;
5409 }
5410 switch (r.in.level) {
5411 case 1:
5412 if (!test_each_DisplayInfo_user(p, tctx, &r, &seen_testuser)) {
5413 ret = false;
5414 }
5415 r.in.start_idx += r.out.info->info1.count;
5416 break;
5417 case 2:
5418 if (!test_each_DisplayInfo_user(p, tctx, &r, NULL)) {
5419 ret = false;
5420 }
5421 r.in.start_idx += r.out.info->info2.count;
5422 break;
5423 case 3:
5424 r.in.start_idx += r.out.info->info3.count;
5425 break;
5426 case 4:
5427 r.in.start_idx += r.out.info->info4.count;
5428 break;
5429 case 5:
5430 r.in.start_idx += r.out.info->info5.count;
5431 break;
5432 }
5433 }
5434 dom_info.in.domain_handle = handle;
5435 dom_info.in.level = 2;
5436 dom_info.out.info = &info;
5437
5438 /* Check number of users returned is correct */
5439 status = dcerpc_samr_QueryDomainInfo(p, tctx, &dom_info);
5440 if (!NT_STATUS_IS_OK(status)) {
5441 torture_warning(tctx, "QueryDomainInfo level %u failed - %s\n",
5442 r.in.level, nt_errstr(status));
5443 ret = false;
5444 break;
5445 }
5446 switch (r.in.level) {
5447 case 1:
5448 case 4:
5449 if (info->general.num_users < r.in.start_idx) {
5450 torture_warning(tctx, "QueryDomainInfo indicates that QueryDisplayInfo returned more users (%d/%d) than the domain %s is said to contain!\n",
5451 r.in.start_idx, info->general.num_groups,
5452 info->general.domain_name.string);
5453 ret = false;
5454 }
5455 if (!seen_testuser) {
5456 struct policy_handle user_handle;
5457 if (NT_STATUS_IS_OK(test_OpenUser_byname(p, tctx, handle, TEST_ACCOUNT_NAME, &user_handle))) {
5458 torture_warning(tctx, "Didn't find test user " TEST_ACCOUNT_NAME " in enumeration of %s\n",
5459 info->general.domain_name.string);
5460 ret = false;
5461 test_samr_handle_Close(p, tctx, &user_handle);
5462 }
5463 }
5464 break;
5465 case 3:
5466 case 5:
5467 if (info->general.num_groups != r.in.start_idx) {
5468 torture_warning(tctx, "QueryDomainInfo indicates that QueryDisplayInfo didn't return all (%d/%d) the groups in %s\n",
5469 r.in.start_idx, info->general.num_groups,
5470 info->general.domain_name.string);
5471 ret = false;
5472 }
5473
5474 break;
5475 }
5476
5477 }
5478
5479 return ret;
5480 }
5481
5482 static bool test_QueryDisplayInfo2(struct dcerpc_pipe *p,
5483 struct torture_context *tctx,
5484 struct policy_handle *handle)
5485 {
5486 NTSTATUS status;
5487 struct samr_QueryDisplayInfo2 r;
5488 bool ret = true;
5489 uint16_t levels[] = {1, 2, 3, 4, 5};
5490 int i;
5491 uint32_t total_size;
5492 uint32_t returned_size;
5493 union samr_DispInfo info;
5494
5495 for (i=0;i<ARRAY_SIZE(levels);i++) {
5496 torture_comment(tctx, "Testing QueryDisplayInfo2 level %u\n", levels[i]);
5497
5498 r.in.domain_handle = handle;
5499 r.in.level = levels[i];
5500 r.in.start_idx = 0;
5501 r.in.max_entries = 1000;
5502 r.in.buf_size = (uint32_t)-1;
5503 r.out.total_size = &total_size;
5504 r.out.returned_size = &returned_size;
5505 r.out.info = &info;
5506
5507 status = dcerpc_samr_QueryDisplayInfo2(p, tctx, &r);
5508 if (!NT_STATUS_IS_OK(status)) {
5509 torture_warning(tctx, "QueryDisplayInfo2 level %u failed - %s\n",
5510 levels[i], nt_errstr(status));
5511 ret = false;
5512 }
5513 }
5514
5515 return ret;
5516 }
5517
5518 static bool test_QueryDisplayInfo3(struct dcerpc_pipe *p, struct torture_context *tctx,
5519 struct policy_handle *handle)
5520 {
5521 NTSTATUS status;
5522 struct samr_QueryDisplayInfo3 r;
5523 bool ret = true;
5524 uint16_t levels[] = {1, 2, 3, 4, 5};
5525 int i;
5526 uint32_t total_size;
5527 uint32_t returned_size;
5528 union samr_DispInfo info;
5529
5530 for (i=0;i<ARRAY_SIZE(levels);i++) {
5531 torture_comment(tctx, "Testing QueryDisplayInfo3 level %u\n", levels[i]);
5532
5533 r.in.domain_handle = handle;
5534 r.in.level = levels[i];
5535 r.in.start_idx = 0;
5536 r.in.max_entries = 1000;
5537 r.in.buf_size = (uint32_t)-1;
5538 r.out.total_size = &total_size;
5539 r.out.returned_size = &returned_size;
5540 r.out.info = &info;
5541
5542 status = dcerpc_samr_QueryDisplayInfo3(p, tctx, &r);
5543 if (!NT_STATUS_IS_OK(status)) {
5544 torture_warning(tctx, "QueryDisplayInfo3 level %u failed - %s\n",
5545 levels[i], nt_errstr(status));
5546 ret = false;
5547 }
5548 }
5549
5550 return ret;
5551 }
5552
5553
5554 static bool test_QueryDisplayInfo_continue(struct dcerpc_pipe *p,
5555 struct torture_context *tctx,
5556 struct policy_handle *handle)
5557 {
5558 NTSTATUS status;
5559 struct samr_QueryDisplayInfo r;
5560 bool ret = true;
5561 uint32_t total_size;
5562 uint32_t returned_size;
5563 union samr_DispInfo info;
5564
5565 torture_comment(tctx, "Testing QueryDisplayInfo continuation\n");
5566
5567 r.in.domain_handle = handle;
5568 r.in.level = 1;
5569 r.in.start_idx = 0;
5570 r.in.max_entries = 1;
5571 r.in.buf_size = (uint32_t)-1;
5572 r.out.total_size = &total_size;
5573 r.out.returned_size = &returned_size;
5574 r.out.info = &info;
5575
5576 do {
5577 status = dcerpc_samr_QueryDisplayInfo(p, tctx, &r);
5578 if (NT_STATUS_IS_OK(status) && *r.out.returned_size != 0) {
5579 if (r.out.info->info1.entries[0].idx != r.in.start_idx + 1) {
5580 torture_warning(tctx, "expected idx %d but got %d\n",
5581 r.in.start_idx + 1,
5582 r.out.info->info1.entries[0].idx);
5583 break;
5584 }
5585 }
5586 if (!NT_STATUS_EQUAL(status, STATUS_MORE_ENTRIES) &&
5587 !NT_STATUS_IS_OK(status)) {
5588 torture_warning(tctx, "QueryDisplayInfo level %u failed - %s\n",
5589 r.in.level, nt_errstr(status));
5590 ret = false;
5591 break;
5592 }
5593 r.in.start_idx++;
5594 } while ((NT_STATUS_EQUAL(status, STATUS_MORE_ENTRIES) ||
5595 NT_STATUS_IS_OK(status)) &&
5596 *r.out.returned_size != 0);
5597
5598 return ret;
5599 }
5600
5601 static bool test_QueryDomainInfo(struct dcerpc_pipe *p, struct torture_context *tctx,
5602 struct policy_handle *handle)
5603 {
5604 NTSTATUS status;
5605 struct samr_QueryDomainInfo r;
5606 union samr_DomainInfo *info = NULL;
5607 struct samr_SetDomainInfo s;
5608 uint16_t levels[] = {1, 2, 3, 4, 5, 6, 7, 8, 9, 11, 12, 13};
5609 uint16_t set_ok[] = {1, 0, 1, 1, 0, 1, 1, 0, 1, 0, 1, 0};
5610 int i;
5611 bool ret = true;
5612 const char *domain_comment = talloc_asprintf(tctx,
5613 "Tortured by Samba4 RPC-SAMR: %s",
5614 timestring(tctx, time(NULL)));
5615
5616 s.in.domain_handle = handle;
5617 s.in.level = 4;
5618 s.in.info = talloc(tctx, union samr_DomainInfo);
5619
5620 s.in.info->oem.oem_information.string = domain_comment;
5621 status = dcerpc_samr_SetDomainInfo(p, tctx, &s);
5622 if (!NT_STATUS_IS_OK(status)) {
5623 torture_warning(tctx, "SetDomainInfo level %u (set comment) failed - %s\n",
5624 s.in.level, nt_errstr(status));
5625 return false;
5626 }
5627
5628 for (i=0;i<ARRAY_SIZE(levels);i++) {
5629 torture_comment(tctx, "Testing QueryDomainInfo level %u\n", levels[i]);
5630
5631 r.in.domain_handle = handle;
5632 r.in.level = levels[i];
5633 r.out.info = &info;
5634
5635 status = dcerpc_samr_QueryDomainInfo(p, tctx, &r);
5636 if (!NT_STATUS_IS_OK(status)) {
5637 torture_warning(tctx, "QueryDomainInfo level %u failed - %s\n",
5638 r.in.level, nt_errstr(status));
5639 ret = false;
5640 continue;
5641 }
5642
5643 switch (levels[i]) {
5644 case 2:
5645 if (strcmp(info->general.oem_information.string, domain_comment) != 0) {
5646 torture_warning(tctx, "QueryDomainInfo level %u returned different oem_information (comment) (%s, expected %s)\n",
5647 levels[i], info->general.oem_information.string, domain_comment);
5648 if (!torture_setting_bool(tctx, "samba3", false)) {
5649 ret = false;
5650 }
5651 }
5652 if (!info->general.primary.string) {
5653 torture_warning(tctx, "QueryDomainInfo level %u returned no PDC name\n",
5654 levels[i]);
5655 ret = false;
5656 } else if (info->general.role == SAMR_ROLE_DOMAIN_PDC) {
5657 if (dcerpc_server_name(p) && strcasecmp_m(dcerpc_server_name(p), info->general.primary.string) != 0) {
5658 torture_warning(tctx, "QueryDomainInfo level %u returned different PDC name (%s) compared to server name (%s), despite claiming to be the PDC\n",
5659 levels[i], info->general.primary.string, dcerpc_server_name(p));
5660 }
5661 }
5662 break;
5663 case 4:
5664 if (strcmp(info->oem.oem_information.string, domain_comment) != 0) {
5665 torture_warning(tctx, "QueryDomainInfo level %u returned different oem_information (comment) (%s, expected %s)\n",
5666 levels[i], info->oem.oem_information.string, domain_comment);
5667 if (!torture_setting_bool(tctx, "samba3", false)) {
5668 ret = false;
5669 }
5670 }
5671 break;
5672 case 6:
5673 if (!info->info6.primary.string) {
5674 torture_warning(tctx, "QueryDomainInfo level %u returned no PDC name\n",
5675 levels[i]);
5676 ret = false;
5677 }
5678 break;
5679 case 11:
5680 if (strcmp(info->general2.general.oem_information.string, domain_comment) != 0) {
5681 torture_warning(tctx, "QueryDomainInfo level %u returned different comment (%s, expected %s)\n",
5682 levels[i], info->general2.general.oem_information.string, domain_comment);
5683 if (!torture_setting_bool(tctx, "samba3", false)) {
5684 ret = false;
5685 }
5686 }
5687 break;
5688 }
5689
5690 torture_comment(tctx, "Testing SetDomainInfo level %u\n", levels[i]);
5691
5692 s.in.domain_handle = handle;
5693 s.in.level = levels[i];
5694 s.in.info = info;
5695
5696 status = dcerpc_samr_SetDomainInfo(p, tctx, &s);
5697 if (set_ok[i]) {
5698 if (!NT_STATUS_IS_OK(status)) {
5699 torture_warning(tctx, "SetDomainInfo level %u failed - %s\n",
5700 r.in.level, nt_errstr(status));
5701 ret = false;
5702 continue;
5703 }
5704 } else {
5705 if (!NT_STATUS_EQUAL(NT_STATUS_INVALID_INFO_CLASS, status)) {
5706 torture_warning(tctx, "SetDomainInfo level %u gave %s - should have been NT_STATUS_INVALID_INFO_CLASS\n",
5707 r.in.level, nt_errstr(status));
5708 ret = false;
5709 continue;
5710 }
5711 }
5712
5713 status = dcerpc_samr_QueryDomainInfo(p, tctx, &r);
5714 if (!NT_STATUS_IS_OK(status)) {
5715 torture_warning(tctx, "QueryDomainInfo level %u failed - %s\n",
5716 r.in.level, nt_errstr(status));
5717 ret = false;
5718 continue;
5719 }
5720 }
5721
5722 return ret;
5723 }
5724
5725
5726 static bool test_QueryDomainInfo2(struct dcerpc_pipe *p, struct torture_context *tctx,
5727 struct policy_handle *handle)
5728 {
5729 NTSTATUS status;
5730 struct samr_QueryDomainInfo2 r;
5731 union samr_DomainInfo *info = NULL;
5732 uint16_t levels[] = {1, 2, 3, 4, 5, 6, 7, 8, 9, 11, 12, 13};
5733 int i;
5734 bool ret = true;
5735
5736 for (i=0;i<ARRAY_SIZE(levels);i++) {
5737 torture_comment(tctx, "Testing QueryDomainInfo2 level %u\n", levels[i]);
5738
5739 r.in.domain_handle = handle;
5740 r.in.level = levels[i];
5741 r.out.info = &info;
5742
5743 status = dcerpc_samr_QueryDomainInfo2(p, tctx, &r);
5744 if (!NT_STATUS_IS_OK(status)) {
5745 torture_warning(tctx, "QueryDomainInfo2 level %u failed - %s\n",
5746 r.in.level, nt_errstr(status));
5747 ret = false;
5748 continue;
5749 }
5750 }
5751
5752 return true;
5753 }
5754
5755 /* Test whether querydispinfo level 5 and enumdomgroups return the same
5756 set of group names. */
5757 static bool test_GroupList(struct dcerpc_pipe *p, struct torture_context *tctx,
5758 struct policy_handle *handle)
5759 {
5760 struct samr_EnumDomainGroups q1;
5761 struct samr_QueryDisplayInfo q2;
5762 NTSTATUS status;
5763 uint32_t resume_handle=0;
5764 struct samr_SamArray *sam = NULL;
5765 uint32_t num_entries = 0;
5766 int i;
5767 bool ret = true;
5768 uint32_t total_size;
5769 uint32_t returned_size;
5770 union samr_DispInfo info;
5771
5772 int num_names = 0;
5773 const char **names = NULL;
5774
5775 torture_comment(tctx, "Testing coherency of querydispinfo vs enumdomgroups\n");
5776
5777 q1.in.domain_handle = handle;
5778 q1.in.resume_handle = &resume_handle;
5779 q1.in.max_size = 5;
5780 q1.out.resume_handle = &resume_handle;
5781 q1.out.num_entries = &num_entries;
5782 q1.out.sam = &sam;
5783
5784 status = STATUS_MORE_ENTRIES;
5785 while (NT_STATUS_EQUAL(status, STATUS_MORE_ENTRIES)) {
5786 status = dcerpc_samr_EnumDomainGroups(p, tctx, &q1);
5787
5788 if (!NT_STATUS_IS_OK(status) &&
5789 !NT_STATUS_EQUAL(status, STATUS_MORE_ENTRIES))
5790 break;
5791
5792 for (i=0; i<*q1.out.num_entries; i++) {
5793 add_string_to_array(tctx,
5794 sam->entries[i].name.string,
5795 &names, &num_names);
5796 }
5797 }
5798
5799 torture_assert_ntstatus_ok(tctx, status, "EnumDomainGroups");
5800
5801 torture_assert(tctx, sam, "EnumDomainGroups failed to return sam");
5802
5803 q2.in.domain_handle = handle;
5804 q2.in.level = 5;
5805 q2.in.start_idx = 0;
5806 q2.in.max_entries = 5;
5807 q2.in.buf_size = (uint32_t)-1;
5808 q2.out.total_size = &total_size;
5809 q2.out.returned_size = &returned_size;
5810 q2.out.info = &info;
5811
5812 status = STATUS_MORE_ENTRIES;
5813 while (NT_STATUS_EQUAL(status, STATUS_MORE_ENTRIES)) {
5814 status = dcerpc_samr_QueryDisplayInfo(p, tctx, &q2);
5815
5816 if (!NT_STATUS_IS_OK(status) &&
5817 !NT_STATUS_EQUAL(status, STATUS_MORE_ENTRIES))
5818 break;
5819
5820 for (i=0; i<q2.out.info->info5.count; i++) {
5821 int j;
5822 const char *name = q2.out.info->info5.entries[i].account_name.string;
5823 bool found = false;
5824 for (j=0; j<num_names; j++) {
5825 if (names[j] == NULL)
5826 continue;
5827 if (strequal(names[j], name)) {
5828 names[j] = NULL;
5829 found = true;
5830 break;
5831 }
5832 }
5833
5834 if (!found) {
5835 torture_warning(tctx, "QueryDisplayInfo gave name [%s] that EnumDomainGroups did not\n",
5836 name);
5837 ret = false;
5838 }
5839 }
5840 q2.in.start_idx += q2.out.info->info5.count;
5841 }
5842
5843 if (!NT_STATUS_IS_OK(status)) {
5844 torture_warning(tctx, "QueryDisplayInfo level 5 failed - %s\n",
5845 nt_errstr(status));
5846 ret = false;
5847 }
5848
5849 for (i=0; i<num_names; i++) {
5850 if (names[i] != NULL) {
5851 torture_warning(tctx, "EnumDomainGroups gave name [%s] that QueryDisplayInfo did not\n",
5852 names[i]);
5853 ret = false;
5854 }
5855 }
5856
5857 return ret;
5858 }
5859
5860 static bool test_DeleteDomainGroup(struct dcerpc_pipe *p, struct torture_context *tctx,
5861 struct policy_handle *group_handle)
5862 {
5863 struct samr_DeleteDomainGroup d;
5864 NTSTATUS status;
5865
5866 torture_comment(tctx, "Testing DeleteDomainGroup\n");
5867
5868 d.in.group_handle = group_handle;
5869 d.out.group_handle = group_handle;
5870
5871 status = dcerpc_samr_DeleteDomainGroup(p, tctx, &d);
5872 torture_assert_ntstatus_ok(tctx, status, "DeleteDomainGroup");
5873
5874 return true;
5875 }
5876
5877 static bool test_TestPrivateFunctionsDomain(struct dcerpc_pipe *p, struct torture_context *tctx,
5878 struct policy_handle *domain_handle)
5879 {
5880 struct samr_TestPrivateFunctionsDomain r;
5881 NTSTATUS status;
5882 bool ret = true;
5883
5884 torture_comment(tctx, "Testing TestPrivateFunctionsDomain\n");
5885
5886 r.in.domain_handle = domain_handle;
5887
5888 status = dcerpc_samr_TestPrivateFunctionsDomain(p, tctx, &r);
5889 torture_assert_ntstatus_equal(tctx, status, NT_STATUS_NOT_IMPLEMENTED, "TestPrivateFunctionsDomain");
5890
5891 return ret;
5892 }
5893
5894 static bool test_RidToSid(struct dcerpc_pipe *p, struct torture_context *tctx,
5895 struct dom_sid *domain_sid,
5896 struct policy_handle *domain_handle)
5897 {
5898 struct samr_RidToSid r;
5899 NTSTATUS status;
5900 bool ret = true;
5901 struct dom_sid *calc_sid, *out_sid;
5902 int rids[] = { 0, 42, 512, 10200 };
5903 int i;
5904
5905 for (i=0;i<ARRAY_SIZE(rids);i++) {
5906 torture_comment(tctx, "Testing RidToSid\n");
5907
5908 calc_sid = dom_sid_dup(tctx, domain_sid);
5909 r.in.domain_handle = domain_handle;
5910 r.in.rid = rids[i];
5911 r.out.sid = &out_sid;
5912
5913 status = dcerpc_samr_RidToSid(p, tctx, &r);
5914 if (!NT_STATUS_IS_OK(status)) {
5915 torture_warning(tctx, "RidToSid for %d failed - %s\n", rids[i], nt_errstr(status));
5916 ret = false;
5917 } else {
5918 calc_sid = dom_sid_add_rid(calc_sid, calc_sid, rids[i]);
5919
5920 if (!dom_sid_equal(calc_sid, out_sid)) {
5921 torture_warning(tctx, "RidToSid for %d failed - got %s, expected %s\n", rids[i],
5922 dom_sid_string(tctx, out_sid),
5923 dom_sid_string(tctx, calc_sid));
5924 ret = false;
5925 }
5926 }
5927 }
5928
5929 return ret;
5930 }
5931
5932 static bool test_GetBootKeyInformation(struct dcerpc_pipe *p, struct torture_context *tctx,
5933 struct policy_handle *domain_handle)
5934 {
5935 struct samr_GetBootKeyInformation r;
5936 NTSTATUS status;
5937 bool ret = true;
5938 uint32_t unknown = 0;
5939
5940 torture_comment(tctx, "Testing GetBootKeyInformation\n");
5941
5942 r.in.domain_handle = domain_handle;
5943 r.out.unknown = &unknown;
5944
5945 status = dcerpc_samr_GetBootKeyInformation(p, tctx, &r);
5946 if (!NT_STATUS_IS_OK(status)) {
5947 /* w2k3 seems to fail this sometimes and pass it sometimes */
5948 torture_comment(tctx, "GetBootKeyInformation (ignored) - %s\n", nt_errstr(status));
5949 }
5950
5951 return ret;
5952 }
5953
5954 static bool test_AddGroupMember(struct dcerpc_pipe *p, struct torture_context *tctx,
5955 struct policy_handle *domain_handle,
5956 struct policy_handle *group_handle)
5957 {
5958 NTSTATUS status;
5959 struct samr_AddGroupMember r;
5960 struct samr_DeleteGroupMember d;
5961 struct samr_QueryGroupMember q;
5962 struct samr_RidTypeArray *rids = NULL;
5963 struct samr_SetMemberAttributesOfGroup s;
5964 uint32_t rid;
5965 bool found_member = false;
5966 int i;
5967
5968 status = test_LookupName(p, tctx, domain_handle, TEST_ACCOUNT_NAME, &rid);
5969 torture_assert_ntstatus_ok(tctx, status, "test_AddGroupMember looking up name " TEST_ACCOUNT_NAME);
5970
5971 r.in.group_handle = group_handle;
5972 r.in.rid = rid;
5973 r.in.flags = 0; /* ??? */
5974
5975 torture_comment(tctx, "Testing AddGroupMember, QueryGroupMember and DeleteGroupMember\n");
5976
5977 d.in.group_handle = group_handle;
5978 d.in.rid = rid;
5979
5980 status = dcerpc_samr_DeleteGroupMember(p, tctx, &d);
5981 torture_assert_ntstatus_equal(tctx, NT_STATUS_MEMBER_NOT_IN_GROUP, status, "DeleteGroupMember");
5982
5983 status = dcerpc_samr_AddGroupMember(p, tctx, &r);
5984 torture_assert_ntstatus_ok(tctx, status, "AddGroupMember");
5985
5986 status = dcerpc_samr_AddGroupMember(p, tctx, &r);
5987 torture_assert_ntstatus_equal(tctx, NT_STATUS_MEMBER_IN_GROUP, status, "AddGroupMember");
5988
5989 if (torture_setting_bool(tctx, "samba4", false) ||
5990 torture_setting_bool(tctx, "samba3", false)) {
5991 torture_comment(tctx, "skipping SetMemberAttributesOfGroup test against Samba\n");
5992 } else {
5993 /* this one is quite strange. I am using random inputs in the
5994 hope of triggering an error that might give us a clue */
5995
5996 s.in.group_handle = group_handle;
5997 s.in.unknown1 = random();
5998 s.in.unknown2 = random();
5999
6000 status = dcerpc_samr_SetMemberAttributesOfGroup(p, tctx, &s);
6001 torture_assert_ntstatus_ok(tctx, status, "SetMemberAttributesOfGroup");
6002 }
6003
6004 q.in.group_handle = group_handle;
6005 q.out.rids = &rids;
6006
6007 status = dcerpc_samr_QueryGroupMember(p, tctx, &q);
6008 torture_assert_ntstatus_ok(tctx, status, "QueryGroupMember");
6009 torture_assert(tctx, rids, "QueryGroupMember did not fill in rids structure");
6010
6011 for (i=0; i < rids->count; i++) {
6012 if (rids->rids[i] == rid) {
6013 found_member = true;
6014 }
6015 }
6016
6017 torture_assert(tctx, found_member, "QueryGroupMember did not list newly added member");
6018
6019 status = dcerpc_samr_DeleteGroupMember(p, tctx, &d);
6020 torture_assert_ntstatus_ok(tctx, status, "DeleteGroupMember");
6021
6022 rids = NULL;
6023 found_member = false;
6024
6025 status = dcerpc_samr_QueryGroupMember(p, tctx, &q);
6026 torture_assert_ntstatus_ok(tctx, status, "QueryGroupMember");
6027 torture_assert(tctx, rids, "QueryGroupMember did not fill in rids structure");
6028
6029 for (i=0; i < rids->count; i++) {
6030 if (rids->rids[i] == rid) {
6031 found_member = true;
6032 }
6033 }
6034
6035 torture_assert(tctx, !found_member, "QueryGroupMember does still list removed member");
6036
6037 status = dcerpc_samr_AddGroupMember(p, tctx, &r);
6038 torture_assert_ntstatus_ok(tctx, status, "AddGroupMember");
6039
6040 return true;
6041 }
6042
6043
6044 static bool test_CreateDomainGroup(struct dcerpc_pipe *p,
6045 struct torture_context *tctx,
6046 struct policy_handle *domain_handle,
6047 const char *group_name,
6048 struct policy_handle *group_handle,
6049 struct dom_sid *domain_sid,
6050 bool test_group)
6051 {
6052 NTSTATUS status;
6053 struct samr_CreateDomainGroup r;
6054 uint32_t rid;
6055 struct lsa_String name;
6056 bool ret = true;
6057
6058 init_lsa_String(&name, group_name);
6059
6060 r.in.domain_handle = domain_handle;
6061 r.in.name = &name;
6062 r.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
6063 r.out.group_handle = group_handle;
6064 r.out.rid = &rid;
6065
6066 torture_comment(tctx, "Testing CreateDomainGroup(%s)\n", r.in.name->string);
6067
6068 status = dcerpc_samr_CreateDomainGroup(p, tctx, &r);
6069
6070 if (dom_sid_equal(domain_sid, dom_sid_parse_talloc(tctx, SID_BUILTIN))) {
6071 if (NT_STATUS_EQUAL(status, NT_STATUS_ACCESS_DENIED)) {
6072 torture_comment(tctx, "Server correctly refused create of '%s'\n", r.in.name->string);
6073 return true;
6074 } else {
6075 torture_warning(tctx, "Server should have refused create of '%s', got %s instead\n", r.in.name->string,
6076 nt_errstr(status));
6077 return false;
6078 }
6079 }
6080
6081 if (NT_STATUS_EQUAL(status, NT_STATUS_GROUP_EXISTS)) {
6082 if (!test_DeleteGroup_byname(p, tctx, domain_handle, r.in.name->string)) {
6083 torture_warning(tctx, "CreateDomainGroup failed: Could not delete domain group %s - %s\n", r.in.name->string,
6084 nt_errstr(status));
6085 return false;
6086 }
6087 status = dcerpc_samr_CreateDomainGroup(p, tctx, &r);
6088 }
6089 if (NT_STATUS_EQUAL(status, NT_STATUS_USER_EXISTS)) {
6090 if (!test_DeleteUser_byname(p, tctx, domain_handle, r.in.name->string)) {
6091
6092 torture_warning(tctx, "CreateDomainGroup failed: Could not delete user %s - %s\n", r.in.name->string,
6093 nt_errstr(status));
6094 return false;
6095 }
6096 status = dcerpc_samr_CreateDomainGroup(p, tctx, &r);
6097 }
6098 torture_assert_ntstatus_ok(tctx, status, "CreateDomainGroup");
6099
6100 if (!test_group) {
6101 return ret;
6102 }
6103
6104 if (!test_AddGroupMember(p, tctx, domain_handle, group_handle)) {
6105 torture_warning(tctx, "CreateDomainGroup failed - %s\n", nt_errstr(status));
6106 ret = false;
6107 }
6108
6109 if (!test_SetGroupInfo(p, tctx, group_handle)) {
6110 ret = false;
6111 }
6112
6113 return ret;
6114 }
6115
6116
6117 /*
6118 its not totally clear what this does. It seems to accept any sid you like.
6119 */
6120 static bool test_RemoveMemberFromForeignDomain(struct dcerpc_pipe *p,
6121 struct torture_context *tctx,
6122 struct policy_handle *domain_handle)
6123 {
6124 NTSTATUS status;
6125 struct samr_RemoveMemberFromForeignDomain r;
6126
6127 r.in.domain_handle = domain_handle;
6128 r.in.sid = dom_sid_parse_talloc(tctx, "S-1-5-32-12-34-56-78");
6129
6130 status = dcerpc_samr_RemoveMemberFromForeignDomain(p, tctx, &r);
6131 torture_assert_ntstatus_ok(tctx, status, "RemoveMemberFromForeignDomain");
6132
6133 return true;
6134 }
6135
6136 static bool test_EnumDomainUsers(struct dcerpc_pipe *p,
6137 struct torture_context *tctx,
6138 struct policy_handle *domain_handle,
6139 uint32_t *total_num_entries_p)
6140 {
6141 NTSTATUS status;
6142 struct samr_EnumDomainUsers r;
6143 uint32_t resume_handle = 0;
6144 uint32_t num_entries = 0;
6145 uint32_t total_num_entries = 0;
6146 struct samr_SamArray *sam;
6147
6148 r.in.domain_handle = domain_handle;
6149 r.in.acct_flags = 0;
6150 r.in.max_size = (uint32_t)-1;
6151 r.in.resume_handle = &resume_handle;
6152
6153 r.out.sam = &sam;
6154 r.out.num_entries = &num_entries;
6155 r.out.resume_handle = &resume_handle;
6156
6157 torture_comment(tctx, "Testing EnumDomainUsers\n");
6158
6159 do {
6160 status = dcerpc_samr_EnumDomainUsers(p, tctx, &r);
6161 if (NT_STATUS_IS_ERR(status)) {
6162 torture_assert_ntstatus_ok(tctx, status,
6163 "failed to enumerate users");
6164 }
6165
6166 total_num_entries += num_entries;
6167 } while (NT_STATUS_EQUAL(status, STATUS_MORE_ENTRIES));
6168
6169 if (total_num_entries_p) {
6170 *total_num_entries_p = total_num_entries;
6171 }
6172
6173 return true;
6174 }
6175
6176 static bool test_EnumDomainGroups(struct dcerpc_pipe *p,
6177 struct torture_context *tctx,
6178 struct policy_handle *domain_handle,
6179 uint32_t *total_num_entries_p)
6180 {
6181 NTSTATUS status;
6182 struct samr_EnumDomainGroups r;
6183 uint32_t resume_handle = 0;
6184 uint32_t num_entries = 0;
6185 uint32_t total_num_entries = 0;
6186 struct samr_SamArray *sam;
6187
6188 r.in.domain_handle = domain_handle;
6189 r.in.max_size = (uint32_t)-1;
6190 r.in.resume_handle = &resume_handle;
6191
6192 r.out.sam = &sam;
6193 r.out.num_entries = &num_entries;
6194 r.out.resume_handle = &resume_handle;
6195
6196 torture_comment(tctx, "Testing EnumDomainGroups\n");
6197
6198 do {
6199 status = dcerpc_samr_EnumDomainGroups(p, tctx, &r);
6200 if (NT_STATUS_IS_ERR(status)) {
6201 torture_assert_ntstatus_ok(tctx, status,
6202 "failed to enumerate groups");
6203 }
6204
6205 total_num_entries += num_entries;
6206 } while (NT_STATUS_EQUAL(status, STATUS_MORE_ENTRIES));
6207
6208 if (total_num_entries_p) {
6209 *total_num_entries_p = total_num_entries;
6210 }
6211
6212 return true;
6213 }
6214
6215 static bool test_EnumDomainAliases(struct dcerpc_pipe *p,
6216 struct torture_context *tctx,
6217 struct policy_handle *domain_handle,
6218 uint32_t *total_num_entries_p)
6219 {
6220 NTSTATUS status;
6221 struct samr_EnumDomainAliases r;
6222 uint32_t resume_handle = 0;
6223 uint32_t num_entries = 0;
6224 uint32_t total_num_entries = 0;
6225 struct samr_SamArray *sam;
6226
6227 r.in.domain_handle = domain_handle;
6228 r.in.max_size = (uint32_t)-1;
6229 r.in.resume_handle = &resume_handle;
6230
6231 r.out.sam = &sam;
6232 r.out.num_entries = &num_entries;
6233 r.out.resume_handle = &resume_handle;
6234
6235 torture_comment(tctx, "Testing EnumDomainAliases\n");
6236
6237 do {
6238 status = dcerpc_samr_EnumDomainAliases(p, tctx, &r);
6239 if (NT_STATUS_IS_ERR(status)) {
6240 torture_assert_ntstatus_ok(tctx, status,
6241 "failed to enumerate aliases");
6242 }
6243
6244 total_num_entries += num_entries;
6245 } while (NT_STATUS_EQUAL(status, STATUS_MORE_ENTRIES));
6246
6247 if (total_num_entries_p) {
6248 *total_num_entries_p = total_num_entries;
6249 }
6250
6251 return true;
6252 }
6253
6254 static bool test_QueryDisplayInfo_level(struct dcerpc_pipe *p,
6255 struct torture_context *tctx,
6256 struct policy_handle *handle,
6257 uint16_t level,
6258 uint32_t *total_num_entries_p)
6259 {
6260 NTSTATUS status;
6261 struct samr_QueryDisplayInfo r;
6262 uint32_t total_num_entries = 0;
6263
6264 r.in.domain_handle = handle;
6265 r.in.level = level;
6266 r.in.start_idx = 0;
6267 r.in.max_entries = (uint32_t)-1;
6268 r.in.buf_size = (uint32_t)-1;
6269
6270 torture_comment(tctx, "Testing QueryDisplayInfo\n");
6271
6272 do {
6273 uint32_t total_size;
6274 uint32_t returned_size;
6275 union samr_DispInfo info;
6276
6277 r.out.total_size = &total_size;
6278 r.out.returned_size = &returned_size;
6279 r.out.info = &info;
6280
6281 status = dcerpc_samr_QueryDisplayInfo(p, tctx, &r);
6282 if (NT_STATUS_IS_ERR(status)) {
6283 torture_assert_ntstatus_ok(tctx, status,
6284 "failed to query displayinfo");
6285 }
6286
6287 if (*r.out.returned_size == 0) {
6288 break;
6289 }
6290
6291 switch (r.in.level) {
6292 case 1:
6293 total_num_entries += info.info1.count;
6294 r.in.start_idx += info.info1.entries[info.info1.count - 1].idx + 1;
6295 break;
6296 case 2:
6297 total_num_entries += info.info2.count;
6298 r.in.start_idx += info.info2.entries[info.info2.count - 1].idx + 1;
6299 break;
6300 case 3:
6301 total_num_entries += info.info3.count;
6302 r.in.start_idx += info.info3.entries[info.info3.count - 1].idx + 1;
6303 break;
6304 case 4:
6305 total_num_entries += info.info4.count;
6306 r.in.start_idx += info.info4.entries[info.info4.count - 1].idx + 1;
6307 break;
6308 case 5:
6309 total_num_entries += info.info5.count;
6310 r.in.start_idx += info.info5.entries[info.info5.count - 1].idx + 1;
6311 break;
6312 default:
6313 return false;
6314 }
6315
6316 } while (NT_STATUS_EQUAL(status, STATUS_MORE_ENTRIES));
6317
6318 if (total_num_entries_p) {
6319 *total_num_entries_p = total_num_entries;
6320 }
6321
6322 return true;
6323 }
6324
6325 static bool test_ManyObjects(struct dcerpc_pipe *p,
6326 struct torture_context *tctx,
6327 struct policy_handle *domain_handle,
6328 struct dom_sid *domain_sid,
6329 struct torture_samr_context *ctx)
6330 {
6331 uint32_t num_total = ctx->num_objects_large_dc;
6332 uint32_t num_enum = 0;
6333 uint32_t num_disp = 0;
6334 uint32_t num_created = 0;
6335 uint32_t num_anounced = 0;
6336 bool ret = true;
6337 NTSTATUS status;
6338 uint32_t i;
6339
6340 struct policy_handle *handles = talloc_zero_array(tctx, struct policy_handle, num_total);
6341
6342 /* query */
6343
6344 {
6345 struct samr_QueryDomainInfo2 r;
6346 union samr_DomainInfo *info;
6347 r.in.domain_handle = domain_handle;
6348 r.in.level = 2;
6349 r.out.info = &info;
6350
6351 status = dcerpc_samr_QueryDomainInfo2(p, tctx, &r);
6352 torture_assert_ntstatus_ok(tctx, status,
6353 "failed to query domain info");
6354
6355 switch (ctx->choice) {
6356 case TORTURE_SAMR_MANY_ACCOUNTS:
6357 num_anounced = info->general.num_users;
6358 break;
6359 case TORTURE_SAMR_MANY_GROUPS:
6360 num_anounced = info->general.num_groups;
6361 break;
6362 case TORTURE_SAMR_MANY_ALIASES:
6363 num_anounced = info->general.num_aliases;
6364 break;
6365 default:
6366 return false;
6367 }
6368 }
6369
6370 /* create */
6371
6372 for (i=0; i < num_total; i++) {
6373
6374 const char *name = NULL;
6375
6376 switch (ctx->choice) {
6377 case TORTURE_SAMR_MANY_ACCOUNTS:
6378 name = talloc_asprintf(tctx, "%s%04d", TEST_ACCOUNT_NAME, i);
6379 ret &= test_CreateUser(p, tctx, domain_handle, name, &handles[i], domain_sid, 0, NULL, false);
6380 break;
6381 case TORTURE_SAMR_MANY_GROUPS:
6382 name = talloc_asprintf(tctx, "%s%04d", TEST_GROUPNAME, i);
6383 ret &= test_CreateDomainGroup(p, tctx, domain_handle, name, &handles[i], domain_sid, false);
6384 break;
6385 case TORTURE_SAMR_MANY_ALIASES:
6386 name = talloc_asprintf(tctx, "%s%04d", TEST_ALIASNAME, i);
6387 ret &= test_CreateAlias(p, tctx, domain_handle, name, &handles[i], domain_sid, false);
6388 break;
6389 default:
6390 return false;
6391 }
6392 if (!policy_handle_empty(&handles[i])) {
6393 num_created++;
6394 }
6395 }
6396
6397 /* enum */
6398
6399 switch (ctx->choice) {
6400 case TORTURE_SAMR_MANY_ACCOUNTS:
6401 ret &= test_EnumDomainUsers(p, tctx, domain_handle, &num_enum);
6402 break;
6403 case TORTURE_SAMR_MANY_GROUPS:
6404 ret &= test_EnumDomainGroups(p, tctx, domain_handle, &num_enum);
6405 break;
6406 case TORTURE_SAMR_MANY_ALIASES:
6407 ret &= test_EnumDomainAliases(p, tctx, domain_handle, &num_enum);
6408 break;
6409 default:
6410 return false;
6411 }
6412
6413 /* dispinfo */
6414
6415 switch (ctx->choice) {
6416 case TORTURE_SAMR_MANY_ACCOUNTS:
6417 ret &= test_QueryDisplayInfo_level(p, tctx, domain_handle, 1, &num_disp);
6418 break;
6419 case TORTURE_SAMR_MANY_GROUPS:
6420 ret &= test_QueryDisplayInfo_level(p, tctx, domain_handle, 3, &num_disp);
6421 break;
6422 case TORTURE_SAMR_MANY_ALIASES:
6423 /* no aliases in dispinfo */
6424 break;
6425 default:
6426 return false;
6427 }
6428
6429 /* close or delete */
6430
6431 for (i=0; i < num_total; i++) {
6432
6433 if (policy_handle_empty(&handles[i])) {
6434 continue;
6435 }
6436
6437 if (torture_setting_bool(tctx, "samba3", false)) {
6438 ret &= test_samr_handle_Close(p, tctx, &handles[i]);
6439 } else {
6440 switch (ctx->choice) {
6441 case TORTURE_SAMR_MANY_ACCOUNTS:
6442 ret &= test_DeleteUser(p, tctx, &handles[i]);
6443 break;
6444 case TORTURE_SAMR_MANY_GROUPS:
6445 ret &= test_DeleteDomainGroup(p, tctx, &handles[i]);
6446 break;
6447 case TORTURE_SAMR_MANY_ALIASES:
6448 ret &= test_DeleteAlias(p, tctx, &handles[i]);
6449 break;
6450 default:
6451 return false;
6452 }
6453 }
6454 }
6455
6456 talloc_free(handles);
6457
6458 if (ctx->choice == TORTURE_SAMR_MANY_ACCOUNTS && num_enum != num_anounced + num_created) {
6459 torture_comment(tctx,
6460 "unexpected number of results (%u) returned in enum call, expected %u\n",
6461 num_enum, num_anounced + num_created);
6462
6463 torture_comment(tctx,
6464 "unexpected number of results (%u) returned in dispinfo, call, expected %u\n",
6465 num_disp, num_anounced + num_created);
6466 }
6467 return ret;
6468 }
6469
6470 static bool test_Connect(struct dcerpc_pipe *p, struct torture_context *tctx,
6471 struct policy_handle *handle);
6472
6473 static bool test_OpenDomain(struct dcerpc_pipe *p, struct torture_context *tctx,
6474 struct torture_samr_context *ctx, struct dom_sid *sid)
6475 {
6476 NTSTATUS status;
6477 struct samr_OpenDomain r;
6478 struct policy_handle domain_handle;
6479 struct policy_handle alias_handle;
6480 struct policy_handle user_handle;
6481 struct policy_handle group_handle;
6482 bool ret = true;
6483
6484 ZERO_STRUCT(alias_handle);
6485 ZERO_STRUCT(user_handle);
6486 ZERO_STRUCT(group_handle);
6487 ZERO_STRUCT(domain_handle);
6488
6489 torture_comment(tctx, "Testing OpenDomain of %s\n", dom_sid_string(tctx, sid));
6490
6491 r.in.connect_handle = &ctx->handle;
6492 r.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
6493 r.in.sid = sid;
6494 r.out.domain_handle = &domain_handle;
6495
6496 status = dcerpc_samr_OpenDomain(p, tctx, &r);
6497 torture_assert_ntstatus_ok(tctx, status, "OpenDomain");
6498
6499 /* run the domain tests with the main handle closed - this tests
6500 the servers reference counting */
6501 torture_assert(tctx, test_samr_handle_Close(p, tctx, &ctx->handle), "Failed to close SAMR handle");
6502
6503 switch (ctx->choice) {
6504 case TORTURE_SAMR_PASSWORDS:
6505 case TORTURE_SAMR_USER_PRIVILEGES:
6506 if (!torture_setting_bool(tctx, "samba3", false)) {
6507 ret &= test_CreateUser2(p, tctx, &domain_handle, sid, ctx->choice, NULL);
6508 }
6509 ret &= test_CreateUser(p, tctx, &domain_handle, TEST_ACCOUNT_NAME, &user_handle, sid, ctx->choice, NULL, true);
6510 if (!ret) {
6511 torture_warning(tctx, "Testing PASSWORDS or PRIVILEGES on domain %s failed!\n", dom_sid_string(tctx, sid));
6512 }
6513 break;
6514 case TORTURE_SAMR_USER_ATTRIBUTES:
6515 if (!torture_setting_bool(tctx, "samba3", false)) {
6516 ret &= test_CreateUser2(p, tctx, &domain_handle, sid, ctx->choice, NULL);
6517 }
6518 ret &= test_CreateUser(p, tctx, &domain_handle, TEST_ACCOUNT_NAME, &user_handle, sid, ctx->choice, NULL, true);
6519 /* This test needs 'complex' users to validate */
6520 ret &= test_QueryDisplayInfo(p, tctx, &domain_handle);
6521 if (!ret) {
6522 torture_warning(tctx, "Testing ATTRIBUTES on domain %s failed!\n", dom_sid_string(tctx, sid));
6523 }
6524 break;
6525 case TORTURE_SAMR_PASSWORDS_PWDLASTSET:
6526 if (!torture_setting_bool(tctx, "samba3", false)) {
6527 ret &= test_CreateUser2(p, tctx, &domain_handle, sid, ctx->choice, ctx->machine_credentials);
6528 }
6529 ret &= test_CreateUser(p, tctx, &domain_handle, TEST_ACCOUNT_NAME, &user_handle, sid, ctx->choice, ctx->machine_credentials, true);
6530 if (!ret) {
6531 torture_warning(tctx, "Testing PASSWORDS PWDLASTSET on domain %s failed!\n", dom_sid_string(tctx, sid));
6532 }
6533 break;
6534 case TORTURE_SAMR_MANY_ACCOUNTS:
6535 case TORTURE_SAMR_MANY_GROUPS:
6536 case TORTURE_SAMR_MANY_ALIASES:
6537 ret &= test_ManyObjects(p, tctx, &domain_handle, sid, ctx);
6538 if (!ret) {
6539 torture_warning(tctx, "Testing MANY-{ACCOUNTS,GROUPS,ALIASES} on domain %s failed!\n", dom_sid_string(tctx, sid));
6540 }
6541 break;
6542 case TORTURE_SAMR_OTHER:
6543 ret &= test_CreateUser(p, tctx, &domain_handle, TEST_ACCOUNT_NAME, &user_handle, sid, ctx->choice, NULL, true);
6544 if (!ret) {
6545 torture_warning(tctx, "Failed to CreateUser in SAMR-OTHER on domain %s!\n", dom_sid_string(tctx, sid));
6546 }
6547 if (!torture_setting_bool(tctx, "samba3", false)) {
6548 ret &= test_QuerySecurity(p, tctx, &domain_handle);
6549 }
6550 ret &= test_RemoveMemberFromForeignDomain(p, tctx, &domain_handle);
6551 ret &= test_CreateAlias(p, tctx, &domain_handle, TEST_ALIASNAME, &alias_handle, sid, true);
6552 ret &= test_CreateDomainGroup(p, tctx, &domain_handle, TEST_GROUPNAME, &group_handle, sid, true);
6553 ret &= test_GetAliasMembership(p, tctx, &domain_handle);
6554 ret &= test_QueryDomainInfo(p, tctx, &domain_handle);
6555 ret &= test_QueryDomainInfo2(p, tctx, &domain_handle);
6556 ret &= test_EnumDomainUsers_all(p, tctx, &domain_handle);
6557 ret &= test_EnumDomainUsers_async(p, tctx, &domain_handle);
6558 ret &= test_EnumDomainGroups_all(p, tctx, &domain_handle);
6559 ret &= test_EnumDomainAliases_all(p, tctx, &domain_handle);
6560 ret &= test_QueryDisplayInfo2(p, tctx, &domain_handle);
6561 ret &= test_QueryDisplayInfo3(p, tctx, &domain_handle);
6562 ret &= test_QueryDisplayInfo_continue(p, tctx, &domain_handle);
6563
6564 if (torture_setting_bool(tctx, "samba4", false)) {
6565 torture_comment(tctx, "skipping GetDisplayEnumerationIndex test against Samba4\n");
6566 } else {
6567 ret &= test_GetDisplayEnumerationIndex(p, tctx, &domain_handle);
6568 ret &= test_GetDisplayEnumerationIndex2(p, tctx, &domain_handle);
6569 }
6570 ret &= test_GroupList(p, tctx, &domain_handle);
6571 ret &= test_TestPrivateFunctionsDomain(p, tctx, &domain_handle);
6572 ret &= test_RidToSid(p, tctx, sid, &domain_handle);
6573 ret &= test_GetBootKeyInformation(p, tctx, &domain_handle);
6574 if (!ret) {
6575 torture_comment(tctx, "Testing SAMR-OTHER on domain %s failed!\n", dom_sid_string(tctx, sid));
6576 }
6577 break;
6578 }
6579
6580 if (!policy_handle_empty(&user_handle) &&
6581 !test_DeleteUser(p, tctx, &user_handle)) {
6582 ret = false;
6583 }
6584
6585 if (!policy_handle_empty(&alias_handle) &&
6586 !test_DeleteAlias(p, tctx, &alias_handle)) {
6587 ret = false;
6588 }
6589
6590 if (!policy_handle_empty(&group_handle) &&
6591 !test_DeleteDomainGroup(p, tctx, &group_handle)) {
6592 ret = false;
6593 }
6594
6595 torture_assert(tctx, test_samr_handle_Close(p, tctx, &domain_handle), "Failed to close SAMR domain handle");
6596
6597 torture_assert(tctx, test_Connect(p, tctx, &ctx->handle), "Faile to re-connect SAMR handle");
6598 /* reconnect the main handle */
6599
6600 if (!ret) {
6601 torture_warning(tctx, "Testing domain %s failed!\n", dom_sid_string(tctx, sid));
6602 }
6603
6604 return ret;
6605 }
6606
6607 static bool test_LookupDomain(struct dcerpc_pipe *p, struct torture_context *tctx,
6608 struct torture_samr_context *ctx, const char *domain)
6609 {
6610 NTSTATUS status;
6611 struct samr_LookupDomain r;
6612 struct dom_sid2 *sid = NULL;
6613 struct lsa_String n1;
6614 struct lsa_String n2;
6615 bool ret = true;
6616
6617 torture_comment(tctx, "Testing LookupDomain(%s)\n", domain);
6618
6619 /* check for correct error codes */
6620 r.in.connect_handle = &ctx->handle;
6621 r.in.domain_name = &n2;
6622 r.out.sid = &sid;
6623 n2.string = NULL;
6624
6625 status = dcerpc_samr_LookupDomain(p, tctx, &r);
6626 torture_assert_ntstatus_equal(tctx, NT_STATUS_INVALID_PARAMETER, status, "LookupDomain expected NT_STATUS_INVALID_PARAMETER");
6627
6628 init_lsa_String(&n2, "xxNODOMAINxx");
6629
6630 status = dcerpc_samr_LookupDomain(p, tctx, &r);
6631 torture_assert_ntstatus_equal(tctx, NT_STATUS_NO_SUCH_DOMAIN, status, "LookupDomain expected NT_STATUS_NO_SUCH_DOMAIN");
6632
6633 r.in.connect_handle = &ctx->handle;
6634
6635 init_lsa_String(&n1, domain);
6636 r.in.domain_name = &n1;
6637
6638 status = dcerpc_samr_LookupDomain(p, tctx, &r);
6639 torture_assert_ntstatus_ok(tctx, status, "LookupDomain");
6640
6641 if (!test_GetDomPwInfo(p, tctx, &n1)) {
6642 ret = false;
6643 }
6644
6645 if (!test_OpenDomain(p, tctx, ctx, *r.out.sid)) {
6646 ret = false;
6647 }
6648
6649 return ret;
6650 }
6651
6652
6653 static bool test_EnumDomains(struct dcerpc_pipe *p, struct torture_context *tctx,
6654 struct torture_samr_context *ctx)
6655 {
6656 NTSTATUS status;
6657 struct samr_EnumDomains r;
6658 uint32_t resume_handle = 0;
6659 uint32_t num_entries = 0;
6660 struct samr_SamArray *sam = NULL;
6661 int i;
6662 bool ret = true;
6663
6664 r.in.connect_handle = &ctx->handle;
6665 r.in.resume_handle = &resume_handle;
6666 r.in.buf_size = (uint32_t)-1;
6667 r.out.resume_handle = &resume_handle;
6668 r.out.num_entries = &num_entries;
6669 r.out.sam = &sam;
6670
6671 status = dcerpc_samr_EnumDomains(p, tctx, &r);
6672 torture_assert_ntstatus_ok(tctx, status, "EnumDomains");
6673
6674 if (!*r.out.sam) {
6675 return false;
6676 }
6677
6678 for (i=0;i<sam->count;i++) {
6679 if (!test_LookupDomain(p, tctx, ctx,
6680 sam->entries[i].name.string)) {
6681 ret = false;
6682 }
6683 }
6684
6685 status = dcerpc_samr_EnumDomains(p, tctx, &r);
6686 torture_assert_ntstatus_ok(tctx, status, "EnumDomains");
6687
6688 return ret;
6689 }
6690
6691
6692 static bool test_Connect(struct dcerpc_pipe *p, struct torture_context *tctx,
6693 struct policy_handle *handle)
6694 {
6695 NTSTATUS status;
6696 struct samr_Connect r;
6697 struct samr_Connect2 r2;
6698 struct samr_Connect3 r3;
6699 struct samr_Connect4 r4;
6700 struct samr_Connect5 r5;
6701 union samr_ConnectInfo info;
6702 struct policy_handle h;
6703 uint32_t level_out = 0;
6704 bool ret = true, got_handle = false;
6705
6706 torture_comment(tctx, "testing samr_Connect\n");
6707
6708 r.in.system_name = 0;
6709 r.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
6710 r.out.connect_handle = &h;
6711
6712 status = dcerpc_samr_Connect(p, tctx, &r);
6713 if (!NT_STATUS_IS_OK(status)) {
6714 torture_comment(tctx, "Connect failed - %s\n", nt_errstr(status));
6715 ret = false;
6716 } else {
6717 got_handle = true;
6718 *handle = h;
6719 }
6720
6721 torture_comment(tctx, "testing samr_Connect2\n");
6722
6723 r2.in.system_name = NULL;
6724 r2.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
6725 r2.out.connect_handle = &h;
6726
6727 status = dcerpc_samr_Connect2(p, tctx, &r2);
6728 if (!NT_STATUS_IS_OK(status)) {
6729 torture_comment(tctx, "Connect2 failed - %s\n", nt_errstr(status));
6730 ret = false;
6731 } else {
6732 if (got_handle) {
6733 test_samr_handle_Close(p, tctx, handle);
6734 }
6735 got_handle = true;
6736 *handle = h;
6737 }
6738
6739 torture_comment(tctx, "testing samr_Connect3\n");
6740
6741 r3.in.system_name = NULL;
6742 r3.in.unknown = 0;
6743 r3.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
6744 r3.out.connect_handle = &h;
6745
6746 status = dcerpc_samr_Connect3(p, tctx, &r3);
6747 if (!NT_STATUS_IS_OK(status)) {
6748 torture_warning(tctx, "Connect3 failed - %s\n", nt_errstr(status));
6749 ret = false;
6750 } else {
6751 if (got_handle) {
6752 test_samr_handle_Close(p, tctx, handle);
6753 }
6754 got_handle = true;
6755 *handle = h;
6756 }
6757
6758 torture_comment(tctx, "testing samr_Connect4\n");
6759
6760 r4.in.system_name = "";
6761 r4.in.client_version = 0;
6762 r4.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
6763 r4.out.connect_handle = &h;
6764
6765 status = dcerpc_samr_Connect4(p, tctx, &r4);
6766 if (!NT_STATUS_IS_OK(status)) {
6767 torture_warning(tctx, "Connect4 failed - %s\n", nt_errstr(status));
6768 ret = false;
6769 } else {
6770 if (got_handle) {
6771 test_samr_handle_Close(p, tctx, handle);
6772 }
6773 got_handle = true;
6774 *handle = h;
6775 }
6776
6777 torture_comment(tctx, "testing samr_Connect5\n");
6778
6779 info.info1.client_version = 0;
6780 info.info1.unknown2 = 0;
6781
6782 r5.in.system_name = "";
6783 r5.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
6784 r5.in.level_in = 1;
6785 r5.out.level_out = &level_out;
6786 r5.in.info_in = &info;
6787 r5.out.info_out = &info;
6788 r5.out.connect_handle = &h;
6789
6790 status = dcerpc_samr_Connect5(p, tctx, &r5);
6791 if (!NT_STATUS_IS_OK(status)) {
6792 torture_warning(tctx, "Connect5 failed - %s\n", nt_errstr(status));
6793 ret = false;
6794 } else {
6795 if (got_handle) {
6796 test_samr_handle_Close(p, tctx, handle);
6797 }
6798 got_handle = true;
6799 *handle = h;
6800 }
6801
6802 return ret;
6803 }
6804
6805
6806 bool torture_rpc_samr(struct torture_context *torture)
6807 {
6808 NTSTATUS status;
6809 struct dcerpc_pipe *p;
6810 bool ret = true;
6811 struct torture_samr_context *ctx;
6812
6813 status = torture_rpc_connection(torture, &p, &ndr_table_samr);
6814 if (!NT_STATUS_IS_OK(status)) {
6815 return false;
6816 }
6817
6818 ctx = talloc_zero(torture, struct torture_samr_context);
6819
6820 ctx->choice = TORTURE_SAMR_OTHER;
6821
6822 ret &= test_Connect(p, torture, &ctx->handle);
6823
6824 if (!torture_setting_bool(torture, "samba3", false)) {
6825 ret &= test_QuerySecurity(p, torture, &ctx->handle);
6826 }
6827
6828 ret &= test_EnumDomains(p, torture, ctx);
6829
6830 ret &= test_SetDsrmPassword(p, torture, &ctx->handle);
6831
6832 ret &= test_Shutdown(p, torture, &ctx->handle);
6833
6834 ret &= test_samr_handle_Close(p, torture, &ctx->handle);
6835
6836 return ret;
6837 }
6838
6839
6840 bool torture_rpc_samr_users(struct torture_context *torture)
6841 {
6842 NTSTATUS status;
6843 struct dcerpc_pipe *p;
6844 bool ret = true;
6845 struct torture_samr_context *ctx;
6846
6847 status = torture_rpc_connection(torture, &p, &ndr_table_samr);
6848 if (!NT_STATUS_IS_OK(status)) {
6849 return false;
6850 }
6851
6852 ctx = talloc_zero(torture, struct torture_samr_context);
6853
6854 ctx->choice = TORTURE_SAMR_USER_ATTRIBUTES;
6855
6856 ret &= test_Connect(p, torture, &ctx->handle);
6857
6858 if (!torture_setting_bool(torture, "samba3", false)) {
6859 ret &= test_QuerySecurity(p, torture, &ctx->handle);
6860 }
6861
6862 ret &= test_EnumDomains(p, torture, ctx);
6863
6864 ret &= test_SetDsrmPassword(p, torture, &ctx->handle);
6865
6866 ret &= test_Shutdown(p, torture, &ctx->handle);
6867
6868 ret &= test_samr_handle_Close(p, torture, &ctx->handle);
6869
6870 return ret;
6871 }
6872
6873
6874 bool torture_rpc_samr_passwords(struct torture_context *torture)
6875 {
6876 NTSTATUS status;
6877 struct dcerpc_pipe *p;
6878 bool ret = true;
6879 struct torture_samr_context *ctx;
6880
6881 status = torture_rpc_connection(torture, &p, &ndr_table_samr);
6882 if (!NT_STATUS_IS_OK(status)) {
6883 return false;
6884 }
6885
6886 ctx = talloc_zero(torture, struct torture_samr_context);
6887
6888 ctx->choice = TORTURE_SAMR_PASSWORDS;
6889
6890 ret &= test_Connect(p, torture, &ctx->handle);
6891
6892 ret &= test_EnumDomains(p, torture, ctx);
6893
6894 ret &= test_samr_handle_Close(p, torture, &ctx->handle);
6895
6896 return ret;
6897 }
6898
6899 static bool torture_rpc_samr_pwdlastset(struct torture_context *torture,
6900 struct dcerpc_pipe *p2,
6901 struct cli_credentials *machine_credentials)
6902 {
6903 NTSTATUS status;
6904 struct dcerpc_pipe *p;
6905 bool ret = true;
6906 struct torture_samr_context *ctx;
6907
6908 status = torture_rpc_connection(torture, &p, &ndr_table_samr);
6909 if (!NT_STATUS_IS_OK(status)) {
6910 return false;
6911 }
6912
6913 ctx = talloc_zero(torture, struct torture_samr_context);
6914
6915 ctx->choice = TORTURE_SAMR_PASSWORDS_PWDLASTSET;
6916 ctx->machine_credentials = machine_credentials;
6917
6918 ret &= test_Connect(p, torture, &ctx->handle);
6919
6920 ret &= test_EnumDomains(p, torture, ctx);
6921
6922 ret &= test_samr_handle_Close(p, torture, &ctx->handle);
6923
6924 return ret;
6925 }
6926
6927 struct torture_suite *torture_rpc_samr_passwords_pwdlastset(TALLOC_CTX *mem_ctx)
6928 {
6929 struct torture_suite *suite = torture_suite_create(mem_ctx, "SAMR-PASSWORDS-PWDLASTSET");
6930 struct torture_rpc_tcase *tcase;
6931
6932 tcase = torture_suite_add_machine_bdc_rpc_iface_tcase(suite, "samr",
6933 &ndr_table_samr,
6934 TEST_ACCOUNT_NAME_PWD);
6935
6936 torture_rpc_tcase_add_test_creds(tcase, "pwdLastSet",
6937 torture_rpc_samr_pwdlastset);
6938
6939 return suite;
6940 }
6941
6942 static bool torture_rpc_samr_users_privileges_delete_user(struct torture_context *torture,
6943 struct dcerpc_pipe *p2,
6944 struct cli_credentials *machine_credentials)
6945 {
6946 NTSTATUS status;
6947 struct dcerpc_pipe *p;
6948 bool ret = true;
6949 struct torture_samr_context *ctx;
6950
6951 status = torture_rpc_connection(torture, &p, &ndr_table_samr);
6952 if (!NT_STATUS_IS_OK(status)) {
6953 return false;
6954 }
6955
6956 ctx = talloc_zero(torture, struct torture_samr_context);
6957
6958 ctx->choice = TORTURE_SAMR_USER_PRIVILEGES;
6959 ctx->machine_credentials = machine_credentials;
6960
6961 ret &= test_Connect(p, torture, &ctx->handle);
6962
6963 ret &= test_EnumDomains(p, torture, ctx);
6964
6965 ret &= test_samr_handle_Close(p, torture, &ctx->handle);
6966
6967 return ret;
6968 }
6969
6970 struct torture_suite *torture_rpc_samr_user_privileges(TALLOC_CTX *mem_ctx)
6971 {
6972 struct torture_suite *suite = torture_suite_create(mem_ctx, "SAMR-USERS-PRIVILEGES");
6973 struct torture_rpc_tcase *tcase;
6974
6975 tcase = torture_suite_add_machine_bdc_rpc_iface_tcase(suite, "samr",
6976 &ndr_table_samr,
6977 TEST_ACCOUNT_NAME_PWD);
6978
6979 torture_rpc_tcase_add_test_creds(tcase, "delete_privileged_user",
6980 torture_rpc_samr_users_privileges_delete_user);
6981
6982 return suite;
6983 }
6984
6985 static bool torture_rpc_samr_many_accounts(struct torture_context *torture,
6986 struct dcerpc_pipe *p2,
6987 void *data)
6988 {
6989 NTSTATUS status;
6990 struct dcerpc_pipe *p;
6991 bool ret = true;
6992 struct torture_samr_context *ctx =
6993 talloc_get_type_abort(data, struct torture_samr_context);
6994
6995 status = torture_rpc_connection(torture, &p, &ndr_table_samr);
6996 if (!NT_STATUS_IS_OK(status)) {
6997 return false;
6998 }
6999
7000 ctx->choice = TORTURE_SAMR_MANY_ACCOUNTS;
7001 ctx->num_objects_large_dc = torture_setting_int(torture, "large_dc",
7002 ctx->num_objects_large_dc);
7003
7004 ret &= test_Connect(p, torture, &ctx->handle);
7005
7006 ret &= test_EnumDomains(p, torture, ctx);
7007
7008 ret &= test_samr_handle_Close(p, torture, &ctx->handle);
7009
7010 return ret;
7011 }
7012
7013 static bool torture_rpc_samr_many_groups(struct torture_context *torture,
7014 struct dcerpc_pipe *p2,
7015 void *data)
7016 {
7017 NTSTATUS status;
7018 struct dcerpc_pipe *p;
7019 bool ret = true;
7020 struct torture_samr_context *ctx =
7021 talloc_get_type_abort(data, struct torture_samr_context);
7022
7023 status = torture_rpc_connection(torture, &p, &ndr_table_samr);
7024 if (!NT_STATUS_IS_OK(status)) {
7025 return false;
7026 }
7027
7028 ctx->choice = TORTURE_SAMR_MANY_GROUPS;
7029 ctx->num_objects_large_dc = torture_setting_int(torture, "large_dc",
7030 ctx->num_objects_large_dc);
7031
7032 ret &= test_Connect(p, torture, &ctx->handle);
7033
7034 ret &= test_EnumDomains(p, torture, ctx);
7035
7036 ret &= test_samr_handle_Close(p, torture, &ctx->handle);
7037
7038 return ret;
7039 }
7040
7041 static bool torture_rpc_samr_many_aliases(struct torture_context *torture,
7042 struct dcerpc_pipe *p2,
7043 void *data)
7044 {
7045 NTSTATUS status;
7046 struct dcerpc_pipe *p;
7047 bool ret = true;
7048 struct torture_samr_context *ctx =
7049 talloc_get_type_abort(data, struct torture_samr_context);
7050
7051 status = torture_rpc_connection(torture, &p, &ndr_table_samr);
7052 if (!NT_STATUS_IS_OK(status)) {
7053 return false;
7054 }
7055
7056 ctx->choice = TORTURE_SAMR_MANY_ALIASES;
7057 ctx->num_objects_large_dc = torture_setting_int(torture, "large_dc",
7058 ctx->num_objects_large_dc);
7059
7060 ret &= test_Connect(p, torture, &ctx->handle);
7061
7062 ret &= test_EnumDomains(p, torture, ctx);
7063
7064 ret &= test_samr_handle_Close(p, torture, &ctx->handle);
7065
7066 return ret;
7067 }
7068
7069 struct torture_suite *torture_rpc_samr_large_dc(TALLOC_CTX *mem_ctx)
7070 {
7071 struct torture_suite *suite = torture_suite_create(mem_ctx, "SAMR-LARGE-DC");
7072 struct torture_rpc_tcase *tcase;
7073 struct torture_samr_context *ctx;
7074
7075 tcase = torture_suite_add_rpc_iface_tcase(suite, "samr", &ndr_table_samr);
7076
7077 ctx = talloc_zero(suite, struct torture_samr_context);
7078 ctx->num_objects_large_dc = 150;
7079
7080 torture_rpc_tcase_add_test_ex(tcase, "many_aliases",
7081 torture_rpc_samr_many_aliases, ctx);
7082 torture_rpc_tcase_add_test_ex(tcase, "many_groups",
7083 torture_rpc_samr_many_groups, ctx);
7084 torture_rpc_tcase_add_test_ex(tcase, "many_accounts",
7085 torture_rpc_samr_many_accounts, ctx);
7086
7087 return suite;
7088 }