?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
s4:torture: refactor querying of domain info out into test_QueryDomainInfo2_level()
[Samba/gebeck_regimport.git] / source4 / torture / rpc / samr.c
blob4ab4a2cdc7e6e5211d32042aefcc964008284f22
1 /*
2 Unix SMB/CIFS implementation.
3 test suite for samr rpc operations
4
5 Copyright (C) Andrew Tridgell 2003
6 Copyright (C) Andrew Bartlett <abartlet@samba.org> 2003
7 Copyright (C) Guenther Deschner 2008-2010
8
9 This program is free software; you can redistribute it and/or modify
10 it under the terms of the GNU General Public License as published by
11 the Free Software Foundation; either version 3 of the License, or
12 (at your option) any later version.
13
14 This program is distributed in the hope that it will be useful,
15 but WITHOUT ANY WARRANTY; without even the implied warranty of
16 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
17 GNU General Public License for more details.
18
19 You should have received a copy of the GNU General Public License
20 along with this program. If not, see <http://www.gnu.org/licenses/>.
21 */
22
23 #include "includes.h"
24 #include "torture/torture.h"
25 #include "system/time.h"
26 #include "librpc/gen_ndr/lsa.h"
27 #include "librpc/gen_ndr/ndr_netlogon.h"
28 #include "librpc/gen_ndr/ndr_netlogon_c.h"
29 #include "librpc/gen_ndr/ndr_samr_c.h"
30 #include "librpc/gen_ndr/ndr_lsa_c.h"
31 #include "../lib/crypto/crypto.h"
32 #include "libcli/auth/libcli_auth.h"
33 #include "libcli/security/security.h"
34 #include "torture/rpc/rpc.h"
35 #include "param/param.h"
36 #include "auth/gensec/gensec.h"
37 #include "auth/gensec/gensec_proto.h"
38 #include "../libcli/auth/schannel.h"
39 #include "auth/gensec/schannel_state.h"
40
41 #include <unistd.h>
42
43 #define TEST_ACCOUNT_NAME "samrtorturetest"
44 #define TEST_ACCOUNT_NAME_PWD "samrpwdlastset"
45 #define TEST_ALIASNAME "samrtorturetestalias"
46 #define TEST_GROUPNAME "samrtorturetestgroup"
47 #define TEST_MACHINENAME "samrtestmach$"
48 #define TEST_DOMAINNAME "samrtestdom$"
49
50 enum torture_samr_choice {
51 TORTURE_SAMR_PASSWORDS,
52 TORTURE_SAMR_PASSWORDS_PWDLASTSET,
53 TORTURE_SAMR_PASSWORDS_BADPWDCOUNT,
54 TORTURE_SAMR_PASSWORDS_LOCKOUT,
55 TORTURE_SAMR_USER_ATTRIBUTES,
56 TORTURE_SAMR_USER_PRIVILEGES,
57 TORTURE_SAMR_OTHER,
58 TORTURE_SAMR_MANY_ACCOUNTS,
59 TORTURE_SAMR_MANY_GROUPS,
60 TORTURE_SAMR_MANY_ALIASES
61 };
62
63 struct torture_samr_context {
64 struct policy_handle handle;
65 struct cli_credentials *machine_credentials;
66 enum torture_samr_choice choice;
67 uint32_t num_objects_large_dc;
68 };
69
70 static bool test_QueryUserInfo(struct dcerpc_pipe *p,
71 struct torture_context *tctx,
72 struct policy_handle *handle);
73
74 static bool test_QueryUserInfo2(struct dcerpc_pipe *p,
75 struct torture_context *tctx,
76 struct policy_handle *handle);
77
78 static bool test_QueryAliasInfo(struct dcerpc_pipe *p,
79 struct torture_context *tctx,
80 struct policy_handle *handle);
81
82 static bool test_ChangePassword(struct dcerpc_pipe *p,
83 struct torture_context *tctx,
84 const char *acct_name,
85 struct policy_handle *domain_handle, char **password);
86
87 static void init_lsa_String(struct lsa_String *string, const char *s)
88 {
89 string->string = s;
90 }
91
92 static void init_lsa_StringLarge(struct lsa_StringLarge *string, const char *s)
93 {
94 string->string = s;
95 }
96
97 static void init_lsa_BinaryString(struct lsa_BinaryString *string, const char *s, uint32_t length)
98 {
99 string->length = length;
100 string->size = length;
101 string->array = (uint16_t *)discard_const(s);
102 }
103
104 bool test_samr_handle_Close(struct dcerpc_pipe *p, struct torture_context *tctx,
105 struct policy_handle *handle)
106 {
107 NTSTATUS status;
108 struct samr_Close r;
109
110 r.in.handle = handle;
111 r.out.handle = handle;
112
113 status = dcerpc_samr_Close(p, tctx, &r);
114 torture_assert_ntstatus_ok(tctx, status, "Close");
115
116 return true;
117 }
118
119 static bool test_Shutdown(struct dcerpc_pipe *p, struct torture_context *tctx,
120 struct policy_handle *handle)
121 {
122 NTSTATUS status;
123 struct samr_Shutdown r;
124
125 if (!torture_setting_bool(tctx, "dangerous", false)) {
126 torture_skip(tctx, "samr_Shutdown disabled - enable dangerous tests to use\n");
127 return true;
128 }
129
130 r.in.connect_handle = handle;
131
132 torture_comment(tctx, "testing samr_Shutdown\n");
133
134 status = dcerpc_samr_Shutdown(p, tctx, &r);
135 torture_assert_ntstatus_ok(tctx, status, "samr_Shutdown");
136
137 return true;
138 }
139
140 static bool test_SetDsrmPassword(struct dcerpc_pipe *p, struct torture_context *tctx,
141 struct policy_handle *handle)
142 {
143 NTSTATUS status;
144 struct samr_SetDsrmPassword r;
145 struct lsa_String string;
146 struct samr_Password hash;
147
148 if (!torture_setting_bool(tctx, "dangerous", false)) {
149 torture_skip(tctx, "samr_SetDsrmPassword disabled - enable dangerous tests to use");
150 }
151
152 E_md4hash("TeSTDSRM123", hash.hash);
153
154 init_lsa_String(&string, "Administrator");
155
156 r.in.name = &string;
157 r.in.unknown = 0;
158 r.in.hash = &hash;
159
160 torture_comment(tctx, "testing samr_SetDsrmPassword\n");
161
162 status = dcerpc_samr_SetDsrmPassword(p, tctx, &r);
163 torture_assert_ntstatus_equal(tctx, status, NT_STATUS_NOT_SUPPORTED, "samr_SetDsrmPassword");
164
165 return true;
166 }
167
168
169 static bool test_QuerySecurity(struct dcerpc_pipe *p,
170 struct torture_context *tctx,
171 struct policy_handle *handle)
172 {
173 NTSTATUS status;
174 struct samr_QuerySecurity r;
175 struct samr_SetSecurity s;
176 struct sec_desc_buf *sdbuf = NULL;
177
178 r.in.handle = handle;
179 r.in.sec_info = 7;
180 r.out.sdbuf = &sdbuf;
181
182 status = dcerpc_samr_QuerySecurity(p, tctx, &r);
183 torture_assert_ntstatus_ok(tctx, status, "QuerySecurity");
184
185 torture_assert(tctx, sdbuf != NULL, "sdbuf is NULL");
186
187 s.in.handle = handle;
188 s.in.sec_info = 7;
189 s.in.sdbuf = sdbuf;
190
191 if (torture_setting_bool(tctx, "samba4", false)) {
192 torture_skip(tctx, "skipping SetSecurity test against Samba4\n");
193 }
194
195 status = dcerpc_samr_SetSecurity(p, tctx, &s);
196 torture_assert_ntstatus_ok(tctx, status, "SetSecurity");
197
198 status = dcerpc_samr_QuerySecurity(p, tctx, &r);
199 torture_assert_ntstatus_ok(tctx, status, "QuerySecurity");
200
201 return true;
202 }
203
204
205 static bool test_SetUserInfo(struct dcerpc_pipe *p, struct torture_context *tctx,
206 struct policy_handle *handle, uint32_t base_acct_flags,
207 const char *base_account_name)
208 {
209 NTSTATUS status;
210 struct samr_SetUserInfo s;
211 struct samr_SetUserInfo2 s2;
212 struct samr_QueryUserInfo q;
213 struct samr_QueryUserInfo q0;
214 union samr_UserInfo u;
215 union samr_UserInfo *info;
216 bool ret = true;
217 const char *test_account_name;
218
219 uint32_t user_extra_flags = 0;
220
221 if (!torture_setting_bool(tctx, "samba3", false)) {
222 if (base_acct_flags == ACB_NORMAL) {
223 /* When created, accounts are expired by default */
224 user_extra_flags = ACB_PW_EXPIRED;
225 }
226 }
227
228 s.in.user_handle = handle;
229 s.in.info = &u;
230
231 s2.in.user_handle = handle;
232 s2.in.info = &u;
233
234 q.in.user_handle = handle;
235 q.out.info = &info;
236 q0 = q;
237
238 #define TESTCALL(call, r) \
239 status = dcerpc_samr_ ##call(p, tctx, &r); \
240 if (!NT_STATUS_IS_OK(status)) { \
241 torture_comment(tctx, #call " level %u failed - %s (%s)\n", \
242 r.in.level, nt_errstr(status), __location__); \
243 ret = false; \
244 break; \
245 }
246
247 #define STRING_EQUAL(s1, s2, field) \
248 if ((s1 && !s2) || (s2 && !s1) || strcmp(s1, s2)) { \
249 torture_comment(tctx, "Failed to set %s to '%s' (%s)\n", \
250 #field, s2, __location__); \
251 ret = false; \
252 break; \
253 }
254
255 #define MEM_EQUAL(s1, s2, length, field) \
256 if ((s1 && !s2) || (s2 && !s1) || memcmp(s1, s2, length)) { \
257 torture_comment(tctx, "Failed to set %s to '%s' (%s)\n", \
258 #field, (const char *)s2, __location__); \
259 ret = false; \
260 break; \
261 }
262
263 #define INT_EQUAL(i1, i2, field) \
264 if (i1 != i2) { \
265 torture_comment(tctx, "Failed to set %s to 0x%llx - got 0x%llx (%s)\n", \
266 #field, (unsigned long long)i2, (unsigned long long)i1, __location__); \
267 ret = false; \
268 break; \
269 }
270
271 #define TEST_USERINFO_STRING(lvl1, field1, lvl2, field2, value, fpval) do { \
272 torture_comment(tctx, "field test %d/%s vs %d/%s\n", lvl1, #field1, lvl2, #field2); \
273 q.in.level = lvl1; \
274 TESTCALL(QueryUserInfo, q) \
275 s.in.level = lvl1; \
276 s2.in.level = lvl1; \
277 u = *info; \
278 if (lvl1 == 21) { \
279 ZERO_STRUCT(u.info21); \
280 u.info21.fields_present = fpval; \
281 } \
282 init_lsa_String(&u.info ## lvl1.field1, value); \
283 TESTCALL(SetUserInfo, s) \
284 TESTCALL(SetUserInfo2, s2) \
285 init_lsa_String(&u.info ## lvl1.field1, ""); \
286 TESTCALL(QueryUserInfo, q); \
287 u = *info; \
288 STRING_EQUAL(u.info ## lvl1.field1.string, value, field1); \
289 q.in.level = lvl2; \
290 TESTCALL(QueryUserInfo, q) \
291 u = *info; \
292 STRING_EQUAL(u.info ## lvl2.field2.string, value, field2); \
293 } while (0)
294
295 #define TEST_USERINFO_BINARYSTRING(lvl1, field1, lvl2, field2, value, fpval) do { \
296 torture_comment(tctx, "field test %d/%s vs %d/%s\n", lvl1, #field1, lvl2, #field2); \
297 q.in.level = lvl1; \
298 TESTCALL(QueryUserInfo, q) \
299 s.in.level = lvl1; \
300 s2.in.level = lvl1; \
301 u = *info; \
302 if (lvl1 == 21) { \
303 ZERO_STRUCT(u.info21); \
304 u.info21.fields_present = fpval; \
305 } \
306 init_lsa_BinaryString(&u.info ## lvl1.field1, value, strlen(value)); \
307 TESTCALL(SetUserInfo, s) \
308 TESTCALL(SetUserInfo2, s2) \
309 init_lsa_BinaryString(&u.info ## lvl1.field1, "", 1); \
310 TESTCALL(QueryUserInfo, q); \
311 u = *info; \
312 MEM_EQUAL(u.info ## lvl1.field1.array, value, strlen(value), field1); \
313 q.in.level = lvl2; \
314 TESTCALL(QueryUserInfo, q) \
315 u = *info; \
316 MEM_EQUAL(u.info ## lvl2.field2.array, value, strlen(value), field2); \
317 } while (0)
318
319 #define TEST_USERINFO_INT_EXP(lvl1, field1, lvl2, field2, value, exp_value, fpval) do { \
320 torture_comment(tctx, "field test %d/%s vs %d/%s\n", lvl1, #field1, lvl2, #field2); \
321 q.in.level = lvl1; \
322 TESTCALL(QueryUserInfo, q) \
323 s.in.level = lvl1; \
324 s2.in.level = lvl1; \
325 u = *info; \
326 if (lvl1 == 21) { \
327 uint8_t *bits = u.info21.logon_hours.bits; \
328 ZERO_STRUCT(u.info21); \
329 if (fpval == SAMR_FIELD_LOGON_HOURS) { \
330 u.info21.logon_hours.units_per_week = 168; \
331 u.info21.logon_hours.bits = bits; \
332 } \
333 u.info21.fields_present = fpval; \
334 } \
335 u.info ## lvl1.field1 = value; \
336 TESTCALL(SetUserInfo, s) \
337 TESTCALL(SetUserInfo2, s2) \
338 u.info ## lvl1.field1 = 0; \
339 TESTCALL(QueryUserInfo, q); \
340 u = *info; \
341 INT_EQUAL(u.info ## lvl1.field1, exp_value, field1); \
342 q.in.level = lvl2; \
343 TESTCALL(QueryUserInfo, q) \
344 u = *info; \
345 INT_EQUAL(u.info ## lvl2.field2, exp_value, field1); \
346 } while (0)
347
348 #define TEST_USERINFO_INT(lvl1, field1, lvl2, field2, value, fpval) do { \
349 TEST_USERINFO_INT_EXP(lvl1, field1, lvl2, field2, value, value, fpval); \
350 } while (0)
351
352 q0.in.level = 12;
353 do { TESTCALL(QueryUserInfo, q0) } while (0);
354
355 TEST_USERINFO_STRING(2, comment, 1, comment, "xx2-1 comment", 0);
356 TEST_USERINFO_STRING(2, comment, 21, comment, "xx2-21 comment", 0);
357 TEST_USERINFO_STRING(21, comment, 21, comment, "xx21-21 comment",
358 SAMR_FIELD_COMMENT);
359
360 test_account_name = talloc_asprintf(tctx, "%sxx7-1", base_account_name);
361 TEST_USERINFO_STRING(7, account_name, 1, account_name, base_account_name, 0);
362 test_account_name = talloc_asprintf(tctx, "%sxx7-3", base_account_name);
363 TEST_USERINFO_STRING(7, account_name, 3, account_name, base_account_name, 0);
364 test_account_name = talloc_asprintf(tctx, "%sxx7-5", base_account_name);
365 TEST_USERINFO_STRING(7, account_name, 5, account_name, base_account_name, 0);
366 test_account_name = talloc_asprintf(tctx, "%sxx7-6", base_account_name);
367 TEST_USERINFO_STRING(7, account_name, 6, account_name, base_account_name, 0);
368 test_account_name = talloc_asprintf(tctx, "%sxx7-7", base_account_name);
369 TEST_USERINFO_STRING(7, account_name, 7, account_name, base_account_name, 0);
370 test_account_name = talloc_asprintf(tctx, "%sxx7-21", base_account_name);
371 TEST_USERINFO_STRING(7, account_name, 21, account_name, base_account_name, 0);
372 test_account_name = base_account_name;
373 TEST_USERINFO_STRING(21, account_name, 21, account_name, base_account_name,
374 SAMR_FIELD_ACCOUNT_NAME);
375
376 TEST_USERINFO_STRING(6, full_name, 1, full_name, "xx6-1 full_name", 0);
377 TEST_USERINFO_STRING(6, full_name, 3, full_name, "xx6-3 full_name", 0);
378 TEST_USERINFO_STRING(6, full_name, 5, full_name, "xx6-5 full_name", 0);
379 TEST_USERINFO_STRING(6, full_name, 6, full_name, "xx6-6 full_name", 0);
380 TEST_USERINFO_STRING(6, full_name, 8, full_name, "xx6-8 full_name", 0);
381 TEST_USERINFO_STRING(6, full_name, 21, full_name, "xx6-21 full_name", 0);
382 TEST_USERINFO_STRING(8, full_name, 21, full_name, "xx8-21 full_name", 0);
383 TEST_USERINFO_STRING(21, full_name, 21, full_name, "xx21-21 full_name",
384 SAMR_FIELD_FULL_NAME);
385
386 TEST_USERINFO_STRING(6, full_name, 1, full_name, "", 0);
387 TEST_USERINFO_STRING(6, full_name, 3, full_name, "", 0);
388 TEST_USERINFO_STRING(6, full_name, 5, full_name, "", 0);
389 TEST_USERINFO_STRING(6, full_name, 6, full_name, "", 0);
390 TEST_USERINFO_STRING(6, full_name, 8, full_name, "", 0);
391 TEST_USERINFO_STRING(6, full_name, 21, full_name, "", 0);
392 TEST_USERINFO_STRING(8, full_name, 21, full_name, "", 0);
393 TEST_USERINFO_STRING(21, full_name, 21, full_name, "",
394 SAMR_FIELD_FULL_NAME);
395
396 TEST_USERINFO_STRING(11, logon_script, 3, logon_script, "xx11-3 logon_script", 0);
397 TEST_USERINFO_STRING(11, logon_script, 5, logon_script, "xx11-5 logon_script", 0);
398 TEST_USERINFO_STRING(11, logon_script, 21, logon_script, "xx11-21 logon_script", 0);
399 TEST_USERINFO_STRING(21, logon_script, 21, logon_script, "xx21-21 logon_script",
400 SAMR_FIELD_LOGON_SCRIPT);
401
402 TEST_USERINFO_STRING(12, profile_path, 3, profile_path, "xx12-3 profile_path", 0);
403 TEST_USERINFO_STRING(12, profile_path, 5, profile_path, "xx12-5 profile_path", 0);
404 TEST_USERINFO_STRING(12, profile_path, 21, profile_path, "xx12-21 profile_path", 0);
405 TEST_USERINFO_STRING(21, profile_path, 21, profile_path, "xx21-21 profile_path",
406 SAMR_FIELD_PROFILE_PATH);
407
408 TEST_USERINFO_STRING(10, home_directory, 3, home_directory, "xx10-3 home_directory", 0);
409 TEST_USERINFO_STRING(10, home_directory, 5, home_directory, "xx10-5 home_directory", 0);
410 TEST_USERINFO_STRING(10, home_directory, 21, home_directory, "xx10-21 home_directory", 0);
411 TEST_USERINFO_STRING(21, home_directory, 21, home_directory, "xx21-21 home_directory",
412 SAMR_FIELD_HOME_DIRECTORY);
413 TEST_USERINFO_STRING(21, home_directory, 10, home_directory, "xx21-10 home_directory",
414 SAMR_FIELD_HOME_DIRECTORY);
415
416 TEST_USERINFO_STRING(10, home_drive, 3, home_drive, "xx10-3 home_drive", 0);
417 TEST_USERINFO_STRING(10, home_drive, 5, home_drive, "xx10-5 home_drive", 0);
418 TEST_USERINFO_STRING(10, home_drive, 21, home_drive, "xx10-21 home_drive", 0);
419 TEST_USERINFO_STRING(21, home_drive, 21, home_drive, "xx21-21 home_drive",
420 SAMR_FIELD_HOME_DRIVE);
421 TEST_USERINFO_STRING(21, home_drive, 10, home_drive, "xx21-10 home_drive",
422 SAMR_FIELD_HOME_DRIVE);
423
424 TEST_USERINFO_STRING(13, description, 1, description, "xx13-1 description", 0);
425 TEST_USERINFO_STRING(13, description, 5, description, "xx13-5 description", 0);
426 TEST_USERINFO_STRING(13, description, 21, description, "xx13-21 description", 0);
427 TEST_USERINFO_STRING(21, description, 21, description, "xx21-21 description",
428 SAMR_FIELD_DESCRIPTION);
429
430 TEST_USERINFO_STRING(14, workstations, 3, workstations, "14workstation3", 0);
431 TEST_USERINFO_STRING(14, workstations, 5, workstations, "14workstation4", 0);
432 TEST_USERINFO_STRING(14, workstations, 21, workstations, "14workstation21", 0);
433 TEST_USERINFO_STRING(21, workstations, 21, workstations, "21workstation21",
434 SAMR_FIELD_WORKSTATIONS);
435 TEST_USERINFO_STRING(21, workstations, 3, workstations, "21workstation3",
436 SAMR_FIELD_WORKSTATIONS);
437 TEST_USERINFO_STRING(21, workstations, 5, workstations, "21workstation5",
438 SAMR_FIELD_WORKSTATIONS);
439 TEST_USERINFO_STRING(21, workstations, 14, workstations, "21workstation14",
440 SAMR_FIELD_WORKSTATIONS);
441
442 TEST_USERINFO_BINARYSTRING(20, parameters, 21, parameters, "xx20-21 parameters", 0);
443 TEST_USERINFO_BINARYSTRING(21, parameters, 21, parameters, "xx21-21 parameters",
444 SAMR_FIELD_PARAMETERS);
445 TEST_USERINFO_BINARYSTRING(21, parameters, 20, parameters, "xx21-20 parameters",
446 SAMR_FIELD_PARAMETERS);
447 /* also empty user parameters are allowed */
448 TEST_USERINFO_BINARYSTRING(20, parameters, 21, parameters, "", 0);
449 TEST_USERINFO_BINARYSTRING(21, parameters, 21, parameters, "",
450 SAMR_FIELD_PARAMETERS);
451 TEST_USERINFO_BINARYSTRING(21, parameters, 20, parameters, "",
452 SAMR_FIELD_PARAMETERS);
453
454 /* Samba 3 cannot store country_code and copy_page atm. - gd */
455 if (!torture_setting_bool(tctx, "samba3", false)) {
456 TEST_USERINFO_INT(2, country_code, 2, country_code, __LINE__, 0);
457 TEST_USERINFO_INT(2, country_code, 21, country_code, __LINE__, 0);
458 TEST_USERINFO_INT(21, country_code, 21, country_code, __LINE__,
459 SAMR_FIELD_COUNTRY_CODE);
460 TEST_USERINFO_INT(21, country_code, 2, country_code, __LINE__,
461 SAMR_FIELD_COUNTRY_CODE);
462
463 TEST_USERINFO_INT(2, code_page, 21, code_page, __LINE__, 0);
464 TEST_USERINFO_INT(21, code_page, 21, code_page, __LINE__,
465 SAMR_FIELD_CODE_PAGE);
466 TEST_USERINFO_INT(21, code_page, 2, code_page, __LINE__,
467 SAMR_FIELD_CODE_PAGE);
468 }
469
470 if (!torture_setting_bool(tctx, "samba3", false)) {
471 TEST_USERINFO_INT(17, acct_expiry, 21, acct_expiry, __LINE__, 0);
472 TEST_USERINFO_INT(17, acct_expiry, 5, acct_expiry, __LINE__, 0);
473 TEST_USERINFO_INT(21, acct_expiry, 21, acct_expiry, __LINE__,
474 SAMR_FIELD_ACCT_EXPIRY);
475 TEST_USERINFO_INT(21, acct_expiry, 5, acct_expiry, __LINE__,
476 SAMR_FIELD_ACCT_EXPIRY);
477 TEST_USERINFO_INT(21, acct_expiry, 17, acct_expiry, __LINE__,
478 SAMR_FIELD_ACCT_EXPIRY);
479 } else {
480 /* Samba 3 can only store seconds / time_t in passdb - gd */
481 NTTIME nt;
482 unix_to_nt_time(&nt, time(NULL) + __LINE__);
483 TEST_USERINFO_INT(17, acct_expiry, 21, acct_expiry, nt, 0);
484 unix_to_nt_time(&nt, time(NULL) + __LINE__);
485 TEST_USERINFO_INT(17, acct_expiry, 5, acct_expiry, nt, 0);
486 unix_to_nt_time(&nt, time(NULL) + __LINE__);
487 TEST_USERINFO_INT(21, acct_expiry, 21, acct_expiry, nt, SAMR_FIELD_ACCT_EXPIRY);
488 unix_to_nt_time(&nt, time(NULL) + __LINE__);
489 TEST_USERINFO_INT(21, acct_expiry, 5, acct_expiry, nt, SAMR_FIELD_ACCT_EXPIRY);
490 unix_to_nt_time(&nt, time(NULL) + __LINE__);
491 TEST_USERINFO_INT(21, acct_expiry, 17, acct_expiry, nt, SAMR_FIELD_ACCT_EXPIRY);
492 }
493
494 TEST_USERINFO_INT(4, logon_hours.bits[3], 3, logon_hours.bits[3], 1, 0);
495 TEST_USERINFO_INT(4, logon_hours.bits[3], 5, logon_hours.bits[3], 2, 0);
496 TEST_USERINFO_INT(4, logon_hours.bits[3], 21, logon_hours.bits[3], 3, 0);
497 TEST_USERINFO_INT(21, logon_hours.bits[3], 21, logon_hours.bits[3], 4,
498 SAMR_FIELD_LOGON_HOURS);
499
500 TEST_USERINFO_INT_EXP(16, acct_flags, 5, acct_flags,
501 (base_acct_flags | ACB_DISABLED | ACB_HOMDIRREQ),
502 (base_acct_flags | ACB_DISABLED | ACB_HOMDIRREQ | user_extra_flags),
503 0);
504 TEST_USERINFO_INT_EXP(16, acct_flags, 5, acct_flags,
505 (base_acct_flags | ACB_DISABLED),
506 (base_acct_flags | ACB_DISABLED | user_extra_flags),
507 0);
508
509 /* Setting PWNOEXP clears the magic ACB_PW_EXPIRED flag */
510 TEST_USERINFO_INT_EXP(16, acct_flags, 5, acct_flags,
511 (base_acct_flags | ACB_DISABLED | ACB_PWNOEXP),
512 (base_acct_flags | ACB_DISABLED | ACB_PWNOEXP),
513 0);
514 TEST_USERINFO_INT_EXP(16, acct_flags, 21, acct_flags,
515 (base_acct_flags | ACB_DISABLED | ACB_HOMDIRREQ),
516 (base_acct_flags | ACB_DISABLED | ACB_HOMDIRREQ | user_extra_flags),
517 0);
518
519
520 /* The 'autolock' flag doesn't stick - check this */
521 TEST_USERINFO_INT_EXP(16, acct_flags, 21, acct_flags,
522 (base_acct_flags | ACB_DISABLED | ACB_AUTOLOCK),
523 (base_acct_flags | ACB_DISABLED | user_extra_flags),
524 0);
525 #if 0
526 /* Removing the 'disabled' flag doesn't stick - check this */
527 TEST_USERINFO_INT_EXP(16, acct_flags, 21, acct_flags,
528 (base_acct_flags),
529 (base_acct_flags | ACB_DISABLED | user_extra_flags),
530 0);
531 #endif
532
533 /* Samba3 cannot store these atm */
534 if (!torture_setting_bool(tctx, "samba3", false)) {
535 /* The 'store plaintext' flag does stick */
536 TEST_USERINFO_INT_EXP(16, acct_flags, 21, acct_flags,
537 (base_acct_flags | ACB_DISABLED | ACB_ENC_TXT_PWD_ALLOWED),
538 (base_acct_flags | ACB_DISABLED | ACB_ENC_TXT_PWD_ALLOWED | user_extra_flags),
539 0);
540 /* The 'use DES' flag does stick */
541 TEST_USERINFO_INT_EXP(16, acct_flags, 21, acct_flags,
542 (base_acct_flags | ACB_DISABLED | ACB_USE_DES_KEY_ONLY),
543 (base_acct_flags | ACB_DISABLED | ACB_USE_DES_KEY_ONLY | user_extra_flags),
544 0);
545 /* The 'don't require kerberos pre-authentication flag does stick */
546 TEST_USERINFO_INT_EXP(16, acct_flags, 21, acct_flags,
547 (base_acct_flags | ACB_DISABLED | ACB_DONT_REQUIRE_PREAUTH),
548 (base_acct_flags | ACB_DISABLED | ACB_DONT_REQUIRE_PREAUTH | user_extra_flags),
549 0);
550 /* The 'no kerberos PAC required' flag sticks */
551 TEST_USERINFO_INT_EXP(16, acct_flags, 21, acct_flags,
552 (base_acct_flags | ACB_DISABLED | ACB_NO_AUTH_DATA_REQD),
553 (base_acct_flags | ACB_DISABLED | ACB_NO_AUTH_DATA_REQD | user_extra_flags),
554 0);
555 }
556 TEST_USERINFO_INT_EXP(21, acct_flags, 21, acct_flags,
557 (base_acct_flags | ACB_DISABLED),
558 (base_acct_flags | ACB_DISABLED | user_extra_flags),
559 SAMR_FIELD_ACCT_FLAGS);
560
561 #if 0
562 /* these fail with win2003 - it appears you can't set the primary gid?
563 the set succeeds, but the gid isn't changed. Very weird! */
564 TEST_USERINFO_INT(9, primary_gid, 1, primary_gid, 513);
565 TEST_USERINFO_INT(9, primary_gid, 3, primary_gid, 513);
566 TEST_USERINFO_INT(9, primary_gid, 5, primary_gid, 513);
567 TEST_USERINFO_INT(9, primary_gid, 21, primary_gid, 513);
568 #endif
569
570 return ret;
571 }
572
573 /*
574 generate a random password for password change tests
575 */
576 static char *samr_rand_pass_silent(TALLOC_CTX *mem_ctx, int min_len)
577 {
578 size_t len = MAX(8, min_len) + (random() % 6);
579 char *s = generate_random_str(mem_ctx, len);
580 return s;
581 }
582
583 static char *samr_rand_pass(TALLOC_CTX *mem_ctx, int min_len)
584 {
585 char *s = samr_rand_pass_silent(mem_ctx, min_len);
586 printf("Generated password '%s'\n", s);
587 return s;
588
589 }
590
591 /*
592 generate a random password for password change tests
593 */
594 static DATA_BLOB samr_very_rand_pass(TALLOC_CTX *mem_ctx, int len)
595 {
596 int i;
597 DATA_BLOB password = data_blob_talloc(mem_ctx, NULL, len * 2 /* number of unicode chars */);
598 generate_random_buffer(password.data, password.length);
599
600 for (i=0; i < len; i++) {
601 if (((uint16_t *)password.data)[i] == 0) {
602 ((uint16_t *)password.data)[i] = 1;
603 }
604 }
605
606 return password;
607 }
608
609 /*
610 generate a random password for password change tests (fixed length)
611 */
612 static char *samr_rand_pass_fixed_len(TALLOC_CTX *mem_ctx, int len)
613 {
614 char *s = generate_random_str(mem_ctx, len);
615 printf("Generated password '%s'\n", s);
616 return s;
617 }
618
619 static bool test_SetUserPass(struct dcerpc_pipe *p, struct torture_context *tctx,
620 struct policy_handle *handle, char **password)
621 {
622 NTSTATUS status;
623 struct samr_SetUserInfo s;
624 union samr_UserInfo u;
625 bool ret = true;
626 DATA_BLOB session_key;
627 char *newpass;
628 struct samr_GetUserPwInfo pwp;
629 struct samr_PwInfo info;
630 int policy_min_pw_len = 0;
631 pwp.in.user_handle = handle;
632 pwp.out.info = &info;
633
634 status = dcerpc_samr_GetUserPwInfo(p, tctx, &pwp);
635 if (NT_STATUS_IS_OK(status)) {
636 policy_min_pw_len = pwp.out.info->min_password_length;
637 }
638 newpass = samr_rand_pass(tctx, policy_min_pw_len);
639
640 s.in.user_handle = handle;
641 s.in.info = &u;
642 s.in.level = 24;
643
644 encode_pw_buffer(u.info24.password.data, newpass, STR_UNICODE);
645 u.info24.password_expired = 0;
646
647 status = dcerpc_fetch_session_key(p, &session_key);
648 if (!NT_STATUS_IS_OK(status)) {
649 torture_warning(tctx, "SetUserInfo level %u - no session key - %s\n",
650 s.in.level, nt_errstr(status));
651 return false;
652 }
653
654 arcfour_crypt_blob(u.info24.password.data, 516, &session_key);
655
656 torture_comment(tctx, "Testing SetUserInfo level 24 (set password)\n");
657
658 status = dcerpc_samr_SetUserInfo(p, tctx, &s);
659 if (!NT_STATUS_IS_OK(status)) {
660 torture_warning(tctx, "SetUserInfo level %u failed - %s\n",
661 s.in.level, nt_errstr(status));
662 ret = false;
663 } else {
664 *password = newpass;
665 }
666
667 return ret;
668 }
669
670
671 static bool test_SetUserPass_23(struct dcerpc_pipe *p, struct torture_context *tctx,
672 struct policy_handle *handle, uint32_t fields_present,
673 char **password)
674 {
675 NTSTATUS status;
676 struct samr_SetUserInfo s;
677 union samr_UserInfo u;
678 bool ret = true;
679 DATA_BLOB session_key;
680 char *newpass;
681 struct samr_GetUserPwInfo pwp;
682 struct samr_PwInfo info;
683 int policy_min_pw_len = 0;
684 pwp.in.user_handle = handle;
685 pwp.out.info = &info;
686
687 status = dcerpc_samr_GetUserPwInfo(p, tctx, &pwp);
688 if (NT_STATUS_IS_OK(status)) {
689 policy_min_pw_len = pwp.out.info->min_password_length;
690 }
691 newpass = samr_rand_pass(tctx, policy_min_pw_len);
692
693 s.in.user_handle = handle;
694 s.in.info = &u;
695 s.in.level = 23;
696
697 ZERO_STRUCT(u);
698
699 u.info23.info.fields_present = fields_present;
700
701 encode_pw_buffer(u.info23.password.data, newpass, STR_UNICODE);
702
703 status = dcerpc_fetch_session_key(p, &session_key);
704 if (!NT_STATUS_IS_OK(status)) {
705 torture_warning(tctx, "SetUserInfo level %u - no session key - %s\n",
706 s.in.level, nt_errstr(status));
707 return false;
708 }
709
710 arcfour_crypt_blob(u.info23.password.data, 516, &session_key);
711
712 torture_comment(tctx, "Testing SetUserInfo level 23 (set password)\n");
713
714 status = dcerpc_samr_SetUserInfo(p, tctx, &s);
715 if (!NT_STATUS_IS_OK(status)) {
716 torture_warning(tctx, "SetUserInfo level %u failed - %s\n",
717 s.in.level, nt_errstr(status));
718 ret = false;
719 } else {
720 *password = newpass;
721 }
722
723 encode_pw_buffer(u.info23.password.data, newpass, STR_UNICODE);
724
725 status = dcerpc_fetch_session_key(p, &session_key);
726 if (!NT_STATUS_IS_OK(status)) {
727 torture_warning(tctx, "SetUserInfo level %u - no session key - %s\n",
728 s.in.level, nt_errstr(status));
729 return false;
730 }
731
732 /* This should break the key nicely */
733 session_key.length--;
734 arcfour_crypt_blob(u.info23.password.data, 516, &session_key);
735
736 torture_comment(tctx, "Testing SetUserInfo level 23 (set password) with wrong password\n");
737
738 status = dcerpc_samr_SetUserInfo(p, tctx, &s);
739 if (!NT_STATUS_EQUAL(status, NT_STATUS_WRONG_PASSWORD)) {
740 torture_warning(tctx, "SetUserInfo level %u should have failed with WRONG_PASSWORD- %s\n",
741 s.in.level, nt_errstr(status));
742 ret = false;
743 }
744
745 return ret;
746 }
747
748
749 static bool test_SetUserPassEx(struct dcerpc_pipe *p, struct torture_context *tctx,
750 struct policy_handle *handle, bool makeshort,
751 char **password)
752 {
753 NTSTATUS status;
754 struct samr_SetUserInfo s;
755 union samr_UserInfo u;
756 bool ret = true;
757 DATA_BLOB session_key;
758 DATA_BLOB confounded_session_key = data_blob_talloc(tctx, NULL, 16);
759 uint8_t confounder[16];
760 char *newpass;
761 struct MD5Context ctx;
762 struct samr_GetUserPwInfo pwp;
763 struct samr_PwInfo info;
764 int policy_min_pw_len = 0;
765 pwp.in.user_handle = handle;
766 pwp.out.info = &info;
767
768 status = dcerpc_samr_GetUserPwInfo(p, tctx, &pwp);
769 if (NT_STATUS_IS_OK(status)) {
770 policy_min_pw_len = pwp.out.info->min_password_length;
771 }
772 if (makeshort && policy_min_pw_len) {
773 newpass = samr_rand_pass_fixed_len(tctx, policy_min_pw_len - 1);
774 } else {
775 newpass = samr_rand_pass(tctx, policy_min_pw_len);
776 }
777
778 s.in.user_handle = handle;
779 s.in.info = &u;
780 s.in.level = 26;
781
782 encode_pw_buffer(u.info26.password.data, newpass, STR_UNICODE);
783 u.info26.password_expired = 0;
784
785 status = dcerpc_fetch_session_key(p, &session_key);
786 if (!NT_STATUS_IS_OK(status)) {
787 torture_warning(tctx, "SetUserInfo level %u - no session key - %s\n",
788 s.in.level, nt_errstr(status));
789 return false;
790 }
791
792 generate_random_buffer((uint8_t *)confounder, 16);
793
794 MD5Init(&ctx);
795 MD5Update(&ctx, confounder, 16);
796 MD5Update(&ctx, session_key.data, session_key.length);
797 MD5Final(confounded_session_key.data, &ctx);
798
799 arcfour_crypt_blob(u.info26.password.data, 516, &confounded_session_key);
800 memcpy(&u.info26.password.data[516], confounder, 16);
801
802 torture_comment(tctx, "Testing SetUserInfo level 26 (set password ex)\n");
803
804 status = dcerpc_samr_SetUserInfo(p, tctx, &s);
805 if (!NT_STATUS_IS_OK(status)) {
806 torture_warning(tctx, "SetUserInfo level %u failed - %s\n",
807 s.in.level, nt_errstr(status));
808 ret = false;
809 } else {
810 *password = newpass;
811 }
812
813 /* This should break the key nicely */
814 confounded_session_key.data[0]++;
815
816 arcfour_crypt_blob(u.info26.password.data, 516, &confounded_session_key);
817 memcpy(&u.info26.password.data[516], confounder, 16);
818
819 torture_comment(tctx, "Testing SetUserInfo level 26 (set password ex) with wrong session key\n");
820
821 status = dcerpc_samr_SetUserInfo(p, tctx, &s);
822 if (!NT_STATUS_EQUAL(status, NT_STATUS_WRONG_PASSWORD)) {
823 torture_warning(tctx, "SetUserInfo level %u should have failed with WRONG_PASSWORD: %s\n",
824 s.in.level, nt_errstr(status));
825 ret = false;
826 } else {
827 *password = newpass;
828 }
829
830 return ret;
831 }
832
833 static bool test_SetUserPass_25(struct dcerpc_pipe *p, struct torture_context *tctx,
834 struct policy_handle *handle, uint32_t fields_present,
835 char **password)
836 {
837 NTSTATUS status;
838 struct samr_SetUserInfo s;
839 union samr_UserInfo u;
840 bool ret = true;
841 DATA_BLOB session_key;
842 DATA_BLOB confounded_session_key = data_blob_talloc(tctx, NULL, 16);
843 struct MD5Context ctx;
844 uint8_t confounder[16];
845 char *newpass;
846 struct samr_GetUserPwInfo pwp;
847 struct samr_PwInfo info;
848 int policy_min_pw_len = 0;
849 pwp.in.user_handle = handle;
850 pwp.out.info = &info;
851
852 status = dcerpc_samr_GetUserPwInfo(p, tctx, &pwp);
853 if (NT_STATUS_IS_OK(status)) {
854 policy_min_pw_len = pwp.out.info->min_password_length;
855 }
856 newpass = samr_rand_pass(tctx, policy_min_pw_len);
857
858 s.in.user_handle = handle;
859 s.in.info = &u;
860 s.in.level = 25;
861
862 ZERO_STRUCT(u);
863
864 u.info25.info.fields_present = fields_present;
865
866 encode_pw_buffer(u.info25.password.data, newpass, STR_UNICODE);
867
868 status = dcerpc_fetch_session_key(p, &session_key);
869 if (!NT_STATUS_IS_OK(status)) {
870 torture_warning(tctx, "SetUserInfo level %u - no session key - %s\n",
871 s.in.level, nt_errstr(status));
872 return false;
873 }
874
875 generate_random_buffer((uint8_t *)confounder, 16);
876
877 MD5Init(&ctx);
878 MD5Update(&ctx, confounder, 16);
879 MD5Update(&ctx, session_key.data, session_key.length);
880 MD5Final(confounded_session_key.data, &ctx);
881
882 arcfour_crypt_blob(u.info25.password.data, 516, &confounded_session_key);
883 memcpy(&u.info25.password.data[516], confounder, 16);
884
885 torture_comment(tctx, "Testing SetUserInfo level 25 (set password ex)\n");
886
887 status = dcerpc_samr_SetUserInfo(p, tctx, &s);
888 if (!NT_STATUS_IS_OK(status)) {
889 torture_warning(tctx, "SetUserInfo level %u failed - %s\n",
890 s.in.level, nt_errstr(status));
891 ret = false;
892 } else {
893 *password = newpass;
894 }
895
896 /* This should break the key nicely */
897 confounded_session_key.data[0]++;
898
899 arcfour_crypt_blob(u.info25.password.data, 516, &confounded_session_key);
900 memcpy(&u.info25.password.data[516], confounder, 16);
901
902 torture_comment(tctx, "Testing SetUserInfo level 25 (set password ex) with wrong session key\n");
903
904 status = dcerpc_samr_SetUserInfo(p, tctx, &s);
905 if (!NT_STATUS_EQUAL(status, NT_STATUS_WRONG_PASSWORD)) {
906 torture_warning(tctx, "SetUserInfo level %u should have failed with WRONG_PASSWORD- %s\n",
907 s.in.level, nt_errstr(status));
908 ret = false;
909 }
910
911 return ret;
912 }
913
914 static bool test_SetUserPass_18(struct dcerpc_pipe *p, struct torture_context *tctx,
915 struct policy_handle *handle, char **password)
916 {
917 NTSTATUS status;
918 struct samr_SetUserInfo s;
919 union samr_UserInfo u;
920 bool ret = true;
921 DATA_BLOB session_key;
922 char *newpass;
923 struct samr_GetUserPwInfo pwp;
924 struct samr_PwInfo info;
925 int policy_min_pw_len = 0;
926 uint8_t lm_hash[16], nt_hash[16];
927
928 pwp.in.user_handle = handle;
929 pwp.out.info = &info;
930
931 status = dcerpc_samr_GetUserPwInfo(p, tctx, &pwp);
932 if (NT_STATUS_IS_OK(status)) {
933 policy_min_pw_len = pwp.out.info->min_password_length;
934 }
935 newpass = samr_rand_pass(tctx, policy_min_pw_len);
936
937 s.in.user_handle = handle;
938 s.in.info = &u;
939 s.in.level = 18;
940
941 ZERO_STRUCT(u);
942
943 u.info18.nt_pwd_active = true;
944 u.info18.lm_pwd_active = true;
945
946 E_md4hash(newpass, nt_hash);
947 E_deshash(newpass, lm_hash);
948
949 status = dcerpc_fetch_session_key(p, &session_key);
950 if (!NT_STATUS_IS_OK(status)) {
951 torture_warning(tctx, "SetUserInfo level %u - no session key - %s\n",
952 s.in.level, nt_errstr(status));
953 return false;
954 }
955
956 {
957 DATA_BLOB in,out;
958 in = data_blob_const(nt_hash, 16);
959 out = data_blob_talloc_zero(tctx, 16);
960 sess_crypt_blob(&out, &in, &session_key, true);
961 memcpy(u.info18.nt_pwd.hash, out.data, out.length);
962 }
963 {
964 DATA_BLOB in,out;
965 in = data_blob_const(lm_hash, 16);
966 out = data_blob_talloc_zero(tctx, 16);
967 sess_crypt_blob(&out, &in, &session_key, true);
968 memcpy(u.info18.lm_pwd.hash, out.data, out.length);
969 }
970
971 torture_comment(tctx, "Testing SetUserInfo level 18 (set password hash)\n");
972
973 status = dcerpc_samr_SetUserInfo(p, tctx, &s);
974 if (!NT_STATUS_IS_OK(status)) {
975 torture_warning(tctx, "SetUserInfo level %u failed - %s\n",
976 s.in.level, nt_errstr(status));
977 ret = false;
978 } else {
979 *password = newpass;
980 }
981
982 return ret;
983 }
984
985 static bool test_SetUserPass_21(struct dcerpc_pipe *p, struct torture_context *tctx,
986 struct policy_handle *handle, uint32_t fields_present,
987 char **password)
988 {
989 NTSTATUS status;
990 struct samr_SetUserInfo s;
991 union samr_UserInfo u;
992 bool ret = true;
993 DATA_BLOB session_key;
994 char *newpass;
995 struct samr_GetUserPwInfo pwp;
996 struct samr_PwInfo info;
997 int policy_min_pw_len = 0;
998 uint8_t lm_hash[16], nt_hash[16];
999
1000 pwp.in.user_handle = handle;
1001 pwp.out.info = &info;
1002
1003 status = dcerpc_samr_GetUserPwInfo(p, tctx, &pwp);
1004 if (NT_STATUS_IS_OK(status)) {
1005 policy_min_pw_len = pwp.out.info->min_password_length;
1006 }
1007 newpass = samr_rand_pass(tctx, policy_min_pw_len);
1008
1009 s.in.user_handle = handle;
1010 s.in.info = &u;
1011 s.in.level = 21;
1012
1013 E_md4hash(newpass, nt_hash);
1014 E_deshash(newpass, lm_hash);
1015
1016 ZERO_STRUCT(u);
1017
1018 u.info21.fields_present = fields_present;
1019
1020 if (fields_present & SAMR_FIELD_LM_PASSWORD_PRESENT) {
1021 u.info21.lm_owf_password.length = 16;
1022 u.info21.lm_owf_password.size = 16;
1023 u.info21.lm_owf_password.array = (uint16_t *)lm_hash;
1024 u.info21.lm_password_set = true;
1025 }
1026
1027 if (fields_present & SAMR_FIELD_NT_PASSWORD_PRESENT) {
1028 u.info21.nt_owf_password.length = 16;
1029 u.info21.nt_owf_password.size = 16;
1030 u.info21.nt_owf_password.array = (uint16_t *)nt_hash;
1031 u.info21.nt_password_set = true;
1032 }
1033
1034 status = dcerpc_fetch_session_key(p, &session_key);
1035 if (!NT_STATUS_IS_OK(status)) {
1036 torture_warning(tctx, "SetUserInfo level %u - no session key - %s\n",
1037 s.in.level, nt_errstr(status));
1038 return false;
1039 }
1040
1041 if (fields_present & SAMR_FIELD_LM_PASSWORD_PRESENT) {
1042 DATA_BLOB in,out;
1043 in = data_blob_const(u.info21.lm_owf_password.array,
1044 u.info21.lm_owf_password.length);
1045 out = data_blob_talloc_zero(tctx, 16);
1046 sess_crypt_blob(&out, &in, &session_key, true);
1047 u.info21.lm_owf_password.array = (uint16_t *)out.data;
1048 }
1049
1050 if (fields_present & SAMR_FIELD_NT_PASSWORD_PRESENT) {
1051 DATA_BLOB in,out;
1052 in = data_blob_const(u.info21.nt_owf_password.array,
1053 u.info21.nt_owf_password.length);
1054 out = data_blob_talloc_zero(tctx, 16);
1055 sess_crypt_blob(&out, &in, &session_key, true);
1056 u.info21.nt_owf_password.array = (uint16_t *)out.data;
1057 }
1058
1059 torture_comment(tctx, "Testing SetUserInfo level 21 (set password hash)\n");
1060
1061 status = dcerpc_samr_SetUserInfo(p, tctx, &s);
1062 if (!NT_STATUS_IS_OK(status)) {
1063 torture_warning(tctx, "SetUserInfo level %u failed - %s\n",
1064 s.in.level, nt_errstr(status));
1065 ret = false;
1066 } else {
1067 *password = newpass;
1068 }
1069
1070 /* try invalid length */
1071 if (fields_present & SAMR_FIELD_NT_PASSWORD_PRESENT) {
1072
1073 u.info21.nt_owf_password.length++;
1074
1075 status = dcerpc_samr_SetUserInfo(p, tctx, &s);
1076
1077 if (!NT_STATUS_EQUAL(status, NT_STATUS_INVALID_PARAMETER)) {
1078 torture_warning(tctx, "SetUserInfo level %u should have failed with NT_STATUS_INVALID_PARAMETER - %s\n",
1079 s.in.level, nt_errstr(status));
1080 ret = false;
1081 }
1082 }
1083
1084 if (fields_present & SAMR_FIELD_LM_PASSWORD_PRESENT) {
1085
1086 u.info21.lm_owf_password.length++;
1087
1088 status = dcerpc_samr_SetUserInfo(p, tctx, &s);
1089
1090 if (!NT_STATUS_EQUAL(status, NT_STATUS_INVALID_PARAMETER)) {
1091 torture_warning(tctx, "SetUserInfo level %u should have failed with NT_STATUS_INVALID_PARAMETER - %s\n",
1092 s.in.level, nt_errstr(status));
1093 ret = false;
1094 }
1095 }
1096
1097 return ret;
1098 }
1099
1100 static bool test_SetUserPass_level_ex(struct dcerpc_pipe *p,
1101 struct torture_context *tctx,
1102 struct policy_handle *handle,
1103 uint16_t level,
1104 uint32_t fields_present,
1105 char **password, uint8_t password_expired,
1106 bool use_setinfo2,
1107 bool *matched_expected_error)
1108 {
1109 NTSTATUS status;
1110 NTSTATUS expected_error = NT_STATUS_OK;
1111 struct samr_SetUserInfo s;
1112 struct samr_SetUserInfo2 s2;
1113 union samr_UserInfo u;
1114 bool ret = true;
1115 DATA_BLOB session_key;
1116 DATA_BLOB confounded_session_key = data_blob_talloc(tctx, NULL, 16);
1117 struct MD5Context ctx;
1118 uint8_t confounder[16];
1119 char *newpass;
1120 struct samr_GetUserPwInfo pwp;
1121 struct samr_PwInfo info;
1122 int policy_min_pw_len = 0;
1123 const char *comment = NULL;
1124 uint8_t lm_hash[16], nt_hash[16];
1125
1126 pwp.in.user_handle = handle;
1127 pwp.out.info = &info;
1128
1129 status = dcerpc_samr_GetUserPwInfo(p, tctx, &pwp);
1130 if (NT_STATUS_IS_OK(status)) {
1131 policy_min_pw_len = pwp.out.info->min_password_length;
1132 }
1133 newpass = samr_rand_pass_silent(tctx, policy_min_pw_len);
1134
1135 if (use_setinfo2) {
1136 s2.in.user_handle = handle;
1137 s2.in.info = &u;
1138 s2.in.level = level;
1139 } else {
1140 s.in.user_handle = handle;
1141 s.in.info = &u;
1142 s.in.level = level;
1143 }
1144
1145 if (fields_present & SAMR_FIELD_COMMENT) {
1146 comment = talloc_asprintf(tctx, "comment: %ld\n", time(NULL));
1147 }
1148
1149 ZERO_STRUCT(u);
1150
1151 switch (level) {
1152 case 18:
1153 E_md4hash(newpass, nt_hash);
1154 E_deshash(newpass, lm_hash);
1155
1156 u.info18.nt_pwd_active = true;
1157 u.info18.lm_pwd_active = true;
1158 u.info18.password_expired = password_expired;
1159
1160 memcpy(u.info18.lm_pwd.hash, lm_hash, 16);
1161 memcpy(u.info18.nt_pwd.hash, nt_hash, 16);
1162
1163 break;
1164 case 21:
1165 E_md4hash(newpass, nt_hash);
1166 E_deshash(newpass, lm_hash);
1167
1168 u.info21.fields_present = fields_present;
1169 u.info21.password_expired = password_expired;
1170 u.info21.comment.string = comment;
1171
1172 if (fields_present & SAMR_FIELD_LM_PASSWORD_PRESENT) {
1173 u.info21.lm_owf_password.length = 16;
1174 u.info21.lm_owf_password.size = 16;
1175 u.info21.lm_owf_password.array = (uint16_t *)lm_hash;
1176 u.info21.lm_password_set = true;
1177 }
1178
1179 if (fields_present & SAMR_FIELD_NT_PASSWORD_PRESENT) {
1180 u.info21.nt_owf_password.length = 16;
1181 u.info21.nt_owf_password.size = 16;
1182 u.info21.nt_owf_password.array = (uint16_t *)nt_hash;
1183 u.info21.nt_password_set = true;
1184 }
1185
1186 break;
1187 case 23:
1188 u.info23.info.fields_present = fields_present;
1189 u.info23.info.password_expired = password_expired;
1190 u.info23.info.comment.string = comment;
1191
1192 encode_pw_buffer(u.info23.password.data, newpass, STR_UNICODE);
1193
1194 break;
1195 case 24:
1196 u.info24.password_expired = password_expired;
1197
1198 encode_pw_buffer(u.info24.password.data, newpass, STR_UNICODE);
1199
1200 break;
1201 case 25:
1202 u.info25.info.fields_present = fields_present;
1203 u.info25.info.password_expired = password_expired;
1204 u.info25.info.comment.string = comment;
1205
1206 encode_pw_buffer(u.info25.password.data, newpass, STR_UNICODE);
1207
1208 break;
1209 case 26:
1210 u.info26.password_expired = password_expired;
1211
1212 encode_pw_buffer(u.info26.password.data, newpass, STR_UNICODE);
1213
1214 break;
1215 }
1216
1217 status = dcerpc_fetch_session_key(p, &session_key);
1218 if (!NT_STATUS_IS_OK(status)) {
1219 torture_warning(tctx, "SetUserInfo level %u - no session key - %s\n",
1220 s.in.level, nt_errstr(status));
1221 return false;
1222 }
1223
1224 generate_random_buffer((uint8_t *)confounder, 16);
1225
1226 MD5Init(&ctx);
1227 MD5Update(&ctx, confounder, 16);
1228 MD5Update(&ctx, session_key.data, session_key.length);
1229 MD5Final(confounded_session_key.data, &ctx);
1230
1231 switch (level) {
1232 case 18:
1233 {
1234 DATA_BLOB in,out;
1235 in = data_blob_const(u.info18.nt_pwd.hash, 16);
1236 out = data_blob_talloc_zero(tctx, 16);
1237 sess_crypt_blob(&out, &in, &session_key, true);
1238 memcpy(u.info18.nt_pwd.hash, out.data, out.length);
1239 }
1240 {
1241 DATA_BLOB in,out;
1242 in = data_blob_const(u.info18.lm_pwd.hash, 16);
1243 out = data_blob_talloc_zero(tctx, 16);
1244 sess_crypt_blob(&out, &in, &session_key, true);
1245 memcpy(u.info18.lm_pwd.hash, out.data, out.length);
1246 }
1247
1248 break;
1249 case 21:
1250 if (fields_present & SAMR_FIELD_LM_PASSWORD_PRESENT) {
1251 DATA_BLOB in,out;
1252 in = data_blob_const(u.info21.lm_owf_password.array,
1253 u.info21.lm_owf_password.length);
1254 out = data_blob_talloc_zero(tctx, 16);
1255 sess_crypt_blob(&out, &in, &session_key, true);
1256 u.info21.lm_owf_password.array = (uint16_t *)out.data;
1257 }
1258 if (fields_present & SAMR_FIELD_NT_PASSWORD_PRESENT) {
1259 DATA_BLOB in,out;
1260 in = data_blob_const(u.info21.nt_owf_password.array,
1261 u.info21.nt_owf_password.length);
1262 out = data_blob_talloc_zero(tctx, 16);
1263 sess_crypt_blob(&out, &in, &session_key, true);
1264 u.info21.nt_owf_password.array = (uint16_t *)out.data;
1265 }
1266 break;
1267 case 23:
1268 arcfour_crypt_blob(u.info23.password.data, 516, &session_key);
1269 break;
1270 case 24:
1271 arcfour_crypt_blob(u.info24.password.data, 516, &session_key);
1272 break;
1273 case 25:
1274 arcfour_crypt_blob(u.info25.password.data, 516, &confounded_session_key);
1275 memcpy(&u.info25.password.data[516], confounder, 16);
1276 break;
1277 case 26:
1278 arcfour_crypt_blob(u.info26.password.data, 516, &confounded_session_key);
1279 memcpy(&u.info26.password.data[516], confounder, 16);
1280 break;
1281 }
1282
1283 if (use_setinfo2) {
1284 status = dcerpc_samr_SetUserInfo2(p, tctx, &s2);
1285 } else {
1286 status = dcerpc_samr_SetUserInfo(p, tctx, &s);
1287 }
1288
1289 if (!NT_STATUS_IS_OK(status)) {
1290 if (fields_present == 0) {
1291 expected_error = NT_STATUS_INVALID_PARAMETER;
1292 }
1293 if (fields_present & SAMR_FIELD_LAST_PWD_CHANGE) {
1294 expected_error = NT_STATUS_ACCESS_DENIED;
1295 }
1296 }
1297
1298 if (!NT_STATUS_IS_OK(expected_error)) {
1299 if (use_setinfo2) {
1300 torture_assert_ntstatus_equal(tctx,
1301 s2.out.result,
1302 expected_error, "SetUserInfo2 failed");
1303 } else {
1304 torture_assert_ntstatus_equal(tctx,
1305 s.out.result,
1306 expected_error, "SetUserInfo failed");
1307 }
1308 *matched_expected_error = true;
1309 return true;
1310 }
1311
1312 if (!NT_STATUS_IS_OK(status)) {
1313 torture_warning(tctx, "SetUserInfo%s level %u failed - %s\n",
1314 use_setinfo2 ? "2":"", level, nt_errstr(status));
1315 ret = false;
1316 } else {
1317 *password = newpass;
1318 }
1319
1320 return ret;
1321 }
1322
1323 static bool test_SetAliasInfo(struct dcerpc_pipe *p, struct torture_context *tctx,
1324 struct policy_handle *handle)
1325 {
1326 NTSTATUS status;
1327 struct samr_SetAliasInfo r;
1328 struct samr_QueryAliasInfo q;
1329 union samr_AliasInfo *info;
1330 uint16_t levels[] = {2, 3};
1331 int i;
1332 bool ret = true;
1333
1334 /* Ignoring switch level 1, as that includes the number of members for the alias
1335 * and setting this to a wrong value might have negative consequences
1336 */
1337
1338 for (i=0;i<ARRAY_SIZE(levels);i++) {
1339 torture_comment(tctx, "Testing SetAliasInfo level %u\n", levels[i]);
1340
1341 r.in.alias_handle = handle;
1342 r.in.level = levels[i];
1343 r.in.info = talloc(tctx, union samr_AliasInfo);
1344 switch (r.in.level) {
1345 case ALIASINFONAME: init_lsa_String(&r.in.info->name,TEST_ALIASNAME); break;
1346 case ALIASINFODESCRIPTION: init_lsa_String(&r.in.info->description,
1347 "Test Description, should test I18N as well"); break;
1348 case ALIASINFOALL: torture_comment(tctx, "ALIASINFOALL ignored\n"); break;
1349 }
1350
1351 status = dcerpc_samr_SetAliasInfo(p, tctx, &r);
1352 if (!NT_STATUS_IS_OK(status)) {
1353 torture_warning(tctx, "SetAliasInfo level %u failed - %s\n",
1354 levels[i], nt_errstr(status));
1355 ret = false;
1356 }
1357
1358 q.in.alias_handle = handle;
1359 q.in.level = levels[i];
1360 q.out.info = &info;
1361
1362 status = dcerpc_samr_QueryAliasInfo(p, tctx, &q);
1363 if (!NT_STATUS_IS_OK(status)) {
1364 torture_warning(tctx, "QueryAliasInfo level %u failed - %s\n",
1365 levels[i], nt_errstr(status));
1366 ret = false;
1367 }
1368 }
1369
1370 return ret;
1371 }
1372
1373 static bool test_GetGroupsForUser(struct dcerpc_pipe *p, struct torture_context *tctx,
1374 struct policy_handle *user_handle)
1375 {
1376 struct samr_GetGroupsForUser r;
1377 struct samr_RidWithAttributeArray *rids = NULL;
1378 NTSTATUS status;
1379
1380 torture_comment(tctx, "testing GetGroupsForUser\n");
1381
1382 r.in.user_handle = user_handle;
1383 r.out.rids = &rids;
1384
1385 status = dcerpc_samr_GetGroupsForUser(p, tctx, &r);
1386 torture_assert_ntstatus_ok(tctx, status, "GetGroupsForUser");
1387
1388 return true;
1389
1390 }
1391
1392 static bool test_GetDomPwInfo(struct dcerpc_pipe *p, struct torture_context *tctx,
1393 struct lsa_String *domain_name)
1394 {
1395 NTSTATUS status;
1396 struct samr_GetDomPwInfo r;
1397 struct samr_PwInfo info;
1398
1399 r.in.domain_name = domain_name;
1400 r.out.info = &info;
1401
1402 torture_comment(tctx, "Testing GetDomPwInfo with name %s\n", r.in.domain_name->string);
1403
1404 status = dcerpc_samr_GetDomPwInfo(p, tctx, &r);
1405 torture_assert_ntstatus_ok(tctx, status, "GetDomPwInfo");
1406
1407 r.in.domain_name->string = talloc_asprintf(tctx, "\\\\%s", dcerpc_server_name(p));
1408 torture_comment(tctx, "Testing GetDomPwInfo with name %s\n", r.in.domain_name->string);
1409
1410 status = dcerpc_samr_GetDomPwInfo(p, tctx, &r);
1411 torture_assert_ntstatus_ok(tctx, status, "GetDomPwInfo");
1412
1413 r.in.domain_name->string = "\\\\__NONAME__";
1414 torture_comment(tctx, "Testing GetDomPwInfo with name %s\n", r.in.domain_name->string);
1415
1416 status = dcerpc_samr_GetDomPwInfo(p, tctx, &r);
1417 torture_assert_ntstatus_ok(tctx, status, "GetDomPwInfo");
1418
1419 r.in.domain_name->string = "\\\\Builtin";
1420 torture_comment(tctx, "Testing GetDomPwInfo with name %s\n", r.in.domain_name->string);
1421
1422 status = dcerpc_samr_GetDomPwInfo(p, tctx, &r);
1423 torture_assert_ntstatus_ok(tctx, status, "GetDomPwInfo");
1424
1425 return true;
1426 }
1427
1428 static bool test_GetUserPwInfo(struct dcerpc_pipe *p, struct torture_context *tctx,
1429 struct policy_handle *handle)
1430 {
1431 NTSTATUS status;
1432 struct samr_GetUserPwInfo r;
1433 struct samr_PwInfo info;
1434
1435 torture_comment(tctx, "Testing GetUserPwInfo\n");
1436
1437 r.in.user_handle = handle;
1438 r.out.info = &info;
1439
1440 status = dcerpc_samr_GetUserPwInfo(p, tctx, &r);
1441 torture_assert_ntstatus_ok(tctx, status, "GetUserPwInfo");
1442
1443 return true;
1444 }
1445
1446 static NTSTATUS test_LookupName(struct dcerpc_pipe *p, struct torture_context *tctx,
1447 struct policy_handle *domain_handle, const char *name,
1448 uint32_t *rid)
1449 {
1450 NTSTATUS status;
1451 struct samr_LookupNames n;
1452 struct lsa_String sname[2];
1453 struct samr_Ids rids, types;
1454
1455 init_lsa_String(&sname[0], name);
1456
1457 n.in.domain_handle = domain_handle;
1458 n.in.num_names = 1;
1459 n.in.names = sname;
1460 n.out.rids = &rids;
1461 n.out.types = &types;
1462 status = dcerpc_samr_LookupNames(p, tctx, &n);
1463 if (NT_STATUS_IS_OK(status)) {
1464 *rid = n.out.rids->ids[0];
1465 } else {
1466 return status;
1467 }
1468
1469 init_lsa_String(&sname[1], "xxNONAMExx");
1470 n.in.num_names = 2;
1471 status = dcerpc_samr_LookupNames(p, tctx, &n);
1472 if (!NT_STATUS_EQUAL(status, STATUS_SOME_UNMAPPED)) {
1473 torture_warning(tctx, "LookupNames[2] failed - %s\n", nt_errstr(status));
1474 if (NT_STATUS_IS_OK(status)) {
1475 return NT_STATUS_UNSUCCESSFUL;
1476 }
1477 return status;
1478 }
1479
1480 n.in.num_names = 0;
1481 status = dcerpc_samr_LookupNames(p, tctx, &n);
1482 if (!NT_STATUS_IS_OK(status)) {
1483 torture_warning(tctx, "LookupNames[0] failed - %s\n", nt_errstr(status));
1484 return status;
1485 }
1486
1487 init_lsa_String(&sname[0], "xxNONAMExx");
1488 n.in.num_names = 1;
1489 status = dcerpc_samr_LookupNames(p, tctx, &n);
1490 if (!NT_STATUS_EQUAL(status, NT_STATUS_NONE_MAPPED)) {
1491 torture_warning(tctx, "LookupNames[1 bad name] failed - %s\n", nt_errstr(status));
1492 if (NT_STATUS_IS_OK(status)) {
1493 return NT_STATUS_UNSUCCESSFUL;
1494 }
1495 return status;
1496 }
1497
1498 init_lsa_String(&sname[0], "xxNONAMExx");
1499 init_lsa_String(&sname[1], "xxNONAME2xx");
1500 n.in.num_names = 2;
1501 status = dcerpc_samr_LookupNames(p, tctx, &n);
1502 if (!NT_STATUS_EQUAL(status, NT_STATUS_NONE_MAPPED)) {
1503 torture_warning(tctx, "LookupNames[2 bad names] failed - %s\n", nt_errstr(status));
1504 if (NT_STATUS_IS_OK(status)) {
1505 return NT_STATUS_UNSUCCESSFUL;
1506 }
1507 return status;
1508 }
1509
1510 return NT_STATUS_OK;
1511 }
1512
1513 static NTSTATUS test_OpenUser_byname(struct dcerpc_pipe *p,
1514 struct torture_context *tctx,
1515 struct policy_handle *domain_handle,
1516 const char *name, struct policy_handle *user_handle)
1517 {
1518 NTSTATUS status;
1519 struct samr_OpenUser r;
1520 uint32_t rid;
1521
1522 status = test_LookupName(p, tctx, domain_handle, name, &rid);
1523 if (!NT_STATUS_IS_OK(status)) {
1524 return status;
1525 }
1526
1527 r.in.domain_handle = domain_handle;
1528 r.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
1529 r.in.rid = rid;
1530 r.out.user_handle = user_handle;
1531 status = dcerpc_samr_OpenUser(p, tctx, &r);
1532 if (!NT_STATUS_IS_OK(status)) {
1533 torture_warning(tctx, "OpenUser_byname(%s -> %d) failed - %s\n", name, rid, nt_errstr(status));
1534 }
1535
1536 return status;
1537 }
1538
1539 #if 0
1540 static bool test_ChangePasswordNT3(struct dcerpc_pipe *p,
1541 struct torture_context *tctx,
1542 struct policy_handle *handle)
1543 {
1544 NTSTATUS status;
1545 struct samr_ChangePasswordUser r;
1546 bool ret = true;
1547 struct samr_Password hash1, hash2, hash3, hash4, hash5, hash6;
1548 struct policy_handle user_handle;
1549 char *oldpass = "test";
1550 char *newpass = "test2";
1551 uint8_t old_nt_hash[16], new_nt_hash[16];
1552 uint8_t old_lm_hash[16], new_lm_hash[16];
1553
1554 status = test_OpenUser_byname(p, tctx, handle, "testuser", &user_handle);
1555 if (!NT_STATUS_IS_OK(status)) {
1556 return false;
1557 }
1558
1559 torture_comment(tctx, "Testing ChangePasswordUser for user 'testuser'\n");
1560
1561 torture_comment(tctx, "old password: %s\n", oldpass);
1562 torture_comment(tctx, "new password: %s\n", newpass);
1563
1564 E_md4hash(oldpass, old_nt_hash);
1565 E_md4hash(newpass, new_nt_hash);
1566 E_deshash(oldpass, old_lm_hash);
1567 E_deshash(newpass, new_lm_hash);
1568
1569 E_old_pw_hash(new_lm_hash, old_lm_hash, hash1.hash);
1570 E_old_pw_hash(old_lm_hash, new_lm_hash, hash2.hash);
1571 E_old_pw_hash(new_nt_hash, old_nt_hash, hash3.hash);
1572 E_old_pw_hash(old_nt_hash, new_nt_hash, hash4.hash);
1573 E_old_pw_hash(old_lm_hash, new_nt_hash, hash5.hash);
1574 E_old_pw_hash(old_nt_hash, new_lm_hash, hash6.hash);
1575
1576 r.in.handle = &user_handle;
1577 r.in.lm_present = 1;
1578 r.in.old_lm_crypted = &hash1;
1579 r.in.new_lm_crypted = &hash2;
1580 r.in.nt_present = 1;
1581 r.in.old_nt_crypted = &hash3;
1582 r.in.new_nt_crypted = &hash4;
1583 r.in.cross1_present = 1;
1584 r.in.nt_cross = &hash5;
1585 r.in.cross2_present = 1;
1586 r.in.lm_cross = &hash6;
1587
1588 status = dcerpc_samr_ChangePasswordUser(p, tctx, &r);
1589 if (!NT_STATUS_IS_OK(status)) {
1590 torture_warning(tctx, "ChangePasswordUser failed - %s\n", nt_errstr(status));
1591 ret = false;
1592 }
1593
1594 if (!test_samr_handle_Close(p, tctx, &user_handle)) {
1595 ret = false;
1596 }
1597
1598 return ret;
1599 }
1600 #endif
1601
1602 static bool test_ChangePasswordUser(struct dcerpc_pipe *p, struct torture_context *tctx,
1603 const char *acct_name,
1604 struct policy_handle *handle, char **password)
1605 {
1606 NTSTATUS status;
1607 struct samr_ChangePasswordUser r;
1608 bool ret = true;
1609 struct samr_Password hash1, hash2, hash3, hash4, hash5, hash6;
1610 struct policy_handle user_handle;
1611 char *oldpass;
1612 uint8_t old_nt_hash[16], new_nt_hash[16];
1613 uint8_t old_lm_hash[16], new_lm_hash[16];
1614 bool changed = true;
1615
1616 char *newpass;
1617 struct samr_GetUserPwInfo pwp;
1618 struct samr_PwInfo info;
1619 int policy_min_pw_len = 0;
1620
1621 status = test_OpenUser_byname(p, tctx, handle, acct_name, &user_handle);
1622 if (!NT_STATUS_IS_OK(status)) {
1623 return false;
1624 }
1625 pwp.in.user_handle = &user_handle;
1626 pwp.out.info = &info;
1627
1628 status = dcerpc_samr_GetUserPwInfo(p, tctx, &pwp);
1629 if (NT_STATUS_IS_OK(status)) {
1630 policy_min_pw_len = pwp.out.info->min_password_length;
1631 }
1632 newpass = samr_rand_pass(tctx, policy_min_pw_len);
1633
1634 torture_comment(tctx, "Testing ChangePasswordUser\n");
1635
1636 torture_assert(tctx, *password != NULL,
1637 "Failing ChangePasswordUser as old password was NULL. Previous test failed?");
1638
1639 oldpass = *password;
1640
1641 E_md4hash(oldpass, old_nt_hash);
1642 E_md4hash(newpass, new_nt_hash);
1643 E_deshash(oldpass, old_lm_hash);
1644 E_deshash(newpass, new_lm_hash);
1645
1646 E_old_pw_hash(new_lm_hash, old_lm_hash, hash1.hash);
1647 E_old_pw_hash(old_lm_hash, new_lm_hash, hash2.hash);
1648 E_old_pw_hash(new_nt_hash, old_nt_hash, hash3.hash);
1649 E_old_pw_hash(old_nt_hash, new_nt_hash, hash4.hash);
1650 E_old_pw_hash(old_lm_hash, new_nt_hash, hash5.hash);
1651 E_old_pw_hash(old_nt_hash, new_lm_hash, hash6.hash);
1652
1653 r.in.user_handle = &user_handle;
1654 r.in.lm_present = 1;
1655 /* Break the LM hash */
1656 hash1.hash[0]++;
1657 r.in.old_lm_crypted = &hash1;
1658 r.in.new_lm_crypted = &hash2;
1659 r.in.nt_present = 1;
1660 r.in.old_nt_crypted = &hash3;
1661 r.in.new_nt_crypted = &hash4;
1662 r.in.cross1_present = 1;
1663 r.in.nt_cross = &hash5;
1664 r.in.cross2_present = 1;
1665 r.in.lm_cross = &hash6;
1666
1667 status = dcerpc_samr_ChangePasswordUser(p, tctx, &r);
1668 torture_assert_ntstatus_equal(tctx, status, NT_STATUS_WRONG_PASSWORD,
1669 "ChangePasswordUser failed: expected NT_STATUS_WRONG_PASSWORD because we broke the LM hash");
1670
1671 /* Unbreak the LM hash */
1672 hash1.hash[0]--;
1673
1674 r.in.user_handle = &user_handle;
1675 r.in.lm_present = 1;
1676 r.in.old_lm_crypted = &hash1;
1677 r.in.new_lm_crypted = &hash2;
1678 /* Break the NT hash */
1679 hash3.hash[0]--;
1680 r.in.nt_present = 1;
1681 r.in.old_nt_crypted = &hash3;
1682 r.in.new_nt_crypted = &hash4;
1683 r.in.cross1_present = 1;
1684 r.in.nt_cross = &hash5;
1685 r.in.cross2_present = 1;
1686 r.in.lm_cross = &hash6;
1687
1688 status = dcerpc_samr_ChangePasswordUser(p, tctx, &r);
1689 torture_assert_ntstatus_equal(tctx, status, NT_STATUS_WRONG_PASSWORD,
1690 "expected NT_STATUS_WRONG_PASSWORD because we broke the NT hash");
1691
1692 /* Unbreak the NT hash */
1693 hash3.hash[0]--;
1694
1695 r.in.user_handle = &user_handle;
1696 r.in.lm_present = 1;
1697 r.in.old_lm_crypted = &hash1;
1698 r.in.new_lm_crypted = &hash2;
1699 r.in.nt_present = 1;
1700 r.in.old_nt_crypted = &hash3;
1701 r.in.new_nt_crypted = &hash4;
1702 r.in.cross1_present = 1;
1703 r.in.nt_cross = &hash5;
1704 r.in.cross2_present = 1;
1705 /* Break the LM cross */
1706 hash6.hash[0]++;
1707 r.in.lm_cross = &hash6;
1708
1709 status = dcerpc_samr_ChangePasswordUser(p, tctx, &r);
1710 if (!NT_STATUS_EQUAL(status, NT_STATUS_WRONG_PASSWORD)) {
1711 torture_warning(tctx, "ChangePasswordUser failed: expected NT_STATUS_WRONG_PASSWORD because we broke the LM cross-hash, got %s\n", nt_errstr(status));
1712 ret = false;
1713 }
1714
1715 /* Unbreak the LM cross */
1716 hash6.hash[0]--;
1717
1718 r.in.user_handle = &user_handle;
1719 r.in.lm_present = 1;
1720 r.in.old_lm_crypted = &hash1;
1721 r.in.new_lm_crypted = &hash2;
1722 r.in.nt_present = 1;
1723 r.in.old_nt_crypted = &hash3;
1724 r.in.new_nt_crypted = &hash4;
1725 r.in.cross1_present = 1;
1726 /* Break the NT cross */
1727 hash5.hash[0]++;
1728 r.in.nt_cross = &hash5;
1729 r.in.cross2_present = 1;
1730 r.in.lm_cross = &hash6;
1731
1732 status = dcerpc_samr_ChangePasswordUser(p, tctx, &r);
1733 if (!NT_STATUS_EQUAL(status, NT_STATUS_WRONG_PASSWORD)) {
1734 torture_warning(tctx, "ChangePasswordUser failed: expected NT_STATUS_WRONG_PASSWORD because we broke the NT cross-hash, got %s\n", nt_errstr(status));
1735 ret = false;
1736 }
1737
1738 /* Unbreak the NT cross */
1739 hash5.hash[0]--;
1740
1741
1742 /* Reset the hashes to not broken values */
1743 E_old_pw_hash(new_lm_hash, old_lm_hash, hash1.hash);
1744 E_old_pw_hash(old_lm_hash, new_lm_hash, hash2.hash);
1745 E_old_pw_hash(new_nt_hash, old_nt_hash, hash3.hash);
1746 E_old_pw_hash(old_nt_hash, new_nt_hash, hash4.hash);
1747 E_old_pw_hash(old_lm_hash, new_nt_hash, hash5.hash);
1748 E_old_pw_hash(old_nt_hash, new_lm_hash, hash6.hash);
1749
1750 r.in.user_handle = &user_handle;
1751 r.in.lm_present = 1;
1752 r.in.old_lm_crypted = &hash1;
1753 r.in.new_lm_crypted = &hash2;
1754 r.in.nt_present = 1;
1755 r.in.old_nt_crypted = &hash3;
1756 r.in.new_nt_crypted = &hash4;
1757 r.in.cross1_present = 1;
1758 r.in.nt_cross = &hash5;
1759 r.in.cross2_present = 0;
1760 r.in.lm_cross = NULL;
1761
1762 status = dcerpc_samr_ChangePasswordUser(p, tctx, &r);
1763 if (NT_STATUS_IS_OK(status)) {
1764 changed = true;
1765 *password = newpass;
1766 } else if (!NT_STATUS_EQUAL(NT_STATUS_PASSWORD_RESTRICTION, status)) {
1767 torture_warning(tctx, "ChangePasswordUser failed: expected NT_STATUS_OK, or at least NT_STATUS_PASSWORD_RESTRICTION, got %s\n", nt_errstr(status));
1768 ret = false;
1769 }
1770
1771 oldpass = newpass;
1772 newpass = samr_rand_pass(tctx, policy_min_pw_len);
1773
1774 E_md4hash(oldpass, old_nt_hash);
1775 E_md4hash(newpass, new_nt_hash);
1776 E_deshash(oldpass, old_lm_hash);
1777 E_deshash(newpass, new_lm_hash);
1778
1779
1780 /* Reset the hashes to not broken values */
1781 E_old_pw_hash(new_lm_hash, old_lm_hash, hash1.hash);
1782 E_old_pw_hash(old_lm_hash, new_lm_hash, hash2.hash);
1783 E_old_pw_hash(new_nt_hash, old_nt_hash, hash3.hash);
1784 E_old_pw_hash(old_nt_hash, new_nt_hash, hash4.hash);
1785 E_old_pw_hash(old_lm_hash, new_nt_hash, hash5.hash);
1786 E_old_pw_hash(old_nt_hash, new_lm_hash, hash6.hash);
1787
1788 r.in.user_handle = &user_handle;
1789 r.in.lm_present = 1;
1790 r.in.old_lm_crypted = &hash1;
1791 r.in.new_lm_crypted = &hash2;
1792 r.in.nt_present = 1;
1793 r.in.old_nt_crypted = &hash3;
1794 r.in.new_nt_crypted = &hash4;
1795 r.in.cross1_present = 0;
1796 r.in.nt_cross = NULL;
1797 r.in.cross2_present = 1;
1798 r.in.lm_cross = &hash6;
1799
1800 status = dcerpc_samr_ChangePasswordUser(p, tctx, &r);
1801 if (NT_STATUS_IS_OK(status)) {
1802 changed = true;
1803 *password = newpass;
1804 } else if (!NT_STATUS_EQUAL(NT_STATUS_PASSWORD_RESTRICTION, status)) {
1805 torture_warning(tctx, "ChangePasswordUser failed: expected NT_STATUS_NT_CROSS_ENCRYPTION_REQUIRED, got %s\n", nt_errstr(status));
1806 ret = false;
1807 }
1808
1809 oldpass = newpass;
1810 newpass = samr_rand_pass(tctx, policy_min_pw_len);
1811
1812 E_md4hash(oldpass, old_nt_hash);
1813 E_md4hash(newpass, new_nt_hash);
1814 E_deshash(oldpass, old_lm_hash);
1815 E_deshash(newpass, new_lm_hash);
1816
1817
1818 /* Reset the hashes to not broken values */
1819 E_old_pw_hash(new_lm_hash, old_lm_hash, hash1.hash);
1820 E_old_pw_hash(old_lm_hash, new_lm_hash, hash2.hash);
1821 E_old_pw_hash(new_nt_hash, old_nt_hash, hash3.hash);
1822 E_old_pw_hash(old_nt_hash, new_nt_hash, hash4.hash);
1823 E_old_pw_hash(old_lm_hash, new_nt_hash, hash5.hash);
1824 E_old_pw_hash(old_nt_hash, new_lm_hash, hash6.hash);
1825
1826 r.in.user_handle = &user_handle;
1827 r.in.lm_present = 1;
1828 r.in.old_lm_crypted = &hash1;
1829 r.in.new_lm_crypted = &hash2;
1830 r.in.nt_present = 1;
1831 r.in.old_nt_crypted = &hash3;
1832 r.in.new_nt_crypted = &hash4;
1833 r.in.cross1_present = 1;
1834 r.in.nt_cross = &hash5;
1835 r.in.cross2_present = 1;
1836 r.in.lm_cross = &hash6;
1837
1838 status = dcerpc_samr_ChangePasswordUser(p, tctx, &r);
1839 if (NT_STATUS_EQUAL(status, NT_STATUS_PASSWORD_RESTRICTION)) {
1840 torture_comment(tctx, "ChangePasswordUser returned: %s perhaps min password age? (not fatal)\n", nt_errstr(status));
1841 } else if (!NT_STATUS_IS_OK(status)) {
1842 torture_warning(tctx, "ChangePasswordUser failed - %s\n", nt_errstr(status));
1843 ret = false;
1844 } else {
1845 changed = true;
1846 *password = newpass;
1847 }
1848
1849 r.in.user_handle = &user_handle;
1850 r.in.lm_present = 1;
1851 r.in.old_lm_crypted = &hash1;
1852 r.in.new_lm_crypted = &hash2;
1853 r.in.nt_present = 1;
1854 r.in.old_nt_crypted = &hash3;
1855 r.in.new_nt_crypted = &hash4;
1856 r.in.cross1_present = 1;
1857 r.in.nt_cross = &hash5;
1858 r.in.cross2_present = 1;
1859 r.in.lm_cross = &hash6;
1860
1861 if (changed) {
1862 status = dcerpc_samr_ChangePasswordUser(p, tctx, &r);
1863 if (NT_STATUS_EQUAL(status, NT_STATUS_PASSWORD_RESTRICTION)) {
1864 torture_comment(tctx, "ChangePasswordUser returned: %s perhaps min password age? (not fatal)\n", nt_errstr(status));
1865 } else if (!NT_STATUS_EQUAL(status, NT_STATUS_WRONG_PASSWORD)) {
1866 torture_warning(tctx, "ChangePasswordUser failed: expected NT_STATUS_WRONG_PASSWORD because we already changed the password, got %s\n", nt_errstr(status));
1867 ret = false;
1868 }
1869 }
1870
1871
1872 if (!test_samr_handle_Close(p, tctx, &user_handle)) {
1873 ret = false;
1874 }
1875
1876 return ret;
1877 }
1878
1879
1880 static bool test_OemChangePasswordUser2(struct dcerpc_pipe *p, struct torture_context *tctx,
1881 const char *acct_name,
1882 struct policy_handle *handle, char **password)
1883 {
1884 NTSTATUS status;
1885 struct samr_OemChangePasswordUser2 r;
1886 bool ret = true;
1887 struct samr_Password lm_verifier;
1888 struct samr_CryptPassword lm_pass;
1889 struct lsa_AsciiString server, account, account_bad;
1890 char *oldpass;
1891 char *newpass;
1892 uint8_t old_lm_hash[16], new_lm_hash[16];
1893
1894 struct samr_GetDomPwInfo dom_pw_info;
1895 struct samr_PwInfo info;
1896 int policy_min_pw_len = 0;
1897
1898 struct lsa_String domain_name;
1899
1900 domain_name.string = "";
1901 dom_pw_info.in.domain_name = &domain_name;
1902 dom_pw_info.out.info = &info;
1903
1904 torture_comment(tctx, "Testing OemChangePasswordUser2\n");
1905
1906 torture_assert(tctx, *password != NULL,
1907 "Failing OemChangePasswordUser2 as old password was NULL. Previous test failed?");
1908
1909 oldpass = *password;
1910
1911 status = dcerpc_samr_GetDomPwInfo(p, tctx, &dom_pw_info);
1912 if (NT_STATUS_IS_OK(status)) {
1913 policy_min_pw_len = dom_pw_info.out.info->min_password_length;
1914 }
1915
1916 newpass = samr_rand_pass(tctx, policy_min_pw_len);
1917
1918 server.string = talloc_asprintf(tctx, "\\\\%s", dcerpc_server_name(p));
1919 account.string = acct_name;
1920
1921 E_deshash(oldpass, old_lm_hash);
1922 E_deshash(newpass, new_lm_hash);
1923
1924 encode_pw_buffer(lm_pass.data, newpass, STR_ASCII);
1925 arcfour_crypt(lm_pass.data, old_lm_hash, 516);
1926 E_old_pw_hash(new_lm_hash, old_lm_hash, lm_verifier.hash);
1927
1928 r.in.server = &server;
1929 r.in.account = &account;
1930 r.in.password = &lm_pass;
1931 r.in.hash = &lm_verifier;
1932
1933 /* Break the verification */
1934 lm_verifier.hash[0]++;
1935
1936 status = dcerpc_samr_OemChangePasswordUser2(p, tctx, &r);
1937
1938 if (!NT_STATUS_EQUAL(status, NT_STATUS_PASSWORD_RESTRICTION)
1939 && !NT_STATUS_EQUAL(status, NT_STATUS_WRONG_PASSWORD)) {
1940 torture_warning(tctx, "OemChangePasswordUser2 failed, should have returned WRONG_PASSWORD (or at least 'PASSWORD_RESTRICTON') for invalid password verifier - %s\n",
1941 nt_errstr(status));
1942 ret = false;
1943 }
1944
1945 encode_pw_buffer(lm_pass.data, newpass, STR_ASCII);
1946 /* Break the old password */
1947 old_lm_hash[0]++;
1948 arcfour_crypt(lm_pass.data, old_lm_hash, 516);
1949 /* unbreak it for the next operation */
1950 old_lm_hash[0]--;
1951 E_old_pw_hash(new_lm_hash, old_lm_hash, lm_verifier.hash);
1952
1953 r.in.server = &server;
1954 r.in.account = &account;
1955 r.in.password = &lm_pass;
1956 r.in.hash = &lm_verifier;
1957
1958 status = dcerpc_samr_OemChangePasswordUser2(p, tctx, &r);
1959
1960 if (!NT_STATUS_EQUAL(status, NT_STATUS_PASSWORD_RESTRICTION)
1961 && !NT_STATUS_EQUAL(status, NT_STATUS_WRONG_PASSWORD)) {
1962 torture_warning(tctx, "OemChangePasswordUser2 failed, should have returned WRONG_PASSWORD (or at least 'PASSWORD_RESTRICTON') for invalidly encrpted password - %s\n",
1963 nt_errstr(status));
1964 ret = false;
1965 }
1966
1967 encode_pw_buffer(lm_pass.data, newpass, STR_ASCII);
1968 arcfour_crypt(lm_pass.data, old_lm_hash, 516);
1969
1970 r.in.server = &server;
1971 r.in.account = &account;
1972 r.in.password = &lm_pass;
1973 r.in.hash = NULL;
1974
1975 status = dcerpc_samr_OemChangePasswordUser2(p, tctx, &r);
1976
1977 if (!NT_STATUS_EQUAL(status, NT_STATUS_PASSWORD_RESTRICTION)
1978 && !NT_STATUS_EQUAL(status, NT_STATUS_INVALID_PARAMETER)) {
1979 torture_warning(tctx, "OemChangePasswordUser2 failed, should have returned INVALID_PARAMETER (or at least 'PASSWORD_RESTRICTON') for no supplied validation hash - %s\n",
1980 nt_errstr(status));
1981 ret = false;
1982 }
1983
1984 /* This shouldn't be a valid name */
1985 account_bad.string = TEST_ACCOUNT_NAME "XX";
1986 r.in.account = &account_bad;
1987
1988 status = dcerpc_samr_OemChangePasswordUser2(p, tctx, &r);
1989
1990 if (!NT_STATUS_EQUAL(status, NT_STATUS_INVALID_PARAMETER)) {
1991 torture_warning(tctx, "OemChangePasswordUser2 failed, should have returned INVALID_PARAMETER for no supplied validation hash and invalid user - %s\n",
1992 nt_errstr(status));
1993 ret = false;
1994 }
1995
1996 /* This shouldn't be a valid name */
1997 account_bad.string = TEST_ACCOUNT_NAME "XX";
1998 r.in.account = &account_bad;
1999 r.in.password = &lm_pass;
2000 r.in.hash = &lm_verifier;
2001
2002 status = dcerpc_samr_OemChangePasswordUser2(p, tctx, &r);
2003
2004 if (!NT_STATUS_EQUAL(status, NT_STATUS_WRONG_PASSWORD)) {
2005 torture_warning(tctx, "OemChangePasswordUser2 failed, should have returned WRONG_PASSWORD for invalid user - %s\n",
2006 nt_errstr(status));
2007 ret = false;
2008 }
2009
2010 /* This shouldn't be a valid name */
2011 account_bad.string = TEST_ACCOUNT_NAME "XX";
2012 r.in.account = &account_bad;
2013 r.in.password = NULL;
2014 r.in.hash = &lm_verifier;
2015
2016 status = dcerpc_samr_OemChangePasswordUser2(p, tctx, &r);
2017
2018 if (!NT_STATUS_EQUAL(status, NT_STATUS_INVALID_PARAMETER)) {
2019 torture_warning(tctx, "OemChangePasswordUser2 failed, should have returned INVALID_PARAMETER for no supplied password and invalid user - %s\n",
2020 nt_errstr(status));
2021 ret = false;
2022 }
2023
2024 E_deshash(oldpass, old_lm_hash);
2025 E_deshash(newpass, new_lm_hash);
2026
2027 encode_pw_buffer(lm_pass.data, newpass, STR_ASCII);
2028 arcfour_crypt(lm_pass.data, old_lm_hash, 516);
2029 E_old_pw_hash(new_lm_hash, old_lm_hash, lm_verifier.hash);
2030
2031 r.in.server = &server;
2032 r.in.account = &account;
2033 r.in.password = &lm_pass;
2034 r.in.hash = &lm_verifier;
2035
2036 status = dcerpc_samr_OemChangePasswordUser2(p, tctx, &r);
2037 if (NT_STATUS_EQUAL(status, NT_STATUS_PASSWORD_RESTRICTION)) {
2038 torture_comment(tctx, "OemChangePasswordUser2 returned: %s perhaps min password age? (not fatal)\n", nt_errstr(status));
2039 } else if (!NT_STATUS_IS_OK(status)) {
2040 torture_warning(tctx, "OemChangePasswordUser2 failed - %s\n", nt_errstr(status));
2041 ret = false;
2042 } else {
2043 *password = newpass;
2044 }
2045
2046 return ret;
2047 }
2048
2049
2050 static bool test_ChangePasswordUser2(struct dcerpc_pipe *p, struct torture_context *tctx,
2051 const char *acct_name,
2052 char **password,
2053 char *newpass, bool allow_password_restriction)
2054 {
2055 NTSTATUS status;
2056 struct samr_ChangePasswordUser2 r;
2057 bool ret = true;
2058 struct lsa_String server, account;
2059 struct samr_CryptPassword nt_pass, lm_pass;
2060 struct samr_Password nt_verifier, lm_verifier;
2061 char *oldpass;
2062 uint8_t old_nt_hash[16], new_nt_hash[16];
2063 uint8_t old_lm_hash[16], new_lm_hash[16];
2064
2065 struct samr_GetDomPwInfo dom_pw_info;
2066 struct samr_PwInfo info;
2067
2068 struct lsa_String domain_name;
2069
2070 domain_name.string = "";
2071 dom_pw_info.in.domain_name = &domain_name;
2072 dom_pw_info.out.info = &info;
2073
2074 torture_comment(tctx, "Testing ChangePasswordUser2 on %s\n", acct_name);
2075
2076 torture_assert(tctx, *password != NULL,
2077 "Failing ChangePasswordUser2 as old password was NULL. Previous test failed?");
2078 oldpass = *password;
2079
2080 if (!newpass) {
2081 int policy_min_pw_len = 0;
2082 status = dcerpc_samr_GetDomPwInfo(p, tctx, &dom_pw_info);
2083 if (NT_STATUS_IS_OK(status)) {
2084 policy_min_pw_len = dom_pw_info.out.info->min_password_length;
2085 }
2086
2087 newpass = samr_rand_pass(tctx, policy_min_pw_len);
2088 }
2089
2090 server.string = talloc_asprintf(tctx, "\\\\%s", dcerpc_server_name(p));
2091 init_lsa_String(&account, acct_name);
2092
2093 E_md4hash(oldpass, old_nt_hash);
2094 E_md4hash(newpass, new_nt_hash);
2095
2096 E_deshash(oldpass, old_lm_hash);
2097 E_deshash(newpass, new_lm_hash);
2098
2099 encode_pw_buffer(lm_pass.data, newpass, STR_ASCII|STR_TERMINATE);
2100 arcfour_crypt(lm_pass.data, old_lm_hash, 516);
2101 E_old_pw_hash(new_nt_hash, old_lm_hash, lm_verifier.hash);
2102
2103 encode_pw_buffer(nt_pass.data, newpass, STR_UNICODE);
2104 arcfour_crypt(nt_pass.data, old_nt_hash, 516);
2105 E_old_pw_hash(new_nt_hash, old_nt_hash, nt_verifier.hash);
2106
2107 r.in.server = &server;
2108 r.in.account = &account;
2109 r.in.nt_password = &nt_pass;
2110 r.in.nt_verifier = &nt_verifier;
2111 r.in.lm_change = 1;
2112 r.in.lm_password = &lm_pass;
2113 r.in.lm_verifier = &lm_verifier;
2114
2115 status = dcerpc_samr_ChangePasswordUser2(p, tctx, &r);
2116 if (allow_password_restriction && NT_STATUS_EQUAL(status, NT_STATUS_PASSWORD_RESTRICTION)) {
2117 torture_comment(tctx, "ChangePasswordUser2 returned: %s perhaps min password age? (not fatal)\n", nt_errstr(status));
2118 } else if (!NT_STATUS_IS_OK(status)) {
2119 torture_warning(tctx, "ChangePasswordUser2 failed - %s\n", nt_errstr(status));
2120 ret = false;
2121 } else {
2122 *password = newpass;
2123 }
2124
2125 return ret;
2126 }
2127
2128
2129 bool test_ChangePasswordUser3(struct dcerpc_pipe *p, struct torture_context *tctx,
2130 const char *account_string,
2131 int policy_min_pw_len,
2132 char **password,
2133 const char *newpass,
2134 NTTIME last_password_change,
2135 bool handle_reject_reason)
2136 {
2137 NTSTATUS status;
2138 struct samr_ChangePasswordUser3 r;
2139 bool ret = true;
2140 struct lsa_String server, account, account_bad;
2141 struct samr_CryptPassword nt_pass, lm_pass;
2142 struct samr_Password nt_verifier, lm_verifier;
2143 char *oldpass;
2144 uint8_t old_nt_hash[16], new_nt_hash[16];
2145 uint8_t old_lm_hash[16], new_lm_hash[16];
2146 NTTIME t;
2147 struct samr_DomInfo1 *dominfo = NULL;
2148 struct userPwdChangeFailureInformation *reject = NULL;
2149
2150 torture_comment(tctx, "Testing ChangePasswordUser3\n");
2151
2152 if (newpass == NULL) {
2153 do {
2154 if (policy_min_pw_len == 0) {
2155 newpass = samr_rand_pass(tctx, policy_min_pw_len);
2156 } else {
2157 newpass = samr_rand_pass_fixed_len(tctx, policy_min_pw_len);
2158 }
2159 } while (check_password_quality(newpass) == false);
2160 } else {
2161 torture_comment(tctx, "Using password '%s'\n", newpass);
2162 }
2163
2164 torture_assert(tctx, *password != NULL,
2165 "Failing ChangePasswordUser3 as old password was NULL. Previous test failed?");
2166
2167 oldpass = *password;
2168 server.string = talloc_asprintf(tctx, "\\\\%s", dcerpc_server_name(p));
2169 init_lsa_String(&account, account_string);
2170
2171 E_md4hash(oldpass, old_nt_hash);
2172 E_md4hash(newpass, new_nt_hash);
2173
2174 E_deshash(oldpass, old_lm_hash);
2175 E_deshash(newpass, new_lm_hash);
2176
2177 encode_pw_buffer(lm_pass.data, newpass, STR_UNICODE);
2178 arcfour_crypt(lm_pass.data, old_nt_hash, 516);
2179 E_old_pw_hash(new_nt_hash, old_lm_hash, lm_verifier.hash);
2180
2181 encode_pw_buffer(nt_pass.data, newpass, STR_UNICODE);
2182 arcfour_crypt(nt_pass.data, old_nt_hash, 516);
2183 E_old_pw_hash(new_nt_hash, old_nt_hash, nt_verifier.hash);
2184
2185 /* Break the verification */
2186 nt_verifier.hash[0]++;
2187
2188 r.in.server = &server;
2189 r.in.account = &account;
2190 r.in.nt_password = &nt_pass;
2191 r.in.nt_verifier = &nt_verifier;
2192 r.in.lm_change = 1;
2193 r.in.lm_password = &lm_pass;
2194 r.in.lm_verifier = &lm_verifier;
2195 r.in.password3 = NULL;
2196 r.out.dominfo = &dominfo;
2197 r.out.reject = &reject;
2198
2199 status = dcerpc_samr_ChangePasswordUser3(p, tctx, &r);
2200 if (!NT_STATUS_EQUAL(status, NT_STATUS_PASSWORD_RESTRICTION) &&
2201 (!NT_STATUS_EQUAL(status, NT_STATUS_WRONG_PASSWORD))) {
2202 torture_warning(tctx, "ChangePasswordUser3 failed, should have returned WRONG_PASSWORD (or at least 'PASSWORD_RESTRICTON') for invalid password verifier - %s\n",
2203 nt_errstr(status));
2204 ret = false;
2205 }
2206
2207 encode_pw_buffer(lm_pass.data, newpass, STR_UNICODE);
2208 arcfour_crypt(lm_pass.data, old_nt_hash, 516);
2209 E_old_pw_hash(new_nt_hash, old_lm_hash, lm_verifier.hash);
2210
2211 encode_pw_buffer(nt_pass.data, newpass, STR_UNICODE);
2212 /* Break the NT hash */
2213 old_nt_hash[0]++;
2214 arcfour_crypt(nt_pass.data, old_nt_hash, 516);
2215 /* Unbreak it again */
2216 old_nt_hash[0]--;
2217 E_old_pw_hash(new_nt_hash, old_nt_hash, nt_verifier.hash);
2218
2219 r.in.server = &server;
2220 r.in.account = &account;
2221 r.in.nt_password = &nt_pass;
2222 r.in.nt_verifier = &nt_verifier;
2223 r.in.lm_change = 1;
2224 r.in.lm_password = &lm_pass;
2225 r.in.lm_verifier = &lm_verifier;
2226 r.in.password3 = NULL;
2227 r.out.dominfo = &dominfo;
2228 r.out.reject = &reject;
2229
2230 status = dcerpc_samr_ChangePasswordUser3(p, tctx, &r);
2231 if (!NT_STATUS_EQUAL(status, NT_STATUS_PASSWORD_RESTRICTION) &&
2232 (!NT_STATUS_EQUAL(status, NT_STATUS_WRONG_PASSWORD))) {
2233 torture_warning(tctx, "ChangePasswordUser3 failed, should have returned WRONG_PASSWORD (or at least 'PASSWORD_RESTRICTON') for invalidly encrpted password - %s\n",
2234 nt_errstr(status));
2235 ret = false;
2236 }
2237
2238 /* This shouldn't be a valid name */
2239 init_lsa_String(&account_bad, talloc_asprintf(tctx, "%sXX", account_string));
2240
2241 r.in.account = &account_bad;
2242 status = dcerpc_samr_ChangePasswordUser3(p, tctx, &r);
2243 if (!NT_STATUS_EQUAL(status, NT_STATUS_WRONG_PASSWORD)) {
2244 torture_warning(tctx, "ChangePasswordUser3 failed, should have returned WRONG_PASSWORD for invalid username - %s\n",
2245 nt_errstr(status));
2246 ret = false;
2247 }
2248
2249 E_md4hash(oldpass, old_nt_hash);
2250 E_md4hash(newpass, new_nt_hash);
2251
2252 E_deshash(oldpass, old_lm_hash);
2253 E_deshash(newpass, new_lm_hash);
2254
2255 encode_pw_buffer(lm_pass.data, newpass, STR_UNICODE);
2256 arcfour_crypt(lm_pass.data, old_nt_hash, 516);
2257 E_old_pw_hash(new_nt_hash, old_lm_hash, lm_verifier.hash);
2258
2259 encode_pw_buffer(nt_pass.data, newpass, STR_UNICODE);
2260 arcfour_crypt(nt_pass.data, old_nt_hash, 516);
2261 E_old_pw_hash(new_nt_hash, old_nt_hash, nt_verifier.hash);
2262
2263 r.in.server = &server;
2264 r.in.account = &account;
2265 r.in.nt_password = &nt_pass;
2266 r.in.nt_verifier = &nt_verifier;
2267 r.in.lm_change = 1;
2268 r.in.lm_password = &lm_pass;
2269 r.in.lm_verifier = &lm_verifier;
2270 r.in.password3 = NULL;
2271 r.out.dominfo = &dominfo;
2272 r.out.reject = &reject;
2273
2274 unix_to_nt_time(&t, time(NULL));
2275
2276 status = dcerpc_samr_ChangePasswordUser3(p, tctx, &r);
2277
2278 if (NT_STATUS_EQUAL(status, NT_STATUS_PASSWORD_RESTRICTION)
2279 && dominfo
2280 && reject
2281 && handle_reject_reason
2282 && (!null_nttime(last_password_change) || !dominfo->min_password_age)) {
2283 if (dominfo->password_properties & DOMAIN_REFUSE_PASSWORD_CHANGE ) {
2284
2285 if (reject && (reject->extendedFailureReason != SAM_PWD_CHANGE_NO_ERROR)) {
2286 torture_warning(tctx, "expected SAM_PWD_CHANGE_NO_ERROR (%d), got %d\n",
2287 SAM_PWD_CHANGE_NO_ERROR, reject->extendedFailureReason);
2288 return false;
2289 }
2290 }
2291
2292 /* We tested the order of precendence which is as follows:
2293
2294 * pwd min_age
2295 * pwd length
2296 * pwd complexity
2297 * pwd history
2298
2299 Guenther */
2300
2301 if ((dominfo->min_password_age > 0) && !null_nttime(last_password_change) &&
2302 (last_password_change + dominfo->min_password_age > t)) {
2303
2304 if (reject->extendedFailureReason != SAM_PWD_CHANGE_NO_ERROR) {
2305 torture_warning(tctx, "expected SAM_PWD_CHANGE_NO_ERROR (%d), got %d\n",
2306 SAM_PWD_CHANGE_NO_ERROR, reject->extendedFailureReason);
2307 return false;
2308 }
2309
2310 } else if ((dominfo->min_password_length > 0) &&
2311 (strlen(newpass) < dominfo->min_password_length)) {
2312
2313 if (reject->extendedFailureReason != SAM_PWD_CHANGE_PASSWORD_TOO_SHORT) {
2314 torture_warning(tctx, "expected SAM_PWD_CHANGE_PASSWORD_TOO_SHORT (%d), got %d\n",
2315 SAM_PWD_CHANGE_PASSWORD_TOO_SHORT, reject->extendedFailureReason);
2316 return false;
2317 }
2318
2319 } else if ((dominfo->password_history_length > 0) &&
2320 strequal(oldpass, newpass)) {
2321
2322 if (reject->extendedFailureReason != SAM_PWD_CHANGE_PWD_IN_HISTORY) {
2323 torture_warning(tctx, "expected SAM_PWD_CHANGE_PWD_IN_HISTORY (%d), got %d\n",
2324 SAM_PWD_CHANGE_PWD_IN_HISTORY, reject->extendedFailureReason);
2325 return false;
2326 }
2327 } else if (dominfo->password_properties & DOMAIN_PASSWORD_COMPLEX) {
2328
2329 if (reject->extendedFailureReason != SAM_PWD_CHANGE_NOT_COMPLEX) {
2330 torture_warning(tctx, "expected SAM_PWD_CHANGE_NOT_COMPLEX (%d), got %d\n",
2331 SAM_PWD_CHANGE_NOT_COMPLEX, reject->extendedFailureReason);
2332 return false;
2333 }
2334
2335 }
2336
2337 if (reject->extendedFailureReason == SAM_PWD_CHANGE_PASSWORD_TOO_SHORT) {
2338 /* retry with adjusted size */
2339 return test_ChangePasswordUser3(p, tctx, account_string,
2340 dominfo->min_password_length,
2341 password, NULL, 0, false);
2342
2343 }
2344
2345 } else if (NT_STATUS_EQUAL(status, NT_STATUS_PASSWORD_RESTRICTION)) {
2346 if (reject && reject->extendedFailureReason != SAM_PWD_CHANGE_NO_ERROR) {
2347 torture_warning(tctx, "expected SAM_PWD_CHANGE_NO_ERROR (%d), got %d\n",
2348 SAM_PWD_CHANGE_NO_ERROR, reject->extendedFailureReason);
2349 return false;
2350 }
2351 /* Perhaps the server has a 'min password age' set? */
2352
2353 } else {
2354 torture_assert_ntstatus_ok(tctx, status, "ChangePasswordUser3");
2355 *password = talloc_strdup(tctx, newpass);
2356 }
2357
2358 return ret;
2359 }
2360
2361 bool test_ChangePasswordRandomBytes(struct dcerpc_pipe *p, struct torture_context *tctx,
2362 const char *account_string,
2363 struct policy_handle *handle,
2364 char **password)
2365 {
2366 NTSTATUS status;
2367 struct samr_ChangePasswordUser3 r;
2368 struct samr_SetUserInfo s;
2369 union samr_UserInfo u;
2370 DATA_BLOB session_key;
2371 DATA_BLOB confounded_session_key = data_blob_talloc(tctx, NULL, 16);
2372 uint8_t confounder[16];
2373 struct MD5Context ctx;
2374
2375 bool ret = true;
2376 struct lsa_String server, account;
2377 struct samr_CryptPassword nt_pass;
2378 struct samr_Password nt_verifier;
2379 DATA_BLOB new_random_pass;
2380 char *newpass;
2381 char *oldpass;
2382 uint8_t old_nt_hash[16], new_nt_hash[16];
2383 NTTIME t;
2384 struct samr_DomInfo1 *dominfo = NULL;
2385 struct userPwdChangeFailureInformation *reject = NULL;
2386
2387 new_random_pass = samr_very_rand_pass(tctx, 128);
2388
2389 torture_assert(tctx, *password != NULL,
2390 "Failing ChangePasswordUser3 as old password was NULL. Previous test failed?");
2391
2392 oldpass = *password;
2393 server.string = talloc_asprintf(tctx, "\\\\%s", dcerpc_server_name(p));
2394 init_lsa_String(&account, account_string);
2395
2396 s.in.user_handle = handle;
2397 s.in.info = &u;
2398 s.in.level = 25;
2399
2400 ZERO_STRUCT(u);
2401
2402 u.info25.info.fields_present = SAMR_FIELD_NT_PASSWORD_PRESENT;
2403
2404 set_pw_in_buffer(u.info25.password.data, &new_random_pass);
2405
2406 status = dcerpc_fetch_session_key(p, &session_key);
2407 if (!NT_STATUS_IS_OK(status)) {
2408 torture_warning(tctx, "SetUserInfo level %u - no session key - %s\n",
2409 s.in.level, nt_errstr(status));
2410 return false;
2411 }
2412
2413 generate_random_buffer((uint8_t *)confounder, 16);
2414
2415 MD5Init(&ctx);
2416 MD5Update(&ctx, confounder, 16);
2417 MD5Update(&ctx, session_key.data, session_key.length);
2418 MD5Final(confounded_session_key.data, &ctx);
2419
2420 arcfour_crypt_blob(u.info25.password.data, 516, &confounded_session_key);
2421 memcpy(&u.info25.password.data[516], confounder, 16);
2422
2423 torture_comment(tctx, "Testing SetUserInfo level 25 (set password ex) with a password made up of only random bytes\n");
2424
2425 status = dcerpc_samr_SetUserInfo(p, tctx, &s);
2426 if (!NT_STATUS_IS_OK(status)) {
2427 torture_warning(tctx, "SetUserInfo level %u failed - %s\n",
2428 s.in.level, nt_errstr(status));
2429 ret = false;
2430 }
2431
2432 torture_comment(tctx, "Testing ChangePasswordUser3 with a password made up of only random bytes\n");
2433
2434 mdfour(old_nt_hash, new_random_pass.data, new_random_pass.length);
2435
2436 new_random_pass = samr_very_rand_pass(tctx, 128);
2437
2438 mdfour(new_nt_hash, new_random_pass.data, new_random_pass.length);
2439
2440 set_pw_in_buffer(nt_pass.data, &new_random_pass);
2441 arcfour_crypt(nt_pass.data, old_nt_hash, 516);
2442 E_old_pw_hash(new_nt_hash, old_nt_hash, nt_verifier.hash);
2443
2444 r.in.server = &server;
2445 r.in.account = &account;
2446 r.in.nt_password = &nt_pass;
2447 r.in.nt_verifier = &nt_verifier;
2448 r.in.lm_change = 0;
2449 r.in.lm_password = NULL;
2450 r.in.lm_verifier = NULL;
2451 r.in.password3 = NULL;
2452 r.out.dominfo = &dominfo;
2453 r.out.reject = &reject;
2454
2455 unix_to_nt_time(&t, time(NULL));
2456
2457 status = dcerpc_samr_ChangePasswordUser3(p, tctx, &r);
2458
2459 if (NT_STATUS_EQUAL(status, NT_STATUS_PASSWORD_RESTRICTION)) {
2460 if (reject && reject->extendedFailureReason != SAM_PWD_CHANGE_NO_ERROR) {
2461 torture_warning(tctx, "expected SAM_PWD_CHANGE_NO_ERROR (%d), got %d\n",
2462 SAM_PWD_CHANGE_NO_ERROR, reject->extendedFailureReason);
2463 return false;
2464 }
2465 /* Perhaps the server has a 'min password age' set? */
2466
2467 } else if (!NT_STATUS_IS_OK(status)) {
2468 torture_warning(tctx, "ChangePasswordUser3 failed - %s\n", nt_errstr(status));
2469 ret = false;
2470 }
2471
2472 newpass = samr_rand_pass(tctx, 128);
2473
2474 mdfour(old_nt_hash, new_random_pass.data, new_random_pass.length);
2475
2476 E_md4hash(newpass, new_nt_hash);
2477
2478 encode_pw_buffer(nt_pass.data, newpass, STR_UNICODE);
2479 arcfour_crypt(nt_pass.data, old_nt_hash, 516);
2480 E_old_pw_hash(new_nt_hash, old_nt_hash, nt_verifier.hash);
2481
2482 r.in.server = &server;
2483 r.in.account = &account;
2484 r.in.nt_password = &nt_pass;
2485 r.in.nt_verifier = &nt_verifier;
2486 r.in.lm_change = 0;
2487 r.in.lm_password = NULL;
2488 r.in.lm_verifier = NULL;
2489 r.in.password3 = NULL;
2490 r.out.dominfo = &dominfo;
2491 r.out.reject = &reject;
2492
2493 unix_to_nt_time(&t, time(NULL));
2494
2495 status = dcerpc_samr_ChangePasswordUser3(p, tctx, &r);
2496
2497 if (NT_STATUS_EQUAL(status, NT_STATUS_PASSWORD_RESTRICTION)) {
2498 if (reject && reject->extendedFailureReason != SAM_PWD_CHANGE_NO_ERROR) {
2499 torture_warning(tctx, "expected SAM_PWD_CHANGE_NO_ERROR (%d), got %d\n",
2500 SAM_PWD_CHANGE_NO_ERROR, reject->extendedFailureReason);
2501 return false;
2502 }
2503 /* Perhaps the server has a 'min password age' set? */
2504
2505 } else {
2506 torture_assert_ntstatus_ok(tctx, status, "ChangePasswordUser3 (on second random password)");
2507 *password = talloc_strdup(tctx, newpass);
2508 }
2509
2510 return ret;
2511 }
2512
2513
2514 static bool test_GetMembersInAlias(struct dcerpc_pipe *p, struct torture_context *tctx,
2515 struct policy_handle *alias_handle)
2516 {
2517 struct samr_GetMembersInAlias r;
2518 struct lsa_SidArray sids;
2519 NTSTATUS status;
2520
2521 torture_comment(tctx, "Testing GetMembersInAlias\n");
2522
2523 r.in.alias_handle = alias_handle;
2524 r.out.sids = &sids;
2525
2526 status = dcerpc_samr_GetMembersInAlias(p, tctx, &r);
2527 torture_assert_ntstatus_ok(tctx, status, "GetMembersInAlias");
2528
2529 return true;
2530 }
2531
2532 static bool test_AddMemberToAlias(struct dcerpc_pipe *p, struct torture_context *tctx,
2533 struct policy_handle *alias_handle,
2534 const struct dom_sid *domain_sid)
2535 {
2536 struct samr_AddAliasMember r;
2537 struct samr_DeleteAliasMember d;
2538 NTSTATUS status;
2539 struct dom_sid *sid;
2540
2541 sid = dom_sid_add_rid(tctx, domain_sid, 512);
2542
2543 torture_comment(tctx, "testing AddAliasMember\n");
2544 r.in.alias_handle = alias_handle;
2545 r.in.sid = sid;
2546
2547 status = dcerpc_samr_AddAliasMember(p, tctx, &r);
2548 torture_assert_ntstatus_ok(tctx, status, "AddAliasMember");
2549
2550 d.in.alias_handle = alias_handle;
2551 d.in.sid = sid;
2552
2553 status = dcerpc_samr_DeleteAliasMember(p, tctx, &d);
2554 torture_assert_ntstatus_ok(tctx, status, "DelAliasMember");
2555
2556 return true;
2557 }
2558
2559 static bool test_AddMultipleMembersToAlias(struct dcerpc_pipe *p, struct torture_context *tctx,
2560 struct policy_handle *alias_handle)
2561 {
2562 struct samr_AddMultipleMembersToAlias a;
2563 struct samr_RemoveMultipleMembersFromAlias r;
2564 NTSTATUS status;
2565 struct lsa_SidArray sids;
2566
2567 torture_comment(tctx, "testing AddMultipleMembersToAlias\n");
2568 a.in.alias_handle = alias_handle;
2569 a.in.sids = &sids;
2570
2571 sids.num_sids = 3;
2572 sids.sids = talloc_array(tctx, struct lsa_SidPtr, 3);
2573
2574 sids.sids[0].sid = dom_sid_parse_talloc(tctx, "S-1-5-32-1-2-3-1");
2575 sids.sids[1].sid = dom_sid_parse_talloc(tctx, "S-1-5-32-1-2-3-2");
2576 sids.sids[2].sid = dom_sid_parse_talloc(tctx, "S-1-5-32-1-2-3-3");
2577
2578 status = dcerpc_samr_AddMultipleMembersToAlias(p, tctx, &a);
2579 torture_assert_ntstatus_ok(tctx, status, "AddMultipleMembersToAlias");
2580
2581
2582 torture_comment(tctx, "testing RemoveMultipleMembersFromAlias\n");
2583 r.in.alias_handle = alias_handle;
2584 r.in.sids = &sids;
2585
2586 status = dcerpc_samr_RemoveMultipleMembersFromAlias(p, tctx, &r);
2587 torture_assert_ntstatus_ok(tctx, status, "RemoveMultipleMembersFromAlias");
2588
2589 /* strange! removing twice doesn't give any error */
2590 status = dcerpc_samr_RemoveMultipleMembersFromAlias(p, tctx, &r);
2591 torture_assert_ntstatus_ok(tctx, status, "RemoveMultipleMembersFromAlias");
2592
2593 /* but removing an alias that isn't there does */
2594 sids.sids[2].sid = dom_sid_parse_talloc(tctx, "S-1-5-32-1-2-3-4");
2595
2596 status = dcerpc_samr_RemoveMultipleMembersFromAlias(p, tctx, &r);
2597 torture_assert_ntstatus_equal(tctx, status, NT_STATUS_OBJECT_NAME_NOT_FOUND, "RemoveMultipleMembersFromAlias");
2598
2599 return true;
2600 }
2601
2602 static bool test_GetAliasMembership(struct dcerpc_pipe *p,
2603 struct torture_context *tctx,
2604 struct policy_handle *domain_handle)
2605 {
2606 struct samr_GetAliasMembership r;
2607 struct lsa_SidArray sids;
2608 struct samr_Ids rids;
2609 NTSTATUS status;
2610
2611 torture_comment(tctx, "Testing GetAliasMembership\n");
2612
2613 if (torture_setting_bool(tctx, "samba4", false)) {
2614 torture_skip(tctx, "skipping GetAliasMembership against s4");
2615 }
2616
2617 r.in.domain_handle = domain_handle;
2618 r.in.sids = &sids;
2619 r.out.rids = &rids;
2620
2621 sids.num_sids = 0;
2622 sids.sids = talloc_zero_array(tctx, struct lsa_SidPtr, sids.num_sids);
2623
2624 status = dcerpc_samr_GetAliasMembership(p, tctx, &r);
2625 torture_assert_ntstatus_ok(tctx, status,
2626 "samr_GetAliasMembership failed");
2627
2628 torture_assert_int_equal(tctx, sids.num_sids, rids.count,
2629 "protocol misbehaviour");
2630
2631 sids.num_sids = 1;
2632 sids.sids = talloc_zero_array(tctx, struct lsa_SidPtr, sids.num_sids);
2633 sids.sids[0].sid = dom_sid_parse_talloc(tctx, "S-1-5-32-1-2-3-1");
2634
2635 status = dcerpc_samr_GetAliasMembership(p, tctx, &r);
2636 torture_assert_ntstatus_ok(tctx, status,
2637 "samr_GetAliasMembership failed");
2638
2639 #if 0
2640 /* only true for w2k8 it seems
2641 * win7, xp, w2k3 will return a 0 length array pointer */
2642
2643 if (rids.ids && (rids.count == 0)) {
2644 torture_fail(tctx, "samr_GetAliasMembership returned 0 count and a rids array");
2645 }
2646 #endif
2647 if (!rids.ids && rids.count) {
2648 torture_fail(tctx, "samr_GetAliasMembership returned non-0 count but no rids");
2649 }
2650
2651 return true;
2652 }
2653
2654 static bool test_TestPrivateFunctionsUser(struct dcerpc_pipe *p, struct torture_context *tctx,
2655 struct policy_handle *user_handle)
2656 {
2657 struct samr_TestPrivateFunctionsUser r;
2658 NTSTATUS status;
2659
2660 torture_comment(tctx, "Testing TestPrivateFunctionsUser\n");
2661
2662 r.in.user_handle = user_handle;
2663
2664 status = dcerpc_samr_TestPrivateFunctionsUser(p, tctx, &r);
2665 torture_assert_ntstatus_equal(tctx, status, NT_STATUS_NOT_IMPLEMENTED, "TestPrivateFunctionsUser");
2666
2667 return true;
2668 }
2669
2670 static bool test_QueryUserInfo_pwdlastset(struct dcerpc_pipe *p,
2671 struct torture_context *tctx,
2672 struct policy_handle *handle,
2673 bool use_info2,
2674 NTTIME *pwdlastset)
2675 {
2676 NTSTATUS status;
2677 uint16_t levels[] = { /* 3, */ 5, 21 };
2678 int i;
2679 NTTIME pwdlastset3 = 0;
2680 NTTIME pwdlastset5 = 0;
2681 NTTIME pwdlastset21 = 0;
2682
2683 torture_comment(tctx, "Testing QueryUserInfo%s level 5 and 21 call ",
2684 use_info2 ? "2":"");
2685
2686 for (i=0; i<ARRAY_SIZE(levels); i++) {
2687
2688 struct samr_QueryUserInfo r;
2689 struct samr_QueryUserInfo2 r2;
2690 union samr_UserInfo *info;
2691
2692 if (use_info2) {
2693 r2.in.user_handle = handle;
2694 r2.in.level = levels[i];
2695 r2.out.info = &info;
2696 status = dcerpc_samr_QueryUserInfo2(p, tctx, &r2);
2697
2698 } else {
2699 r.in.user_handle = handle;
2700 r.in.level = levels[i];
2701 r.out.info = &info;
2702 status = dcerpc_samr_QueryUserInfo(p, tctx, &r);
2703 }
2704
2705 if (!NT_STATUS_IS_OK(status) &&
2706 !NT_STATUS_EQUAL(status, NT_STATUS_INVALID_INFO_CLASS)) {
2707 torture_warning(tctx, "QueryUserInfo%s level %u failed - %s\n",
2708 use_info2 ? "2":"", levels[i], nt_errstr(status));
2709 return false;
2710 }
2711
2712 switch (levels[i]) {
2713 case 3:
2714 pwdlastset3 = info->info3.last_password_change;
2715 break;
2716 case 5:
2717 pwdlastset5 = info->info5.last_password_change;
2718 break;
2719 case 21:
2720 pwdlastset21 = info->info21.last_password_change;
2721 break;
2722 default:
2723 return false;
2724 }
2725 }
2726 /* torture_assert_int_equal(tctx, pwdlastset3, pwdlastset5,
2727 "pwdlastset mixup"); */
2728 torture_assert_int_equal(tctx, pwdlastset5, pwdlastset21,
2729 "pwdlastset mixup");
2730
2731 *pwdlastset = pwdlastset21;
2732
2733 torture_comment(tctx, "(pwdlastset: %lld)\n", *pwdlastset);
2734
2735 return true;
2736 }
2737
2738 static bool test_SamLogon(struct torture_context *tctx,
2739 struct dcerpc_pipe *p,
2740 struct cli_credentials *test_credentials,
2741 NTSTATUS expected_result,
2742 bool interactive)
2743 {
2744 NTSTATUS status;
2745 struct netr_LogonSamLogonEx r;
2746 union netr_LogonLevel logon;
2747 union netr_Validation validation;
2748 uint8_t authoritative;
2749 struct netr_IdentityInfo identity;
2750 struct netr_NetworkInfo ninfo;
2751 struct netr_PasswordInfo pinfo;
2752 DATA_BLOB names_blob, chal, lm_resp, nt_resp;
2753 int flags = CLI_CRED_NTLM_AUTH;
2754 uint32_t samlogon_flags = 0;
2755 struct netlogon_creds_CredentialState *creds;
2756 struct netr_Authenticator a;
2757
2758 torture_assert_ntstatus_ok(tctx, dcerpc_schannel_creds(p->conn->security_state.generic_state, tctx, &creds), "");
2759
2760 if (lp_client_lanman_auth(tctx->lp_ctx)) {
2761 flags |= CLI_CRED_LANMAN_AUTH;
2762 }
2763
2764 if (lp_client_ntlmv2_auth(tctx->lp_ctx)) {
2765 flags |= CLI_CRED_NTLMv2_AUTH;
2766 }
2767
2768 cli_credentials_get_ntlm_username_domain(test_credentials, tctx,
2769 &identity.account_name.string,
2770 &identity.domain_name.string);
2771
2772 identity.parameter_control =
2773 MSV1_0_ALLOW_SERVER_TRUST_ACCOUNT |
2774 MSV1_0_ALLOW_WORKSTATION_TRUST_ACCOUNT;
2775 identity.logon_id_low = 0;
2776 identity.logon_id_high = 0;
2777 identity.workstation.string = cli_credentials_get_workstation(test_credentials);
2778
2779 if (interactive) {
2780 netlogon_creds_client_authenticator(creds, &a);
2781
2782 if (!E_deshash(cli_credentials_get_password(test_credentials), pinfo.lmpassword.hash)) {
2783 ZERO_STRUCT(pinfo.lmpassword.hash);
2784 }
2785 E_md4hash(cli_credentials_get_password(test_credentials), pinfo.ntpassword.hash);
2786
2787 if (creds->negotiate_flags & NETLOGON_NEG_ARCFOUR) {
2788 netlogon_creds_arcfour_crypt(creds, pinfo.lmpassword.hash, 16);
2789 netlogon_creds_arcfour_crypt(creds, pinfo.ntpassword.hash, 16);
2790 } else {
2791 netlogon_creds_des_encrypt(creds, &pinfo.lmpassword);
2792 netlogon_creds_des_encrypt(creds, &pinfo.ntpassword);
2793 }
2794
2795 pinfo.identity_info = identity;
2796 logon.password = &pinfo;
2797
2798 r.in.logon_level = NetlogonInteractiveInformation;
2799 } else {
2800 generate_random_buffer(ninfo.challenge,
2801 sizeof(ninfo.challenge));
2802 chal = data_blob_const(ninfo.challenge,
2803 sizeof(ninfo.challenge));
2804
2805 names_blob = NTLMv2_generate_names_blob(tctx, cli_credentials_get_workstation(test_credentials),
2806 cli_credentials_get_domain(test_credentials));
2807
2808 status = cli_credentials_get_ntlm_response(test_credentials, tctx,
2809 &flags,
2810 chal,
2811 names_blob,
2812 &lm_resp, &nt_resp,
2813 NULL, NULL);
2814 torture_assert_ntstatus_ok(tctx, status, "cli_credentials_get_ntlm_response failed");
2815
2816 ninfo.lm.data = lm_resp.data;
2817 ninfo.lm.length = lm_resp.length;
2818
2819 ninfo.nt.data = nt_resp.data;
2820 ninfo.nt.length = nt_resp.length;
2821
2822 ninfo.identity_info = identity;
2823 logon.network = &ninfo;
2824
2825 r.in.logon_level = NetlogonNetworkInformation;
2826 }
2827
2828 r.in.server_name = talloc_asprintf(tctx, "\\\\%s", dcerpc_server_name(p));
2829 r.in.computer_name = cli_credentials_get_workstation(test_credentials);
2830 r.in.logon = &logon;
2831 r.in.flags = &samlogon_flags;
2832 r.out.flags = &samlogon_flags;
2833 r.out.validation = &validation;
2834 r.out.authoritative = &authoritative;
2835
2836 torture_comment(tctx, "Testing LogonSamLogon with name %s\n", identity.account_name.string);
2837
2838 r.in.validation_level = 6;
2839
2840 status = dcerpc_netr_LogonSamLogonEx(p, tctx, &r);
2841 if (NT_STATUS_EQUAL(status, NT_STATUS_INVALID_INFO_CLASS)) {
2842 r.in.validation_level = 3;
2843 status = dcerpc_netr_LogonSamLogonEx(p, tctx, &r);
2844 }
2845 if (!NT_STATUS_IS_OK(status)) {
2846 torture_assert_ntstatus_equal(tctx, status, expected_result, "LogonSamLogonEx failed");
2847 return true;
2848 } else {
2849 torture_assert_ntstatus_ok(tctx, status, "LogonSamLogonEx failed");
2850 }
2851
2852 return true;
2853 }
2854
2855 static bool test_SamLogon_with_creds(struct torture_context *tctx,
2856 struct dcerpc_pipe *p,
2857 struct cli_credentials *machine_creds,
2858 const char *acct_name,
2859 char *password,
2860 NTSTATUS expected_samlogon_result,
2861 bool interactive)
2862 {
2863 bool ret = true;
2864 struct cli_credentials *test_credentials;
2865
2866 test_credentials = cli_credentials_init(tctx);
2867
2868 cli_credentials_set_workstation(test_credentials,
2869 cli_credentials_get_workstation(machine_creds), CRED_SPECIFIED);
2870 cli_credentials_set_domain(test_credentials,
2871 cli_credentials_get_domain(machine_creds), CRED_SPECIFIED);
2872 cli_credentials_set_username(test_credentials,
2873 acct_name, CRED_SPECIFIED);
2874 cli_credentials_set_password(test_credentials,
2875 password, CRED_SPECIFIED);
2876
2877 torture_comment(tctx, "testing samlogon (%s) as %s password: %s\n",
2878 interactive ? "interactive" : "network", acct_name, password);
2879
2880 if (!test_SamLogon(tctx, p, test_credentials,
2881 expected_samlogon_result, interactive)) {
2882 torture_warning(tctx, "new password did not work\n");
2883 ret = false;
2884 }
2885
2886 return ret;
2887 }
2888
2889 static bool test_SetPassword_level(struct dcerpc_pipe *p,
2890 struct dcerpc_pipe *np,
2891 struct torture_context *tctx,
2892 struct policy_handle *handle,
2893 uint16_t level,
2894 uint32_t fields_present,
2895 uint8_t password_expired,
2896 bool *matched_expected_error,
2897 bool use_setinfo2,
2898 const char *acct_name,
2899 char **password,
2900 struct cli_credentials *machine_creds,
2901 bool use_queryinfo2,
2902 NTTIME *pwdlastset,
2903 NTSTATUS expected_samlogon_result)
2904 {
2905 const char *fields = NULL;
2906 bool ret = true;
2907
2908 switch (level) {
2909 case 21:
2910 case 23:
2911 case 25:
2912 fields = talloc_asprintf(tctx, "(fields_present: 0x%08x)",
2913 fields_present);
2914 break;
2915 default:
2916 break;
2917 }
2918
2919 torture_comment(tctx, "Testing SetUserInfo%s level %d call "
2920 "(password_expired: %d) %s\n",
2921 use_setinfo2 ? "2":"", level, password_expired,
2922 fields ? fields : "");
2923
2924 if (!test_SetUserPass_level_ex(p, tctx, handle, level,
2925 fields_present,
2926 password,
2927 password_expired,
2928 use_setinfo2,
2929 matched_expected_error)) {
2930 ret = false;
2931 }
2932
2933 if (!test_QueryUserInfo_pwdlastset(p, tctx, handle,
2934 use_queryinfo2,
2935 pwdlastset)) {
2936 ret = false;
2937 }
2938
2939 if (*matched_expected_error == true) {
2940 return ret;
2941 }
2942
2943 if (!test_SamLogon_with_creds(tctx, np,
2944 machine_creds,
2945 acct_name,
2946 *password,
2947 expected_samlogon_result,
2948 false)) {
2949 ret = false;
2950 }
2951
2952 return ret;
2953 }
2954
2955 static bool setup_schannel_netlogon_pipe(struct torture_context *tctx,
2956 struct cli_credentials *credentials,
2957 struct dcerpc_pipe **p)
2958 {
2959 struct dcerpc_binding *b;
2960
2961 torture_assert_ntstatus_ok(tctx, torture_rpc_binding(tctx, &b),
2962 "failed to get rpc binding");
2963
2964 /* We have to use schannel, otherwise the SamLogonEx fails
2965 * with INTERNAL_ERROR */
2966
2967 b->flags &= ~DCERPC_AUTH_OPTIONS;
2968 b->flags |= DCERPC_SCHANNEL | DCERPC_SIGN | DCERPC_SCHANNEL_128;
2969
2970 torture_assert_ntstatus_ok(tctx,
2971 dcerpc_pipe_connect_b(tctx, p, b, &ndr_table_netlogon,
2972 credentials, tctx->ev, tctx->lp_ctx),
2973 "failed to bind to netlogon");
2974
2975 return true;
2976 }
2977
2978 static bool test_SetPassword_pwdlastset(struct dcerpc_pipe *p,
2979 struct torture_context *tctx,
2980 uint32_t acct_flags,
2981 const char *acct_name,
2982 struct policy_handle *handle,
2983 char **password,
2984 struct cli_credentials *machine_credentials)
2985 {
2986 int s = 0, q = 0, f = 0, l = 0, z = 0;
2987 bool ret = true;
2988 int delay = 50000;
2989 bool set_levels[] = { false, true };
2990 bool query_levels[] = { false, true };
2991 uint32_t levels[] = { 18, 21, 26, 23, 24, 25 }; /* Second half only used when TEST_ALL_LEVELS defined */
2992 uint32_t nonzeros[] = { 1, 24 };
2993 uint32_t fields_present[] = {
2994 0,
2995 SAMR_FIELD_EXPIRED_FLAG,
2996 SAMR_FIELD_LAST_PWD_CHANGE,
2997 SAMR_FIELD_EXPIRED_FLAG | SAMR_FIELD_LAST_PWD_CHANGE,
2998 SAMR_FIELD_COMMENT,
2999 SAMR_FIELD_NT_PASSWORD_PRESENT,
3000 SAMR_FIELD_NT_PASSWORD_PRESENT | SAMR_FIELD_LAST_PWD_CHANGE,
3001 SAMR_FIELD_NT_PASSWORD_PRESENT | SAMR_FIELD_LM_PASSWORD_PRESENT,
3002 SAMR_FIELD_NT_PASSWORD_PRESENT | SAMR_FIELD_LM_PASSWORD_PRESENT | SAMR_FIELD_LAST_PWD_CHANGE,
3003 SAMR_FIELD_NT_PASSWORD_PRESENT | SAMR_FIELD_EXPIRED_FLAG,
3004 SAMR_FIELD_NT_PASSWORD_PRESENT | SAMR_FIELD_LM_PASSWORD_PRESENT | SAMR_FIELD_EXPIRED_FLAG,
3005 SAMR_FIELD_NT_PASSWORD_PRESENT | SAMR_FIELD_LM_PASSWORD_PRESENT | SAMR_FIELD_LAST_PWD_CHANGE | SAMR_FIELD_EXPIRED_FLAG
3006 };
3007 struct dcerpc_pipe *np = NULL;
3008
3009 if (torture_setting_bool(tctx, "samba3", false)) {
3010 delay = 999999;
3011 torture_comment(tctx, "Samba3 has second granularity, setting delay to: %d\n",
3012 delay);
3013 }
3014
3015 torture_assert(tctx, setup_schannel_netlogon_pipe(tctx, machine_credentials, &np), "");
3016
3017 /* set to 1 to enable testing for all possible opcode
3018 (SetUserInfo, SetUserInfo2, QueryUserInfo, QueryUserInfo2)
3019 combinations */
3020 #if 0
3021 #define TEST_ALL_LEVELS 1
3022 #define TEST_SET_LEVELS 1
3023 #define TEST_QUERY_LEVELS 1
3024 #endif
3025 #ifdef TEST_ALL_LEVELS
3026 for (l=0; l<ARRAY_SIZE(levels); l++) {
3027 #else
3028 for (l=0; l<(ARRAY_SIZE(levels))/2; l++) {
3029 #endif
3030 for (z=0; z<ARRAY_SIZE(nonzeros); z++) {
3031 for (f=0; f<ARRAY_SIZE(fields_present); f++) {
3032 #ifdef TEST_SET_LEVELS
3033 for (s=0; s<ARRAY_SIZE(set_levels); s++) {
3034 #endif
3035 #ifdef TEST_QUERY_LEVELS
3036 for (q=0; q<ARRAY_SIZE(query_levels); q++) {
3037 #endif
3038 NTTIME pwdlastset_old = 0;
3039 NTTIME pwdlastset_new = 0;
3040 bool matched_expected_error = false;
3041 NTSTATUS expected_samlogon_result = NT_STATUS_ACCOUNT_DISABLED;
3042
3043 torture_comment(tctx, "------------------------------\n"
3044 "Testing pwdLastSet attribute for flags: 0x%08x "
3045 "(s: %d (l: %d), q: %d)\n",
3046 acct_flags, s, levels[l], q);
3047
3048 switch (levels[l]) {
3049 case 21:
3050 case 23:
3051 case 25:
3052 if (!((fields_present[f] & SAMR_FIELD_NT_PASSWORD_PRESENT) ||
3053 (fields_present[f] & SAMR_FIELD_LM_PASSWORD_PRESENT))) {
3054 expected_samlogon_result = NT_STATUS_WRONG_PASSWORD;
3055 }
3056 break;
3057 }
3058
3059
3060 /* set #1 */
3061
3062 /* set a password and force password change (pwdlastset 0) by
3063 * setting the password expired flag to a non-0 value */
3064
3065 if (!test_SetPassword_level(p, np, tctx, handle,
3066 levels[l],
3067 fields_present[f],
3068 nonzeros[z],
3069 &matched_expected_error,
3070 set_levels[s],
3071 acct_name,
3072 password,
3073 machine_credentials,
3074 query_levels[q],
3075 &pwdlastset_old,
3076 expected_samlogon_result)) {
3077 ret = false;
3078 }
3079
3080 if (matched_expected_error == true) {
3081 /* skipping on expected failure */
3082 continue;
3083 }
3084
3085 /* pwdlastset must be 0 afterwards, except for a level 21, 23 and 25
3086 * set without the SAMR_FIELD_EXPIRED_FLAG */
3087
3088 switch (levels[l]) {
3089 case 21:
3090 case 23:
3091 case 25:
3092 if ((pwdlastset_new != 0) &&
3093 !(fields_present[f] & SAMR_FIELD_EXPIRED_FLAG)) {
3094 torture_comment(tctx, "not considering a non-0 "
3095 "pwdLastSet as a an error as the "
3096 "SAMR_FIELD_EXPIRED_FLAG has not "
3097 "been set\n");
3098 break;
3099 }
3100 default:
3101 if (pwdlastset_new != 0) {
3102 torture_warning(tctx, "pwdLastSet test failed: "
3103 "expected pwdLastSet 0 but got %lld\n",
3104 pwdlastset_old);
3105 ret = false;
3106 }
3107 break;
3108 }
3109
3110 switch (levels[l]) {
3111 case 21:
3112 case 23:
3113 case 25:
3114 if (((fields_present[f] & SAMR_FIELD_NT_PASSWORD_PRESENT) ||
3115 (fields_present[f] & SAMR_FIELD_LM_PASSWORD_PRESENT)) &&
3116 (pwdlastset_old > 0) && (pwdlastset_new > 0) &&
3117 (pwdlastset_old >= pwdlastset_new)) {
3118 torture_warning(tctx, "pwdlastset not increasing\n");
3119 ret = false;
3120 }
3121 break;
3122 default:
3123 if ((pwdlastset_old > 0) && (pwdlastset_new > 0) &&
3124 (pwdlastset_old >= pwdlastset_new)) {
3125 torture_warning(tctx, "pwdlastset not increasing\n");
3126 ret = false;
3127 }
3128 break;
3129 }
3130
3131 usleep(delay);
3132
3133 /* set #2 */
3134
3135 /* set a password, pwdlastset needs to get updated (increased
3136 * value), password_expired value used here is 0 */
3137
3138 if (!test_SetPassword_level(p, np, tctx, handle,
3139 levels[l],
3140 fields_present[f],
3141 0,
3142 &matched_expected_error,
3143 set_levels[s],
3144 acct_name,
3145 password,
3146 machine_credentials,
3147 query_levels[q],
3148 &pwdlastset_new,
3149 expected_samlogon_result)) {
3150 ret = false;
3151 }
3152
3153 /* when a password has been changed, pwdlastset must not be 0 afterwards
3154 * and must be larger then the old value */
3155
3156 switch (levels[l]) {
3157 case 21:
3158 case 23:
3159 case 25:
3160
3161 /* SAMR_FIELD_EXPIRED_FLAG has not been set and no
3162 * password has been changed, old and new pwdlastset
3163 * need to be the same value */
3164
3165 if (!(fields_present[f] & SAMR_FIELD_EXPIRED_FLAG) &&
3166 !((fields_present[f] & SAMR_FIELD_NT_PASSWORD_PRESENT) ||
3167 (fields_present[f] & SAMR_FIELD_LM_PASSWORD_PRESENT)))
3168 {
3169 torture_assert_int_equal(tctx, pwdlastset_old,
3170 pwdlastset_new, "pwdlastset must be equal");
3171 break;
3172 }
3173 default:
3174 if (pwdlastset_old >= pwdlastset_new) {
3175 torture_warning(tctx, "pwdLastSet test failed: "
3176 "expected last pwdlastset (%lld) < new pwdlastset (%lld)\n",
3177 pwdlastset_old, pwdlastset_new);
3178 ret = false;
3179 }
3180 if (pwdlastset_new == 0) {
3181 torture_warning(tctx, "pwdLastSet test failed: "
3182 "expected non-0 pwdlastset, got: %lld\n",
3183 pwdlastset_new);
3184 ret = false;
3185 }
3186 }
3187
3188 switch (levels[l]) {
3189 case 21:
3190 case 23:
3191 case 25:
3192 if (((fields_present[f] & SAMR_FIELD_NT_PASSWORD_PRESENT) ||
3193 (fields_present[f] & SAMR_FIELD_LM_PASSWORD_PRESENT)) &&
3194 (pwdlastset_old > 0) && (pwdlastset_new > 0) &&
3195 (pwdlastset_old >= pwdlastset_new)) {
3196 torture_warning(tctx, "pwdlastset not increasing\n");
3197 ret = false;
3198 }
3199 break;
3200 default:
3201 if ((pwdlastset_old > 0) && (pwdlastset_new > 0) &&
3202 (pwdlastset_old >= pwdlastset_new)) {
3203 torture_warning(tctx, "pwdlastset not increasing\n");
3204 ret = false;
3205 }
3206 break;
3207 }
3208
3209 pwdlastset_old = pwdlastset_new;
3210
3211 usleep(delay);
3212
3213 /* set #2b */
3214
3215 /* set a password, pwdlastset needs to get updated (increased
3216 * value), password_expired value used here is 0 */
3217
3218 if (!test_SetPassword_level(p, np, tctx, handle,
3219 levels[l],
3220 fields_present[f],
3221 0,
3222 &matched_expected_error,
3223 set_levels[s],
3224 acct_name,
3225 password,
3226 machine_credentials,
3227 query_levels[q],
3228 &pwdlastset_new,
3229 expected_samlogon_result)) {
3230 ret = false;
3231 }
3232
3233 /* when a password has been changed, pwdlastset must not be 0 afterwards
3234 * and must be larger then the old value */
3235
3236 switch (levels[l]) {
3237 case 21:
3238 case 23:
3239 case 25:
3240
3241 /* if no password has been changed, old and new pwdlastset
3242 * need to be the same value */
3243
3244 if (!((fields_present[f] & SAMR_FIELD_NT_PASSWORD_PRESENT) ||
3245 (fields_present[f] & SAMR_FIELD_LM_PASSWORD_PRESENT)))
3246 {
3247 torture_assert_int_equal(tctx, pwdlastset_old,
3248 pwdlastset_new, "pwdlastset must be equal");
3249 break;
3250 }
3251 default:
3252 if (pwdlastset_old >= pwdlastset_new) {
3253 torture_warning(tctx, "pwdLastSet test failed: "
3254 "expected last pwdlastset (%lld) < new pwdlastset (%lld)\n",
3255 pwdlastset_old, pwdlastset_new);
3256 ret = false;
3257 }
3258 if (pwdlastset_new == 0) {
3259 torture_warning(tctx, "pwdLastSet test failed: "
3260 "expected non-0 pwdlastset, got: %lld\n",
3261 pwdlastset_new);
3262 ret = false;
3263 }
3264 }
3265
3266 /* set #3 */
3267
3268 /* set a password and force password change (pwdlastset 0) by
3269 * setting the password expired flag to a non-0 value */
3270
3271 if (!test_SetPassword_level(p, np, tctx, handle,
3272 levels[l],
3273 fields_present[f],
3274 nonzeros[z],
3275 &matched_expected_error,
3276 set_levels[s],
3277 acct_name,
3278 password,
3279 machine_credentials,
3280 query_levels[q],
3281 &pwdlastset_new,
3282 expected_samlogon_result)) {
3283 ret = false;
3284 }
3285
3286 /* pwdlastset must be 0 afterwards, except for a level 21, 23 and 25
3287 * set without the SAMR_FIELD_EXPIRED_FLAG */
3288
3289 switch (levels[l]) {
3290 case 21:
3291 case 23:
3292 case 25:
3293 if ((pwdlastset_new != 0) &&
3294 !(fields_present[f] & SAMR_FIELD_EXPIRED_FLAG)) {
3295 torture_comment(tctx, "not considering a non-0 "
3296 "pwdLastSet as a an error as the "
3297 "SAMR_FIELD_EXPIRED_FLAG has not "
3298 "been set\n");
3299 break;
3300 }
3301
3302 /* SAMR_FIELD_EXPIRED_FLAG has not been set and no
3303 * password has been changed, old and new pwdlastset
3304 * need to be the same value */
3305
3306 if (!(fields_present[f] & SAMR_FIELD_EXPIRED_FLAG) &&
3307 !((fields_present[f] & SAMR_FIELD_NT_PASSWORD_PRESENT) ||
3308 (fields_present[f] & SAMR_FIELD_LM_PASSWORD_PRESENT)))
3309 {
3310 torture_assert_int_equal(tctx, pwdlastset_old,
3311 pwdlastset_new, "pwdlastset must be equal");
3312 break;
3313 }
3314 default:
3315
3316 if (pwdlastset_old == pwdlastset_new) {
3317 torture_warning(tctx, "pwdLastSet test failed: "
3318 "expected last pwdlastset (%lld) != new pwdlastset (%lld)\n",
3319 pwdlastset_old, pwdlastset_new);
3320 ret = false;
3321 }
3322
3323 if (pwdlastset_new != 0) {
3324 torture_warning(tctx, "pwdLastSet test failed: "
3325 "expected pwdLastSet 0, got %lld\n",
3326 pwdlastset_old);
3327 ret = false;
3328 }
3329 break;
3330 }
3331
3332 switch (levels[l]) {
3333 case 21:
3334 case 23:
3335 case 25:
3336 if (((fields_present[f] & SAMR_FIELD_NT_PASSWORD_PRESENT) ||
3337 (fields_present[f] & SAMR_FIELD_LM_PASSWORD_PRESENT)) &&
3338 (pwdlastset_old > 0) && (pwdlastset_new > 0) &&
3339 (pwdlastset_old >= pwdlastset_new)) {
3340 torture_warning(tctx, "pwdlastset not increasing\n");
3341 ret = false;
3342 }
3343 break;
3344 default:
3345 if ((pwdlastset_old > 0) && (pwdlastset_new > 0) &&
3346 (pwdlastset_old >= pwdlastset_new)) {
3347 torture_warning(tctx, "pwdlastset not increasing\n");
3348 ret = false;
3349 }
3350 break;
3351 }
3352
3353 /* if the level we are testing does not have a fields_present
3354 * field, skip all fields present tests by setting f to to
3355 * arraysize */
3356 switch (levels[l]) {
3357 case 18:
3358 case 24:
3359 case 26:
3360 f = ARRAY_SIZE(fields_present);
3361 break;
3362 }
3363
3364 #ifdef TEST_QUERY_LEVELS
3365 }
3366 #endif
3367 #ifdef TEST_SET_LEVELS
3368 }
3369 #endif
3370 } /* fields present */
3371 } /* nonzeros */
3372 } /* levels */
3373
3374 #undef TEST_SET_LEVELS
3375 #undef TEST_QUERY_LEVELS
3376
3377 talloc_free(np);
3378
3379 return ret;
3380 }
3381
3382 static bool test_QueryUserInfo_badpwdcount(struct dcerpc_pipe *p,
3383 struct torture_context *tctx,
3384 struct policy_handle *handle,
3385 uint32_t *badpwdcount)
3386 {
3387 union samr_UserInfo *info;
3388 struct samr_QueryUserInfo r;
3389
3390 r.in.user_handle = handle;
3391 r.in.level = 3;
3392 r.out.info = &info;
3393
3394 torture_comment(tctx, "Testing QueryUserInfo level %d", r.in.level);
3395
3396 torture_assert_ntstatus_ok(tctx, dcerpc_samr_QueryUserInfo(p, tctx, &r),
3397 "failed to query userinfo");
3398
3399 *badpwdcount = info->info3.bad_password_count;
3400
3401 torture_comment(tctx, " (bad password count: %d)\n", *badpwdcount);
3402
3403 return true;
3404 }
3405
3406 static bool test_SetUserInfo_acct_flags(struct dcerpc_pipe *p,
3407 struct torture_context *tctx,
3408 struct policy_handle *user_handle,
3409 uint32_t acct_flags)
3410 {
3411 struct samr_SetUserInfo r;
3412 union samr_UserInfo user_info;
3413
3414 torture_comment(tctx, "Testing SetUserInfo level 16\n");
3415
3416 user_info.info16.acct_flags = acct_flags;
3417
3418 r.in.user_handle = user_handle;
3419 r.in.level = 16;
3420 r.in.info = &user_info;
3421
3422 torture_assert_ntstatus_ok(tctx, dcerpc_samr_SetUserInfo(p, tctx, &r),
3423 "failed to set account flags");
3424
3425 return true;
3426 }
3427
3428 static bool test_reset_badpwdcount(struct dcerpc_pipe *p,
3429 struct torture_context *tctx,
3430 struct policy_handle *user_handle,
3431 uint32_t acct_flags,
3432 char **password)
3433 {
3434 torture_assert(tctx, test_SetUserPass(p, tctx, user_handle, password),
3435 "failed to set password");
3436
3437 torture_comment(tctx, "Testing SetUserInfo level 16 (enable account)\n");
3438
3439 torture_assert(tctx,
3440 test_SetUserInfo_acct_flags(p, tctx, user_handle,
3441 acct_flags & ~ACB_DISABLED),
3442 "failed to enable user");
3443
3444 torture_assert(tctx, test_SetUserPass(p, tctx, user_handle, password),
3445 "failed to set password");
3446
3447 return true;
3448 }
3449
3450 static bool test_SetDomainInfo(struct dcerpc_pipe *p,
3451 struct torture_context *tctx,
3452 struct policy_handle *domain_handle,
3453 enum samr_DomainInfoClass level,
3454 union samr_DomainInfo *info)
3455 {
3456 struct samr_SetDomainInfo r;
3457
3458 r.in.domain_handle = domain_handle;
3459 r.in.level = level;
3460 r.in.info = info;
3461
3462 torture_assert_ntstatus_ok(tctx,
3463 dcerpc_samr_SetDomainInfo(p, tctx, &r),
3464 "failed to set domain info");
3465
3466 return true;
3467 }
3468
3469 static bool test_SetDomainInfo_ntstatus(struct dcerpc_pipe *p,
3470 struct torture_context *tctx,
3471 struct policy_handle *domain_handle,
3472 enum samr_DomainInfoClass level,
3473 union samr_DomainInfo *info,
3474 NTSTATUS expected)
3475 {
3476 struct samr_SetDomainInfo r;
3477
3478 r.in.domain_handle = domain_handle;
3479 r.in.level = level;
3480 r.in.info = info;
3481
3482 torture_assert_ntstatus_equal(tctx,
3483 dcerpc_samr_SetDomainInfo(p, tctx, &r),
3484 expected,
3485 "");
3486
3487 return true;
3488 }
3489
3490 static bool test_QueryDomainInfo2_level(struct dcerpc_pipe *p,
3491 struct torture_context *tctx,
3492 struct policy_handle *domain_handle,
3493 enum samr_DomainInfoClass level,
3494 union samr_DomainInfo **q_info)
3495 {
3496 struct samr_QueryDomainInfo2 r;
3497
3498 r.in.domain_handle = domain_handle;
3499 r.in.level = level;
3500 r.out.info = q_info;
3501
3502 torture_assert_ntstatus_ok(tctx,
3503 dcerpc_samr_QueryDomainInfo2(p, tctx, &r),
3504 "failed to query domain info");
3505
3506 return true;
3507 }
3508
3509 static bool test_Password_badpwdcount(struct dcerpc_pipe *p,
3510 struct dcerpc_pipe *np,
3511 struct torture_context *tctx,
3512 uint32_t acct_flags,
3513 const char *acct_name,
3514 struct policy_handle *domain_handle,
3515 struct policy_handle *user_handle,
3516 char **password,
3517 struct cli_credentials *machine_credentials,
3518 const char *comment,
3519 bool disable,
3520 bool interactive,
3521 NTSTATUS expected_success_status,
3522 struct samr_DomInfo1 *info1,
3523 struct samr_DomInfo12 *info12)
3524 {
3525 union samr_DomainInfo info;
3526 char **passwords;
3527 int i;
3528 uint32_t badpwdcount, tmp;
3529 uint32_t password_history_length = 12;
3530 uint32_t lockout_threshold = 15;
3531
3532 torture_comment(tctx, "\nTesting bad pwd count with: %s\n", comment);
3533
3534 torture_assert(tctx, password_history_length < lockout_threshold,
3535 "password history length needs to be smaller than account lockout threshold for this test");
3536
3537
3538 /* set policies */
3539
3540 info.info1 = *info1;
3541 info.info1.password_history_length = password_history_length;
3542
3543 torture_assert(tctx,
3544 test_SetDomainInfo(p, tctx, domain_handle,
3545 DomainPasswordInformation, &info),
3546 "failed to set password history length");
3547
3548 info.info12 = *info12;
3549 info.info12.lockout_threshold = lockout_threshold;
3550
3551 torture_assert(tctx,
3552 test_SetDomainInfo(p, tctx, domain_handle,
3553 DomainLockoutInformation, &info),
3554 "failed to set lockout threshold");
3555
3556 /* reset bad pwd count */
3557
3558 torture_assert(tctx,
3559 test_reset_badpwdcount(p, tctx, user_handle, acct_flags, password), "");
3560
3561
3562 /* enable or disable account */
3563 if (disable) {
3564 torture_assert(tctx,
3565 test_SetUserInfo_acct_flags(p, tctx, user_handle,
3566 acct_flags | ACB_DISABLED),
3567 "failed to disable user");
3568 } else {
3569 torture_assert(tctx,
3570 test_SetUserInfo_acct_flags(p, tctx, user_handle,
3571 acct_flags & ~ACB_DISABLED),
3572 "failed to enable user");
3573 }
3574
3575
3576 /* setup password history */
3577
3578 passwords = talloc_array(tctx, char *, password_history_length);
3579
3580 for (i=0; i < password_history_length; i++) {
3581
3582 torture_assert(tctx, test_SetUserPass(p, tctx, user_handle, password),
3583 "failed to set password");
3584 passwords[i] = talloc_strdup(tctx, *password);
3585
3586 if (!test_SamLogon_with_creds(tctx, np, machine_credentials,
3587 acct_name, passwords[i],
3588 expected_success_status, interactive)) {
3589 torture_fail(tctx, "failed to auth with latest password");
3590 }
3591
3592 torture_assert(tctx,
3593 test_QueryUserInfo_badpwdcount(p, tctx, user_handle, &badpwdcount), "");
3594
3595 torture_assert_int_equal(tctx, badpwdcount, 0, "expected badpwdcount to be 0");
3596 }
3597
3598
3599 /* test with wrong password */
3600
3601 if (!test_SamLogon_with_creds(tctx, np, machine_credentials,
3602 acct_name, "random_crap",
3603 NT_STATUS_WRONG_PASSWORD, interactive)) {
3604 torture_fail(tctx, "succeeded to authenticate with wrong password");
3605 }
3606
3607 torture_assert(tctx,
3608 test_QueryUserInfo_badpwdcount(p, tctx, user_handle, &badpwdcount), "");
3609
3610 torture_assert_int_equal(tctx, badpwdcount, 1, "expected badpwdcount to be 1");
3611
3612
3613 /* test with latest good password */
3614
3615 if (!test_SamLogon_with_creds(tctx, np, machine_credentials, acct_name,
3616 passwords[password_history_length-1],
3617 expected_success_status, interactive)) {
3618 torture_fail(tctx, "succeeded to authenticate with wrong password");
3619 }
3620
3621 torture_assert(tctx,
3622 test_QueryUserInfo_badpwdcount(p, tctx, user_handle, &badpwdcount), "");
3623
3624 if (disable) {
3625 torture_assert_int_equal(tctx, badpwdcount, 1, "expected badpwdcount to be 1");
3626 } else {
3627 /* only enabled accounts get the bad pwd count reset upon
3628 * successful logon */
3629 torture_assert_int_equal(tctx, badpwdcount, 0, "expected badpwdcount to be 0");
3630 }
3631
3632 tmp = badpwdcount;
3633
3634
3635 /* test password history */
3636
3637 for (i=0; i < password_history_length; i++) {
3638
3639 torture_comment(tctx, "Testing bad password count behavior with "
3640 "password #%d of #%d\n", i, password_history_length);
3641
3642 /* - network samlogon will succeed auth and not
3643 * increase badpwdcount for 2 last entries
3644 * - interactive samlogon only for the last one */
3645
3646 if (i == password_history_length - 1 ||
3647 (i == password_history_length - 2 && !interactive)) {
3648
3649 if (!test_SamLogon_with_creds(tctx, np, machine_credentials,
3650 acct_name, passwords[i],
3651 expected_success_status, interactive)) {
3652 torture_fail(tctx, talloc_asprintf(tctx, "succeeded to authenticate with old password (#%d of #%d in history)", i, password_history_length));
3653 }
3654
3655 torture_assert(tctx,
3656 test_QueryUserInfo_badpwdcount(p, tctx, user_handle, &badpwdcount), "");
3657
3658 if (disable) {
3659 /* torture_comment(tctx, "expecting bad pwd count to *NOT INCREASE* for pwd history entry %d\n", i); */
3660 torture_assert_int_equal(tctx, badpwdcount, tmp, "unexpected badpwdcount");
3661 } else {
3662 /* torture_comment(tctx, "expecting bad pwd count to be 0 for pwd history entry %d\n", i); */
3663 torture_assert_int_equal(tctx, badpwdcount, 0, "expected badpwdcount to be 0");
3664 }
3665
3666 tmp = badpwdcount;
3667
3668 continue;
3669 }
3670
3671 if (!test_SamLogon_with_creds(tctx, np, machine_credentials,
3672 acct_name, passwords[i],
3673 NT_STATUS_WRONG_PASSWORD, interactive)) {
3674 torture_fail(tctx, talloc_asprintf(tctx, "succeeded to authenticate with old password (#%d of #%d in history)", i, password_history_length));
3675 }
3676
3677 torture_assert(tctx,
3678 test_QueryUserInfo_badpwdcount(p, tctx, user_handle, &badpwdcount), "");
3679
3680 /* - network samlogon will fail auth but not increase
3681 * badpwdcount for 3rd last entry
3682 * - interactive samlogon for 3rd and 2nd last entry */
3683
3684 if (i == password_history_length - 3 ||
3685 (i == password_history_length - 2 && interactive)) {
3686 /* torture_comment(tctx, "expecting bad pwd count to *NOT INCREASE * by one for pwd history entry %d\n", i); */
3687 torture_assert_int_equal(tctx, badpwdcount, tmp, "unexpected badpwdcount");
3688 } else {
3689 /* torture_comment(tctx, "expecting bad pwd count to increase by one for pwd history entry %d\n", i); */
3690 torture_assert_int_equal(tctx, badpwdcount, tmp + 1, "unexpected badpwdcount");
3691 }
3692
3693 tmp = badpwdcount;
3694 }
3695
3696 return true;
3697 }
3698
3699 static bool test_Password_badpwdcount_wrap(struct dcerpc_pipe *p,
3700 struct torture_context *tctx,
3701 uint32_t acct_flags,
3702 const char *acct_name,
3703 struct policy_handle *domain_handle,
3704 struct policy_handle *user_handle,
3705 char **password,
3706 struct cli_credentials *machine_credentials)
3707 {
3708 union samr_DomainInfo *q_info, s_info;
3709 struct samr_DomInfo1 info1, _info1;
3710 struct samr_DomInfo12 info12, _info12;
3711 bool ret = true;
3712 struct dcerpc_pipe *np;
3713 int i;
3714
3715 struct {
3716 const char *comment;
3717 bool disabled;
3718 bool interactive;
3719 NTSTATUS expected_success_status;
3720 } creds[] = {
3721 {
3722 .comment = "network logon (disabled account)",
3723 .disabled = true,
3724 .interactive = false,
3725 .expected_success_status= NT_STATUS_ACCOUNT_DISABLED
3726 },
3727 {
3728 .comment = "network logon (enabled account)",
3729 .disabled = false,
3730 .interactive = false,
3731 .expected_success_status= NT_STATUS_OK
3732 },
3733 {
3734 .comment = "interactive logon (disabled account)",
3735 .disabled = true,
3736 .interactive = true,
3737 .expected_success_status= NT_STATUS_ACCOUNT_DISABLED
3738 },
3739 {
3740 .comment = "interactive logon (enabled account)",
3741 .disabled = false,
3742 .interactive = true,
3743 .expected_success_status= NT_STATUS_OK
3744 },
3745 };
3746
3747 torture_assert(tctx, setup_schannel_netlogon_pipe(tctx, machine_credentials, &np), "");
3748
3749 /* backup old policies */
3750
3751 torture_assert(tctx,
3752 test_QueryDomainInfo2_level(p, tctx, domain_handle,
3753 DomainPasswordInformation, &q_info),
3754 "failed to query domain info level 1");
3755
3756 info1 = q_info->info1;
3757 _info1 = info1;
3758
3759 torture_assert(tctx,
3760 test_QueryDomainInfo2_level(p, tctx, domain_handle,
3761 DomainLockoutInformation, &q_info),
3762 "failed to query domain info level 12");
3763
3764 info12 = q_info->info12;
3765 _info12 = info12;
3766
3767 /* run tests */
3768
3769 for (i=0; i < ARRAY_SIZE(creds); i++) {
3770
3771 /* skip trust tests for now */
3772 if (acct_flags & ACB_WSTRUST ||
3773 acct_flags & ACB_SVRTRUST ||
3774 acct_flags & ACB_DOMTRUST) {
3775 continue;
3776 }
3777
3778 ret &= test_Password_badpwdcount(p, np, tctx, acct_flags, acct_name,
3779 domain_handle, user_handle, password,
3780 machine_credentials,
3781 creds[i].comment,
3782 creds[i].disabled,
3783 creds[i].interactive,
3784 creds[i].expected_success_status,
3785 &_info1, &_info12);
3786 if (!ret) {
3787 torture_warning(tctx, "TEST #%d (%s) failed\n", i, creds[i].comment);
3788 } else {
3789 torture_comment(tctx, "TEST #%d (%s) succeeded\n", i, creds[i].comment);
3790 }
3791 }
3792
3793 /* restore policies */
3794
3795 s_info.info1 = info1;
3796
3797 torture_assert(tctx,
3798 test_SetDomainInfo(p, tctx, domain_handle,
3799 DomainPasswordInformation, &s_info),
3800 "failed to set password information");
3801
3802 s_info.info12 = info12;
3803
3804 torture_assert(tctx,
3805 test_SetDomainInfo(p, tctx, domain_handle,
3806 DomainLockoutInformation, &s_info),
3807 "failed to set lockout information");
3808
3809 return ret;
3810 }
3811
3812 static bool test_QueryUserInfo_acct_flags(struct dcerpc_pipe *p,
3813 struct torture_context *tctx,
3814 struct policy_handle *handle,
3815 uint32_t *acct_flags)
3816 {
3817 union samr_UserInfo *info;
3818 struct samr_QueryUserInfo r;
3819
3820 r.in.user_handle = handle;
3821 r.in.level = 16;
3822 r.out.info = &info;
3823
3824 torture_comment(tctx, "Testing QueryUserInfo level %d", r.in.level);
3825
3826 torture_assert_ntstatus_ok(tctx, dcerpc_samr_QueryUserInfo(p, tctx, &r),
3827 "failed to query userinfo");
3828
3829 *acct_flags = info->info16.acct_flags;
3830
3831 torture_comment(tctx, " (acct_flags: 0x%08x)\n", *acct_flags);
3832
3833 return true;
3834 }
3835
3836 static bool test_Password_lockout(struct dcerpc_pipe *p,
3837 struct dcerpc_pipe *np,
3838 struct torture_context *tctx,
3839 uint32_t acct_flags,
3840 const char *acct_name,
3841 struct policy_handle *domain_handle,
3842 struct policy_handle *user_handle,
3843 char **password,
3844 struct cli_credentials *machine_credentials,
3845 const char *comment,
3846 bool disable,
3847 bool interactive,
3848 NTSTATUS expected_success_status,
3849 struct samr_DomInfo1 *info1,
3850 struct samr_DomInfo12 *info12)
3851 {
3852 union samr_DomainInfo info;
3853 uint32_t badpwdcount;
3854 uint32_t password_history_length = 1;
3855 uint64_t lockout_threshold = 1;
3856 uint32_t lockout_seconds = 5;
3857 uint64_t delta_time_factor = 10 * 1000 * 1000;
3858
3859 torture_comment(tctx, "\nTesting account lockout: %s\n", comment);
3860
3861 /* set policies */
3862
3863 info.info1 = *info1;
3864
3865 torture_comment(tctx, "setting password history lenght.\n");
3866 info.info1.password_history_length = password_history_length;
3867
3868 torture_assert(tctx,
3869 test_SetDomainInfo(p, tctx, domain_handle,
3870 DomainPasswordInformation, &info),
3871 "failed to set password history length");
3872
3873 info.info12 = *info12;
3874 info.info12.lockout_threshold = lockout_threshold;
3875
3876 /* set lockout duration < lockout window: should fail */
3877 info.info12.lockout_duration = ~(lockout_seconds * delta_time_factor);
3878 info.info12.lockout_window = ~((lockout_seconds + 1) * delta_time_factor);
3879
3880 torture_assert(tctx,
3881 test_SetDomainInfo_ntstatus(p, tctx, domain_handle,
3882 DomainLockoutInformation, &info,
3883 NT_STATUS_INVALID_PARAMETER),
3884 "setting lockout duration < lockout window gave unexpected result");
3885
3886 info.info12.lockout_duration = 0;
3887 info.info12.lockout_window = 0;
3888
3889 torture_assert(tctx,
3890 test_SetDomainInfo(p, tctx, domain_handle,
3891 DomainLockoutInformation, &info),
3892 "failed to set lockout window and duration to 0");
3893
3894
3895 /* set lockout duration of 5 seconds */
3896 info.info12.lockout_duration = ~(lockout_seconds * delta_time_factor);
3897 info.info12.lockout_window = ~(lockout_seconds * delta_time_factor);
3898
3899 torture_assert(tctx,
3900 test_SetDomainInfo(p, tctx, domain_handle,
3901 DomainLockoutInformation, &info),
3902 "failed to set lockout window and duration to 5 seconds");
3903
3904 /* reset bad pwd count */
3905
3906 torture_assert(tctx,
3907 test_reset_badpwdcount(p, tctx, user_handle, acct_flags, password), "");
3908
3909
3910 /* enable or disable account */
3911
3912 if (disable) {
3913 torture_assert(tctx,
3914 test_SetUserInfo_acct_flags(p, tctx, user_handle,
3915 acct_flags | ACB_DISABLED),
3916 "failed to disable user");
3917 } else {
3918 torture_assert(tctx,
3919 test_SetUserInfo_acct_flags(p, tctx, user_handle,
3920 acct_flags & ~ACB_DISABLED),
3921 "failed to enable user");
3922 }
3923
3924
3925 /* test logon with right password */
3926
3927 if (!test_SamLogon_with_creds(tctx, np, machine_credentials,
3928 acct_name, *password,
3929 expected_success_status, interactive)) {
3930 torture_fail(tctx, "failed to auth with latest password");
3931 }
3932
3933 torture_assert(tctx,
3934 test_QueryUserInfo_badpwdcount(p, tctx, user_handle, &badpwdcount), "");
3935 torture_assert_int_equal(tctx, badpwdcount, 0, "expected badpwdcount to be 0");
3936
3937
3938 /* test with wrong password ==> lockout */
3939
3940 if (!test_SamLogon_with_creds(tctx, np, machine_credentials,
3941 acct_name, "random_crap",
3942 NT_STATUS_WRONG_PASSWORD, interactive)) {
3943 torture_fail(tctx, "succeeded to authenticate with wrong password");
3944 }
3945
3946 torture_assert(tctx,
3947 test_QueryUserInfo_badpwdcount(p, tctx, user_handle, &badpwdcount), "");
3948 torture_assert_int_equal(tctx, badpwdcount, 1, "expected badpwdcount to be 1");
3949
3950 torture_assert(tctx,
3951 test_QueryUserInfo_acct_flags(p, tctx, user_handle, &acct_flags), "");
3952 torture_assert_int_equal(tctx, acct_flags & ACB_AUTOLOCK, 0,
3953 "expected account to be locked");
3954
3955
3956 /* test with good password */
3957
3958 if (!test_SamLogon_with_creds(tctx, np, machine_credentials, acct_name,
3959 *password,
3960 NT_STATUS_ACCOUNT_LOCKED_OUT, interactive))
3961 {
3962 torture_fail(tctx, "authenticate did not return NT_STATUS_ACCOUNT_LOCKED_OUT");
3963 }
3964
3965 /* bad pwd count should not get updated */
3966 torture_assert(tctx,
3967 test_QueryUserInfo_badpwdcount(p, tctx, user_handle, &badpwdcount), "");
3968 torture_assert_int_equal(tctx, badpwdcount, 1, "expected badpwdcount to be 1");
3969
3970 /* curiously, windows does _not_ set the autlock flag */
3971 torture_assert(tctx,
3972 test_QueryUserInfo_acct_flags(p, tctx, user_handle, &acct_flags), "");
3973 torture_assert_int_equal(tctx, acct_flags & ACB_AUTOLOCK, 0,
3974 "expected account to be locked");
3975
3976
3977 /* with bad password */
3978
3979 if (!test_SamLogon_with_creds(tctx, np, machine_credentials,
3980 acct_name, "random_crap2",
3981 NT_STATUS_ACCOUNT_LOCKED_OUT, interactive))
3982 {
3983 torture_fail(tctx, "authenticate did not return NT_STATUS_ACCOUNT_LOCKED_OUT");
3984 }
3985
3986 /* bad pwd count should not get updated */
3987 torture_assert(tctx,
3988 test_QueryUserInfo_badpwdcount(p, tctx, user_handle, &badpwdcount), "");
3989 torture_assert_int_equal(tctx, badpwdcount, 1, "expected badpwdcount to be 1");
3990
3991 /* curiously, windows does _not_ set the autlock flag */
3992 torture_assert(tctx,
3993 test_QueryUserInfo_acct_flags(p, tctx, user_handle, &acct_flags), "");
3994 torture_assert_int_equal(tctx, acct_flags & ACB_AUTOLOCK, 0,
3995 "expected account to be locked");
3996
3997
3998 /* let lockout duration expire ==> unlock */
3999
4000 torture_comment(tctx, "let lockout duration expire...\n");
4001 sleep(lockout_seconds + 1);
4002
4003 if (!test_SamLogon_with_creds(tctx, np, machine_credentials, acct_name,
4004 *password,
4005 expected_success_status, interactive))
4006 {
4007 torture_fail(tctx, "failed to authenticate after lockout expired");
4008 }
4009
4010 torture_assert(tctx,
4011 test_QueryUserInfo_acct_flags(p, tctx, user_handle, &acct_flags), "");
4012 torture_assert_int_equal(tctx, acct_flags & ACB_AUTOLOCK, 0,
4013 "expected account not to be locked");
4014
4015 return true;
4016 }
4017
4018 static bool test_Password_lockout_wrap(struct dcerpc_pipe *p,
4019 struct torture_context *tctx,
4020 uint32_t acct_flags,
4021 const char *acct_name,
4022 struct policy_handle *domain_handle,
4023 struct policy_handle *user_handle,
4024 char **password,
4025 struct cli_credentials *machine_credentials)
4026 {
4027 union samr_DomainInfo *q_info, s_info;
4028 struct samr_DomInfo1 info1, _info1;
4029 struct samr_DomInfo12 info12, _info12;
4030 bool ret = true;
4031 struct dcerpc_pipe *np;
4032 int i;
4033
4034 struct {
4035 const char *comment;
4036 bool disabled;
4037 bool interactive;
4038 NTSTATUS expected_success_status;
4039 } creds[] = {
4040 {
4041 .comment = "network logon (disabled account)",
4042 .disabled = true,
4043 .interactive = false,
4044 .expected_success_status= NT_STATUS_ACCOUNT_DISABLED
4045 },
4046 {
4047 .comment = "network logon (enabled account)",
4048 .disabled = false,
4049 .interactive = false,
4050 .expected_success_status= NT_STATUS_OK
4051 },
4052 {
4053 .comment = "interactive logon (disabled account)",
4054 .disabled = true,
4055 .interactive = true,
4056 .expected_success_status= NT_STATUS_ACCOUNT_DISABLED
4057 },
4058 {
4059 .comment = "interactive logon (enabled account)",
4060 .disabled = false,
4061 .interactive = true,
4062 .expected_success_status= NT_STATUS_OK
4063 },
4064 };
4065
4066 torture_assert(tctx, setup_schannel_netlogon_pipe(tctx, machine_credentials, &np), "");
4067
4068 /* backup old policies */
4069
4070 torture_assert(tctx,
4071 test_QueryDomainInfo2_level(p, tctx, domain_handle,
4072 DomainPasswordInformation, &q_info),
4073 "failed to query domain info level 1");
4074
4075 info1 = q_info->info1;
4076 _info1 = info1;
4077
4078 torture_assert(tctx,
4079 test_QueryDomainInfo2_level(p, tctx, domain_handle,
4080 DomainLockoutInformation, &q_info),
4081 "failed to query domain info level 12");
4082
4083 info12 = q_info->info12;
4084 _info12 = info12;
4085
4086 /* run tests */
4087
4088 for (i=0; i < ARRAY_SIZE(creds); i++) {
4089
4090 /* skip trust tests for now */
4091 if (acct_flags & ACB_WSTRUST ||
4092 acct_flags & ACB_SVRTRUST ||
4093 acct_flags & ACB_DOMTRUST) {
4094 continue;
4095 }
4096
4097 ret &= test_Password_lockout(p, np, tctx, acct_flags, acct_name,
4098 domain_handle, user_handle, password,
4099 machine_credentials,
4100 creds[i].comment,
4101 creds[i].disabled,
4102 creds[i].interactive,
4103 creds[i].expected_success_status,
4104 &_info1, &_info12);
4105 if (!ret) {
4106 torture_warning(tctx, "TEST #%d (%s) failed\n", i, creds[i].comment);
4107 } else {
4108 torture_comment(tctx, "TEST #%d (%s) succeeded\n", i, creds[i].comment);
4109 }
4110 }
4111
4112 /* restore policies */
4113
4114 s_info.info1 = info1;
4115
4116 torture_assert(tctx,
4117 test_SetDomainInfo(p, tctx, domain_handle,
4118 DomainPasswordInformation, &s_info),
4119 "failed to set password information");
4120
4121 s_info.info12 = info12;
4122
4123 torture_assert(tctx,
4124 test_SetDomainInfo(p, tctx, domain_handle,
4125 DomainLockoutInformation, &s_info),
4126 "failed to set lockout information");
4127
4128 return ret;
4129 }
4130
4131 static bool test_DeleteUser_with_privs(struct dcerpc_pipe *p,
4132 struct dcerpc_pipe *lp,
4133 struct torture_context *tctx,
4134 struct policy_handle *domain_handle,
4135 struct policy_handle *lsa_handle,
4136 struct policy_handle *user_handle,
4137 const struct dom_sid *domain_sid,
4138 uint32_t rid,
4139 struct cli_credentials *machine_credentials)
4140 {
4141 NTSTATUS status;
4142 bool ret = true;
4143
4144 struct policy_handle lsa_acct_handle;
4145 struct dom_sid *user_sid;
4146
4147 user_sid = dom_sid_add_rid(tctx, domain_sid, rid);
4148
4149 {
4150 struct lsa_EnumAccountRights r;
4151 struct lsa_RightSet rights;
4152
4153 torture_comment(tctx, "Testing LSA EnumAccountRights\n");
4154
4155 r.in.handle = lsa_handle;
4156 r.in.sid = user_sid;
4157 r.out.rights = &rights;
4158
4159 status = dcerpc_lsa_EnumAccountRights(lp, tctx, &r);
4160 torture_assert_ntstatus_equal(tctx, status, NT_STATUS_OBJECT_NAME_NOT_FOUND,
4161 "Expected enum rights for account to fail");
4162 }
4163
4164 {
4165 struct lsa_RightSet rights;
4166 struct lsa_StringLarge names[2];
4167 struct lsa_AddAccountRights r;
4168
4169 torture_comment(tctx, "Testing LSA AddAccountRights\n");
4170
4171 init_lsa_StringLarge(&names[0], "SeMachineAccountPrivilege");
4172 init_lsa_StringLarge(&names[1], NULL);
4173
4174 rights.count = 1;
4175 rights.names = names;
4176
4177 r.in.handle = lsa_handle;
4178 r.in.sid = user_sid;
4179 r.in.rights = &rights;
4180
4181 status = dcerpc_lsa_AddAccountRights(lp, tctx, &r);
4182 torture_assert_ntstatus_ok(tctx, status,
4183 "Failed to add privileges");
4184 }
4185
4186 {
4187 struct lsa_EnumAccounts r;
4188 uint32_t resume_handle = 0;
4189 struct lsa_SidArray lsa_sid_array;
4190 int i;
4191 bool found_sid = false;
4192
4193 torture_comment(tctx, "Testing LSA EnumAccounts\n");
4194
4195 r.in.handle = lsa_handle;
4196 r.in.num_entries = 0x1000;
4197 r.in.resume_handle = &resume_handle;
4198 r.out.sids = &lsa_sid_array;
4199 r.out.resume_handle = &resume_handle;
4200
4201 status = dcerpc_lsa_EnumAccounts(lp, tctx, &r);
4202 torture_assert_ntstatus_ok(tctx, status,
4203 "Failed to enum accounts");
4204
4205 for (i=0; i < lsa_sid_array.num_sids; i++) {
4206 if (dom_sid_equal(user_sid, lsa_sid_array.sids[i].sid)) {
4207 found_sid = true;
4208 }
4209 }
4210
4211 torture_assert(tctx, found_sid,
4212 "failed to list privileged account");
4213 }
4214
4215 {
4216 struct lsa_EnumAccountRights r;
4217 struct lsa_RightSet user_rights;
4218
4219 torture_comment(tctx, "Testing LSA EnumAccountRights\n");
4220
4221 r.in.handle = lsa_handle;
4222 r.in.sid = user_sid;
4223 r.out.rights = &user_rights;
4224
4225 status = dcerpc_lsa_EnumAccountRights(lp, tctx, &r);
4226 torture_assert_ntstatus_ok(tctx, status,
4227 "Failed to enum rights for account");
4228
4229 if (user_rights.count < 1) {
4230 torture_warning(tctx, "failed to find newly added rights");
4231 return false;
4232 }
4233 }
4234
4235 {
4236 struct lsa_OpenAccount r;
4237
4238 torture_comment(tctx, "Testing LSA OpenAccount\n");
4239
4240 r.in.handle = lsa_handle;
4241 r.in.sid = user_sid;
4242 r.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
4243 r.out.acct_handle = &lsa_acct_handle;
4244
4245 status = dcerpc_lsa_OpenAccount(lp, tctx, &r);
4246 torture_assert_ntstatus_ok(tctx, status,
4247 "Failed to open lsa account");
4248 }
4249
4250 {
4251 struct lsa_GetSystemAccessAccount r;
4252 uint32_t access_mask;
4253
4254 torture_comment(tctx, "Testing LSA GetSystemAccessAccount\n");
4255
4256 r.in.handle = &lsa_acct_handle;
4257 r.out.access_mask = &access_mask;
4258
4259 status = dcerpc_lsa_GetSystemAccessAccount(lp, tctx, &r);
4260 torture_assert_ntstatus_ok(tctx, status,
4261 "Failed to get lsa system access account");
4262 }
4263
4264 {
4265 struct lsa_Close r;
4266
4267 torture_comment(tctx, "Testing LSA Close\n");
4268
4269 r.in.handle = &lsa_acct_handle;
4270 r.out.handle = &lsa_acct_handle;
4271
4272 status = dcerpc_lsa_Close(lp, tctx, &r);
4273 torture_assert_ntstatus_ok(tctx, status,
4274 "Failed to close lsa");
4275 }
4276
4277 {
4278 struct samr_DeleteUser r;
4279
4280 torture_comment(tctx, "Testing SAMR DeleteUser\n");
4281
4282 r.in.user_handle = user_handle;
4283 r.out.user_handle = user_handle;
4284
4285 status = dcerpc_samr_DeleteUser(p, tctx, &r);
4286 torture_assert_ntstatus_ok(tctx, status, "Delete User failed");
4287 }
4288
4289 {
4290 struct lsa_EnumAccounts r;
4291 uint32_t resume_handle = 0;
4292 struct lsa_SidArray lsa_sid_array;
4293 int i;
4294 bool found_sid = false;
4295
4296 torture_comment(tctx, "Testing LSA EnumAccounts\n");
4297
4298 r.in.handle = lsa_handle;
4299 r.in.num_entries = 0x1000;
4300 r.in.resume_handle = &resume_handle;
4301 r.out.sids = &lsa_sid_array;
4302 r.out.resume_handle = &resume_handle;
4303
4304 status = dcerpc_lsa_EnumAccounts(lp, tctx, &r);
4305 torture_assert_ntstatus_ok(tctx, status,
4306 "Failed to enum accounts");
4307
4308 for (i=0; i < lsa_sid_array.num_sids; i++) {
4309 if (dom_sid_equal(user_sid, lsa_sid_array.sids[i].sid)) {
4310 found_sid = true;
4311 }
4312 }
4313
4314 torture_assert(tctx, found_sid,
4315 "failed to list privileged account");
4316 }
4317
4318 {
4319 struct lsa_EnumAccountRights r;
4320 struct lsa_RightSet user_rights;
4321
4322 torture_comment(tctx, "Testing LSA EnumAccountRights\n");
4323
4324 r.in.handle = lsa_handle;
4325 r.in.sid = user_sid;
4326 r.out.rights = &user_rights;
4327
4328 status = dcerpc_lsa_EnumAccountRights(lp, tctx, &r);
4329 torture_assert_ntstatus_ok(tctx, status,
4330 "Failed to enum rights for account");
4331
4332 if (user_rights.count < 1) {
4333 torture_warning(tctx, "failed to find newly added rights");
4334 return false;
4335 }
4336 }
4337
4338 {
4339 struct lsa_OpenAccount r;
4340
4341 torture_comment(tctx, "Testing LSA OpenAccount\n");
4342
4343 r.in.handle = lsa_handle;
4344 r.in.sid = user_sid;
4345 r.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
4346 r.out.acct_handle = &lsa_acct_handle;
4347
4348 status = dcerpc_lsa_OpenAccount(lp, tctx, &r);
4349 torture_assert_ntstatus_ok(tctx, status,
4350 "Failed to open lsa account");
4351 }
4352
4353 {
4354 struct lsa_GetSystemAccessAccount r;
4355 uint32_t access_mask;
4356
4357 torture_comment(tctx, "Testing LSA GetSystemAccessAccount\n");
4358
4359 r.in.handle = &lsa_acct_handle;
4360 r.out.access_mask = &access_mask;
4361
4362 status = dcerpc_lsa_GetSystemAccessAccount(lp, tctx, &r);
4363 torture_assert_ntstatus_ok(tctx, status,
4364 "Failed to get lsa system access account");
4365 }
4366
4367 {
4368 struct lsa_DeleteObject r;
4369
4370 torture_comment(tctx, "Testing LSA DeleteObject\n");
4371
4372 r.in.handle = &lsa_acct_handle;
4373 r.out.handle = &lsa_acct_handle;
4374
4375 status = dcerpc_lsa_DeleteObject(lp, tctx, &r);
4376 torture_assert_ntstatus_ok(tctx, status,
4377 "Failed to delete object");
4378 }
4379
4380 {
4381 struct lsa_EnumAccounts r;
4382 uint32_t resume_handle = 0;
4383 struct lsa_SidArray lsa_sid_array;
4384 int i;
4385 bool found_sid = false;
4386
4387 torture_comment(tctx, "Testing LSA EnumAccounts\n");
4388
4389 r.in.handle = lsa_handle;
4390 r.in.num_entries = 0x1000;
4391 r.in.resume_handle = &resume_handle;
4392 r.out.sids = &lsa_sid_array;
4393 r.out.resume_handle = &resume_handle;
4394
4395 status = dcerpc_lsa_EnumAccounts(lp, tctx, &r);
4396 torture_assert_ntstatus_ok(tctx, status,
4397 "Failed to enum accounts");
4398
4399 for (i=0; i < lsa_sid_array.num_sids; i++) {
4400 if (dom_sid_equal(user_sid, lsa_sid_array.sids[i].sid)) {
4401 found_sid = true;
4402 }
4403 }
4404
4405 torture_assert(tctx, !found_sid,
4406 "should not have listed privileged account");
4407 }
4408
4409 {
4410 struct lsa_EnumAccountRights r;
4411 struct lsa_RightSet user_rights;
4412
4413 torture_comment(tctx, "Testing LSA EnumAccountRights\n");
4414
4415 r.in.handle = lsa_handle;
4416 r.in.sid = user_sid;
4417 r.out.rights = &user_rights;
4418
4419 status = dcerpc_lsa_EnumAccountRights(lp, tctx, &r);
4420 torture_assert_ntstatus_equal(tctx, status, NT_STATUS_OBJECT_NAME_NOT_FOUND,
4421 "Failed to enum rights for account");
4422 }
4423
4424 return ret;
4425 }
4426
4427 static bool test_user_ops(struct dcerpc_pipe *p,
4428 struct torture_context *tctx,
4429 struct policy_handle *user_handle,
4430 struct policy_handle *domain_handle,
4431 const struct dom_sid *domain_sid,
4432 uint32_t base_acct_flags,
4433 const char *base_acct_name, enum torture_samr_choice which_ops,
4434 struct cli_credentials *machine_credentials)
4435 {
4436 char *password = NULL;
4437 struct samr_QueryUserInfo q;
4438 union samr_UserInfo *info;
4439 NTSTATUS status;
4440
4441 bool ret = true;
4442 int i;
4443 uint32_t rid;
4444 const uint32_t password_fields[] = {
4445 SAMR_FIELD_NT_PASSWORD_PRESENT,
4446 SAMR_FIELD_LM_PASSWORD_PRESENT,
4447 SAMR_FIELD_NT_PASSWORD_PRESENT | SAMR_FIELD_LM_PASSWORD_PRESENT,
4448 0
4449 };
4450
4451 status = test_LookupName(p, tctx, domain_handle, base_acct_name, &rid);
4452 if (!NT_STATUS_IS_OK(status)) {
4453 ret = false;
4454 }
4455
4456 switch (which_ops) {
4457 case TORTURE_SAMR_USER_ATTRIBUTES:
4458 if (!test_QuerySecurity(p, tctx, user_handle)) {
4459 ret = false;
4460 }
4461
4462 if (!test_QueryUserInfo(p, tctx, user_handle)) {
4463 ret = false;
4464 }
4465
4466 if (!test_QueryUserInfo2(p, tctx, user_handle)) {
4467 ret = false;
4468 }
4469
4470 if (!test_SetUserInfo(p, tctx, user_handle, base_acct_flags,
4471 base_acct_name)) {
4472 ret = false;
4473 }
4474
4475 if (!test_GetUserPwInfo(p, tctx, user_handle)) {
4476 ret = false;
4477 }
4478
4479 if (!test_TestPrivateFunctionsUser(p, tctx, user_handle)) {
4480 ret = false;
4481 }
4482
4483 if (!test_SetUserPass(p, tctx, user_handle, &password)) {
4484 ret = false;
4485 }
4486 break;
4487 case TORTURE_SAMR_PASSWORDS:
4488 if (base_acct_flags & (ACB_WSTRUST|ACB_DOMTRUST|ACB_SVRTRUST)) {
4489 char simple_pass[9];
4490 char *v = generate_random_str(tctx, 1);
4491
4492 ZERO_STRUCT(simple_pass);
4493 memset(simple_pass, *v, sizeof(simple_pass) - 1);
4494
4495 torture_comment(tctx, "Testing machine account password policy rules\n");
4496
4497 /* Workstation trust accounts don't seem to need to honour password quality policy */
4498 if (!test_SetUserPassEx(p, tctx, user_handle, true, &password)) {
4499 ret = false;
4500 }
4501
4502 if (!test_ChangePasswordUser2(p, tctx, base_acct_name, &password, simple_pass, false)) {
4503 ret = false;
4504 }
4505
4506 /* reset again, to allow another 'user' password change */
4507 if (!test_SetUserPassEx(p, tctx, user_handle, true, &password)) {
4508 ret = false;
4509 }
4510
4511 /* Try a 'short' password */
4512 if (!test_ChangePasswordUser2(p, tctx, base_acct_name, &password, samr_rand_pass(tctx, 4), false)) {
4513 ret = false;
4514 }
4515
4516 /* Try a compleatly random password */
4517 if (!test_ChangePasswordRandomBytes(p, tctx, base_acct_name, user_handle, &password)) {
4518 ret = false;
4519 }
4520 }
4521
4522 for (i = 0; password_fields[i]; i++) {
4523 if (!test_SetUserPass_23(p, tctx, user_handle, password_fields[i], &password)) {
4524 ret = false;
4525 }
4526
4527 /* check it was set right */
4528 if (!test_ChangePasswordUser3(p, tctx, base_acct_name, 0, &password, NULL, 0, false)) {
4529 ret = false;
4530 }
4531 }
4532
4533 for (i = 0; password_fields[i]; i++) {
4534 if (!test_SetUserPass_25(p, tctx, user_handle, password_fields[i], &password)) {
4535 ret = false;
4536 }
4537
4538 /* check it was set right */
4539 if (!test_ChangePasswordUser3(p, tctx, base_acct_name, 0, &password, NULL, 0, false)) {
4540 ret = false;
4541 }
4542 }
4543
4544 if (!test_SetUserPassEx(p, tctx, user_handle, false, &password)) {
4545 ret = false;
4546 }
4547
4548 if (!test_ChangePassword(p, tctx, base_acct_name, domain_handle, &password)) {
4549 ret = false;
4550 }
4551
4552 if (torture_setting_bool(tctx, "samba4", false)) {
4553 torture_comment(tctx, "skipping Set Password level 18 and 21 against Samba4\n");
4554 } else {
4555
4556 if (!test_SetUserPass_18(p, tctx, user_handle, &password)) {
4557 ret = false;
4558 }
4559
4560 if (!test_ChangePasswordUser3(p, tctx, base_acct_name, 0, &password, NULL, 0, false)) {
4561 ret = false;
4562 }
4563
4564 for (i = 0; password_fields[i]; i++) {
4565
4566 if (password_fields[i] == SAMR_FIELD_LM_PASSWORD_PRESENT) {
4567 /* we need to skip as that would break
4568 * the ChangePasswordUser3 verify */
4569 continue;
4570 }
4571
4572 if (!test_SetUserPass_21(p, tctx, user_handle, password_fields[i], &password)) {
4573 ret = false;
4574 }
4575
4576 /* check it was set right */
4577 if (!test_ChangePasswordUser3(p, tctx, base_acct_name, 0, &password, NULL, 0, false)) {
4578 ret = false;
4579 }
4580 }
4581 }
4582
4583 q.in.user_handle = user_handle;
4584 q.in.level = 5;
4585 q.out.info = &info;
4586
4587 status = dcerpc_samr_QueryUserInfo(p, tctx, &q);
4588 if (!NT_STATUS_IS_OK(status)) {
4589 torture_warning(tctx, "QueryUserInfo level %u failed - %s\n",
4590 q.in.level, nt_errstr(status));
4591 ret = false;
4592 } else {
4593 uint32_t expected_flags = (base_acct_flags | ACB_PWNOTREQ | ACB_DISABLED);
4594 if ((info->info5.acct_flags) != expected_flags) {
4595 torture_warning(tctx, "QuerUserInfo level 5 failed, it returned 0x%08x when we expected flags of 0x%08x\n",
4596 info->info5.acct_flags,
4597 expected_flags);
4598 /* FIXME: GD */
4599 if (!torture_setting_bool(tctx, "samba3", false)) {
4600 ret = false;
4601 }
4602 }
4603 if (info->info5.rid != rid) {
4604 torture_warning(tctx, "QuerUserInfo level 5 failed, it returned %u when we expected rid of %u\n",
4605 info->info5.rid, rid);
4606
4607 }
4608 }
4609
4610 break;
4611
4612 case TORTURE_SAMR_PASSWORDS_PWDLASTSET:
4613
4614 /* test last password change timestamp behaviour */
4615 if (!test_SetPassword_pwdlastset(p, tctx, base_acct_flags,
4616 base_acct_name,
4617 user_handle, &password,
4618 machine_credentials)) {
4619 ret = false;
4620 }
4621
4622 if (ret == true) {
4623 torture_comment(tctx, "pwdLastSet test succeeded\n");
4624 } else {
4625 torture_warning(tctx, "pwdLastSet test failed\n");
4626 }
4627
4628 break;
4629
4630 case TORTURE_SAMR_PASSWORDS_BADPWDCOUNT:
4631
4632 /* test bad pwd count change behaviour */
4633 if (!test_Password_badpwdcount_wrap(p, tctx, base_acct_flags,
4634 base_acct_name,
4635 domain_handle,
4636 user_handle, &password,
4637 machine_credentials)) {
4638 ret = false;
4639 }
4640
4641 if (ret == true) {
4642 torture_comment(tctx, "badPwdCount test succeeded\n");
4643 } else {
4644 torture_warning(tctx, "badPwdCount test failed\n");
4645 }
4646
4647 break;
4648
4649 case TORTURE_SAMR_PASSWORDS_LOCKOUT:
4650
4651 if (!test_Password_lockout_wrap(p, tctx, base_acct_flags,
4652 base_acct_name,
4653 domain_handle,
4654 user_handle, &password,
4655 machine_credentials))
4656 {
4657 ret = false;
4658 }
4659
4660 if (ret == true) {
4661 torture_comment(tctx, "lockout test succeeded\n");
4662 } else {
4663 torture_warning(tctx, "lockout test failed\n");
4664 }
4665
4666 break;
4667
4668
4669 case TORTURE_SAMR_USER_PRIVILEGES: {
4670
4671 struct dcerpc_pipe *lp;
4672 struct policy_handle *lsa_handle;
4673
4674 status = torture_rpc_connection(tctx, &lp, &ndr_table_lsarpc);
4675 torture_assert_ntstatus_ok(tctx, status, "Failed to open LSA pipe");
4676
4677 if (!test_lsa_OpenPolicy2(lp, tctx, &lsa_handle)) {
4678 ret = false;
4679 }
4680
4681 if (!test_DeleteUser_with_privs(p, lp, tctx,
4682 domain_handle, lsa_handle, user_handle,
4683 domain_sid, rid,
4684 machine_credentials)) {
4685 ret = false;
4686 }
4687
4688 if (!test_lsa_Close(lp, tctx, lsa_handle)) {
4689 ret = false;
4690 }
4691
4692 if (!ret) {
4693 torture_warning(tctx, "privileged user delete test failed\n");
4694 }
4695
4696 break;
4697 }
4698 case TORTURE_SAMR_OTHER:
4699 /* We just need the account to exist */
4700 break;
4701 }
4702 return ret;
4703 }
4704
4705 static bool test_alias_ops(struct dcerpc_pipe *p, struct torture_context *tctx,
4706 struct policy_handle *alias_handle,
4707 const struct dom_sid *domain_sid)
4708 {
4709 bool ret = true;
4710
4711 if (!torture_setting_bool(tctx, "samba3", false)) {
4712 if (!test_QuerySecurity(p, tctx, alias_handle)) {
4713 ret = false;
4714 }
4715 }
4716
4717 if (!test_QueryAliasInfo(p, tctx, alias_handle)) {
4718 ret = false;
4719 }
4720
4721 if (!test_SetAliasInfo(p, tctx, alias_handle)) {
4722 ret = false;
4723 }
4724
4725 if (!test_AddMemberToAlias(p, tctx, alias_handle, domain_sid)) {
4726 ret = false;
4727 }
4728
4729 if (torture_setting_bool(tctx, "samba3", false) ||
4730 torture_setting_bool(tctx, "samba4", false)) {
4731 torture_comment(tctx, "skipping MultipleMembers Alias tests against Samba\n");
4732 return ret;
4733 }
4734
4735 if (!test_AddMultipleMembersToAlias(p, tctx, alias_handle)) {
4736 ret = false;
4737 }
4738
4739 return ret;
4740 }
4741
4742
4743 static bool test_DeleteUser(struct dcerpc_pipe *p, struct torture_context *tctx,
4744 struct policy_handle *user_handle)
4745 {
4746 struct samr_DeleteUser d;
4747 NTSTATUS status;
4748 torture_comment(tctx, "Testing DeleteUser\n");
4749
4750 d.in.user_handle = user_handle;
4751 d.out.user_handle = user_handle;
4752
4753 status = dcerpc_samr_DeleteUser(p, tctx, &d);
4754 torture_assert_ntstatus_ok(tctx, status, "DeleteUser");
4755
4756 return true;
4757 }
4758
4759 bool test_DeleteUser_byname(struct dcerpc_pipe *p,
4760 struct torture_context *tctx,
4761 struct policy_handle *handle, const char *name)
4762 {
4763 NTSTATUS status;
4764 struct samr_DeleteUser d;
4765 struct policy_handle user_handle;
4766 uint32_t rid;
4767
4768 status = test_LookupName(p, tctx, handle, name, &rid);
4769 if (!NT_STATUS_IS_OK(status)) {
4770 goto failed;
4771 }
4772
4773 status = test_OpenUser_byname(p, tctx, handle, name, &user_handle);
4774 if (!NT_STATUS_IS_OK(status)) {
4775 goto failed;
4776 }
4777
4778 d.in.user_handle = &user_handle;
4779 d.out.user_handle = &user_handle;
4780 status = dcerpc_samr_DeleteUser(p, tctx, &d);
4781 if (!NT_STATUS_IS_OK(status)) {
4782 goto failed;
4783 }
4784
4785 return true;
4786
4787 failed:
4788 torture_warning(tctx, "DeleteUser_byname(%s) failed - %s\n", name, nt_errstr(status));
4789 return false;
4790 }
4791
4792
4793 static bool test_DeleteGroup_byname(struct dcerpc_pipe *p,
4794 struct torture_context *tctx,
4795 struct policy_handle *handle, const char *name)
4796 {
4797 NTSTATUS status;
4798 struct samr_OpenGroup r;
4799 struct samr_DeleteDomainGroup d;
4800 struct policy_handle group_handle;
4801 uint32_t rid;
4802
4803 status = test_LookupName(p, tctx, handle, name, &rid);
4804 if (!NT_STATUS_IS_OK(status)) {
4805 goto failed;
4806 }
4807
4808 r.in.domain_handle = handle;
4809 r.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
4810 r.in.rid = rid;
4811 r.out.group_handle = &group_handle;
4812 status = dcerpc_samr_OpenGroup(p, tctx, &r);
4813 if (!NT_STATUS_IS_OK(status)) {
4814 goto failed;
4815 }
4816
4817 d.in.group_handle = &group_handle;
4818 d.out.group_handle = &group_handle;
4819 status = dcerpc_samr_DeleteDomainGroup(p, tctx, &d);
4820 if (!NT_STATUS_IS_OK(status)) {
4821 goto failed;
4822 }
4823
4824 return true;
4825
4826 failed:
4827 torture_warning(tctx, "DeleteGroup_byname(%s) failed - %s\n", name, nt_errstr(status));
4828 return false;
4829 }
4830
4831
4832 static bool test_DeleteAlias_byname(struct dcerpc_pipe *p,
4833 struct torture_context *tctx,
4834 struct policy_handle *domain_handle,
4835 const char *name)
4836 {
4837 NTSTATUS status;
4838 struct samr_OpenAlias r;
4839 struct samr_DeleteDomAlias d;
4840 struct policy_handle alias_handle;
4841 uint32_t rid;
4842
4843 torture_comment(tctx, "testing DeleteAlias_byname\n");
4844
4845 status = test_LookupName(p, tctx, domain_handle, name, &rid);
4846 if (!NT_STATUS_IS_OK(status)) {
4847 goto failed;
4848 }
4849
4850 r.in.domain_handle = domain_handle;
4851 r.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
4852 r.in.rid = rid;
4853 r.out.alias_handle = &alias_handle;
4854 status = dcerpc_samr_OpenAlias(p, tctx, &r);
4855 if (!NT_STATUS_IS_OK(status)) {
4856 goto failed;
4857 }
4858
4859 d.in.alias_handle = &alias_handle;
4860 d.out.alias_handle = &alias_handle;
4861 status = dcerpc_samr_DeleteDomAlias(p, tctx, &d);
4862 if (!NT_STATUS_IS_OK(status)) {
4863 goto failed;
4864 }
4865
4866 return true;
4867
4868 failed:
4869 torture_warning(tctx, "DeleteAlias_byname(%s) failed - %s\n", name, nt_errstr(status));
4870 return false;
4871 }
4872
4873 static bool test_DeleteAlias(struct dcerpc_pipe *p,
4874 struct torture_context *tctx,
4875 struct policy_handle *alias_handle)
4876 {
4877 struct samr_DeleteDomAlias d;
4878 NTSTATUS status;
4879 bool ret = true;
4880
4881 torture_comment(tctx, "Testing DeleteAlias\n");
4882
4883 d.in.alias_handle = alias_handle;
4884 d.out.alias_handle = alias_handle;
4885
4886 status = dcerpc_samr_DeleteDomAlias(p, tctx, &d);
4887 if (!NT_STATUS_IS_OK(status)) {
4888 torture_warning(tctx, "DeleteAlias failed - %s\n", nt_errstr(status));
4889 ret = false;
4890 }
4891
4892 return ret;
4893 }
4894
4895 static bool test_CreateAlias(struct dcerpc_pipe *p, struct torture_context *tctx,
4896 struct policy_handle *domain_handle,
4897 const char *alias_name,
4898 struct policy_handle *alias_handle,
4899 const struct dom_sid *domain_sid,
4900 bool test_alias)
4901 {
4902 NTSTATUS status;
4903 struct samr_CreateDomAlias r;
4904 struct lsa_String name;
4905 uint32_t rid;
4906 bool ret = true;
4907
4908 init_lsa_String(&name, alias_name);
4909 r.in.domain_handle = domain_handle;
4910 r.in.alias_name = &name;
4911 r.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
4912 r.out.alias_handle = alias_handle;
4913 r.out.rid = &rid;
4914
4915 torture_comment(tctx, "Testing CreateAlias (%s)\n", r.in.alias_name->string);
4916
4917 status = dcerpc_samr_CreateDomAlias(p, tctx, &r);
4918
4919 if (dom_sid_equal(domain_sid, dom_sid_parse_talloc(tctx, SID_BUILTIN))) {
4920 if (NT_STATUS_EQUAL(status, NT_STATUS_ACCESS_DENIED)) {
4921 torture_comment(tctx, "Server correctly refused create of '%s'\n", r.in.alias_name->string);
4922 return true;
4923 } else {
4924 torture_warning(tctx, "Server should have refused create of '%s', got %s instead\n", r.in.alias_name->string,
4925 nt_errstr(status));
4926 return false;
4927 }
4928 }
4929
4930 if (NT_STATUS_EQUAL(status, NT_STATUS_ALIAS_EXISTS)) {
4931 if (!test_DeleteAlias_byname(p, tctx, domain_handle, r.in.alias_name->string)) {
4932 return false;
4933 }
4934 status = dcerpc_samr_CreateDomAlias(p, tctx, &r);
4935 }
4936
4937 if (!NT_STATUS_IS_OK(status)) {
4938 torture_warning(tctx, "CreateAlias failed - %s\n", nt_errstr(status));
4939 return false;
4940 }
4941
4942 if (!test_alias) {
4943 return ret;
4944 }
4945
4946 if (!test_alias_ops(p, tctx, alias_handle, domain_sid)) {
4947 ret = false;
4948 }
4949
4950 return ret;
4951 }
4952
4953 static bool test_ChangePassword(struct dcerpc_pipe *p,
4954 struct torture_context *tctx,
4955 const char *acct_name,
4956 struct policy_handle *domain_handle, char **password)
4957 {
4958 bool ret = true;
4959
4960 if (!*password) {
4961 return false;
4962 }
4963
4964 if (!test_ChangePasswordUser(p, tctx, acct_name, domain_handle, password)) {
4965 ret = false;
4966 }
4967
4968 if (!test_ChangePasswordUser2(p, tctx, acct_name, password, 0, true)) {
4969 ret = false;
4970 }
4971
4972 if (!test_OemChangePasswordUser2(p, tctx, acct_name, domain_handle, password)) {
4973 ret = false;
4974 }
4975
4976 /* test what happens when setting the old password again */
4977 if (!test_ChangePasswordUser3(p, tctx, acct_name, 0, password, *password, 0, true)) {
4978 ret = false;
4979 }
4980
4981 {
4982 char simple_pass[9];
4983 char *v = generate_random_str(tctx, 1);
4984
4985 ZERO_STRUCT(simple_pass);
4986 memset(simple_pass, *v, sizeof(simple_pass) - 1);
4987
4988 /* test what happens when picking a simple password */
4989 if (!test_ChangePasswordUser3(p, tctx, acct_name, 0, password, simple_pass, 0, true)) {
4990 ret = false;
4991 }
4992 }
4993
4994 /* set samr_SetDomainInfo level 1 with min_length 5 */
4995 {
4996 struct samr_QueryDomainInfo r;
4997 union samr_DomainInfo *info = NULL;
4998 struct samr_SetDomainInfo s;
4999 uint16_t len_old, len;
5000 uint32_t pwd_prop_old;
5001 int64_t min_pwd_age_old;
5002 NTSTATUS status;
5003
5004 len = 5;
5005
5006 r.in.domain_handle = domain_handle;
5007 r.in.level = 1;
5008 r.out.info = &info;
5009
5010 torture_comment(tctx, "testing samr_QueryDomainInfo level 1\n");
5011 status = dcerpc_samr_QueryDomainInfo(p, tctx, &r);
5012 if (!NT_STATUS_IS_OK(status)) {
5013 return false;
5014 }
5015
5016 s.in.domain_handle = domain_handle;
5017 s.in.level = 1;
5018 s.in.info = info;
5019
5020 /* remember the old min length, so we can reset it */
5021 len_old = s.in.info->info1.min_password_length;
5022 s.in.info->info1.min_password_length = len;
5023 pwd_prop_old = s.in.info->info1.password_properties;
5024 /* turn off password complexity checks for this test */
5025 s.in.info->info1.password_properties &= ~DOMAIN_PASSWORD_COMPLEX;
5026
5027 min_pwd_age_old = s.in.info->info1.min_password_age;
5028 s.in.info->info1.min_password_age = 0;
5029
5030 torture_comment(tctx, "testing samr_SetDomainInfo level 1\n");
5031 status = dcerpc_samr_SetDomainInfo(p, tctx, &s);
5032 if (!NT_STATUS_IS_OK(status)) {
5033 return false;
5034 }
5035
5036 torture_comment(tctx, "calling test_ChangePasswordUser3 with too short password\n");
5037
5038 if (!test_ChangePasswordUser3(p, tctx, acct_name, len - 1, password, NULL, 0, true)) {
5039 ret = false;
5040 }
5041
5042 s.in.info->info1.min_password_length = len_old;
5043 s.in.info->info1.password_properties = pwd_prop_old;
5044 s.in.info->info1.min_password_age = min_pwd_age_old;
5045
5046 torture_comment(tctx, "testing samr_SetDomainInfo level 1\n");
5047 status = dcerpc_samr_SetDomainInfo(p, tctx, &s);
5048 if (!NT_STATUS_IS_OK(status)) {
5049 return false;
5050 }
5051
5052 }
5053
5054 {
5055 NTSTATUS status;
5056 struct samr_OpenUser r;
5057 struct samr_QueryUserInfo q;
5058 union samr_UserInfo *info;
5059 struct samr_LookupNames n;
5060 struct policy_handle user_handle;
5061 struct samr_Ids rids, types;
5062
5063 n.in.domain_handle = domain_handle;
5064 n.in.num_names = 1;
5065 n.in.names = talloc_array(tctx, struct lsa_String, 1);
5066 n.in.names[0].string = acct_name;
5067 n.out.rids = &rids;
5068 n.out.types = &types;
5069
5070 status = dcerpc_samr_LookupNames(p, tctx, &n);
5071 if (!NT_STATUS_IS_OK(status)) {
5072 torture_warning(tctx, "LookupNames failed - %s\n", nt_errstr(status));
5073 return false;
5074 }
5075
5076 r.in.domain_handle = domain_handle;
5077 r.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
5078 r.in.rid = n.out.rids->ids[0];
5079 r.out.user_handle = &user_handle;
5080
5081 status = dcerpc_samr_OpenUser(p, tctx, &r);
5082 if (!NT_STATUS_IS_OK(status)) {
5083 torture_warning(tctx, "OpenUser(%u) failed - %s\n", n.out.rids->ids[0], nt_errstr(status));
5084 return false;
5085 }
5086
5087 q.in.user_handle = &user_handle;
5088 q.in.level = 5;
5089 q.out.info = &info;
5090
5091 status = dcerpc_samr_QueryUserInfo(p, tctx, &q);
5092 if (!NT_STATUS_IS_OK(status)) {
5093 torture_warning(tctx, "QueryUserInfo failed - %s\n", nt_errstr(status));
5094 return false;
5095 }
5096
5097 torture_comment(tctx, "calling test_ChangePasswordUser3 with too early password change\n");
5098
5099 if (!test_ChangePasswordUser3(p, tctx, acct_name, 0, password, NULL,
5100 info->info5.last_password_change, true)) {
5101 ret = false;
5102 }
5103 }
5104
5105 /* we change passwords twice - this has the effect of verifying
5106 they were changed correctly for the final call */
5107 if (!test_ChangePasswordUser3(p, tctx, acct_name, 0, password, NULL, 0, true)) {
5108 ret = false;
5109 }
5110
5111 if (!test_ChangePasswordUser3(p, tctx, acct_name, 0, password, NULL, 0, true)) {
5112 ret = false;
5113 }
5114
5115 return ret;
5116 }
5117
5118 static bool test_CreateUser(struct dcerpc_pipe *p, struct torture_context *tctx,
5119 struct policy_handle *domain_handle,
5120 const char *user_name,
5121 struct policy_handle *user_handle_out,
5122 struct dom_sid *domain_sid,
5123 enum torture_samr_choice which_ops,
5124 struct cli_credentials *machine_credentials,
5125 bool test_user)
5126 {
5127
5128 TALLOC_CTX *user_ctx;
5129
5130 NTSTATUS status;
5131 struct samr_CreateUser r;
5132 struct samr_QueryUserInfo q;
5133 union samr_UserInfo *info;
5134 struct samr_DeleteUser d;
5135 uint32_t rid;
5136
5137 /* This call creates a 'normal' account - check that it really does */
5138 const uint32_t acct_flags = ACB_NORMAL;
5139 struct lsa_String name;
5140 bool ret = true;
5141
5142 struct policy_handle user_handle;
5143 user_ctx = talloc_named(tctx, 0, "test_CreateUser2 per-user context");
5144 init_lsa_String(&name, user_name);
5145
5146 r.in.domain_handle = domain_handle;
5147 r.in.account_name = &name;
5148 r.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
5149 r.out.user_handle = &user_handle;
5150 r.out.rid = &rid;
5151
5152 torture_comment(tctx, "Testing CreateUser(%s)\n", r.in.account_name->string);
5153
5154 status = dcerpc_samr_CreateUser(p, user_ctx, &r);
5155
5156 if (dom_sid_equal(domain_sid, dom_sid_parse_talloc(tctx, SID_BUILTIN))) {
5157 if (NT_STATUS_EQUAL(status, NT_STATUS_ACCESS_DENIED) || NT_STATUS_EQUAL(status, NT_STATUS_INVALID_PARAMETER)) {
5158 torture_comment(tctx, "Server correctly refused create of '%s'\n", r.in.account_name->string);
5159 return true;
5160 } else {
5161 torture_warning(tctx, "Server should have refused create of '%s', got %s instead\n", r.in.account_name->string,
5162 nt_errstr(status));
5163 return false;
5164 }
5165 }
5166
5167 if (NT_STATUS_EQUAL(status, NT_STATUS_USER_EXISTS)) {
5168 if (!test_DeleteUser_byname(p, user_ctx, domain_handle, r.in.account_name->string)) {
5169 talloc_free(user_ctx);
5170 return false;
5171 }
5172 status = dcerpc_samr_CreateUser(p, user_ctx, &r);
5173 }
5174
5175 if (!NT_STATUS_IS_OK(status)) {
5176 talloc_free(user_ctx);
5177 torture_warning(tctx, "CreateUser failed - %s\n", nt_errstr(status));
5178 return false;
5179 }
5180
5181 if (!test_user) {
5182 if (user_handle_out) {
5183 *user_handle_out = user_handle;
5184 }
5185 return ret;
5186 }
5187
5188 {
5189 q.in.user_handle = &user_handle;
5190 q.in.level = 16;
5191 q.out.info = &info;
5192
5193 status = dcerpc_samr_QueryUserInfo(p, user_ctx, &q);
5194 if (!NT_STATUS_IS_OK(status)) {
5195 torture_warning(tctx, "QueryUserInfo level %u failed - %s\n",
5196 q.in.level, nt_errstr(status));
5197 ret = false;
5198 } else {
5199 if ((info->info16.acct_flags & acct_flags) != acct_flags) {
5200 torture_warning(tctx, "QuerUserInfo level 16 failed, it returned 0x%08x when we expected flags of 0x%08x\n",
5201 info->info16.acct_flags,
5202 acct_flags);
5203 ret = false;
5204 }
5205 }
5206
5207 if (!test_user_ops(p, tctx, &user_handle, domain_handle,
5208 domain_sid, acct_flags, name.string, which_ops,
5209 machine_credentials)) {
5210 ret = false;
5211 }
5212
5213 if (user_handle_out) {
5214 *user_handle_out = user_handle;
5215 } else {
5216 torture_comment(tctx, "Testing DeleteUser (createuser test)\n");
5217
5218 d.in.user_handle = &user_handle;
5219 d.out.user_handle = &user_handle;
5220
5221 status = dcerpc_samr_DeleteUser(p, user_ctx, &d);
5222 if (!NT_STATUS_IS_OK(status)) {
5223 torture_warning(tctx, "DeleteUser failed - %s\n", nt_errstr(status));
5224 ret = false;
5225 }
5226 }
5227
5228 }
5229
5230 talloc_free(user_ctx);
5231
5232 return ret;
5233 }
5234
5235
5236 static bool test_CreateUser2(struct dcerpc_pipe *p, struct torture_context *tctx,
5237 struct policy_handle *domain_handle,
5238 struct dom_sid *domain_sid,
5239 enum torture_samr_choice which_ops,
5240 struct cli_credentials *machine_credentials)
5241 {
5242 NTSTATUS status;
5243 struct samr_CreateUser2 r;
5244 struct samr_QueryUserInfo q;
5245 union samr_UserInfo *info;
5246 struct samr_DeleteUser d;
5247 struct policy_handle user_handle;
5248 uint32_t rid;
5249 struct lsa_String name;
5250 bool ret = true;
5251 int i;
5252
5253 struct {
5254 uint32_t acct_flags;
5255 const char *account_name;
5256 NTSTATUS nt_status;
5257 } account_types[] = {
5258 { ACB_NORMAL, TEST_ACCOUNT_NAME, NT_STATUS_OK },
5259 { ACB_NORMAL | ACB_DISABLED, TEST_ACCOUNT_NAME, NT_STATUS_INVALID_PARAMETER },
5260 { ACB_NORMAL | ACB_PWNOEXP, TEST_ACCOUNT_NAME, NT_STATUS_INVALID_PARAMETER },
5261 { ACB_WSTRUST, TEST_MACHINENAME, NT_STATUS_OK },
5262 { ACB_WSTRUST | ACB_DISABLED, TEST_MACHINENAME, NT_STATUS_INVALID_PARAMETER },
5263 { ACB_WSTRUST | ACB_PWNOEXP, TEST_MACHINENAME, NT_STATUS_INVALID_PARAMETER },
5264 { ACB_SVRTRUST, TEST_MACHINENAME, NT_STATUS_OK },
5265 { ACB_SVRTRUST | ACB_DISABLED, TEST_MACHINENAME, NT_STATUS_INVALID_PARAMETER },
5266 { ACB_SVRTRUST | ACB_PWNOEXP, TEST_MACHINENAME, NT_STATUS_INVALID_PARAMETER },
5267 { ACB_DOMTRUST, TEST_DOMAINNAME, NT_STATUS_ACCESS_DENIED },
5268 { ACB_DOMTRUST | ACB_DISABLED, TEST_DOMAINNAME, NT_STATUS_INVALID_PARAMETER },
5269 { ACB_DOMTRUST | ACB_PWNOEXP, TEST_DOMAINNAME, NT_STATUS_INVALID_PARAMETER },
5270 { 0, TEST_ACCOUNT_NAME, NT_STATUS_INVALID_PARAMETER },
5271 { ACB_DISABLED, TEST_ACCOUNT_NAME, NT_STATUS_INVALID_PARAMETER },
5272 { 0, NULL, NT_STATUS_INVALID_PARAMETER }
5273 };
5274
5275 for (i = 0; account_types[i].account_name; i++) {
5276 TALLOC_CTX *user_ctx;
5277 uint32_t acct_flags = account_types[i].acct_flags;
5278 uint32_t access_granted;
5279 user_ctx = talloc_named(tctx, 0, "test_CreateUser2 per-user context");
5280 init_lsa_String(&name, account_types[i].account_name);
5281
5282 r.in.domain_handle = domain_handle;
5283 r.in.account_name = &name;
5284 r.in.acct_flags = acct_flags;
5285 r.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
5286 r.out.user_handle = &user_handle;
5287 r.out.access_granted = &access_granted;
5288 r.out.rid = &rid;
5289
5290 torture_comment(tctx, "Testing CreateUser2(%s, 0x%x)\n", r.in.account_name->string, acct_flags);
5291
5292 status = dcerpc_samr_CreateUser2(p, user_ctx, &r);
5293
5294 if (dom_sid_equal(domain_sid, dom_sid_parse_talloc(tctx, SID_BUILTIN))) {
5295 if (NT_STATUS_EQUAL(status, NT_STATUS_ACCESS_DENIED) || NT_STATUS_EQUAL(status, NT_STATUS_INVALID_PARAMETER)) {
5296 torture_comment(tctx, "Server correctly refused create of '%s'\n", r.in.account_name->string);
5297 continue;
5298 } else {
5299 torture_warning(tctx, "Server should have refused create of '%s', got %s instead\n", r.in.account_name->string,
5300 nt_errstr(status));
5301 ret = false;
5302 continue;
5303 }
5304 }
5305
5306 if (NT_STATUS_EQUAL(status, NT_STATUS_USER_EXISTS)) {
5307 if (!test_DeleteUser_byname(p, user_ctx, domain_handle, r.in.account_name->string)) {
5308 talloc_free(user_ctx);
5309 ret = false;
5310 continue;
5311 }
5312 status = dcerpc_samr_CreateUser2(p, user_ctx, &r);
5313
5314 }
5315 if (!NT_STATUS_EQUAL(status, account_types[i].nt_status)) {
5316 torture_warning(tctx, "CreateUser2 failed gave incorrect error return - %s (should be %s)\n",
5317 nt_errstr(status), nt_errstr(account_types[i].nt_status));
5318 ret = false;
5319 }
5320
5321 if (NT_STATUS_IS_OK(status)) {
5322 q.in.user_handle = &user_handle;
5323 q.in.level = 5;
5324 q.out.info = &info;
5325
5326 status = dcerpc_samr_QueryUserInfo(p, user_ctx, &q);
5327 if (!NT_STATUS_IS_OK(status)) {
5328 torture_warning(tctx, "QueryUserInfo level %u failed - %s\n",
5329 q.in.level, nt_errstr(status));
5330 ret = false;
5331 } else {
5332 uint32_t expected_flags = (acct_flags | ACB_PWNOTREQ | ACB_DISABLED);
5333 if (acct_flags == ACB_NORMAL) {
5334 expected_flags |= ACB_PW_EXPIRED;
5335 }
5336 if ((info->info5.acct_flags) != expected_flags) {
5337 torture_warning(tctx, "QuerUserInfo level 5 failed, it returned 0x%08x when we expected flags of 0x%08x\n",
5338 info->info5.acct_flags,
5339 expected_flags);
5340 ret = false;
5341 }
5342 switch (acct_flags) {
5343 case ACB_SVRTRUST:
5344 if (info->info5.primary_gid != DOMAIN_RID_DCS) {
5345 torture_warning(tctx, "QuerUserInfo level 5: DC should have had Primary Group %d, got %d\n",
5346 DOMAIN_RID_DCS, info->info5.primary_gid);
5347 ret = false;
5348 }
5349 break;
5350 case ACB_WSTRUST:
5351 if (info->info5.primary_gid != DOMAIN_RID_DOMAIN_MEMBERS) {
5352 torture_warning(tctx, "QuerUserInfo level 5: Domain Member should have had Primary Group %d, got %d\n",
5353 DOMAIN_RID_DOMAIN_MEMBERS, info->info5.primary_gid);
5354 ret = false;
5355 }
5356 break;
5357 case ACB_NORMAL:
5358 if (info->info5.primary_gid != DOMAIN_RID_USERS) {
5359 torture_warning(tctx, "QuerUserInfo level 5: Users should have had Primary Group %d, got %d\n",
5360 DOMAIN_RID_USERS, info->info5.primary_gid);
5361 ret = false;
5362 }
5363 break;
5364 }
5365 }
5366
5367 if (!test_user_ops(p, tctx, &user_handle, domain_handle,
5368 domain_sid, acct_flags, name.string, which_ops,
5369 machine_credentials)) {
5370 ret = false;
5371 }
5372
5373 if (!policy_handle_empty(&user_handle)) {
5374 torture_comment(tctx, "Testing DeleteUser (createuser2 test)\n");
5375
5376 d.in.user_handle = &user_handle;
5377 d.out.user_handle = &user_handle;
5378
5379 status = dcerpc_samr_DeleteUser(p, user_ctx, &d);
5380 if (!NT_STATUS_IS_OK(status)) {
5381 torture_warning(tctx, "DeleteUser failed - %s\n", nt_errstr(status));
5382 ret = false;
5383 }
5384 }
5385 }
5386 talloc_free(user_ctx);
5387 }
5388
5389 return ret;
5390 }
5391
5392 static bool test_QueryAliasInfo(struct dcerpc_pipe *p,
5393 struct torture_context *tctx,
5394 struct policy_handle *handle)
5395 {
5396 NTSTATUS status;
5397 struct samr_QueryAliasInfo r;
5398 union samr_AliasInfo *info;
5399 uint16_t levels[] = {1, 2, 3};
5400 int i;
5401 bool ret = true;
5402
5403 for (i=0;i<ARRAY_SIZE(levels);i++) {
5404 torture_comment(tctx, "Testing QueryAliasInfo level %u\n", levels[i]);
5405
5406 r.in.alias_handle = handle;
5407 r.in.level = levels[i];
5408 r.out.info = &info;
5409
5410 status = dcerpc_samr_QueryAliasInfo(p, tctx, &r);
5411 if (!NT_STATUS_IS_OK(status)) {
5412 torture_warning(tctx, "QueryAliasInfo level %u failed - %s\n",
5413 levels[i], nt_errstr(status));
5414 ret = false;
5415 }
5416 }
5417
5418 return ret;
5419 }
5420
5421 static bool test_QueryGroupInfo(struct dcerpc_pipe *p,
5422 struct torture_context *tctx,
5423 struct policy_handle *handle)
5424 {
5425 NTSTATUS status;
5426 struct samr_QueryGroupInfo r;
5427 union samr_GroupInfo *info;
5428 uint16_t levels[] = {1, 2, 3, 4, 5};
5429 int i;
5430 bool ret = true;
5431
5432 for (i=0;i<ARRAY_SIZE(levels);i++) {
5433 torture_comment(tctx, "Testing QueryGroupInfo level %u\n", levels[i]);
5434
5435 r.in.group_handle = handle;
5436 r.in.level = levels[i];
5437 r.out.info = &info;
5438
5439 status = dcerpc_samr_QueryGroupInfo(p, tctx, &r);
5440 if (!NT_STATUS_IS_OK(status)) {
5441 torture_warning(tctx, "QueryGroupInfo level %u failed - %s\n",
5442 levels[i], nt_errstr(status));
5443 ret = false;
5444 }
5445 }
5446
5447 return ret;
5448 }
5449
5450 static bool test_QueryGroupMember(struct dcerpc_pipe *p,
5451 struct torture_context *tctx,
5452 struct policy_handle *handle)
5453 {
5454 NTSTATUS status;
5455 struct samr_QueryGroupMember r;
5456 struct samr_RidTypeArray *rids = NULL;
5457 bool ret = true;
5458
5459 torture_comment(tctx, "Testing QueryGroupMember\n");
5460
5461 r.in.group_handle = handle;
5462 r.out.rids = &rids;
5463
5464 status = dcerpc_samr_QueryGroupMember(p, tctx, &r);
5465 if (!NT_STATUS_IS_OK(status)) {
5466 torture_warning(tctx, "QueryGroupInfo failed - %s\n", nt_errstr(status));
5467 ret = false;
5468 }
5469
5470 return ret;
5471 }
5472
5473
5474 static bool test_SetGroupInfo(struct dcerpc_pipe *p,
5475 struct torture_context *tctx,
5476 struct policy_handle *handle)
5477 {
5478 NTSTATUS status;
5479 struct samr_QueryGroupInfo r;
5480 union samr_GroupInfo *info;
5481 struct samr_SetGroupInfo s;
5482 uint16_t levels[] = {1, 2, 3, 4};
5483 uint16_t set_ok[] = {0, 1, 1, 1};
5484 int i;
5485 bool ret = true;
5486
5487 for (i=0;i<ARRAY_SIZE(levels);i++) {
5488 torture_comment(tctx, "Testing QueryGroupInfo level %u\n", levels[i]);
5489
5490 r.in.group_handle = handle;
5491 r.in.level = levels[i];
5492 r.out.info = &info;
5493
5494 status = dcerpc_samr_QueryGroupInfo(p, tctx, &r);
5495 if (!NT_STATUS_IS_OK(status)) {
5496 torture_warning(tctx, "QueryGroupInfo level %u failed - %s\n",
5497 levels[i], nt_errstr(status));
5498 ret = false;
5499 }
5500
5501 torture_comment(tctx, "Testing SetGroupInfo level %u\n", levels[i]);
5502
5503 s.in.group_handle = handle;
5504 s.in.level = levels[i];
5505 s.in.info = *r.out.info;
5506
5507 #if 0
5508 /* disabled this, as it changes the name only from the point of view of samr,
5509 but leaves the name from the point of view of w2k3 internals (and ldap). This means
5510 the name is still reserved, so creating the old name fails, but deleting by the old name
5511 also fails */
5512 if (s.in.level == 2) {
5513 init_lsa_String(&s.in.info->string, "NewName");
5514 }
5515 #endif
5516
5517 if (s.in.level == 4) {
5518 init_lsa_String(&s.in.info->description, "test description");
5519 }
5520
5521 status = dcerpc_samr_SetGroupInfo(p, tctx, &s);
5522 if (set_ok[i]) {
5523 if (!NT_STATUS_IS_OK(status)) {
5524 torture_warning(tctx, "SetGroupInfo level %u failed - %s\n",
5525 r.in.level, nt_errstr(status));
5526 ret = false;
5527 continue;
5528 }
5529 } else {
5530 if (!NT_STATUS_EQUAL(NT_STATUS_INVALID_INFO_CLASS, status)) {
5531 torture_warning(tctx, "SetGroupInfo level %u gave %s - should have been NT_STATUS_INVALID_INFO_CLASS\n",
5532 r.in.level, nt_errstr(status));
5533 ret = false;
5534 continue;
5535 }
5536 }
5537 }
5538
5539 return ret;
5540 }
5541
5542 static bool test_QueryUserInfo(struct dcerpc_pipe *p,
5543 struct torture_context *tctx,
5544 struct policy_handle *handle)
5545 {
5546 NTSTATUS status;
5547 struct samr_QueryUserInfo r;
5548 union samr_UserInfo *info;
5549 uint16_t levels[] = {1, 2, 3, 4, 5, 6, 7, 8, 9, 10,
5550 11, 12, 13, 14, 16, 17, 20, 21};
5551 int i;
5552 bool ret = true;
5553
5554 for (i=0;i<ARRAY_SIZE(levels);i++) {
5555 torture_comment(tctx, "Testing QueryUserInfo level %u\n", levels[i]);
5556
5557 r.in.user_handle = handle;
5558 r.in.level = levels[i];
5559 r.out.info = &info;
5560
5561 status = dcerpc_samr_QueryUserInfo(p, tctx, &r);
5562 if (!NT_STATUS_IS_OK(status)) {
5563 torture_warning(tctx, "QueryUserInfo level %u failed - %s\n",
5564 levels[i], nt_errstr(status));
5565 ret = false;
5566 }
5567 }
5568
5569 return ret;
5570 }
5571
5572 static bool test_QueryUserInfo2(struct dcerpc_pipe *p,
5573 struct torture_context *tctx,
5574 struct policy_handle *handle)
5575 {
5576 NTSTATUS status;
5577 struct samr_QueryUserInfo2 r;
5578 union samr_UserInfo *info;
5579 uint16_t levels[] = {1, 2, 3, 4, 5, 6, 7, 8, 9, 10,
5580 11, 12, 13, 14, 16, 17, 20, 21};
5581 int i;
5582 bool ret = true;
5583
5584 for (i=0;i<ARRAY_SIZE(levels);i++) {
5585 torture_comment(tctx, "Testing QueryUserInfo2 level %u\n", levels[i]);
5586
5587 r.in.user_handle = handle;
5588 r.in.level = levels[i];
5589 r.out.info = &info;
5590
5591 status = dcerpc_samr_QueryUserInfo2(p, tctx, &r);
5592 if (!NT_STATUS_IS_OK(status)) {
5593 torture_warning(tctx, "QueryUserInfo2 level %u failed - %s\n",
5594 levels[i], nt_errstr(status));
5595 ret = false;
5596 }
5597 }
5598
5599 return ret;
5600 }
5601
5602 static bool test_OpenUser(struct dcerpc_pipe *p,
5603 struct torture_context *tctx,
5604 struct policy_handle *handle, uint32_t rid)
5605 {
5606 NTSTATUS status;
5607 struct samr_OpenUser r;
5608 struct policy_handle user_handle;
5609 bool ret = true;
5610
5611 torture_comment(tctx, "Testing OpenUser(%u)\n", rid);
5612
5613 r.in.domain_handle = handle;
5614 r.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
5615 r.in.rid = rid;
5616 r.out.user_handle = &user_handle;
5617
5618 status = dcerpc_samr_OpenUser(p, tctx, &r);
5619 if (!NT_STATUS_IS_OK(status)) {
5620 torture_warning(tctx, "OpenUser(%u) failed - %s\n", rid, nt_errstr(status));
5621 return false;
5622 }
5623
5624 if (!test_QuerySecurity(p, tctx, &user_handle)) {
5625 ret = false;
5626 }
5627
5628 if (!test_QueryUserInfo(p, tctx, &user_handle)) {
5629 ret = false;
5630 }
5631
5632 if (!test_QueryUserInfo2(p, tctx, &user_handle)) {
5633 ret = false;
5634 }
5635
5636 if (!test_GetUserPwInfo(p, tctx, &user_handle)) {
5637 ret = false;
5638 }
5639
5640 if (!test_GetGroupsForUser(p,tctx, &user_handle)) {
5641 ret = false;
5642 }
5643
5644 if (!test_samr_handle_Close(p, tctx, &user_handle)) {
5645 ret = false;
5646 }
5647
5648 return ret;
5649 }
5650
5651 static bool test_OpenGroup(struct dcerpc_pipe *p,
5652 struct torture_context *tctx,
5653 struct policy_handle *handle, uint32_t rid)
5654 {
5655 NTSTATUS status;
5656 struct samr_OpenGroup r;
5657 struct policy_handle group_handle;
5658 bool ret = true;
5659
5660 torture_comment(tctx, "Testing OpenGroup(%u)\n", rid);
5661
5662 r.in.domain_handle = handle;
5663 r.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
5664 r.in.rid = rid;
5665 r.out.group_handle = &group_handle;
5666
5667 status = dcerpc_samr_OpenGroup(p, tctx, &r);
5668 if (!NT_STATUS_IS_OK(status)) {
5669 torture_warning(tctx, "OpenGroup(%u) failed - %s\n", rid, nt_errstr(status));
5670 return false;
5671 }
5672
5673 if (!torture_setting_bool(tctx, "samba3", false)) {
5674 if (!test_QuerySecurity(p, tctx, &group_handle)) {
5675 ret = false;
5676 }
5677 }
5678
5679 if (!test_QueryGroupInfo(p, tctx, &group_handle)) {
5680 ret = false;
5681 }
5682
5683 if (!test_QueryGroupMember(p, tctx, &group_handle)) {
5684 ret = false;
5685 }
5686
5687 if (!test_samr_handle_Close(p, tctx, &group_handle)) {
5688 ret = false;
5689 }
5690
5691 return ret;
5692 }
5693
5694 static bool test_OpenAlias(struct dcerpc_pipe *p, struct torture_context *tctx,
5695 struct policy_handle *handle, uint32_t rid)
5696 {
5697 NTSTATUS status;
5698 struct samr_OpenAlias r;
5699 struct policy_handle alias_handle;
5700 bool ret = true;
5701
5702 torture_comment(tctx, "Testing OpenAlias(%u)\n", rid);
5703
5704 r.in.domain_handle = handle;
5705 r.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
5706 r.in.rid = rid;
5707 r.out.alias_handle = &alias_handle;
5708
5709 status = dcerpc_samr_OpenAlias(p, tctx, &r);
5710 if (!NT_STATUS_IS_OK(status)) {
5711 torture_warning(tctx, "OpenAlias(%u) failed - %s\n", rid, nt_errstr(status));
5712 return false;
5713 }
5714
5715 if (!torture_setting_bool(tctx, "samba3", false)) {
5716 if (!test_QuerySecurity(p, tctx, &alias_handle)) {
5717 ret = false;
5718 }
5719 }
5720
5721 if (!test_QueryAliasInfo(p, tctx, &alias_handle)) {
5722 ret = false;
5723 }
5724
5725 if (!test_GetMembersInAlias(p, tctx, &alias_handle)) {
5726 ret = false;
5727 }
5728
5729 if (!test_samr_handle_Close(p, tctx, &alias_handle)) {
5730 ret = false;
5731 }
5732
5733 return ret;
5734 }
5735
5736 static bool check_mask(struct dcerpc_pipe *p, struct torture_context *tctx,
5737 struct policy_handle *handle, uint32_t rid,
5738 uint32_t acct_flag_mask)
5739 {
5740 NTSTATUS status;
5741 struct samr_OpenUser r;
5742 struct samr_QueryUserInfo q;
5743 union samr_UserInfo *info;
5744 struct policy_handle user_handle;
5745 bool ret = true;
5746
5747 torture_comment(tctx, "Testing OpenUser(%u)\n", rid);
5748
5749 r.in.domain_handle = handle;
5750 r.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
5751 r.in.rid = rid;
5752 r.out.user_handle = &user_handle;
5753
5754 status = dcerpc_samr_OpenUser(p, tctx, &r);
5755 if (!NT_STATUS_IS_OK(status)) {
5756 torture_warning(tctx, "OpenUser(%u) failed - %s\n", rid, nt_errstr(status));
5757 return false;
5758 }
5759
5760 q.in.user_handle = &user_handle;
5761 q.in.level = 16;
5762 q.out.info = &info;
5763
5764 status = dcerpc_samr_QueryUserInfo(p, tctx, &q);
5765 if (!NT_STATUS_IS_OK(status)) {
5766 torture_warning(tctx, "QueryUserInfo level 16 failed - %s\n",
5767 nt_errstr(status));
5768 ret = false;
5769 } else {
5770 if ((acct_flag_mask & info->info16.acct_flags) == 0) {
5771 torture_warning(tctx, "Server failed to filter for 0x%x, allowed 0x%x (%d) on EnumDomainUsers\n",
5772 acct_flag_mask, info->info16.acct_flags, rid);
5773 ret = false;
5774 }
5775 }
5776
5777 if (!test_samr_handle_Close(p, tctx, &user_handle)) {
5778 ret = false;
5779 }
5780
5781 return ret;
5782 }
5783
5784 static bool test_EnumDomainUsers_all(struct dcerpc_pipe *p,
5785 struct torture_context *tctx,
5786 struct policy_handle *handle)
5787 {
5788 NTSTATUS status = STATUS_MORE_ENTRIES;
5789 struct samr_EnumDomainUsers r;
5790 uint32_t mask, resume_handle=0;
5791 int i, mask_idx;
5792 bool ret = true;
5793 struct samr_LookupNames n;
5794 struct samr_LookupRids lr ;
5795 struct lsa_Strings names;
5796 struct samr_Ids rids, types;
5797 struct samr_SamArray *sam = NULL;
5798 uint32_t num_entries = 0;
5799
5800 uint32_t masks[] = {ACB_NORMAL, ACB_DOMTRUST, ACB_WSTRUST,
5801 ACB_DISABLED, ACB_NORMAL | ACB_DISABLED,
5802 ACB_SVRTRUST | ACB_DOMTRUST | ACB_WSTRUST,
5803 ACB_PWNOEXP, 0};
5804
5805 torture_comment(tctx, "Testing EnumDomainUsers\n");
5806
5807 for (mask_idx=0;mask_idx<ARRAY_SIZE(masks);mask_idx++) {
5808 r.in.domain_handle = handle;
5809 r.in.resume_handle = &resume_handle;
5810 r.in.acct_flags = mask = masks[mask_idx];
5811 r.in.max_size = (uint32_t)-1;
5812 r.out.resume_handle = &resume_handle;
5813 r.out.num_entries = &num_entries;
5814 r.out.sam = &sam;
5815
5816 status = dcerpc_samr_EnumDomainUsers(p, tctx, &r);
5817 if (!NT_STATUS_EQUAL(status, STATUS_MORE_ENTRIES) &&
5818 !NT_STATUS_IS_OK(status)) {
5819 torture_warning(tctx, "EnumDomainUsers failed - %s\n", nt_errstr(status));
5820 return false;
5821 }
5822
5823 torture_assert(tctx, sam, "EnumDomainUsers failed: r.out.sam unexpectedly NULL");
5824
5825 if (sam->count == 0) {
5826 continue;
5827 }
5828
5829 for (i=0;i<sam->count;i++) {
5830 if (mask) {
5831 if (!check_mask(p, tctx, handle, sam->entries[i].idx, mask)) {
5832 ret = false;
5833 }
5834 } else if (!test_OpenUser(p, tctx, handle, sam->entries[i].idx)) {
5835 ret = false;
5836 }
5837 }
5838 }
5839
5840 torture_comment(tctx, "Testing LookupNames\n");
5841 n.in.domain_handle = handle;
5842 n.in.num_names = sam->count;
5843 n.in.names = talloc_array(tctx, struct lsa_String, sam->count);
5844 n.out.rids = &rids;
5845 n.out.types = &types;
5846 for (i=0;i<sam->count;i++) {
5847 n.in.names[i].string = sam->entries[i].name.string;
5848 }
5849 status = dcerpc_samr_LookupNames(p, tctx, &n);
5850 if (!NT_STATUS_IS_OK(status)) {
5851 torture_warning(tctx, "LookupNames failed - %s\n", nt_errstr(status));
5852 ret = false;
5853 }
5854
5855
5856 torture_comment(tctx, "Testing LookupRids\n");
5857 lr.in.domain_handle = handle;
5858 lr.in.num_rids = sam->count;
5859 lr.in.rids = talloc_array(tctx, uint32_t, sam->count);
5860 lr.out.names = &names;
5861 lr.out.types = &types;
5862 for (i=0;i<sam->count;i++) {
5863 lr.in.rids[i] = sam->entries[i].idx;
5864 }
5865 status = dcerpc_samr_LookupRids(p, tctx, &lr);
5866 torture_assert_ntstatus_ok(tctx, status, "LookupRids");
5867
5868 return ret;
5869 }
5870
5871 /*
5872 try blasting the server with a bunch of sync requests
5873 */
5874 static bool test_EnumDomainUsers_async(struct dcerpc_pipe *p, struct torture_context *tctx,
5875 struct policy_handle *handle)
5876 {
5877 NTSTATUS status;
5878 struct samr_EnumDomainUsers r;
5879 uint32_t resume_handle=0;
5880 int i;
5881 #define ASYNC_COUNT 100
5882 struct rpc_request *req[ASYNC_COUNT];
5883
5884 if (!torture_setting_bool(tctx, "dangerous", false)) {
5885 torture_skip(tctx, "samr async test disabled - enable dangerous tests to use\n");
5886 }
5887
5888 torture_comment(tctx, "Testing EnumDomainUsers_async\n");
5889
5890 r.in.domain_handle = handle;
5891 r.in.resume_handle = &resume_handle;
5892 r.in.acct_flags = 0;
5893 r.in.max_size = (uint32_t)-1;
5894 r.out.resume_handle = &resume_handle;
5895
5896 for (i=0;i<ASYNC_COUNT;i++) {
5897 req[i] = dcerpc_samr_EnumDomainUsers_send(p, tctx, &r);
5898 }
5899
5900 for (i=0;i<ASYNC_COUNT;i++) {
5901 status = dcerpc_ndr_request_recv(req[i]);
5902 if (!NT_STATUS_IS_OK(status)) {
5903 torture_warning(tctx, "EnumDomainUsers[%d] failed - %s\n",
5904 i, nt_errstr(status));
5905 return false;
5906 }
5907 }
5908
5909 torture_comment(tctx, "%d async requests OK\n", i);
5910
5911 return true;
5912 }
5913
5914 static bool test_EnumDomainGroups_all(struct dcerpc_pipe *p,
5915 struct torture_context *tctx,
5916 struct policy_handle *handle)
5917 {
5918 NTSTATUS status;
5919 struct samr_EnumDomainGroups r;
5920 uint32_t resume_handle=0;
5921 struct samr_SamArray *sam = NULL;
5922 uint32_t num_entries = 0;
5923 int i;
5924 bool ret = true;
5925
5926 torture_comment(tctx, "Testing EnumDomainGroups\n");
5927
5928 r.in.domain_handle = handle;
5929 r.in.resume_handle = &resume_handle;
5930 r.in.max_size = (uint32_t)-1;
5931 r.out.resume_handle = &resume_handle;
5932 r.out.num_entries = &num_entries;
5933 r.out.sam = &sam;
5934
5935 status = dcerpc_samr_EnumDomainGroups(p, tctx, &r);
5936 if (!NT_STATUS_IS_OK(status)) {
5937 torture_warning(tctx, "EnumDomainGroups failed - %s\n", nt_errstr(status));
5938 return false;
5939 }
5940
5941 if (!sam) {
5942 return false;
5943 }
5944
5945 for (i=0;i<sam->count;i++) {
5946 if (!test_OpenGroup(p, tctx, handle, sam->entries[i].idx)) {
5947 ret = false;
5948 }
5949 }
5950
5951 return ret;
5952 }
5953
5954 static bool test_EnumDomainAliases_all(struct dcerpc_pipe *p,
5955 struct torture_context *tctx,
5956 struct policy_handle *handle)
5957 {
5958 NTSTATUS status;
5959 struct samr_EnumDomainAliases r;
5960 uint32_t resume_handle=0;
5961 struct samr_SamArray *sam = NULL;
5962 uint32_t num_entries = 0;
5963 int i;
5964 bool ret = true;
5965
5966 torture_comment(tctx, "Testing EnumDomainAliases\n");
5967
5968 r.in.domain_handle = handle;
5969 r.in.resume_handle = &resume_handle;
5970 r.in.max_size = (uint32_t)-1;
5971 r.out.sam = &sam;
5972 r.out.num_entries = &num_entries;
5973 r.out.resume_handle = &resume_handle;
5974
5975 status = dcerpc_samr_EnumDomainAliases(p, tctx, &r);
5976 if (!NT_STATUS_IS_OK(status)) {
5977 torture_warning(tctx, "EnumDomainAliases failed - %s\n", nt_errstr(status));
5978 return false;
5979 }
5980
5981 if (!sam) {
5982 return false;
5983 }
5984
5985 for (i=0;i<sam->count;i++) {
5986 if (!test_OpenAlias(p, tctx, handle, sam->entries[i].idx)) {
5987 ret = false;
5988 }
5989 }
5990
5991 return ret;
5992 }
5993
5994 static bool test_GetDisplayEnumerationIndex(struct dcerpc_pipe *p,
5995 struct torture_context *tctx,
5996 struct policy_handle *handle)
5997 {
5998 NTSTATUS status;
5999 struct samr_GetDisplayEnumerationIndex r;
6000 bool ret = true;
6001 uint16_t levels[] = {1, 2, 3, 4, 5};
6002 uint16_t ok_lvl[] = {1, 1, 1, 0, 0};
6003 struct lsa_String name;
6004 uint32_t idx = 0;
6005 int i;
6006
6007 for (i=0;i<ARRAY_SIZE(levels);i++) {
6008 torture_comment(tctx, "Testing GetDisplayEnumerationIndex level %u\n", levels[i]);
6009
6010 init_lsa_String(&name, TEST_ACCOUNT_NAME);
6011
6012 r.in.domain_handle = handle;
6013 r.in.level = levels[i];
6014 r.in.name = &name;
6015 r.out.idx = &idx;
6016
6017 status = dcerpc_samr_GetDisplayEnumerationIndex(p, tctx, &r);
6018
6019 if (ok_lvl[i] &&
6020 !NT_STATUS_IS_OK(status) &&
6021 !NT_STATUS_EQUAL(NT_STATUS_NO_MORE_ENTRIES, status)) {
6022 torture_warning(tctx, "GetDisplayEnumerationIndex level %u failed - %s\n",
6023 levels[i], nt_errstr(status));
6024 ret = false;
6025 }
6026
6027 init_lsa_String(&name, "zzzzzzzz");
6028
6029 status = dcerpc_samr_GetDisplayEnumerationIndex(p, tctx, &r);
6030
6031 if (ok_lvl[i] && !NT_STATUS_EQUAL(NT_STATUS_NO_MORE_ENTRIES, status)) {
6032 torture_warning(tctx, "GetDisplayEnumerationIndex level %u failed - %s\n",
6033 levels[i], nt_errstr(status));
6034 ret = false;
6035 }
6036 }
6037
6038 return ret;
6039 }
6040
6041 static bool test_GetDisplayEnumerationIndex2(struct dcerpc_pipe *p,
6042 struct torture_context *tctx,
6043 struct policy_handle *handle)
6044 {
6045 NTSTATUS status;
6046 struct samr_GetDisplayEnumerationIndex2 r;
6047 bool ret = true;
6048 uint16_t levels[] = {1, 2, 3, 4, 5};
6049 uint16_t ok_lvl[] = {1, 1, 1, 0, 0};
6050 struct lsa_String name;
6051 uint32_t idx = 0;
6052 int i;
6053
6054 for (i=0;i<ARRAY_SIZE(levels);i++) {
6055 torture_comment(tctx, "Testing GetDisplayEnumerationIndex2 level %u\n", levels[i]);
6056
6057 init_lsa_String(&name, TEST_ACCOUNT_NAME);
6058
6059 r.in.domain_handle = handle;
6060 r.in.level = levels[i];
6061 r.in.name = &name;
6062 r.out.idx = &idx;
6063
6064 status = dcerpc_samr_GetDisplayEnumerationIndex2(p, tctx, &r);
6065 if (ok_lvl[i] &&
6066 !NT_STATUS_IS_OK(status) &&
6067 !NT_STATUS_EQUAL(NT_STATUS_NO_MORE_ENTRIES, status)) {
6068 torture_warning(tctx, "GetDisplayEnumerationIndex2 level %u failed - %s\n",
6069 levels[i], nt_errstr(status));
6070 ret = false;
6071 }
6072
6073 init_lsa_String(&name, "zzzzzzzz");
6074
6075 status = dcerpc_samr_GetDisplayEnumerationIndex2(p, tctx, &r);
6076 if (ok_lvl[i] && !NT_STATUS_EQUAL(NT_STATUS_NO_MORE_ENTRIES, status)) {
6077 torture_warning(tctx, "GetDisplayEnumerationIndex2 level %u failed - %s\n",
6078 levels[i], nt_errstr(status));
6079 ret = false;
6080 }
6081 }
6082
6083 return ret;
6084 }
6085
6086 #define STRING_EQUAL_QUERY(s1, s2, user) \
6087 if (s1.string == NULL && s2.string != NULL && s2.string[0] == '\0') { \
6088 /* odd, but valid */ \
6089 } else if ((s1.string && !s2.string) || (s2.string && !s1.string) || strcmp(s1.string, s2.string)) { \
6090 torture_warning(tctx, "%s mismatch for %s: %s != %s (%s)\n", \
6091 #s1, user.string, s1.string, s2.string, __location__); \
6092 ret = false; \
6093 }
6094 #define INT_EQUAL_QUERY(s1, s2, user) \
6095 if (s1 != s2) { \
6096 torture_warning(tctx, "%s mismatch for %s: 0x%llx != 0x%llx (%s)\n", \
6097 #s1, user.string, (unsigned long long)s1, (unsigned long long)s2, __location__); \
6098 ret = false; \
6099 }
6100
6101 static bool test_each_DisplayInfo_user(struct dcerpc_pipe *p,
6102 struct torture_context *tctx,
6103 struct samr_QueryDisplayInfo *querydisplayinfo,
6104 bool *seen_testuser)
6105 {
6106 struct samr_OpenUser r;
6107 struct samr_QueryUserInfo q;
6108 union samr_UserInfo *info;
6109 struct policy_handle user_handle;
6110 int i, ret = true;
6111 NTSTATUS status;
6112 r.in.domain_handle = querydisplayinfo->in.domain_handle;
6113 r.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
6114 for (i = 0; ; i++) {
6115 switch (querydisplayinfo->in.level) {
6116 case 1:
6117 if (i >= querydisplayinfo->out.info->info1.count) {
6118 return ret;
6119 }
6120 r.in.rid = querydisplayinfo->out.info->info1.entries[i].rid;
6121 break;
6122 case 2:
6123 if (i >= querydisplayinfo->out.info->info2.count) {
6124 return ret;
6125 }
6126 r.in.rid = querydisplayinfo->out.info->info2.entries[i].rid;
6127 break;
6128 case 3:
6129 /* Groups */
6130 case 4:
6131 case 5:
6132 /* Not interested in validating just the account name */
6133 return true;
6134 }
6135
6136 r.out.user_handle = &user_handle;
6137
6138 switch (querydisplayinfo->in.level) {
6139 case 1:
6140 case 2:
6141 status = dcerpc_samr_OpenUser(p, tctx, &r);
6142 if (!NT_STATUS_IS_OK(status)) {
6143 torture_warning(tctx, "OpenUser(%u) failed - %s\n", r.in.rid, nt_errstr(status));
6144 return false;
6145 }
6146 }
6147
6148 q.in.user_handle = &user_handle;
6149 q.in.level = 21;
6150 q.out.info = &info;
6151 status = dcerpc_samr_QueryUserInfo(p, tctx, &q);
6152 if (!NT_STATUS_IS_OK(status)) {
6153 torture_warning(tctx, "QueryUserInfo(%u) failed - %s\n", r.in.rid, nt_errstr(status));
6154 return false;
6155 }
6156
6157 switch (querydisplayinfo->in.level) {
6158 case 1:
6159 if (seen_testuser && strcmp(info->info21.account_name.string, TEST_ACCOUNT_NAME) == 0) {
6160 *seen_testuser = true;
6161 }
6162 STRING_EQUAL_QUERY(querydisplayinfo->out.info->info1.entries[i].full_name,
6163 info->info21.full_name, info->info21.account_name);
6164 STRING_EQUAL_QUERY(querydisplayinfo->out.info->info1.entries[i].account_name,
6165 info->info21.account_name, info->info21.account_name);
6166 STRING_EQUAL_QUERY(querydisplayinfo->out.info->info1.entries[i].description,
6167 info->info21.description, info->info21.account_name);
6168 INT_EQUAL_QUERY(querydisplayinfo->out.info->info1.entries[i].rid,
6169 info->info21.rid, info->info21.account_name);
6170 INT_EQUAL_QUERY(querydisplayinfo->out.info->info1.entries[i].acct_flags,
6171 info->info21.acct_flags, info->info21.account_name);
6172
6173 break;
6174 case 2:
6175 STRING_EQUAL_QUERY(querydisplayinfo->out.info->info2.entries[i].account_name,
6176 info->info21.account_name, info->info21.account_name);
6177 STRING_EQUAL_QUERY(querydisplayinfo->out.info->info2.entries[i].description,
6178 info->info21.description, info->info21.account_name);
6179 INT_EQUAL_QUERY(querydisplayinfo->out.info->info2.entries[i].rid,
6180 info->info21.rid, info->info21.account_name);
6181 INT_EQUAL_QUERY((querydisplayinfo->out.info->info2.entries[i].acct_flags & ~ACB_NORMAL),
6182 info->info21.acct_flags, info->info21.account_name);
6183
6184 if (!(querydisplayinfo->out.info->info2.entries[i].acct_flags & ACB_NORMAL)) {
6185 torture_warning(tctx, "Missing ACB_NORMAL in querydisplayinfo->out.info.info2.entries[i].acct_flags on %s\n",
6186 info->info21.account_name.string);
6187 }
6188
6189 if (!(info->info21.acct_flags & (ACB_WSTRUST | ACB_SVRTRUST))) {
6190 torture_warning(tctx, "Found non-trust account %s in trust account listing: 0x%x 0x%x\n",
6191 info->info21.account_name.string,
6192 querydisplayinfo->out.info->info2.entries[i].acct_flags,
6193 info->info21.acct_flags);
6194 return false;
6195 }
6196
6197 break;
6198 }
6199
6200 if (!test_samr_handle_Close(p, tctx, &user_handle)) {
6201 return false;
6202 }
6203 }
6204 return ret;
6205 }
6206
6207 static bool test_QueryDisplayInfo(struct dcerpc_pipe *p,
6208 struct torture_context *tctx,
6209 struct policy_handle *handle)
6210 {
6211 NTSTATUS status;
6212 struct samr_QueryDisplayInfo r;
6213 struct samr_QueryDomainInfo dom_info;
6214 union samr_DomainInfo *info = NULL;
6215 bool ret = true;
6216 uint16_t levels[] = {1, 2, 3, 4, 5};
6217 int i;
6218 bool seen_testuser = false;
6219 uint32_t total_size;
6220 uint32_t returned_size;
6221 union samr_DispInfo disp_info;
6222
6223
6224 for (i=0;i<ARRAY_SIZE(levels);i++) {
6225 torture_comment(tctx, "Testing QueryDisplayInfo level %u\n", levels[i]);
6226
6227 r.in.start_idx = 0;
6228 status = STATUS_MORE_ENTRIES;
6229 while (NT_STATUS_EQUAL(status, STATUS_MORE_ENTRIES)) {
6230 r.in.domain_handle = handle;
6231 r.in.level = levels[i];
6232 r.in.max_entries = 2;
6233 r.in.buf_size = (uint32_t)-1;
6234 r.out.total_size = &total_size;
6235 r.out.returned_size = &returned_size;
6236 r.out.info = &disp_info;
6237
6238 status = dcerpc_samr_QueryDisplayInfo(p, tctx, &r);
6239 if (!NT_STATUS_EQUAL(status, STATUS_MORE_ENTRIES) && !NT_STATUS_IS_OK(status)) {
6240 torture_warning(tctx, "QueryDisplayInfo level %u failed - %s\n",
6241 levels[i], nt_errstr(status));
6242 ret = false;
6243 }
6244 switch (r.in.level) {
6245 case 1:
6246 if (!test_each_DisplayInfo_user(p, tctx, &r, &seen_testuser)) {
6247 ret = false;
6248 }
6249 r.in.start_idx += r.out.info->info1.count;
6250 break;
6251 case 2:
6252 if (!test_each_DisplayInfo_user(p, tctx, &r, NULL)) {
6253 ret = false;
6254 }
6255 r.in.start_idx += r.out.info->info2.count;
6256 break;
6257 case 3:
6258 r.in.start_idx += r.out.info->info3.count;
6259 break;
6260 case 4:
6261 r.in.start_idx += r.out.info->info4.count;
6262 break;
6263 case 5:
6264 r.in.start_idx += r.out.info->info5.count;
6265 break;
6266 }
6267 }
6268 dom_info.in.domain_handle = handle;
6269 dom_info.in.level = 2;
6270 dom_info.out.info = &info;
6271
6272 /* Check number of users returned is correct */
6273 status = dcerpc_samr_QueryDomainInfo(p, tctx, &dom_info);
6274 if (!NT_STATUS_IS_OK(status)) {
6275 torture_warning(tctx, "QueryDomainInfo level %u failed - %s\n",
6276 r.in.level, nt_errstr(status));
6277 ret = false;
6278 break;
6279 }
6280 switch (r.in.level) {
6281 case 1:
6282 case 4:
6283 if (info->general.num_users < r.in.start_idx) {
6284 torture_warning(tctx, "QueryDomainInfo indicates that QueryDisplayInfo returned more users (%d/%d) than the domain %s is said to contain!\n",
6285 r.in.start_idx, info->general.num_groups,
6286 info->general.domain_name.string);
6287 ret = false;
6288 }
6289 if (!seen_testuser) {
6290 struct policy_handle user_handle;
6291 if (NT_STATUS_IS_OK(test_OpenUser_byname(p, tctx, handle, TEST_ACCOUNT_NAME, &user_handle))) {
6292 torture_warning(tctx, "Didn't find test user " TEST_ACCOUNT_NAME " in enumeration of %s\n",
6293 info->general.domain_name.string);
6294 ret = false;
6295 test_samr_handle_Close(p, tctx, &user_handle);
6296 }
6297 }
6298 break;
6299 case 3:
6300 case 5:
6301 if (info->general.num_groups != r.in.start_idx) {
6302 torture_warning(tctx, "QueryDomainInfo indicates that QueryDisplayInfo didn't return all (%d/%d) the groups in %s\n",
6303 r.in.start_idx, info->general.num_groups,
6304 info->general.domain_name.string);
6305 ret = false;
6306 }
6307
6308 break;
6309 }
6310
6311 }
6312
6313 return ret;
6314 }
6315
6316 static bool test_QueryDisplayInfo2(struct dcerpc_pipe *p,
6317 struct torture_context *tctx,
6318 struct policy_handle *handle)
6319 {
6320 NTSTATUS status;
6321 struct samr_QueryDisplayInfo2 r;
6322 bool ret = true;
6323 uint16_t levels[] = {1, 2, 3, 4, 5};
6324 int i;
6325 uint32_t total_size;
6326 uint32_t returned_size;
6327 union samr_DispInfo info;
6328
6329 for (i=0;i<ARRAY_SIZE(levels);i++) {
6330 torture_comment(tctx, "Testing QueryDisplayInfo2 level %u\n", levels[i]);
6331
6332 r.in.domain_handle = handle;
6333 r.in.level = levels[i];
6334 r.in.start_idx = 0;
6335 r.in.max_entries = 1000;
6336 r.in.buf_size = (uint32_t)-1;
6337 r.out.total_size = &total_size;
6338 r.out.returned_size = &returned_size;
6339 r.out.info = &info;
6340
6341 status = dcerpc_samr_QueryDisplayInfo2(p, tctx, &r);
6342 if (!NT_STATUS_IS_OK(status)) {
6343 torture_warning(tctx, "QueryDisplayInfo2 level %u failed - %s\n",
6344 levels[i], nt_errstr(status));
6345 ret = false;
6346 }
6347 }
6348
6349 return ret;
6350 }
6351
6352 static bool test_QueryDisplayInfo3(struct dcerpc_pipe *p, struct torture_context *tctx,
6353 struct policy_handle *handle)
6354 {
6355 NTSTATUS status;
6356 struct samr_QueryDisplayInfo3 r;
6357 bool ret = true;
6358 uint16_t levels[] = {1, 2, 3, 4, 5};
6359 int i;
6360 uint32_t total_size;
6361 uint32_t returned_size;
6362 union samr_DispInfo info;
6363
6364 for (i=0;i<ARRAY_SIZE(levels);i++) {
6365 torture_comment(tctx, "Testing QueryDisplayInfo3 level %u\n", levels[i]);
6366
6367 r.in.domain_handle = handle;
6368 r.in.level = levels[i];
6369 r.in.start_idx = 0;
6370 r.in.max_entries = 1000;
6371 r.in.buf_size = (uint32_t)-1;
6372 r.out.total_size = &total_size;
6373 r.out.returned_size = &returned_size;
6374 r.out.info = &info;
6375
6376 status = dcerpc_samr_QueryDisplayInfo3(p, tctx, &r);
6377 if (!NT_STATUS_IS_OK(status)) {
6378 torture_warning(tctx, "QueryDisplayInfo3 level %u failed - %s\n",
6379 levels[i], nt_errstr(status));
6380 ret = false;
6381 }
6382 }
6383
6384 return ret;
6385 }
6386
6387
6388 static bool test_QueryDisplayInfo_continue(struct dcerpc_pipe *p,
6389 struct torture_context *tctx,
6390 struct policy_handle *handle)
6391 {
6392 NTSTATUS status;
6393 struct samr_QueryDisplayInfo r;
6394 bool ret = true;
6395 uint32_t total_size;
6396 uint32_t returned_size;
6397 union samr_DispInfo info;
6398
6399 torture_comment(tctx, "Testing QueryDisplayInfo continuation\n");
6400
6401 r.in.domain_handle = handle;
6402 r.in.level = 1;
6403 r.in.start_idx = 0;
6404 r.in.max_entries = 1;
6405 r.in.buf_size = (uint32_t)-1;
6406 r.out.total_size = &total_size;
6407 r.out.returned_size = &returned_size;
6408 r.out.info = &info;
6409
6410 do {
6411 status = dcerpc_samr_QueryDisplayInfo(p, tctx, &r);
6412 if (NT_STATUS_IS_OK(status) && *r.out.returned_size != 0) {
6413 if (r.out.info->info1.entries[0].idx != r.in.start_idx + 1) {
6414 torture_warning(tctx, "expected idx %d but got %d\n",
6415 r.in.start_idx + 1,
6416 r.out.info->info1.entries[0].idx);
6417 break;
6418 }
6419 }
6420 if (!NT_STATUS_EQUAL(status, STATUS_MORE_ENTRIES) &&
6421 !NT_STATUS_IS_OK(status)) {
6422 torture_warning(tctx, "QueryDisplayInfo level %u failed - %s\n",
6423 r.in.level, nt_errstr(status));
6424 ret = false;
6425 break;
6426 }
6427 r.in.start_idx++;
6428 } while ((NT_STATUS_EQUAL(status, STATUS_MORE_ENTRIES) ||
6429 NT_STATUS_IS_OK(status)) &&
6430 *r.out.returned_size != 0);
6431
6432 return ret;
6433 }
6434
6435 static bool test_QueryDomainInfo(struct dcerpc_pipe *p, struct torture_context *tctx,
6436 struct policy_handle *handle)
6437 {
6438 NTSTATUS status;
6439 struct samr_QueryDomainInfo r;
6440 union samr_DomainInfo *info = NULL;
6441 struct samr_SetDomainInfo s;
6442 uint16_t levels[] = {1, 2, 3, 4, 5, 6, 7, 8, 9, 11, 12, 13};
6443 uint16_t set_ok[] = {1, 0, 1, 1, 0, 1, 1, 0, 1, 0, 1, 0};
6444 int i;
6445 bool ret = true;
6446 const char *domain_comment = talloc_asprintf(tctx,
6447 "Tortured by Samba4 RPC-SAMR: %s",
6448 timestring(tctx, time(NULL)));
6449
6450 s.in.domain_handle = handle;
6451 s.in.level = 4;
6452 s.in.info = talloc(tctx, union samr_DomainInfo);
6453
6454 s.in.info->oem.oem_information.string = domain_comment;
6455 status = dcerpc_samr_SetDomainInfo(p, tctx, &s);
6456 if (!NT_STATUS_IS_OK(status)) {
6457 torture_warning(tctx, "SetDomainInfo level %u (set comment) failed - %s\n",
6458 s.in.level, nt_errstr(status));
6459 return false;
6460 }
6461
6462 for (i=0;i<ARRAY_SIZE(levels);i++) {
6463 torture_comment(tctx, "Testing QueryDomainInfo level %u\n", levels[i]);
6464
6465 r.in.domain_handle = handle;
6466 r.in.level = levels[i];
6467 r.out.info = &info;
6468
6469 status = dcerpc_samr_QueryDomainInfo(p, tctx, &r);
6470 if (!NT_STATUS_IS_OK(status)) {
6471 torture_warning(tctx, "QueryDomainInfo level %u failed - %s\n",
6472 r.in.level, nt_errstr(status));
6473 ret = false;
6474 continue;
6475 }
6476
6477 switch (levels[i]) {
6478 case 2:
6479 if (strcmp(info->general.oem_information.string, domain_comment) != 0) {
6480 torture_warning(tctx, "QueryDomainInfo level %u returned different oem_information (comment) (%s, expected %s)\n",
6481 levels[i], info->general.oem_information.string, domain_comment);
6482 if (!torture_setting_bool(tctx, "samba3", false)) {
6483 ret = false;
6484 }
6485 }
6486 if (!info->general.primary.string) {
6487 torture_warning(tctx, "QueryDomainInfo level %u returned no PDC name\n",
6488 levels[i]);
6489 ret = false;
6490 } else if (info->general.role == SAMR_ROLE_DOMAIN_PDC) {
6491 if (dcerpc_server_name(p) && strcasecmp_m(dcerpc_server_name(p), info->general.primary.string) != 0) {
6492 torture_warning(tctx, "QueryDomainInfo level %u returned different PDC name (%s) compared to server name (%s), despite claiming to be the PDC\n",
6493 levels[i], info->general.primary.string, dcerpc_server_name(p));
6494 }
6495 }
6496 break;
6497 case 4:
6498 if (strcmp(info->oem.oem_information.string, domain_comment) != 0) {
6499 torture_warning(tctx, "QueryDomainInfo level %u returned different oem_information (comment) (%s, expected %s)\n",
6500 levels[i], info->oem.oem_information.string, domain_comment);
6501 if (!torture_setting_bool(tctx, "samba3", false)) {
6502 ret = false;
6503 }
6504 }
6505 break;
6506 case 6:
6507 if (!info->info6.primary.string) {
6508 torture_warning(tctx, "QueryDomainInfo level %u returned no PDC name\n",
6509 levels[i]);
6510 ret = false;
6511 }
6512 break;
6513 case 11:
6514 if (strcmp(info->general2.general.oem_information.string, domain_comment) != 0) {
6515 torture_warning(tctx, "QueryDomainInfo level %u returned different comment (%s, expected %s)\n",
6516 levels[i], info->general2.general.oem_information.string, domain_comment);
6517 if (!torture_setting_bool(tctx, "samba3", false)) {
6518 ret = false;
6519 }
6520 }
6521 break;
6522 }
6523
6524 torture_comment(tctx, "Testing SetDomainInfo level %u\n", levels[i]);
6525
6526 s.in.domain_handle = handle;
6527 s.in.level = levels[i];
6528 s.in.info = info;
6529
6530 status = dcerpc_samr_SetDomainInfo(p, tctx, &s);
6531 if (set_ok[i]) {
6532 if (!NT_STATUS_IS_OK(status)) {
6533 torture_warning(tctx, "SetDomainInfo level %u failed - %s\n",
6534 r.in.level, nt_errstr(status));
6535 ret = false;
6536 continue;
6537 }
6538 } else {
6539 if (!NT_STATUS_EQUAL(NT_STATUS_INVALID_INFO_CLASS, status)) {
6540 torture_warning(tctx, "SetDomainInfo level %u gave %s - should have been NT_STATUS_INVALID_INFO_CLASS\n",
6541 r.in.level, nt_errstr(status));
6542 ret = false;
6543 continue;
6544 }
6545 }
6546
6547 status = dcerpc_samr_QueryDomainInfo(p, tctx, &r);
6548 if (!NT_STATUS_IS_OK(status)) {
6549 torture_warning(tctx, "QueryDomainInfo level %u failed - %s\n",
6550 r.in.level, nt_errstr(status));
6551 ret = false;
6552 continue;
6553 }
6554 }
6555
6556 return ret;
6557 }
6558
6559
6560 static bool test_QueryDomainInfo2(struct dcerpc_pipe *p, struct torture_context *tctx,
6561 struct policy_handle *handle)
6562 {
6563 NTSTATUS status;
6564 struct samr_QueryDomainInfo2 r;
6565 union samr_DomainInfo *info = NULL;
6566 uint16_t levels[] = {1, 2, 3, 4, 5, 6, 7, 8, 9, 11, 12, 13};
6567 int i;
6568 bool ret = true;
6569
6570 for (i=0;i<ARRAY_SIZE(levels);i++) {
6571 torture_comment(tctx, "Testing QueryDomainInfo2 level %u\n", levels[i]);
6572
6573 r.in.domain_handle = handle;
6574 r.in.level = levels[i];
6575 r.out.info = &info;
6576
6577 status = dcerpc_samr_QueryDomainInfo2(p, tctx, &r);
6578 if (!NT_STATUS_IS_OK(status)) {
6579 torture_warning(tctx, "QueryDomainInfo2 level %u failed - %s\n",
6580 r.in.level, nt_errstr(status));
6581 ret = false;
6582 continue;
6583 }
6584 }
6585
6586 return true;
6587 }
6588
6589 /* Test whether querydispinfo level 5 and enumdomgroups return the same
6590 set of group names. */
6591 static bool test_GroupList(struct dcerpc_pipe *p, struct torture_context *tctx,
6592 struct policy_handle *handle)
6593 {
6594 struct samr_EnumDomainGroups q1;
6595 struct samr_QueryDisplayInfo q2;
6596 NTSTATUS status;
6597 uint32_t resume_handle=0;
6598 struct samr_SamArray *sam = NULL;
6599 uint32_t num_entries = 0;
6600 int i;
6601 bool ret = true;
6602 uint32_t total_size;
6603 uint32_t returned_size;
6604 union samr_DispInfo info;
6605
6606 int num_names = 0;
6607 const char **names = NULL;
6608
6609 torture_comment(tctx, "Testing coherency of querydispinfo vs enumdomgroups\n");
6610
6611 q1.in.domain_handle = handle;
6612 q1.in.resume_handle = &resume_handle;
6613 q1.in.max_size = 5;
6614 q1.out.resume_handle = &resume_handle;
6615 q1.out.num_entries = &num_entries;
6616 q1.out.sam = &sam;
6617
6618 status = STATUS_MORE_ENTRIES;
6619 while (NT_STATUS_EQUAL(status, STATUS_MORE_ENTRIES)) {
6620 status = dcerpc_samr_EnumDomainGroups(p, tctx, &q1);
6621
6622 if (!NT_STATUS_IS_OK(status) &&
6623 !NT_STATUS_EQUAL(status, STATUS_MORE_ENTRIES))
6624 break;
6625
6626 for (i=0; i<*q1.out.num_entries; i++) {
6627 add_string_to_array(tctx,
6628 sam->entries[i].name.string,
6629 &names, &num_names);
6630 }
6631 }
6632
6633 torture_assert_ntstatus_ok(tctx, status, "EnumDomainGroups");
6634
6635 torture_assert(tctx, sam, "EnumDomainGroups failed to return sam");
6636
6637 q2.in.domain_handle = handle;
6638 q2.in.level = 5;
6639 q2.in.start_idx = 0;
6640 q2.in.max_entries = 5;
6641 q2.in.buf_size = (uint32_t)-1;
6642 q2.out.total_size = &total_size;
6643 q2.out.returned_size = &returned_size;
6644 q2.out.info = &info;
6645
6646 status = STATUS_MORE_ENTRIES;
6647 while (NT_STATUS_EQUAL(status, STATUS_MORE_ENTRIES)) {
6648 status = dcerpc_samr_QueryDisplayInfo(p, tctx, &q2);
6649
6650 if (!NT_STATUS_IS_OK(status) &&
6651 !NT_STATUS_EQUAL(status, STATUS_MORE_ENTRIES))
6652 break;
6653
6654 for (i=0; i<q2.out.info->info5.count; i++) {
6655 int j;
6656 const char *name = q2.out.info->info5.entries[i].account_name.string;
6657 bool found = false;
6658 for (j=0; j<num_names; j++) {
6659 if (names[j] == NULL)
6660 continue;
6661 if (strequal(names[j], name)) {
6662 names[j] = NULL;
6663 found = true;
6664 break;
6665 }
6666 }
6667
6668 if (!found) {
6669 torture_warning(tctx, "QueryDisplayInfo gave name [%s] that EnumDomainGroups did not\n",
6670 name);
6671 ret = false;
6672 }
6673 }
6674 q2.in.start_idx += q2.out.info->info5.count;
6675 }
6676
6677 if (!NT_STATUS_IS_OK(status)) {
6678 torture_warning(tctx, "QueryDisplayInfo level 5 failed - %s\n",
6679 nt_errstr(status));
6680 ret = false;
6681 }
6682
6683 for (i=0; i<num_names; i++) {
6684 if (names[i] != NULL) {
6685 torture_warning(tctx, "EnumDomainGroups gave name [%s] that QueryDisplayInfo did not\n",
6686 names[i]);
6687 ret = false;
6688 }
6689 }
6690
6691 return ret;
6692 }
6693
6694 static bool test_DeleteDomainGroup(struct dcerpc_pipe *p, struct torture_context *tctx,
6695 struct policy_handle *group_handle)
6696 {
6697 struct samr_DeleteDomainGroup d;
6698 NTSTATUS status;
6699
6700 torture_comment(tctx, "Testing DeleteDomainGroup\n");
6701
6702 d.in.group_handle = group_handle;
6703 d.out.group_handle = group_handle;
6704
6705 status = dcerpc_samr_DeleteDomainGroup(p, tctx, &d);
6706 torture_assert_ntstatus_ok(tctx, status, "DeleteDomainGroup");
6707
6708 return true;
6709 }
6710
6711 static bool test_TestPrivateFunctionsDomain(struct dcerpc_pipe *p, struct torture_context *tctx,
6712 struct policy_handle *domain_handle)
6713 {
6714 struct samr_TestPrivateFunctionsDomain r;
6715 NTSTATUS status;
6716 bool ret = true;
6717
6718 torture_comment(tctx, "Testing TestPrivateFunctionsDomain\n");
6719
6720 r.in.domain_handle = domain_handle;
6721
6722 status = dcerpc_samr_TestPrivateFunctionsDomain(p, tctx, &r);
6723 torture_assert_ntstatus_equal(tctx, status, NT_STATUS_NOT_IMPLEMENTED, "TestPrivateFunctionsDomain");
6724
6725 return ret;
6726 }
6727
6728 static bool test_RidToSid(struct dcerpc_pipe *p, struct torture_context *tctx,
6729 struct dom_sid *domain_sid,
6730 struct policy_handle *domain_handle)
6731 {
6732 struct samr_RidToSid r;
6733 NTSTATUS status;
6734 bool ret = true;
6735 struct dom_sid *calc_sid, *out_sid;
6736 int rids[] = { 0, 42, 512, 10200 };
6737 int i;
6738
6739 for (i=0;i<ARRAY_SIZE(rids);i++) {
6740 torture_comment(tctx, "Testing RidToSid\n");
6741
6742 calc_sid = dom_sid_dup(tctx, domain_sid);
6743 r.in.domain_handle = domain_handle;
6744 r.in.rid = rids[i];
6745 r.out.sid = &out_sid;
6746
6747 status = dcerpc_samr_RidToSid(p, tctx, &r);
6748 if (!NT_STATUS_IS_OK(status)) {
6749 torture_warning(tctx, "RidToSid for %d failed - %s\n", rids[i], nt_errstr(status));
6750 ret = false;
6751 } else {
6752 calc_sid = dom_sid_add_rid(calc_sid, calc_sid, rids[i]);
6753
6754 if (!dom_sid_equal(calc_sid, out_sid)) {
6755 torture_warning(tctx, "RidToSid for %d failed - got %s, expected %s\n", rids[i],
6756 dom_sid_string(tctx, out_sid),
6757 dom_sid_string(tctx, calc_sid));
6758 ret = false;
6759 }
6760 }
6761 }
6762
6763 return ret;
6764 }
6765
6766 static bool test_GetBootKeyInformation(struct dcerpc_pipe *p, struct torture_context *tctx,
6767 struct policy_handle *domain_handle)
6768 {
6769 struct samr_GetBootKeyInformation r;
6770 NTSTATUS status;
6771 bool ret = true;
6772 uint32_t unknown = 0;
6773
6774 torture_comment(tctx, "Testing GetBootKeyInformation\n");
6775
6776 r.in.domain_handle = domain_handle;
6777 r.out.unknown = &unknown;
6778
6779 status = dcerpc_samr_GetBootKeyInformation(p, tctx, &r);
6780 if (!NT_STATUS_IS_OK(status)) {
6781 /* w2k3 seems to fail this sometimes and pass it sometimes */
6782 torture_comment(tctx, "GetBootKeyInformation (ignored) - %s\n", nt_errstr(status));
6783 }
6784
6785 return ret;
6786 }
6787
6788 static bool test_AddGroupMember(struct dcerpc_pipe *p, struct torture_context *tctx,
6789 struct policy_handle *domain_handle,
6790 struct policy_handle *group_handle)
6791 {
6792 NTSTATUS status;
6793 struct samr_AddGroupMember r;
6794 struct samr_DeleteGroupMember d;
6795 struct samr_QueryGroupMember q;
6796 struct samr_RidTypeArray *rids = NULL;
6797 struct samr_SetMemberAttributesOfGroup s;
6798 uint32_t rid;
6799 bool found_member = false;
6800 int i;
6801
6802 status = test_LookupName(p, tctx, domain_handle, TEST_ACCOUNT_NAME, &rid);
6803 torture_assert_ntstatus_ok(tctx, status, "test_AddGroupMember looking up name " TEST_ACCOUNT_NAME);
6804
6805 r.in.group_handle = group_handle;
6806 r.in.rid = rid;
6807 r.in.flags = 0; /* ??? */
6808
6809 torture_comment(tctx, "Testing AddGroupMember, QueryGroupMember and DeleteGroupMember\n");
6810
6811 d.in.group_handle = group_handle;
6812 d.in.rid = rid;
6813
6814 status = dcerpc_samr_DeleteGroupMember(p, tctx, &d);
6815 torture_assert_ntstatus_equal(tctx, NT_STATUS_MEMBER_NOT_IN_GROUP, status, "DeleteGroupMember");
6816
6817 status = dcerpc_samr_AddGroupMember(p, tctx, &r);
6818 torture_assert_ntstatus_ok(tctx, status, "AddGroupMember");
6819
6820 status = dcerpc_samr_AddGroupMember(p, tctx, &r);
6821 torture_assert_ntstatus_equal(tctx, NT_STATUS_MEMBER_IN_GROUP, status, "AddGroupMember");
6822
6823 if (torture_setting_bool(tctx, "samba4", false) ||
6824 torture_setting_bool(tctx, "samba3", false)) {
6825 torture_comment(tctx, "skipping SetMemberAttributesOfGroup test against Samba\n");
6826 } else {
6827 /* this one is quite strange. I am using random inputs in the
6828 hope of triggering an error that might give us a clue */
6829
6830 s.in.group_handle = group_handle;
6831 s.in.unknown1 = random();
6832 s.in.unknown2 = random();
6833
6834 status = dcerpc_samr_SetMemberAttributesOfGroup(p, tctx, &s);
6835 torture_assert_ntstatus_ok(tctx, status, "SetMemberAttributesOfGroup");
6836 }
6837
6838 q.in.group_handle = group_handle;
6839 q.out.rids = &rids;
6840
6841 status = dcerpc_samr_QueryGroupMember(p, tctx, &q);
6842 torture_assert_ntstatus_ok(tctx, status, "QueryGroupMember");
6843 torture_assert(tctx, rids, "QueryGroupMember did not fill in rids structure");
6844
6845 for (i=0; i < rids->count; i++) {
6846 if (rids->rids[i] == rid) {
6847 found_member = true;
6848 }
6849 }
6850
6851 torture_assert(tctx, found_member, "QueryGroupMember did not list newly added member");
6852
6853 status = dcerpc_samr_DeleteGroupMember(p, tctx, &d);
6854 torture_assert_ntstatus_ok(tctx, status, "DeleteGroupMember");
6855
6856 rids = NULL;
6857 found_member = false;
6858
6859 status = dcerpc_samr_QueryGroupMember(p, tctx, &q);
6860 torture_assert_ntstatus_ok(tctx, status, "QueryGroupMember");
6861 torture_assert(tctx, rids, "QueryGroupMember did not fill in rids structure");
6862
6863 for (i=0; i < rids->count; i++) {
6864 if (rids->rids[i] == rid) {
6865 found_member = true;
6866 }
6867 }
6868
6869 torture_assert(tctx, !found_member, "QueryGroupMember does still list removed member");
6870
6871 status = dcerpc_samr_AddGroupMember(p, tctx, &r);
6872 torture_assert_ntstatus_ok(tctx, status, "AddGroupMember");
6873
6874 return true;
6875 }
6876
6877
6878 static bool test_CreateDomainGroup(struct dcerpc_pipe *p,
6879 struct torture_context *tctx,
6880 struct policy_handle *domain_handle,
6881 const char *group_name,
6882 struct policy_handle *group_handle,
6883 struct dom_sid *domain_sid,
6884 bool test_group)
6885 {
6886 NTSTATUS status;
6887 struct samr_CreateDomainGroup r;
6888 uint32_t rid;
6889 struct lsa_String name;
6890 bool ret = true;
6891
6892 init_lsa_String(&name, group_name);
6893
6894 r.in.domain_handle = domain_handle;
6895 r.in.name = &name;
6896 r.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
6897 r.out.group_handle = group_handle;
6898 r.out.rid = &rid;
6899
6900 torture_comment(tctx, "Testing CreateDomainGroup(%s)\n", r.in.name->string);
6901
6902 status = dcerpc_samr_CreateDomainGroup(p, tctx, &r);
6903
6904 if (dom_sid_equal(domain_sid, dom_sid_parse_talloc(tctx, SID_BUILTIN))) {
6905 if (NT_STATUS_EQUAL(status, NT_STATUS_ACCESS_DENIED)) {
6906 torture_comment(tctx, "Server correctly refused create of '%s'\n", r.in.name->string);
6907 return true;
6908 } else {
6909 torture_warning(tctx, "Server should have refused create of '%s', got %s instead\n", r.in.name->string,
6910 nt_errstr(status));
6911 return false;
6912 }
6913 }
6914
6915 if (NT_STATUS_EQUAL(status, NT_STATUS_GROUP_EXISTS)) {
6916 if (!test_DeleteGroup_byname(p, tctx, domain_handle, r.in.name->string)) {
6917 torture_warning(tctx, "CreateDomainGroup failed: Could not delete domain group %s - %s\n", r.in.name->string,
6918 nt_errstr(status));
6919 return false;
6920 }
6921 status = dcerpc_samr_CreateDomainGroup(p, tctx, &r);
6922 }
6923 if (NT_STATUS_EQUAL(status, NT_STATUS_USER_EXISTS)) {
6924 if (!test_DeleteUser_byname(p, tctx, domain_handle, r.in.name->string)) {
6925
6926 torture_warning(tctx, "CreateDomainGroup failed: Could not delete user %s - %s\n", r.in.name->string,
6927 nt_errstr(status));
6928 return false;
6929 }
6930 status = dcerpc_samr_CreateDomainGroup(p, tctx, &r);
6931 }
6932 torture_assert_ntstatus_ok(tctx, status, "CreateDomainGroup");
6933
6934 if (!test_group) {
6935 return ret;
6936 }
6937
6938 if (!test_AddGroupMember(p, tctx, domain_handle, group_handle)) {
6939 torture_warning(tctx, "CreateDomainGroup failed - %s\n", nt_errstr(status));
6940 ret = false;
6941 }
6942
6943 if (!test_SetGroupInfo(p, tctx, group_handle)) {
6944 ret = false;
6945 }
6946
6947 return ret;
6948 }
6949
6950
6951 /*
6952 its not totally clear what this does. It seems to accept any sid you like.
6953 */
6954 static bool test_RemoveMemberFromForeignDomain(struct dcerpc_pipe *p,
6955 struct torture_context *tctx,
6956 struct policy_handle *domain_handle)
6957 {
6958 NTSTATUS status;
6959 struct samr_RemoveMemberFromForeignDomain r;
6960
6961 r.in.domain_handle = domain_handle;
6962 r.in.sid = dom_sid_parse_talloc(tctx, "S-1-5-32-12-34-56-78");
6963
6964 status = dcerpc_samr_RemoveMemberFromForeignDomain(p, tctx, &r);
6965 torture_assert_ntstatus_ok(tctx, status, "RemoveMemberFromForeignDomain");
6966
6967 return true;
6968 }
6969
6970 static bool test_EnumDomainUsers(struct dcerpc_pipe *p,
6971 struct torture_context *tctx,
6972 struct policy_handle *domain_handle,
6973 uint32_t *total_num_entries_p)
6974 {
6975 NTSTATUS status;
6976 struct samr_EnumDomainUsers r;
6977 uint32_t resume_handle = 0;
6978 uint32_t num_entries = 0;
6979 uint32_t total_num_entries = 0;
6980 struct samr_SamArray *sam;
6981
6982 r.in.domain_handle = domain_handle;
6983 r.in.acct_flags = 0;
6984 r.in.max_size = (uint32_t)-1;
6985 r.in.resume_handle = &resume_handle;
6986
6987 r.out.sam = &sam;
6988 r.out.num_entries = &num_entries;
6989 r.out.resume_handle = &resume_handle;
6990
6991 torture_comment(tctx, "Testing EnumDomainUsers\n");
6992
6993 do {
6994 status = dcerpc_samr_EnumDomainUsers(p, tctx, &r);
6995 if (NT_STATUS_IS_ERR(status)) {
6996 torture_assert_ntstatus_ok(tctx, status,
6997 "failed to enumerate users");
6998 }
6999
7000 total_num_entries += num_entries;
7001 } while (NT_STATUS_EQUAL(status, STATUS_MORE_ENTRIES));
7002
7003 if (total_num_entries_p) {
7004 *total_num_entries_p = total_num_entries;
7005 }
7006
7007 return true;
7008 }
7009
7010 static bool test_EnumDomainGroups(struct dcerpc_pipe *p,
7011 struct torture_context *tctx,
7012 struct policy_handle *domain_handle,
7013 uint32_t *total_num_entries_p)
7014 {
7015 NTSTATUS status;
7016 struct samr_EnumDomainGroups r;
7017 uint32_t resume_handle = 0;
7018 uint32_t num_entries = 0;
7019 uint32_t total_num_entries = 0;
7020 struct samr_SamArray *sam;
7021
7022 r.in.domain_handle = domain_handle;
7023 r.in.max_size = (uint32_t)-1;
7024 r.in.resume_handle = &resume_handle;
7025
7026 r.out.sam = &sam;
7027 r.out.num_entries = &num_entries;
7028 r.out.resume_handle = &resume_handle;
7029
7030 torture_comment(tctx, "Testing EnumDomainGroups\n");
7031
7032 do {
7033 status = dcerpc_samr_EnumDomainGroups(p, tctx, &r);
7034 if (NT_STATUS_IS_ERR(status)) {
7035 torture_assert_ntstatus_ok(tctx, status,
7036 "failed to enumerate groups");
7037 }
7038
7039 total_num_entries += num_entries;
7040 } while (NT_STATUS_EQUAL(status, STATUS_MORE_ENTRIES));
7041
7042 if (total_num_entries_p) {
7043 *total_num_entries_p = total_num_entries;
7044 }
7045
7046 return true;
7047 }
7048
7049 static bool test_EnumDomainAliases(struct dcerpc_pipe *p,
7050 struct torture_context *tctx,
7051 struct policy_handle *domain_handle,
7052 uint32_t *total_num_entries_p)
7053 {
7054 NTSTATUS status;
7055 struct samr_EnumDomainAliases r;
7056 uint32_t resume_handle = 0;
7057 uint32_t num_entries = 0;
7058 uint32_t total_num_entries = 0;
7059 struct samr_SamArray *sam;
7060
7061 r.in.domain_handle = domain_handle;
7062 r.in.max_size = (uint32_t)-1;
7063 r.in.resume_handle = &resume_handle;
7064
7065 r.out.sam = &sam;
7066 r.out.num_entries = &num_entries;
7067 r.out.resume_handle = &resume_handle;
7068
7069 torture_comment(tctx, "Testing EnumDomainAliases\n");
7070
7071 do {
7072 status = dcerpc_samr_EnumDomainAliases(p, tctx, &r);
7073 if (NT_STATUS_IS_ERR(status)) {
7074 torture_assert_ntstatus_ok(tctx, status,
7075 "failed to enumerate aliases");
7076 }
7077
7078 total_num_entries += num_entries;
7079 } while (NT_STATUS_EQUAL(status, STATUS_MORE_ENTRIES));
7080
7081 if (total_num_entries_p) {
7082 *total_num_entries_p = total_num_entries;
7083 }
7084
7085 return true;
7086 }
7087
7088 static bool test_QueryDisplayInfo_level(struct dcerpc_pipe *p,
7089 struct torture_context *tctx,
7090 struct policy_handle *handle,
7091 uint16_t level,
7092 uint32_t *total_num_entries_p)
7093 {
7094 NTSTATUS status;
7095 struct samr_QueryDisplayInfo r;
7096 uint32_t total_num_entries = 0;
7097
7098 r.in.domain_handle = handle;
7099 r.in.level = level;
7100 r.in.start_idx = 0;
7101 r.in.max_entries = (uint32_t)-1;
7102 r.in.buf_size = (uint32_t)-1;
7103
7104 torture_comment(tctx, "Testing QueryDisplayInfo\n");
7105
7106 do {
7107 uint32_t total_size;
7108 uint32_t returned_size;
7109 union samr_DispInfo info;
7110
7111 r.out.total_size = &total_size;
7112 r.out.returned_size = &returned_size;
7113 r.out.info = &info;
7114
7115 status = dcerpc_samr_QueryDisplayInfo(p, tctx, &r);
7116 if (NT_STATUS_IS_ERR(status)) {
7117 torture_assert_ntstatus_ok(tctx, status,
7118 "failed to query displayinfo");
7119 }
7120
7121 if (*r.out.returned_size == 0) {
7122 break;
7123 }
7124
7125 switch (r.in.level) {
7126 case 1:
7127 total_num_entries += info.info1.count;
7128 r.in.start_idx += info.info1.entries[info.info1.count - 1].idx + 1;
7129 break;
7130 case 2:
7131 total_num_entries += info.info2.count;
7132 r.in.start_idx += info.info2.entries[info.info2.count - 1].idx + 1;
7133 break;
7134 case 3:
7135 total_num_entries += info.info3.count;
7136 r.in.start_idx += info.info3.entries[info.info3.count - 1].idx + 1;
7137 break;
7138 case 4:
7139 total_num_entries += info.info4.count;
7140 r.in.start_idx += info.info4.entries[info.info4.count - 1].idx + 1;
7141 break;
7142 case 5:
7143 total_num_entries += info.info5.count;
7144 r.in.start_idx += info.info5.entries[info.info5.count - 1].idx + 1;
7145 break;
7146 default:
7147 return false;
7148 }
7149
7150 } while (NT_STATUS_EQUAL(status, STATUS_MORE_ENTRIES));
7151
7152 if (total_num_entries_p) {
7153 *total_num_entries_p = total_num_entries;
7154 }
7155
7156 return true;
7157 }
7158
7159 static bool test_ManyObjects(struct dcerpc_pipe *p,
7160 struct torture_context *tctx,
7161 struct policy_handle *domain_handle,
7162 struct dom_sid *domain_sid,
7163 struct torture_samr_context *ctx)
7164 {
7165 uint32_t num_total = ctx->num_objects_large_dc;
7166 uint32_t num_enum = 0;
7167 uint32_t num_disp = 0;
7168 uint32_t num_created = 0;
7169 uint32_t num_anounced = 0;
7170 bool ret = true;
7171 NTSTATUS status;
7172 uint32_t i;
7173
7174 struct policy_handle *handles = talloc_zero_array(tctx, struct policy_handle, num_total);
7175
7176 /* query */
7177
7178 {
7179 struct samr_QueryDomainInfo2 r;
7180 union samr_DomainInfo *info;
7181 r.in.domain_handle = domain_handle;
7182 r.in.level = 2;
7183 r.out.info = &info;
7184
7185 status = dcerpc_samr_QueryDomainInfo2(p, tctx, &r);
7186 torture_assert_ntstatus_ok(tctx, status,
7187 "failed to query domain info");
7188
7189 switch (ctx->choice) {
7190 case TORTURE_SAMR_MANY_ACCOUNTS:
7191 num_anounced = info->general.num_users;
7192 break;
7193 case TORTURE_SAMR_MANY_GROUPS:
7194 num_anounced = info->general.num_groups;
7195 break;
7196 case TORTURE_SAMR_MANY_ALIASES:
7197 num_anounced = info->general.num_aliases;
7198 break;
7199 default:
7200 return false;
7201 }
7202 }
7203
7204 /* create */
7205
7206 for (i=0; i < num_total; i++) {
7207
7208 const char *name = NULL;
7209
7210 switch (ctx->choice) {
7211 case TORTURE_SAMR_MANY_ACCOUNTS:
7212 name = talloc_asprintf(tctx, "%s%04d", TEST_ACCOUNT_NAME, i);
7213 ret &= test_CreateUser(p, tctx, domain_handle, name, &handles[i], domain_sid, 0, NULL, false);
7214 break;
7215 case TORTURE_SAMR_MANY_GROUPS:
7216 name = talloc_asprintf(tctx, "%s%04d", TEST_GROUPNAME, i);
7217 ret &= test_CreateDomainGroup(p, tctx, domain_handle, name, &handles[i], domain_sid, false);
7218 break;
7219 case TORTURE_SAMR_MANY_ALIASES:
7220 name = talloc_asprintf(tctx, "%s%04d", TEST_ALIASNAME, i);
7221 ret &= test_CreateAlias(p, tctx, domain_handle, name, &handles[i], domain_sid, false);
7222 break;
7223 default:
7224 return false;
7225 }
7226 if (!policy_handle_empty(&handles[i])) {
7227 num_created++;
7228 }
7229 }
7230
7231 /* enum */
7232
7233 switch (ctx->choice) {
7234 case TORTURE_SAMR_MANY_ACCOUNTS:
7235 ret &= test_EnumDomainUsers(p, tctx, domain_handle, &num_enum);
7236 break;
7237 case TORTURE_SAMR_MANY_GROUPS:
7238 ret &= test_EnumDomainGroups(p, tctx, domain_handle, &num_enum);
7239 break;
7240 case TORTURE_SAMR_MANY_ALIASES:
7241 ret &= test_EnumDomainAliases(p, tctx, domain_handle, &num_enum);
7242 break;
7243 default:
7244 return false;
7245 }
7246
7247 /* dispinfo */
7248
7249 switch (ctx->choice) {
7250 case TORTURE_SAMR_MANY_ACCOUNTS:
7251 ret &= test_QueryDisplayInfo_level(p, tctx, domain_handle, 1, &num_disp);
7252 break;
7253 case TORTURE_SAMR_MANY_GROUPS:
7254 ret &= test_QueryDisplayInfo_level(p, tctx, domain_handle, 3, &num_disp);
7255 break;
7256 case TORTURE_SAMR_MANY_ALIASES:
7257 /* no aliases in dispinfo */
7258 break;
7259 default:
7260 return false;
7261 }
7262
7263 /* close or delete */
7264
7265 for (i=0; i < num_total; i++) {
7266
7267 if (policy_handle_empty(&handles[i])) {
7268 continue;
7269 }
7270
7271 if (torture_setting_bool(tctx, "samba3", false)) {
7272 ret &= test_samr_handle_Close(p, tctx, &handles[i]);
7273 } else {
7274 switch (ctx->choice) {
7275 case TORTURE_SAMR_MANY_ACCOUNTS:
7276 ret &= test_DeleteUser(p, tctx, &handles[i]);
7277 break;
7278 case TORTURE_SAMR_MANY_GROUPS:
7279 ret &= test_DeleteDomainGroup(p, tctx, &handles[i]);
7280 break;
7281 case TORTURE_SAMR_MANY_ALIASES:
7282 ret &= test_DeleteAlias(p, tctx, &handles[i]);
7283 break;
7284 default:
7285 return false;
7286 }
7287 }
7288 }
7289
7290 talloc_free(handles);
7291
7292 if (ctx->choice == TORTURE_SAMR_MANY_ACCOUNTS && num_enum != num_anounced + num_created) {
7293 torture_comment(tctx,
7294 "unexpected number of results (%u) returned in enum call, expected %u\n",
7295 num_enum, num_anounced + num_created);
7296
7297 torture_comment(tctx,
7298 "unexpected number of results (%u) returned in dispinfo, call, expected %u\n",
7299 num_disp, num_anounced + num_created);
7300 }
7301 return ret;
7302 }
7303
7304 static bool test_Connect(struct dcerpc_pipe *p, struct torture_context *tctx,
7305 struct policy_handle *handle);
7306
7307 static bool test_OpenDomain(struct dcerpc_pipe *p, struct torture_context *tctx,
7308 struct torture_samr_context *ctx, struct dom_sid *sid)
7309 {
7310 NTSTATUS status;
7311 struct samr_OpenDomain r;
7312 struct policy_handle domain_handle;
7313 struct policy_handle alias_handle;
7314 struct policy_handle user_handle;
7315 struct policy_handle group_handle;
7316 bool ret = true;
7317
7318 ZERO_STRUCT(alias_handle);
7319 ZERO_STRUCT(user_handle);
7320 ZERO_STRUCT(group_handle);
7321 ZERO_STRUCT(domain_handle);
7322
7323 torture_comment(tctx, "Testing OpenDomain of %s\n", dom_sid_string(tctx, sid));
7324
7325 r.in.connect_handle = &ctx->handle;
7326 r.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
7327 r.in.sid = sid;
7328 r.out.domain_handle = &domain_handle;
7329
7330 status = dcerpc_samr_OpenDomain(p, tctx, &r);
7331 torture_assert_ntstatus_ok(tctx, status, "OpenDomain");
7332
7333 /* run the domain tests with the main handle closed - this tests
7334 the servers reference counting */
7335 torture_assert(tctx, test_samr_handle_Close(p, tctx, &ctx->handle), "Failed to close SAMR handle");
7336
7337 switch (ctx->choice) {
7338 case TORTURE_SAMR_PASSWORDS:
7339 case TORTURE_SAMR_USER_PRIVILEGES:
7340 if (!torture_setting_bool(tctx, "samba3", false)) {
7341 ret &= test_CreateUser2(p, tctx, &domain_handle, sid, ctx->choice, NULL);
7342 }
7343 ret &= test_CreateUser(p, tctx, &domain_handle, TEST_ACCOUNT_NAME, &user_handle, sid, ctx->choice, NULL, true);
7344 if (!ret) {
7345 torture_warning(tctx, "Testing PASSWORDS or PRIVILEGES on domain %s failed!\n", dom_sid_string(tctx, sid));
7346 }
7347 break;
7348 case TORTURE_SAMR_USER_ATTRIBUTES:
7349 if (!torture_setting_bool(tctx, "samba3", false)) {
7350 ret &= test_CreateUser2(p, tctx, &domain_handle, sid, ctx->choice, NULL);
7351 }
7352 ret &= test_CreateUser(p, tctx, &domain_handle, TEST_ACCOUNT_NAME, &user_handle, sid, ctx->choice, NULL, true);
7353 /* This test needs 'complex' users to validate */
7354 ret &= test_QueryDisplayInfo(p, tctx, &domain_handle);
7355 if (!ret) {
7356 torture_warning(tctx, "Testing ATTRIBUTES on domain %s failed!\n", dom_sid_string(tctx, sid));
7357 }
7358 break;
7359 case TORTURE_SAMR_PASSWORDS_PWDLASTSET:
7360 case TORTURE_SAMR_PASSWORDS_BADPWDCOUNT:
7361 case TORTURE_SAMR_PASSWORDS_LOCKOUT:
7362 if (!torture_setting_bool(tctx, "samba3", false)) {
7363 ret &= test_CreateUser2(p, tctx, &domain_handle, sid, ctx->choice, ctx->machine_credentials);
7364 }
7365 ret &= test_CreateUser(p, tctx, &domain_handle, TEST_ACCOUNT_NAME, &user_handle, sid, ctx->choice, ctx->machine_credentials, true);
7366 if (!ret) {
7367 torture_warning(tctx, "Testing PASSWORDS PWDLASTSET or BADPWDCOUNT on domain %s failed!\n", dom_sid_string(tctx, sid));
7368 }
7369 break;
7370 case TORTURE_SAMR_MANY_ACCOUNTS:
7371 case TORTURE_SAMR_MANY_GROUPS:
7372 case TORTURE_SAMR_MANY_ALIASES:
7373 ret &= test_ManyObjects(p, tctx, &domain_handle, sid, ctx);
7374 if (!ret) {
7375 torture_warning(tctx, "Testing MANY-{ACCOUNTS,GROUPS,ALIASES} on domain %s failed!\n", dom_sid_string(tctx, sid));
7376 }
7377 break;
7378 case TORTURE_SAMR_OTHER:
7379 ret &= test_CreateUser(p, tctx, &domain_handle, TEST_ACCOUNT_NAME, &user_handle, sid, ctx->choice, NULL, true);
7380 if (!ret) {
7381 torture_warning(tctx, "Failed to CreateUser in SAMR-OTHER on domain %s!\n", dom_sid_string(tctx, sid));
7382 }
7383 if (!torture_setting_bool(tctx, "samba3", false)) {
7384 ret &= test_QuerySecurity(p, tctx, &domain_handle);
7385 }
7386 ret &= test_RemoveMemberFromForeignDomain(p, tctx, &domain_handle);
7387 ret &= test_CreateAlias(p, tctx, &domain_handle, TEST_ALIASNAME, &alias_handle, sid, true);
7388 ret &= test_CreateDomainGroup(p, tctx, &domain_handle, TEST_GROUPNAME, &group_handle, sid, true);
7389 ret &= test_GetAliasMembership(p, tctx, &domain_handle);
7390 ret &= test_QueryDomainInfo(p, tctx, &domain_handle);
7391 ret &= test_QueryDomainInfo2(p, tctx, &domain_handle);
7392 ret &= test_EnumDomainUsers_all(p, tctx, &domain_handle);
7393 ret &= test_EnumDomainUsers_async(p, tctx, &domain_handle);
7394 ret &= test_EnumDomainGroups_all(p, tctx, &domain_handle);
7395 ret &= test_EnumDomainAliases_all(p, tctx, &domain_handle);
7396 ret &= test_QueryDisplayInfo2(p, tctx, &domain_handle);
7397 ret &= test_QueryDisplayInfo3(p, tctx, &domain_handle);
7398 ret &= test_QueryDisplayInfo_continue(p, tctx, &domain_handle);
7399
7400 if (torture_setting_bool(tctx, "samba4", false)) {
7401 torture_comment(tctx, "skipping GetDisplayEnumerationIndex test against Samba4\n");
7402 } else {
7403 ret &= test_GetDisplayEnumerationIndex(p, tctx, &domain_handle);
7404 ret &= test_GetDisplayEnumerationIndex2(p, tctx, &domain_handle);
7405 }
7406 ret &= test_GroupList(p, tctx, &domain_handle);
7407 ret &= test_TestPrivateFunctionsDomain(p, tctx, &domain_handle);
7408 ret &= test_RidToSid(p, tctx, sid, &domain_handle);
7409 ret &= test_GetBootKeyInformation(p, tctx, &domain_handle);
7410 if (!ret) {
7411 torture_comment(tctx, "Testing SAMR-OTHER on domain %s failed!\n", dom_sid_string(tctx, sid));
7412 }
7413 break;
7414 }
7415
7416 if (!policy_handle_empty(&user_handle) &&
7417 !test_DeleteUser(p, tctx, &user_handle)) {
7418 ret = false;
7419 }
7420
7421 if (!policy_handle_empty(&alias_handle) &&
7422 !test_DeleteAlias(p, tctx, &alias_handle)) {
7423 ret = false;
7424 }
7425
7426 if (!policy_handle_empty(&group_handle) &&
7427 !test_DeleteDomainGroup(p, tctx, &group_handle)) {
7428 ret = false;
7429 }
7430
7431 torture_assert(tctx, test_samr_handle_Close(p, tctx, &domain_handle), "Failed to close SAMR domain handle");
7432
7433 torture_assert(tctx, test_Connect(p, tctx, &ctx->handle), "Faile to re-connect SAMR handle");
7434 /* reconnect the main handle */
7435
7436 if (!ret) {
7437 torture_warning(tctx, "Testing domain %s failed!\n", dom_sid_string(tctx, sid));
7438 }
7439
7440 return ret;
7441 }
7442
7443 static bool test_LookupDomain(struct dcerpc_pipe *p, struct torture_context *tctx,
7444 struct torture_samr_context *ctx, const char *domain)
7445 {
7446 NTSTATUS status;
7447 struct samr_LookupDomain r;
7448 struct dom_sid2 *sid = NULL;
7449 struct lsa_String n1;
7450 struct lsa_String n2;
7451 bool ret = true;
7452
7453 torture_comment(tctx, "Testing LookupDomain(%s)\n", domain);
7454
7455 /* check for correct error codes */
7456 r.in.connect_handle = &ctx->handle;
7457 r.in.domain_name = &n2;
7458 r.out.sid = &sid;
7459 n2.string = NULL;
7460
7461 status = dcerpc_samr_LookupDomain(p, tctx, &r);
7462 torture_assert_ntstatus_equal(tctx, NT_STATUS_INVALID_PARAMETER, status, "LookupDomain expected NT_STATUS_INVALID_PARAMETER");
7463
7464 init_lsa_String(&n2, "xxNODOMAINxx");
7465
7466 status = dcerpc_samr_LookupDomain(p, tctx, &r);
7467 torture_assert_ntstatus_equal(tctx, NT_STATUS_NO_SUCH_DOMAIN, status, "LookupDomain expected NT_STATUS_NO_SUCH_DOMAIN");
7468
7469 r.in.connect_handle = &ctx->handle;
7470
7471 init_lsa_String(&n1, domain);
7472 r.in.domain_name = &n1;
7473
7474 status = dcerpc_samr_LookupDomain(p, tctx, &r);
7475 torture_assert_ntstatus_ok(tctx, status, "LookupDomain");
7476
7477 if (!test_GetDomPwInfo(p, tctx, &n1)) {
7478 ret = false;
7479 }
7480
7481 if (!test_OpenDomain(p, tctx, ctx, *r.out.sid)) {
7482 ret = false;
7483 }
7484
7485 return ret;
7486 }
7487
7488
7489 static bool test_EnumDomains(struct dcerpc_pipe *p, struct torture_context *tctx,
7490 struct torture_samr_context *ctx)
7491 {
7492 NTSTATUS status;
7493 struct samr_EnumDomains r;
7494 uint32_t resume_handle = 0;
7495 uint32_t num_entries = 0;
7496 struct samr_SamArray *sam = NULL;
7497 int i;
7498 bool ret = true;
7499
7500 r.in.connect_handle = &ctx->handle;
7501 r.in.resume_handle = &resume_handle;
7502 r.in.buf_size = (uint32_t)-1;
7503 r.out.resume_handle = &resume_handle;
7504 r.out.num_entries = &num_entries;
7505 r.out.sam = &sam;
7506
7507 status = dcerpc_samr_EnumDomains(p, tctx, &r);
7508 torture_assert_ntstatus_ok(tctx, status, "EnumDomains");
7509
7510 if (!*r.out.sam) {
7511 return false;
7512 }
7513
7514 for (i=0;i<sam->count;i++) {
7515 if (!test_LookupDomain(p, tctx, ctx,
7516 sam->entries[i].name.string)) {
7517 ret = false;
7518 }
7519 }
7520
7521 status = dcerpc_samr_EnumDomains(p, tctx, &r);
7522 torture_assert_ntstatus_ok(tctx, status, "EnumDomains");
7523
7524 return ret;
7525 }
7526
7527
7528 static bool test_Connect(struct dcerpc_pipe *p, struct torture_context *tctx,
7529 struct policy_handle *handle)
7530 {
7531 NTSTATUS status;
7532 struct samr_Connect r;
7533 struct samr_Connect2 r2;
7534 struct samr_Connect3 r3;
7535 struct samr_Connect4 r4;
7536 struct samr_Connect5 r5;
7537 union samr_ConnectInfo info;
7538 struct policy_handle h;
7539 uint32_t level_out = 0;
7540 bool ret = true, got_handle = false;
7541
7542 torture_comment(tctx, "testing samr_Connect\n");
7543
7544 r.in.system_name = 0;
7545 r.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
7546 r.out.connect_handle = &h;
7547
7548 status = dcerpc_samr_Connect(p, tctx, &r);
7549 if (!NT_STATUS_IS_OK(status)) {
7550 torture_comment(tctx, "Connect failed - %s\n", nt_errstr(status));
7551 ret = false;
7552 } else {
7553 got_handle = true;
7554 *handle = h;
7555 }
7556
7557 torture_comment(tctx, "testing samr_Connect2\n");
7558
7559 r2.in.system_name = NULL;
7560 r2.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
7561 r2.out.connect_handle = &h;
7562
7563 status = dcerpc_samr_Connect2(p, tctx, &r2);
7564 if (!NT_STATUS_IS_OK(status)) {
7565 torture_comment(tctx, "Connect2 failed - %s\n", nt_errstr(status));
7566 ret = false;
7567 } else {
7568 if (got_handle) {
7569 test_samr_handle_Close(p, tctx, handle);
7570 }
7571 got_handle = true;
7572 *handle = h;
7573 }
7574
7575 torture_comment(tctx, "testing samr_Connect3\n");
7576
7577 r3.in.system_name = NULL;
7578 r3.in.unknown = 0;
7579 r3.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
7580 r3.out.connect_handle = &h;
7581
7582 status = dcerpc_samr_Connect3(p, tctx, &r3);
7583 if (!NT_STATUS_IS_OK(status)) {
7584 torture_warning(tctx, "Connect3 failed - %s\n", nt_errstr(status));
7585 ret = false;
7586 } else {
7587 if (got_handle) {
7588 test_samr_handle_Close(p, tctx, handle);
7589 }
7590 got_handle = true;
7591 *handle = h;
7592 }
7593
7594 torture_comment(tctx, "testing samr_Connect4\n");
7595
7596 r4.in.system_name = "";
7597 r4.in.client_version = 0;
7598 r4.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
7599 r4.out.connect_handle = &h;
7600
7601 status = dcerpc_samr_Connect4(p, tctx, &r4);
7602 if (!NT_STATUS_IS_OK(status)) {
7603 torture_warning(tctx, "Connect4 failed - %s\n", nt_errstr(status));
7604 ret = false;
7605 } else {
7606 if (got_handle) {
7607 test_samr_handle_Close(p, tctx, handle);
7608 }
7609 got_handle = true;
7610 *handle = h;
7611 }
7612
7613 torture_comment(tctx, "testing samr_Connect5\n");
7614
7615 info.info1.client_version = 0;
7616 info.info1.unknown2 = 0;
7617
7618 r5.in.system_name = "";
7619 r5.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
7620 r5.in.level_in = 1;
7621 r5.out.level_out = &level_out;
7622 r5.in.info_in = &info;
7623 r5.out.info_out = &info;
7624 r5.out.connect_handle = &h;
7625
7626 status = dcerpc_samr_Connect5(p, tctx, &r5);
7627 if (!NT_STATUS_IS_OK(status)) {
7628 torture_warning(tctx, "Connect5 failed - %s\n", nt_errstr(status));
7629 ret = false;
7630 } else {
7631 if (got_handle) {
7632 test_samr_handle_Close(p, tctx, handle);
7633 }
7634 got_handle = true;
7635 *handle = h;
7636 }
7637
7638 return ret;
7639 }
7640
7641
7642 static bool test_samr_ValidatePassword(struct dcerpc_pipe *p, struct torture_context *tctx)
7643 {
7644 struct samr_ValidatePassword r;
7645 union samr_ValidatePasswordReq req;
7646 union samr_ValidatePasswordRep *repp = NULL;
7647 NTSTATUS status;
7648 const char *passwords[] = { "penguin", "p@ssw0rd", "p@ssw0rd123$", NULL };
7649 int i;
7650
7651 torture_comment(tctx, "testing samr_ValidatePassword\n");
7652
7653 ZERO_STRUCT(r);
7654 r.in.level = NetValidatePasswordReset;
7655 r.in.req = &req;
7656 r.out.rep = &repp;
7657
7658 ZERO_STRUCT(req);
7659 req.req3.account.string = "non-existant-account-aklsdji";
7660
7661 for (i=0; passwords[i]; i++) {
7662 req.req3.password.string = passwords[i];
7663 status = dcerpc_samr_ValidatePassword(p, tctx, &r);
7664 torture_assert_ntstatus_ok(tctx, status, "samr_ValidatePassword");
7665 torture_comment(tctx, "Server %s password '%s' with code %i\n",
7666 repp->ctr3.status==SAMR_VALIDATION_STATUS_SUCCESS?"allowed":"refused",
7667 req.req3.password.string, repp->ctr3.status);
7668 }
7669
7670 return true;
7671 }
7672
7673 bool torture_rpc_samr(struct torture_context *torture)
7674 {
7675 NTSTATUS status;
7676 struct dcerpc_pipe *p;
7677 bool ret = true;
7678 struct torture_samr_context *ctx;
7679
7680 status = torture_rpc_connection(torture, &p, &ndr_table_samr);
7681 if (!NT_STATUS_IS_OK(status)) {
7682 return false;
7683 }
7684
7685 ctx = talloc_zero(torture, struct torture_samr_context);
7686
7687 ctx->choice = TORTURE_SAMR_OTHER;
7688
7689 ret &= test_Connect(p, torture, &ctx->handle);
7690
7691 if (!torture_setting_bool(torture, "samba3", false)) {
7692 ret &= test_QuerySecurity(p, torture, &ctx->handle);
7693 }
7694
7695 ret &= test_EnumDomains(p, torture, ctx);
7696
7697 ret &= test_SetDsrmPassword(p, torture, &ctx->handle);
7698
7699 ret &= test_Shutdown(p, torture, &ctx->handle);
7700
7701 ret &= test_samr_handle_Close(p, torture, &ctx->handle);
7702
7703 return ret;
7704 }
7705
7706
7707 bool torture_rpc_samr_users(struct torture_context *torture)
7708 {
7709 NTSTATUS status;
7710 struct dcerpc_pipe *p;
7711 bool ret = true;
7712 struct torture_samr_context *ctx;
7713
7714 status = torture_rpc_connection(torture, &p, &ndr_table_samr);
7715 if (!NT_STATUS_IS_OK(status)) {
7716 return false;
7717 }
7718
7719 ctx = talloc_zero(torture, struct torture_samr_context);
7720
7721 ctx->choice = TORTURE_SAMR_USER_ATTRIBUTES;
7722
7723 ret &= test_Connect(p, torture, &ctx->handle);
7724
7725 if (!torture_setting_bool(torture, "samba3", false)) {
7726 ret &= test_QuerySecurity(p, torture, &ctx->handle);
7727 }
7728
7729 ret &= test_EnumDomains(p, torture, ctx);
7730
7731 ret &= test_SetDsrmPassword(p, torture, &ctx->handle);
7732
7733 ret &= test_Shutdown(p, torture, &ctx->handle);
7734
7735 ret &= test_samr_handle_Close(p, torture, &ctx->handle);
7736
7737 return ret;
7738 }
7739
7740
7741 bool torture_rpc_samr_passwords(struct torture_context *torture)
7742 {
7743 NTSTATUS status;
7744 struct dcerpc_pipe *p;
7745 bool ret = true;
7746 struct torture_samr_context *ctx;
7747
7748 status = torture_rpc_connection(torture, &p, &ndr_table_samr);
7749 if (!NT_STATUS_IS_OK(status)) {
7750 return false;
7751 }
7752
7753 ctx = talloc_zero(torture, struct torture_samr_context);
7754
7755 ctx->choice = TORTURE_SAMR_PASSWORDS;
7756
7757 ret &= test_Connect(p, torture, &ctx->handle);
7758
7759 ret &= test_EnumDomains(p, torture, ctx);
7760
7761 ret &= test_samr_handle_Close(p, torture, &ctx->handle);
7762
7763 ret &= test_samr_ValidatePassword(p, torture);
7764
7765 return ret;
7766 }
7767
7768 static bool torture_rpc_samr_pwdlastset(struct torture_context *torture,
7769 struct dcerpc_pipe *p2,
7770 struct cli_credentials *machine_credentials)
7771 {
7772 NTSTATUS status;
7773 struct dcerpc_pipe *p;
7774 bool ret = true;
7775 struct torture_samr_context *ctx;
7776
7777 status = torture_rpc_connection(torture, &p, &ndr_table_samr);
7778 if (!NT_STATUS_IS_OK(status)) {
7779 return false;
7780 }
7781
7782 ctx = talloc_zero(torture, struct torture_samr_context);
7783
7784 ctx->choice = TORTURE_SAMR_PASSWORDS_PWDLASTSET;
7785 ctx->machine_credentials = machine_credentials;
7786
7787 ret &= test_Connect(p, torture, &ctx->handle);
7788
7789 ret &= test_EnumDomains(p, torture, ctx);
7790
7791 ret &= test_samr_handle_Close(p, torture, &ctx->handle);
7792
7793 return ret;
7794 }
7795
7796 struct torture_suite *torture_rpc_samr_passwords_pwdlastset(TALLOC_CTX *mem_ctx)
7797 {
7798 struct torture_suite *suite = torture_suite_create(mem_ctx, "SAMR-PASSWORDS-PWDLASTSET");
7799 struct torture_rpc_tcase *tcase;
7800
7801 tcase = torture_suite_add_machine_bdc_rpc_iface_tcase(suite, "samr",
7802 &ndr_table_samr,
7803 TEST_ACCOUNT_NAME_PWD);
7804
7805 torture_rpc_tcase_add_test_creds(tcase, "pwdLastSet",
7806 torture_rpc_samr_pwdlastset);
7807
7808 return suite;
7809 }
7810
7811 static bool torture_rpc_samr_users_privileges_delete_user(struct torture_context *torture,
7812 struct dcerpc_pipe *p2,
7813 struct cli_credentials *machine_credentials)
7814 {
7815 NTSTATUS status;
7816 struct dcerpc_pipe *p;
7817 bool ret = true;
7818 struct torture_samr_context *ctx;
7819
7820 status = torture_rpc_connection(torture, &p, &ndr_table_samr);
7821 if (!NT_STATUS_IS_OK(status)) {
7822 return false;
7823 }
7824
7825 ctx = talloc_zero(torture, struct torture_samr_context);
7826
7827 ctx->choice = TORTURE_SAMR_USER_PRIVILEGES;
7828 ctx->machine_credentials = machine_credentials;
7829
7830 ret &= test_Connect(p, torture, &ctx->handle);
7831
7832 ret &= test_EnumDomains(p, torture, ctx);
7833
7834 ret &= test_samr_handle_Close(p, torture, &ctx->handle);
7835
7836 return ret;
7837 }
7838
7839 struct torture_suite *torture_rpc_samr_user_privileges(TALLOC_CTX *mem_ctx)
7840 {
7841 struct torture_suite *suite = torture_suite_create(mem_ctx, "SAMR-USERS-PRIVILEGES");
7842 struct torture_rpc_tcase *tcase;
7843
7844 tcase = torture_suite_add_machine_bdc_rpc_iface_tcase(suite, "samr",
7845 &ndr_table_samr,
7846 TEST_ACCOUNT_NAME_PWD);
7847
7848 torture_rpc_tcase_add_test_creds(tcase, "delete_privileged_user",
7849 torture_rpc_samr_users_privileges_delete_user);
7850
7851 return suite;
7852 }
7853
7854 static bool torture_rpc_samr_many_accounts(struct torture_context *torture,
7855 struct dcerpc_pipe *p2,
7856 void *data)
7857 {
7858 NTSTATUS status;
7859 struct dcerpc_pipe *p;
7860 bool ret = true;
7861 struct torture_samr_context *ctx =
7862 talloc_get_type_abort(data, struct torture_samr_context);
7863
7864 status = torture_rpc_connection(torture, &p, &ndr_table_samr);
7865 if (!NT_STATUS_IS_OK(status)) {
7866 return false;
7867 }
7868
7869 ctx->choice = TORTURE_SAMR_MANY_ACCOUNTS;
7870 ctx->num_objects_large_dc = torture_setting_int(torture, "large_dc",
7871 ctx->num_objects_large_dc);
7872
7873 ret &= test_Connect(p, torture, &ctx->handle);
7874
7875 ret &= test_EnumDomains(p, torture, ctx);
7876
7877 ret &= test_samr_handle_Close(p, torture, &ctx->handle);
7878
7879 return ret;
7880 }
7881
7882 static bool torture_rpc_samr_many_groups(struct torture_context *torture,
7883 struct dcerpc_pipe *p2,
7884 void *data)
7885 {
7886 NTSTATUS status;
7887 struct dcerpc_pipe *p;
7888 bool ret = true;
7889 struct torture_samr_context *ctx =
7890 talloc_get_type_abort(data, struct torture_samr_context);
7891
7892 status = torture_rpc_connection(torture, &p, &ndr_table_samr);
7893 if (!NT_STATUS_IS_OK(status)) {
7894 return false;
7895 }
7896
7897 ctx->choice = TORTURE_SAMR_MANY_GROUPS;
7898 ctx->num_objects_large_dc = torture_setting_int(torture, "large_dc",
7899 ctx->num_objects_large_dc);
7900
7901 ret &= test_Connect(p, torture, &ctx->handle);
7902
7903 ret &= test_EnumDomains(p, torture, ctx);
7904
7905 ret &= test_samr_handle_Close(p, torture, &ctx->handle);
7906
7907 return ret;
7908 }
7909
7910 static bool torture_rpc_samr_many_aliases(struct torture_context *torture,
7911 struct dcerpc_pipe *p2,
7912 void *data)
7913 {
7914 NTSTATUS status;
7915 struct dcerpc_pipe *p;
7916 bool ret = true;
7917 struct torture_samr_context *ctx =
7918 talloc_get_type_abort(data, struct torture_samr_context);
7919
7920 status = torture_rpc_connection(torture, &p, &ndr_table_samr);
7921 if (!NT_STATUS_IS_OK(status)) {
7922 return false;
7923 }
7924
7925 ctx->choice = TORTURE_SAMR_MANY_ALIASES;
7926 ctx->num_objects_large_dc = torture_setting_int(torture, "large_dc",
7927 ctx->num_objects_large_dc);
7928
7929 ret &= test_Connect(p, torture, &ctx->handle);
7930
7931 ret &= test_EnumDomains(p, torture, ctx);
7932
7933 ret &= test_samr_handle_Close(p, torture, &ctx->handle);
7934
7935 return ret;
7936 }
7937
7938 struct torture_suite *torture_rpc_samr_large_dc(TALLOC_CTX *mem_ctx)
7939 {
7940 struct torture_suite *suite = torture_suite_create(mem_ctx, "SAMR-LARGE-DC");
7941 struct torture_rpc_tcase *tcase;
7942 struct torture_samr_context *ctx;
7943
7944 tcase = torture_suite_add_rpc_iface_tcase(suite, "samr", &ndr_table_samr);
7945
7946 ctx = talloc_zero(suite, struct torture_samr_context);
7947 ctx->num_objects_large_dc = 150;
7948
7949 torture_rpc_tcase_add_test_ex(tcase, "many_aliases",
7950 torture_rpc_samr_many_aliases, ctx);
7951 torture_rpc_tcase_add_test_ex(tcase, "many_groups",
7952 torture_rpc_samr_many_groups, ctx);
7953 torture_rpc_tcase_add_test_ex(tcase, "many_accounts",
7954 torture_rpc_samr_many_accounts, ctx);
7955
7956 return suite;
7957 }
7958
7959 static bool torture_rpc_samr_badpwdcount(struct torture_context *torture,
7960 struct dcerpc_pipe *p2,
7961 struct cli_credentials *machine_credentials)
7962 {
7963 NTSTATUS status;
7964 struct dcerpc_pipe *p;
7965 bool ret = true;
7966 struct torture_samr_context *ctx;
7967
7968 status = torture_rpc_connection(torture, &p, &ndr_table_samr);
7969 if (!NT_STATUS_IS_OK(status)) {
7970 return false;
7971 }
7972
7973 ctx = talloc_zero(torture, struct torture_samr_context);
7974
7975 ctx->choice = TORTURE_SAMR_PASSWORDS_BADPWDCOUNT;
7976 ctx->machine_credentials = machine_credentials;
7977
7978 ret &= test_Connect(p, torture, &ctx->handle);
7979
7980 ret &= test_EnumDomains(p, torture, ctx);
7981
7982 ret &= test_samr_handle_Close(p, torture, &ctx->handle);
7983
7984 return ret;
7985 }
7986
7987 struct torture_suite *torture_rpc_samr_passwords_badpwdcount(TALLOC_CTX *mem_ctx)
7988 {
7989 struct torture_suite *suite = torture_suite_create(mem_ctx, "SAMR-PASSWORDS-BADPWDCOUNT");
7990 struct torture_rpc_tcase *tcase;
7991
7992 tcase = torture_suite_add_machine_bdc_rpc_iface_tcase(suite, "samr",
7993 &ndr_table_samr,
7994 TEST_ACCOUNT_NAME_PWD);
7995
7996 torture_rpc_tcase_add_test_creds(tcase, "badPwdCount",
7997 torture_rpc_samr_badpwdcount);
7998
7999 return suite;
8000 }
8001
8002 static bool torture_rpc_samr_lockout(struct torture_context *torture,
8003 struct dcerpc_pipe *p2,
8004 struct cli_credentials *machine_credentials)
8005 {
8006 NTSTATUS status;
8007 struct dcerpc_pipe *p;
8008 bool ret = true;
8009 struct torture_samr_context *ctx;
8010
8011 status = torture_rpc_connection(torture, &p, &ndr_table_samr);
8012 if (!NT_STATUS_IS_OK(status)) {
8013 return false;
8014 }
8015
8016 ctx = talloc_zero(torture, struct torture_samr_context);
8017
8018 ctx->choice = TORTURE_SAMR_PASSWORDS_LOCKOUT;
8019 ctx->machine_credentials = machine_credentials;
8020
8021 ret &= test_Connect(p, torture, &ctx->handle);
8022
8023 ret &= test_EnumDomains(p, torture, ctx);
8024
8025 ret &= test_samr_handle_Close(p, torture, &ctx->handle);
8026
8027 return ret;
8028 }
8029
8030 struct torture_suite *torture_rpc_samr_passwords_lockout(TALLOC_CTX *mem_ctx)
8031 {
8032 struct torture_suite *suite = torture_suite_create(mem_ctx, "SAMR-PASSWORDS-LOCKOUT");
8033 struct torture_rpc_tcase *tcase;
8034
8035 tcase = torture_suite_add_machine_bdc_rpc_iface_tcase(suite, "samr",
8036 &ndr_table_samr,
8037 TEST_ACCOUNT_NAME_PWD);
8038
8039 torture_rpc_tcase_add_test_creds(tcase, "lockout",
8040 torture_rpc_samr_lockout);
8041
8042 return suite;
8043 }
8044
8045
reg import