?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
s3-selftest: Remove some unnecessary comma
[Samba/gebeck_regimport.git] / source4 / torture / rpc / samr.c
blobbf1d713eed3b08e70eb50ce7940d31433e79b011
1 /*
2 Unix SMB/CIFS implementation.
3 test suite for samr rpc operations
4
5 Copyright (C) Andrew Tridgell 2003
6 Copyright (C) Andrew Bartlett <abartlet@samba.org> 2003
7 Copyright (C) Jelmer Vernooij 2005-2007
8 Copyright (C) Guenther Deschner 2008-2010
9
10 This program is free software; you can redistribute it and/or modify
11 it under the terms of the GNU General Public License as published by
12 the Free Software Foundation; either version 3 of the License, or
13 (at your option) any later version.
14
15 This program is distributed in the hope that it will be useful,
16 but WITHOUT ANY WARRANTY; without even the implied warranty of
17 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
18 GNU General Public License for more details.
19
20 You should have received a copy of the GNU General Public License
21 along with this program. If not, see <http://www.gnu.org/licenses/>.
22 */
23
24 #include "includes.h"
25 #include "torture/torture.h"
26 #include <tevent.h>
27 #include "system/time.h"
28 #include "system/network.h"
29 #include "librpc/gen_ndr/lsa.h"
30 #include "librpc/gen_ndr/ndr_netlogon.h"
31 #include "librpc/gen_ndr/ndr_netlogon_c.h"
32 #include "librpc/gen_ndr/ndr_samr_c.h"
33 #include "librpc/gen_ndr/ndr_lsa_c.h"
34 #include "../lib/crypto/crypto.h"
35 #include "libcli/auth/libcli_auth.h"
36 #include "libcli/security/security.h"
37 #include "torture/rpc/torture_rpc.h"
38 #include "param/param.h"
39 #include "auth/gensec/gensec.h"
40 #include "auth/gensec/schannel.h"
41 #include "auth/gensec/gensec_proto.h"
42 #include "../libcli/auth/schannel.h"
43
44 #define TEST_ACCOUNT_NAME "samrtorturetest"
45 #define TEST_ACCOUNT_NAME_PWD "samrpwdlastset"
46 #define TEST_ALIASNAME "samrtorturetestalias"
47 #define TEST_GROUPNAME "samrtorturetestgroup"
48 #define TEST_MACHINENAME "samrtestmach$"
49 #define TEST_DOMAINNAME "samrtestdom$"
50
51 enum torture_samr_choice {
52 TORTURE_SAMR_PASSWORDS,
53 TORTURE_SAMR_PASSWORDS_PWDLASTSET,
54 TORTURE_SAMR_PASSWORDS_BADPWDCOUNT,
55 TORTURE_SAMR_PASSWORDS_LOCKOUT,
56 TORTURE_SAMR_USER_ATTRIBUTES,
57 TORTURE_SAMR_USER_PRIVILEGES,
58 TORTURE_SAMR_OTHER,
59 TORTURE_SAMR_MANY_ACCOUNTS,
60 TORTURE_SAMR_MANY_GROUPS,
61 TORTURE_SAMR_MANY_ALIASES
62 };
63
64 struct torture_samr_context {
65 struct policy_handle handle;
66 struct cli_credentials *machine_credentials;
67 enum torture_samr_choice choice;
68 uint32_t num_objects_large_dc;
69 };
70
71 static bool test_QueryUserInfo(struct dcerpc_binding_handle *b,
72 struct torture_context *tctx,
73 struct policy_handle *handle);
74
75 static bool test_QueryUserInfo2(struct dcerpc_binding_handle *b,
76 struct torture_context *tctx,
77 struct policy_handle *handle);
78
79 static bool test_QueryAliasInfo(struct dcerpc_binding_handle *b,
80 struct torture_context *tctx,
81 struct policy_handle *handle);
82
83 static bool test_ChangePassword(struct dcerpc_pipe *p,
84 struct torture_context *tctx,
85 const char *acct_name,
86 struct policy_handle *domain_handle, char **password);
87
88 static void init_lsa_String(struct lsa_String *string, const char *s)
89 {
90 string->string = s;
91 }
92
93 static void init_lsa_StringLarge(struct lsa_StringLarge *string, const char *s)
94 {
95 string->string = s;
96 }
97
98 static void init_lsa_BinaryString(struct lsa_BinaryString *string, const char *s, uint32_t length)
99 {
100 string->length = length;
101 string->size = length;
102 string->array = (uint16_t *)discard_const(s);
103 }
104
105 bool test_samr_handle_Close(struct dcerpc_binding_handle *b,
106 struct torture_context *tctx,
107 struct policy_handle *handle)
108 {
109 struct samr_Close r;
110
111 r.in.handle = handle;
112 r.out.handle = handle;
113
114 torture_assert_ntstatus_ok(tctx, dcerpc_samr_Close_r(b, tctx, &r),
115 "Close failed");
116 torture_assert_ntstatus_ok(tctx, r.out.result, "Close failed");
117
118 return true;
119 }
120
121 static bool test_Shutdown(struct dcerpc_binding_handle *b,
122 struct torture_context *tctx,
123 struct policy_handle *handle)
124 {
125 struct samr_Shutdown r;
126
127 if (!torture_setting_bool(tctx, "dangerous", false)) {
128 torture_skip(tctx, "samr_Shutdown disabled - enable dangerous tests to use\n");
129 return true;
130 }
131
132 r.in.connect_handle = handle;
133
134 torture_comment(tctx, "Testing samr_Shutdown\n");
135
136 torture_assert_ntstatus_ok(tctx, dcerpc_samr_Shutdown_r(b, tctx, &r),
137 "Shutdown failed");
138 torture_assert_ntstatus_ok(tctx, r.out.result, "Shutdown failed");
139
140 return true;
141 }
142
143 static bool test_SetDsrmPassword(struct dcerpc_binding_handle *b,
144 struct torture_context *tctx,
145 struct policy_handle *handle)
146 {
147 struct samr_SetDsrmPassword r;
148 struct lsa_String string;
149 struct samr_Password hash;
150
151 if (!torture_setting_bool(tctx, "dangerous", false)) {
152 torture_skip(tctx, "samr_SetDsrmPassword disabled - enable dangerous tests to use");
153 }
154
155 E_md4hash("TeSTDSRM123", hash.hash);
156
157 init_lsa_String(&string, "Administrator");
158
159 r.in.name = &string;
160 r.in.unknown = 0;
161 r.in.hash = &hash;
162
163 torture_comment(tctx, "Testing samr_SetDsrmPassword\n");
164
165 torture_assert_ntstatus_ok(tctx, dcerpc_samr_SetDsrmPassword_r(b, tctx, &r),
166 "SetDsrmPassword failed");
167 torture_assert_ntstatus_equal(tctx, r.out.result, NT_STATUS_NOT_SUPPORTED, "SetDsrmPassword failed");
168
169 return true;
170 }
171
172
173 static bool test_QuerySecurity(struct dcerpc_binding_handle *b,
174 struct torture_context *tctx,
175 struct policy_handle *handle)
176 {
177 struct samr_QuerySecurity r;
178 struct samr_SetSecurity s;
179 struct sec_desc_buf *sdbuf = NULL;
180
181 r.in.handle = handle;
182 r.in.sec_info = 7;
183 r.out.sdbuf = &sdbuf;
184
185 torture_assert_ntstatus_ok(tctx, dcerpc_samr_QuerySecurity_r(b, tctx, &r),
186 "QuerySecurity failed");
187 torture_assert_ntstatus_ok(tctx, r.out.result, "QuerySecurity failed");
188
189 torture_assert(tctx, sdbuf != NULL, "sdbuf is NULL");
190
191 s.in.handle = handle;
192 s.in.sec_info = 7;
193 s.in.sdbuf = sdbuf;
194
195 if (torture_setting_bool(tctx, "samba4", false)) {
196 torture_skip(tctx, "skipping SetSecurity test against Samba4\n");
197 }
198
199 torture_assert_ntstatus_ok(tctx, dcerpc_samr_SetSecurity_r(b, tctx, &s),
200 "SetSecurity failed");
201 torture_assert_ntstatus_ok(tctx, r.out.result, "SetSecurity failed");
202
203 torture_assert_ntstatus_ok(tctx, dcerpc_samr_QuerySecurity_r(b, tctx, &r),
204 "QuerySecurity failed");
205 torture_assert_ntstatus_ok(tctx, r.out.result, "QuerySecurity failed");
206
207 return true;
208 }
209
210
211 static bool test_SetUserInfo(struct dcerpc_binding_handle *b, struct torture_context *tctx,
212 struct policy_handle *handle, uint32_t base_acct_flags,
213 const char *base_account_name)
214 {
215 struct samr_SetUserInfo s;
216 struct samr_SetUserInfo2 s2;
217 struct samr_QueryUserInfo q;
218 struct samr_QueryUserInfo q0;
219 union samr_UserInfo u;
220 union samr_UserInfo *info;
221 bool ret = true;
222 const char *test_account_name;
223
224 uint32_t user_extra_flags = 0;
225
226 if (!torture_setting_bool(tctx, "samba3", false)) {
227 if (base_acct_flags == ACB_NORMAL) {
228 /* When created, accounts are expired by default */
229 user_extra_flags = ACB_PW_EXPIRED;
230 }
231 }
232
233 s.in.user_handle = handle;
234 s.in.info = &u;
235
236 s2.in.user_handle = handle;
237 s2.in.info = &u;
238
239 q.in.user_handle = handle;
240 q.out.info = &info;
241 q0 = q;
242
243 #define TESTCALL(call, r) \
244 torture_assert_ntstatus_ok(tctx, dcerpc_samr_ ##call## _r(b, tctx, &r),\
245 #call " failed"); \
246 if (!NT_STATUS_IS_OK(r.out.result)) { \
247 torture_comment(tctx, #call " level %u failed - %s (%s)\n", \
248 r.in.level, nt_errstr(r.out.result), __location__); \
249 ret = false; \
250 break; \
251 }
252
253 #define STRING_EQUAL(s1, s2, field) \
254 if ((s1 && !s2) || (s2 && !s1) || strcmp(s1, s2)) { \
255 torture_comment(tctx, "Failed to set %s to '%s' (%s)\n", \
256 #field, s2, __location__); \
257 ret = false; \
258 break; \
259 }
260
261 #define MEM_EQUAL(s1, s2, length, field) \
262 if ((s1 && !s2) || (s2 && !s1) || memcmp(s1, s2, length)) { \
263 torture_comment(tctx, "Failed to set %s to '%s' (%s)\n", \
264 #field, (const char *)s2, __location__); \
265 ret = false; \
266 break; \
267 }
268
269 #define INT_EQUAL(i1, i2, field) \
270 if (i1 != i2) { \
271 torture_comment(tctx, "Failed to set %s to 0x%llx - got 0x%llx (%s)\n", \
272 #field, (unsigned long long)i2, (unsigned long long)i1, __location__); \
273 ret = false; \
274 break; \
275 }
276
277 #define TEST_USERINFO_STRING(lvl1, field1, lvl2, field2, value, fpval) do { \
278 torture_comment(tctx, "field test %d/%s vs %d/%s\n", lvl1, #field1, lvl2, #field2); \
279 q.in.level = lvl1; \
280 TESTCALL(QueryUserInfo, q) \
281 s.in.level = lvl1; \
282 s2.in.level = lvl1; \
283 u = *info; \
284 if (lvl1 == 21) { \
285 ZERO_STRUCT(u.info21); \
286 u.info21.fields_present = fpval; \
287 } \
288 init_lsa_String(&u.info ## lvl1.field1, value); \
289 TESTCALL(SetUserInfo, s) \
290 TESTCALL(SetUserInfo2, s2) \
291 init_lsa_String(&u.info ## lvl1.field1, ""); \
292 TESTCALL(QueryUserInfo, q); \
293 u = *info; \
294 STRING_EQUAL(u.info ## lvl1.field1.string, value, field1); \
295 q.in.level = lvl2; \
296 TESTCALL(QueryUserInfo, q) \
297 u = *info; \
298 STRING_EQUAL(u.info ## lvl2.field2.string, value, field2); \
299 } while (0)
300
301 #define TEST_USERINFO_BINARYSTRING(lvl1, field1, lvl2, field2, value, fpval) do { \
302 torture_comment(tctx, "field test %d/%s vs %d/%s\n", lvl1, #field1, lvl2, #field2); \
303 q.in.level = lvl1; \
304 TESTCALL(QueryUserInfo, q) \
305 s.in.level = lvl1; \
306 s2.in.level = lvl1; \
307 u = *info; \
308 if (lvl1 == 21) { \
309 ZERO_STRUCT(u.info21); \
310 u.info21.fields_present = fpval; \
311 } \
312 init_lsa_BinaryString(&u.info ## lvl1.field1, value, strlen(value)); \
313 TESTCALL(SetUserInfo, s) \
314 TESTCALL(SetUserInfo2, s2) \
315 init_lsa_BinaryString(&u.info ## lvl1.field1, "", 1); \
316 TESTCALL(QueryUserInfo, q); \
317 u = *info; \
318 MEM_EQUAL(u.info ## lvl1.field1.array, value, strlen(value), field1); \
319 q.in.level = lvl2; \
320 TESTCALL(QueryUserInfo, q) \
321 u = *info; \
322 MEM_EQUAL(u.info ## lvl2.field2.array, value, strlen(value), field2); \
323 } while (0)
324
325 #define TEST_USERINFO_INT_EXP(lvl1, field1, lvl2, field2, value, exp_value, fpval) do { \
326 torture_comment(tctx, "field test %d/%s vs %d/%s\n", lvl1, #field1, lvl2, #field2); \
327 q.in.level = lvl1; \
328 TESTCALL(QueryUserInfo, q) \
329 s.in.level = lvl1; \
330 s2.in.level = lvl1; \
331 u = *info; \
332 if (lvl1 == 21) { \
333 uint8_t *bits = u.info21.logon_hours.bits; \
334 ZERO_STRUCT(u.info21); \
335 if (fpval == SAMR_FIELD_LOGON_HOURS) { \
336 u.info21.logon_hours.units_per_week = 168; \
337 u.info21.logon_hours.bits = bits; \
338 } \
339 u.info21.fields_present = fpval; \
340 } \
341 u.info ## lvl1.field1 = value; \
342 TESTCALL(SetUserInfo, s) \
343 TESTCALL(SetUserInfo2, s2) \
344 u.info ## lvl1.field1 = 0; \
345 TESTCALL(QueryUserInfo, q); \
346 u = *info; \
347 INT_EQUAL(u.info ## lvl1.field1, exp_value, field1); \
348 q.in.level = lvl2; \
349 TESTCALL(QueryUserInfo, q) \
350 u = *info; \
351 INT_EQUAL(u.info ## lvl2.field2, exp_value, field1); \
352 } while (0)
353
354 #define TEST_USERINFO_INT(lvl1, field1, lvl2, field2, value, fpval) do { \
355 TEST_USERINFO_INT_EXP(lvl1, field1, lvl2, field2, value, value, fpval); \
356 } while (0)
357
358 q0.in.level = 12;
359 do { TESTCALL(QueryUserInfo, q0) } while (0);
360
361 TEST_USERINFO_STRING(2, comment, 1, comment, "xx2-1 comment", 0);
362 TEST_USERINFO_STRING(2, comment, 21, comment, "xx2-21 comment", 0);
363 TEST_USERINFO_STRING(21, comment, 21, comment, "xx21-21 comment",
364 SAMR_FIELD_COMMENT);
365
366 test_account_name = talloc_asprintf(tctx, "%sxx7-1", base_account_name);
367 TEST_USERINFO_STRING(7, account_name, 1, account_name, base_account_name, 0);
368 test_account_name = talloc_asprintf(tctx, "%sxx7-3", base_account_name);
369 TEST_USERINFO_STRING(7, account_name, 3, account_name, base_account_name, 0);
370 test_account_name = talloc_asprintf(tctx, "%sxx7-5", base_account_name);
371 TEST_USERINFO_STRING(7, account_name, 5, account_name, base_account_name, 0);
372 test_account_name = talloc_asprintf(tctx, "%sxx7-6", base_account_name);
373 TEST_USERINFO_STRING(7, account_name, 6, account_name, base_account_name, 0);
374 test_account_name = talloc_asprintf(tctx, "%sxx7-7", base_account_name);
375 TEST_USERINFO_STRING(7, account_name, 7, account_name, base_account_name, 0);
376 test_account_name = talloc_asprintf(tctx, "%sxx7-21", base_account_name);
377 TEST_USERINFO_STRING(7, account_name, 21, account_name, base_account_name, 0);
378 test_account_name = base_account_name;
379 TEST_USERINFO_STRING(21, account_name, 21, account_name, base_account_name,
380 SAMR_FIELD_ACCOUNT_NAME);
381
382 TEST_USERINFO_STRING(6, full_name, 1, full_name, "xx6-1 full_name", 0);
383 TEST_USERINFO_STRING(6, full_name, 3, full_name, "xx6-3 full_name", 0);
384 TEST_USERINFO_STRING(6, full_name, 5, full_name, "xx6-5 full_name", 0);
385 TEST_USERINFO_STRING(6, full_name, 6, full_name, "xx6-6 full_name", 0);
386 TEST_USERINFO_STRING(6, full_name, 8, full_name, "xx6-8 full_name", 0);
387 TEST_USERINFO_STRING(6, full_name, 21, full_name, "xx6-21 full_name", 0);
388 TEST_USERINFO_STRING(8, full_name, 21, full_name, "xx8-21 full_name", 0);
389 TEST_USERINFO_STRING(21, full_name, 21, full_name, "xx21-21 full_name",
390 SAMR_FIELD_FULL_NAME);
391
392 TEST_USERINFO_STRING(6, full_name, 1, full_name, "", 0);
393 TEST_USERINFO_STRING(6, full_name, 3, full_name, "", 0);
394 TEST_USERINFO_STRING(6, full_name, 5, full_name, "", 0);
395 TEST_USERINFO_STRING(6, full_name, 6, full_name, "", 0);
396 TEST_USERINFO_STRING(6, full_name, 8, full_name, "", 0);
397 TEST_USERINFO_STRING(6, full_name, 21, full_name, "", 0);
398 TEST_USERINFO_STRING(8, full_name, 21, full_name, "", 0);
399 TEST_USERINFO_STRING(21, full_name, 21, full_name, "",
400 SAMR_FIELD_FULL_NAME);
401
402 TEST_USERINFO_STRING(11, logon_script, 3, logon_script, "xx11-3 logon_script", 0);
403 TEST_USERINFO_STRING(11, logon_script, 5, logon_script, "xx11-5 logon_script", 0);
404 TEST_USERINFO_STRING(11, logon_script, 21, logon_script, "xx11-21 logon_script", 0);
405 TEST_USERINFO_STRING(21, logon_script, 21, logon_script, "xx21-21 logon_script",
406 SAMR_FIELD_LOGON_SCRIPT);
407
408 TEST_USERINFO_STRING(12, profile_path, 3, profile_path, "xx12-3 profile_path", 0);
409 TEST_USERINFO_STRING(12, profile_path, 5, profile_path, "xx12-5 profile_path", 0);
410 TEST_USERINFO_STRING(12, profile_path, 21, profile_path, "xx12-21 profile_path", 0);
411 TEST_USERINFO_STRING(21, profile_path, 21, profile_path, "xx21-21 profile_path",
412 SAMR_FIELD_PROFILE_PATH);
413
414 TEST_USERINFO_STRING(10, home_directory, 3, home_directory, "xx10-3 home_directory", 0);
415 TEST_USERINFO_STRING(10, home_directory, 5, home_directory, "xx10-5 home_directory", 0);
416 TEST_USERINFO_STRING(10, home_directory, 21, home_directory, "xx10-21 home_directory", 0);
417 TEST_USERINFO_STRING(21, home_directory, 21, home_directory, "xx21-21 home_directory",
418 SAMR_FIELD_HOME_DIRECTORY);
419 TEST_USERINFO_STRING(21, home_directory, 10, home_directory, "xx21-10 home_directory",
420 SAMR_FIELD_HOME_DIRECTORY);
421
422 TEST_USERINFO_STRING(10, home_drive, 3, home_drive, "xx10-3 home_drive", 0);
423 TEST_USERINFO_STRING(10, home_drive, 5, home_drive, "xx10-5 home_drive", 0);
424 TEST_USERINFO_STRING(10, home_drive, 21, home_drive, "xx10-21 home_drive", 0);
425 TEST_USERINFO_STRING(21, home_drive, 21, home_drive, "xx21-21 home_drive",
426 SAMR_FIELD_HOME_DRIVE);
427 TEST_USERINFO_STRING(21, home_drive, 10, home_drive, "xx21-10 home_drive",
428 SAMR_FIELD_HOME_DRIVE);
429
430 TEST_USERINFO_STRING(13, description, 1, description, "xx13-1 description", 0);
431 TEST_USERINFO_STRING(13, description, 5, description, "xx13-5 description", 0);
432 TEST_USERINFO_STRING(13, description, 21, description, "xx13-21 description", 0);
433 TEST_USERINFO_STRING(21, description, 21, description, "xx21-21 description",
434 SAMR_FIELD_DESCRIPTION);
435
436 TEST_USERINFO_STRING(14, workstations, 3, workstations, "14workstation3", 0);
437 TEST_USERINFO_STRING(14, workstations, 5, workstations, "14workstation4", 0);
438 TEST_USERINFO_STRING(14, workstations, 21, workstations, "14workstation21", 0);
439 TEST_USERINFO_STRING(21, workstations, 21, workstations, "21workstation21",
440 SAMR_FIELD_WORKSTATIONS);
441 TEST_USERINFO_STRING(21, workstations, 3, workstations, "21workstation3",
442 SAMR_FIELD_WORKSTATIONS);
443 TEST_USERINFO_STRING(21, workstations, 5, workstations, "21workstation5",
444 SAMR_FIELD_WORKSTATIONS);
445 TEST_USERINFO_STRING(21, workstations, 14, workstations, "21workstation14",
446 SAMR_FIELD_WORKSTATIONS);
447
448 TEST_USERINFO_BINARYSTRING(20, parameters, 21, parameters, "xx20-21 parameters", 0);
449 TEST_USERINFO_BINARYSTRING(21, parameters, 21, parameters, "xx21-21 parameters",
450 SAMR_FIELD_PARAMETERS);
451 TEST_USERINFO_BINARYSTRING(21, parameters, 20, parameters, "xx21-20 parameters",
452 SAMR_FIELD_PARAMETERS);
453 /* also empty user parameters are allowed */
454 TEST_USERINFO_BINARYSTRING(20, parameters, 21, parameters, "", 0);
455 TEST_USERINFO_BINARYSTRING(21, parameters, 21, parameters, "",
456 SAMR_FIELD_PARAMETERS);
457 TEST_USERINFO_BINARYSTRING(21, parameters, 20, parameters, "",
458 SAMR_FIELD_PARAMETERS);
459
460 /* Samba 3 cannot store country_code and code_page atm. - gd */
461 if (!torture_setting_bool(tctx, "samba3", false)) {
462 TEST_USERINFO_INT(2, country_code, 2, country_code, __LINE__, 0);
463 TEST_USERINFO_INT(2, country_code, 21, country_code, __LINE__, 0);
464 TEST_USERINFO_INT(21, country_code, 21, country_code, __LINE__,
465 SAMR_FIELD_COUNTRY_CODE);
466 TEST_USERINFO_INT(21, country_code, 2, country_code, __LINE__,
467 SAMR_FIELD_COUNTRY_CODE);
468
469 TEST_USERINFO_INT(2, code_page, 21, code_page, __LINE__, 0);
470 TEST_USERINFO_INT(21, code_page, 21, code_page, __LINE__,
471 SAMR_FIELD_CODE_PAGE);
472 TEST_USERINFO_INT(21, code_page, 2, code_page, __LINE__,
473 SAMR_FIELD_CODE_PAGE);
474 }
475
476 if (!torture_setting_bool(tctx, "samba3", false)) {
477 TEST_USERINFO_INT(17, acct_expiry, 21, acct_expiry, __LINE__, 0);
478 TEST_USERINFO_INT(17, acct_expiry, 5, acct_expiry, __LINE__, 0);
479 TEST_USERINFO_INT(21, acct_expiry, 21, acct_expiry, __LINE__,
480 SAMR_FIELD_ACCT_EXPIRY);
481 TEST_USERINFO_INT(21, acct_expiry, 5, acct_expiry, __LINE__,
482 SAMR_FIELD_ACCT_EXPIRY);
483 TEST_USERINFO_INT(21, acct_expiry, 17, acct_expiry, __LINE__,
484 SAMR_FIELD_ACCT_EXPIRY);
485 } else {
486 /* Samba 3 can only store seconds / time_t in passdb - gd */
487 NTTIME nt;
488 unix_to_nt_time(&nt, time(NULL) + __LINE__);
489 TEST_USERINFO_INT(17, acct_expiry, 21, acct_expiry, nt, 0);
490 unix_to_nt_time(&nt, time(NULL) + __LINE__);
491 TEST_USERINFO_INT(17, acct_expiry, 5, acct_expiry, nt, 0);
492 unix_to_nt_time(&nt, time(NULL) + __LINE__);
493 TEST_USERINFO_INT(21, acct_expiry, 21, acct_expiry, nt, SAMR_FIELD_ACCT_EXPIRY);
494 unix_to_nt_time(&nt, time(NULL) + __LINE__);
495 TEST_USERINFO_INT(21, acct_expiry, 5, acct_expiry, nt, SAMR_FIELD_ACCT_EXPIRY);
496 unix_to_nt_time(&nt, time(NULL) + __LINE__);
497 TEST_USERINFO_INT(21, acct_expiry, 17, acct_expiry, nt, SAMR_FIELD_ACCT_EXPIRY);
498 }
499
500 TEST_USERINFO_INT(4, logon_hours.bits[3], 3, logon_hours.bits[3], 1, 0);
501 TEST_USERINFO_INT(4, logon_hours.bits[3], 5, logon_hours.bits[3], 2, 0);
502 TEST_USERINFO_INT(4, logon_hours.bits[3], 21, logon_hours.bits[3], 3, 0);
503 TEST_USERINFO_INT(21, logon_hours.bits[3], 21, logon_hours.bits[3], 4,
504 SAMR_FIELD_LOGON_HOURS);
505
506 TEST_USERINFO_INT_EXP(16, acct_flags, 5, acct_flags,
507 (base_acct_flags | ACB_DISABLED | ACB_HOMDIRREQ),
508 (base_acct_flags | ACB_DISABLED | ACB_HOMDIRREQ | user_extra_flags),
509 0);
510 TEST_USERINFO_INT_EXP(16, acct_flags, 5, acct_flags,
511 (base_acct_flags | ACB_DISABLED),
512 (base_acct_flags | ACB_DISABLED | user_extra_flags),
513 0);
514
515 /* Setting PWNOEXP clears the magic ACB_PW_EXPIRED flag */
516 TEST_USERINFO_INT_EXP(16, acct_flags, 5, acct_flags,
517 (base_acct_flags | ACB_DISABLED | ACB_PWNOEXP),
518 (base_acct_flags | ACB_DISABLED | ACB_PWNOEXP),
519 0);
520 TEST_USERINFO_INT_EXP(16, acct_flags, 21, acct_flags,
521 (base_acct_flags | ACB_DISABLED | ACB_HOMDIRREQ),
522 (base_acct_flags | ACB_DISABLED | ACB_HOMDIRREQ | user_extra_flags),
523 0);
524
525
526 /* The 'autolock' flag doesn't stick - check this */
527 TEST_USERINFO_INT_EXP(16, acct_flags, 21, acct_flags,
528 (base_acct_flags | ACB_DISABLED | ACB_AUTOLOCK),
529 (base_acct_flags | ACB_DISABLED | user_extra_flags),
530 0);
531 #if 0
532 /* Removing the 'disabled' flag doesn't stick - check this */
533 TEST_USERINFO_INT_EXP(16, acct_flags, 21, acct_flags,
534 (base_acct_flags),
535 (base_acct_flags | ACB_DISABLED | user_extra_flags),
536 0);
537 #endif
538
539 /* Samba3 cannot store these atm */
540 if (!torture_setting_bool(tctx, "samba3", false)) {
541 /* The 'store plaintext' flag does stick */
542 TEST_USERINFO_INT_EXP(16, acct_flags, 21, acct_flags,
543 (base_acct_flags | ACB_DISABLED | ACB_ENC_TXT_PWD_ALLOWED),
544 (base_acct_flags | ACB_DISABLED | ACB_ENC_TXT_PWD_ALLOWED | user_extra_flags),
545 0);
546 /* The 'use DES' flag does stick */
547 TEST_USERINFO_INT_EXP(16, acct_flags, 21, acct_flags,
548 (base_acct_flags | ACB_DISABLED | ACB_USE_DES_KEY_ONLY),
549 (base_acct_flags | ACB_DISABLED | ACB_USE_DES_KEY_ONLY | user_extra_flags),
550 0);
551 /* The 'don't require kerberos pre-authentication flag does stick */
552 TEST_USERINFO_INT_EXP(16, acct_flags, 21, acct_flags,
553 (base_acct_flags | ACB_DISABLED | ACB_DONT_REQUIRE_PREAUTH),
554 (base_acct_flags | ACB_DISABLED | ACB_DONT_REQUIRE_PREAUTH | user_extra_flags),
555 0);
556 /* The 'no kerberos PAC required' flag sticks */
557 TEST_USERINFO_INT_EXP(16, acct_flags, 21, acct_flags,
558 (base_acct_flags | ACB_DISABLED | ACB_NO_AUTH_DATA_REQD),
559 (base_acct_flags | ACB_DISABLED | ACB_NO_AUTH_DATA_REQD | user_extra_flags),
560 0);
561 }
562 TEST_USERINFO_INT_EXP(21, acct_flags, 21, acct_flags,
563 (base_acct_flags | ACB_DISABLED),
564 (base_acct_flags | ACB_DISABLED | user_extra_flags),
565 SAMR_FIELD_ACCT_FLAGS);
566
567 #if 0
568 /* these fail with win2003 - it appears you can't set the primary gid?
569 the set succeeds, but the gid isn't changed. Very weird! */
570 TEST_USERINFO_INT(9, primary_gid, 1, primary_gid, 513);
571 TEST_USERINFO_INT(9, primary_gid, 3, primary_gid, 513);
572 TEST_USERINFO_INT(9, primary_gid, 5, primary_gid, 513);
573 TEST_USERINFO_INT(9, primary_gid, 21, primary_gid, 513);
574 #endif
575
576 return ret;
577 }
578
579 /*
580 generate a random password for password change tests
581 */
582 static char *samr_rand_pass_silent(TALLOC_CTX *mem_ctx, int min_len)
583 {
584 size_t len = MAX(8, min_len);
585 char *s = generate_random_password(mem_ctx, len, len+6);
586 return s;
587 }
588
589 static char *samr_rand_pass(TALLOC_CTX *mem_ctx, int min_len)
590 {
591 char *s = samr_rand_pass_silent(mem_ctx, min_len);
592 printf("Generated password '%s'\n", s);
593 return s;
594
595 }
596
597 /*
598 generate a random password for password change tests
599 */
600 static DATA_BLOB samr_very_rand_pass(TALLOC_CTX *mem_ctx, int len)
601 {
602 int i;
603 DATA_BLOB password = data_blob_talloc(mem_ctx, NULL, len * 2 /* number of unicode chars */);
604 generate_random_buffer(password.data, password.length);
605
606 for (i=0; i < len; i++) {
607 if (((uint16_t *)password.data)[i] == 0) {
608 ((uint16_t *)password.data)[i] = 1;
609 }
610 }
611
612 return password;
613 }
614
615 /*
616 generate a random password for password change tests (fixed length)
617 */
618 static char *samr_rand_pass_fixed_len(TALLOC_CTX *mem_ctx, int len)
619 {
620 char *s = generate_random_password(mem_ctx, len, len);
621 printf("Generated password '%s'\n", s);
622 return s;
623 }
624
625 static bool test_SetUserPass(struct dcerpc_pipe *p, struct torture_context *tctx,
626 struct policy_handle *handle, char **password)
627 {
628 NTSTATUS status;
629 struct samr_SetUserInfo s;
630 union samr_UserInfo u;
631 bool ret = true;
632 DATA_BLOB session_key;
633 char *newpass;
634 struct dcerpc_binding_handle *b = p->binding_handle;
635 struct samr_GetUserPwInfo pwp;
636 struct samr_PwInfo info;
637 int policy_min_pw_len = 0;
638 pwp.in.user_handle = handle;
639 pwp.out.info = &info;
640
641 torture_assert_ntstatus_ok(tctx, dcerpc_samr_GetUserPwInfo_r(b, tctx, &pwp),
642 "GetUserPwInfo failed");
643 if (NT_STATUS_IS_OK(pwp.out.result)) {
644 policy_min_pw_len = pwp.out.info->min_password_length;
645 }
646 newpass = samr_rand_pass(tctx, policy_min_pw_len);
647
648 s.in.user_handle = handle;
649 s.in.info = &u;
650 s.in.level = 24;
651
652 encode_pw_buffer(u.info24.password.data, newpass, STR_UNICODE);
653 u.info24.password_expired = 0;
654
655 status = dcerpc_fetch_session_key(p, &session_key);
656 if (!NT_STATUS_IS_OK(status)) {
657 torture_warning(tctx, "SetUserInfo level %u - no session key - %s\n",
658 s.in.level, nt_errstr(status));
659 return false;
660 }
661
662 arcfour_crypt_blob(u.info24.password.data, 516, &session_key);
663
664 torture_comment(tctx, "Testing SetUserInfo level 24 (set password)\n");
665
666 torture_assert_ntstatus_ok(tctx, dcerpc_samr_SetUserInfo_r(b, tctx, &s),
667 "SetUserInfo failed");
668 if (!NT_STATUS_IS_OK(s.out.result)) {
669 torture_warning(tctx, "SetUserInfo level %u failed - %s\n",
670 s.in.level, nt_errstr(s.out.result));
671 ret = false;
672 } else {
673 *password = newpass;
674 }
675
676 return ret;
677 }
678
679
680 static bool test_SetUserPass_23(struct dcerpc_pipe *p, struct torture_context *tctx,
681 struct policy_handle *handle, uint32_t fields_present,
682 char **password)
683 {
684 NTSTATUS status;
685 struct samr_SetUserInfo s;
686 union samr_UserInfo u;
687 bool ret = true;
688 DATA_BLOB session_key;
689 struct dcerpc_binding_handle *b = p->binding_handle;
690 char *newpass;
691 struct samr_GetUserPwInfo pwp;
692 struct samr_PwInfo info;
693 int policy_min_pw_len = 0;
694 pwp.in.user_handle = handle;
695 pwp.out.info = &info;
696
697 torture_assert_ntstatus_ok(tctx, dcerpc_samr_GetUserPwInfo_r(b, tctx, &pwp),
698 "GetUserPwInfo failed");
699 if (NT_STATUS_IS_OK(pwp.out.result)) {
700 policy_min_pw_len = pwp.out.info->min_password_length;
701 }
702 newpass = samr_rand_pass(tctx, policy_min_pw_len);
703
704 s.in.user_handle = handle;
705 s.in.info = &u;
706 s.in.level = 23;
707
708 ZERO_STRUCT(u);
709
710 u.info23.info.fields_present = fields_present;
711
712 encode_pw_buffer(u.info23.password.data, newpass, STR_UNICODE);
713
714 status = dcerpc_fetch_session_key(p, &session_key);
715 if (!NT_STATUS_IS_OK(status)) {
716 torture_warning(tctx, "SetUserInfo level %u - no session key - %s\n",
717 s.in.level, nt_errstr(status));
718 return false;
719 }
720
721 arcfour_crypt_blob(u.info23.password.data, 516, &session_key);
722
723 torture_comment(tctx, "Testing SetUserInfo level 23 (set password)\n");
724
725 torture_assert_ntstatus_ok(tctx, dcerpc_samr_SetUserInfo_r(b, tctx, &s),
726 "SetUserInfo failed");
727 if (!NT_STATUS_IS_OK(s.out.result)) {
728 torture_warning(tctx, "SetUserInfo level %u failed - %s\n",
729 s.in.level, nt_errstr(s.out.result));
730 ret = false;
731 } else {
732 *password = newpass;
733 }
734
735 encode_pw_buffer(u.info23.password.data, newpass, STR_UNICODE);
736
737 status = dcerpc_fetch_session_key(p, &session_key);
738 if (!NT_STATUS_IS_OK(status)) {
739 torture_warning(tctx, "SetUserInfo level %u - no session key - %s\n",
740 s.in.level, nt_errstr(status));
741 return false;
742 }
743
744 /* This should break the key nicely */
745 session_key.length--;
746 arcfour_crypt_blob(u.info23.password.data, 516, &session_key);
747
748 torture_comment(tctx, "Testing SetUserInfo level 23 (set password) with wrong password\n");
749
750 torture_assert_ntstatus_ok(tctx, dcerpc_samr_SetUserInfo_r(b, tctx, &s),
751 "SetUserInfo failed");
752 if (!NT_STATUS_EQUAL(s.out.result, NT_STATUS_WRONG_PASSWORD)) {
753 torture_warning(tctx, "SetUserInfo level %u should have failed with WRONG_PASSWORD- %s\n",
754 s.in.level, nt_errstr(s.out.result));
755 ret = false;
756 }
757
758 return ret;
759 }
760
761
762 static bool test_SetUserPassEx(struct dcerpc_pipe *p, struct torture_context *tctx,
763 struct policy_handle *handle, bool makeshort,
764 char **password)
765 {
766 NTSTATUS status;
767 struct samr_SetUserInfo s;
768 union samr_UserInfo u;
769 bool ret = true;
770 DATA_BLOB session_key;
771 DATA_BLOB confounded_session_key = data_blob_talloc(tctx, NULL, 16);
772 uint8_t confounder[16];
773 char *newpass;
774 struct dcerpc_binding_handle *b = p->binding_handle;
775 struct MD5Context ctx;
776 struct samr_GetUserPwInfo pwp;
777 struct samr_PwInfo info;
778 int policy_min_pw_len = 0;
779 pwp.in.user_handle = handle;
780 pwp.out.info = &info;
781
782 torture_assert_ntstatus_ok(tctx, dcerpc_samr_GetUserPwInfo_r(b, tctx, &pwp),
783 "GetUserPwInfo failed");
784 if (NT_STATUS_IS_OK(pwp.out.result)) {
785 policy_min_pw_len = pwp.out.info->min_password_length;
786 }
787 if (makeshort && policy_min_pw_len) {
788 newpass = samr_rand_pass_fixed_len(tctx, policy_min_pw_len - 1);
789 } else {
790 newpass = samr_rand_pass(tctx, policy_min_pw_len);
791 }
792
793 s.in.user_handle = handle;
794 s.in.info = &u;
795 s.in.level = 26;
796
797 encode_pw_buffer(u.info26.password.data, newpass, STR_UNICODE);
798 u.info26.password_expired = 0;
799
800 status = dcerpc_fetch_session_key(p, &session_key);
801 if (!NT_STATUS_IS_OK(status)) {
802 torture_warning(tctx, "SetUserInfo level %u - no session key - %s\n",
803 s.in.level, nt_errstr(status));
804 return false;
805 }
806
807 generate_random_buffer((uint8_t *)confounder, 16);
808
809 MD5Init(&ctx);
810 MD5Update(&ctx, confounder, 16);
811 MD5Update(&ctx, session_key.data, session_key.length);
812 MD5Final(confounded_session_key.data, &ctx);
813
814 arcfour_crypt_blob(u.info26.password.data, 516, &confounded_session_key);
815 memcpy(&u.info26.password.data[516], confounder, 16);
816
817 torture_comment(tctx, "Testing SetUserInfo level 26 (set password ex)\n");
818
819 torture_assert_ntstatus_ok(tctx, dcerpc_samr_SetUserInfo_r(b, tctx, &s),
820 "SetUserInfo failed");
821 if (!NT_STATUS_IS_OK(s.out.result)) {
822 torture_warning(tctx, "SetUserInfo level %u failed - %s\n",
823 s.in.level, nt_errstr(s.out.result));
824 ret = false;
825 } else {
826 *password = newpass;
827 }
828
829 /* This should break the key nicely */
830 confounded_session_key.data[0]++;
831
832 arcfour_crypt_blob(u.info26.password.data, 516, &confounded_session_key);
833 memcpy(&u.info26.password.data[516], confounder, 16);
834
835 torture_comment(tctx, "Testing SetUserInfo level 26 (set password ex) with wrong session key\n");
836
837 torture_assert_ntstatus_ok(tctx, dcerpc_samr_SetUserInfo_r(b, tctx, &s),
838 "SetUserInfo failed");
839 if (!NT_STATUS_EQUAL(s.out.result, NT_STATUS_WRONG_PASSWORD)) {
840 torture_warning(tctx, "SetUserInfo level %u should have failed with WRONG_PASSWORD: %s\n",
841 s.in.level, nt_errstr(s.out.result));
842 ret = false;
843 } else {
844 *password = newpass;
845 }
846
847 return ret;
848 }
849
850 static bool test_SetUserPass_25(struct dcerpc_pipe *p, struct torture_context *tctx,
851 struct policy_handle *handle, uint32_t fields_present,
852 char **password)
853 {
854 NTSTATUS status;
855 struct samr_SetUserInfo s;
856 union samr_UserInfo u;
857 bool ret = true;
858 DATA_BLOB session_key;
859 DATA_BLOB confounded_session_key = data_blob_talloc(tctx, NULL, 16);
860 struct MD5Context ctx;
861 uint8_t confounder[16];
862 char *newpass;
863 struct dcerpc_binding_handle *b = p->binding_handle;
864 struct samr_GetUserPwInfo pwp;
865 struct samr_PwInfo info;
866 int policy_min_pw_len = 0;
867 pwp.in.user_handle = handle;
868 pwp.out.info = &info;
869
870 torture_assert_ntstatus_ok(tctx, dcerpc_samr_GetUserPwInfo_r(b, tctx, &pwp),
871 "GetUserPwInfo failed");
872 if (NT_STATUS_IS_OK(pwp.out.result)) {
873 policy_min_pw_len = pwp.out.info->min_password_length;
874 }
875 newpass = samr_rand_pass(tctx, policy_min_pw_len);
876
877 s.in.user_handle = handle;
878 s.in.info = &u;
879 s.in.level = 25;
880
881 ZERO_STRUCT(u);
882
883 u.info25.info.fields_present = fields_present;
884
885 encode_pw_buffer(u.info25.password.data, newpass, STR_UNICODE);
886
887 status = dcerpc_fetch_session_key(p, &session_key);
888 if (!NT_STATUS_IS_OK(status)) {
889 torture_warning(tctx, "SetUserInfo level %u - no session key - %s\n",
890 s.in.level, nt_errstr(status));
891 return false;
892 }
893
894 generate_random_buffer((uint8_t *)confounder, 16);
895
896 MD5Init(&ctx);
897 MD5Update(&ctx, confounder, 16);
898 MD5Update(&ctx, session_key.data, session_key.length);
899 MD5Final(confounded_session_key.data, &ctx);
900
901 arcfour_crypt_blob(u.info25.password.data, 516, &confounded_session_key);
902 memcpy(&u.info25.password.data[516], confounder, 16);
903
904 torture_comment(tctx, "Testing SetUserInfo level 25 (set password ex)\n");
905
906 torture_assert_ntstatus_ok(tctx, dcerpc_samr_SetUserInfo_r(b, tctx, &s),
907 "SetUserInfo failed");
908 if (!NT_STATUS_IS_OK(s.out.result)) {
909 torture_warning(tctx, "SetUserInfo level %u failed - %s\n",
910 s.in.level, nt_errstr(s.out.result));
911 ret = false;
912 } else {
913 *password = newpass;
914 }
915
916 /* This should break the key nicely */
917 confounded_session_key.data[0]++;
918
919 arcfour_crypt_blob(u.info25.password.data, 516, &confounded_session_key);
920 memcpy(&u.info25.password.data[516], confounder, 16);
921
922 torture_comment(tctx, "Testing SetUserInfo level 25 (set password ex) with wrong session key\n");
923
924 torture_assert_ntstatus_ok(tctx, dcerpc_samr_SetUserInfo_r(b, tctx, &s),
925 "SetUserInfo failed");
926 if (!NT_STATUS_EQUAL(s.out.result, NT_STATUS_WRONG_PASSWORD)) {
927 torture_warning(tctx, "SetUserInfo level %u should have failed with WRONG_PASSWORD- %s\n",
928 s.in.level, nt_errstr(s.out.result));
929 ret = false;
930 }
931
932 return ret;
933 }
934
935 static bool test_SetUserPass_18(struct dcerpc_pipe *p, struct torture_context *tctx,
936 struct policy_handle *handle, char **password)
937 {
938 NTSTATUS status;
939 struct samr_SetUserInfo s;
940 union samr_UserInfo u;
941 bool ret = true;
942 DATA_BLOB session_key;
943 char *newpass;
944 struct dcerpc_binding_handle *b = p->binding_handle;
945 struct samr_GetUserPwInfo pwp;
946 struct samr_PwInfo info;
947 int policy_min_pw_len = 0;
948 uint8_t lm_hash[16], nt_hash[16];
949
950 pwp.in.user_handle = handle;
951 pwp.out.info = &info;
952
953 torture_assert_ntstatus_ok(tctx, dcerpc_samr_GetUserPwInfo_r(b, tctx, &pwp),
954 "GetUserPwInfo failed");
955 if (NT_STATUS_IS_OK(pwp.out.result)) {
956 policy_min_pw_len = pwp.out.info->min_password_length;
957 }
958 newpass = samr_rand_pass(tctx, policy_min_pw_len);
959
960 s.in.user_handle = handle;
961 s.in.info = &u;
962 s.in.level = 18;
963
964 ZERO_STRUCT(u);
965
966 u.info18.nt_pwd_active = true;
967 u.info18.lm_pwd_active = true;
968
969 E_md4hash(newpass, nt_hash);
970 E_deshash(newpass, lm_hash);
971
972 status = dcerpc_fetch_session_key(p, &session_key);
973 if (!NT_STATUS_IS_OK(status)) {
974 torture_warning(tctx, "SetUserInfo level %u - no session key - %s\n",
975 s.in.level, nt_errstr(status));
976 return false;
977 }
978
979 {
980 DATA_BLOB in,out;
981 in = data_blob_const(nt_hash, 16);
982 out = data_blob_talloc_zero(tctx, 16);
983 sess_crypt_blob(&out, &in, &session_key, true);
984 memcpy(u.info18.nt_pwd.hash, out.data, out.length);
985 }
986 {
987 DATA_BLOB in,out;
988 in = data_blob_const(lm_hash, 16);
989 out = data_blob_talloc_zero(tctx, 16);
990 sess_crypt_blob(&out, &in, &session_key, true);
991 memcpy(u.info18.lm_pwd.hash, out.data, out.length);
992 }
993
994 torture_comment(tctx, "Testing SetUserInfo level 18 (set password hash)\n");
995
996 torture_assert_ntstatus_ok(tctx, dcerpc_samr_SetUserInfo_r(b, tctx, &s),
997 "SetUserInfo failed");
998 if (!NT_STATUS_IS_OK(s.out.result)) {
999 torture_warning(tctx, "SetUserInfo level %u failed - %s\n",
1000 s.in.level, nt_errstr(s.out.result));
1001 ret = false;
1002 } else {
1003 *password = newpass;
1004 }
1005
1006 return ret;
1007 }
1008
1009 static bool test_SetUserPass_21(struct dcerpc_pipe *p, struct torture_context *tctx,
1010 struct policy_handle *handle, uint32_t fields_present,
1011 char **password)
1012 {
1013 NTSTATUS status;
1014 struct samr_SetUserInfo s;
1015 union samr_UserInfo u;
1016 bool ret = true;
1017 DATA_BLOB session_key;
1018 char *newpass;
1019 struct dcerpc_binding_handle *b = p->binding_handle;
1020 struct samr_GetUserPwInfo pwp;
1021 struct samr_PwInfo info;
1022 int policy_min_pw_len = 0;
1023 uint8_t lm_hash[16], nt_hash[16];
1024
1025 pwp.in.user_handle = handle;
1026 pwp.out.info = &info;
1027
1028 torture_assert_ntstatus_ok(tctx, dcerpc_samr_GetUserPwInfo_r(b, tctx, &pwp),
1029 "GetUserPwInfo failed");
1030 if (NT_STATUS_IS_OK(pwp.out.result)) {
1031 policy_min_pw_len = pwp.out.info->min_password_length;
1032 }
1033 newpass = samr_rand_pass(tctx, policy_min_pw_len);
1034
1035 s.in.user_handle = handle;
1036 s.in.info = &u;
1037 s.in.level = 21;
1038
1039 E_md4hash(newpass, nt_hash);
1040 E_deshash(newpass, lm_hash);
1041
1042 ZERO_STRUCT(u);
1043
1044 u.info21.fields_present = fields_present;
1045
1046 if (fields_present & SAMR_FIELD_LM_PASSWORD_PRESENT) {
1047 u.info21.lm_owf_password.length = 16;
1048 u.info21.lm_owf_password.size = 16;
1049 u.info21.lm_owf_password.array = (uint16_t *)lm_hash;
1050 u.info21.lm_password_set = true;
1051 }
1052
1053 if (fields_present & SAMR_FIELD_NT_PASSWORD_PRESENT) {
1054 u.info21.nt_owf_password.length = 16;
1055 u.info21.nt_owf_password.size = 16;
1056 u.info21.nt_owf_password.array = (uint16_t *)nt_hash;
1057 u.info21.nt_password_set = true;
1058 }
1059
1060 status = dcerpc_fetch_session_key(p, &session_key);
1061 if (!NT_STATUS_IS_OK(status)) {
1062 torture_warning(tctx, "SetUserInfo level %u - no session key - %s\n",
1063 s.in.level, nt_errstr(status));
1064 return false;
1065 }
1066
1067 if (fields_present & SAMR_FIELD_LM_PASSWORD_PRESENT) {
1068 DATA_BLOB in,out;
1069 in = data_blob_const(u.info21.lm_owf_password.array,
1070 u.info21.lm_owf_password.length);
1071 out = data_blob_talloc_zero(tctx, 16);
1072 sess_crypt_blob(&out, &in, &session_key, true);
1073 u.info21.lm_owf_password.array = (uint16_t *)out.data;
1074 }
1075
1076 if (fields_present & SAMR_FIELD_NT_PASSWORD_PRESENT) {
1077 DATA_BLOB in,out;
1078 in = data_blob_const(u.info21.nt_owf_password.array,
1079 u.info21.nt_owf_password.length);
1080 out = data_blob_talloc_zero(tctx, 16);
1081 sess_crypt_blob(&out, &in, &session_key, true);
1082 u.info21.nt_owf_password.array = (uint16_t *)out.data;
1083 }
1084
1085 torture_comment(tctx, "Testing SetUserInfo level 21 (set password hash)\n");
1086
1087 torture_assert_ntstatus_ok(tctx, dcerpc_samr_SetUserInfo_r(b, tctx, &s),
1088 "SetUserInfo failed");
1089 if (!NT_STATUS_IS_OK(s.out.result)) {
1090 torture_warning(tctx, "SetUserInfo level %u failed - %s\n",
1091 s.in.level, nt_errstr(s.out.result));
1092 ret = false;
1093 } else {
1094 *password = newpass;
1095 }
1096
1097 /* try invalid length */
1098 if (fields_present & SAMR_FIELD_NT_PASSWORD_PRESENT) {
1099
1100 u.info21.nt_owf_password.length++;
1101
1102 torture_assert_ntstatus_ok(tctx, dcerpc_samr_SetUserInfo_r(b, tctx, &s),
1103 "SetUserInfo failed");
1104 if (!NT_STATUS_EQUAL(s.out.result, NT_STATUS_INVALID_PARAMETER)) {
1105 torture_warning(tctx, "SetUserInfo level %u should have failed with NT_STATUS_INVALID_PARAMETER - %s\n",
1106 s.in.level, nt_errstr(s.out.result));
1107 ret = false;
1108 }
1109 }
1110
1111 if (fields_present & SAMR_FIELD_LM_PASSWORD_PRESENT) {
1112
1113 u.info21.lm_owf_password.length++;
1114
1115 torture_assert_ntstatus_ok(tctx, dcerpc_samr_SetUserInfo_r(b, tctx, &s),
1116 "SetUserInfo failed");
1117 if (!NT_STATUS_EQUAL(s.out.result, NT_STATUS_INVALID_PARAMETER)) {
1118 torture_warning(tctx, "SetUserInfo level %u should have failed with NT_STATUS_INVALID_PARAMETER - %s\n",
1119 s.in.level, nt_errstr(s.out.result));
1120 ret = false;
1121 }
1122 }
1123
1124 return ret;
1125 }
1126
1127 static bool test_SetUserPass_level_ex(struct dcerpc_pipe *p,
1128 struct torture_context *tctx,
1129 struct policy_handle *handle,
1130 uint16_t level,
1131 uint32_t fields_present,
1132 char **password, uint8_t password_expired,
1133 bool use_setinfo2,
1134 bool *matched_expected_error)
1135 {
1136 NTSTATUS status;
1137 NTSTATUS expected_error = NT_STATUS_OK;
1138 struct samr_SetUserInfo s;
1139 struct samr_SetUserInfo2 s2;
1140 union samr_UserInfo u;
1141 bool ret = true;
1142 DATA_BLOB session_key;
1143 DATA_BLOB confounded_session_key = data_blob_talloc(tctx, NULL, 16);
1144 struct MD5Context ctx;
1145 uint8_t confounder[16];
1146 char *newpass;
1147 struct dcerpc_binding_handle *b = p->binding_handle;
1148 struct samr_GetUserPwInfo pwp;
1149 struct samr_PwInfo info;
1150 int policy_min_pw_len = 0;
1151 const char *comment = NULL;
1152 uint8_t lm_hash[16], nt_hash[16];
1153
1154 pwp.in.user_handle = handle;
1155 pwp.out.info = &info;
1156
1157 torture_assert_ntstatus_ok(tctx, dcerpc_samr_GetUserPwInfo_r(b, tctx, &pwp),
1158 "GetUserPwInfo failed");
1159 if (NT_STATUS_IS_OK(pwp.out.result)) {
1160 policy_min_pw_len = pwp.out.info->min_password_length;
1161 }
1162 newpass = samr_rand_pass_silent(tctx, policy_min_pw_len);
1163
1164 if (use_setinfo2) {
1165 s2.in.user_handle = handle;
1166 s2.in.info = &u;
1167 s2.in.level = level;
1168 } else {
1169 s.in.user_handle = handle;
1170 s.in.info = &u;
1171 s.in.level = level;
1172 }
1173
1174 if (fields_present & SAMR_FIELD_COMMENT) {
1175 comment = talloc_asprintf(tctx, "comment: %ld\n", (long int) time(NULL));
1176 }
1177
1178 ZERO_STRUCT(u);
1179
1180 switch (level) {
1181 case 18:
1182 E_md4hash(newpass, nt_hash);
1183 E_deshash(newpass, lm_hash);
1184
1185 u.info18.nt_pwd_active = true;
1186 u.info18.lm_pwd_active = true;
1187 u.info18.password_expired = password_expired;
1188
1189 memcpy(u.info18.lm_pwd.hash, lm_hash, 16);
1190 memcpy(u.info18.nt_pwd.hash, nt_hash, 16);
1191
1192 break;
1193 case 21:
1194 E_md4hash(newpass, nt_hash);
1195 E_deshash(newpass, lm_hash);
1196
1197 u.info21.fields_present = fields_present;
1198 u.info21.password_expired = password_expired;
1199 u.info21.comment.string = comment;
1200
1201 if (fields_present & SAMR_FIELD_LM_PASSWORD_PRESENT) {
1202 u.info21.lm_owf_password.length = 16;
1203 u.info21.lm_owf_password.size = 16;
1204 u.info21.lm_owf_password.array = (uint16_t *)lm_hash;
1205 u.info21.lm_password_set = true;
1206 }
1207
1208 if (fields_present & SAMR_FIELD_NT_PASSWORD_PRESENT) {
1209 u.info21.nt_owf_password.length = 16;
1210 u.info21.nt_owf_password.size = 16;
1211 u.info21.nt_owf_password.array = (uint16_t *)nt_hash;
1212 u.info21.nt_password_set = true;
1213 }
1214
1215 break;
1216 case 23:
1217 u.info23.info.fields_present = fields_present;
1218 u.info23.info.password_expired = password_expired;
1219 u.info23.info.comment.string = comment;
1220
1221 encode_pw_buffer(u.info23.password.data, newpass, STR_UNICODE);
1222
1223 break;
1224 case 24:
1225 u.info24.password_expired = password_expired;
1226
1227 encode_pw_buffer(u.info24.password.data, newpass, STR_UNICODE);
1228
1229 break;
1230 case 25:
1231 u.info25.info.fields_present = fields_present;
1232 u.info25.info.password_expired = password_expired;
1233 u.info25.info.comment.string = comment;
1234
1235 encode_pw_buffer(u.info25.password.data, newpass, STR_UNICODE);
1236
1237 break;
1238 case 26:
1239 u.info26.password_expired = password_expired;
1240
1241 encode_pw_buffer(u.info26.password.data, newpass, STR_UNICODE);
1242
1243 break;
1244 }
1245
1246 status = dcerpc_fetch_session_key(p, &session_key);
1247 if (!NT_STATUS_IS_OK(status)) {
1248 torture_warning(tctx, "SetUserInfo level %u - no session key - %s\n",
1249 s.in.level, nt_errstr(status));
1250 return false;
1251 }
1252
1253 generate_random_buffer((uint8_t *)confounder, 16);
1254
1255 MD5Init(&ctx);
1256 MD5Update(&ctx, confounder, 16);
1257 MD5Update(&ctx, session_key.data, session_key.length);
1258 MD5Final(confounded_session_key.data, &ctx);
1259
1260 switch (level) {
1261 case 18:
1262 {
1263 DATA_BLOB in,out;
1264 in = data_blob_const(u.info18.nt_pwd.hash, 16);
1265 out = data_blob_talloc_zero(tctx, 16);
1266 sess_crypt_blob(&out, &in, &session_key, true);
1267 memcpy(u.info18.nt_pwd.hash, out.data, out.length);
1268 }
1269 {
1270 DATA_BLOB in,out;
1271 in = data_blob_const(u.info18.lm_pwd.hash, 16);
1272 out = data_blob_talloc_zero(tctx, 16);
1273 sess_crypt_blob(&out, &in, &session_key, true);
1274 memcpy(u.info18.lm_pwd.hash, out.data, out.length);
1275 }
1276
1277 break;
1278 case 21:
1279 if (fields_present & SAMR_FIELD_LM_PASSWORD_PRESENT) {
1280 DATA_BLOB in,out;
1281 in = data_blob_const(u.info21.lm_owf_password.array,
1282 u.info21.lm_owf_password.length);
1283 out = data_blob_talloc_zero(tctx, 16);
1284 sess_crypt_blob(&out, &in, &session_key, true);
1285 u.info21.lm_owf_password.array = (uint16_t *)out.data;
1286 }
1287 if (fields_present & SAMR_FIELD_NT_PASSWORD_PRESENT) {
1288 DATA_BLOB in,out;
1289 in = data_blob_const(u.info21.nt_owf_password.array,
1290 u.info21.nt_owf_password.length);
1291 out = data_blob_talloc_zero(tctx, 16);
1292 sess_crypt_blob(&out, &in, &session_key, true);
1293 u.info21.nt_owf_password.array = (uint16_t *)out.data;
1294 }
1295 break;
1296 case 23:
1297 arcfour_crypt_blob(u.info23.password.data, 516, &session_key);
1298 break;
1299 case 24:
1300 arcfour_crypt_blob(u.info24.password.data, 516, &session_key);
1301 break;
1302 case 25:
1303 arcfour_crypt_blob(u.info25.password.data, 516, &confounded_session_key);
1304 memcpy(&u.info25.password.data[516], confounder, 16);
1305 break;
1306 case 26:
1307 arcfour_crypt_blob(u.info26.password.data, 516, &confounded_session_key);
1308 memcpy(&u.info26.password.data[516], confounder, 16);
1309 break;
1310 }
1311
1312 if (use_setinfo2) {
1313 torture_assert_ntstatus_ok(tctx, dcerpc_samr_SetUserInfo2_r(b, tctx, &s2),
1314 "SetUserInfo2 failed");
1315 status = s2.out.result;
1316 } else {
1317 torture_assert_ntstatus_ok(tctx, dcerpc_samr_SetUserInfo_r(b, tctx, &s),
1318 "SetUserInfo failed");
1319 status = s.out.result;
1320 }
1321
1322 if (!NT_STATUS_IS_OK(status)) {
1323 if (fields_present == 0) {
1324 expected_error = NT_STATUS_INVALID_PARAMETER;
1325 }
1326 if (fields_present & SAMR_FIELD_LAST_PWD_CHANGE) {
1327 expected_error = NT_STATUS_ACCESS_DENIED;
1328 }
1329 }
1330
1331 if (!NT_STATUS_IS_OK(expected_error)) {
1332 if (use_setinfo2) {
1333 torture_assert_ntstatus_equal(tctx,
1334 s2.out.result,
1335 expected_error, "SetUserInfo2 failed");
1336 } else {
1337 torture_assert_ntstatus_equal(tctx,
1338 s.out.result,
1339 expected_error, "SetUserInfo failed");
1340 }
1341 *matched_expected_error = true;
1342 return true;
1343 }
1344
1345 if (!NT_STATUS_IS_OK(status)) {
1346 torture_warning(tctx, "SetUserInfo%s level %u failed - %s\n",
1347 use_setinfo2 ? "2":"", level, nt_errstr(status));
1348 ret = false;
1349 } else {
1350 *password = newpass;
1351 }
1352
1353 return ret;
1354 }
1355
1356 static bool test_SetAliasInfo(struct dcerpc_binding_handle *b,
1357 struct torture_context *tctx,
1358 struct policy_handle *handle)
1359 {
1360 struct samr_SetAliasInfo r;
1361 struct samr_QueryAliasInfo q;
1362 union samr_AliasInfo *info;
1363 uint16_t levels[] = {2, 3};
1364 int i;
1365 bool ret = true;
1366
1367 /* Ignoring switch level 1, as that includes the number of members for the alias
1368 * and setting this to a wrong value might have negative consequences
1369 */
1370
1371 for (i=0;i<ARRAY_SIZE(levels);i++) {
1372 torture_comment(tctx, "Testing SetAliasInfo level %u\n", levels[i]);
1373
1374 r.in.alias_handle = handle;
1375 r.in.level = levels[i];
1376 r.in.info = talloc(tctx, union samr_AliasInfo);
1377 switch (r.in.level) {
1378 case ALIASINFONAME: init_lsa_String(&r.in.info->name,TEST_ALIASNAME); break;
1379 case ALIASINFODESCRIPTION: init_lsa_String(&r.in.info->description,
1380 "Test Description, should test I18N as well"); break;
1381 case ALIASINFOALL: torture_comment(tctx, "ALIASINFOALL ignored\n"); break;
1382 }
1383
1384 torture_assert_ntstatus_ok(tctx, dcerpc_samr_SetAliasInfo_r(b, tctx, &r),
1385 "SetAliasInfo failed");
1386 if (!NT_STATUS_IS_OK(r.out.result)) {
1387 torture_warning(tctx, "SetAliasInfo level %u failed - %s\n",
1388 levels[i], nt_errstr(r.out.result));
1389 ret = false;
1390 }
1391
1392 q.in.alias_handle = handle;
1393 q.in.level = levels[i];
1394 q.out.info = &info;
1395
1396 torture_assert_ntstatus_ok(tctx, dcerpc_samr_QueryAliasInfo_r(b, tctx, &q),
1397 "QueryAliasInfo failed");
1398 if (!NT_STATUS_IS_OK(q.out.result)) {
1399 torture_warning(tctx, "QueryAliasInfo level %u failed - %s\n",
1400 levels[i], nt_errstr(q.out.result));
1401 ret = false;
1402 }
1403 }
1404
1405 return ret;
1406 }
1407
1408 static bool test_GetGroupsForUser(struct dcerpc_binding_handle *b,
1409 struct torture_context *tctx,
1410 struct policy_handle *user_handle)
1411 {
1412 struct samr_GetGroupsForUser r;
1413 struct samr_RidWithAttributeArray *rids = NULL;
1414
1415 torture_comment(tctx, "Testing GetGroupsForUser\n");
1416
1417 r.in.user_handle = user_handle;
1418 r.out.rids = &rids;
1419
1420 torture_assert_ntstatus_ok(tctx, dcerpc_samr_GetGroupsForUser_r(b, tctx, &r),
1421 "GetGroupsForUser failed");
1422 torture_assert_ntstatus_ok(tctx, r.out.result, "GetGroupsForUser failed");
1423
1424 return true;
1425
1426 }
1427
1428 static bool test_GetDomPwInfo(struct dcerpc_pipe *p, struct torture_context *tctx,
1429 struct lsa_String *domain_name)
1430 {
1431 struct samr_GetDomPwInfo r;
1432 struct samr_PwInfo info;
1433 struct dcerpc_binding_handle *b = p->binding_handle;
1434
1435 r.in.domain_name = domain_name;
1436 r.out.info = &info;
1437
1438 torture_comment(tctx, "Testing GetDomPwInfo with name %s\n", r.in.domain_name->string);
1439
1440 torture_assert_ntstatus_ok(tctx, dcerpc_samr_GetDomPwInfo_r(b, tctx, &r),
1441 "GetDomPwInfo failed");
1442 torture_assert_ntstatus_ok(tctx, r.out.result, "GetDomPwInfo failed");
1443
1444 r.in.domain_name->string = talloc_asprintf(tctx, "\\\\%s", dcerpc_server_name(p));
1445 torture_comment(tctx, "Testing GetDomPwInfo with name %s\n", r.in.domain_name->string);
1446
1447 torture_assert_ntstatus_ok(tctx, dcerpc_samr_GetDomPwInfo_r(b, tctx, &r),
1448 "GetDomPwInfo failed");
1449 torture_assert_ntstatus_ok(tctx, r.out.result, "GetDomPwInfo failed");
1450
1451 r.in.domain_name->string = "\\\\__NONAME__";
1452 torture_comment(tctx, "Testing GetDomPwInfo with name %s\n", r.in.domain_name->string);
1453
1454 torture_assert_ntstatus_ok(tctx, dcerpc_samr_GetDomPwInfo_r(b, tctx, &r),
1455 "GetDomPwInfo failed");
1456 torture_assert_ntstatus_ok(tctx, r.out.result, "GetDomPwInfo failed");
1457
1458 r.in.domain_name->string = "\\\\Builtin";
1459 torture_comment(tctx, "Testing GetDomPwInfo with name %s\n", r.in.domain_name->string);
1460
1461 torture_assert_ntstatus_ok(tctx, dcerpc_samr_GetDomPwInfo_r(b, tctx, &r),
1462 "GetDomPwInfo failed");
1463 torture_assert_ntstatus_ok(tctx, r.out.result, "GetDomPwInfo failed");
1464
1465 return true;
1466 }
1467
1468 static bool test_GetUserPwInfo(struct dcerpc_binding_handle *b,
1469 struct torture_context *tctx,
1470 struct policy_handle *handle)
1471 {
1472 struct samr_GetUserPwInfo r;
1473 struct samr_PwInfo info;
1474
1475 torture_comment(tctx, "Testing GetUserPwInfo\n");
1476
1477 r.in.user_handle = handle;
1478 r.out.info = &info;
1479
1480 torture_assert_ntstatus_ok(tctx, dcerpc_samr_GetUserPwInfo_r(b, tctx, &r),
1481 "GetUserPwInfo failed");
1482 torture_assert_ntstatus_ok(tctx, r.out.result, "GetUserPwInfo");
1483
1484 return true;
1485 }
1486
1487 static NTSTATUS test_LookupName(struct dcerpc_binding_handle *b,
1488 struct torture_context *tctx,
1489 struct policy_handle *domain_handle, const char *name,
1490 uint32_t *rid)
1491 {
1492 NTSTATUS status;
1493 struct samr_LookupNames n;
1494 struct lsa_String sname[2];
1495 struct samr_Ids rids, types;
1496
1497 init_lsa_String(&sname[0], name);
1498
1499 n.in.domain_handle = domain_handle;
1500 n.in.num_names = 1;
1501 n.in.names = sname;
1502 n.out.rids = &rids;
1503 n.out.types = &types;
1504 status = dcerpc_samr_LookupNames_r(b, tctx, &n);
1505 if (!NT_STATUS_IS_OK(status)) {
1506 return status;
1507 }
1508 if (NT_STATUS_IS_OK(n.out.result)) {
1509 *rid = n.out.rids->ids[0];
1510 } else {
1511 return n.out.result;
1512 }
1513
1514 init_lsa_String(&sname[1], "xxNONAMExx");
1515 n.in.num_names = 2;
1516 status = dcerpc_samr_LookupNames_r(b, tctx, &n);
1517 if (!NT_STATUS_IS_OK(status)) {
1518 return status;
1519 }
1520 if (!NT_STATUS_EQUAL(n.out.result, STATUS_SOME_UNMAPPED)) {
1521 torture_warning(tctx, "LookupNames[2] failed - %s\n", nt_errstr(n.out.result));
1522 if (NT_STATUS_IS_OK(n.out.result)) {
1523 return NT_STATUS_UNSUCCESSFUL;
1524 }
1525 return n.out.result;
1526 }
1527
1528 n.in.num_names = 0;
1529 status = dcerpc_samr_LookupNames_r(b, tctx, &n);
1530 if (!NT_STATUS_IS_OK(status)) {
1531 return status;
1532 }
1533 if (!NT_STATUS_IS_OK(n.out.result)) {
1534 torture_warning(tctx, "LookupNames[0] failed - %s\n", nt_errstr(status));
1535 return n.out.result;
1536 }
1537
1538 init_lsa_String(&sname[0], "xxNONAMExx");
1539 n.in.num_names = 1;
1540 status = dcerpc_samr_LookupNames_r(b, tctx, &n);
1541 if (!NT_STATUS_IS_OK(status)) {
1542 return status;
1543 }
1544 if (!NT_STATUS_EQUAL(n.out.result, NT_STATUS_NONE_MAPPED)) {
1545 torture_warning(tctx, "LookupNames[1 bad name] failed - %s\n", nt_errstr(n.out.result));
1546 if (NT_STATUS_IS_OK(n.out.result)) {
1547 return NT_STATUS_UNSUCCESSFUL;
1548 }
1549 return n.out.result;
1550 }
1551
1552 init_lsa_String(&sname[0], "xxNONAMExx");
1553 init_lsa_String(&sname[1], "xxNONAME2xx");
1554 n.in.num_names = 2;
1555 status = dcerpc_samr_LookupNames_r(b, tctx, &n);
1556 if (!NT_STATUS_IS_OK(status)) {
1557 return status;
1558 }
1559 if (!NT_STATUS_EQUAL(n.out.result, NT_STATUS_NONE_MAPPED)) {
1560 torture_warning(tctx, "LookupNames[2 bad names] failed - %s\n", nt_errstr(n.out.result));
1561 if (NT_STATUS_IS_OK(n.out.result)) {
1562 return NT_STATUS_UNSUCCESSFUL;
1563 }
1564 return n.out.result;
1565 }
1566
1567 return NT_STATUS_OK;
1568 }
1569
1570 static NTSTATUS test_OpenUser_byname(struct dcerpc_binding_handle *b,
1571 struct torture_context *tctx,
1572 struct policy_handle *domain_handle,
1573 const char *name, struct policy_handle *user_handle)
1574 {
1575 NTSTATUS status;
1576 struct samr_OpenUser r;
1577 uint32_t rid;
1578
1579 status = test_LookupName(b, tctx, domain_handle, name, &rid);
1580 if (!NT_STATUS_IS_OK(status)) {
1581 return status;
1582 }
1583
1584 r.in.domain_handle = domain_handle;
1585 r.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
1586 r.in.rid = rid;
1587 r.out.user_handle = user_handle;
1588 status = dcerpc_samr_OpenUser_r(b, tctx, &r);
1589 if (!NT_STATUS_IS_OK(status)) {
1590 return status;
1591 }
1592 if (!NT_STATUS_IS_OK(r.out.result)) {
1593 torture_warning(tctx, "OpenUser_byname(%s -> %d) failed - %s\n", name, rid, nt_errstr(r.out.result));
1594 }
1595
1596 return r.out.result;
1597 }
1598
1599 #if 0
1600 static bool test_ChangePasswordNT3(struct dcerpc_pipe *p,
1601 struct torture_context *tctx,
1602 struct policy_handle *handle)
1603 {
1604 NTSTATUS status;
1605 struct samr_ChangePasswordUser r;
1606 bool ret = true;
1607 struct samr_Password hash1, hash2, hash3, hash4, hash5, hash6;
1608 struct policy_handle user_handle;
1609 char *oldpass = "test";
1610 char *newpass = "test2";
1611 uint8_t old_nt_hash[16], new_nt_hash[16];
1612 uint8_t old_lm_hash[16], new_lm_hash[16];
1613
1614 status = test_OpenUser_byname(p, tctx, handle, "testuser", &user_handle);
1615 if (!NT_STATUS_IS_OK(status)) {
1616 return false;
1617 }
1618
1619 torture_comment(tctx, "Testing ChangePasswordUser for user 'testuser'\n");
1620
1621 torture_comment(tctx, "old password: %s\n", oldpass);
1622 torture_comment(tctx, "new password: %s\n", newpass);
1623
1624 E_md4hash(oldpass, old_nt_hash);
1625 E_md4hash(newpass, new_nt_hash);
1626 E_deshash(oldpass, old_lm_hash);
1627 E_deshash(newpass, new_lm_hash);
1628
1629 E_old_pw_hash(new_lm_hash, old_lm_hash, hash1.hash);
1630 E_old_pw_hash(old_lm_hash, new_lm_hash, hash2.hash);
1631 E_old_pw_hash(new_nt_hash, old_nt_hash, hash3.hash);
1632 E_old_pw_hash(old_nt_hash, new_nt_hash, hash4.hash);
1633 E_old_pw_hash(old_lm_hash, new_nt_hash, hash5.hash);
1634 E_old_pw_hash(old_nt_hash, new_lm_hash, hash6.hash);
1635
1636 r.in.handle = &user_handle;
1637 r.in.lm_present = 1;
1638 r.in.old_lm_crypted = &hash1;
1639 r.in.new_lm_crypted = &hash2;
1640 r.in.nt_present = 1;
1641 r.in.old_nt_crypted = &hash3;
1642 r.in.new_nt_crypted = &hash4;
1643 r.in.cross1_present = 1;
1644 r.in.nt_cross = &hash5;
1645 r.in.cross2_present = 1;
1646 r.in.lm_cross = &hash6;
1647
1648 torture_assert_ntstatus_ok(tctx, dcerpc_samr_ChangePasswordUser_r(b, tctx, &r),
1649 "ChangePasswordUser failed");
1650 if (!NT_STATUS_IS_OK(r.out.result)) {
1651 torture_warning(tctx, "ChangePasswordUser failed - %s\n", nt_errstr(r.out.result));
1652 ret = false;
1653 }
1654
1655 if (!test_samr_handle_Close(p, tctx, &user_handle)) {
1656 ret = false;
1657 }
1658
1659 return ret;
1660 }
1661 #endif
1662
1663 static bool test_ChangePasswordUser(struct dcerpc_binding_handle *b,
1664 struct torture_context *tctx,
1665 const char *acct_name,
1666 struct policy_handle *handle, char **password)
1667 {
1668 NTSTATUS status;
1669 struct samr_ChangePasswordUser r;
1670 bool ret = true;
1671 struct samr_Password hash1, hash2, hash3, hash4, hash5, hash6;
1672 struct policy_handle user_handle;
1673 char *oldpass;
1674 uint8_t old_nt_hash[16], new_nt_hash[16];
1675 uint8_t old_lm_hash[16], new_lm_hash[16];
1676 bool changed = true;
1677
1678 char *newpass;
1679 struct samr_GetUserPwInfo pwp;
1680 struct samr_PwInfo info;
1681 int policy_min_pw_len = 0;
1682
1683 status = test_OpenUser_byname(b, tctx, handle, acct_name, &user_handle);
1684 if (!NT_STATUS_IS_OK(status)) {
1685 return false;
1686 }
1687 pwp.in.user_handle = &user_handle;
1688 pwp.out.info = &info;
1689
1690 torture_assert_ntstatus_ok(tctx, dcerpc_samr_GetUserPwInfo_r(b, tctx, &pwp),
1691 "GetUserPwInfo failed");
1692 if (NT_STATUS_IS_OK(pwp.out.result)) {
1693 policy_min_pw_len = pwp.out.info->min_password_length;
1694 }
1695 newpass = samr_rand_pass(tctx, policy_min_pw_len);
1696
1697 torture_comment(tctx, "Testing ChangePasswordUser\n");
1698
1699 torture_assert(tctx, *password != NULL,
1700 "Failing ChangePasswordUser as old password was NULL. Previous test failed?");
1701
1702 oldpass = *password;
1703
1704 E_md4hash(oldpass, old_nt_hash);
1705 E_md4hash(newpass, new_nt_hash);
1706 E_deshash(oldpass, old_lm_hash);
1707 E_deshash(newpass, new_lm_hash);
1708
1709 E_old_pw_hash(new_lm_hash, old_lm_hash, hash1.hash);
1710 E_old_pw_hash(old_lm_hash, new_lm_hash, hash2.hash);
1711 E_old_pw_hash(new_nt_hash, old_nt_hash, hash3.hash);
1712 E_old_pw_hash(old_nt_hash, new_nt_hash, hash4.hash);
1713 E_old_pw_hash(old_lm_hash, new_nt_hash, hash5.hash);
1714 E_old_pw_hash(old_nt_hash, new_lm_hash, hash6.hash);
1715
1716 r.in.user_handle = &user_handle;
1717 r.in.lm_present = 1;
1718 /* Break the LM hash */
1719 hash1.hash[0]++;
1720 r.in.old_lm_crypted = &hash1;
1721 r.in.new_lm_crypted = &hash2;
1722 r.in.nt_present = 1;
1723 r.in.old_nt_crypted = &hash3;
1724 r.in.new_nt_crypted = &hash4;
1725 r.in.cross1_present = 1;
1726 r.in.nt_cross = &hash5;
1727 r.in.cross2_present = 1;
1728 r.in.lm_cross = &hash6;
1729
1730 torture_assert_ntstatus_ok(tctx, dcerpc_samr_ChangePasswordUser_r(b, tctx, &r),
1731 "ChangePasswordUser failed");
1732 torture_assert_ntstatus_equal(tctx, r.out.result, NT_STATUS_WRONG_PASSWORD,
1733 "ChangePasswordUser failed: expected NT_STATUS_WRONG_PASSWORD because we broke the LM hash");
1734
1735 /* Unbreak the LM hash */
1736 hash1.hash[0]--;
1737
1738 r.in.user_handle = &user_handle;
1739 r.in.lm_present = 1;
1740 r.in.old_lm_crypted = &hash1;
1741 r.in.new_lm_crypted = &hash2;
1742 /* Break the NT hash */
1743 hash3.hash[0]--;
1744 r.in.nt_present = 1;
1745 r.in.old_nt_crypted = &hash3;
1746 r.in.new_nt_crypted = &hash4;
1747 r.in.cross1_present = 1;
1748 r.in.nt_cross = &hash5;
1749 r.in.cross2_present = 1;
1750 r.in.lm_cross = &hash6;
1751
1752 torture_assert_ntstatus_ok(tctx, dcerpc_samr_ChangePasswordUser_r(b, tctx, &r),
1753 "ChangePasswordUser failed");
1754 torture_assert_ntstatus_equal(tctx, r.out.result, NT_STATUS_WRONG_PASSWORD,
1755 "expected NT_STATUS_WRONG_PASSWORD because we broke the NT hash");
1756
1757 /* Unbreak the NT hash */
1758 hash3.hash[0]--;
1759
1760 r.in.user_handle = &user_handle;
1761 r.in.lm_present = 1;
1762 r.in.old_lm_crypted = &hash1;
1763 r.in.new_lm_crypted = &hash2;
1764 r.in.nt_present = 1;
1765 r.in.old_nt_crypted = &hash3;
1766 r.in.new_nt_crypted = &hash4;
1767 r.in.cross1_present = 1;
1768 r.in.nt_cross = &hash5;
1769 r.in.cross2_present = 1;
1770 /* Break the LM cross */
1771 hash6.hash[0]++;
1772 r.in.lm_cross = &hash6;
1773
1774 torture_assert_ntstatus_ok(tctx, dcerpc_samr_ChangePasswordUser_r(b, tctx, &r),
1775 "ChangePasswordUser failed");
1776 if (!NT_STATUS_EQUAL(r.out.result, NT_STATUS_WRONG_PASSWORD)) {
1777 torture_warning(tctx, "ChangePasswordUser failed: expected NT_STATUS_WRONG_PASSWORD because we broke the LM cross-hash, got %s\n", nt_errstr(r.out.result));
1778 ret = false;
1779 }
1780
1781 /* Unbreak the LM cross */
1782 hash6.hash[0]--;
1783
1784 r.in.user_handle = &user_handle;
1785 r.in.lm_present = 1;
1786 r.in.old_lm_crypted = &hash1;
1787 r.in.new_lm_crypted = &hash2;
1788 r.in.nt_present = 1;
1789 r.in.old_nt_crypted = &hash3;
1790 r.in.new_nt_crypted = &hash4;
1791 r.in.cross1_present = 1;
1792 /* Break the NT cross */
1793 hash5.hash[0]++;
1794 r.in.nt_cross = &hash5;
1795 r.in.cross2_present = 1;
1796 r.in.lm_cross = &hash6;
1797
1798 torture_assert_ntstatus_ok(tctx, dcerpc_samr_ChangePasswordUser_r(b, tctx, &r),
1799 "ChangePasswordUser failed");
1800 if (!NT_STATUS_EQUAL(r.out.result, NT_STATUS_WRONG_PASSWORD)) {
1801 torture_warning(tctx, "ChangePasswordUser failed: expected NT_STATUS_WRONG_PASSWORD because we broke the NT cross-hash, got %s\n", nt_errstr(r.out.result));
1802 ret = false;
1803 }
1804
1805 /* Unbreak the NT cross */
1806 hash5.hash[0]--;
1807
1808
1809 /* Reset the hashes to not broken values */
1810 E_old_pw_hash(new_lm_hash, old_lm_hash, hash1.hash);
1811 E_old_pw_hash(old_lm_hash, new_lm_hash, hash2.hash);
1812 E_old_pw_hash(new_nt_hash, old_nt_hash, hash3.hash);
1813 E_old_pw_hash(old_nt_hash, new_nt_hash, hash4.hash);
1814 E_old_pw_hash(old_lm_hash, new_nt_hash, hash5.hash);
1815 E_old_pw_hash(old_nt_hash, new_lm_hash, hash6.hash);
1816
1817 r.in.user_handle = &user_handle;
1818 r.in.lm_present = 1;
1819 r.in.old_lm_crypted = &hash1;
1820 r.in.new_lm_crypted = &hash2;
1821 r.in.nt_present = 1;
1822 r.in.old_nt_crypted = &hash3;
1823 r.in.new_nt_crypted = &hash4;
1824 r.in.cross1_present = 1;
1825 r.in.nt_cross = &hash5;
1826 r.in.cross2_present = 0;
1827 r.in.lm_cross = NULL;
1828
1829 torture_assert_ntstatus_ok(tctx, dcerpc_samr_ChangePasswordUser_r(b, tctx, &r),
1830 "ChangePasswordUser failed");
1831 if (NT_STATUS_IS_OK(r.out.result)) {
1832 changed = true;
1833 *password = newpass;
1834 } else if (!NT_STATUS_EQUAL(NT_STATUS_PASSWORD_RESTRICTION, r.out.result)) {
1835 torture_warning(tctx, "ChangePasswordUser failed: expected NT_STATUS_OK, or at least NT_STATUS_PASSWORD_RESTRICTION, got %s\n", nt_errstr(r.out.result));
1836 ret = false;
1837 }
1838
1839 oldpass = newpass;
1840 newpass = samr_rand_pass(tctx, policy_min_pw_len);
1841
1842 E_md4hash(oldpass, old_nt_hash);
1843 E_md4hash(newpass, new_nt_hash);
1844 E_deshash(oldpass, old_lm_hash);
1845 E_deshash(newpass, new_lm_hash);
1846
1847
1848 /* Reset the hashes to not broken values */
1849 E_old_pw_hash(new_lm_hash, old_lm_hash, hash1.hash);
1850 E_old_pw_hash(old_lm_hash, new_lm_hash, hash2.hash);
1851 E_old_pw_hash(new_nt_hash, old_nt_hash, hash3.hash);
1852 E_old_pw_hash(old_nt_hash, new_nt_hash, hash4.hash);
1853 E_old_pw_hash(old_lm_hash, new_nt_hash, hash5.hash);
1854 E_old_pw_hash(old_nt_hash, new_lm_hash, hash6.hash);
1855
1856 r.in.user_handle = &user_handle;
1857 r.in.lm_present = 1;
1858 r.in.old_lm_crypted = &hash1;
1859 r.in.new_lm_crypted = &hash2;
1860 r.in.nt_present = 1;
1861 r.in.old_nt_crypted = &hash3;
1862 r.in.new_nt_crypted = &hash4;
1863 r.in.cross1_present = 0;
1864 r.in.nt_cross = NULL;
1865 r.in.cross2_present = 1;
1866 r.in.lm_cross = &hash6;
1867
1868 torture_assert_ntstatus_ok(tctx, dcerpc_samr_ChangePasswordUser_r(b, tctx, &r),
1869 "ChangePasswordUser failed");
1870 if (NT_STATUS_IS_OK(r.out.result)) {
1871 changed = true;
1872 *password = newpass;
1873 } else if (!NT_STATUS_EQUAL(NT_STATUS_PASSWORD_RESTRICTION, r.out.result)) {
1874 torture_warning(tctx, "ChangePasswordUser failed: expected NT_STATUS_OK, or at least NT_STATUS_PASSWORD_RESTRICTION, got %s\n", nt_errstr(r.out.result));
1875 ret = false;
1876 }
1877
1878 oldpass = newpass;
1879 newpass = samr_rand_pass(tctx, policy_min_pw_len);
1880
1881 E_md4hash(oldpass, old_nt_hash);
1882 E_md4hash(newpass, new_nt_hash);
1883 E_deshash(oldpass, old_lm_hash);
1884 E_deshash(newpass, new_lm_hash);
1885
1886
1887 /* Reset the hashes to not broken values */
1888 E_old_pw_hash(new_lm_hash, old_lm_hash, hash1.hash);
1889 E_old_pw_hash(old_lm_hash, new_lm_hash, hash2.hash);
1890 E_old_pw_hash(new_nt_hash, old_nt_hash, hash3.hash);
1891 E_old_pw_hash(old_nt_hash, new_nt_hash, hash4.hash);
1892 E_old_pw_hash(old_lm_hash, new_nt_hash, hash5.hash);
1893 E_old_pw_hash(old_nt_hash, new_lm_hash, hash6.hash);
1894
1895 r.in.user_handle = &user_handle;
1896 r.in.lm_present = 1;
1897 r.in.old_lm_crypted = &hash1;
1898 r.in.new_lm_crypted = &hash2;
1899 r.in.nt_present = 1;
1900 r.in.old_nt_crypted = &hash3;
1901 r.in.new_nt_crypted = &hash4;
1902 r.in.cross1_present = 1;
1903 r.in.nt_cross = &hash5;
1904 r.in.cross2_present = 1;
1905 r.in.lm_cross = &hash6;
1906
1907 torture_assert_ntstatus_ok(tctx, dcerpc_samr_ChangePasswordUser_r(b, tctx, &r),
1908 "ChangePasswordUser failed");
1909 if (NT_STATUS_EQUAL(r.out.result, NT_STATUS_PASSWORD_RESTRICTION)) {
1910 torture_comment(tctx, "ChangePasswordUser returned: %s perhaps min password age? (not fatal)\n", nt_errstr(r.out.result));
1911 } else if (!NT_STATUS_IS_OK(r.out.result)) {
1912 torture_warning(tctx, "ChangePasswordUser failed - %s\n", nt_errstr(r.out.result));
1913 ret = false;
1914 } else {
1915 changed = true;
1916 *password = newpass;
1917 }
1918
1919 r.in.user_handle = &user_handle;
1920 r.in.lm_present = 1;
1921 r.in.old_lm_crypted = &hash1;
1922 r.in.new_lm_crypted = &hash2;
1923 r.in.nt_present = 1;
1924 r.in.old_nt_crypted = &hash3;
1925 r.in.new_nt_crypted = &hash4;
1926 r.in.cross1_present = 1;
1927 r.in.nt_cross = &hash5;
1928 r.in.cross2_present = 1;
1929 r.in.lm_cross = &hash6;
1930
1931 if (changed) {
1932 torture_assert_ntstatus_ok(tctx, dcerpc_samr_ChangePasswordUser_r(b, tctx, &r),
1933 "ChangePasswordUser failed");
1934 if (NT_STATUS_EQUAL(r.out.result, NT_STATUS_PASSWORD_RESTRICTION)) {
1935 torture_comment(tctx, "ChangePasswordUser returned: %s perhaps min password age? (not fatal)\n", nt_errstr(r.out.result));
1936 } else if (!NT_STATUS_EQUAL(r.out.result, NT_STATUS_WRONG_PASSWORD)) {
1937 torture_warning(tctx, "ChangePasswordUser failed: expected NT_STATUS_WRONG_PASSWORD because we already changed the password, got %s\n", nt_errstr(r.out.result));
1938 ret = false;
1939 }
1940 }
1941
1942
1943 if (!test_samr_handle_Close(b, tctx, &user_handle)) {
1944 ret = false;
1945 }
1946
1947 return ret;
1948 }
1949
1950
1951 static bool test_OemChangePasswordUser2(struct dcerpc_pipe *p,
1952 struct torture_context *tctx,
1953 const char *acct_name,
1954 struct policy_handle *handle, char **password)
1955 {
1956 struct samr_OemChangePasswordUser2 r;
1957 bool ret = true;
1958 struct samr_Password lm_verifier;
1959 struct samr_CryptPassword lm_pass;
1960 struct lsa_AsciiString server, account, account_bad;
1961 char *oldpass;
1962 char *newpass;
1963 struct dcerpc_binding_handle *b = p->binding_handle;
1964 uint8_t old_lm_hash[16], new_lm_hash[16];
1965
1966 struct samr_GetDomPwInfo dom_pw_info;
1967 struct samr_PwInfo info;
1968 int policy_min_pw_len = 0;
1969
1970 struct lsa_String domain_name;
1971
1972 domain_name.string = "";
1973 dom_pw_info.in.domain_name = &domain_name;
1974 dom_pw_info.out.info = &info;
1975
1976 torture_comment(tctx, "Testing OemChangePasswordUser2\n");
1977
1978 torture_assert(tctx, *password != NULL,
1979 "Failing OemChangePasswordUser2 as old password was NULL. Previous test failed?");
1980
1981 oldpass = *password;
1982
1983 torture_assert_ntstatus_ok(tctx, dcerpc_samr_GetDomPwInfo_r(b, tctx, &dom_pw_info),
1984 "GetDomPwInfo failed");
1985 if (NT_STATUS_IS_OK(dom_pw_info.out.result)) {
1986 policy_min_pw_len = dom_pw_info.out.info->min_password_length;
1987 }
1988
1989 newpass = samr_rand_pass(tctx, policy_min_pw_len);
1990
1991 server.string = talloc_asprintf(tctx, "\\\\%s", dcerpc_server_name(p));
1992 account.string = acct_name;
1993
1994 E_deshash(oldpass, old_lm_hash);
1995 E_deshash(newpass, new_lm_hash);
1996
1997 encode_pw_buffer(lm_pass.data, newpass, STR_ASCII);
1998 arcfour_crypt(lm_pass.data, old_lm_hash, 516);
1999 E_old_pw_hash(new_lm_hash, old_lm_hash, lm_verifier.hash);
2000
2001 r.in.server = &server;
2002 r.in.account = &account;
2003 r.in.password = &lm_pass;
2004 r.in.hash = &lm_verifier;
2005
2006 /* Break the verification */
2007 lm_verifier.hash[0]++;
2008
2009 torture_assert_ntstatus_ok(tctx, dcerpc_samr_OemChangePasswordUser2_r(b, tctx, &r),
2010 "OemChangePasswordUser2 failed");
2011
2012 if (!NT_STATUS_EQUAL(r.out.result, NT_STATUS_PASSWORD_RESTRICTION)
2013 && !NT_STATUS_EQUAL(r.out.result, NT_STATUS_WRONG_PASSWORD)) {
2014 torture_warning(tctx, "OemChangePasswordUser2 failed, should have returned WRONG_PASSWORD (or at least 'PASSWORD_RESTRICTON') for invalid password verifier - %s\n",
2015 nt_errstr(r.out.result));
2016 ret = false;
2017 }
2018
2019 encode_pw_buffer(lm_pass.data, newpass, STR_ASCII);
2020 /* Break the old password */
2021 old_lm_hash[0]++;
2022 arcfour_crypt(lm_pass.data, old_lm_hash, 516);
2023 /* unbreak it for the next operation */
2024 old_lm_hash[0]--;
2025 E_old_pw_hash(new_lm_hash, old_lm_hash, lm_verifier.hash);
2026
2027 r.in.server = &server;
2028 r.in.account = &account;
2029 r.in.password = &lm_pass;
2030 r.in.hash = &lm_verifier;
2031
2032 torture_assert_ntstatus_ok(tctx, dcerpc_samr_OemChangePasswordUser2_r(b, tctx, &r),
2033 "OemChangePasswordUser2 failed");
2034
2035 if (!NT_STATUS_EQUAL(r.out.result, NT_STATUS_PASSWORD_RESTRICTION)
2036 && !NT_STATUS_EQUAL(r.out.result, NT_STATUS_WRONG_PASSWORD)) {
2037 torture_warning(tctx, "OemChangePasswordUser2 failed, should have returned WRONG_PASSWORD (or at least 'PASSWORD_RESTRICTON') for invalidly encrpted password - %s\n",
2038 nt_errstr(r.out.result));
2039 ret = false;
2040 }
2041
2042 encode_pw_buffer(lm_pass.data, newpass, STR_ASCII);
2043 arcfour_crypt(lm_pass.data, old_lm_hash, 516);
2044
2045 r.in.server = &server;
2046 r.in.account = &account;
2047 r.in.password = &lm_pass;
2048 r.in.hash = NULL;
2049
2050 torture_assert_ntstatus_ok(tctx, dcerpc_samr_OemChangePasswordUser2_r(b, tctx, &r),
2051 "OemChangePasswordUser2 failed");
2052
2053 if (!NT_STATUS_EQUAL(r.out.result, NT_STATUS_PASSWORD_RESTRICTION)
2054 && !NT_STATUS_EQUAL(r.out.result, NT_STATUS_INVALID_PARAMETER)) {
2055 torture_warning(tctx, "OemChangePasswordUser2 failed, should have returned INVALID_PARAMETER (or at least 'PASSWORD_RESTRICTON') for no supplied validation hash - %s\n",
2056 nt_errstr(r.out.result));
2057 ret = false;
2058 }
2059
2060 /* This shouldn't be a valid name */
2061 account_bad.string = TEST_ACCOUNT_NAME "XX";
2062 r.in.account = &account_bad;
2063
2064 torture_assert_ntstatus_ok(tctx, dcerpc_samr_OemChangePasswordUser2_r(b, tctx, &r),
2065 "OemChangePasswordUser2 failed");
2066
2067 if (!NT_STATUS_EQUAL(r.out.result, NT_STATUS_INVALID_PARAMETER)) {
2068 torture_warning(tctx, "OemChangePasswordUser2 failed, should have returned INVALID_PARAMETER for no supplied validation hash and invalid user - %s\n",
2069 nt_errstr(r.out.result));
2070 ret = false;
2071 }
2072
2073 /* This shouldn't be a valid name */
2074 account_bad.string = TEST_ACCOUNT_NAME "XX";
2075 r.in.account = &account_bad;
2076 r.in.password = &lm_pass;
2077 r.in.hash = &lm_verifier;
2078
2079 torture_assert_ntstatus_ok(tctx, dcerpc_samr_OemChangePasswordUser2_r(b, tctx, &r),
2080 "OemChangePasswordUser2 failed");
2081
2082 if (!NT_STATUS_EQUAL(r.out.result, NT_STATUS_WRONG_PASSWORD)) {
2083 torture_warning(tctx, "OemChangePasswordUser2 failed, should have returned WRONG_PASSWORD for invalid user - %s\n",
2084 nt_errstr(r.out.result));
2085 ret = false;
2086 }
2087
2088 /* This shouldn't be a valid name */
2089 account_bad.string = TEST_ACCOUNT_NAME "XX";
2090 r.in.account = &account_bad;
2091 r.in.password = NULL;
2092 r.in.hash = &lm_verifier;
2093
2094 torture_assert_ntstatus_ok(tctx, dcerpc_samr_OemChangePasswordUser2_r(b, tctx, &r),
2095 "OemChangePasswordUser2 failed");
2096
2097 if (!NT_STATUS_EQUAL(r.out.result, NT_STATUS_INVALID_PARAMETER)) {
2098 torture_warning(tctx, "OemChangePasswordUser2 failed, should have returned INVALID_PARAMETER for no supplied password and invalid user - %s\n",
2099 nt_errstr(r.out.result));
2100 ret = false;
2101 }
2102
2103 E_deshash(oldpass, old_lm_hash);
2104 E_deshash(newpass, new_lm_hash);
2105
2106 encode_pw_buffer(lm_pass.data, newpass, STR_ASCII);
2107 arcfour_crypt(lm_pass.data, old_lm_hash, 516);
2108 E_old_pw_hash(new_lm_hash, old_lm_hash, lm_verifier.hash);
2109
2110 r.in.server = &server;
2111 r.in.account = &account;
2112 r.in.password = &lm_pass;
2113 r.in.hash = &lm_verifier;
2114
2115 torture_assert_ntstatus_ok(tctx, dcerpc_samr_OemChangePasswordUser2_r(b, tctx, &r),
2116 "OemChangePasswordUser2 failed");
2117
2118 if (NT_STATUS_EQUAL(r.out.result, NT_STATUS_PASSWORD_RESTRICTION)) {
2119 torture_comment(tctx, "OemChangePasswordUser2 returned: %s perhaps min password age? (not fatal)\n", nt_errstr(r.out.result));
2120 } else if (!NT_STATUS_IS_OK(r.out.result)) {
2121 torture_warning(tctx, "OemChangePasswordUser2 failed - %s\n", nt_errstr(r.out.result));
2122 ret = false;
2123 } else {
2124 *password = newpass;
2125 }
2126
2127 return ret;
2128 }
2129
2130
2131 static bool test_ChangePasswordUser2(struct dcerpc_pipe *p, struct torture_context *tctx,
2132 const char *acct_name,
2133 char **password,
2134 char *newpass, bool allow_password_restriction)
2135 {
2136 struct samr_ChangePasswordUser2 r;
2137 bool ret = true;
2138 struct lsa_String server, account;
2139 struct samr_CryptPassword nt_pass, lm_pass;
2140 struct samr_Password nt_verifier, lm_verifier;
2141 char *oldpass;
2142 struct dcerpc_binding_handle *b = p->binding_handle;
2143 uint8_t old_nt_hash[16], new_nt_hash[16];
2144 uint8_t old_lm_hash[16], new_lm_hash[16];
2145
2146 struct samr_GetDomPwInfo dom_pw_info;
2147 struct samr_PwInfo info;
2148
2149 struct lsa_String domain_name;
2150
2151 domain_name.string = "";
2152 dom_pw_info.in.domain_name = &domain_name;
2153 dom_pw_info.out.info = &info;
2154
2155 torture_comment(tctx, "Testing ChangePasswordUser2 on %s\n", acct_name);
2156
2157 torture_assert(tctx, *password != NULL,
2158 "Failing ChangePasswordUser2 as old password was NULL. Previous test failed?");
2159 oldpass = *password;
2160
2161 if (!newpass) {
2162 int policy_min_pw_len = 0;
2163 torture_assert_ntstatus_ok(tctx, dcerpc_samr_GetDomPwInfo_r(b, tctx, &dom_pw_info),
2164 "GetDomPwInfo failed");
2165 if (NT_STATUS_IS_OK(dom_pw_info.out.result)) {
2166 policy_min_pw_len = dom_pw_info.out.info->min_password_length;
2167 }
2168
2169 newpass = samr_rand_pass(tctx, policy_min_pw_len);
2170 }
2171
2172 server.string = talloc_asprintf(tctx, "\\\\%s", dcerpc_server_name(p));
2173 init_lsa_String(&account, acct_name);
2174
2175 E_md4hash(oldpass, old_nt_hash);
2176 E_md4hash(newpass, new_nt_hash);
2177
2178 E_deshash(oldpass, old_lm_hash);
2179 E_deshash(newpass, new_lm_hash);
2180
2181 encode_pw_buffer(lm_pass.data, newpass, STR_ASCII|STR_TERMINATE);
2182 arcfour_crypt(lm_pass.data, old_lm_hash, 516);
2183 E_old_pw_hash(new_nt_hash, old_lm_hash, lm_verifier.hash);
2184
2185 encode_pw_buffer(nt_pass.data, newpass, STR_UNICODE);
2186 arcfour_crypt(nt_pass.data, old_nt_hash, 516);
2187 E_old_pw_hash(new_nt_hash, old_nt_hash, nt_verifier.hash);
2188
2189 r.in.server = &server;
2190 r.in.account = &account;
2191 r.in.nt_password = &nt_pass;
2192 r.in.nt_verifier = &nt_verifier;
2193 r.in.lm_change = 1;
2194 r.in.lm_password = &lm_pass;
2195 r.in.lm_verifier = &lm_verifier;
2196
2197 torture_assert_ntstatus_ok(tctx, dcerpc_samr_ChangePasswordUser2_r(b, tctx, &r),
2198 "ChangePasswordUser2 failed");
2199
2200 if (allow_password_restriction && NT_STATUS_EQUAL(r.out.result, NT_STATUS_PASSWORD_RESTRICTION)) {
2201 torture_comment(tctx, "ChangePasswordUser2 returned: %s perhaps min password age? (not fatal)\n", nt_errstr(r.out.result));
2202 } else if (!NT_STATUS_IS_OK(r.out.result)) {
2203 torture_warning(tctx, "ChangePasswordUser2 failed - %s\n", nt_errstr(r.out.result));
2204 ret = false;
2205 } else {
2206 *password = newpass;
2207 }
2208
2209 return ret;
2210 }
2211
2212
2213 bool test_ChangePasswordUser3(struct dcerpc_pipe *p, struct torture_context *tctx,
2214 const char *account_string,
2215 int policy_min_pw_len,
2216 char **password,
2217 const char *newpass,
2218 NTTIME last_password_change,
2219 bool handle_reject_reason)
2220 {
2221 struct samr_ChangePasswordUser3 r;
2222 bool ret = true;
2223 struct lsa_String server, account, account_bad;
2224 struct samr_CryptPassword nt_pass, lm_pass;
2225 struct samr_Password nt_verifier, lm_verifier;
2226 char *oldpass;
2227 struct dcerpc_binding_handle *b = p->binding_handle;
2228 uint8_t old_nt_hash[16], new_nt_hash[16];
2229 uint8_t old_lm_hash[16], new_lm_hash[16];
2230 NTTIME t;
2231 struct samr_DomInfo1 *dominfo = NULL;
2232 struct userPwdChangeFailureInformation *reject = NULL;
2233
2234 torture_comment(tctx, "Testing ChangePasswordUser3\n");
2235
2236 if (newpass == NULL) {
2237 do {
2238 if (policy_min_pw_len == 0) {
2239 newpass = samr_rand_pass(tctx, policy_min_pw_len);
2240 } else {
2241 newpass = samr_rand_pass_fixed_len(tctx, policy_min_pw_len);
2242 }
2243 } while (check_password_quality(newpass) == false);
2244 } else {
2245 torture_comment(tctx, "Using password '%s'\n", newpass);
2246 }
2247
2248 torture_assert(tctx, *password != NULL,
2249 "Failing ChangePasswordUser3 as old password was NULL. Previous test failed?");
2250
2251 oldpass = *password;
2252 server.string = talloc_asprintf(tctx, "\\\\%s", dcerpc_server_name(p));
2253 init_lsa_String(&account, account_string);
2254
2255 E_md4hash(oldpass, old_nt_hash);
2256 E_md4hash(newpass, new_nt_hash);
2257
2258 E_deshash(oldpass, old_lm_hash);
2259 E_deshash(newpass, new_lm_hash);
2260
2261 encode_pw_buffer(lm_pass.data, newpass, STR_UNICODE);
2262 arcfour_crypt(lm_pass.data, old_nt_hash, 516);
2263 E_old_pw_hash(new_nt_hash, old_lm_hash, lm_verifier.hash);
2264
2265 encode_pw_buffer(nt_pass.data, newpass, STR_UNICODE);
2266 arcfour_crypt(nt_pass.data, old_nt_hash, 516);
2267 E_old_pw_hash(new_nt_hash, old_nt_hash, nt_verifier.hash);
2268
2269 /* Break the verification */
2270 nt_verifier.hash[0]++;
2271
2272 r.in.server = &server;
2273 r.in.account = &account;
2274 r.in.nt_password = &nt_pass;
2275 r.in.nt_verifier = &nt_verifier;
2276 r.in.lm_change = 1;
2277 r.in.lm_password = &lm_pass;
2278 r.in.lm_verifier = &lm_verifier;
2279 r.in.password3 = NULL;
2280 r.out.dominfo = &dominfo;
2281 r.out.reject = &reject;
2282
2283 torture_assert_ntstatus_ok(tctx, dcerpc_samr_ChangePasswordUser3_r(b, tctx, &r),
2284 "ChangePasswordUser3 failed");
2285 if (!NT_STATUS_EQUAL(r.out.result, NT_STATUS_PASSWORD_RESTRICTION) &&
2286 (!NT_STATUS_EQUAL(r.out.result, NT_STATUS_WRONG_PASSWORD))) {
2287 torture_warning(tctx, "ChangePasswordUser3 failed, should have returned WRONG_PASSWORD (or at least 'PASSWORD_RESTRICTON') for invalid password verifier - %s\n",
2288 nt_errstr(r.out.result));
2289 ret = false;
2290 }
2291
2292 encode_pw_buffer(lm_pass.data, newpass, STR_UNICODE);
2293 arcfour_crypt(lm_pass.data, old_nt_hash, 516);
2294 E_old_pw_hash(new_nt_hash, old_lm_hash, lm_verifier.hash);
2295
2296 encode_pw_buffer(nt_pass.data, newpass, STR_UNICODE);
2297 /* Break the NT hash */
2298 old_nt_hash[0]++;
2299 arcfour_crypt(nt_pass.data, old_nt_hash, 516);
2300 /* Unbreak it again */
2301 old_nt_hash[0]--;
2302 E_old_pw_hash(new_nt_hash, old_nt_hash, nt_verifier.hash);
2303
2304 r.in.server = &server;
2305 r.in.account = &account;
2306 r.in.nt_password = &nt_pass;
2307 r.in.nt_verifier = &nt_verifier;
2308 r.in.lm_change = 1;
2309 r.in.lm_password = &lm_pass;
2310 r.in.lm_verifier = &lm_verifier;
2311 r.in.password3 = NULL;
2312 r.out.dominfo = &dominfo;
2313 r.out.reject = &reject;
2314
2315 torture_assert_ntstatus_ok(tctx, dcerpc_samr_ChangePasswordUser3_r(b, tctx, &r),
2316 "ChangePasswordUser3 failed");
2317 if (!NT_STATUS_EQUAL(r.out.result, NT_STATUS_PASSWORD_RESTRICTION) &&
2318 (!NT_STATUS_EQUAL(r.out.result, NT_STATUS_WRONG_PASSWORD))) {
2319 torture_warning(tctx, "ChangePasswordUser3 failed, should have returned WRONG_PASSWORD (or at least 'PASSWORD_RESTRICTON') for invalidly encrpted password - %s\n",
2320 nt_errstr(r.out.result));
2321 ret = false;
2322 }
2323
2324 /* This shouldn't be a valid name */
2325 init_lsa_String(&account_bad, talloc_asprintf(tctx, "%sXX", account_string));
2326
2327 r.in.account = &account_bad;
2328 torture_assert_ntstatus_ok(tctx, dcerpc_samr_ChangePasswordUser3_r(b, tctx, &r),
2329 "ChangePasswordUser3 failed");
2330 if (!NT_STATUS_EQUAL(r.out.result, NT_STATUS_WRONG_PASSWORD)) {
2331 torture_warning(tctx, "ChangePasswordUser3 failed, should have returned WRONG_PASSWORD for invalid username - %s\n",
2332 nt_errstr(r.out.result));
2333 ret = false;
2334 }
2335
2336 E_md4hash(oldpass, old_nt_hash);
2337 E_md4hash(newpass, new_nt_hash);
2338
2339 E_deshash(oldpass, old_lm_hash);
2340 E_deshash(newpass, new_lm_hash);
2341
2342 encode_pw_buffer(lm_pass.data, newpass, STR_UNICODE);
2343 arcfour_crypt(lm_pass.data, old_nt_hash, 516);
2344 E_old_pw_hash(new_nt_hash, old_lm_hash, lm_verifier.hash);
2345
2346 encode_pw_buffer(nt_pass.data, newpass, STR_UNICODE);
2347 arcfour_crypt(nt_pass.data, old_nt_hash, 516);
2348 E_old_pw_hash(new_nt_hash, old_nt_hash, nt_verifier.hash);
2349
2350 r.in.server = &server;
2351 r.in.account = &account;
2352 r.in.nt_password = &nt_pass;
2353 r.in.nt_verifier = &nt_verifier;
2354 r.in.lm_change = 1;
2355 r.in.lm_password = &lm_pass;
2356 r.in.lm_verifier = &lm_verifier;
2357 r.in.password3 = NULL;
2358 r.out.dominfo = &dominfo;
2359 r.out.reject = &reject;
2360
2361 unix_to_nt_time(&t, time(NULL));
2362
2363 torture_assert_ntstatus_ok(tctx, dcerpc_samr_ChangePasswordUser3_r(b, tctx, &r),
2364 "ChangePasswordUser3 failed");
2365
2366 if (NT_STATUS_EQUAL(r.out.result, NT_STATUS_PASSWORD_RESTRICTION)
2367 && dominfo
2368 && reject
2369 && handle_reject_reason
2370 && (!null_nttime(last_password_change) || !dominfo->min_password_age)) {
2371 if (dominfo->password_properties & DOMAIN_REFUSE_PASSWORD_CHANGE ) {
2372
2373 if (reject && (reject->extendedFailureReason != SAM_PWD_CHANGE_NO_ERROR)) {
2374 torture_warning(tctx, "expected SAM_PWD_CHANGE_NO_ERROR (%d), got %d\n",
2375 SAM_PWD_CHANGE_NO_ERROR, reject->extendedFailureReason);
2376 return false;
2377 }
2378 }
2379
2380 /* We tested the order of precendence which is as follows:
2381
2382 * pwd min_age
2383 * pwd length
2384 * pwd complexity
2385 * pwd history
2386
2387 Guenther */
2388
2389 if ((dominfo->min_password_age > 0) && !null_nttime(last_password_change) &&
2390 (last_password_change + dominfo->min_password_age > t)) {
2391
2392 if (reject->extendedFailureReason != SAM_PWD_CHANGE_NO_ERROR) {
2393 torture_warning(tctx, "expected SAM_PWD_CHANGE_NO_ERROR (%d), got %d\n",
2394 SAM_PWD_CHANGE_NO_ERROR, reject->extendedFailureReason);
2395 return false;
2396 }
2397
2398 } else if ((dominfo->min_password_length > 0) &&
2399 (strlen(newpass) < dominfo->min_password_length)) {
2400
2401 if (reject->extendedFailureReason != SAM_PWD_CHANGE_PASSWORD_TOO_SHORT) {
2402 torture_warning(tctx, "expected SAM_PWD_CHANGE_PASSWORD_TOO_SHORT (%d), got %d\n",
2403 SAM_PWD_CHANGE_PASSWORD_TOO_SHORT, reject->extendedFailureReason);
2404 return false;
2405 }
2406
2407 } else if ((dominfo->password_history_length > 0) &&
2408 strequal(oldpass, newpass)) {
2409
2410 if (reject->extendedFailureReason != SAM_PWD_CHANGE_PWD_IN_HISTORY) {
2411 torture_warning(tctx, "expected SAM_PWD_CHANGE_PWD_IN_HISTORY (%d), got %d\n",
2412 SAM_PWD_CHANGE_PWD_IN_HISTORY, reject->extendedFailureReason);
2413 return false;
2414 }
2415 } else if (dominfo->password_properties & DOMAIN_PASSWORD_COMPLEX) {
2416
2417 if (reject->extendedFailureReason != SAM_PWD_CHANGE_NOT_COMPLEX) {
2418 torture_warning(tctx, "expected SAM_PWD_CHANGE_NOT_COMPLEX (%d), got %d\n",
2419 SAM_PWD_CHANGE_NOT_COMPLEX, reject->extendedFailureReason);
2420 return false;
2421 }
2422
2423 }
2424
2425 if (reject->extendedFailureReason == SAM_PWD_CHANGE_PASSWORD_TOO_SHORT) {
2426 /* retry with adjusted size */
2427 return test_ChangePasswordUser3(p, tctx, account_string,
2428 dominfo->min_password_length,
2429 password, NULL, 0, false);
2430
2431 }
2432
2433 } else if (NT_STATUS_EQUAL(r.out.result, NT_STATUS_PASSWORD_RESTRICTION)) {
2434 if (reject && reject->extendedFailureReason != SAM_PWD_CHANGE_NO_ERROR) {
2435 torture_warning(tctx, "expected SAM_PWD_CHANGE_NO_ERROR (%d), got %d\n",
2436 SAM_PWD_CHANGE_NO_ERROR, reject->extendedFailureReason);
2437 return false;
2438 }
2439 /* Perhaps the server has a 'min password age' set? */
2440
2441 } else {
2442 torture_assert_ntstatus_ok(tctx, r.out.result, "ChangePasswordUser3");
2443
2444 *password = talloc_strdup(tctx, newpass);
2445 }
2446
2447 return ret;
2448 }
2449
2450 bool test_ChangePasswordRandomBytes(struct dcerpc_pipe *p, struct torture_context *tctx,
2451 const char *account_string,
2452 struct policy_handle *handle,
2453 char **password)
2454 {
2455 NTSTATUS status;
2456 struct samr_ChangePasswordUser3 r;
2457 struct samr_SetUserInfo s;
2458 union samr_UserInfo u;
2459 DATA_BLOB session_key;
2460 DATA_BLOB confounded_session_key = data_blob_talloc(tctx, NULL, 16);
2461 uint8_t confounder[16];
2462 struct MD5Context ctx;
2463
2464 bool ret = true;
2465 struct lsa_String server, account;
2466 struct samr_CryptPassword nt_pass;
2467 struct samr_Password nt_verifier;
2468 DATA_BLOB new_random_pass;
2469 char *newpass;
2470 char *oldpass;
2471 struct dcerpc_binding_handle *b = p->binding_handle;
2472 uint8_t old_nt_hash[16], new_nt_hash[16];
2473 NTTIME t;
2474 struct samr_DomInfo1 *dominfo = NULL;
2475 struct userPwdChangeFailureInformation *reject = NULL;
2476
2477 new_random_pass = samr_very_rand_pass(tctx, 128);
2478
2479 torture_assert(tctx, *password != NULL,
2480 "Failing ChangePasswordUser3 as old password was NULL. Previous test failed?");
2481
2482 oldpass = *password;
2483 server.string = talloc_asprintf(tctx, "\\\\%s", dcerpc_server_name(p));
2484 init_lsa_String(&account, account_string);
2485
2486 s.in.user_handle = handle;
2487 s.in.info = &u;
2488 s.in.level = 25;
2489
2490 ZERO_STRUCT(u);
2491
2492 u.info25.info.fields_present = SAMR_FIELD_NT_PASSWORD_PRESENT;
2493
2494 set_pw_in_buffer(u.info25.password.data, &new_random_pass);
2495
2496 status = dcerpc_fetch_session_key(p, &session_key);
2497 if (!NT_STATUS_IS_OK(status)) {
2498 torture_warning(tctx, "SetUserInfo level %u - no session key - %s\n",
2499 s.in.level, nt_errstr(status));
2500 return false;
2501 }
2502
2503 generate_random_buffer((uint8_t *)confounder, 16);
2504
2505 MD5Init(&ctx);
2506 MD5Update(&ctx, confounder, 16);
2507 MD5Update(&ctx, session_key.data, session_key.length);
2508 MD5Final(confounded_session_key.data, &ctx);
2509
2510 arcfour_crypt_blob(u.info25.password.data, 516, &confounded_session_key);
2511 memcpy(&u.info25.password.data[516], confounder, 16);
2512
2513 torture_comment(tctx, "Testing SetUserInfo level 25 (set password ex) with a password made up of only random bytes\n");
2514
2515 torture_assert_ntstatus_ok(tctx, dcerpc_samr_SetUserInfo_r(b, tctx, &s),
2516 "SetUserInfo failed");
2517 if (!NT_STATUS_IS_OK(s.out.result)) {
2518 torture_warning(tctx, "SetUserInfo level %u failed - %s\n",
2519 s.in.level, nt_errstr(s.out.result));
2520 ret = false;
2521 }
2522
2523 torture_comment(tctx, "Testing ChangePasswordUser3 with a password made up of only random bytes\n");
2524
2525 mdfour(old_nt_hash, new_random_pass.data, new_random_pass.length);
2526
2527 new_random_pass = samr_very_rand_pass(tctx, 128);
2528
2529 mdfour(new_nt_hash, new_random_pass.data, new_random_pass.length);
2530
2531 set_pw_in_buffer(nt_pass.data, &new_random_pass);
2532 arcfour_crypt(nt_pass.data, old_nt_hash, 516);
2533 E_old_pw_hash(new_nt_hash, old_nt_hash, nt_verifier.hash);
2534
2535 r.in.server = &server;
2536 r.in.account = &account;
2537 r.in.nt_password = &nt_pass;
2538 r.in.nt_verifier = &nt_verifier;
2539 r.in.lm_change = 0;
2540 r.in.lm_password = NULL;
2541 r.in.lm_verifier = NULL;
2542 r.in.password3 = NULL;
2543 r.out.dominfo = &dominfo;
2544 r.out.reject = &reject;
2545
2546 unix_to_nt_time(&t, time(NULL));
2547
2548 torture_assert_ntstatus_ok(tctx, dcerpc_samr_ChangePasswordUser3_r(b, tctx, &r),
2549 "ChangePasswordUser3 failed");
2550
2551 if (NT_STATUS_EQUAL(r.out.result, NT_STATUS_PASSWORD_RESTRICTION)) {
2552 if (reject && reject->extendedFailureReason != SAM_PWD_CHANGE_NO_ERROR) {
2553 torture_warning(tctx, "expected SAM_PWD_CHANGE_NO_ERROR (%d), got %d\n",
2554 SAM_PWD_CHANGE_NO_ERROR, reject->extendedFailureReason);
2555 return false;
2556 }
2557 /* Perhaps the server has a 'min password age' set? */
2558
2559 } else if (!NT_STATUS_IS_OK(r.out.result)) {
2560 torture_warning(tctx, "ChangePasswordUser3 failed - %s\n", nt_errstr(r.out.result));
2561 ret = false;
2562 }
2563
2564 newpass = samr_rand_pass(tctx, 128);
2565
2566 mdfour(old_nt_hash, new_random_pass.data, new_random_pass.length);
2567
2568 E_md4hash(newpass, new_nt_hash);
2569
2570 encode_pw_buffer(nt_pass.data, newpass, STR_UNICODE);
2571 arcfour_crypt(nt_pass.data, old_nt_hash, 516);
2572 E_old_pw_hash(new_nt_hash, old_nt_hash, nt_verifier.hash);
2573
2574 r.in.server = &server;
2575 r.in.account = &account;
2576 r.in.nt_password = &nt_pass;
2577 r.in.nt_verifier = &nt_verifier;
2578 r.in.lm_change = 0;
2579 r.in.lm_password = NULL;
2580 r.in.lm_verifier = NULL;
2581 r.in.password3 = NULL;
2582 r.out.dominfo = &dominfo;
2583 r.out.reject = &reject;
2584
2585 unix_to_nt_time(&t, time(NULL));
2586
2587 torture_assert_ntstatus_ok(tctx, dcerpc_samr_ChangePasswordUser3_r(b, tctx, &r),
2588 "ChangePasswordUser3 failed");
2589
2590 if (NT_STATUS_EQUAL(r.out.result, NT_STATUS_PASSWORD_RESTRICTION)) {
2591 if (reject && reject->extendedFailureReason != SAM_PWD_CHANGE_NO_ERROR) {
2592 torture_warning(tctx, "expected SAM_PWD_CHANGE_NO_ERROR (%d), got %d\n",
2593 SAM_PWD_CHANGE_NO_ERROR, reject->extendedFailureReason);
2594 return false;
2595 }
2596 /* Perhaps the server has a 'min password age' set? */
2597
2598 } else {
2599 torture_assert_ntstatus_ok(tctx, r.out.result, "ChangePasswordUser3 (on second random password)");
2600 *password = talloc_strdup(tctx, newpass);
2601 }
2602
2603 return ret;
2604 }
2605
2606
2607 static bool test_GetMembersInAlias(struct dcerpc_binding_handle *b,
2608 struct torture_context *tctx,
2609 struct policy_handle *alias_handle)
2610 {
2611 struct samr_GetMembersInAlias r;
2612 struct lsa_SidArray sids;
2613
2614 torture_comment(tctx, "Testing GetMembersInAlias\n");
2615
2616 r.in.alias_handle = alias_handle;
2617 r.out.sids = &sids;
2618
2619 torture_assert_ntstatus_ok(tctx, dcerpc_samr_GetMembersInAlias_r(b, tctx, &r),
2620 "GetMembersInAlias failed");
2621 torture_assert_ntstatus_ok(tctx, r.out.result, "GetMembersInAlias failed");
2622
2623 return true;
2624 }
2625
2626 static bool test_AddMemberToAlias(struct dcerpc_binding_handle *b,
2627 struct torture_context *tctx,
2628 struct policy_handle *alias_handle,
2629 const struct dom_sid *domain_sid)
2630 {
2631 struct samr_AddAliasMember r;
2632 struct samr_DeleteAliasMember d;
2633 struct dom_sid *sid;
2634
2635 sid = dom_sid_add_rid(tctx, domain_sid, 512);
2636
2637 torture_comment(tctx, "Testing AddAliasMember\n");
2638 r.in.alias_handle = alias_handle;
2639 r.in.sid = sid;
2640
2641 torture_assert_ntstatus_ok(tctx, dcerpc_samr_AddAliasMember_r(b, tctx, &r),
2642 "AddAliasMember failed");
2643 torture_assert_ntstatus_ok(tctx, r.out.result, "AddAliasMember failed");
2644
2645 d.in.alias_handle = alias_handle;
2646 d.in.sid = sid;
2647
2648 torture_assert_ntstatus_ok(tctx, dcerpc_samr_DeleteAliasMember_r(b, tctx, &d),
2649 "DeleteAliasMember failed");
2650 torture_assert_ntstatus_ok(tctx, d.out.result, "DelAliasMember failed");
2651
2652 return true;
2653 }
2654
2655 static bool test_AddMultipleMembersToAlias(struct dcerpc_binding_handle *b,
2656 struct torture_context *tctx,
2657 struct policy_handle *alias_handle)
2658 {
2659 struct samr_AddMultipleMembersToAlias a;
2660 struct samr_RemoveMultipleMembersFromAlias r;
2661 struct lsa_SidArray sids;
2662
2663 torture_comment(tctx, "Testing AddMultipleMembersToAlias\n");
2664 a.in.alias_handle = alias_handle;
2665 a.in.sids = &sids;
2666
2667 sids.num_sids = 3;
2668 sids.sids = talloc_array(tctx, struct lsa_SidPtr, 3);
2669
2670 sids.sids[0].sid = dom_sid_parse_talloc(tctx, "S-1-5-32-1-2-3-1");
2671 sids.sids[1].sid = dom_sid_parse_talloc(tctx, "S-1-5-32-1-2-3-2");
2672 sids.sids[2].sid = dom_sid_parse_talloc(tctx, "S-1-5-32-1-2-3-3");
2673
2674 torture_assert_ntstatus_ok(tctx, dcerpc_samr_AddMultipleMembersToAlias_r(b, tctx, &a),
2675 "AddMultipleMembersToAlias failed");
2676 torture_assert_ntstatus_ok(tctx, a.out.result, "AddMultipleMembersToAlias");
2677
2678
2679 torture_comment(tctx, "Testing RemoveMultipleMembersFromAlias\n");
2680 r.in.alias_handle = alias_handle;
2681 r.in.sids = &sids;
2682
2683 torture_assert_ntstatus_ok(tctx, dcerpc_samr_RemoveMultipleMembersFromAlias_r(b, tctx, &r),
2684 "RemoveMultipleMembersFromAlias failed");
2685 torture_assert_ntstatus_ok(tctx, r.out.result, "RemoveMultipleMembersFromAlias failed");
2686
2687 /* strange! removing twice doesn't give any error */
2688 torture_assert_ntstatus_ok(tctx, dcerpc_samr_RemoveMultipleMembersFromAlias_r(b, tctx, &r),
2689 "RemoveMultipleMembersFromAlias failed");
2690 torture_assert_ntstatus_ok(tctx, r.out.result, "RemoveMultipleMembersFromAlias failed");
2691
2692 /* but removing an alias that isn't there does */
2693 sids.sids[2].sid = dom_sid_parse_talloc(tctx, "S-1-5-32-1-2-3-4");
2694
2695 torture_assert_ntstatus_ok(tctx, dcerpc_samr_RemoveMultipleMembersFromAlias_r(b, tctx, &r),
2696 "RemoveMultipleMembersFromAlias failed");
2697 torture_assert_ntstatus_equal(tctx, r.out.result, NT_STATUS_OBJECT_NAME_NOT_FOUND, "RemoveMultipleMembersFromAlias");
2698
2699 return true;
2700 }
2701
2702 static bool test_GetAliasMembership(struct dcerpc_binding_handle *b,
2703 struct torture_context *tctx,
2704 struct policy_handle *domain_handle)
2705 {
2706 struct samr_GetAliasMembership r;
2707 struct lsa_SidArray sids;
2708 struct samr_Ids rids;
2709
2710 torture_comment(tctx, "Testing GetAliasMembership\n");
2711
2712 r.in.domain_handle = domain_handle;
2713 r.in.sids = &sids;
2714 r.out.rids = &rids;
2715
2716 sids.num_sids = 0;
2717 sids.sids = talloc_zero_array(tctx, struct lsa_SidPtr, sids.num_sids);
2718
2719 torture_assert_ntstatus_ok(tctx, dcerpc_samr_GetAliasMembership_r(b, tctx, &r),
2720 "GetAliasMembership failed");
2721 torture_assert_ntstatus_ok(tctx, r.out.result,
2722 "samr_GetAliasMembership failed");
2723
2724 torture_assert_int_equal(tctx, sids.num_sids, rids.count,
2725 "protocol misbehaviour");
2726
2727 sids.num_sids = 1;
2728 sids.sids = talloc_zero_array(tctx, struct lsa_SidPtr, sids.num_sids);
2729 sids.sids[0].sid = dom_sid_parse_talloc(tctx, "S-1-5-32-1-2-3-1");
2730
2731 torture_assert_ntstatus_ok(tctx, dcerpc_samr_GetAliasMembership_r(b, tctx, &r),
2732 "samr_GetAliasMembership failed");
2733 torture_assert_ntstatus_ok(tctx, r.out.result,
2734 "samr_GetAliasMembership failed");
2735
2736 #if 0
2737 /* only true for w2k8 it seems
2738 * win7, xp, w2k3 will return a 0 length array pointer */
2739
2740 if (rids.ids && (rids.count == 0)) {
2741 torture_fail(tctx, "samr_GetAliasMembership returned 0 count and a rids array");
2742 }
2743 #endif
2744 if (!rids.ids && rids.count) {
2745 torture_fail(tctx, "samr_GetAliasMembership returned non-0 count but no rids");
2746 }
2747
2748 return true;
2749 }
2750
2751 static bool test_TestPrivateFunctionsUser(struct dcerpc_binding_handle *b,
2752 struct torture_context *tctx,
2753 struct policy_handle *user_handle)
2754 {
2755 struct samr_TestPrivateFunctionsUser r;
2756
2757 torture_comment(tctx, "Testing TestPrivateFunctionsUser\n");
2758
2759 r.in.user_handle = user_handle;
2760
2761 torture_assert_ntstatus_ok(tctx, dcerpc_samr_TestPrivateFunctionsUser_r(b, tctx, &r),
2762 "TestPrivateFunctionsUser failed");
2763 torture_assert_ntstatus_equal(tctx, r.out.result, NT_STATUS_NOT_IMPLEMENTED, "TestPrivateFunctionsUser");
2764
2765 return true;
2766 }
2767
2768 static bool test_QueryUserInfo_pwdlastset(struct dcerpc_binding_handle *b,
2769 struct torture_context *tctx,
2770 struct policy_handle *handle,
2771 bool use_info2,
2772 NTTIME *pwdlastset)
2773 {
2774 NTSTATUS status;
2775 uint16_t levels[] = { /* 3, */ 5, 21 };
2776 int i;
2777 NTTIME pwdlastset3 = 0;
2778 NTTIME pwdlastset5 = 0;
2779 NTTIME pwdlastset21 = 0;
2780
2781 torture_comment(tctx, "Testing QueryUserInfo%s level 5 and 21 call ",
2782 use_info2 ? "2":"");
2783
2784 for (i=0; i<ARRAY_SIZE(levels); i++) {
2785
2786 struct samr_QueryUserInfo r;
2787 struct samr_QueryUserInfo2 r2;
2788 union samr_UserInfo *info;
2789
2790 if (use_info2) {
2791 r2.in.user_handle = handle;
2792 r2.in.level = levels[i];
2793 r2.out.info = &info;
2794 torture_assert_ntstatus_ok(tctx, dcerpc_samr_QueryUserInfo2_r(b, tctx, &r2),
2795 "QueryUserInfo2 failed");
2796 status = r2.out.result;
2797
2798 } else {
2799 r.in.user_handle = handle;
2800 r.in.level = levels[i];
2801 r.out.info = &info;
2802 torture_assert_ntstatus_ok(tctx, dcerpc_samr_QueryUserInfo_r(b, tctx, &r),
2803 "QueryUserInfo failed");
2804 status = r.out.result;
2805 }
2806
2807 if (!NT_STATUS_IS_OK(status) &&
2808 !NT_STATUS_EQUAL(status, NT_STATUS_INVALID_INFO_CLASS)) {
2809 torture_warning(tctx, "QueryUserInfo%s level %u failed - %s\n",
2810 use_info2 ? "2":"", levels[i], nt_errstr(status));
2811 return false;
2812 }
2813
2814 switch (levels[i]) {
2815 case 3:
2816 pwdlastset3 = info->info3.last_password_change;
2817 break;
2818 case 5:
2819 pwdlastset5 = info->info5.last_password_change;
2820 break;
2821 case 21:
2822 pwdlastset21 = info->info21.last_password_change;
2823 break;
2824 default:
2825 return false;
2826 }
2827 }
2828 /* torture_assert_int_equal(tctx, pwdlastset3, pwdlastset5,
2829 "pwdlastset mixup"); */
2830 torture_assert_int_equal(tctx, pwdlastset5, pwdlastset21,
2831 "pwdlastset mixup");
2832
2833 *pwdlastset = pwdlastset21;
2834
2835 torture_comment(tctx, "(pwdlastset: %llu)\n",
2836 (unsigned long long) *pwdlastset);
2837
2838 return true;
2839 }
2840
2841 static bool test_SamLogon(struct torture_context *tctx,
2842 struct dcerpc_pipe *p,
2843 struct cli_credentials *test_credentials,
2844 NTSTATUS expected_result,
2845 bool interactive)
2846 {
2847 NTSTATUS status;
2848 struct netr_LogonSamLogonEx r;
2849 union netr_LogonLevel logon;
2850 union netr_Validation validation;
2851 uint8_t authoritative;
2852 struct netr_IdentityInfo identity;
2853 struct netr_NetworkInfo ninfo;
2854 struct netr_PasswordInfo pinfo;
2855 DATA_BLOB names_blob, chal, lm_resp, nt_resp;
2856 int flags = CLI_CRED_NTLM_AUTH;
2857 uint32_t samlogon_flags = 0;
2858 struct netlogon_creds_CredentialState *creds;
2859 struct netr_Authenticator a;
2860 struct dcerpc_binding_handle *b = p->binding_handle;
2861
2862 torture_assert_ntstatus_ok(tctx, dcerpc_schannel_creds(p->conn->security_state.generic_state, tctx, &creds), "");
2863
2864 if (lpcfg_client_lanman_auth(tctx->lp_ctx)) {
2865 flags |= CLI_CRED_LANMAN_AUTH;
2866 }
2867
2868 if (lpcfg_client_ntlmv2_auth(tctx->lp_ctx)) {
2869 flags |= CLI_CRED_NTLMv2_AUTH;
2870 }
2871
2872 cli_credentials_get_ntlm_username_domain(test_credentials, tctx,
2873 &identity.account_name.string,
2874 &identity.domain_name.string);
2875
2876 identity.parameter_control =
2877 MSV1_0_ALLOW_SERVER_TRUST_ACCOUNT |
2878 MSV1_0_ALLOW_WORKSTATION_TRUST_ACCOUNT;
2879 identity.logon_id_low = 0;
2880 identity.logon_id_high = 0;
2881 identity.workstation.string = cli_credentials_get_workstation(test_credentials);
2882
2883 if (interactive) {
2884 netlogon_creds_client_authenticator(creds, &a);
2885
2886 if (!E_deshash(cli_credentials_get_password(test_credentials), pinfo.lmpassword.hash)) {
2887 ZERO_STRUCT(pinfo.lmpassword.hash);
2888 }
2889 E_md4hash(cli_credentials_get_password(test_credentials), pinfo.ntpassword.hash);
2890
2891 if (creds->negotiate_flags & NETLOGON_NEG_ARCFOUR) {
2892 netlogon_creds_arcfour_crypt(creds, pinfo.lmpassword.hash, 16);
2893 netlogon_creds_arcfour_crypt(creds, pinfo.ntpassword.hash, 16);
2894 } else {
2895 netlogon_creds_des_encrypt(creds, &pinfo.lmpassword);
2896 netlogon_creds_des_encrypt(creds, &pinfo.ntpassword);
2897 }
2898
2899 pinfo.identity_info = identity;
2900 logon.password = &pinfo;
2901
2902 r.in.logon_level = NetlogonInteractiveInformation;
2903 } else {
2904 generate_random_buffer(ninfo.challenge,
2905 sizeof(ninfo.challenge));
2906 chal = data_blob_const(ninfo.challenge,
2907 sizeof(ninfo.challenge));
2908
2909 names_blob = NTLMv2_generate_names_blob(tctx, cli_credentials_get_workstation(test_credentials),
2910 cli_credentials_get_domain(test_credentials));
2911
2912 status = cli_credentials_get_ntlm_response(test_credentials, tctx,
2913 &flags,
2914 chal,
2915 names_blob,
2916 &lm_resp, &nt_resp,
2917 NULL, NULL);
2918 torture_assert_ntstatus_ok(tctx, status, "cli_credentials_get_ntlm_response failed");
2919
2920 ninfo.lm.data = lm_resp.data;
2921 ninfo.lm.length = lm_resp.length;
2922
2923 ninfo.nt.data = nt_resp.data;
2924 ninfo.nt.length = nt_resp.length;
2925
2926 ninfo.identity_info = identity;
2927 logon.network = &ninfo;
2928
2929 r.in.logon_level = NetlogonNetworkInformation;
2930 }
2931
2932 r.in.server_name = talloc_asprintf(tctx, "\\\\%s", dcerpc_server_name(p));
2933 r.in.computer_name = cli_credentials_get_workstation(test_credentials);
2934 r.in.logon = &logon;
2935 r.in.flags = &samlogon_flags;
2936 r.out.flags = &samlogon_flags;
2937 r.out.validation = &validation;
2938 r.out.authoritative = &authoritative;
2939
2940 torture_comment(tctx, "Testing LogonSamLogon with name %s\n", identity.account_name.string);
2941
2942 r.in.validation_level = 6;
2943
2944 torture_assert_ntstatus_ok(tctx, dcerpc_netr_LogonSamLogonEx_r(b, tctx, &r),
2945 "netr_LogonSamLogonEx failed");
2946 if (NT_STATUS_EQUAL(r.out.result, NT_STATUS_INVALID_INFO_CLASS)) {
2947 r.in.validation_level = 3;
2948 torture_assert_ntstatus_ok(tctx, dcerpc_netr_LogonSamLogonEx_r(b, tctx, &r),
2949 "netr_LogonSamLogonEx failed");
2950 }
2951 if (!NT_STATUS_IS_OK(r.out.result)) {
2952 torture_assert_ntstatus_equal(tctx, r.out.result, expected_result, "LogonSamLogonEx failed");
2953 return true;
2954 } else {
2955 torture_assert_ntstatus_ok(tctx, r.out.result, "LogonSamLogonEx failed");
2956 }
2957
2958 return true;
2959 }
2960
2961 static bool test_SamLogon_with_creds(struct torture_context *tctx,
2962 struct dcerpc_pipe *p,
2963 struct cli_credentials *machine_creds,
2964 const char *acct_name,
2965 const char *password,
2966 NTSTATUS expected_samlogon_result,
2967 bool interactive)
2968 {
2969 bool ret = true;
2970 struct cli_credentials *test_credentials;
2971
2972 test_credentials = cli_credentials_init(tctx);
2973
2974 cli_credentials_set_workstation(test_credentials,
2975 cli_credentials_get_workstation(machine_creds), CRED_SPECIFIED);
2976 cli_credentials_set_domain(test_credentials,
2977 cli_credentials_get_domain(machine_creds), CRED_SPECIFIED);
2978 cli_credentials_set_username(test_credentials,
2979 acct_name, CRED_SPECIFIED);
2980 cli_credentials_set_password(test_credentials,
2981 password, CRED_SPECIFIED);
2982
2983 torture_comment(tctx, "Testing samlogon (%s) as %s password: %s\n",
2984 interactive ? "interactive" : "network", acct_name, password);
2985
2986 if (!test_SamLogon(tctx, p, test_credentials,
2987 expected_samlogon_result, interactive)) {
2988 torture_warning(tctx, "new password did not work\n");
2989 ret = false;
2990 }
2991
2992 return ret;
2993 }
2994
2995 static bool test_SetPassword_level(struct dcerpc_pipe *p,
2996 struct dcerpc_pipe *np,
2997 struct torture_context *tctx,
2998 struct policy_handle *handle,
2999 uint16_t level,
3000 uint32_t fields_present,
3001 uint8_t password_expired,
3002 bool *matched_expected_error,
3003 bool use_setinfo2,
3004 const char *acct_name,
3005 char **password,
3006 struct cli_credentials *machine_creds,
3007 bool use_queryinfo2,
3008 NTTIME *pwdlastset,
3009 NTSTATUS expected_samlogon_result)
3010 {
3011 const char *fields = NULL;
3012 bool ret = true;
3013 struct dcerpc_binding_handle *b = p->binding_handle;
3014
3015 switch (level) {
3016 case 21:
3017 case 23:
3018 case 25:
3019 fields = talloc_asprintf(tctx, "(fields_present: 0x%08x)",
3020 fields_present);
3021 break;
3022 default:
3023 break;
3024 }
3025
3026 torture_comment(tctx, "Testing SetUserInfo%s level %d call "
3027 "(password_expired: %d) %s\n",
3028 use_setinfo2 ? "2":"", level, password_expired,
3029 fields ? fields : "");
3030
3031 if (!test_SetUserPass_level_ex(p, tctx, handle, level,
3032 fields_present,
3033 password,
3034 password_expired,
3035 use_setinfo2,
3036 matched_expected_error)) {
3037 ret = false;
3038 }
3039
3040 if (!test_QueryUserInfo_pwdlastset(b, tctx, handle,
3041 use_queryinfo2,
3042 pwdlastset)) {
3043 ret = false;
3044 }
3045
3046 if (*matched_expected_error == true) {
3047 return ret;
3048 }
3049
3050 if (!test_SamLogon_with_creds(tctx, np,
3051 machine_creds,
3052 acct_name,
3053 *password,
3054 expected_samlogon_result,
3055 false)) {
3056 ret = false;
3057 }
3058
3059 return ret;
3060 }
3061
3062 static bool setup_schannel_netlogon_pipe(struct torture_context *tctx,
3063 struct cli_credentials *credentials,
3064 struct dcerpc_pipe **p)
3065 {
3066 struct dcerpc_binding *b;
3067
3068 torture_assert_ntstatus_ok(tctx, torture_rpc_binding(tctx, &b),
3069 "failed to get rpc binding");
3070
3071 /* We have to use schannel, otherwise the SamLogonEx fails
3072 * with INTERNAL_ERROR */
3073
3074 b->flags &= ~DCERPC_AUTH_OPTIONS;
3075 b->flags |= DCERPC_SCHANNEL | DCERPC_SIGN | DCERPC_SCHANNEL_128;
3076
3077 torture_assert_ntstatus_ok(tctx,
3078 dcerpc_pipe_connect_b(tctx, p, b, &ndr_table_netlogon,
3079 credentials, tctx->ev, tctx->lp_ctx),
3080 "failed to bind to netlogon");
3081
3082 return true;
3083 }
3084
3085 static bool test_SetPassword_pwdlastset(struct dcerpc_pipe *p,
3086 struct torture_context *tctx,
3087 uint32_t acct_flags,
3088 const char *acct_name,
3089 struct policy_handle *handle,
3090 char **password,
3091 struct cli_credentials *machine_credentials)
3092 {
3093 int s = 0, q = 0, f = 0, l = 0, z = 0;
3094 bool ret = true;
3095 int delay = 50000;
3096 bool set_levels[] = { false, true };
3097 bool query_levels[] = { false, true };
3098 uint32_t levels[] = { 18, 21, 26, 23, 24, 25 }; /* Second half only used when TEST_ALL_LEVELS defined */
3099 uint32_t nonzeros[] = { 1, 24 };
3100 uint32_t fields_present[] = {
3101 0,
3102 SAMR_FIELD_EXPIRED_FLAG,
3103 SAMR_FIELD_LAST_PWD_CHANGE,
3104 SAMR_FIELD_EXPIRED_FLAG | SAMR_FIELD_LAST_PWD_CHANGE,
3105 SAMR_FIELD_COMMENT,
3106 SAMR_FIELD_NT_PASSWORD_PRESENT,
3107 SAMR_FIELD_NT_PASSWORD_PRESENT | SAMR_FIELD_LAST_PWD_CHANGE,
3108 SAMR_FIELD_NT_PASSWORD_PRESENT | SAMR_FIELD_LM_PASSWORD_PRESENT,
3109 SAMR_FIELD_NT_PASSWORD_PRESENT | SAMR_FIELD_LM_PASSWORD_PRESENT | SAMR_FIELD_LAST_PWD_CHANGE,
3110 SAMR_FIELD_NT_PASSWORD_PRESENT | SAMR_FIELD_EXPIRED_FLAG,
3111 SAMR_FIELD_NT_PASSWORD_PRESENT | SAMR_FIELD_LM_PASSWORD_PRESENT | SAMR_FIELD_EXPIRED_FLAG,
3112 SAMR_FIELD_NT_PASSWORD_PRESENT | SAMR_FIELD_LM_PASSWORD_PRESENT | SAMR_FIELD_LAST_PWD_CHANGE | SAMR_FIELD_EXPIRED_FLAG
3113 };
3114 struct dcerpc_pipe *np = NULL;
3115
3116 if (torture_setting_bool(tctx, "samba3", false) ||
3117 torture_setting_bool(tctx, "samba4", false)) {
3118 delay = 999999;
3119 torture_comment(tctx, "Samba3 has second granularity, setting delay to: %d\n",
3120 delay);
3121 }
3122
3123 torture_assert(tctx, setup_schannel_netlogon_pipe(tctx, machine_credentials, &np), "");
3124
3125 /* set to 1 to enable testing for all possible opcode
3126 (SetUserInfo, SetUserInfo2, QueryUserInfo, QueryUserInfo2)
3127 combinations */
3128 #if 0
3129 #define TEST_ALL_LEVELS 1
3130 #define TEST_SET_LEVELS 1
3131 #define TEST_QUERY_LEVELS 1
3132 #endif
3133 #ifdef TEST_ALL_LEVELS
3134 for (l=0; l<ARRAY_SIZE(levels); l++) {
3135 #else
3136 for (l=0; l<(ARRAY_SIZE(levels))/2; l++) {
3137 #endif
3138 for (z=0; z<ARRAY_SIZE(nonzeros); z++) {
3139 for (f=0; f<ARRAY_SIZE(fields_present); f++) {
3140 #ifdef TEST_SET_LEVELS
3141 for (s=0; s<ARRAY_SIZE(set_levels); s++) {
3142 #endif
3143 #ifdef TEST_QUERY_LEVELS
3144 for (q=0; q<ARRAY_SIZE(query_levels); q++) {
3145 #endif
3146 NTTIME pwdlastset_old = 0;
3147 NTTIME pwdlastset_new = 0;
3148 bool matched_expected_error = false;
3149 NTSTATUS expected_samlogon_result = NT_STATUS_ACCOUNT_DISABLED;
3150
3151 torture_comment(tctx, "------------------------------\n"
3152 "Testing pwdLastSet attribute for flags: 0x%08x "
3153 "(s: %d (l: %d), q: %d)\n",
3154 acct_flags, s, levels[l], q);
3155
3156 switch (levels[l]) {
3157 case 21:
3158 case 23:
3159 case 25:
3160 if (!((fields_present[f] & SAMR_FIELD_NT_PASSWORD_PRESENT) ||
3161 (fields_present[f] & SAMR_FIELD_LM_PASSWORD_PRESENT))) {
3162 expected_samlogon_result = NT_STATUS_WRONG_PASSWORD;
3163 }
3164 break;
3165 }
3166
3167
3168 /* set #1 */
3169
3170 /* set a password and force password change (pwdlastset 0) by
3171 * setting the password expired flag to a non-0 value */
3172
3173 if (!test_SetPassword_level(p, np, tctx, handle,
3174 levels[l],
3175 fields_present[f],
3176 nonzeros[z],
3177 &matched_expected_error,
3178 set_levels[s],
3179 acct_name,
3180 password,
3181 machine_credentials,
3182 query_levels[q],
3183 &pwdlastset_new,
3184 expected_samlogon_result)) {
3185 ret = false;
3186 }
3187
3188 if (matched_expected_error == true) {
3189 /* skipping on expected failure */
3190 continue;
3191 }
3192
3193 /* pwdlastset must be 0 afterwards, except for a level 21, 23 and 25
3194 * set without the SAMR_FIELD_EXPIRED_FLAG */
3195
3196 switch (levels[l]) {
3197 case 21:
3198 case 23:
3199 case 25:
3200 if ((pwdlastset_new != 0) &&
3201 !(fields_present[f] & SAMR_FIELD_EXPIRED_FLAG)) {
3202 torture_comment(tctx, "not considering a non-0 "
3203 "pwdLastSet as a an error as the "
3204 "SAMR_FIELD_EXPIRED_FLAG has not "
3205 "been set\n");
3206 break;
3207 }
3208 break;
3209 default:
3210 if (pwdlastset_new != 0) {
3211 torture_warning(tctx, "pwdLastSet test failed: "
3212 "expected pwdLastSet 0 but got %llu\n",
3213 (unsigned long long) pwdlastset_old);
3214 ret = false;
3215 }
3216 break;
3217 }
3218
3219 switch (levels[l]) {
3220 case 21:
3221 case 23:
3222 case 25:
3223 if (((fields_present[f] & SAMR_FIELD_NT_PASSWORD_PRESENT) ||
3224 (fields_present[f] & SAMR_FIELD_LM_PASSWORD_PRESENT)) &&
3225 (pwdlastset_old > 0) && (pwdlastset_new > 0) &&
3226 (pwdlastset_old >= pwdlastset_new)) {
3227 torture_warning(tctx, "pwdlastset not increasing\n");
3228 ret = false;
3229 }
3230 break;
3231 }
3232
3233 pwdlastset_old = pwdlastset_new;
3234
3235 usleep(delay);
3236
3237 /* set #2 */
3238
3239 /* set a password, pwdlastset needs to get updated (increased
3240 * value), password_expired value used here is 0 */
3241
3242 if (!test_SetPassword_level(p, np, tctx, handle,
3243 levels[l],
3244 fields_present[f],
3245 0,
3246 &matched_expected_error,
3247 set_levels[s],
3248 acct_name,
3249 password,
3250 machine_credentials,
3251 query_levels[q],
3252 &pwdlastset_new,
3253 expected_samlogon_result)) {
3254 ret = false;
3255 }
3256
3257 /* when a password has been changed, pwdlastset must not be 0 afterwards
3258 * and must be larger then the old value */
3259
3260 switch (levels[l]) {
3261 case 21:
3262 case 23:
3263 case 25:
3264 /* SAMR_FIELD_EXPIRED_FLAG has not been set and no
3265 * password has been changed, old and new pwdlastset
3266 * need to be the same value */
3267
3268 if (!(fields_present[f] & SAMR_FIELD_EXPIRED_FLAG) &&
3269 !((fields_present[f] & SAMR_FIELD_NT_PASSWORD_PRESENT) ||
3270 (fields_present[f] & SAMR_FIELD_LM_PASSWORD_PRESENT)))
3271 {
3272 torture_assert_int_equal(tctx, pwdlastset_old,
3273 pwdlastset_new, "pwdlastset must be equal");
3274 break;
3275 }
3276 break;
3277 default:
3278 if (pwdlastset_old >= pwdlastset_new) {
3279 torture_warning(tctx, "pwdLastSet test failed: "
3280 "expected last pwdlastset (%llu) < new pwdlastset (%llu)\n",
3281 (unsigned long long) pwdlastset_old,
3282 (unsigned long long) pwdlastset_new);
3283 ret = false;
3284 }
3285 if (pwdlastset_new == 0) {
3286 torture_warning(tctx, "pwdLastSet test failed: "
3287 "expected non-0 pwdlastset, got: %llu\n",
3288 (unsigned long long) pwdlastset_new);
3289 ret = false;
3290 }
3291 break;
3292 }
3293
3294 switch (levels[l]) {
3295 case 21:
3296 case 23:
3297 case 25:
3298 if (((fields_present[f] & SAMR_FIELD_NT_PASSWORD_PRESENT) ||
3299 (fields_present[f] & SAMR_FIELD_LM_PASSWORD_PRESENT)) &&
3300 (pwdlastset_old > 0) && (pwdlastset_new > 0) &&
3301 (pwdlastset_old >= pwdlastset_new)) {
3302 torture_warning(tctx, "pwdlastset not increasing\n");
3303 ret = false;
3304 }
3305 break;
3306 }
3307
3308 pwdlastset_old = pwdlastset_new;
3309
3310 usleep(delay);
3311
3312 /* set #2b */
3313
3314 /* set a password, pwdlastset needs to get updated (increased
3315 * value), password_expired value used here is 0 */
3316
3317 if (!test_SetPassword_level(p, np, tctx, handle,
3318 levels[l],
3319 fields_present[f],
3320 0,
3321 &matched_expected_error,
3322 set_levels[s],
3323 acct_name,
3324 password,
3325 machine_credentials,
3326 query_levels[q],
3327 &pwdlastset_new,
3328 expected_samlogon_result)) {
3329 ret = false;
3330 }
3331
3332 /* when a password has been changed, pwdlastset must not be 0 afterwards
3333 * and must be larger then the old value */
3334
3335 switch (levels[l]) {
3336 case 21:
3337 case 23:
3338 case 25:
3339
3340 /* SAMR_FIELD_EXPIRED_FLAG has not been set and no
3341 * password has been changed, old and new pwdlastset
3342 * need to be the same value */
3343
3344 if (!(fields_present[f] & SAMR_FIELD_EXPIRED_FLAG) &&
3345 !((fields_present[f] & SAMR_FIELD_NT_PASSWORD_PRESENT) ||
3346 (fields_present[f] & SAMR_FIELD_LM_PASSWORD_PRESENT)))
3347 {
3348 torture_assert_int_equal(tctx, pwdlastset_old,
3349 pwdlastset_new, "pwdlastset must be equal");
3350 break;
3351 }
3352 break;
3353 default:
3354 if (pwdlastset_old >= pwdlastset_new) {
3355 torture_warning(tctx, "pwdLastSet test failed: "
3356 "expected last pwdlastset (%llu) < new pwdlastset (%llu)\n",
3357 (unsigned long long) pwdlastset_old,
3358 (unsigned long long) pwdlastset_new);
3359 ret = false;
3360 }
3361 if (pwdlastset_new == 0) {
3362 torture_warning(tctx, "pwdLastSet test failed: "
3363 "expected non-0 pwdlastset, got: %llu\n",
3364 (unsigned long long) pwdlastset_new);
3365 ret = false;
3366 }
3367 break;
3368 }
3369
3370 switch (levels[l]) {
3371 case 21:
3372 case 23:
3373 case 25:
3374 if (((fields_present[f] & SAMR_FIELD_NT_PASSWORD_PRESENT) ||
3375 (fields_present[f] & SAMR_FIELD_LM_PASSWORD_PRESENT)) &&
3376 (pwdlastset_old > 0) && (pwdlastset_new > 0) &&
3377 (pwdlastset_old >= pwdlastset_new)) {
3378 torture_warning(tctx, "pwdlastset not increasing\n");
3379 ret = false;
3380 }
3381 break;
3382 }
3383
3384 pwdlastset_old = pwdlastset_new;
3385
3386 usleep(delay);
3387
3388 /* set #3 */
3389
3390 /* set a password and force password change (pwdlastset 0) by
3391 * setting the password expired flag to a non-0 value */
3392
3393 if (!test_SetPassword_level(p, np, tctx, handle,
3394 levels[l],
3395 fields_present[f],
3396 nonzeros[z],
3397 &matched_expected_error,
3398 set_levels[s],
3399 acct_name,
3400 password,
3401 machine_credentials,
3402 query_levels[q],
3403 &pwdlastset_new,
3404 expected_samlogon_result)) {
3405 ret = false;
3406 }
3407
3408 /* pwdlastset must be 0 afterwards, except for a level 21, 23 and 25
3409 * set without the SAMR_FIELD_EXPIRED_FLAG */
3410
3411 switch (levels[l]) {
3412 case 21:
3413 case 23:
3414 case 25:
3415 if ((pwdlastset_new != 0) &&
3416 !(fields_present[f] & SAMR_FIELD_EXPIRED_FLAG)) {
3417 torture_comment(tctx, "not considering a non-0 "
3418 "pwdLastSet as a an error as the "
3419 "SAMR_FIELD_EXPIRED_FLAG has not "
3420 "been set\n");
3421 break;
3422 }
3423
3424 /* SAMR_FIELD_EXPIRED_FLAG has not been set and no
3425 * password has been changed, old and new pwdlastset
3426 * need to be the same value */
3427
3428 if (!(fields_present[f] & SAMR_FIELD_EXPIRED_FLAG) &&
3429 !((fields_present[f] & SAMR_FIELD_NT_PASSWORD_PRESENT) ||
3430 (fields_present[f] & SAMR_FIELD_LM_PASSWORD_PRESENT)))
3431 {
3432 torture_assert_int_equal(tctx, pwdlastset_old,
3433 pwdlastset_new, "pwdlastset must be equal");
3434 break;
3435 }
3436 break;
3437 default:
3438 if (pwdlastset_new != 0) {
3439 torture_warning(tctx, "pwdLastSet test failed: "
3440 "expected pwdLastSet 0, got %llu\n",
3441 (unsigned long long) pwdlastset_old);
3442 ret = false;
3443 }
3444 break;
3445 }
3446
3447 switch (levels[l]) {
3448 case 21:
3449 case 23:
3450 case 25:
3451 if (((fields_present[f] & SAMR_FIELD_NT_PASSWORD_PRESENT) ||
3452 (fields_present[f] & SAMR_FIELD_LM_PASSWORD_PRESENT)) &&
3453 (pwdlastset_old > 0) && (pwdlastset_new > 0) &&
3454 (pwdlastset_old >= pwdlastset_new)) {
3455 torture_warning(tctx, "pwdlastset not increasing\n");
3456 ret = false;
3457 }
3458 break;
3459 }
3460
3461 /* if the level we are testing does not have a fields_present
3462 * field, skip all fields present tests by setting f to to
3463 * arraysize */
3464 switch (levels[l]) {
3465 case 18:
3466 case 24:
3467 case 26:
3468 f = ARRAY_SIZE(fields_present);
3469 break;
3470 }
3471
3472 #ifdef TEST_QUERY_LEVELS
3473 }
3474 #endif
3475 #ifdef TEST_SET_LEVELS
3476 }
3477 #endif
3478 } /* fields present */
3479 } /* nonzeros */
3480 } /* levels */
3481
3482 #undef TEST_SET_LEVELS
3483 #undef TEST_QUERY_LEVELS
3484
3485 talloc_free(np);
3486
3487 return ret;
3488 }
3489
3490 static bool test_QueryUserInfo_badpwdcount(struct dcerpc_binding_handle *b,
3491 struct torture_context *tctx,
3492 struct policy_handle *handle,
3493 uint32_t *badpwdcount)
3494 {
3495 union samr_UserInfo *info;
3496 struct samr_QueryUserInfo r;
3497
3498 r.in.user_handle = handle;
3499 r.in.level = 3;
3500 r.out.info = &info;
3501
3502 torture_comment(tctx, "Testing QueryUserInfo level %d", r.in.level);
3503
3504 torture_assert_ntstatus_ok(tctx, dcerpc_samr_QueryUserInfo_r(b, tctx, &r),
3505 "failed to query userinfo");
3506 torture_assert_ntstatus_ok(tctx, r.out.result,
3507 "failed to query userinfo");
3508
3509 *badpwdcount = info->info3.bad_password_count;
3510
3511 torture_comment(tctx, " (bad password count: %d)\n", *badpwdcount);
3512
3513 return true;
3514 }
3515
3516 static bool test_SetUserInfo_acct_flags(struct dcerpc_binding_handle *b,
3517 struct torture_context *tctx,
3518 struct policy_handle *user_handle,
3519 uint32_t acct_flags)
3520 {
3521 struct samr_SetUserInfo r;
3522 union samr_UserInfo user_info;
3523
3524 torture_comment(tctx, "Testing SetUserInfo level 16\n");
3525
3526 user_info.info16.acct_flags = acct_flags;
3527
3528 r.in.user_handle = user_handle;
3529 r.in.level = 16;
3530 r.in.info = &user_info;
3531
3532 torture_assert_ntstatus_ok(tctx, dcerpc_samr_SetUserInfo_r(b, tctx, &r),
3533 "failed to set account flags");
3534 torture_assert_ntstatus_ok(tctx, r.out.result,
3535 "failed to set account flags");
3536
3537 return true;
3538 }
3539
3540 static bool test_reset_badpwdcount(struct dcerpc_pipe *p,
3541 struct torture_context *tctx,
3542 struct policy_handle *user_handle,
3543 uint32_t acct_flags,
3544 char **password)
3545 {
3546 struct dcerpc_binding_handle *b = p->binding_handle;
3547
3548 torture_assert(tctx, test_SetUserPass(p, tctx, user_handle, password),
3549 "failed to set password");
3550
3551 torture_comment(tctx, "Testing SetUserInfo level 16 (enable account)\n");
3552
3553 torture_assert(tctx,
3554 test_SetUserInfo_acct_flags(b, tctx, user_handle,
3555 acct_flags & ~ACB_DISABLED),
3556 "failed to enable user");
3557
3558 torture_assert(tctx, test_SetUserPass(p, tctx, user_handle, password),
3559 "failed to set password");
3560
3561 return true;
3562 }
3563
3564 static bool test_SetDomainInfo(struct dcerpc_binding_handle *b,
3565 struct torture_context *tctx,
3566 struct policy_handle *domain_handle,
3567 enum samr_DomainInfoClass level,
3568 union samr_DomainInfo *info)
3569 {
3570 struct samr_SetDomainInfo r;
3571
3572 r.in.domain_handle = domain_handle;
3573 r.in.level = level;
3574 r.in.info = info;
3575
3576 torture_assert_ntstatus_ok(tctx,
3577 dcerpc_samr_SetDomainInfo_r(b, tctx, &r),
3578 "failed to set domain info");
3579 torture_assert_ntstatus_ok(tctx, r.out.result,
3580 "failed to set domain info");
3581
3582 return true;
3583 }
3584
3585 static bool test_SetDomainInfo_ntstatus(struct dcerpc_binding_handle *b,
3586 struct torture_context *tctx,
3587 struct policy_handle *domain_handle,
3588 enum samr_DomainInfoClass level,
3589 union samr_DomainInfo *info,
3590 NTSTATUS expected)
3591 {
3592 struct samr_SetDomainInfo r;
3593
3594 r.in.domain_handle = domain_handle;
3595 r.in.level = level;
3596 r.in.info = info;
3597
3598 torture_assert_ntstatus_ok(tctx, dcerpc_samr_SetDomainInfo_r(b, tctx, &r),
3599 "SetDomainInfo failed");
3600 torture_assert_ntstatus_equal(tctx, r.out.result, expected, "");
3601
3602 return true;
3603 }
3604
3605 static bool test_QueryDomainInfo2_level(struct dcerpc_binding_handle *b,
3606 struct torture_context *tctx,
3607 struct policy_handle *domain_handle,
3608 enum samr_DomainInfoClass level,
3609 union samr_DomainInfo **q_info)
3610 {
3611 struct samr_QueryDomainInfo2 r;
3612
3613 r.in.domain_handle = domain_handle;
3614 r.in.level = level;
3615 r.out.info = q_info;
3616
3617 torture_assert_ntstatus_ok(tctx, dcerpc_samr_QueryDomainInfo2_r(b, tctx, &r),
3618 "failed to query domain info");
3619 torture_assert_ntstatus_ok(tctx, r.out.result,
3620 "failed to query domain info");
3621
3622 return true;
3623 }
3624
3625 static bool test_Password_badpwdcount(struct dcerpc_pipe *p,
3626 struct dcerpc_pipe *np,
3627 struct torture_context *tctx,
3628 uint32_t acct_flags,
3629 const char *acct_name,
3630 struct policy_handle *domain_handle,
3631 struct policy_handle *user_handle,
3632 char **password,
3633 struct cli_credentials *machine_credentials,
3634 const char *comment,
3635 bool disable,
3636 bool interactive,
3637 NTSTATUS expected_success_status,
3638 struct samr_DomInfo1 *info1,
3639 struct samr_DomInfo12 *info12)
3640 {
3641 union samr_DomainInfo info;
3642 char **passwords;
3643 int i;
3644 uint32_t badpwdcount, tmp;
3645 uint32_t password_history_length = 12;
3646 uint32_t lockout_threshold = 15;
3647 struct dcerpc_binding_handle *b = p->binding_handle;
3648
3649 torture_comment(tctx, "\nTesting bad pwd count with: %s\n", comment);
3650
3651 torture_assert(tctx, password_history_length < lockout_threshold,
3652 "password history length needs to be smaller than account lockout threshold for this test");
3653
3654
3655 /* set policies */
3656
3657 info.info1 = *info1;
3658 info.info1.password_history_length = password_history_length;
3659
3660 torture_assert(tctx,
3661 test_SetDomainInfo(b, tctx, domain_handle,
3662 DomainPasswordInformation, &info),
3663 "failed to set password history length");
3664
3665 info.info12 = *info12;
3666 info.info12.lockout_threshold = lockout_threshold;
3667
3668 torture_assert(tctx,
3669 test_SetDomainInfo(b, tctx, domain_handle,
3670 DomainLockoutInformation, &info),
3671 "failed to set lockout threshold");
3672
3673 /* reset bad pwd count */
3674
3675 torture_assert(tctx,
3676 test_reset_badpwdcount(p, tctx, user_handle, acct_flags, password), "");
3677
3678
3679 /* enable or disable account */
3680 if (disable) {
3681 torture_assert(tctx,
3682 test_SetUserInfo_acct_flags(b, tctx, user_handle,
3683 acct_flags | ACB_DISABLED),
3684 "failed to disable user");
3685 } else {
3686 torture_assert(tctx,
3687 test_SetUserInfo_acct_flags(b, tctx, user_handle,
3688 acct_flags & ~ACB_DISABLED),
3689 "failed to enable user");
3690 }
3691
3692
3693 /* setup password history */
3694
3695 passwords = talloc_array(tctx, char *, password_history_length);
3696
3697 for (i=0; i < password_history_length; i++) {
3698
3699 torture_assert(tctx, test_SetUserPass(p, tctx, user_handle, password),
3700 "failed to set password");
3701 passwords[i] = talloc_strdup(tctx, *password);
3702
3703 if (!test_SamLogon_with_creds(tctx, np, machine_credentials,
3704 acct_name, passwords[i],
3705 expected_success_status, interactive)) {
3706 torture_fail(tctx, "failed to auth with latest password");
3707 }
3708
3709 torture_assert(tctx,
3710 test_QueryUserInfo_badpwdcount(b, tctx, user_handle, &badpwdcount), "");
3711
3712 torture_assert_int_equal(tctx, badpwdcount, 0, "expected badpwdcount to be 0");
3713 }
3714
3715
3716 /* test with wrong password */
3717
3718 if (!test_SamLogon_with_creds(tctx, np, machine_credentials,
3719 acct_name, "random_crap",
3720 NT_STATUS_WRONG_PASSWORD, interactive)) {
3721 torture_fail(tctx, "succeeded to authenticate with wrong password");
3722 }
3723
3724 torture_assert(tctx,
3725 test_QueryUserInfo_badpwdcount(b, tctx, user_handle, &badpwdcount), "");
3726
3727 torture_assert_int_equal(tctx, badpwdcount, 1, "expected badpwdcount to be 1");
3728
3729
3730 /* test with latest good password */
3731
3732 if (!test_SamLogon_with_creds(tctx, np, machine_credentials, acct_name,
3733 passwords[password_history_length-1],
3734 expected_success_status, interactive)) {
3735 torture_fail(tctx, "succeeded to authenticate with wrong password");
3736 }
3737
3738 torture_assert(tctx,
3739 test_QueryUserInfo_badpwdcount(b, tctx, user_handle, &badpwdcount), "");
3740
3741 if (disable) {
3742 torture_assert_int_equal(tctx, badpwdcount, 1, "expected badpwdcount to be 1");
3743 } else {
3744 /* only enabled accounts get the bad pwd count reset upon
3745 * successful logon */
3746 torture_assert_int_equal(tctx, badpwdcount, 0, "expected badpwdcount to be 0");
3747 }
3748
3749 tmp = badpwdcount;
3750
3751
3752 /* test password history */
3753
3754 for (i=0; i < password_history_length; i++) {
3755
3756 torture_comment(tctx, "Testing bad password count behavior with "
3757 "password #%d of #%d\n", i, password_history_length);
3758
3759 /* - network samlogon will succeed auth and not
3760 * increase badpwdcount for 2 last entries
3761 * - interactive samlogon only for the last one */
3762
3763 if (i == password_history_length - 1 ||
3764 (i == password_history_length - 2 && !interactive)) {
3765
3766 if (!test_SamLogon_with_creds(tctx, np, machine_credentials,
3767 acct_name, passwords[i],
3768 expected_success_status, interactive)) {
3769 torture_fail(tctx, talloc_asprintf(tctx, "succeeded to authenticate with old password (#%d of #%d in history)", i, password_history_length));
3770 }
3771
3772 torture_assert(tctx,
3773 test_QueryUserInfo_badpwdcount(b, tctx, user_handle, &badpwdcount), "");
3774
3775 if (disable) {
3776 /* torture_comment(tctx, "expecting bad pwd count to *NOT INCREASE* for pwd history entry %d\n", i); */
3777 torture_assert_int_equal(tctx, badpwdcount, tmp, "unexpected badpwdcount");
3778 } else {
3779 /* torture_comment(tctx, "expecting bad pwd count to be 0 for pwd history entry %d\n", i); */
3780 torture_assert_int_equal(tctx, badpwdcount, 0, "expected badpwdcount to be 0");
3781 }
3782
3783 tmp = badpwdcount;
3784
3785 continue;
3786 }
3787
3788 if (!test_SamLogon_with_creds(tctx, np, machine_credentials,
3789 acct_name, passwords[i],
3790 NT_STATUS_WRONG_PASSWORD, interactive)) {
3791 torture_fail(tctx, talloc_asprintf(tctx, "succeeded to authenticate with old password (#%d of #%d in history)", i, password_history_length));
3792 }
3793
3794 torture_assert(tctx,
3795 test_QueryUserInfo_badpwdcount(b, tctx, user_handle, &badpwdcount), "");
3796
3797 /* - network samlogon will fail auth but not increase
3798 * badpwdcount for 3rd last entry
3799 * - interactive samlogon for 3rd and 2nd last entry */
3800
3801 if (i == password_history_length - 3 ||
3802 (i == password_history_length - 2 && interactive)) {
3803 /* torture_comment(tctx, "expecting bad pwd count to *NOT INCREASE * by one for pwd history entry %d\n", i); */
3804 torture_assert_int_equal(tctx, badpwdcount, tmp, "unexpected badpwdcount");
3805 } else {
3806 /* torture_comment(tctx, "expecting bad pwd count to increase by one for pwd history entry %d\n", i); */
3807 torture_assert_int_equal(tctx, badpwdcount, tmp + 1, "unexpected badpwdcount");
3808 }
3809
3810 tmp = badpwdcount;
3811 }
3812
3813 return true;
3814 }
3815
3816 static bool test_Password_badpwdcount_wrap(struct dcerpc_pipe *p,
3817 struct torture_context *tctx,
3818 uint32_t acct_flags,
3819 const char *acct_name,
3820 struct policy_handle *domain_handle,
3821 struct policy_handle *user_handle,
3822 char **password,
3823 struct cli_credentials *machine_credentials)
3824 {
3825 union samr_DomainInfo *q_info, s_info;
3826 struct samr_DomInfo1 info1, _info1;
3827 struct samr_DomInfo12 info12, _info12;
3828 bool ret = true;
3829 struct dcerpc_binding_handle *b = p->binding_handle;
3830 struct dcerpc_pipe *np;
3831 int i;
3832
3833 struct {
3834 const char *comment;
3835 bool disabled;
3836 bool interactive;
3837 NTSTATUS expected_success_status;
3838 } creds[] = {
3839 {
3840 .comment = "network logon (disabled account)",
3841 .disabled = true,
3842 .interactive = false,
3843 .expected_success_status= NT_STATUS_ACCOUNT_DISABLED
3844 },
3845 {
3846 .comment = "network logon (enabled account)",
3847 .disabled = false,
3848 .interactive = false,
3849 .expected_success_status= NT_STATUS_OK
3850 },
3851 {
3852 .comment = "interactive logon (disabled account)",
3853 .disabled = true,
3854 .interactive = true,
3855 .expected_success_status= NT_STATUS_ACCOUNT_DISABLED
3856 },
3857 {
3858 .comment = "interactive logon (enabled account)",
3859 .disabled = false,
3860 .interactive = true,
3861 .expected_success_status= NT_STATUS_OK
3862 },
3863 };
3864
3865 torture_assert(tctx, setup_schannel_netlogon_pipe(tctx, machine_credentials, &np), "");
3866
3867 /* backup old policies */
3868
3869 torture_assert(tctx,
3870 test_QueryDomainInfo2_level(b, tctx, domain_handle,
3871 DomainPasswordInformation, &q_info),
3872 "failed to query domain info level 1");
3873
3874 info1 = q_info->info1;
3875 _info1 = info1;
3876
3877 torture_assert(tctx,
3878 test_QueryDomainInfo2_level(b, tctx, domain_handle,
3879 DomainLockoutInformation, &q_info),
3880 "failed to query domain info level 12");
3881
3882 info12 = q_info->info12;
3883 _info12 = info12;
3884
3885 /* run tests */
3886
3887 for (i=0; i < ARRAY_SIZE(creds); i++) {
3888
3889 /* skip trust tests for now */
3890 if (acct_flags & ACB_WSTRUST ||
3891 acct_flags & ACB_SVRTRUST ||
3892 acct_flags & ACB_DOMTRUST) {
3893 continue;
3894 }
3895
3896 ret &= test_Password_badpwdcount(p, np, tctx, acct_flags, acct_name,
3897 domain_handle, user_handle, password,
3898 machine_credentials,
3899 creds[i].comment,
3900 creds[i].disabled,
3901 creds[i].interactive,
3902 creds[i].expected_success_status,
3903 &_info1, &_info12);
3904 if (!ret) {
3905 torture_warning(tctx, "TEST #%d (%s) failed\n", i, creds[i].comment);
3906 } else {
3907 torture_comment(tctx, "TEST #%d (%s) succeeded\n", i, creds[i].comment);
3908 }
3909 }
3910
3911 /* restore policies */
3912
3913 s_info.info1 = info1;
3914
3915 torture_assert(tctx,
3916 test_SetDomainInfo(b, tctx, domain_handle,
3917 DomainPasswordInformation, &s_info),
3918 "failed to set password information");
3919
3920 s_info.info12 = info12;
3921
3922 torture_assert(tctx,
3923 test_SetDomainInfo(b, tctx, domain_handle,
3924 DomainLockoutInformation, &s_info),
3925 "failed to set lockout information");
3926
3927 return ret;
3928 }
3929
3930 static bool test_QueryUserInfo_acct_flags(struct dcerpc_binding_handle *b,
3931 struct torture_context *tctx,
3932 struct policy_handle *handle,
3933 uint32_t *acct_flags)
3934 {
3935 union samr_UserInfo *info;
3936 struct samr_QueryUserInfo r;
3937
3938 r.in.user_handle = handle;
3939 r.in.level = 16;
3940 r.out.info = &info;
3941
3942 torture_comment(tctx, "Testing QueryUserInfo level %d", r.in.level);
3943
3944 torture_assert_ntstatus_ok(tctx, dcerpc_samr_QueryUserInfo_r(b, tctx, &r),
3945 "failed to query userinfo");
3946 torture_assert_ntstatus_ok(tctx, r.out.result,
3947 "failed to query userinfo");
3948
3949 *acct_flags = info->info16.acct_flags;
3950
3951 torture_comment(tctx, " (acct_flags: 0x%08x)\n", *acct_flags);
3952
3953 return true;
3954 }
3955
3956 static bool test_Password_lockout(struct dcerpc_pipe *p,
3957 struct dcerpc_pipe *np,
3958 struct torture_context *tctx,
3959 uint32_t acct_flags,
3960 const char *acct_name,
3961 struct policy_handle *domain_handle,
3962 struct policy_handle *user_handle,
3963 char **password,
3964 struct cli_credentials *machine_credentials,
3965 const char *comment,
3966 bool disable,
3967 bool interactive,
3968 NTSTATUS expected_success_status,
3969 struct samr_DomInfo1 *info1,
3970 struct samr_DomInfo12 *info12)
3971 {
3972 union samr_DomainInfo info;
3973 uint32_t badpwdcount;
3974 uint32_t password_history_length = 1;
3975 uint64_t lockout_threshold = 1;
3976 uint32_t lockout_seconds = 5;
3977 uint64_t delta_time_factor = 10 * 1000 * 1000;
3978 struct dcerpc_binding_handle *b = p->binding_handle;
3979
3980 torture_comment(tctx, "\nTesting account lockout: %s\n", comment);
3981
3982 /* set policies */
3983
3984 info.info1 = *info1;
3985
3986 torture_comment(tctx, "setting password history length.\n");
3987 info.info1.password_history_length = password_history_length;
3988
3989 torture_assert(tctx,
3990 test_SetDomainInfo(b, tctx, domain_handle,
3991 DomainPasswordInformation, &info),
3992 "failed to set password history length");
3993
3994 info.info12 = *info12;
3995 info.info12.lockout_threshold = lockout_threshold;
3996
3997 /* set lockout duration < lockout window: should fail */
3998 info.info12.lockout_duration = ~(lockout_seconds * delta_time_factor);
3999 info.info12.lockout_window = ~((lockout_seconds + 1) * delta_time_factor);
4000
4001 torture_assert(tctx,
4002 test_SetDomainInfo_ntstatus(b, tctx, domain_handle,
4003 DomainLockoutInformation, &info,
4004 NT_STATUS_INVALID_PARAMETER),
4005 "setting lockout duration < lockout window gave unexpected result");
4006
4007 info.info12.lockout_duration = 0;
4008 info.info12.lockout_window = 0;
4009
4010 torture_assert(tctx,
4011 test_SetDomainInfo(b, tctx, domain_handle,
4012 DomainLockoutInformation, &info),
4013 "failed to set lockout window and duration to 0");
4014
4015
4016 /* set lockout duration of 5 seconds */
4017 info.info12.lockout_duration = ~(lockout_seconds * delta_time_factor);
4018 info.info12.lockout_window = ~(lockout_seconds * delta_time_factor);
4019
4020 torture_assert(tctx,
4021 test_SetDomainInfo(b, tctx, domain_handle,
4022 DomainLockoutInformation, &info),
4023 "failed to set lockout window and duration to 5 seconds");
4024
4025 /* reset bad pwd count */
4026
4027 torture_assert(tctx,
4028 test_reset_badpwdcount(p, tctx, user_handle, acct_flags, password), "");
4029
4030
4031 /* enable or disable account */
4032
4033 if (disable) {
4034 torture_assert(tctx,
4035 test_SetUserInfo_acct_flags(b, tctx, user_handle,
4036 acct_flags | ACB_DISABLED),
4037 "failed to disable user");
4038 } else {
4039 torture_assert(tctx,
4040 test_SetUserInfo_acct_flags(b, tctx, user_handle,
4041 acct_flags & ~ACB_DISABLED),
4042 "failed to enable user");
4043 }
4044
4045
4046 /* test logon with right password */
4047
4048 if (!test_SamLogon_with_creds(tctx, np, machine_credentials,
4049 acct_name, *password,
4050 expected_success_status, interactive)) {
4051 torture_fail(tctx, "failed to auth with latest password");
4052 }
4053
4054 torture_assert(tctx,
4055 test_QueryUserInfo_badpwdcount(b, tctx, user_handle, &badpwdcount), "");
4056 torture_assert_int_equal(tctx, badpwdcount, 0, "expected badpwdcount to be 0");
4057
4058
4059 /* test with wrong password ==> lockout */
4060
4061 if (!test_SamLogon_with_creds(tctx, np, machine_credentials,
4062 acct_name, "random_crap",
4063 NT_STATUS_WRONG_PASSWORD, interactive)) {
4064 torture_fail(tctx, "succeeded to authenticate with wrong password");
4065 }
4066
4067 torture_assert(tctx,
4068 test_QueryUserInfo_badpwdcount(b, tctx, user_handle, &badpwdcount), "");
4069 torture_assert_int_equal(tctx, badpwdcount, 1, "expected badpwdcount to be 1");
4070
4071 torture_assert(tctx,
4072 test_QueryUserInfo_acct_flags(b, tctx, user_handle, &acct_flags), "");
4073 torture_assert_int_equal(tctx, acct_flags & ACB_AUTOLOCK, 0,
4074 "expected account to be locked");
4075
4076
4077 /* test with good password */
4078
4079 if (!test_SamLogon_with_creds(tctx, np, machine_credentials, acct_name,
4080 *password,
4081 NT_STATUS_ACCOUNT_LOCKED_OUT, interactive))
4082 {
4083 torture_fail(tctx, "authenticate did not return NT_STATUS_ACCOUNT_LOCKED_OUT");
4084 }
4085
4086 /* bad pwd count should not get updated */
4087 torture_assert(tctx,
4088 test_QueryUserInfo_badpwdcount(b, tctx, user_handle, &badpwdcount), "");
4089 torture_assert_int_equal(tctx, badpwdcount, 1, "expected badpwdcount to be 1");
4090
4091 /* curiously, windows does _not_ set the autlock flag */
4092 torture_assert(tctx,
4093 test_QueryUserInfo_acct_flags(b, tctx, user_handle, &acct_flags), "");
4094 torture_assert_int_equal(tctx, acct_flags & ACB_AUTOLOCK, 0,
4095 "expected account to be locked");
4096
4097
4098 /* with bad password */
4099
4100 if (!test_SamLogon_with_creds(tctx, np, machine_credentials,
4101 acct_name, "random_crap2",
4102 NT_STATUS_ACCOUNT_LOCKED_OUT, interactive))
4103 {
4104 torture_fail(tctx, "authenticate did not return NT_STATUS_ACCOUNT_LOCKED_OUT");
4105 }
4106
4107 /* bad pwd count should not get updated */
4108 torture_assert(tctx,
4109 test_QueryUserInfo_badpwdcount(b, tctx, user_handle, &badpwdcount), "");
4110 torture_assert_int_equal(tctx, badpwdcount, 1, "expected badpwdcount to be 1");
4111
4112 /* curiously, windows does _not_ set the autlock flag */
4113 torture_assert(tctx,
4114 test_QueryUserInfo_acct_flags(b, tctx, user_handle, &acct_flags), "");
4115 torture_assert_int_equal(tctx, acct_flags & ACB_AUTOLOCK, 0,
4116 "expected account to be locked");
4117
4118
4119 /* let lockout duration expire ==> unlock */
4120
4121 torture_comment(tctx, "let lockout duration expire...\n");
4122 sleep(lockout_seconds + 1);
4123
4124 if (!test_SamLogon_with_creds(tctx, np, machine_credentials, acct_name,
4125 *password,
4126 expected_success_status, interactive))
4127 {
4128 torture_fail(tctx, "failed to authenticate after lockout expired");
4129 }
4130
4131 torture_assert(tctx,
4132 test_QueryUserInfo_acct_flags(b, tctx, user_handle, &acct_flags), "");
4133 torture_assert_int_equal(tctx, acct_flags & ACB_AUTOLOCK, 0,
4134 "expected account not to be locked");
4135
4136 return true;
4137 }
4138
4139 static bool test_Password_lockout_wrap(struct dcerpc_pipe *p,
4140 struct torture_context *tctx,
4141 uint32_t acct_flags,
4142 const char *acct_name,
4143 struct policy_handle *domain_handle,
4144 struct policy_handle *user_handle,
4145 char **password,
4146 struct cli_credentials *machine_credentials)
4147 {
4148 union samr_DomainInfo *q_info, s_info;
4149 struct samr_DomInfo1 info1, _info1;
4150 struct samr_DomInfo12 info12, _info12;
4151 bool ret = true;
4152 struct dcerpc_binding_handle *b = p->binding_handle;
4153 struct dcerpc_pipe *np;
4154 int i;
4155
4156 struct {
4157 const char *comment;
4158 bool disabled;
4159 bool interactive;
4160 NTSTATUS expected_success_status;
4161 } creds[] = {
4162 {
4163 .comment = "network logon (disabled account)",
4164 .disabled = true,
4165 .interactive = false,
4166 .expected_success_status= NT_STATUS_ACCOUNT_DISABLED
4167 },
4168 {
4169 .comment = "network logon (enabled account)",
4170 .disabled = false,
4171 .interactive = false,
4172 .expected_success_status= NT_STATUS_OK
4173 },
4174 {
4175 .comment = "interactive logon (disabled account)",
4176 .disabled = true,
4177 .interactive = true,
4178 .expected_success_status= NT_STATUS_ACCOUNT_DISABLED
4179 },
4180 {
4181 .comment = "interactive logon (enabled account)",
4182 .disabled = false,
4183 .interactive = true,
4184 .expected_success_status= NT_STATUS_OK
4185 },
4186 };
4187
4188 torture_assert(tctx, setup_schannel_netlogon_pipe(tctx, machine_credentials, &np), "");
4189
4190 /* backup old policies */
4191
4192 torture_assert(tctx,
4193 test_QueryDomainInfo2_level(b, tctx, domain_handle,
4194 DomainPasswordInformation, &q_info),
4195 "failed to query domain info level 1");
4196
4197 info1 = q_info->info1;
4198 _info1 = info1;
4199
4200 torture_assert(tctx,
4201 test_QueryDomainInfo2_level(b, tctx, domain_handle,
4202 DomainLockoutInformation, &q_info),
4203 "failed to query domain info level 12");
4204
4205 info12 = q_info->info12;
4206 _info12 = info12;
4207
4208 /* run tests */
4209
4210 for (i=0; i < ARRAY_SIZE(creds); i++) {
4211
4212 /* skip trust tests for now */
4213 if (acct_flags & ACB_WSTRUST ||
4214 acct_flags & ACB_SVRTRUST ||
4215 acct_flags & ACB_DOMTRUST) {
4216 continue;
4217 }
4218
4219 ret &= test_Password_lockout(p, np, tctx, acct_flags, acct_name,
4220 domain_handle, user_handle, password,
4221 machine_credentials,
4222 creds[i].comment,
4223 creds[i].disabled,
4224 creds[i].interactive,
4225 creds[i].expected_success_status,
4226 &_info1, &_info12);
4227 if (!ret) {
4228 torture_warning(tctx, "TEST #%d (%s) failed\n", i, creds[i].comment);
4229 } else {
4230 torture_comment(tctx, "TEST #%d (%s) succeeded\n", i, creds[i].comment);
4231 }
4232 }
4233
4234 /* restore policies */
4235
4236 s_info.info1 = info1;
4237
4238 torture_assert(tctx,
4239 test_SetDomainInfo(b, tctx, domain_handle,
4240 DomainPasswordInformation, &s_info),
4241 "failed to set password information");
4242
4243 s_info.info12 = info12;
4244
4245 torture_assert(tctx,
4246 test_SetDomainInfo(b, tctx, domain_handle,
4247 DomainLockoutInformation, &s_info),
4248 "failed to set lockout information");
4249
4250 return ret;
4251 }
4252
4253 static bool test_DeleteUser_with_privs(struct dcerpc_pipe *p,
4254 struct dcerpc_pipe *lp,
4255 struct torture_context *tctx,
4256 struct policy_handle *domain_handle,
4257 struct policy_handle *lsa_handle,
4258 struct policy_handle *user_handle,
4259 const struct dom_sid *domain_sid,
4260 uint32_t rid,
4261 struct cli_credentials *machine_credentials)
4262 {
4263 bool ret = true;
4264 struct dcerpc_binding_handle *b = p->binding_handle;
4265 struct dcerpc_binding_handle *lb = lp->binding_handle;
4266
4267 struct policy_handle lsa_acct_handle;
4268 struct dom_sid *user_sid;
4269
4270 user_sid = dom_sid_add_rid(tctx, domain_sid, rid);
4271
4272 {
4273 struct lsa_EnumAccountRights r;
4274 struct lsa_RightSet rights;
4275
4276 torture_comment(tctx, "Testing LSA EnumAccountRights\n");
4277
4278 r.in.handle = lsa_handle;
4279 r.in.sid = user_sid;
4280 r.out.rights = &rights;
4281
4282 torture_assert_ntstatus_ok(tctx, dcerpc_lsa_EnumAccountRights_r(lb, tctx, &r),
4283 "lsa_EnumAccountRights failed");
4284 torture_assert_ntstatus_equal(tctx, r.out.result, NT_STATUS_OBJECT_NAME_NOT_FOUND,
4285 "Expected enum rights for account to fail");
4286 }
4287
4288 {
4289 struct lsa_RightSet rights;
4290 struct lsa_StringLarge names[2];
4291 struct lsa_AddAccountRights r;
4292
4293 torture_comment(tctx, "Testing LSA AddAccountRights\n");
4294
4295 init_lsa_StringLarge(&names[0], "SeMachineAccountPrivilege");
4296 init_lsa_StringLarge(&names[1], NULL);
4297
4298 rights.count = 1;
4299 rights.names = names;
4300
4301 r.in.handle = lsa_handle;
4302 r.in.sid = user_sid;
4303 r.in.rights = &rights;
4304
4305 torture_assert_ntstatus_ok(tctx, dcerpc_lsa_AddAccountRights_r(lb, tctx, &r),
4306 "lsa_AddAccountRights failed");
4307 torture_assert_ntstatus_ok(tctx, r.out.result,
4308 "Failed to add privileges");
4309 }
4310
4311 {
4312 struct lsa_EnumAccounts r;
4313 uint32_t resume_handle = 0;
4314 struct lsa_SidArray lsa_sid_array;
4315 int i;
4316 bool found_sid = false;
4317
4318 torture_comment(tctx, "Testing LSA EnumAccounts\n");
4319
4320 r.in.handle = lsa_handle;
4321 r.in.num_entries = 0x1000;
4322 r.in.resume_handle = &resume_handle;
4323 r.out.sids = &lsa_sid_array;
4324 r.out.resume_handle = &resume_handle;
4325
4326 torture_assert_ntstatus_ok(tctx, dcerpc_lsa_EnumAccounts_r(lb, tctx, &r),
4327 "lsa_EnumAccounts failed");
4328 torture_assert_ntstatus_ok(tctx, r.out.result,
4329 "Failed to enum accounts");
4330
4331 for (i=0; i < lsa_sid_array.num_sids; i++) {
4332 if (dom_sid_equal(user_sid, lsa_sid_array.sids[i].sid)) {
4333 found_sid = true;
4334 }
4335 }
4336
4337 torture_assert(tctx, found_sid,
4338 "failed to list privileged account");
4339 }
4340
4341 {
4342 struct lsa_EnumAccountRights r;
4343 struct lsa_RightSet user_rights;
4344
4345 torture_comment(tctx, "Testing LSA EnumAccountRights\n");
4346
4347 r.in.handle = lsa_handle;
4348 r.in.sid = user_sid;
4349 r.out.rights = &user_rights;
4350
4351 torture_assert_ntstatus_ok(tctx, dcerpc_lsa_EnumAccountRights_r(lb, tctx, &r),
4352 "lsa_EnumAccountRights failed");
4353 torture_assert_ntstatus_ok(tctx, r.out.result,
4354 "Failed to enum rights for account");
4355
4356 if (user_rights.count < 1) {
4357 torture_warning(tctx, "failed to find newly added rights");
4358 return false;
4359 }
4360 }
4361
4362 {
4363 struct lsa_OpenAccount r;
4364
4365 torture_comment(tctx, "Testing LSA OpenAccount\n");
4366
4367 r.in.handle = lsa_handle;
4368 r.in.sid = user_sid;
4369 r.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
4370 r.out.acct_handle = &lsa_acct_handle;
4371
4372 torture_assert_ntstatus_ok(tctx, dcerpc_lsa_OpenAccount_r(lb, tctx, &r),
4373 "lsa_OpenAccount failed");
4374 torture_assert_ntstatus_ok(tctx, r.out.result,
4375 "Failed to open lsa account");
4376 }
4377
4378 {
4379 struct lsa_GetSystemAccessAccount r;
4380 uint32_t access_mask;
4381
4382 torture_comment(tctx, "Testing LSA GetSystemAccessAccount\n");
4383
4384 r.in.handle = &lsa_acct_handle;
4385 r.out.access_mask = &access_mask;
4386
4387 torture_assert_ntstatus_ok(tctx, dcerpc_lsa_GetSystemAccessAccount_r(lb, tctx, &r),
4388 "lsa_GetSystemAccessAccount failed");
4389 torture_assert_ntstatus_ok(tctx, r.out.result,
4390 "Failed to get lsa system access account");
4391 }
4392
4393 {
4394 struct lsa_Close r;
4395
4396 torture_comment(tctx, "Testing LSA Close\n");
4397
4398 r.in.handle = &lsa_acct_handle;
4399 r.out.handle = &lsa_acct_handle;
4400
4401 torture_assert_ntstatus_ok(tctx, dcerpc_lsa_Close_r(lb, tctx, &r),
4402 "lsa_Close failed");
4403 torture_assert_ntstatus_ok(tctx, r.out.result,
4404 "Failed to close lsa");
4405 }
4406
4407 {
4408 struct samr_DeleteUser r;
4409
4410 torture_comment(tctx, "Testing SAMR DeleteUser\n");
4411
4412 r.in.user_handle = user_handle;
4413 r.out.user_handle = user_handle;
4414
4415 torture_assert_ntstatus_ok(tctx, dcerpc_samr_DeleteUser_r(b, tctx, &r),
4416 "DeleteUser failed");
4417 torture_assert_ntstatus_ok(tctx, r.out.result,
4418 "DeleteUser failed");
4419 }
4420
4421 {
4422 struct lsa_EnumAccounts r;
4423 uint32_t resume_handle = 0;
4424 struct lsa_SidArray lsa_sid_array;
4425 int i;
4426 bool found_sid = false;
4427
4428 torture_comment(tctx, "Testing LSA EnumAccounts\n");
4429
4430 r.in.handle = lsa_handle;
4431 r.in.num_entries = 0x1000;
4432 r.in.resume_handle = &resume_handle;
4433 r.out.sids = &lsa_sid_array;
4434 r.out.resume_handle = &resume_handle;
4435
4436 torture_assert_ntstatus_ok(tctx, dcerpc_lsa_EnumAccounts_r(lb, tctx, &r),
4437 "lsa_EnumAccounts failed");
4438 torture_assert_ntstatus_ok(tctx, r.out.result,
4439 "Failed to enum accounts");
4440
4441 for (i=0; i < lsa_sid_array.num_sids; i++) {
4442 if (dom_sid_equal(user_sid, lsa_sid_array.sids[i].sid)) {
4443 found_sid = true;
4444 }
4445 }
4446
4447 torture_assert(tctx, found_sid,
4448 "failed to list privileged account");
4449 }
4450
4451 {
4452 struct lsa_EnumAccountRights r;
4453 struct lsa_RightSet user_rights;
4454
4455 torture_comment(tctx, "Testing LSA EnumAccountRights\n");
4456
4457 r.in.handle = lsa_handle;
4458 r.in.sid = user_sid;
4459 r.out.rights = &user_rights;
4460
4461 torture_assert_ntstatus_ok(tctx, dcerpc_lsa_EnumAccountRights_r(lb, tctx, &r),
4462 "lsa_EnumAccountRights failed");
4463 torture_assert_ntstatus_ok(tctx, r.out.result,
4464 "Failed to enum rights for account");
4465
4466 if (user_rights.count < 1) {
4467 torture_warning(tctx, "failed to find newly added rights");
4468 return false;
4469 }
4470 }
4471
4472 {
4473 struct lsa_OpenAccount r;
4474
4475 torture_comment(tctx, "Testing LSA OpenAccount\n");
4476
4477 r.in.handle = lsa_handle;
4478 r.in.sid = user_sid;
4479 r.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
4480 r.out.acct_handle = &lsa_acct_handle;
4481
4482 torture_assert_ntstatus_ok(tctx, dcerpc_lsa_OpenAccount_r(lb, tctx, &r),
4483 "lsa_OpenAccount failed");
4484 torture_assert_ntstatus_ok(tctx, r.out.result,
4485 "Failed to open lsa account");
4486 }
4487
4488 {
4489 struct lsa_GetSystemAccessAccount r;
4490 uint32_t access_mask;
4491
4492 torture_comment(tctx, "Testing LSA GetSystemAccessAccount\n");
4493
4494 r.in.handle = &lsa_acct_handle;
4495 r.out.access_mask = &access_mask;
4496
4497 torture_assert_ntstatus_ok(tctx, dcerpc_lsa_GetSystemAccessAccount_r(lb, tctx, &r),
4498 "lsa_GetSystemAccessAccount failed");
4499 torture_assert_ntstatus_ok(tctx, r.out.result,
4500 "Failed to get lsa system access account");
4501 }
4502
4503 {
4504 struct lsa_DeleteObject r;
4505
4506 torture_comment(tctx, "Testing LSA DeleteObject\n");
4507
4508 r.in.handle = &lsa_acct_handle;
4509 r.out.handle = &lsa_acct_handle;
4510
4511 torture_assert_ntstatus_ok(tctx, dcerpc_lsa_DeleteObject_r(lb, tctx, &r),
4512 "lsa_DeleteObject failed");
4513 torture_assert_ntstatus_ok(tctx, r.out.result,
4514 "Failed to delete object");
4515 }
4516
4517 {
4518 struct lsa_EnumAccounts r;
4519 uint32_t resume_handle = 0;
4520 struct lsa_SidArray lsa_sid_array;
4521 int i;
4522 bool found_sid = false;
4523
4524 torture_comment(tctx, "Testing LSA EnumAccounts\n");
4525
4526 r.in.handle = lsa_handle;
4527 r.in.num_entries = 0x1000;
4528 r.in.resume_handle = &resume_handle;
4529 r.out.sids = &lsa_sid_array;
4530 r.out.resume_handle = &resume_handle;
4531
4532 torture_assert_ntstatus_ok(tctx, dcerpc_lsa_EnumAccounts_r(lb, tctx, &r),
4533 "lsa_EnumAccounts failed");
4534 torture_assert_ntstatus_ok(tctx, r.out.result,
4535 "Failed to enum accounts");
4536
4537 for (i=0; i < lsa_sid_array.num_sids; i++) {
4538 if (dom_sid_equal(user_sid, lsa_sid_array.sids[i].sid)) {
4539 found_sid = true;
4540 }
4541 }
4542
4543 torture_assert(tctx, !found_sid,
4544 "should not have listed privileged account");
4545 }
4546
4547 {
4548 struct lsa_EnumAccountRights r;
4549 struct lsa_RightSet user_rights;
4550
4551 torture_comment(tctx, "Testing LSA EnumAccountRights\n");
4552
4553 r.in.handle = lsa_handle;
4554 r.in.sid = user_sid;
4555 r.out.rights = &user_rights;
4556
4557 torture_assert_ntstatus_ok(tctx, dcerpc_lsa_EnumAccountRights_r(lb, tctx, &r),
4558 "lsa_EnumAccountRights failed");
4559 torture_assert_ntstatus_equal(tctx, r.out.result, NT_STATUS_OBJECT_NAME_NOT_FOUND,
4560 "Failed to enum rights for account");
4561 }
4562
4563 return ret;
4564 }
4565
4566 static bool test_user_ops(struct dcerpc_pipe *p,
4567 struct torture_context *tctx,
4568 struct policy_handle *user_handle,
4569 struct policy_handle *domain_handle,
4570 const struct dom_sid *domain_sid,
4571 uint32_t base_acct_flags,
4572 const char *base_acct_name, enum torture_samr_choice which_ops,
4573 struct cli_credentials *machine_credentials)
4574 {
4575 char *password = NULL;
4576 struct samr_QueryUserInfo q;
4577 union samr_UserInfo *info;
4578 NTSTATUS status;
4579 struct dcerpc_binding_handle *b = p->binding_handle;
4580
4581 bool ret = true;
4582 int i;
4583 uint32_t rid;
4584 const uint32_t password_fields[] = {
4585 SAMR_FIELD_NT_PASSWORD_PRESENT,
4586 SAMR_FIELD_LM_PASSWORD_PRESENT,
4587 SAMR_FIELD_NT_PASSWORD_PRESENT | SAMR_FIELD_LM_PASSWORD_PRESENT,
4588 0
4589 };
4590
4591 status = test_LookupName(b, tctx, domain_handle, base_acct_name, &rid);
4592 if (!NT_STATUS_IS_OK(status)) {
4593 ret = false;
4594 }
4595
4596 switch (which_ops) {
4597 case TORTURE_SAMR_USER_ATTRIBUTES:
4598 if (!test_QuerySecurity(b, tctx, user_handle)) {
4599 ret = false;
4600 }
4601
4602 if (!test_QueryUserInfo(b, tctx, user_handle)) {
4603 ret = false;
4604 }
4605
4606 if (!test_QueryUserInfo2(b, tctx, user_handle)) {
4607 ret = false;
4608 }
4609
4610 if (!test_SetUserInfo(b, tctx, user_handle, base_acct_flags,
4611 base_acct_name)) {
4612 ret = false;
4613 }
4614
4615 if (!test_GetUserPwInfo(b, tctx, user_handle)) {
4616 ret = false;
4617 }
4618
4619 if (!test_TestPrivateFunctionsUser(b, tctx, user_handle)) {
4620 ret = false;
4621 }
4622
4623 if (!test_SetUserPass(p, tctx, user_handle, &password)) {
4624 ret = false;
4625 }
4626 break;
4627 case TORTURE_SAMR_PASSWORDS:
4628 if (base_acct_flags & (ACB_WSTRUST|ACB_DOMTRUST|ACB_SVRTRUST)) {
4629 char simple_pass[9];
4630 char *v = generate_random_str(tctx, 1);
4631
4632 ZERO_STRUCT(simple_pass);
4633 memset(simple_pass, *v, sizeof(simple_pass) - 1);
4634
4635 torture_comment(tctx, "Testing machine account password policy rules\n");
4636
4637 /* Workstation trust accounts don't seem to need to honour password quality policy */
4638 if (!test_SetUserPassEx(p, tctx, user_handle, true, &password)) {
4639 ret = false;
4640 }
4641
4642 if (!test_ChangePasswordUser2(p, tctx, base_acct_name, &password, simple_pass, false)) {
4643 ret = false;
4644 }
4645
4646 /* reset again, to allow another 'user' password change */
4647 if (!test_SetUserPassEx(p, tctx, user_handle, true, &password)) {
4648 ret = false;
4649 }
4650
4651 /* Try a 'short' password */
4652 if (!test_ChangePasswordUser2(p, tctx, base_acct_name, &password, samr_rand_pass(tctx, 4), false)) {
4653 ret = false;
4654 }
4655
4656 /* Try a compleatly random password */
4657 if (!test_ChangePasswordRandomBytes(p, tctx, base_acct_name, user_handle, &password)) {
4658 ret = false;
4659 }
4660 }
4661
4662 for (i = 0; password_fields[i]; i++) {
4663 if (!test_SetUserPass_23(p, tctx, user_handle, password_fields[i], &password)) {
4664 ret = false;
4665 }
4666
4667 /* check it was set right */
4668 if (!test_ChangePasswordUser3(p, tctx, base_acct_name, 0, &password, NULL, 0, false)) {
4669 ret = false;
4670 }
4671 }
4672
4673 for (i = 0; password_fields[i]; i++) {
4674 if (!test_SetUserPass_25(p, tctx, user_handle, password_fields[i], &password)) {
4675 ret = false;
4676 }
4677
4678 /* check it was set right */
4679 if (!test_ChangePasswordUser3(p, tctx, base_acct_name, 0, &password, NULL, 0, false)) {
4680 ret = false;
4681 }
4682 }
4683
4684 if (!test_SetUserPassEx(p, tctx, user_handle, false, &password)) {
4685 ret = false;
4686 }
4687
4688 if (!test_ChangePassword(p, tctx, base_acct_name, domain_handle, &password)) {
4689 ret = false;
4690 }
4691
4692 if (!test_SetUserPass_18(p, tctx, user_handle, &password)) {
4693 ret = false;
4694 }
4695
4696 if (!test_ChangePasswordUser3(p, tctx, base_acct_name, 0, &password, NULL, 0, false)) {
4697 ret = false;
4698 }
4699
4700 for (i = 0; password_fields[i]; i++) {
4701
4702 if (password_fields[i] == SAMR_FIELD_LM_PASSWORD_PRESENT) {
4703 /* we need to skip as that would break
4704 * the ChangePasswordUser3 verify */
4705 continue;
4706 }
4707
4708 if (!test_SetUserPass_21(p, tctx, user_handle, password_fields[i], &password)) {
4709 ret = false;
4710 }
4711
4712 /* check it was set right */
4713 if (!test_ChangePasswordUser3(p, tctx, base_acct_name, 0, &password, NULL, 0, false)) {
4714 ret = false;
4715 }
4716 }
4717
4718 q.in.user_handle = user_handle;
4719 q.in.level = 5;
4720 q.out.info = &info;
4721
4722 torture_assert_ntstatus_ok(tctx, dcerpc_samr_QueryUserInfo_r(b, tctx, &q),
4723 "QueryUserInfo failed");
4724 if (!NT_STATUS_IS_OK(q.out.result)) {
4725 torture_warning(tctx, "QueryUserInfo level %u failed - %s\n",
4726 q.in.level, nt_errstr(q.out.result));
4727 ret = false;
4728 } else {
4729 uint32_t expected_flags = (base_acct_flags | ACB_PWNOTREQ | ACB_DISABLED);
4730 if ((info->info5.acct_flags) != expected_flags) {
4731 torture_warning(tctx, "QueryUserInfo level 5 failed, it returned 0x%08x when we expected flags of 0x%08x\n",
4732 info->info5.acct_flags,
4733 expected_flags);
4734 /* FIXME: GD */
4735 if (!torture_setting_bool(tctx, "samba3", false)) {
4736 ret = false;
4737 }
4738 }
4739 if (info->info5.rid != rid) {
4740 torture_warning(tctx, "QueryUserInfo level 5 failed, it returned %u when we expected rid of %u\n",
4741 info->info5.rid, rid);
4742
4743 }
4744 }
4745
4746 break;
4747
4748 case TORTURE_SAMR_PASSWORDS_PWDLASTSET:
4749
4750 /* test last password change timestamp behaviour */
4751 if (!test_SetPassword_pwdlastset(p, tctx, base_acct_flags,
4752 base_acct_name,
4753 user_handle, &password,
4754 machine_credentials)) {
4755 ret = false;
4756 }
4757
4758 if (ret == true) {
4759 torture_comment(tctx, "pwdLastSet test succeeded\n");
4760 } else {
4761 torture_warning(tctx, "pwdLastSet test failed\n");
4762 }
4763
4764 break;
4765
4766 case TORTURE_SAMR_PASSWORDS_BADPWDCOUNT:
4767
4768 /* test bad pwd count change behaviour */
4769 if (!test_Password_badpwdcount_wrap(p, tctx, base_acct_flags,
4770 base_acct_name,
4771 domain_handle,
4772 user_handle, &password,
4773 machine_credentials)) {
4774 ret = false;
4775 }
4776
4777 if (ret == true) {
4778 torture_comment(tctx, "badPwdCount test succeeded\n");
4779 } else {
4780 torture_warning(tctx, "badPwdCount test failed\n");
4781 }
4782
4783 break;
4784
4785 case TORTURE_SAMR_PASSWORDS_LOCKOUT:
4786
4787 if (!test_Password_lockout_wrap(p, tctx, base_acct_flags,
4788 base_acct_name,
4789 domain_handle,
4790 user_handle, &password,
4791 machine_credentials))
4792 {
4793 ret = false;
4794 }
4795
4796 if (ret == true) {
4797 torture_comment(tctx, "lockout test succeeded\n");
4798 } else {
4799 torture_warning(tctx, "lockout test failed\n");
4800 }
4801
4802 break;
4803
4804
4805 case TORTURE_SAMR_USER_PRIVILEGES: {
4806
4807 struct dcerpc_pipe *lp;
4808 struct policy_handle *lsa_handle;
4809 struct dcerpc_binding_handle *lb;
4810
4811 status = torture_rpc_connection(tctx, &lp, &ndr_table_lsarpc);
4812 torture_assert_ntstatus_ok(tctx, status, "Failed to open LSA pipe");
4813 lb = lp->binding_handle;
4814
4815 if (!test_lsa_OpenPolicy2(lb, tctx, &lsa_handle)) {
4816 ret = false;
4817 }
4818
4819 if (!test_DeleteUser_with_privs(p, lp, tctx,
4820 domain_handle, lsa_handle, user_handle,
4821 domain_sid, rid,
4822 machine_credentials)) {
4823 ret = false;
4824 }
4825
4826 if (!test_lsa_Close(lb, tctx, lsa_handle)) {
4827 ret = false;
4828 }
4829
4830 if (!ret) {
4831 torture_warning(tctx, "privileged user delete test failed\n");
4832 }
4833
4834 break;
4835 }
4836 case TORTURE_SAMR_OTHER:
4837 case TORTURE_SAMR_MANY_ACCOUNTS:
4838 case TORTURE_SAMR_MANY_GROUPS:
4839 case TORTURE_SAMR_MANY_ALIASES:
4840 /* We just need the account to exist */
4841 break;
4842 }
4843 return ret;
4844 }
4845
4846 static bool test_alias_ops(struct dcerpc_binding_handle *b,
4847 struct torture_context *tctx,
4848 struct policy_handle *alias_handle,
4849 const struct dom_sid *domain_sid)
4850 {
4851 bool ret = true;
4852
4853 if (!torture_setting_bool(tctx, "samba3", false)) {
4854 if (!test_QuerySecurity(b, tctx, alias_handle)) {
4855 ret = false;
4856 }
4857 }
4858
4859 if (!test_QueryAliasInfo(b, tctx, alias_handle)) {
4860 ret = false;
4861 }
4862
4863 if (!test_SetAliasInfo(b, tctx, alias_handle)) {
4864 ret = false;
4865 }
4866
4867 if (!test_AddMemberToAlias(b, tctx, alias_handle, domain_sid)) {
4868 ret = false;
4869 }
4870
4871 if (torture_setting_bool(tctx, "samba3", false) ||
4872 torture_setting_bool(tctx, "samba4", false)) {
4873 torture_comment(tctx, "skipping MultipleMembers Alias tests against Samba\n");
4874 return ret;
4875 }
4876
4877 if (!test_AddMultipleMembersToAlias(b, tctx, alias_handle)) {
4878 ret = false;
4879 }
4880
4881 return ret;
4882 }
4883
4884
4885 static bool test_DeleteUser(struct dcerpc_binding_handle *b,
4886 struct torture_context *tctx,
4887 struct policy_handle *user_handle)
4888 {
4889 struct samr_DeleteUser d;
4890 torture_comment(tctx, "Testing DeleteUser\n");
4891
4892 d.in.user_handle = user_handle;
4893 d.out.user_handle = user_handle;
4894
4895 torture_assert_ntstatus_ok(tctx, dcerpc_samr_DeleteUser_r(b, tctx, &d),
4896 "DeleteUser failed");
4897 torture_assert_ntstatus_ok(tctx, d.out.result, "DeleteUser");
4898
4899 return true;
4900 }
4901
4902 bool test_DeleteUser_byname(struct dcerpc_binding_handle *b,
4903 struct torture_context *tctx,
4904 struct policy_handle *handle, const char *name)
4905 {
4906 NTSTATUS status;
4907 struct samr_DeleteUser d;
4908 struct policy_handle user_handle;
4909 uint32_t rid;
4910
4911 status = test_LookupName(b, tctx, handle, name, &rid);
4912 if (!NT_STATUS_IS_OK(status)) {
4913 goto failed;
4914 }
4915
4916 status = test_OpenUser_byname(b, tctx, handle, name, &user_handle);
4917 if (!NT_STATUS_IS_OK(status)) {
4918 goto failed;
4919 }
4920
4921 d.in.user_handle = &user_handle;
4922 d.out.user_handle = &user_handle;
4923 torture_assert_ntstatus_ok(tctx, dcerpc_samr_DeleteUser_r(b, tctx, &d),
4924 "DeleteUser failed");
4925 if (!NT_STATUS_IS_OK(d.out.result)) {
4926 status = d.out.result;
4927 goto failed;
4928 }
4929
4930 return true;
4931
4932 failed:
4933 torture_warning(tctx, "DeleteUser_byname(%s) failed - %s\n", name, nt_errstr(status));
4934 return false;
4935 }
4936
4937
4938 static bool test_DeleteGroup_byname(struct dcerpc_binding_handle *b,
4939 struct torture_context *tctx,
4940 struct policy_handle *handle, const char *name)
4941 {
4942 NTSTATUS status;
4943 struct samr_OpenGroup r;
4944 struct samr_DeleteDomainGroup d;
4945 struct policy_handle group_handle;
4946 uint32_t rid;
4947
4948 status = test_LookupName(b, tctx, handle, name, &rid);
4949 if (!NT_STATUS_IS_OK(status)) {
4950 goto failed;
4951 }
4952
4953 r.in.domain_handle = handle;
4954 r.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
4955 r.in.rid = rid;
4956 r.out.group_handle = &group_handle;
4957 torture_assert_ntstatus_ok(tctx, dcerpc_samr_OpenGroup_r(b, tctx, &r),
4958 "OpenGroup failed");
4959 if (!NT_STATUS_IS_OK(r.out.result)) {
4960 status = r.out.result;
4961 goto failed;
4962 }
4963
4964 d.in.group_handle = &group_handle;
4965 d.out.group_handle = &group_handle;
4966 torture_assert_ntstatus_ok(tctx, dcerpc_samr_DeleteDomainGroup_r(b, tctx, &d),
4967 "DeleteDomainGroup failed");
4968 if (!NT_STATUS_IS_OK(d.out.result)) {
4969 status = d.out.result;
4970 goto failed;
4971 }
4972
4973 return true;
4974
4975 failed:
4976 torture_warning(tctx, "DeleteGroup_byname(%s) failed - %s\n", name, nt_errstr(status));
4977 return false;
4978 }
4979
4980
4981 static bool test_DeleteAlias_byname(struct dcerpc_binding_handle *b,
4982 struct torture_context *tctx,
4983 struct policy_handle *domain_handle,
4984 const char *name)
4985 {
4986 NTSTATUS status;
4987 struct samr_OpenAlias r;
4988 struct samr_DeleteDomAlias d;
4989 struct policy_handle alias_handle;
4990 uint32_t rid;
4991
4992 torture_comment(tctx, "Testing DeleteAlias_byname\n");
4993
4994 status = test_LookupName(b, tctx, domain_handle, name, &rid);
4995 if (!NT_STATUS_IS_OK(status)) {
4996 goto failed;
4997 }
4998
4999 r.in.domain_handle = domain_handle;
5000 r.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
5001 r.in.rid = rid;
5002 r.out.alias_handle = &alias_handle;
5003 torture_assert_ntstatus_ok(tctx, dcerpc_samr_OpenAlias_r(b, tctx, &r),
5004 "OpenAlias failed");
5005 if (!NT_STATUS_IS_OK(r.out.result)) {
5006 status = r.out.result;
5007 goto failed;
5008 }
5009
5010 d.in.alias_handle = &alias_handle;
5011 d.out.alias_handle = &alias_handle;
5012 torture_assert_ntstatus_ok(tctx, dcerpc_samr_DeleteDomAlias_r(b, tctx, &d),
5013 "DeleteDomAlias failed");
5014 if (!NT_STATUS_IS_OK(d.out.result)) {
5015 status = d.out.result;
5016 goto failed;
5017 }
5018
5019 return true;
5020
5021 failed:
5022 torture_warning(tctx, "DeleteAlias_byname(%s) failed - %s\n", name, nt_errstr(status));
5023 return false;
5024 }
5025
5026 static bool test_DeleteAlias(struct dcerpc_binding_handle *b,
5027 struct torture_context *tctx,
5028 struct policy_handle *alias_handle)
5029 {
5030 struct samr_DeleteDomAlias d;
5031 bool ret = true;
5032
5033 torture_comment(tctx, "Testing DeleteAlias\n");
5034
5035 d.in.alias_handle = alias_handle;
5036 d.out.alias_handle = alias_handle;
5037
5038 torture_assert_ntstatus_ok(tctx, dcerpc_samr_DeleteDomAlias_r(b, tctx, &d),
5039 "DeleteDomAlias failed");
5040 if (!NT_STATUS_IS_OK(d.out.result)) {
5041 torture_warning(tctx, "DeleteAlias failed - %s\n", nt_errstr(d.out.result));
5042 ret = false;
5043 }
5044
5045 return ret;
5046 }
5047
5048 static bool test_CreateAlias(struct dcerpc_binding_handle *b,
5049 struct torture_context *tctx,
5050 struct policy_handle *domain_handle,
5051 const char *alias_name,
5052 struct policy_handle *alias_handle,
5053 const struct dom_sid *domain_sid,
5054 bool test_alias)
5055 {
5056 struct samr_CreateDomAlias r;
5057 struct lsa_String name;
5058 uint32_t rid;
5059 bool ret = true;
5060
5061 init_lsa_String(&name, alias_name);
5062 r.in.domain_handle = domain_handle;
5063 r.in.alias_name = &name;
5064 r.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
5065 r.out.alias_handle = alias_handle;
5066 r.out.rid = &rid;
5067
5068 torture_comment(tctx, "Testing CreateAlias (%s)\n", r.in.alias_name->string);
5069
5070 torture_assert_ntstatus_ok(tctx, dcerpc_samr_CreateDomAlias_r(b, tctx, &r),
5071 "CreateDomAlias failed");
5072
5073 if (dom_sid_equal(domain_sid, dom_sid_parse_talloc(tctx, SID_BUILTIN))) {
5074 if (NT_STATUS_EQUAL(r.out.result, NT_STATUS_ACCESS_DENIED)) {
5075 torture_comment(tctx, "Server correctly refused create of '%s'\n", r.in.alias_name->string);
5076 return true;
5077 } else {
5078 torture_warning(tctx, "Server should have refused create of '%s', got %s instead\n", r.in.alias_name->string,
5079 nt_errstr(r.out.result));
5080 return false;
5081 }
5082 }
5083
5084 if (NT_STATUS_EQUAL(r.out.result, NT_STATUS_ALIAS_EXISTS)) {
5085 if (!test_DeleteAlias_byname(b, tctx, domain_handle, r.in.alias_name->string)) {
5086 return false;
5087 }
5088 torture_assert_ntstatus_ok(tctx, dcerpc_samr_CreateDomAlias_r(b, tctx, &r),
5089 "CreateDomAlias failed");
5090 }
5091
5092 if (!NT_STATUS_IS_OK(r.out.result)) {
5093 torture_warning(tctx, "CreateAlias failed - %s\n", nt_errstr(r.out.result));
5094 return false;
5095 }
5096
5097 if (!test_alias) {
5098 return ret;
5099 }
5100
5101 if (!test_alias_ops(b, tctx, alias_handle, domain_sid)) {
5102 ret = false;
5103 }
5104
5105 return ret;
5106 }
5107
5108 static bool test_ChangePassword(struct dcerpc_pipe *p,
5109 struct torture_context *tctx,
5110 const char *acct_name,
5111 struct policy_handle *domain_handle, char **password)
5112 {
5113 bool ret = true;
5114 struct dcerpc_binding_handle *b = p->binding_handle;
5115
5116 if (!*password) {
5117 return false;
5118 }
5119
5120 if (!test_ChangePasswordUser(b, tctx, acct_name, domain_handle, password)) {
5121 ret = false;
5122 }
5123
5124 if (!test_ChangePasswordUser2(p, tctx, acct_name, password, 0, true)) {
5125 ret = false;
5126 }
5127
5128 if (!test_OemChangePasswordUser2(p, tctx, acct_name, domain_handle, password)) {
5129 ret = false;
5130 }
5131
5132 /* test what happens when setting the old password again */
5133 if (!test_ChangePasswordUser3(p, tctx, acct_name, 0, password, *password, 0, true)) {
5134 ret = false;
5135 }
5136
5137 {
5138 char simple_pass[9];
5139 char *v = generate_random_str(tctx, 1);
5140
5141 ZERO_STRUCT(simple_pass);
5142 memset(simple_pass, *v, sizeof(simple_pass) - 1);
5143
5144 /* test what happens when picking a simple password */
5145 if (!test_ChangePasswordUser3(p, tctx, acct_name, 0, password, simple_pass, 0, true)) {
5146 ret = false;
5147 }
5148 }
5149
5150 /* set samr_SetDomainInfo level 1 with min_length 5 */
5151 {
5152 struct samr_QueryDomainInfo r;
5153 union samr_DomainInfo *info = NULL;
5154 struct samr_SetDomainInfo s;
5155 uint16_t len_old, len;
5156 uint32_t pwd_prop_old;
5157 int64_t min_pwd_age_old;
5158
5159 len = 5;
5160
5161 r.in.domain_handle = domain_handle;
5162 r.in.level = 1;
5163 r.out.info = &info;
5164
5165 torture_comment(tctx, "Testing samr_QueryDomainInfo level 1\n");
5166 torture_assert_ntstatus_ok(tctx, dcerpc_samr_QueryDomainInfo_r(b, tctx, &r),
5167 "QueryDomainInfo failed");
5168 if (!NT_STATUS_IS_OK(r.out.result)) {
5169 return false;
5170 }
5171
5172 s.in.domain_handle = domain_handle;
5173 s.in.level = 1;
5174 s.in.info = info;
5175
5176 /* remember the old min length, so we can reset it */
5177 len_old = s.in.info->info1.min_password_length;
5178 s.in.info->info1.min_password_length = len;
5179 pwd_prop_old = s.in.info->info1.password_properties;
5180 /* turn off password complexity checks for this test */
5181 s.in.info->info1.password_properties &= ~DOMAIN_PASSWORD_COMPLEX;
5182
5183 min_pwd_age_old = s.in.info->info1.min_password_age;
5184 s.in.info->info1.min_password_age = 0;
5185
5186 torture_comment(tctx, "Testing samr_SetDomainInfo level 1\n");
5187 torture_assert_ntstatus_ok(tctx, dcerpc_samr_SetDomainInfo_r(b, tctx, &s),
5188 "SetDomainInfo failed");
5189 if (!NT_STATUS_IS_OK(s.out.result)) {
5190 return false;
5191 }
5192
5193 torture_comment(tctx, "calling test_ChangePasswordUser3 with too short password\n");
5194
5195 if (!test_ChangePasswordUser3(p, tctx, acct_name, len - 1, password, NULL, 0, true)) {
5196 ret = false;
5197 }
5198
5199 s.in.info->info1.min_password_length = len_old;
5200 s.in.info->info1.password_properties = pwd_prop_old;
5201 s.in.info->info1.min_password_age = min_pwd_age_old;
5202
5203 torture_comment(tctx, "Testing samr_SetDomainInfo level 1\n");
5204 torture_assert_ntstatus_ok(tctx, dcerpc_samr_SetDomainInfo_r(b, tctx, &s),
5205 "SetDomainInfo failed");
5206 if (!NT_STATUS_IS_OK(s.out.result)) {
5207 return false;
5208 }
5209
5210 }
5211
5212 {
5213 struct samr_OpenUser r;
5214 struct samr_QueryUserInfo q;
5215 union samr_UserInfo *info;
5216 struct samr_LookupNames n;
5217 struct policy_handle user_handle;
5218 struct samr_Ids rids, types;
5219
5220 n.in.domain_handle = domain_handle;
5221 n.in.num_names = 1;
5222 n.in.names = talloc_array(tctx, struct lsa_String, 1);
5223 n.in.names[0].string = acct_name;
5224 n.out.rids = &rids;
5225 n.out.types = &types;
5226
5227 torture_assert_ntstatus_ok(tctx, dcerpc_samr_LookupNames_r(b, tctx, &n),
5228 "LookupNames failed");
5229 if (!NT_STATUS_IS_OK(n.out.result)) {
5230 torture_warning(tctx, "LookupNames failed - %s\n", nt_errstr(n.out.result));
5231 return false;
5232 }
5233
5234 r.in.domain_handle = domain_handle;
5235 r.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
5236 r.in.rid = n.out.rids->ids[0];
5237 r.out.user_handle = &user_handle;
5238
5239 torture_assert_ntstatus_ok(tctx, dcerpc_samr_OpenUser_r(b, tctx, &r),
5240 "OpenUser failed");
5241 if (!NT_STATUS_IS_OK(r.out.result)) {
5242 torture_warning(tctx, "OpenUser(%u) failed - %s\n", n.out.rids->ids[0], nt_errstr(r.out.result));
5243 return false;
5244 }
5245
5246 q.in.user_handle = &user_handle;
5247 q.in.level = 5;
5248 q.out.info = &info;
5249
5250 torture_assert_ntstatus_ok(tctx, dcerpc_samr_QueryUserInfo_r(b, tctx, &q),
5251 "QueryUserInfo failed");
5252 if (!NT_STATUS_IS_OK(q.out.result)) {
5253 torture_warning(tctx, "QueryUserInfo failed - %s\n", nt_errstr(q.out.result));
5254 return false;
5255 }
5256
5257 torture_comment(tctx, "calling test_ChangePasswordUser3 with too early password change\n");
5258
5259 if (!test_ChangePasswordUser3(p, tctx, acct_name, 0, password, NULL,
5260 info->info5.last_password_change, true)) {
5261 ret = false;
5262 }
5263 }
5264
5265 /* we change passwords twice - this has the effect of verifying
5266 they were changed correctly for the final call */
5267 if (!test_ChangePasswordUser3(p, tctx, acct_name, 0, password, NULL, 0, true)) {
5268 ret = false;
5269 }
5270
5271 if (!test_ChangePasswordUser3(p, tctx, acct_name, 0, password, NULL, 0, true)) {
5272 ret = false;
5273 }
5274
5275 return ret;
5276 }
5277
5278 static bool test_CreateUser(struct dcerpc_pipe *p, struct torture_context *tctx,
5279 struct policy_handle *domain_handle,
5280 const char *user_name,
5281 struct policy_handle *user_handle_out,
5282 struct dom_sid *domain_sid,
5283 enum torture_samr_choice which_ops,
5284 struct cli_credentials *machine_credentials,
5285 bool test_user)
5286 {
5287
5288 TALLOC_CTX *user_ctx;
5289
5290 struct samr_CreateUser r;
5291 struct samr_QueryUserInfo q;
5292 union samr_UserInfo *info;
5293 struct samr_DeleteUser d;
5294 uint32_t rid;
5295
5296 /* This call creates a 'normal' account - check that it really does */
5297 const uint32_t acct_flags = ACB_NORMAL;
5298 struct lsa_String name;
5299 bool ret = true;
5300 struct dcerpc_binding_handle *b = p->binding_handle;
5301
5302 struct policy_handle user_handle;
5303 user_ctx = talloc_named(tctx, 0, "test_CreateUser2 per-user context");
5304 init_lsa_String(&name, user_name);
5305
5306 r.in.domain_handle = domain_handle;
5307 r.in.account_name = &name;
5308 r.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
5309 r.out.user_handle = &user_handle;
5310 r.out.rid = &rid;
5311
5312 torture_comment(tctx, "Testing CreateUser(%s)\n", r.in.account_name->string);
5313
5314 torture_assert_ntstatus_ok(tctx, dcerpc_samr_CreateUser_r(b, user_ctx, &r),
5315 "CreateUser failed");
5316
5317 if (dom_sid_equal(domain_sid, dom_sid_parse_talloc(tctx, SID_BUILTIN))) {
5318 if (NT_STATUS_EQUAL(r.out.result, NT_STATUS_ACCESS_DENIED) || NT_STATUS_EQUAL(r.out.result, NT_STATUS_INVALID_PARAMETER)) {
5319 torture_comment(tctx, "Server correctly refused create of '%s'\n", r.in.account_name->string);
5320 return true;
5321 } else {
5322 torture_warning(tctx, "Server should have refused create of '%s', got %s instead\n", r.in.account_name->string,
5323 nt_errstr(r.out.result));
5324 return false;
5325 }
5326 }
5327
5328 if (NT_STATUS_EQUAL(r.out.result, NT_STATUS_USER_EXISTS)) {
5329 if (!test_DeleteUser_byname(b, tctx, domain_handle, r.in.account_name->string)) {
5330 talloc_free(user_ctx);
5331 return false;
5332 }
5333 torture_assert_ntstatus_ok(tctx, dcerpc_samr_CreateUser_r(b, user_ctx, &r),
5334 "CreateUser failed");
5335 }
5336
5337 if (!NT_STATUS_IS_OK(r.out.result)) {
5338 talloc_free(user_ctx);
5339 torture_warning(tctx, "CreateUser failed - %s\n", nt_errstr(r.out.result));
5340 return false;
5341 }
5342
5343 if (!test_user) {
5344 if (user_handle_out) {
5345 *user_handle_out = user_handle;
5346 }
5347 return ret;
5348 }
5349
5350 {
5351 q.in.user_handle = &user_handle;
5352 q.in.level = 16;
5353 q.out.info = &info;
5354
5355 torture_assert_ntstatus_ok(tctx, dcerpc_samr_QueryUserInfo_r(b, user_ctx, &q),
5356 "QueryUserInfo failed");
5357 if (!NT_STATUS_IS_OK(q.out.result)) {
5358 torture_warning(tctx, "QueryUserInfo level %u failed - %s\n",
5359 q.in.level, nt_errstr(q.out.result));
5360 ret = false;
5361 } else {
5362 if ((info->info16.acct_flags & acct_flags) != acct_flags) {
5363 torture_warning(tctx, "QueryUserInfo level 16 failed, it returned 0x%08x when we expected flags of 0x%08x\n",
5364 info->info16.acct_flags,
5365 acct_flags);
5366 ret = false;
5367 }
5368 }
5369
5370 if (!test_user_ops(p, tctx, &user_handle, domain_handle,
5371 domain_sid, acct_flags, name.string, which_ops,
5372 machine_credentials)) {
5373 ret = false;
5374 }
5375
5376 if (user_handle_out) {
5377 *user_handle_out = user_handle;
5378 } else {
5379 torture_comment(tctx, "Testing DeleteUser (createuser test)\n");
5380
5381 d.in.user_handle = &user_handle;
5382 d.out.user_handle = &user_handle;
5383
5384 torture_assert_ntstatus_ok(tctx, dcerpc_samr_DeleteUser_r(b, user_ctx, &d),
5385 "DeleteUser failed");
5386 if (!NT_STATUS_IS_OK(d.out.result)) {
5387 torture_warning(tctx, "DeleteUser failed - %s\n", nt_errstr(d.out.result));
5388 ret = false;
5389 }
5390 }
5391
5392 }
5393
5394 talloc_free(user_ctx);
5395
5396 return ret;
5397 }
5398
5399
5400 static bool test_CreateUser2(struct dcerpc_pipe *p, struct torture_context *tctx,
5401 struct policy_handle *domain_handle,
5402 struct dom_sid *domain_sid,
5403 enum torture_samr_choice which_ops,
5404 struct cli_credentials *machine_credentials)
5405 {
5406 struct samr_CreateUser2 r;
5407 struct samr_QueryUserInfo q;
5408 union samr_UserInfo *info;
5409 struct samr_DeleteUser d;
5410 struct policy_handle user_handle;
5411 uint32_t rid;
5412 struct lsa_String name;
5413 bool ret = true;
5414 int i;
5415 struct dcerpc_binding_handle *b = p->binding_handle;
5416
5417 struct {
5418 uint32_t acct_flags;
5419 const char *account_name;
5420 NTSTATUS nt_status;
5421 } account_types[] = {
5422 { ACB_NORMAL, TEST_ACCOUNT_NAME, NT_STATUS_OK },
5423 { ACB_NORMAL | ACB_DISABLED, TEST_ACCOUNT_NAME, NT_STATUS_INVALID_PARAMETER },
5424 { ACB_NORMAL | ACB_PWNOEXP, TEST_ACCOUNT_NAME, NT_STATUS_INVALID_PARAMETER },
5425 { ACB_WSTRUST, TEST_MACHINENAME, NT_STATUS_OK },
5426 { ACB_WSTRUST | ACB_DISABLED, TEST_MACHINENAME, NT_STATUS_INVALID_PARAMETER },
5427 { ACB_WSTRUST | ACB_PWNOEXP, TEST_MACHINENAME, NT_STATUS_INVALID_PARAMETER },
5428 { ACB_SVRTRUST, TEST_MACHINENAME, NT_STATUS_OK },
5429 { ACB_SVRTRUST | ACB_DISABLED, TEST_MACHINENAME, NT_STATUS_INVALID_PARAMETER },
5430 { ACB_SVRTRUST | ACB_PWNOEXP, TEST_MACHINENAME, NT_STATUS_INVALID_PARAMETER },
5431 { ACB_DOMTRUST, TEST_DOMAINNAME, NT_STATUS_ACCESS_DENIED },
5432 { ACB_DOMTRUST | ACB_DISABLED, TEST_DOMAINNAME, NT_STATUS_INVALID_PARAMETER },
5433 { ACB_DOMTRUST | ACB_PWNOEXP, TEST_DOMAINNAME, NT_STATUS_INVALID_PARAMETER },
5434 { 0, TEST_ACCOUNT_NAME, NT_STATUS_INVALID_PARAMETER },
5435 { ACB_DISABLED, TEST_ACCOUNT_NAME, NT_STATUS_INVALID_PARAMETER },
5436 { 0, NULL, NT_STATUS_INVALID_PARAMETER }
5437 };
5438
5439 for (i = 0; account_types[i].account_name; i++) {
5440 TALLOC_CTX *user_ctx;
5441 uint32_t acct_flags = account_types[i].acct_flags;
5442 uint32_t access_granted;
5443 user_ctx = talloc_named(tctx, 0, "test_CreateUser2 per-user context");
5444 init_lsa_String(&name, account_types[i].account_name);
5445
5446 r.in.domain_handle = domain_handle;
5447 r.in.account_name = &name;
5448 r.in.acct_flags = acct_flags;
5449 r.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
5450 r.out.user_handle = &user_handle;
5451 r.out.access_granted = &access_granted;
5452 r.out.rid = &rid;
5453
5454 torture_comment(tctx, "Testing CreateUser2(%s, 0x%x)\n", r.in.account_name->string, acct_flags);
5455
5456 torture_assert_ntstatus_ok(tctx, dcerpc_samr_CreateUser2_r(b, user_ctx, &r),
5457 "CreateUser2 failed");
5458
5459 if (dom_sid_equal(domain_sid, dom_sid_parse_talloc(tctx, SID_BUILTIN))) {
5460 if (NT_STATUS_EQUAL(r.out.result, NT_STATUS_ACCESS_DENIED) || NT_STATUS_EQUAL(r.out.result, NT_STATUS_INVALID_PARAMETER)) {
5461 torture_comment(tctx, "Server correctly refused create of '%s'\n", r.in.account_name->string);
5462 continue;
5463 } else {
5464 torture_warning(tctx, "Server should have refused create of '%s', got %s instead\n", r.in.account_name->string,
5465 nt_errstr(r.out.result));
5466 ret = false;
5467 continue;
5468 }
5469 }
5470
5471 if (NT_STATUS_EQUAL(r.out.result, NT_STATUS_USER_EXISTS)) {
5472 if (!test_DeleteUser_byname(b, tctx, domain_handle, r.in.account_name->string)) {
5473 talloc_free(user_ctx);
5474 ret = false;
5475 continue;
5476 }
5477 torture_assert_ntstatus_ok(tctx, dcerpc_samr_CreateUser2_r(b, user_ctx, &r),
5478 "CreateUser2 failed");
5479
5480 }
5481 if (!NT_STATUS_EQUAL(r.out.result, account_types[i].nt_status)) {
5482 torture_warning(tctx, "CreateUser2 failed gave incorrect error return - %s (should be %s)\n",
5483 nt_errstr(r.out.result), nt_errstr(account_types[i].nt_status));
5484 ret = false;
5485 }
5486
5487 if (NT_STATUS_IS_OK(r.out.result)) {
5488 q.in.user_handle = &user_handle;
5489 q.in.level = 5;
5490 q.out.info = &info;
5491
5492 torture_assert_ntstatus_ok(tctx, dcerpc_samr_QueryUserInfo_r(b, user_ctx, &q),
5493 "QueryUserInfo failed");
5494 if (!NT_STATUS_IS_OK(q.out.result)) {
5495 torture_warning(tctx, "QueryUserInfo level %u failed - %s\n",
5496 q.in.level, nt_errstr(q.out.result));
5497 ret = false;
5498 } else {
5499 uint32_t expected_flags = (acct_flags | ACB_PWNOTREQ | ACB_DISABLED);
5500 if (acct_flags == ACB_NORMAL) {
5501 expected_flags |= ACB_PW_EXPIRED;
5502 }
5503 if ((info->info5.acct_flags) != expected_flags) {
5504 torture_warning(tctx, "QueryUserInfo level 5 failed, it returned 0x%08x when we expected flags of 0x%08x\n",
5505 info->info5.acct_flags,
5506 expected_flags);
5507 ret = false;
5508 }
5509 switch (acct_flags) {
5510 case ACB_SVRTRUST:
5511 if (info->info5.primary_gid != DOMAIN_RID_DCS) {
5512 torture_warning(tctx, "QueryUserInfo level 5: DC should have had Primary Group %d, got %d\n",
5513 DOMAIN_RID_DCS, info->info5.primary_gid);
5514 ret = false;
5515 }
5516 break;
5517 case ACB_WSTRUST:
5518 if (info->info5.primary_gid != DOMAIN_RID_DOMAIN_MEMBERS) {
5519 torture_warning(tctx, "QueryUserInfo level 5: Domain Member should have had Primary Group %d, got %d\n",
5520 DOMAIN_RID_DOMAIN_MEMBERS, info->info5.primary_gid);
5521 ret = false;
5522 }
5523 break;
5524 case ACB_NORMAL:
5525 if (info->info5.primary_gid != DOMAIN_RID_USERS) {
5526 torture_warning(tctx, "QueryUserInfo level 5: Users should have had Primary Group %d, got %d\n",
5527 DOMAIN_RID_USERS, info->info5.primary_gid);
5528 ret = false;
5529 }
5530 break;
5531 }
5532 }
5533
5534 if (!test_user_ops(p, tctx, &user_handle, domain_handle,
5535 domain_sid, acct_flags, name.string, which_ops,
5536 machine_credentials)) {
5537 ret = false;
5538 }
5539
5540 if (!ndr_policy_handle_empty(&user_handle)) {
5541 torture_comment(tctx, "Testing DeleteUser (createuser2 test)\n");
5542
5543 d.in.user_handle = &user_handle;
5544 d.out.user_handle = &user_handle;
5545
5546 torture_assert_ntstatus_ok(tctx, dcerpc_samr_DeleteUser_r(b, user_ctx, &d),
5547 "DeleteUser failed");
5548 if (!NT_STATUS_IS_OK(d.out.result)) {
5549 torture_warning(tctx, "DeleteUser failed - %s\n", nt_errstr(d.out.result));
5550 ret = false;
5551 }
5552 }
5553 }
5554 talloc_free(user_ctx);
5555 }
5556
5557 return ret;
5558 }
5559
5560 static bool test_QueryAliasInfo(struct dcerpc_binding_handle *b,
5561 struct torture_context *tctx,
5562 struct policy_handle *handle)
5563 {
5564 struct samr_QueryAliasInfo r;
5565 union samr_AliasInfo *info;
5566 uint16_t levels[] = {1, 2, 3};
5567 int i;
5568 bool ret = true;
5569
5570 for (i=0;i<ARRAY_SIZE(levels);i++) {
5571 torture_comment(tctx, "Testing QueryAliasInfo level %u\n", levels[i]);
5572
5573 r.in.alias_handle = handle;
5574 r.in.level = levels[i];
5575 r.out.info = &info;
5576
5577 torture_assert_ntstatus_ok(tctx, dcerpc_samr_QueryAliasInfo_r(b, tctx, &r),
5578 "QueryAliasInfo failed");
5579 if (!NT_STATUS_IS_OK(r.out.result)) {
5580 torture_warning(tctx, "QueryAliasInfo level %u failed - %s\n",
5581 levels[i], nt_errstr(r.out.result));
5582 ret = false;
5583 }
5584 }
5585
5586 return ret;
5587 }
5588
5589 static bool test_QueryGroupInfo(struct dcerpc_binding_handle *b,
5590 struct torture_context *tctx,
5591 struct policy_handle *handle)
5592 {
5593 struct samr_QueryGroupInfo r;
5594 union samr_GroupInfo *info;
5595 uint16_t levels[] = {1, 2, 3, 4, 5};
5596 int i;
5597 bool ret = true;
5598
5599 for (i=0;i<ARRAY_SIZE(levels);i++) {
5600 torture_comment(tctx, "Testing QueryGroupInfo level %u\n", levels[i]);
5601
5602 r.in.group_handle = handle;
5603 r.in.level = levels[i];
5604 r.out.info = &info;
5605
5606 torture_assert_ntstatus_ok(tctx, dcerpc_samr_QueryGroupInfo_r(b, tctx, &r),
5607 "QueryGroupInfo failed");
5608 if (!NT_STATUS_IS_OK(r.out.result)) {
5609 torture_warning(tctx, "QueryGroupInfo level %u failed - %s\n",
5610 levels[i], nt_errstr(r.out.result));
5611 ret = false;
5612 }
5613 }
5614
5615 return ret;
5616 }
5617
5618 static bool test_QueryGroupMember(struct dcerpc_binding_handle *b,
5619 struct torture_context *tctx,
5620 struct policy_handle *handle)
5621 {
5622 struct samr_QueryGroupMember r;
5623 struct samr_RidAttrArray *rids = NULL;
5624 bool ret = true;
5625
5626 torture_comment(tctx, "Testing QueryGroupMember\n");
5627
5628 r.in.group_handle = handle;
5629 r.out.rids = &rids;
5630
5631 torture_assert_ntstatus_ok(tctx, dcerpc_samr_QueryGroupMember_r(b, tctx, &r),
5632 "QueryGroupMember failed");
5633 if (!NT_STATUS_IS_OK(r.out.result)) {
5634 torture_warning(tctx, "QueryGroupMember failed - %s\n", nt_errstr(r.out.result));
5635 ret = false;
5636 }
5637
5638 return ret;
5639 }
5640
5641
5642 static bool test_SetGroupInfo(struct dcerpc_binding_handle *b,
5643 struct torture_context *tctx,
5644 struct policy_handle *handle)
5645 {
5646 struct samr_QueryGroupInfo r;
5647 union samr_GroupInfo *info;
5648 struct samr_SetGroupInfo s;
5649 uint16_t levels[] = {1, 2, 3, 4};
5650 uint16_t set_ok[] = {0, 1, 1, 1};
5651 int i;
5652 bool ret = true;
5653
5654 for (i=0;i<ARRAY_SIZE(levels);i++) {
5655 torture_comment(tctx, "Testing QueryGroupInfo level %u\n", levels[i]);
5656
5657 r.in.group_handle = handle;
5658 r.in.level = levels[i];
5659 r.out.info = &info;
5660
5661 torture_assert_ntstatus_ok(tctx, dcerpc_samr_QueryGroupInfo_r(b, tctx, &r),
5662 "QueryGroupInfo failed");
5663 if (!NT_STATUS_IS_OK(r.out.result)) {
5664 torture_warning(tctx, "QueryGroupInfo level %u failed - %s\n",
5665 levels[i], nt_errstr(r.out.result));
5666 ret = false;
5667 }
5668
5669 torture_comment(tctx, "Testing SetGroupInfo level %u\n", levels[i]);
5670
5671 s.in.group_handle = handle;
5672 s.in.level = levels[i];
5673 s.in.info = *r.out.info;
5674
5675 #if 0
5676 /* disabled this, as it changes the name only from the point of view of samr,
5677 but leaves the name from the point of view of w2k3 internals (and ldap). This means
5678 the name is still reserved, so creating the old name fails, but deleting by the old name
5679 also fails */
5680 if (s.in.level == 2) {
5681 init_lsa_String(&s.in.info->string, "NewName");
5682 }
5683 #endif
5684
5685 if (s.in.level == 4) {
5686 init_lsa_String(&s.in.info->description, "test description");
5687 }
5688
5689 torture_assert_ntstatus_ok(tctx, dcerpc_samr_SetGroupInfo_r(b, tctx, &s),
5690 "SetGroupInfo failed");
5691 if (set_ok[i]) {
5692 if (!NT_STATUS_IS_OK(s.out.result)) {
5693 torture_warning(tctx, "SetGroupInfo level %u failed - %s\n",
5694 r.in.level, nt_errstr(s.out.result));
5695 ret = false;
5696 continue;
5697 }
5698 } else {
5699 if (!NT_STATUS_EQUAL(NT_STATUS_INVALID_INFO_CLASS, s.out.result)) {
5700 torture_warning(tctx, "SetGroupInfo level %u gave %s - should have been NT_STATUS_INVALID_INFO_CLASS\n",
5701 r.in.level, nt_errstr(s.out.result));
5702 ret = false;
5703 continue;
5704 }
5705 }
5706 }
5707
5708 return ret;
5709 }
5710
5711 static bool test_QueryUserInfo(struct dcerpc_binding_handle *b,
5712 struct torture_context *tctx,
5713 struct policy_handle *handle)
5714 {
5715 struct samr_QueryUserInfo r;
5716 union samr_UserInfo *info;
5717 uint16_t levels[] = {1, 2, 3, 4, 5, 6, 7, 8, 9, 10,
5718 11, 12, 13, 14, 16, 17, 20, 21};
5719 int i;
5720 bool ret = true;
5721
5722 for (i=0;i<ARRAY_SIZE(levels);i++) {
5723 torture_comment(tctx, "Testing QueryUserInfo level %u\n", levels[i]);
5724
5725 r.in.user_handle = handle;
5726 r.in.level = levels[i];
5727 r.out.info = &info;
5728
5729 torture_assert_ntstatus_ok(tctx, dcerpc_samr_QueryUserInfo_r(b, tctx, &r),
5730 "QueryUserInfo failed");
5731 if (!NT_STATUS_IS_OK(r.out.result)) {
5732 torture_warning(tctx, "QueryUserInfo level %u failed - %s\n",
5733 levels[i], nt_errstr(r.out.result));
5734 ret = false;
5735 }
5736 }
5737
5738 return ret;
5739 }
5740
5741 static bool test_QueryUserInfo2(struct dcerpc_binding_handle *b,
5742 struct torture_context *tctx,
5743 struct policy_handle *handle)
5744 {
5745 struct samr_QueryUserInfo2 r;
5746 union samr_UserInfo *info;
5747 uint16_t levels[] = {1, 2, 3, 4, 5, 6, 7, 8, 9, 10,
5748 11, 12, 13, 14, 16, 17, 20, 21};
5749 int i;
5750 bool ret = true;
5751
5752 for (i=0;i<ARRAY_SIZE(levels);i++) {
5753 torture_comment(tctx, "Testing QueryUserInfo2 level %u\n", levels[i]);
5754
5755 r.in.user_handle = handle;
5756 r.in.level = levels[i];
5757 r.out.info = &info;
5758
5759 torture_assert_ntstatus_ok(tctx, dcerpc_samr_QueryUserInfo2_r(b, tctx, &r),
5760 "QueryUserInfo2 failed");
5761 if (!NT_STATUS_IS_OK(r.out.result)) {
5762 torture_warning(tctx, "QueryUserInfo2 level %u failed - %s\n",
5763 levels[i], nt_errstr(r.out.result));
5764 ret = false;
5765 }
5766 }
5767
5768 return ret;
5769 }
5770
5771 static bool test_OpenUser(struct dcerpc_binding_handle *b,
5772 struct torture_context *tctx,
5773 struct policy_handle *handle, uint32_t rid)
5774 {
5775 struct samr_OpenUser r;
5776 struct policy_handle user_handle;
5777 bool ret = true;
5778
5779 torture_comment(tctx, "Testing OpenUser(%u)\n", rid);
5780
5781 r.in.domain_handle = handle;
5782 r.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
5783 r.in.rid = rid;
5784 r.out.user_handle = &user_handle;
5785
5786 torture_assert_ntstatus_ok(tctx, dcerpc_samr_OpenUser_r(b, tctx, &r),
5787 "OpenUser failed");
5788 if (!NT_STATUS_IS_OK(r.out.result)) {
5789 torture_warning(tctx, "OpenUser(%u) failed - %s\n", rid, nt_errstr(r.out.result));
5790 return false;
5791 }
5792
5793 if (!test_QuerySecurity(b, tctx, &user_handle)) {
5794 ret = false;
5795 }
5796
5797 if (!test_QueryUserInfo(b, tctx, &user_handle)) {
5798 ret = false;
5799 }
5800
5801 if (!test_QueryUserInfo2(b, tctx, &user_handle)) {
5802 ret = false;
5803 }
5804
5805 if (!test_GetUserPwInfo(b, tctx, &user_handle)) {
5806 ret = false;
5807 }
5808
5809 if (!test_GetGroupsForUser(b, tctx, &user_handle)) {
5810 ret = false;
5811 }
5812
5813 if (!test_samr_handle_Close(b, tctx, &user_handle)) {
5814 ret = false;
5815 }
5816
5817 return ret;
5818 }
5819
5820 static bool test_OpenGroup(struct dcerpc_binding_handle *b,
5821 struct torture_context *tctx,
5822 struct policy_handle *handle, uint32_t rid)
5823 {
5824 struct samr_OpenGroup r;
5825 struct policy_handle group_handle;
5826 bool ret = true;
5827
5828 torture_comment(tctx, "Testing OpenGroup(%u)\n", rid);
5829
5830 r.in.domain_handle = handle;
5831 r.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
5832 r.in.rid = rid;
5833 r.out.group_handle = &group_handle;
5834
5835 torture_assert_ntstatus_ok(tctx, dcerpc_samr_OpenGroup_r(b, tctx, &r),
5836 "OpenGroup failed");
5837 if (!NT_STATUS_IS_OK(r.out.result)) {
5838 torture_warning(tctx, "OpenGroup(%u) failed - %s\n", rid, nt_errstr(r.out.result));
5839 return false;
5840 }
5841
5842 if (!torture_setting_bool(tctx, "samba3", false)) {
5843 if (!test_QuerySecurity(b, tctx, &group_handle)) {
5844 ret = false;
5845 }
5846 }
5847
5848 if (!test_QueryGroupInfo(b, tctx, &group_handle)) {
5849 ret = false;
5850 }
5851
5852 if (!test_QueryGroupMember(b, tctx, &group_handle)) {
5853 ret = false;
5854 }
5855
5856 if (!test_samr_handle_Close(b, tctx, &group_handle)) {
5857 ret = false;
5858 }
5859
5860 return ret;
5861 }
5862
5863 static bool test_OpenAlias(struct dcerpc_binding_handle *b,
5864 struct torture_context *tctx,
5865 struct policy_handle *handle, uint32_t rid)
5866 {
5867 struct samr_OpenAlias r;
5868 struct policy_handle alias_handle;
5869 bool ret = true;
5870
5871 torture_comment(tctx, "Testing OpenAlias(%u)\n", rid);
5872
5873 r.in.domain_handle = handle;
5874 r.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
5875 r.in.rid = rid;
5876 r.out.alias_handle = &alias_handle;
5877
5878 torture_assert_ntstatus_ok(tctx, dcerpc_samr_OpenAlias_r(b, tctx, &r),
5879 "OpenAlias failed");
5880 if (!NT_STATUS_IS_OK(r.out.result)) {
5881 torture_warning(tctx, "OpenAlias(%u) failed - %s\n", rid, nt_errstr(r.out.result));
5882 return false;
5883 }
5884
5885 if (!torture_setting_bool(tctx, "samba3", false)) {
5886 if (!test_QuerySecurity(b, tctx, &alias_handle)) {
5887 ret = false;
5888 }
5889 }
5890
5891 if (!test_QueryAliasInfo(b, tctx, &alias_handle)) {
5892 ret = false;
5893 }
5894
5895 if (!test_GetMembersInAlias(b, tctx, &alias_handle)) {
5896 ret = false;
5897 }
5898
5899 if (!test_samr_handle_Close(b, tctx, &alias_handle)) {
5900 ret = false;
5901 }
5902
5903 return ret;
5904 }
5905
5906 static bool check_mask(struct dcerpc_binding_handle *b,
5907 struct torture_context *tctx,
5908 struct policy_handle *handle, uint32_t rid,
5909 uint32_t acct_flag_mask)
5910 {
5911 struct samr_OpenUser r;
5912 struct samr_QueryUserInfo q;
5913 union samr_UserInfo *info;
5914 struct policy_handle user_handle;
5915 bool ret = true;
5916
5917 torture_comment(tctx, "Testing OpenUser(%u)\n", rid);
5918
5919 r.in.domain_handle = handle;
5920 r.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
5921 r.in.rid = rid;
5922 r.out.user_handle = &user_handle;
5923
5924 torture_assert_ntstatus_ok(tctx, dcerpc_samr_OpenUser_r(b, tctx, &r),
5925 "OpenUser failed");
5926 if (!NT_STATUS_IS_OK(r.out.result)) {
5927 torture_warning(tctx, "OpenUser(%u) failed - %s\n", rid, nt_errstr(r.out.result));
5928 return false;
5929 }
5930
5931 q.in.user_handle = &user_handle;
5932 q.in.level = 16;
5933 q.out.info = &info;
5934
5935 torture_assert_ntstatus_ok(tctx, dcerpc_samr_QueryUserInfo_r(b, tctx, &q),
5936 "QueryUserInfo failed");
5937 if (!NT_STATUS_IS_OK(q.out.result)) {
5938 torture_warning(tctx, "QueryUserInfo level 16 failed - %s\n",
5939 nt_errstr(q.out.result));
5940 ret = false;
5941 } else {
5942 if ((acct_flag_mask & info->info16.acct_flags) == 0) {
5943 torture_warning(tctx, "Server failed to filter for 0x%x, allowed 0x%x (%d) on EnumDomainUsers\n",
5944 acct_flag_mask, info->info16.acct_flags, rid);
5945 ret = false;
5946 }
5947 }
5948
5949 if (!test_samr_handle_Close(b, tctx, &user_handle)) {
5950 ret = false;
5951 }
5952
5953 return ret;
5954 }
5955
5956 static bool test_EnumDomainUsers_all(struct dcerpc_binding_handle *b,
5957 struct torture_context *tctx,
5958 struct policy_handle *handle)
5959 {
5960 struct samr_EnumDomainUsers r;
5961 uint32_t mask, resume_handle=0;
5962 int i, mask_idx;
5963 bool ret = true;
5964 struct samr_LookupNames n;
5965 struct samr_LookupRids lr ;
5966 struct lsa_Strings names;
5967 struct samr_Ids rids, types;
5968 struct samr_SamArray *sam = NULL;
5969 uint32_t num_entries = 0;
5970
5971 uint32_t masks[] = {ACB_NORMAL, ACB_DOMTRUST, ACB_WSTRUST,
5972 ACB_DISABLED, ACB_NORMAL | ACB_DISABLED,
5973 ACB_SVRTRUST | ACB_DOMTRUST | ACB_WSTRUST,
5974 ACB_PWNOEXP, 0};
5975
5976 torture_comment(tctx, "Testing EnumDomainUsers\n");
5977
5978 for (mask_idx=0;mask_idx<ARRAY_SIZE(masks);mask_idx++) {
5979 r.in.domain_handle = handle;
5980 r.in.resume_handle = &resume_handle;
5981 r.in.acct_flags = mask = masks[mask_idx];
5982 r.in.max_size = (uint32_t)-1;
5983 r.out.resume_handle = &resume_handle;
5984 r.out.num_entries = &num_entries;
5985 r.out.sam = &sam;
5986
5987 torture_assert_ntstatus_ok(tctx, dcerpc_samr_EnumDomainUsers_r(b, tctx, &r),
5988 "EnumDomainUsers failed");
5989 if (!NT_STATUS_EQUAL(r.out.result, STATUS_MORE_ENTRIES) &&
5990 !NT_STATUS_IS_OK(r.out.result)) {
5991 torture_warning(tctx, "EnumDomainUsers failed - %s\n", nt_errstr(r.out.result));
5992 return false;
5993 }
5994
5995 torture_assert(tctx, sam, "EnumDomainUsers failed: r.out.sam unexpectedly NULL");
5996
5997 if (sam->count == 0) {
5998 continue;
5999 }
6000
6001 for (i=0;i<sam->count;i++) {
6002 if (mask) {
6003 if (!check_mask(b, tctx, handle, sam->entries[i].idx, mask)) {
6004 ret = false;
6005 }
6006 } else if (!test_OpenUser(b, tctx, handle, sam->entries[i].idx)) {
6007 ret = false;
6008 }
6009 }
6010 }
6011
6012 torture_comment(tctx, "Testing LookupNames\n");
6013 n.in.domain_handle = handle;
6014 n.in.num_names = sam->count;
6015 n.in.names = talloc_array(tctx, struct lsa_String, sam->count);
6016 n.out.rids = &rids;
6017 n.out.types = &types;
6018 for (i=0;i<sam->count;i++) {
6019 n.in.names[i].string = sam->entries[i].name.string;
6020 }
6021 torture_assert_ntstatus_ok(tctx, dcerpc_samr_LookupNames_r(b, tctx, &n),
6022 "LookupNames failed");
6023 if (!NT_STATUS_IS_OK(n.out.result)) {
6024 torture_warning(tctx, "LookupNames failed - %s\n", nt_errstr(n.out.result));
6025 ret = false;
6026 }
6027
6028
6029 torture_comment(tctx, "Testing LookupRids\n");
6030 lr.in.domain_handle = handle;
6031 lr.in.num_rids = sam->count;
6032 lr.in.rids = talloc_array(tctx, uint32_t, sam->count);
6033 lr.out.names = &names;
6034 lr.out.types = &types;
6035 for (i=0;i<sam->count;i++) {
6036 lr.in.rids[i] = sam->entries[i].idx;
6037 }
6038 torture_assert_ntstatus_ok(tctx, dcerpc_samr_LookupRids_r(b, tctx, &lr),
6039 "LookupRids failed");
6040 torture_assert_ntstatus_ok(tctx, lr.out.result, "LookupRids");
6041
6042 return ret;
6043 }
6044
6045 /*
6046 try blasting the server with a bunch of sync requests
6047 */
6048 static bool test_EnumDomainUsers_async(struct dcerpc_pipe *p, struct torture_context *tctx,
6049 struct policy_handle *handle)
6050 {
6051 struct samr_EnumDomainUsers r;
6052 uint32_t resume_handle=0;
6053 int i;
6054 #define ASYNC_COUNT 100
6055 struct tevent_req *req[ASYNC_COUNT];
6056
6057 if (!torture_setting_bool(tctx, "dangerous", false)) {
6058 torture_skip(tctx, "samr async test disabled - enable dangerous tests to use\n");
6059 }
6060
6061 torture_comment(tctx, "Testing EnumDomainUsers_async\n");
6062
6063 r.in.domain_handle = handle;
6064 r.in.resume_handle = &resume_handle;
6065 r.in.acct_flags = 0;
6066 r.in.max_size = (uint32_t)-1;
6067 r.out.resume_handle = &resume_handle;
6068
6069 for (i=0;i<ASYNC_COUNT;i++) {
6070 req[i] = dcerpc_samr_EnumDomainUsers_r_send(tctx, tctx->ev, p->binding_handle, &r);
6071 }
6072
6073 for (i=0;i<ASYNC_COUNT;i++) {
6074 tevent_req_poll(req[i], tctx->ev);
6075 torture_assert_ntstatus_ok(tctx, dcerpc_samr_EnumDomainUsers_r_recv(req[i], tctx),
6076 talloc_asprintf(tctx, "EnumDomainUsers[%d] failed - %s\n",
6077 i, nt_errstr(r.out.result)));
6078 }
6079
6080 torture_comment(tctx, "%d async requests OK\n", i);
6081
6082 return true;
6083 }
6084
6085 static bool test_EnumDomainGroups_all(struct dcerpc_binding_handle *b,
6086 struct torture_context *tctx,
6087 struct policy_handle *handle)
6088 {
6089 struct samr_EnumDomainGroups r;
6090 uint32_t resume_handle=0;
6091 struct samr_SamArray *sam = NULL;
6092 uint32_t num_entries = 0;
6093 int i;
6094 bool ret = true;
6095 bool universal_group_found = false;
6096
6097 torture_comment(tctx, "Testing EnumDomainGroups\n");
6098
6099 r.in.domain_handle = handle;
6100 r.in.resume_handle = &resume_handle;
6101 r.in.max_size = (uint32_t)-1;
6102 r.out.resume_handle = &resume_handle;
6103 r.out.num_entries = &num_entries;
6104 r.out.sam = &sam;
6105
6106 torture_assert_ntstatus_ok(tctx, dcerpc_samr_EnumDomainGroups_r(b, tctx, &r),
6107 "EnumDomainGroups failed");
6108 if (!NT_STATUS_IS_OK(r.out.result)) {
6109 torture_warning(tctx, "EnumDomainGroups failed - %s\n", nt_errstr(r.out.result));
6110 return false;
6111 }
6112
6113 if (!sam) {
6114 return false;
6115 }
6116
6117 for (i=0;i<sam->count;i++) {
6118 if (!test_OpenGroup(b, tctx, handle, sam->entries[i].idx)) {
6119 ret = false;
6120 }
6121 if ((ret == true) && (strcasecmp(sam->entries[i].name.string,
6122 "Enterprise Admins") == 0)) {
6123 universal_group_found = true;
6124 }
6125 }
6126
6127 /* when we are running this on s4 we should get back at least the
6128 * "Enterprise Admins" universal group. If we don't get a group entry
6129 * at all we probably are performing the test on the builtin domain.
6130 * So ignore this case. */
6131 if (torture_setting_bool(tctx, "samba4", false)) {
6132 if ((sam->count > 0) && (!universal_group_found)) {
6133 ret = false;
6134 }
6135 }
6136
6137 return ret;
6138 }
6139
6140 static bool test_EnumDomainAliases_all(struct dcerpc_binding_handle *b,
6141 struct torture_context *tctx,
6142 struct policy_handle *handle)
6143 {
6144 struct samr_EnumDomainAliases r;
6145 uint32_t resume_handle=0;
6146 struct samr_SamArray *sam = NULL;
6147 uint32_t num_entries = 0;
6148 int i;
6149 bool ret = true;
6150
6151 torture_comment(tctx, "Testing EnumDomainAliases\n");
6152
6153 r.in.domain_handle = handle;
6154 r.in.resume_handle = &resume_handle;
6155 r.in.max_size = (uint32_t)-1;
6156 r.out.sam = &sam;
6157 r.out.num_entries = &num_entries;
6158 r.out.resume_handle = &resume_handle;
6159
6160 torture_assert_ntstatus_ok(tctx, dcerpc_samr_EnumDomainAliases_r(b, tctx, &r),
6161 "EnumDomainAliases failed");
6162 if (!NT_STATUS_IS_OK(r.out.result)) {
6163 torture_warning(tctx, "EnumDomainAliases failed - %s\n", nt_errstr(r.out.result));
6164 return false;
6165 }
6166
6167 if (!sam) {
6168 return false;
6169 }
6170
6171 for (i=0;i<sam->count;i++) {
6172 if (!test_OpenAlias(b, tctx, handle, sam->entries[i].idx)) {
6173 ret = false;
6174 }
6175 }
6176
6177 return ret;
6178 }
6179
6180 static bool test_GetDisplayEnumerationIndex(struct dcerpc_binding_handle *b,
6181 struct torture_context *tctx,
6182 struct policy_handle *handle)
6183 {
6184 struct samr_GetDisplayEnumerationIndex r;
6185 bool ret = true;
6186 uint16_t levels[] = {1, 2, 3, 4, 5};
6187 uint16_t ok_lvl[] = {1, 1, 1, 0, 0};
6188 struct lsa_String name;
6189 uint32_t idx = 0;
6190 int i;
6191
6192 for (i=0;i<ARRAY_SIZE(levels);i++) {
6193 torture_comment(tctx, "Testing GetDisplayEnumerationIndex level %u\n", levels[i]);
6194
6195 init_lsa_String(&name, TEST_ACCOUNT_NAME);
6196
6197 r.in.domain_handle = handle;
6198 r.in.level = levels[i];
6199 r.in.name = &name;
6200 r.out.idx = &idx;
6201
6202 torture_assert_ntstatus_ok(tctx, dcerpc_samr_GetDisplayEnumerationIndex_r(b, tctx, &r),
6203 "GetDisplayEnumerationIndex failed");
6204
6205 if (ok_lvl[i] &&
6206 !NT_STATUS_IS_OK(r.out.result) &&
6207 !NT_STATUS_EQUAL(NT_STATUS_NO_MORE_ENTRIES, r.out.result)) {
6208 torture_warning(tctx, "GetDisplayEnumerationIndex level %u failed - %s\n",
6209 levels[i], nt_errstr(r.out.result));
6210 ret = false;
6211 }
6212
6213 init_lsa_String(&name, "zzzzzzzz");
6214
6215 torture_assert_ntstatus_ok(tctx, dcerpc_samr_GetDisplayEnumerationIndex_r(b, tctx, &r),
6216 "GetDisplayEnumerationIndex failed");
6217
6218 if (ok_lvl[i] && !NT_STATUS_EQUAL(NT_STATUS_NO_MORE_ENTRIES, r.out.result)) {
6219 torture_warning(tctx, "GetDisplayEnumerationIndex level %u failed - %s\n",
6220 levels[i], nt_errstr(r.out.result));
6221 ret = false;
6222 }
6223 }
6224
6225 return ret;
6226 }
6227
6228 static bool test_GetDisplayEnumerationIndex2(struct dcerpc_binding_handle *b,
6229 struct torture_context *tctx,
6230 struct policy_handle *handle)
6231 {
6232 struct samr_GetDisplayEnumerationIndex2 r;
6233 bool ret = true;
6234 uint16_t levels[] = {1, 2, 3, 4, 5};
6235 uint16_t ok_lvl[] = {1, 1, 1, 0, 0};
6236 struct lsa_String name;
6237 uint32_t idx = 0;
6238 int i;
6239
6240 for (i=0;i<ARRAY_SIZE(levels);i++) {
6241 torture_comment(tctx, "Testing GetDisplayEnumerationIndex2 level %u\n", levels[i]);
6242
6243 init_lsa_String(&name, TEST_ACCOUNT_NAME);
6244
6245 r.in.domain_handle = handle;
6246 r.in.level = levels[i];
6247 r.in.name = &name;
6248 r.out.idx = &idx;
6249
6250 torture_assert_ntstatus_ok(tctx, dcerpc_samr_GetDisplayEnumerationIndex2_r(b, tctx, &r),
6251 "GetDisplayEnumerationIndex2 failed");
6252 if (ok_lvl[i] &&
6253 !NT_STATUS_IS_OK(r.out.result) &&
6254 !NT_STATUS_EQUAL(NT_STATUS_NO_MORE_ENTRIES, r.out.result)) {
6255 torture_warning(tctx, "GetDisplayEnumerationIndex2 level %u failed - %s\n",
6256 levels[i], nt_errstr(r.out.result));
6257 ret = false;
6258 }
6259
6260 init_lsa_String(&name, "zzzzzzzz");
6261
6262 torture_assert_ntstatus_ok(tctx, dcerpc_samr_GetDisplayEnumerationIndex2_r(b, tctx, &r),
6263 "GetDisplayEnumerationIndex2 failed");
6264 if (ok_lvl[i] && !NT_STATUS_EQUAL(NT_STATUS_NO_MORE_ENTRIES, r.out.result)) {
6265 torture_warning(tctx, "GetDisplayEnumerationIndex2 level %u failed - %s\n",
6266 levels[i], nt_errstr(r.out.result));
6267 ret = false;
6268 }
6269 }
6270
6271 return ret;
6272 }
6273
6274 #define STRING_EQUAL_QUERY(s1, s2, user) \
6275 if (s1.string == NULL && s2.string != NULL && s2.string[0] == '\0') { \
6276 /* odd, but valid */ \
6277 } else if ((s1.string && !s2.string) || (s2.string && !s1.string) || strcmp(s1.string, s2.string)) { \
6278 torture_warning(tctx, "%s mismatch for %s: %s != %s (%s)\n", \
6279 #s1, user.string, s1.string, s2.string, __location__); \
6280 ret = false; \
6281 }
6282 #define INT_EQUAL_QUERY(s1, s2, user) \
6283 if (s1 != s2) { \
6284 torture_warning(tctx, "%s mismatch for %s: 0x%llx != 0x%llx (%s)\n", \
6285 #s1, user.string, (unsigned long long)s1, (unsigned long long)s2, __location__); \
6286 ret = false; \
6287 }
6288
6289 static bool test_each_DisplayInfo_user(struct dcerpc_binding_handle *b,
6290 struct torture_context *tctx,
6291 struct samr_QueryDisplayInfo *querydisplayinfo,
6292 bool *seen_testuser)
6293 {
6294 struct samr_OpenUser r;
6295 struct samr_QueryUserInfo q;
6296 union samr_UserInfo *info;
6297 struct policy_handle user_handle;
6298 int i, ret = true;
6299 r.in.domain_handle = querydisplayinfo->in.domain_handle;
6300 r.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
6301 for (i = 0; ; i++) {
6302 switch (querydisplayinfo->in.level) {
6303 case 1:
6304 if (i >= querydisplayinfo->out.info->info1.count) {
6305 return ret;
6306 }
6307 r.in.rid = querydisplayinfo->out.info->info1.entries[i].rid;
6308 break;
6309 case 2:
6310 if (i >= querydisplayinfo->out.info->info2.count) {
6311 return ret;
6312 }
6313 r.in.rid = querydisplayinfo->out.info->info2.entries[i].rid;
6314 break;
6315 case 3:
6316 /* Groups */
6317 case 4:
6318 case 5:
6319 /* Not interested in validating just the account name */
6320 return true;
6321 }
6322
6323 r.out.user_handle = &user_handle;
6324
6325 switch (querydisplayinfo->in.level) {
6326 case 1:
6327 case 2:
6328 torture_assert_ntstatus_ok(tctx, dcerpc_samr_OpenUser_r(b, tctx, &r),
6329 "OpenUser failed");
6330 if (!NT_STATUS_IS_OK(r.out.result)) {
6331 torture_warning(tctx, "OpenUser(%u) failed - %s\n", r.in.rid, nt_errstr(r.out.result));
6332 return false;
6333 }
6334 }
6335
6336 q.in.user_handle = &user_handle;
6337 q.in.level = 21;
6338 q.out.info = &info;
6339 torture_assert_ntstatus_ok(tctx, dcerpc_samr_QueryUserInfo_r(b, tctx, &q),
6340 "QueryUserInfo failed");
6341 if (!NT_STATUS_IS_OK(r.out.result)) {
6342 torture_warning(tctx, "QueryUserInfo(%u) failed - %s\n", r.in.rid, nt_errstr(r.out.result));
6343 return false;
6344 }
6345
6346 switch (querydisplayinfo->in.level) {
6347 case 1:
6348 if (seen_testuser && strcmp(info->info21.account_name.string, TEST_ACCOUNT_NAME) == 0) {
6349 *seen_testuser = true;
6350 }
6351 STRING_EQUAL_QUERY(querydisplayinfo->out.info->info1.entries[i].full_name,
6352 info->info21.full_name, info->info21.account_name);
6353 STRING_EQUAL_QUERY(querydisplayinfo->out.info->info1.entries[i].account_name,
6354 info->info21.account_name, info->info21.account_name);
6355 STRING_EQUAL_QUERY(querydisplayinfo->out.info->info1.entries[i].description,
6356 info->info21.description, info->info21.account_name);
6357 INT_EQUAL_QUERY(querydisplayinfo->out.info->info1.entries[i].rid,
6358 info->info21.rid, info->info21.account_name);
6359 INT_EQUAL_QUERY(querydisplayinfo->out.info->info1.entries[i].acct_flags,
6360 info->info21.acct_flags, info->info21.account_name);
6361
6362 break;
6363 case 2:
6364 STRING_EQUAL_QUERY(querydisplayinfo->out.info->info2.entries[i].account_name,
6365 info->info21.account_name, info->info21.account_name);
6366 STRING_EQUAL_QUERY(querydisplayinfo->out.info->info2.entries[i].description,
6367 info->info21.description, info->info21.account_name);
6368 INT_EQUAL_QUERY(querydisplayinfo->out.info->info2.entries[i].rid,
6369 info->info21.rid, info->info21.account_name);
6370 INT_EQUAL_QUERY((querydisplayinfo->out.info->info2.entries[i].acct_flags & ~ACB_NORMAL),
6371 info->info21.acct_flags, info->info21.account_name);
6372
6373 if (!(querydisplayinfo->out.info->info2.entries[i].acct_flags & ACB_NORMAL)) {
6374 torture_warning(tctx, "Missing ACB_NORMAL in querydisplayinfo->out.info.info2.entries[i].acct_flags on %s\n",
6375 info->info21.account_name.string);
6376 }
6377
6378 if (!(info->info21.acct_flags & (ACB_WSTRUST | ACB_SVRTRUST))) {
6379 torture_warning(tctx, "Found non-trust account %s in trust account listing: 0x%x 0x%x\n",
6380 info->info21.account_name.string,
6381 querydisplayinfo->out.info->info2.entries[i].acct_flags,
6382 info->info21.acct_flags);
6383 return false;
6384 }
6385
6386 break;
6387 }
6388
6389 if (!test_samr_handle_Close(b, tctx, &user_handle)) {
6390 return false;
6391 }
6392 }
6393 return ret;
6394 }
6395
6396 static bool test_QueryDisplayInfo(struct dcerpc_binding_handle *b,
6397 struct torture_context *tctx,
6398 struct policy_handle *handle)
6399 {
6400 struct samr_QueryDisplayInfo r;
6401 struct samr_QueryDomainInfo dom_info;
6402 union samr_DomainInfo *info = NULL;
6403 bool ret = true;
6404 uint16_t levels[] = {1, 2, 3, 4, 5};
6405 int i;
6406 bool seen_testuser = false;
6407 uint32_t total_size;
6408 uint32_t returned_size;
6409 union samr_DispInfo disp_info;
6410
6411
6412 for (i=0;i<ARRAY_SIZE(levels);i++) {
6413 torture_comment(tctx, "Testing QueryDisplayInfo level %u\n", levels[i]);
6414
6415 r.in.start_idx = 0;
6416 r.out.result = STATUS_MORE_ENTRIES;
6417 while (NT_STATUS_EQUAL(r.out.result, STATUS_MORE_ENTRIES)) {
6418 r.in.domain_handle = handle;
6419 r.in.level = levels[i];
6420 r.in.max_entries = 2;
6421 r.in.buf_size = (uint32_t)-1;
6422 r.out.total_size = &total_size;
6423 r.out.returned_size = &returned_size;
6424 r.out.info = &disp_info;
6425
6426 torture_assert_ntstatus_ok(tctx, dcerpc_samr_QueryDisplayInfo_r(b, tctx, &r),
6427 "QueryDisplayInfo failed");
6428 if (!NT_STATUS_EQUAL(r.out.result, STATUS_MORE_ENTRIES) && !NT_STATUS_IS_OK(r.out.result)) {
6429 torture_warning(tctx, "QueryDisplayInfo level %u failed - %s\n",
6430 levels[i], nt_errstr(r.out.result));
6431 ret = false;
6432 }
6433 switch (r.in.level) {
6434 case 1:
6435 if (!test_each_DisplayInfo_user(b, tctx, &r, &seen_testuser)) {
6436 ret = false;
6437 }
6438 r.in.start_idx += r.out.info->info1.count;
6439 break;
6440 case 2:
6441 if (!test_each_DisplayInfo_user(b, tctx, &r, NULL)) {
6442 ret = false;
6443 }
6444 r.in.start_idx += r.out.info->info2.count;
6445 break;
6446 case 3:
6447 r.in.start_idx += r.out.info->info3.count;
6448 break;
6449 case 4:
6450 r.in.start_idx += r.out.info->info4.count;
6451 break;
6452 case 5:
6453 r.in.start_idx += r.out.info->info5.count;
6454 break;
6455 }
6456 }
6457 dom_info.in.domain_handle = handle;
6458 dom_info.in.level = 2;
6459 dom_info.out.info = &info;
6460
6461 /* Check number of users returned is correct */
6462 torture_assert_ntstatus_ok(tctx, dcerpc_samr_QueryDomainInfo_r(b, tctx, &dom_info),
6463 "QueryDomainInfo failed");
6464 if (!NT_STATUS_IS_OK(dom_info.out.result)) {
6465 torture_warning(tctx, "QueryDomainInfo level %u failed - %s\n",
6466 r.in.level, nt_errstr(dom_info.out.result));
6467 ret = false;
6468 break;
6469 }
6470 switch (r.in.level) {
6471 case 1:
6472 case 4:
6473 if (info->general.num_users < r.in.start_idx) {
6474 /* On AD deployments this numbers don't match
6475 * since QueryDisplayInfo returns universal and
6476 * global groups, QueryDomainInfo only global
6477 * ones. */
6478 if (torture_setting_bool(tctx, "samba3", false)) {
6479 torture_warning(tctx, "QueryDomainInfo indicates that QueryDisplayInfo returned more users (%d/%d) than the domain %s is said to contain!\n",
6480 r.in.start_idx, info->general.num_groups,
6481 info->general.domain_name.string);
6482 ret = false;
6483 }
6484 }
6485 if (!seen_testuser) {
6486 struct policy_handle user_handle;
6487 if (NT_STATUS_IS_OK(test_OpenUser_byname(b, tctx, handle, TEST_ACCOUNT_NAME, &user_handle))) {
6488 torture_warning(tctx, "Didn't find test user " TEST_ACCOUNT_NAME " in enumeration of %s\n",
6489 info->general.domain_name.string);
6490 ret = false;
6491 test_samr_handle_Close(b, tctx, &user_handle);
6492 }
6493 }
6494 break;
6495 case 3:
6496 case 5:
6497 if (info->general.num_groups != r.in.start_idx) {
6498 /* On AD deployments this numbers don't match
6499 * since QueryDisplayInfo returns universal and
6500 * global groups, QueryDomainInfo only global
6501 * ones. */
6502 if (torture_setting_bool(tctx, "samba3", false)) {
6503 torture_warning(tctx, "QueryDomainInfo indicates that QueryDisplayInfo didn't return all (%d/%d) the groups in %s\n",
6504 r.in.start_idx, info->general.num_groups,
6505 info->general.domain_name.string);
6506 ret = false;
6507 }
6508 }
6509
6510 break;
6511 }
6512
6513 }
6514
6515 return ret;
6516 }
6517
6518 static bool test_QueryDisplayInfo2(struct dcerpc_binding_handle *b,
6519 struct torture_context *tctx,
6520 struct policy_handle *handle)
6521 {
6522 struct samr_QueryDisplayInfo2 r;
6523 bool ret = true;
6524 uint16_t levels[] = {1, 2, 3, 4, 5};
6525 int i;
6526 uint32_t total_size;
6527 uint32_t returned_size;
6528 union samr_DispInfo info;
6529
6530 for (i=0;i<ARRAY_SIZE(levels);i++) {
6531 torture_comment(tctx, "Testing QueryDisplayInfo2 level %u\n", levels[i]);
6532
6533 r.in.domain_handle = handle;
6534 r.in.level = levels[i];
6535 r.in.start_idx = 0;
6536 r.in.max_entries = 1000;
6537 r.in.buf_size = (uint32_t)-1;
6538 r.out.total_size = &total_size;
6539 r.out.returned_size = &returned_size;
6540 r.out.info = &info;
6541
6542 torture_assert_ntstatus_ok(tctx, dcerpc_samr_QueryDisplayInfo2_r(b, tctx, &r),
6543 "QueryDisplayInfo2 failed");
6544 if (!NT_STATUS_IS_OK(r.out.result)) {
6545 torture_warning(tctx, "QueryDisplayInfo2 level %u failed - %s\n",
6546 levels[i], nt_errstr(r.out.result));
6547 ret = false;
6548 }
6549 }
6550
6551 return ret;
6552 }
6553
6554 static bool test_QueryDisplayInfo3(struct dcerpc_binding_handle *b,
6555 struct torture_context *tctx,
6556 struct policy_handle *handle)
6557 {
6558 struct samr_QueryDisplayInfo3 r;
6559 bool ret = true;
6560 uint16_t levels[] = {1, 2, 3, 4, 5};
6561 int i;
6562 uint32_t total_size;
6563 uint32_t returned_size;
6564 union samr_DispInfo info;
6565
6566 for (i=0;i<ARRAY_SIZE(levels);i++) {
6567 torture_comment(tctx, "Testing QueryDisplayInfo3 level %u\n", levels[i]);
6568
6569 r.in.domain_handle = handle;
6570 r.in.level = levels[i];
6571 r.in.start_idx = 0;
6572 r.in.max_entries = 1000;
6573 r.in.buf_size = (uint32_t)-1;
6574 r.out.total_size = &total_size;
6575 r.out.returned_size = &returned_size;
6576 r.out.info = &info;
6577
6578 torture_assert_ntstatus_ok(tctx, dcerpc_samr_QueryDisplayInfo3_r(b, tctx, &r),
6579 "QueryDisplayInfo3 failed");
6580 if (!NT_STATUS_IS_OK(r.out.result)) {
6581 torture_warning(tctx, "QueryDisplayInfo3 level %u failed - %s\n",
6582 levels[i], nt_errstr(r.out.result));
6583 ret = false;
6584 }
6585 }
6586
6587 return ret;
6588 }
6589
6590
6591 static bool test_QueryDisplayInfo_continue(struct dcerpc_binding_handle *b,
6592 struct torture_context *tctx,
6593 struct policy_handle *handle)
6594 {
6595 struct samr_QueryDisplayInfo r;
6596 bool ret = true;
6597 uint32_t total_size;
6598 uint32_t returned_size;
6599 union samr_DispInfo info;
6600
6601 torture_comment(tctx, "Testing QueryDisplayInfo continuation\n");
6602
6603 r.in.domain_handle = handle;
6604 r.in.level = 1;
6605 r.in.start_idx = 0;
6606 r.in.max_entries = 1;
6607 r.in.buf_size = (uint32_t)-1;
6608 r.out.total_size = &total_size;
6609 r.out.returned_size = &returned_size;
6610 r.out.info = &info;
6611
6612 do {
6613 torture_assert_ntstatus_ok(tctx, dcerpc_samr_QueryDisplayInfo_r(b, tctx, &r),
6614 "QueryDisplayInfo failed");
6615 if (NT_STATUS_IS_OK(r.out.result) && *r.out.returned_size != 0) {
6616 if (r.out.info->info1.entries[0].idx != r.in.start_idx + 1) {
6617 torture_warning(tctx, "expected idx %d but got %d\n",
6618 r.in.start_idx + 1,
6619 r.out.info->info1.entries[0].idx);
6620 break;
6621 }
6622 }
6623 if (!NT_STATUS_EQUAL(r.out.result, STATUS_MORE_ENTRIES) &&
6624 !NT_STATUS_IS_OK(r.out.result)) {
6625 torture_warning(tctx, "QueryDisplayInfo level %u failed - %s\n",
6626 r.in.level, nt_errstr(r.out.result));
6627 ret = false;
6628 break;
6629 }
6630 r.in.start_idx++;
6631 } while ((NT_STATUS_EQUAL(r.out.result, STATUS_MORE_ENTRIES) ||
6632 NT_STATUS_IS_OK(r.out.result)) &&
6633 *r.out.returned_size != 0);
6634
6635 return ret;
6636 }
6637
6638 static bool test_QueryDomainInfo(struct dcerpc_pipe *p,
6639 struct torture_context *tctx,
6640 struct policy_handle *handle)
6641 {
6642 struct samr_QueryDomainInfo r;
6643 union samr_DomainInfo *info = NULL;
6644 struct samr_SetDomainInfo s;
6645 uint16_t levels[] = {1, 2, 3, 4, 5, 6, 7, 8, 9, 11, 12, 13};
6646 uint16_t set_ok[] = {1, 0, 1, 1, 0, 1, 1, 0, 1, 0, 1, 0};
6647 int i;
6648 bool ret = true;
6649 struct dcerpc_binding_handle *b = p->binding_handle;
6650 const char *domain_comment = talloc_asprintf(tctx,
6651 "Tortured by Samba4 RPC-SAMR: %s",
6652 timestring(tctx, time(NULL)));
6653
6654 s.in.domain_handle = handle;
6655 s.in.level = 4;
6656 s.in.info = talloc(tctx, union samr_DomainInfo);
6657
6658 s.in.info->oem.oem_information.string = domain_comment;
6659 torture_assert_ntstatus_ok(tctx, dcerpc_samr_SetDomainInfo_r(b, tctx, &s),
6660 "SetDomainInfo failed");
6661 if (!NT_STATUS_IS_OK(s.out.result)) {
6662 torture_warning(tctx, "SetDomainInfo level %u (set comment) failed - %s\n",
6663 s.in.level, nt_errstr(s.out.result));
6664 return false;
6665 }
6666
6667 for (i=0;i<ARRAY_SIZE(levels);i++) {
6668 torture_comment(tctx, "Testing QueryDomainInfo level %u\n", levels[i]);
6669
6670 r.in.domain_handle = handle;
6671 r.in.level = levels[i];
6672 r.out.info = &info;
6673
6674 torture_assert_ntstatus_ok(tctx, dcerpc_samr_QueryDomainInfo_r(b, tctx, &r),
6675 "QueryDomainInfo failed");
6676 if (!NT_STATUS_IS_OK(r.out.result)) {
6677 torture_warning(tctx, "QueryDomainInfo level %u failed - %s\n",
6678 r.in.level, nt_errstr(r.out.result));
6679 ret = false;
6680 continue;
6681 }
6682
6683 switch (levels[i]) {
6684 case 2:
6685 if (strcmp(info->general.oem_information.string, domain_comment) != 0) {
6686 torture_warning(tctx, "QueryDomainInfo level %u returned different oem_information (comment) (%s, expected %s)\n",
6687 levels[i], info->general.oem_information.string, domain_comment);
6688 if (!torture_setting_bool(tctx, "samba3", false)) {
6689 ret = false;
6690 }
6691 }
6692 if (!info->general.primary.string) {
6693 torture_warning(tctx, "QueryDomainInfo level %u returned no PDC name\n",
6694 levels[i]);
6695 ret = false;
6696 } else if (info->general.role == SAMR_ROLE_DOMAIN_PDC) {
6697 if (dcerpc_server_name(p) && strcasecmp_m(dcerpc_server_name(p), info->general.primary.string) != 0) {
6698 if (torture_setting_bool(tctx, "samba3", false)) {
6699 torture_warning(tctx, "QueryDomainInfo level %u returned different PDC name (%s) compared to server name (%s), despite claiming to be the PDC\n",
6700 levels[i], info->general.primary.string, dcerpc_server_name(p));
6701 }
6702 }
6703 }
6704 break;
6705 case 4:
6706 if (strcmp(info->oem.oem_information.string, domain_comment) != 0) {
6707 torture_warning(tctx, "QueryDomainInfo level %u returned different oem_information (comment) (%s, expected %s)\n",
6708 levels[i], info->oem.oem_information.string, domain_comment);
6709 if (!torture_setting_bool(tctx, "samba3", false)) {
6710 ret = false;
6711 }
6712 }
6713 break;
6714 case 6:
6715 if (!info->info6.primary.string) {
6716 torture_warning(tctx, "QueryDomainInfo level %u returned no PDC name\n",
6717 levels[i]);
6718 ret = false;
6719 }
6720 break;
6721 case 11:
6722 if (strcmp(info->general2.general.oem_information.string, domain_comment) != 0) {
6723 torture_warning(tctx, "QueryDomainInfo level %u returned different comment (%s, expected %s)\n",
6724 levels[i], info->general2.general.oem_information.string, domain_comment);
6725 if (!torture_setting_bool(tctx, "samba3", false)) {
6726 ret = false;
6727 }
6728 }
6729 break;
6730 }
6731
6732 torture_comment(tctx, "Testing SetDomainInfo level %u\n", levels[i]);
6733
6734 s.in.domain_handle = handle;
6735 s.in.level = levels[i];
6736 s.in.info = info;
6737
6738 torture_assert_ntstatus_ok(tctx, dcerpc_samr_SetDomainInfo_r(b, tctx, &s),
6739 "SetDomainInfo failed");
6740 if (set_ok[i]) {
6741 if (!NT_STATUS_IS_OK(s.out.result)) {
6742 torture_warning(tctx, "SetDomainInfo level %u failed - %s\n",
6743 r.in.level, nt_errstr(s.out.result));
6744 ret = false;
6745 continue;
6746 }
6747 } else {
6748 if (!NT_STATUS_EQUAL(NT_STATUS_INVALID_INFO_CLASS, s.out.result)) {
6749 torture_warning(tctx, "SetDomainInfo level %u gave %s - should have been NT_STATUS_INVALID_INFO_CLASS\n",
6750 r.in.level, nt_errstr(s.out.result));
6751 ret = false;
6752 continue;
6753 }
6754 }
6755
6756 torture_assert_ntstatus_ok(tctx, dcerpc_samr_QueryDomainInfo_r(b, tctx, &r),
6757 "QueryDomainInfo failed");
6758 if (!NT_STATUS_IS_OK(r.out.result)) {
6759 torture_warning(tctx, "QueryDomainInfo level %u failed - %s\n",
6760 r.in.level, nt_errstr(r.out.result));
6761 ret = false;
6762 continue;
6763 }
6764 }
6765
6766 return ret;
6767 }
6768
6769
6770 static bool test_QueryDomainInfo2(struct dcerpc_binding_handle *b,
6771 struct torture_context *tctx,
6772 struct policy_handle *handle)
6773 {
6774 struct samr_QueryDomainInfo2 r;
6775 union samr_DomainInfo *info = NULL;
6776 uint16_t levels[] = {1, 2, 3, 4, 5, 6, 7, 8, 9, 11, 12, 13};
6777 int i;
6778 bool ret = true;
6779
6780 for (i=0;i<ARRAY_SIZE(levels);i++) {
6781 torture_comment(tctx, "Testing QueryDomainInfo2 level %u\n", levels[i]);
6782
6783 r.in.domain_handle = handle;
6784 r.in.level = levels[i];
6785 r.out.info = &info;
6786
6787 torture_assert_ntstatus_ok(tctx, dcerpc_samr_QueryDomainInfo2_r(b, tctx, &r),
6788 "QueryDomainInfo2 failed");
6789 if (!NT_STATUS_IS_OK(r.out.result)) {
6790 torture_warning(tctx, "QueryDomainInfo2 level %u failed - %s\n",
6791 r.in.level, nt_errstr(r.out.result));
6792 ret = false;
6793 continue;
6794 }
6795 }
6796
6797 return true;
6798 }
6799
6800 /* Test whether querydispinfo level 5 and enumdomgroups return the same
6801 set of group names. */
6802 static bool test_GroupList(struct dcerpc_binding_handle *b,
6803 struct torture_context *tctx,
6804 struct dom_sid *domain_sid,
6805 struct policy_handle *handle)
6806 {
6807 struct samr_EnumDomainGroups q1;
6808 struct samr_QueryDisplayInfo q2;
6809 NTSTATUS status;
6810 uint32_t resume_handle=0;
6811 struct samr_SamArray *sam = NULL;
6812 uint32_t num_entries = 0;
6813 int i;
6814 bool ret = true;
6815 uint32_t total_size;
6816 uint32_t returned_size;
6817 union samr_DispInfo info;
6818
6819 int num_names = 0;
6820 const char **names = NULL;
6821
6822 bool builtin_domain = dom_sid_compare(domain_sid,
6823 &global_sid_Builtin) == 0;
6824
6825 torture_comment(tctx, "Testing coherency of querydispinfo vs enumdomgroups\n");
6826
6827 q1.in.domain_handle = handle;
6828 q1.in.resume_handle = &resume_handle;
6829 q1.in.max_size = 5;
6830 q1.out.resume_handle = &resume_handle;
6831 q1.out.num_entries = &num_entries;
6832 q1.out.sam = &sam;
6833
6834 status = STATUS_MORE_ENTRIES;
6835 while (NT_STATUS_EQUAL(status, STATUS_MORE_ENTRIES)) {
6836 torture_assert_ntstatus_ok(tctx, dcerpc_samr_EnumDomainGroups_r(b, tctx, &q1),
6837 "EnumDomainGroups failed");
6838 status = q1.out.result;
6839
6840 if (!NT_STATUS_IS_OK(status) &&
6841 !NT_STATUS_EQUAL(status, STATUS_MORE_ENTRIES))
6842 break;
6843
6844 for (i=0; i<*q1.out.num_entries; i++) {
6845 add_string_to_array(tctx,
6846 sam->entries[i].name.string,
6847 &names, &num_names);
6848 }
6849 }
6850
6851 torture_assert_ntstatus_ok(tctx, status, "EnumDomainGroups");
6852
6853 torture_assert(tctx, sam, "EnumDomainGroups failed to return sam");
6854
6855 if (builtin_domain) {
6856 torture_assert(tctx, num_names == 0,
6857 "EnumDomainGroups shouldn't return any group in the builtin domain!");
6858 }
6859
6860 q2.in.domain_handle = handle;
6861 q2.in.level = 5;
6862 q2.in.start_idx = 0;
6863 q2.in.max_entries = 5;
6864 q2.in.buf_size = (uint32_t)-1;
6865 q2.out.total_size = &total_size;
6866 q2.out.returned_size = &returned_size;
6867 q2.out.info = &info;
6868
6869 status = STATUS_MORE_ENTRIES;
6870 while (NT_STATUS_EQUAL(status, STATUS_MORE_ENTRIES)) {
6871 torture_assert_ntstatus_ok(tctx, dcerpc_samr_QueryDisplayInfo_r(b, tctx, &q2),
6872 "QueryDisplayInfo failed");
6873 status = q2.out.result;
6874 if (!NT_STATUS_IS_OK(status) &&
6875 !NT_STATUS_EQUAL(status, STATUS_MORE_ENTRIES))
6876 break;
6877
6878 for (i=0; i<q2.out.info->info5.count; i++) {
6879 int j;
6880 const char *name = q2.out.info->info5.entries[i].account_name.string;
6881 bool found = false;
6882 for (j=0; j<num_names; j++) {
6883 if (names[j] == NULL)
6884 continue;
6885 if (strequal(names[j], name)) {
6886 names[j] = NULL;
6887 found = true;
6888 break;
6889 }
6890 }
6891
6892 if ((!found) && (!builtin_domain)) {
6893 torture_warning(tctx, "QueryDisplayInfo gave name [%s] that EnumDomainGroups did not\n",
6894 name);
6895 ret = false;
6896 }
6897 }
6898 q2.in.start_idx += q2.out.info->info5.count;
6899 }
6900
6901 if (!NT_STATUS_IS_OK(status)) {
6902 torture_warning(tctx, "QueryDisplayInfo level 5 failed - %s\n",
6903 nt_errstr(status));
6904 ret = false;
6905 }
6906
6907 if (builtin_domain) {
6908 torture_assert(tctx, q2.in.start_idx != 0,
6909 "QueryDisplayInfo should return all domain groups also on the builtin domain handle!");
6910 }
6911
6912 for (i=0; i<num_names; i++) {
6913 if (names[i] != NULL) {
6914 torture_warning(tctx, "EnumDomainGroups gave name [%s] that QueryDisplayInfo did not\n",
6915 names[i]);
6916 ret = false;
6917 }
6918 }
6919
6920 return ret;
6921 }
6922
6923 static bool test_DeleteDomainGroup(struct dcerpc_binding_handle *b,
6924 struct torture_context *tctx,
6925 struct policy_handle *group_handle)
6926 {
6927 struct samr_DeleteDomainGroup d;
6928
6929 torture_comment(tctx, "Testing DeleteDomainGroup\n");
6930
6931 d.in.group_handle = group_handle;
6932 d.out.group_handle = group_handle;
6933
6934 torture_assert_ntstatus_ok(tctx, dcerpc_samr_DeleteDomainGroup_r(b, tctx, &d),
6935 "DeleteDomainGroup failed");
6936 torture_assert_ntstatus_ok(tctx, d.out.result, "DeleteDomainGroup");
6937
6938 return true;
6939 }
6940
6941 static bool test_TestPrivateFunctionsDomain(struct dcerpc_binding_handle *b,
6942 struct torture_context *tctx,
6943 struct policy_handle *domain_handle)
6944 {
6945 struct samr_TestPrivateFunctionsDomain r;
6946 bool ret = true;
6947
6948 torture_comment(tctx, "Testing TestPrivateFunctionsDomain\n");
6949
6950 r.in.domain_handle = domain_handle;
6951
6952 torture_assert_ntstatus_ok(tctx, dcerpc_samr_TestPrivateFunctionsDomain_r(b, tctx, &r),
6953 "TestPrivateFunctionsDomain failed");
6954 torture_assert_ntstatus_equal(tctx, r.out.result, NT_STATUS_NOT_IMPLEMENTED, "TestPrivateFunctionsDomain");
6955
6956 return ret;
6957 }
6958
6959 static bool test_RidToSid(struct dcerpc_binding_handle *b,
6960 struct torture_context *tctx,
6961 struct dom_sid *domain_sid,
6962 struct policy_handle *domain_handle)
6963 {
6964 struct samr_RidToSid r;
6965 bool ret = true;
6966 struct dom_sid *calc_sid, *out_sid;
6967 int rids[] = { 0, 42, 512, 10200 };
6968 int i;
6969
6970 for (i=0;i<ARRAY_SIZE(rids);i++) {
6971 torture_comment(tctx, "Testing RidToSid\n");
6972
6973 calc_sid = dom_sid_dup(tctx, domain_sid);
6974 r.in.domain_handle = domain_handle;
6975 r.in.rid = rids[i];
6976 r.out.sid = &out_sid;
6977
6978 torture_assert_ntstatus_ok(tctx, dcerpc_samr_RidToSid_r(b, tctx, &r),
6979 "RidToSid failed");
6980 if (!NT_STATUS_IS_OK(r.out.result)) {
6981 torture_warning(tctx, "RidToSid for %d failed - %s\n", rids[i], nt_errstr(r.out.result));
6982 ret = false;
6983 } else {
6984 calc_sid = dom_sid_add_rid(calc_sid, calc_sid, rids[i]);
6985
6986 if (!dom_sid_equal(calc_sid, out_sid)) {
6987 torture_warning(tctx, "RidToSid for %d failed - got %s, expected %s\n", rids[i],
6988 dom_sid_string(tctx, out_sid),
6989 dom_sid_string(tctx, calc_sid));
6990 ret = false;
6991 }
6992 }
6993 }
6994
6995 return ret;
6996 }
6997
6998 static bool test_GetBootKeyInformation(struct dcerpc_binding_handle *b,
6999 struct torture_context *tctx,
7000 struct policy_handle *domain_handle)
7001 {
7002 struct samr_GetBootKeyInformation r;
7003 bool ret = true;
7004 uint32_t unknown = 0;
7005 NTSTATUS status;
7006
7007 torture_comment(tctx, "Testing GetBootKeyInformation\n");
7008
7009 r.in.domain_handle = domain_handle;
7010 r.out.unknown = &unknown;
7011
7012 status = dcerpc_samr_GetBootKeyInformation_r(b, tctx, &r);
7013 if (NT_STATUS_IS_OK(status) && !NT_STATUS_IS_OK(r.out.result)) {
7014 status = r.out.result;
7015 }
7016 if (!NT_STATUS_IS_OK(status)) {
7017 /* w2k3 seems to fail this sometimes and pass it sometimes */
7018 torture_comment(tctx, "GetBootKeyInformation (ignored) - %s\n", nt_errstr(status));
7019 }
7020
7021 return ret;
7022 }
7023
7024 static bool test_AddGroupMember(struct dcerpc_binding_handle *b,
7025 struct torture_context *tctx,
7026 struct policy_handle *domain_handle,
7027 struct policy_handle *group_handle)
7028 {
7029 NTSTATUS status;
7030 struct samr_AddGroupMember r;
7031 struct samr_DeleteGroupMember d;
7032 struct samr_QueryGroupMember q;
7033 struct samr_RidAttrArray *rids = NULL;
7034 struct samr_SetMemberAttributesOfGroup s;
7035 uint32_t rid;
7036 bool found_member = false;
7037 int i;
7038
7039 status = test_LookupName(b, tctx, domain_handle, TEST_ACCOUNT_NAME, &rid);
7040 torture_assert_ntstatus_ok(tctx, status, "test_AddGroupMember looking up name " TEST_ACCOUNT_NAME);
7041
7042 r.in.group_handle = group_handle;
7043 r.in.rid = rid;
7044 r.in.flags = 0; /* ??? */
7045
7046 torture_comment(tctx, "Testing AddGroupMember, QueryGroupMember and DeleteGroupMember\n");
7047
7048 d.in.group_handle = group_handle;
7049 d.in.rid = rid;
7050
7051 torture_assert_ntstatus_ok(tctx, dcerpc_samr_DeleteGroupMember_r(b, tctx, &d),
7052 "DeleteGroupMember failed");
7053 torture_assert_ntstatus_equal(tctx, NT_STATUS_MEMBER_NOT_IN_GROUP, d.out.result, "DeleteGroupMember");
7054
7055 torture_assert_ntstatus_ok(tctx, dcerpc_samr_AddGroupMember_r(b, tctx, &r),
7056 "AddGroupMember failed");
7057 torture_assert_ntstatus_ok(tctx, r.out.result, "AddGroupMember");
7058
7059 torture_assert_ntstatus_ok(tctx, dcerpc_samr_AddGroupMember_r(b, tctx, &r),
7060 "AddGroupMember failed");
7061 torture_assert_ntstatus_equal(tctx, NT_STATUS_MEMBER_IN_GROUP, r.out.result, "AddGroupMember");
7062
7063 if (torture_setting_bool(tctx, "samba4", false) ||
7064 torture_setting_bool(tctx, "samba3", false)) {
7065 torture_comment(tctx, "skipping SetMemberAttributesOfGroup test against Samba\n");
7066 } else {
7067 /* this one is quite strange. I am using random inputs in the
7068 hope of triggering an error that might give us a clue */
7069
7070 s.in.group_handle = group_handle;
7071 s.in.unknown1 = random();
7072 s.in.unknown2 = random();
7073
7074 torture_assert_ntstatus_ok(tctx, dcerpc_samr_SetMemberAttributesOfGroup_r(b, tctx, &s),
7075 "SetMemberAttributesOfGroup failed");
7076 torture_assert_ntstatus_ok(tctx, s.out.result, "SetMemberAttributesOfGroup");
7077 }
7078
7079 q.in.group_handle = group_handle;
7080 q.out.rids = &rids;
7081
7082 torture_assert_ntstatus_ok(tctx, dcerpc_samr_QueryGroupMember_r(b, tctx, &q),
7083 "QueryGroupMember failed");
7084 torture_assert_ntstatus_ok(tctx, q.out.result, "QueryGroupMember");
7085 torture_assert(tctx, rids, "QueryGroupMember did not fill in rids structure");
7086
7087 for (i=0; i < rids->count; i++) {
7088 if (rids->rids[i] == rid) {
7089 found_member = true;
7090 }
7091 }
7092
7093 torture_assert(tctx, found_member, "QueryGroupMember did not list newly added member");
7094
7095 torture_assert_ntstatus_ok(tctx, dcerpc_samr_DeleteGroupMember_r(b, tctx, &d),
7096 "DeleteGroupMember failed");
7097 torture_assert_ntstatus_ok(tctx, d.out.result, "DeleteGroupMember");
7098
7099 rids = NULL;
7100 found_member = false;
7101
7102 torture_assert_ntstatus_ok(tctx, dcerpc_samr_QueryGroupMember_r(b, tctx, &q),
7103 "QueryGroupMember failed");
7104 torture_assert_ntstatus_ok(tctx, q.out.result, "QueryGroupMember");
7105 torture_assert(tctx, rids, "QueryGroupMember did not fill in rids structure");
7106
7107 for (i=0; i < rids->count; i++) {
7108 if (rids->rids[i] == rid) {
7109 found_member = true;
7110 }
7111 }
7112
7113 torture_assert(tctx, !found_member, "QueryGroupMember does still list removed member");
7114
7115 torture_assert_ntstatus_ok(tctx, dcerpc_samr_AddGroupMember_r(b, tctx, &r),
7116 "AddGroupMember failed");
7117 torture_assert_ntstatus_ok(tctx, r.out.result, "AddGroupMember");
7118
7119 return true;
7120 }
7121
7122
7123 static bool test_CreateDomainGroup(struct dcerpc_binding_handle *b,
7124 struct torture_context *tctx,
7125 struct policy_handle *domain_handle,
7126 const char *group_name,
7127 struct policy_handle *group_handle,
7128 struct dom_sid *domain_sid,
7129 bool test_group)
7130 {
7131 struct samr_CreateDomainGroup r;
7132 uint32_t rid;
7133 struct lsa_String name;
7134 bool ret = true;
7135
7136 init_lsa_String(&name, group_name);
7137
7138 r.in.domain_handle = domain_handle;
7139 r.in.name = &name;
7140 r.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
7141 r.out.group_handle = group_handle;
7142 r.out.rid = &rid;
7143
7144 torture_comment(tctx, "Testing CreateDomainGroup(%s)\n", r.in.name->string);
7145
7146 torture_assert_ntstatus_ok(tctx, dcerpc_samr_CreateDomainGroup_r(b, tctx, &r),
7147 "CreateDomainGroup failed");
7148
7149 if (dom_sid_equal(domain_sid, dom_sid_parse_talloc(tctx, SID_BUILTIN))) {
7150 if (NT_STATUS_EQUAL(r.out.result, NT_STATUS_ACCESS_DENIED)) {
7151 torture_comment(tctx, "Server correctly refused create of '%s'\n", r.in.name->string);
7152 return true;
7153 } else {
7154 torture_warning(tctx, "Server should have refused create of '%s', got %s instead\n", r.in.name->string,
7155 nt_errstr(r.out.result));
7156 return false;
7157 }
7158 }
7159
7160 if (NT_STATUS_EQUAL(r.out.result, NT_STATUS_GROUP_EXISTS)) {
7161 if (!test_DeleteGroup_byname(b, tctx, domain_handle, r.in.name->string)) {
7162 torture_warning(tctx, "CreateDomainGroup failed: Could not delete domain group %s - %s\n", r.in.name->string,
7163 nt_errstr(r.out.result));
7164 return false;
7165 }
7166 torture_assert_ntstatus_ok(tctx, dcerpc_samr_CreateDomainGroup_r(b, tctx, &r),
7167 "CreateDomainGroup failed");
7168 }
7169 if (NT_STATUS_EQUAL(r.out.result, NT_STATUS_USER_EXISTS)) {
7170 if (!test_DeleteUser_byname(b, tctx, domain_handle, r.in.name->string)) {
7171
7172 torture_warning(tctx, "CreateDomainGroup failed: Could not delete user %s - %s\n", r.in.name->string,
7173 nt_errstr(r.out.result));
7174 return false;
7175 }
7176 torture_assert_ntstatus_ok(tctx, dcerpc_samr_CreateDomainGroup_r(b, tctx, &r),
7177 "CreateDomainGroup failed");
7178 }
7179 torture_assert_ntstatus_ok(tctx, r.out.result, "CreateDomainGroup");
7180
7181 if (!test_group) {
7182 return ret;
7183 }
7184
7185 if (!test_AddGroupMember(b, tctx, domain_handle, group_handle)) {
7186 torture_warning(tctx, "CreateDomainGroup failed - %s\n", nt_errstr(r.out.result));
7187 ret = false;
7188 }
7189
7190 if (!test_SetGroupInfo(b, tctx, group_handle)) {
7191 ret = false;
7192 }
7193
7194 return ret;
7195 }
7196
7197
7198 /*
7199 its not totally clear what this does. It seems to accept any sid you like.
7200 */
7201 static bool test_RemoveMemberFromForeignDomain(struct dcerpc_binding_handle *b,
7202 struct torture_context *tctx,
7203 struct policy_handle *domain_handle)
7204 {
7205 struct samr_RemoveMemberFromForeignDomain r;
7206
7207 r.in.domain_handle = domain_handle;
7208 r.in.sid = dom_sid_parse_talloc(tctx, "S-1-5-32-12-34-56-78");
7209
7210 torture_assert_ntstatus_ok(tctx, dcerpc_samr_RemoveMemberFromForeignDomain_r(b, tctx, &r),
7211 "RemoveMemberFromForeignDomain failed");
7212 torture_assert_ntstatus_ok(tctx, r.out.result, "RemoveMemberFromForeignDomain");
7213
7214 return true;
7215 }
7216
7217 static bool test_EnumDomainUsers(struct dcerpc_binding_handle *b,
7218 struct torture_context *tctx,
7219 struct policy_handle *domain_handle,
7220 uint32_t *total_num_entries_p)
7221 {
7222 NTSTATUS status;
7223 struct samr_EnumDomainUsers r;
7224 uint32_t resume_handle = 0;
7225 uint32_t num_entries = 0;
7226 uint32_t total_num_entries = 0;
7227 struct samr_SamArray *sam;
7228
7229 r.in.domain_handle = domain_handle;
7230 r.in.acct_flags = 0;
7231 r.in.max_size = (uint32_t)-1;
7232 r.in.resume_handle = &resume_handle;
7233
7234 r.out.sam = &sam;
7235 r.out.num_entries = &num_entries;
7236 r.out.resume_handle = &resume_handle;
7237
7238 torture_comment(tctx, "Testing EnumDomainUsers\n");
7239
7240 do {
7241 torture_assert_ntstatus_ok(tctx, dcerpc_samr_EnumDomainUsers_r(b, tctx, &r),
7242 "EnumDomainUsers failed");
7243 if (NT_STATUS_IS_ERR(r.out.result)) {
7244 torture_assert_ntstatus_ok(tctx, r.out.result,
7245 "failed to enumerate users");
7246 }
7247 status = r.out.result;
7248
7249 total_num_entries += num_entries;
7250 } while (NT_STATUS_EQUAL(status, STATUS_MORE_ENTRIES));
7251
7252 if (total_num_entries_p) {
7253 *total_num_entries_p = total_num_entries;
7254 }
7255
7256 return true;
7257 }
7258
7259 static bool test_EnumDomainGroups(struct dcerpc_binding_handle *b,
7260 struct torture_context *tctx,
7261 struct policy_handle *domain_handle,
7262 uint32_t *total_num_entries_p)
7263 {
7264 NTSTATUS status;
7265 struct samr_EnumDomainGroups r;
7266 uint32_t resume_handle = 0;
7267 uint32_t num_entries = 0;
7268 uint32_t total_num_entries = 0;
7269 struct samr_SamArray *sam;
7270
7271 r.in.domain_handle = domain_handle;
7272 r.in.max_size = (uint32_t)-1;
7273 r.in.resume_handle = &resume_handle;
7274
7275 r.out.sam = &sam;
7276 r.out.num_entries = &num_entries;
7277 r.out.resume_handle = &resume_handle;
7278
7279 torture_comment(tctx, "Testing EnumDomainGroups\n");
7280
7281 do {
7282 torture_assert_ntstatus_ok(tctx, dcerpc_samr_EnumDomainGroups_r(b, tctx, &r),
7283 "EnumDomainGroups failed");
7284 if (NT_STATUS_IS_ERR(r.out.result)) {
7285 torture_assert_ntstatus_ok(tctx, r.out.result,
7286 "failed to enumerate groups");
7287 }
7288 status = r.out.result;
7289
7290 total_num_entries += num_entries;
7291 } while (NT_STATUS_EQUAL(status, STATUS_MORE_ENTRIES));
7292
7293 if (total_num_entries_p) {
7294 *total_num_entries_p = total_num_entries;
7295 }
7296
7297 return true;
7298 }
7299
7300 static bool test_EnumDomainAliases(struct dcerpc_binding_handle *b,
7301 struct torture_context *tctx,
7302 struct policy_handle *domain_handle,
7303 uint32_t *total_num_entries_p)
7304 {
7305 NTSTATUS status;
7306 struct samr_EnumDomainAliases r;
7307 uint32_t resume_handle = 0;
7308 uint32_t num_entries = 0;
7309 uint32_t total_num_entries = 0;
7310 struct samr_SamArray *sam;
7311
7312 r.in.domain_handle = domain_handle;
7313 r.in.max_size = (uint32_t)-1;
7314 r.in.resume_handle = &resume_handle;
7315
7316 r.out.sam = &sam;
7317 r.out.num_entries = &num_entries;
7318 r.out.resume_handle = &resume_handle;
7319
7320 torture_comment(tctx, "Testing EnumDomainAliases\n");
7321
7322 do {
7323 torture_assert_ntstatus_ok(tctx, dcerpc_samr_EnumDomainAliases_r(b, tctx, &r),
7324 "EnumDomainAliases failed");
7325 if (NT_STATUS_IS_ERR(r.out.result)) {
7326 torture_assert_ntstatus_ok(tctx, r.out.result,
7327 "failed to enumerate aliases");
7328 }
7329 status = r.out.result;
7330
7331 total_num_entries += num_entries;
7332 } while (NT_STATUS_EQUAL(status, STATUS_MORE_ENTRIES));
7333
7334 if (total_num_entries_p) {
7335 *total_num_entries_p = total_num_entries;
7336 }
7337
7338 return true;
7339 }
7340
7341 static bool test_QueryDisplayInfo_level(struct dcerpc_binding_handle *b,
7342 struct torture_context *tctx,
7343 struct policy_handle *handle,
7344 uint16_t level,
7345 uint32_t *total_num_entries_p)
7346 {
7347 NTSTATUS status;
7348 struct samr_QueryDisplayInfo r;
7349 uint32_t total_num_entries = 0;
7350
7351 r.in.domain_handle = handle;
7352 r.in.level = level;
7353 r.in.start_idx = 0;
7354 r.in.max_entries = (uint32_t)-1;
7355 r.in.buf_size = (uint32_t)-1;
7356
7357 torture_comment(tctx, "Testing QueryDisplayInfo\n");
7358
7359 do {
7360 uint32_t total_size;
7361 uint32_t returned_size;
7362 union samr_DispInfo info;
7363
7364 r.out.total_size = &total_size;
7365 r.out.returned_size = &returned_size;
7366 r.out.info = &info;
7367
7368 torture_assert_ntstatus_ok(tctx, dcerpc_samr_QueryDisplayInfo_r(b, tctx, &r),
7369 "failed to query displayinfo");
7370 if (NT_STATUS_IS_ERR(r.out.result)) {
7371 torture_assert_ntstatus_ok(tctx, r.out.result,
7372 "failed to query displayinfo");
7373 }
7374 status = r.out.result;
7375
7376 if (*r.out.returned_size == 0) {
7377 break;
7378 }
7379
7380 switch (r.in.level) {
7381 case 1:
7382 total_num_entries += info.info1.count;
7383 r.in.start_idx += info.info1.entries[info.info1.count - 1].idx + 1;
7384 break;
7385 case 2:
7386 total_num_entries += info.info2.count;
7387 r.in.start_idx += info.info2.entries[info.info2.count - 1].idx + 1;
7388 break;
7389 case 3:
7390 total_num_entries += info.info3.count;
7391 r.in.start_idx += info.info3.entries[info.info3.count - 1].idx + 1;
7392 break;
7393 case 4:
7394 total_num_entries += info.info4.count;
7395 r.in.start_idx += info.info4.entries[info.info4.count - 1].idx + 1;
7396 break;
7397 case 5:
7398 total_num_entries += info.info5.count;
7399 r.in.start_idx += info.info5.entries[info.info5.count - 1].idx + 1;
7400 break;
7401 default:
7402 return false;
7403 }
7404
7405 } while (NT_STATUS_EQUAL(status, STATUS_MORE_ENTRIES));
7406
7407 if (total_num_entries_p) {
7408 *total_num_entries_p = total_num_entries;
7409 }
7410
7411 return true;
7412 }
7413
7414 static bool test_ManyObjects(struct dcerpc_pipe *p,
7415 struct torture_context *tctx,
7416 struct policy_handle *domain_handle,
7417 struct dom_sid *domain_sid,
7418 struct torture_samr_context *ctx)
7419 {
7420 uint32_t num_total = ctx->num_objects_large_dc;
7421 uint32_t num_enum = 0;
7422 uint32_t num_disp = 0;
7423 uint32_t num_created = 0;
7424 uint32_t num_anounced = 0;
7425 uint32_t i;
7426 struct dcerpc_binding_handle *b = p->binding_handle;
7427
7428 struct policy_handle *handles = talloc_zero_array(tctx, struct policy_handle, num_total);
7429
7430 /* query */
7431
7432 {
7433 struct samr_QueryDomainInfo2 r;
7434 union samr_DomainInfo *info;
7435 r.in.domain_handle = domain_handle;
7436 r.in.level = 2;
7437 r.out.info = &info;
7438
7439 torture_assert_ntstatus_ok(tctx, dcerpc_samr_QueryDomainInfo2_r(b, tctx, &r),
7440 "QueryDomainInfo2 failed");
7441 torture_assert_ntstatus_ok(tctx, r.out.result,
7442 "failed to query domain info");
7443
7444 switch (ctx->choice) {
7445 case TORTURE_SAMR_MANY_ACCOUNTS:
7446 num_anounced = info->general.num_users;
7447 break;
7448 case TORTURE_SAMR_MANY_GROUPS:
7449 num_anounced = info->general.num_groups;
7450 break;
7451 case TORTURE_SAMR_MANY_ALIASES:
7452 num_anounced = info->general.num_aliases;
7453 break;
7454 default:
7455 return false;
7456 }
7457 }
7458
7459 /* create */
7460
7461 for (i=0; i < num_total; i++) {
7462
7463 const char *name = NULL;
7464
7465 switch (ctx->choice) {
7466 case TORTURE_SAMR_MANY_ACCOUNTS:
7467 name = talloc_asprintf(tctx, "%s%04d", TEST_ACCOUNT_NAME, i);
7468 torture_assert(tctx,
7469 test_CreateUser(p, tctx, domain_handle, name, &handles[i], domain_sid, 0, NULL, false),
7470 "failed to create user");
7471 break;
7472 case TORTURE_SAMR_MANY_GROUPS:
7473 name = talloc_asprintf(tctx, "%s%04d", TEST_GROUPNAME, i);
7474 torture_assert(tctx,
7475 test_CreateDomainGroup(b, tctx, domain_handle, name, &handles[i], domain_sid, false),
7476 "failed to create group");
7477 break;
7478 case TORTURE_SAMR_MANY_ALIASES:
7479 name = talloc_asprintf(tctx, "%s%04d", TEST_ALIASNAME, i);
7480 torture_assert(tctx,
7481 test_CreateAlias(b, tctx, domain_handle, name, &handles[i], domain_sid, false),
7482 "failed to create alias");
7483 break;
7484 default:
7485 return false;
7486 }
7487 if (!ndr_policy_handle_empty(&handles[i])) {
7488 num_created++;
7489 }
7490 }
7491
7492 /* enum */
7493
7494 switch (ctx->choice) {
7495 case TORTURE_SAMR_MANY_ACCOUNTS:
7496 torture_assert(tctx,
7497 test_EnumDomainUsers(b, tctx, domain_handle, &num_enum),
7498 "failed to enum users");
7499 break;
7500 case TORTURE_SAMR_MANY_GROUPS:
7501 torture_assert(tctx,
7502 test_EnumDomainGroups(b, tctx, domain_handle, &num_enum),
7503 "failed to enum groups");
7504 break;
7505 case TORTURE_SAMR_MANY_ALIASES:
7506 torture_assert(tctx,
7507 test_EnumDomainAliases(b, tctx, domain_handle, &num_enum),
7508 "failed to enum aliases");
7509 break;
7510 default:
7511 return false;
7512 }
7513
7514 /* dispinfo */
7515
7516 switch (ctx->choice) {
7517 case TORTURE_SAMR_MANY_ACCOUNTS:
7518 torture_assert(tctx,
7519 test_QueryDisplayInfo_level(b, tctx, domain_handle, 1, &num_disp),
7520 "failed to query display info");
7521 break;
7522 case TORTURE_SAMR_MANY_GROUPS:
7523 torture_assert(tctx,
7524 test_QueryDisplayInfo_level(b, tctx, domain_handle, 3, &num_disp),
7525 "failed to query display info");
7526 break;
7527 case TORTURE_SAMR_MANY_ALIASES:
7528 /* no aliases in dispinfo */
7529 break;
7530 default:
7531 return false;
7532 }
7533
7534 /* close or delete */
7535
7536 for (i=0; i < num_total; i++) {
7537
7538 if (ndr_policy_handle_empty(&handles[i])) {
7539 continue;
7540 }
7541
7542 if (torture_setting_bool(tctx, "samba3", false)) {
7543 torture_assert(tctx,
7544 test_samr_handle_Close(b, tctx, &handles[i]),
7545 "failed to close handle");
7546 } else {
7547 switch (ctx->choice) {
7548 case TORTURE_SAMR_MANY_ACCOUNTS:
7549 torture_assert(tctx,
7550 test_DeleteUser(b, tctx, &handles[i]),
7551 "failed to delete user");
7552 break;
7553 case TORTURE_SAMR_MANY_GROUPS:
7554 torture_assert(tctx,
7555 test_DeleteDomainGroup(b, tctx, &handles[i]),
7556 "failed to delete group");
7557 break;
7558 case TORTURE_SAMR_MANY_ALIASES:
7559 torture_assert(tctx,
7560 test_DeleteAlias(b, tctx, &handles[i]),
7561 "failed to delete alias");
7562 break;
7563 default:
7564 return false;
7565 }
7566 }
7567 }
7568
7569 talloc_free(handles);
7570
7571 if (ctx->choice == TORTURE_SAMR_MANY_ACCOUNTS && num_enum != num_anounced + num_created) {
7572 torture_comment(tctx,
7573 "unexpected number of results (%u) returned in enum call, expected %u\n",
7574 num_enum, num_anounced + num_created);
7575
7576 torture_comment(tctx,
7577 "unexpected number of results (%u) returned in dispinfo, call, expected %u\n",
7578 num_disp, num_anounced + num_created);
7579 }
7580
7581 return true;
7582 }
7583
7584 static bool test_Connect(struct dcerpc_binding_handle *b,
7585 struct torture_context *tctx,
7586 struct policy_handle *handle);
7587
7588 static bool test_OpenDomain(struct dcerpc_pipe *p, struct torture_context *tctx,
7589 struct torture_samr_context *ctx, struct dom_sid *sid)
7590 {
7591 struct samr_OpenDomain r;
7592 struct policy_handle domain_handle;
7593 struct policy_handle alias_handle;
7594 struct policy_handle user_handle;
7595 struct policy_handle group_handle;
7596 bool ret = true;
7597 struct dcerpc_binding_handle *b = p->binding_handle;
7598
7599 ZERO_STRUCT(alias_handle);
7600 ZERO_STRUCT(user_handle);
7601 ZERO_STRUCT(group_handle);
7602 ZERO_STRUCT(domain_handle);
7603
7604 torture_comment(tctx, "Testing OpenDomain of %s\n", dom_sid_string(tctx, sid));
7605
7606 r.in.connect_handle = &ctx->handle;
7607 r.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
7608 r.in.sid = sid;
7609 r.out.domain_handle = &domain_handle;
7610
7611 torture_assert_ntstatus_ok(tctx, dcerpc_samr_OpenDomain_r(b, tctx, &r),
7612 "OpenDomain failed");
7613 torture_assert_ntstatus_ok(tctx, r.out.result, "OpenDomain failed");
7614
7615 /* run the domain tests with the main handle closed - this tests
7616 the servers reference counting */
7617 torture_assert(tctx, test_samr_handle_Close(b, tctx, &ctx->handle), "Failed to close SAMR handle");
7618
7619 switch (ctx->choice) {
7620 case TORTURE_SAMR_PASSWORDS:
7621 case TORTURE_SAMR_USER_PRIVILEGES:
7622 if (!torture_setting_bool(tctx, "samba3", false)) {
7623 ret &= test_CreateUser2(p, tctx, &domain_handle, sid, ctx->choice, NULL);
7624 }
7625 ret &= test_CreateUser(p, tctx, &domain_handle, TEST_ACCOUNT_NAME, &user_handle, sid, ctx->choice, NULL, true);
7626 if (!ret) {
7627 torture_warning(tctx, "Testing PASSWORDS or PRIVILEGES on domain %s failed!\n", dom_sid_string(tctx, sid));
7628 }
7629 break;
7630 case TORTURE_SAMR_USER_ATTRIBUTES:
7631 if (!torture_setting_bool(tctx, "samba3", false)) {
7632 ret &= test_CreateUser2(p, tctx, &domain_handle, sid, ctx->choice, NULL);
7633 }
7634 ret &= test_CreateUser(p, tctx, &domain_handle, TEST_ACCOUNT_NAME, &user_handle, sid, ctx->choice, NULL, true);
7635 /* This test needs 'complex' users to validate */
7636 ret &= test_QueryDisplayInfo(b, tctx, &domain_handle);
7637 if (!ret) {
7638 torture_warning(tctx, "Testing ATTRIBUTES on domain %s failed!\n", dom_sid_string(tctx, sid));
7639 }
7640 break;
7641 case TORTURE_SAMR_PASSWORDS_PWDLASTSET:
7642 case TORTURE_SAMR_PASSWORDS_BADPWDCOUNT:
7643 case TORTURE_SAMR_PASSWORDS_LOCKOUT:
7644 if (!torture_setting_bool(tctx, "samba3", false)) {
7645 ret &= test_CreateUser2(p, tctx, &domain_handle, sid, ctx->choice, ctx->machine_credentials);
7646 }
7647 ret &= test_CreateUser(p, tctx, &domain_handle, TEST_ACCOUNT_NAME, &user_handle, sid, ctx->choice, ctx->machine_credentials, true);
7648 if (!ret) {
7649 torture_warning(tctx, "Testing PASSWORDS PWDLASTSET or BADPWDCOUNT on domain %s failed!\n", dom_sid_string(tctx, sid));
7650 }
7651 break;
7652 case TORTURE_SAMR_MANY_ACCOUNTS:
7653 case TORTURE_SAMR_MANY_GROUPS:
7654 case TORTURE_SAMR_MANY_ALIASES:
7655 ret &= test_ManyObjects(p, tctx, &domain_handle, sid, ctx);
7656 if (!ret) {
7657 torture_warning(tctx, "Testing MANY-{ACCOUNTS,GROUPS,ALIASES} on domain %s failed!\n", dom_sid_string(tctx, sid));
7658 }
7659 break;
7660 case TORTURE_SAMR_OTHER:
7661 ret &= test_CreateUser(p, tctx, &domain_handle, TEST_ACCOUNT_NAME, &user_handle, sid, ctx->choice, NULL, true);
7662 if (!ret) {
7663 torture_warning(tctx, "Failed to CreateUser in SAMR-OTHER on domain %s!\n", dom_sid_string(tctx, sid));
7664 }
7665 if (!torture_setting_bool(tctx, "samba3", false)) {
7666 ret &= test_QuerySecurity(b, tctx, &domain_handle);
7667 }
7668 ret &= test_RemoveMemberFromForeignDomain(b, tctx, &domain_handle);
7669 ret &= test_CreateAlias(b, tctx, &domain_handle, TEST_ALIASNAME, &alias_handle, sid, true);
7670 ret &= test_CreateDomainGroup(b, tctx, &domain_handle, TEST_GROUPNAME, &group_handle, sid, true);
7671 ret &= test_GetAliasMembership(b, tctx, &domain_handle);
7672 ret &= test_QueryDomainInfo(p, tctx, &domain_handle);
7673 ret &= test_QueryDomainInfo2(b, tctx, &domain_handle);
7674 ret &= test_EnumDomainUsers_all(b, tctx, &domain_handle);
7675 ret &= test_EnumDomainUsers_async(p, tctx, &domain_handle);
7676 ret &= test_EnumDomainGroups_all(b, tctx, &domain_handle);
7677 ret &= test_EnumDomainAliases_all(b, tctx, &domain_handle);
7678 ret &= test_QueryDisplayInfo2(b, tctx, &domain_handle);
7679 ret &= test_QueryDisplayInfo3(b, tctx, &domain_handle);
7680 ret &= test_QueryDisplayInfo_continue(b, tctx, &domain_handle);
7681
7682 if (torture_setting_bool(tctx, "samba4", false)) {
7683 torture_comment(tctx, "skipping GetDisplayEnumerationIndex test against Samba4\n");
7684 } else {
7685 ret &= test_GetDisplayEnumerationIndex(b, tctx, &domain_handle);
7686 ret &= test_GetDisplayEnumerationIndex2(b, tctx, &domain_handle);
7687 }
7688 ret &= test_GroupList(b, tctx, sid, &domain_handle);
7689 ret &= test_TestPrivateFunctionsDomain(b, tctx, &domain_handle);
7690 ret &= test_RidToSid(b, tctx, sid, &domain_handle);
7691 ret &= test_GetBootKeyInformation(b, tctx, &domain_handle);
7692 if (!ret) {
7693 torture_comment(tctx, "Testing SAMR-OTHER on domain %s failed!\n", dom_sid_string(tctx, sid));
7694 }
7695 break;
7696 }
7697
7698 if (!ndr_policy_handle_empty(&user_handle) &&
7699 !test_DeleteUser(b, tctx, &user_handle)) {
7700 ret = false;
7701 }
7702
7703 if (!ndr_policy_handle_empty(&alias_handle) &&
7704 !test_DeleteAlias(b, tctx, &alias_handle)) {
7705 ret = false;
7706 }
7707
7708 if (!ndr_policy_handle_empty(&group_handle) &&
7709 !test_DeleteDomainGroup(b, tctx, &group_handle)) {
7710 ret = false;
7711 }
7712
7713 torture_assert(tctx, test_samr_handle_Close(b, tctx, &domain_handle), "Failed to close SAMR domain handle");
7714
7715 torture_assert(tctx, test_Connect(b, tctx, &ctx->handle), "Faile to re-connect SAMR handle");
7716 /* reconnect the main handle */
7717
7718 if (!ret) {
7719 torture_warning(tctx, "Testing domain %s failed!\n", dom_sid_string(tctx, sid));
7720 }
7721
7722 return ret;
7723 }
7724
7725 static bool test_LookupDomain(struct dcerpc_pipe *p, struct torture_context *tctx,
7726 struct torture_samr_context *ctx, const char *domain)
7727 {
7728 struct samr_LookupDomain r;
7729 struct dom_sid2 *sid = NULL;
7730 struct lsa_String n1;
7731 struct lsa_String n2;
7732 bool ret = true;
7733 struct dcerpc_binding_handle *b = p->binding_handle;
7734
7735 torture_comment(tctx, "Testing LookupDomain(%s)\n", domain);
7736
7737 /* check for correct error codes */
7738 r.in.connect_handle = &ctx->handle;
7739 r.in.domain_name = &n2;
7740 r.out.sid = &sid;
7741 n2.string = NULL;
7742
7743 torture_assert_ntstatus_ok(tctx, dcerpc_samr_LookupDomain_r(b, tctx, &r),
7744 "LookupDomain failed");
7745 torture_assert_ntstatus_equal(tctx, NT_STATUS_INVALID_PARAMETER, r.out.result, "LookupDomain expected NT_STATUS_INVALID_PARAMETER");
7746
7747 init_lsa_String(&n2, "xxNODOMAINxx");
7748
7749 torture_assert_ntstatus_ok(tctx, dcerpc_samr_LookupDomain_r(b, tctx, &r),
7750 "LookupDomain failed");
7751 torture_assert_ntstatus_equal(tctx, NT_STATUS_NO_SUCH_DOMAIN, r.out.result, "LookupDomain expected NT_STATUS_NO_SUCH_DOMAIN");
7752
7753 r.in.connect_handle = &ctx->handle;
7754
7755 init_lsa_String(&n1, domain);
7756 r.in.domain_name = &n1;
7757
7758 torture_assert_ntstatus_ok(tctx, dcerpc_samr_LookupDomain_r(b, tctx, &r),
7759 "LookupDomain failed");
7760 torture_assert_ntstatus_ok(tctx, r.out.result, "LookupDomain");
7761
7762 if (!test_GetDomPwInfo(p, tctx, &n1)) {
7763 ret = false;
7764 }
7765
7766 if (!test_OpenDomain(p, tctx, ctx, *r.out.sid)) {
7767 ret = false;
7768 }
7769
7770 return ret;
7771 }
7772
7773
7774 static bool test_EnumDomains(struct dcerpc_pipe *p, struct torture_context *tctx,
7775 struct torture_samr_context *ctx)
7776 {
7777 struct samr_EnumDomains r;
7778 uint32_t resume_handle = 0;
7779 uint32_t num_entries = 0;
7780 struct samr_SamArray *sam = NULL;
7781 int i;
7782 bool ret = true;
7783 struct dcerpc_binding_handle *b = p->binding_handle;
7784
7785 r.in.connect_handle = &ctx->handle;
7786 r.in.resume_handle = &resume_handle;
7787 r.in.buf_size = (uint32_t)-1;
7788 r.out.resume_handle = &resume_handle;
7789 r.out.num_entries = &num_entries;
7790 r.out.sam = &sam;
7791
7792 torture_assert_ntstatus_ok(tctx, dcerpc_samr_EnumDomains_r(b, tctx, &r),
7793 "EnumDomains failed");
7794 torture_assert_ntstatus_ok(tctx, r.out.result, "EnumDomains failed");
7795
7796 if (!*r.out.sam) {
7797 return false;
7798 }
7799
7800 for (i=0;i<sam->count;i++) {
7801 if (!test_LookupDomain(p, tctx, ctx,
7802 sam->entries[i].name.string)) {
7803 ret = false;
7804 }
7805 }
7806
7807 torture_assert_ntstatus_ok(tctx, dcerpc_samr_EnumDomains_r(b, tctx, &r),
7808 "EnumDomains failed");
7809 torture_assert_ntstatus_ok(tctx, r.out.result, "EnumDomains failed");
7810
7811 return ret;
7812 }
7813
7814
7815 static bool test_Connect(struct dcerpc_binding_handle *b,
7816 struct torture_context *tctx,
7817 struct policy_handle *handle)
7818 {
7819 struct samr_Connect r;
7820 struct samr_Connect2 r2;
7821 struct samr_Connect3 r3;
7822 struct samr_Connect4 r4;
7823 struct samr_Connect5 r5;
7824 union samr_ConnectInfo info;
7825 struct policy_handle h;
7826 uint32_t level_out = 0;
7827 bool ret = true, got_handle = false;
7828
7829 torture_comment(tctx, "Testing samr_Connect\n");
7830
7831 r.in.system_name = NULL;
7832 r.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
7833 r.out.connect_handle = &h;
7834
7835 torture_assert_ntstatus_ok(tctx, dcerpc_samr_Connect_r(b, tctx, &r),
7836 "Connect failed");
7837 if (!NT_STATUS_IS_OK(r.out.result)) {
7838 torture_comment(tctx, "Connect failed - %s\n", nt_errstr(r.out.result));
7839 ret = false;
7840 } else {
7841 got_handle = true;
7842 *handle = h;
7843 }
7844
7845 torture_comment(tctx, "Testing samr_Connect2\n");
7846
7847 r2.in.system_name = NULL;
7848 r2.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
7849 r2.out.connect_handle = &h;
7850
7851 torture_assert_ntstatus_ok(tctx, dcerpc_samr_Connect2_r(b, tctx, &r2),
7852 "Connect2 failed");
7853 if (!NT_STATUS_IS_OK(r2.out.result)) {
7854 torture_comment(tctx, "Connect2 failed - %s\n", nt_errstr(r2.out.result));
7855 ret = false;
7856 } else {
7857 if (got_handle) {
7858 test_samr_handle_Close(b, tctx, handle);
7859 }
7860 got_handle = true;
7861 *handle = h;
7862 }
7863
7864 torture_comment(tctx, "Testing samr_Connect3\n");
7865
7866 r3.in.system_name = NULL;
7867 r3.in.unknown = 0;
7868 r3.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
7869 r3.out.connect_handle = &h;
7870
7871 torture_assert_ntstatus_ok(tctx, dcerpc_samr_Connect3_r(b, tctx, &r3),
7872 "Connect3 failed");
7873 if (!NT_STATUS_IS_OK(r3.out.result)) {
7874 torture_warning(tctx, "Connect3 failed - %s\n", nt_errstr(r3.out.result));
7875 ret = false;
7876 } else {
7877 if (got_handle) {
7878 test_samr_handle_Close(b, tctx, handle);
7879 }
7880 got_handle = true;
7881 *handle = h;
7882 }
7883
7884 torture_comment(tctx, "Testing samr_Connect4\n");
7885
7886 r4.in.system_name = "";
7887 r4.in.client_version = 0;
7888 r4.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
7889 r4.out.connect_handle = &h;
7890
7891 torture_assert_ntstatus_ok(tctx, dcerpc_samr_Connect4_r(b, tctx, &r4),
7892 "Connect4 failed");
7893 if (!NT_STATUS_IS_OK(r4.out.result)) {
7894 torture_warning(tctx, "Connect4 failed - %s\n", nt_errstr(r4.out.result));
7895 ret = false;
7896 } else {
7897 if (got_handle) {
7898 test_samr_handle_Close(b, tctx, handle);
7899 }
7900 got_handle = true;
7901 *handle = h;
7902 }
7903
7904 torture_comment(tctx, "Testing samr_Connect5\n");
7905
7906 info.info1.client_version = 0;
7907 info.info1.unknown2 = 0;
7908
7909 r5.in.system_name = "";
7910 r5.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
7911 r5.in.level_in = 1;
7912 r5.out.level_out = &level_out;
7913 r5.in.info_in = &info;
7914 r5.out.info_out = &info;
7915 r5.out.connect_handle = &h;
7916
7917 torture_assert_ntstatus_ok(tctx, dcerpc_samr_Connect5_r(b, tctx, &r5),
7918 "Connect5 failed");
7919 if (!NT_STATUS_IS_OK(r5.out.result)) {
7920 torture_warning(tctx, "Connect5 failed - %s\n", nt_errstr(r5.out.result));
7921 ret = false;
7922 } else {
7923 if (got_handle) {
7924 test_samr_handle_Close(b, tctx, handle);
7925 }
7926 got_handle = true;
7927 *handle = h;
7928 }
7929
7930 return ret;
7931 }
7932
7933
7934 static bool test_samr_ValidatePassword(struct dcerpc_pipe *p,
7935 struct torture_context *tctx)
7936 {
7937 struct samr_ValidatePassword r;
7938 union samr_ValidatePasswordReq req;
7939 union samr_ValidatePasswordRep *repp = NULL;
7940 NTSTATUS status;
7941 const char *passwords[] = { "penguin", "p@ssw0rd", "p@ssw0rd123$", NULL };
7942 int i;
7943 struct dcerpc_binding_handle *b = p->binding_handle;
7944
7945 torture_comment(tctx, "Testing samr_ValidatePassword\n");
7946
7947 ZERO_STRUCT(r);
7948 r.in.level = NetValidatePasswordReset;
7949 r.in.req = &req;
7950 r.out.rep = &repp;
7951
7952 ZERO_STRUCT(req);
7953 req.req3.account.string = "non-existant-account-aklsdji";
7954
7955 for (i=0; passwords[i]; i++) {
7956 req.req3.password.string = passwords[i];
7957
7958 status = dcerpc_samr_ValidatePassword_r(b, tctx, &r);
7959 if (NT_STATUS_EQUAL(status, NT_STATUS_RPC_PROCNUM_OUT_OF_RANGE)) {
7960 torture_skip(tctx, "ValidatePassword not supported by server\n");
7961 }
7962 torture_assert_ntstatus_ok(tctx, status,
7963 "samr_ValidatePassword failed");
7964 torture_assert_ntstatus_ok(tctx, r.out.result,
7965 "samr_ValidatePassword failed");
7966 torture_comment(tctx, "Server %s password '%s' with code %i\n",
7967 repp->ctr3.status==SAMR_VALIDATION_STATUS_SUCCESS?"allowed":"refused",
7968 req.req3.password.string, repp->ctr3.status);
7969 }
7970
7971 return true;
7972 }
7973
7974 bool torture_rpc_samr(struct torture_context *torture)
7975 {
7976 NTSTATUS status;
7977 struct dcerpc_pipe *p;
7978 bool ret = true;
7979 struct torture_samr_context *ctx;
7980 struct dcerpc_binding_handle *b;
7981
7982 status = torture_rpc_connection(torture, &p, &ndr_table_samr);
7983 if (!NT_STATUS_IS_OK(status)) {
7984 return false;
7985 }
7986 b = p->binding_handle;
7987
7988 ctx = talloc_zero(torture, struct torture_samr_context);
7989
7990 ctx->choice = TORTURE_SAMR_OTHER;
7991
7992 ret &= test_Connect(b, torture, &ctx->handle);
7993
7994 if (!torture_setting_bool(torture, "samba3", false)) {
7995 ret &= test_QuerySecurity(b, torture, &ctx->handle);
7996 }
7997
7998 ret &= test_EnumDomains(p, torture, ctx);
7999
8000 ret &= test_SetDsrmPassword(b, torture, &ctx->handle);
8001
8002 ret &= test_Shutdown(b, torture, &ctx->handle);
8003
8004 ret &= test_samr_handle_Close(b, torture, &ctx->handle);
8005
8006 return ret;
8007 }
8008
8009
8010 bool torture_rpc_samr_users(struct torture_context *torture)
8011 {
8012 NTSTATUS status;
8013 struct dcerpc_pipe *p;
8014 bool ret = true;
8015 struct torture_samr_context *ctx;
8016 struct dcerpc_binding_handle *b;
8017
8018 status = torture_rpc_connection(torture, &p, &ndr_table_samr);
8019 if (!NT_STATUS_IS_OK(status)) {
8020 return false;
8021 }
8022 b = p->binding_handle;
8023
8024 ctx = talloc_zero(torture, struct torture_samr_context);
8025
8026 ctx->choice = TORTURE_SAMR_USER_ATTRIBUTES;
8027
8028 ret &= test_Connect(b, torture, &ctx->handle);
8029
8030 if (!torture_setting_bool(torture, "samba3", false)) {
8031 ret &= test_QuerySecurity(b, torture, &ctx->handle);
8032 }
8033
8034 ret &= test_EnumDomains(p, torture, ctx);
8035
8036 ret &= test_SetDsrmPassword(b, torture, &ctx->handle);
8037
8038 ret &= test_Shutdown(b, torture, &ctx->handle);
8039
8040 ret &= test_samr_handle_Close(b, torture, &ctx->handle);
8041
8042 return ret;
8043 }
8044
8045
8046 bool torture_rpc_samr_passwords(struct torture_context *torture)
8047 {
8048 NTSTATUS status;
8049 struct dcerpc_pipe *p;
8050 bool ret = true;
8051 struct torture_samr_context *ctx;
8052 struct dcerpc_binding_handle *b;
8053
8054 status = torture_rpc_connection(torture, &p, &ndr_table_samr);
8055 if (!NT_STATUS_IS_OK(status)) {
8056 return false;
8057 }
8058 b = p->binding_handle;
8059
8060 ctx = talloc_zero(torture, struct torture_samr_context);
8061
8062 ctx->choice = TORTURE_SAMR_PASSWORDS;
8063
8064 ret &= test_Connect(b, torture, &ctx->handle);
8065
8066 ret &= test_EnumDomains(p, torture, ctx);
8067
8068 ret &= test_samr_handle_Close(b, torture, &ctx->handle);
8069
8070 ret &= test_samr_ValidatePassword(p, torture);
8071
8072 return ret;
8073 }
8074
8075 static bool torture_rpc_samr_pwdlastset(struct torture_context *torture,
8076 struct dcerpc_pipe *p2,
8077 struct cli_credentials *machine_credentials)
8078 {
8079 NTSTATUS status;
8080 struct dcerpc_pipe *p;
8081 bool ret = true;
8082 struct torture_samr_context *ctx;
8083 struct dcerpc_binding_handle *b;
8084
8085 status = torture_rpc_connection(torture, &p, &ndr_table_samr);
8086 if (!NT_STATUS_IS_OK(status)) {
8087 return false;
8088 }
8089 b = p->binding_handle;
8090
8091 ctx = talloc_zero(torture, struct torture_samr_context);
8092
8093 ctx->choice = TORTURE_SAMR_PASSWORDS_PWDLASTSET;
8094 ctx->machine_credentials = machine_credentials;
8095
8096 ret &= test_Connect(b, torture, &ctx->handle);
8097
8098 ret &= test_EnumDomains(p, torture, ctx);
8099
8100 ret &= test_samr_handle_Close(b, torture, &ctx->handle);
8101
8102 return ret;
8103 }
8104
8105 struct torture_suite *torture_rpc_samr_passwords_pwdlastset(TALLOC_CTX *mem_ctx)
8106 {
8107 struct torture_suite *suite = torture_suite_create(mem_ctx, "samr.passwords.pwdlastset");
8108 struct torture_rpc_tcase *tcase;
8109
8110 tcase = torture_suite_add_machine_bdc_rpc_iface_tcase(suite, "samr",
8111 &ndr_table_samr,
8112 TEST_ACCOUNT_NAME_PWD);
8113
8114 torture_rpc_tcase_add_test_creds(tcase, "pwdLastSet",
8115 torture_rpc_samr_pwdlastset);
8116
8117 return suite;
8118 }
8119
8120 static bool torture_rpc_samr_users_privileges_delete_user(struct torture_context *torture,
8121 struct dcerpc_pipe *p2,
8122 struct cli_credentials *machine_credentials)
8123 {
8124 NTSTATUS status;
8125 struct dcerpc_pipe *p;
8126 bool ret = true;
8127 struct torture_samr_context *ctx;
8128 struct dcerpc_binding_handle *b;
8129
8130 status = torture_rpc_connection(torture, &p, &ndr_table_samr);
8131 if (!NT_STATUS_IS_OK(status)) {
8132 return false;
8133 }
8134 b = p->binding_handle;
8135
8136 ctx = talloc_zero(torture, struct torture_samr_context);
8137
8138 ctx->choice = TORTURE_SAMR_USER_PRIVILEGES;
8139 ctx->machine_credentials = machine_credentials;
8140
8141 ret &= test_Connect(b, torture, &ctx->handle);
8142
8143 ret &= test_EnumDomains(p, torture, ctx);
8144
8145 ret &= test_samr_handle_Close(b, torture, &ctx->handle);
8146
8147 return ret;
8148 }
8149
8150 struct torture_suite *torture_rpc_samr_user_privileges(TALLOC_CTX *mem_ctx)
8151 {
8152 struct torture_suite *suite = torture_suite_create(mem_ctx, "samr.users.privileges");
8153 struct torture_rpc_tcase *tcase;
8154
8155 tcase = torture_suite_add_machine_bdc_rpc_iface_tcase(suite, "samr",
8156 &ndr_table_samr,
8157 TEST_ACCOUNT_NAME_PWD);
8158
8159 torture_rpc_tcase_add_test_creds(tcase, "delete_privileged_user",
8160 torture_rpc_samr_users_privileges_delete_user);
8161
8162 return suite;
8163 }
8164
8165 static bool torture_rpc_samr_many_accounts(struct torture_context *torture,
8166 struct dcerpc_pipe *p2,
8167 void *data)
8168 {
8169 NTSTATUS status;
8170 struct dcerpc_pipe *p;
8171 bool ret = true;
8172 struct torture_samr_context *ctx =
8173 talloc_get_type_abort(data, struct torture_samr_context);
8174 struct dcerpc_binding_handle *b;
8175
8176 status = torture_rpc_connection(torture, &p, &ndr_table_samr);
8177 if (!NT_STATUS_IS_OK(status)) {
8178 return false;
8179 }
8180 b = p->binding_handle;
8181
8182 ctx->choice = TORTURE_SAMR_MANY_ACCOUNTS;
8183 ctx->num_objects_large_dc = torture_setting_int(torture, "large_dc",
8184 ctx->num_objects_large_dc);
8185
8186 ret &= test_Connect(b, torture, &ctx->handle);
8187
8188 ret &= test_EnumDomains(p, torture, ctx);
8189
8190 ret &= test_samr_handle_Close(b, torture, &ctx->handle);
8191
8192 return ret;
8193 }
8194
8195 static bool torture_rpc_samr_many_groups(struct torture_context *torture,
8196 struct dcerpc_pipe *p2,
8197 void *data)
8198 {
8199 NTSTATUS status;
8200 struct dcerpc_pipe *p;
8201 bool ret = true;
8202 struct torture_samr_context *ctx =
8203 talloc_get_type_abort(data, struct torture_samr_context);
8204 struct dcerpc_binding_handle *b;
8205
8206 status = torture_rpc_connection(torture, &p, &ndr_table_samr);
8207 if (!NT_STATUS_IS_OK(status)) {
8208 return false;
8209 }
8210 b = p->binding_handle;
8211
8212 ctx->choice = TORTURE_SAMR_MANY_GROUPS;
8213 ctx->num_objects_large_dc = torture_setting_int(torture, "large_dc",
8214 ctx->num_objects_large_dc);
8215
8216 ret &= test_Connect(b, torture, &ctx->handle);
8217
8218 ret &= test_EnumDomains(p, torture, ctx);
8219
8220 ret &= test_samr_handle_Close(b, torture, &ctx->handle);
8221
8222 return ret;
8223 }
8224
8225 static bool torture_rpc_samr_many_aliases(struct torture_context *torture,
8226 struct dcerpc_pipe *p2,
8227 void *data)
8228 {
8229 NTSTATUS status;
8230 struct dcerpc_pipe *p;
8231 bool ret = true;
8232 struct torture_samr_context *ctx =
8233 talloc_get_type_abort(data, struct torture_samr_context);
8234 struct dcerpc_binding_handle *b;
8235
8236 status = torture_rpc_connection(torture, &p, &ndr_table_samr);
8237 if (!NT_STATUS_IS_OK(status)) {
8238 return false;
8239 }
8240 b = p->binding_handle;
8241
8242 ctx->choice = TORTURE_SAMR_MANY_ALIASES;
8243 ctx->num_objects_large_dc = torture_setting_int(torture, "large_dc",
8244 ctx->num_objects_large_dc);
8245
8246 ret &= test_Connect(b, torture, &ctx->handle);
8247
8248 ret &= test_EnumDomains(p, torture, ctx);
8249
8250 ret &= test_samr_handle_Close(b, torture, &ctx->handle);
8251
8252 return ret;
8253 }
8254
8255 struct torture_suite *torture_rpc_samr_large_dc(TALLOC_CTX *mem_ctx)
8256 {
8257 struct torture_suite *suite = torture_suite_create(mem_ctx, "samr.large-dc");
8258 struct torture_rpc_tcase *tcase;
8259 struct torture_samr_context *ctx;
8260
8261 tcase = torture_suite_add_rpc_iface_tcase(suite, "samr", &ndr_table_samr);
8262
8263 ctx = talloc_zero(suite, struct torture_samr_context);
8264 ctx->num_objects_large_dc = 150;
8265
8266 torture_rpc_tcase_add_test_ex(tcase, "many_aliases",
8267 torture_rpc_samr_many_aliases, ctx);
8268 torture_rpc_tcase_add_test_ex(tcase, "many_groups",
8269 torture_rpc_samr_many_groups, ctx);
8270 torture_rpc_tcase_add_test_ex(tcase, "many_accounts",
8271 torture_rpc_samr_many_accounts, ctx);
8272
8273 return suite;
8274 }
8275
8276 static bool torture_rpc_samr_badpwdcount(struct torture_context *torture,
8277 struct dcerpc_pipe *p2,
8278 struct cli_credentials *machine_credentials)
8279 {
8280 NTSTATUS status;
8281 struct dcerpc_pipe *p;
8282 bool ret = true;
8283 struct torture_samr_context *ctx;
8284 struct dcerpc_binding_handle *b;
8285
8286 status = torture_rpc_connection(torture, &p, &ndr_table_samr);
8287 if (!NT_STATUS_IS_OK(status)) {
8288 return false;
8289 }
8290 b = p->binding_handle;
8291
8292 ctx = talloc_zero(torture, struct torture_samr_context);
8293
8294 ctx->choice = TORTURE_SAMR_PASSWORDS_BADPWDCOUNT;
8295 ctx->machine_credentials = machine_credentials;
8296
8297 ret &= test_Connect(b, torture, &ctx->handle);
8298
8299 ret &= test_EnumDomains(p, torture, ctx);
8300
8301 ret &= test_samr_handle_Close(b, torture, &ctx->handle);
8302
8303 return ret;
8304 }
8305
8306 struct torture_suite *torture_rpc_samr_passwords_badpwdcount(TALLOC_CTX *mem_ctx)
8307 {
8308 struct torture_suite *suite = torture_suite_create(mem_ctx, "samr.passwords.badpwdcount");
8309 struct torture_rpc_tcase *tcase;
8310
8311 tcase = torture_suite_add_machine_bdc_rpc_iface_tcase(suite, "samr",
8312 &ndr_table_samr,
8313 TEST_ACCOUNT_NAME_PWD);
8314
8315 torture_rpc_tcase_add_test_creds(tcase, "badPwdCount",
8316 torture_rpc_samr_badpwdcount);
8317
8318 return suite;
8319 }
8320
8321 static bool torture_rpc_samr_lockout(struct torture_context *torture,
8322 struct dcerpc_pipe *p2,
8323 struct cli_credentials *machine_credentials)
8324 {
8325 NTSTATUS status;
8326 struct dcerpc_pipe *p;
8327 bool ret = true;
8328 struct torture_samr_context *ctx;
8329 struct dcerpc_binding_handle *b;
8330
8331 status = torture_rpc_connection(torture, &p, &ndr_table_samr);
8332 if (!NT_STATUS_IS_OK(status)) {
8333 return false;
8334 }
8335 b = p->binding_handle;
8336
8337 ctx = talloc_zero(torture, struct torture_samr_context);
8338
8339 ctx->choice = TORTURE_SAMR_PASSWORDS_LOCKOUT;
8340 ctx->machine_credentials = machine_credentials;
8341
8342 ret &= test_Connect(b, torture, &ctx->handle);
8343
8344 ret &= test_EnumDomains(p, torture, ctx);
8345
8346 ret &= test_samr_handle_Close(b, torture, &ctx->handle);
8347
8348 return ret;
8349 }
8350
8351 struct torture_suite *torture_rpc_samr_passwords_lockout(TALLOC_CTX *mem_ctx)
8352 {
8353 struct torture_suite *suite = torture_suite_create(mem_ctx, "samr.passwords.lockout");
8354 struct torture_rpc_tcase *tcase;
8355
8356 tcase = torture_suite_add_machine_bdc_rpc_iface_tcase(suite, "samr",
8357 &ndr_table_samr,
8358 TEST_ACCOUNT_NAME_PWD);
8359
8360 torture_rpc_tcase_add_test_creds(tcase, "lockout",
8361 torture_rpc_samr_lockout);
8362
8363 return suite;
8364 }
8365
8366
reg import