?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
s3/torture: adjust dependency to fix build when no winbind was build before
[Samba/gebeck_regimport.git] / source4 / torture / rpc / lsa.c
blob942dd5234b9db92e77a7c5d8e3b5960282fae947
1 /*
2 Unix SMB/CIFS implementation.
3 test suite for lsa rpc operations
4
5 Copyright (C) Andrew Tridgell 2003
6 Copyright (C) Andrew Bartlett <abartlet@samba.org> 2004-2005
7
8 This program is free software; you can redistribute it and/or modify
9 it under the terms of the GNU General Public License as published by
10 the Free Software Foundation; either version 3 of the License, or
11 (at your option) any later version.
12
13 This program is distributed in the hope that it will be useful,
14 but WITHOUT ANY WARRANTY; without even the implied warranty of
15 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
16 GNU General Public License for more details.
17
18 You should have received a copy of the GNU General Public License
19 along with this program. If not, see <http://www.gnu.org/licenses/>.
20 */
21
22 #include "includes.h"
23 #include "torture/torture.h"
24 #include "librpc/gen_ndr/ndr_lsa_c.h"
25 #include "librpc/gen_ndr/netlogon.h"
26 #include "librpc/gen_ndr/ndr_drsblobs.h"
27 #include "librpc/gen_ndr/ndr_netlogon_c.h"
28 #include "lib/events/events.h"
29 #include "libcli/security/security.h"
30 #include "libcli/auth/libcli_auth.h"
31 #include "torture/rpc/torture_rpc.h"
32 #include "param/param.h"
33 #include "../lib/crypto/crypto.h"
34 #define TEST_MACHINENAME "lsatestmach"
35 #define TRUSTPW "12345678"
36
37 static void init_lsa_String(struct lsa_String *name, const char *s)
38 {
39 name->string = s;
40 }
41
42 static bool test_OpenPolicy(struct dcerpc_binding_handle *b,
43 struct torture_context *tctx)
44 {
45 struct lsa_ObjectAttribute attr;
46 struct policy_handle handle;
47 struct lsa_QosInfo qos;
48 struct lsa_OpenPolicy r;
49 uint16_t system_name = '\\';
50
51 torture_comment(tctx, "\nTesting OpenPolicy\n");
52
53 qos.len = 0;
54 qos.impersonation_level = 2;
55 qos.context_mode = 1;
56 qos.effective_only = 0;
57
58 attr.len = 0;
59 attr.root_dir = NULL;
60 attr.object_name = NULL;
61 attr.attributes = 0;
62 attr.sec_desc = NULL;
63 attr.sec_qos = &qos;
64
65 r.in.system_name = &system_name;
66 r.in.attr = &attr;
67 r.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
68 r.out.handle = &handle;
69
70 torture_assert_ntstatus_ok(tctx, dcerpc_lsa_OpenPolicy_r(b, tctx, &r),
71 "OpenPolicy failed");
72
73 torture_assert_ntstatus_ok(tctx,
74 r.out.result,
75 "OpenPolicy failed");
76
77 return true;
78 }
79
80 static bool test_OpenPolicy_fail(struct dcerpc_binding_handle *b,
81 struct torture_context *tctx)
82 {
83 struct lsa_ObjectAttribute attr;
84 struct policy_handle handle;
85 struct lsa_QosInfo qos;
86 struct lsa_OpenPolicy r;
87 uint16_t system_name = '\\';
88 NTSTATUS status;
89
90 torture_comment(tctx, "\nTesting OpenPolicy_fail\n");
91
92 qos.len = 0;
93 qos.impersonation_level = 2;
94 qos.context_mode = 1;
95 qos.effective_only = 0;
96
97 attr.len = 0;
98 attr.root_dir = NULL;
99 attr.object_name = NULL;
100 attr.attributes = 0;
101 attr.sec_desc = NULL;
102 attr.sec_qos = &qos;
103
104 r.in.system_name = &system_name;
105 r.in.attr = &attr;
106 r.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
107 r.out.handle = &handle;
108
109 status = dcerpc_lsa_OpenPolicy_r(b, tctx, &r);
110 if (!NT_STATUS_IS_OK(status)) {
111 if (NT_STATUS_EQUAL(status, NT_STATUS_ACCESS_DENIED)) {
112 torture_comment(tctx,
113 "OpenPolicy correctly returned with "
114 "status: %s\n",
115 nt_errstr(status));
116 return true;
117 }
118
119 torture_assert_ntstatus_equal(tctx,
120 status,
121 NT_STATUS_ACCESS_DENIED,
122 "OpenPolicy return value should "
123 "be ACCESS_DENIED");
124 return true;
125 }
126
127 if (!NT_STATUS_IS_OK(r.out.result)) {
128 if (NT_STATUS_EQUAL(r.out.result, NT_STATUS_ACCESS_DENIED) ||
129 NT_STATUS_EQUAL(r.out.result, NT_STATUS_RPC_PROTSEQ_NOT_SUPPORTED)) {
130 torture_comment(tctx,
131 "OpenPolicy correctly returned with "
132 "result: %s\n",
133 nt_errstr(r.out.result));
134 return true;
135 }
136 }
137
138 torture_assert_ntstatus_equal(tctx,
139 r.out.result,
140 NT_STATUS_OK,
141 "OpenPolicy return value should be "
142 "ACCESS_DENIED");
143
144 return false;
145 }
146
147
148 bool test_lsa_OpenPolicy2_ex(struct dcerpc_binding_handle *b,
149 struct torture_context *tctx,
150 struct policy_handle **handle,
151 NTSTATUS expected_status)
152 {
153 struct lsa_ObjectAttribute attr;
154 struct lsa_QosInfo qos;
155 struct lsa_OpenPolicy2 r;
156 NTSTATUS status;
157
158 torture_comment(tctx, "\nTesting OpenPolicy2\n");
159
160 *handle = talloc(tctx, struct policy_handle);
161 if (!*handle) {
162 return false;
163 }
164
165 qos.len = 0;
166 qos.impersonation_level = 2;
167 qos.context_mode = 1;
168 qos.effective_only = 0;
169
170 attr.len = 0;
171 attr.root_dir = NULL;
172 attr.object_name = NULL;
173 attr.attributes = 0;
174 attr.sec_desc = NULL;
175 attr.sec_qos = &qos;
176
177 r.in.system_name = "\\";
178 r.in.attr = &attr;
179 r.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
180 r.out.handle = *handle;
181
182 status = dcerpc_lsa_OpenPolicy2_r(b, tctx, &r);
183 torture_assert_ntstatus_equal(tctx, status, expected_status,
184 "OpenPolicy2 failed");
185 if (!NT_STATUS_IS_OK(expected_status)) {
186 return true;
187 }
188
189 torture_assert_ntstatus_ok(tctx,
190 r.out.result,
191 "OpenPolicy2 failed");
192
193 return true;
194 }
195
196
197 bool test_lsa_OpenPolicy2(struct dcerpc_binding_handle *b,
198 struct torture_context *tctx,
199 struct policy_handle **handle)
200 {
201 return test_lsa_OpenPolicy2_ex(b, tctx, handle, NT_STATUS_OK);
202 }
203
204 static bool test_OpenPolicy2_fail(struct dcerpc_binding_handle *b,
205 struct torture_context *tctx)
206 {
207 struct lsa_ObjectAttribute attr;
208 struct policy_handle handle;
209 struct lsa_QosInfo qos;
210 struct lsa_OpenPolicy2 r;
211 NTSTATUS status;
212
213 torture_comment(tctx, "\nTesting OpenPolicy2_fail\n");
214
215 qos.len = 0;
216 qos.impersonation_level = 2;
217 qos.context_mode = 1;
218 qos.effective_only = 0;
219
220 attr.len = 0;
221 attr.root_dir = NULL;
222 attr.object_name = NULL;
223 attr.attributes = 0;
224 attr.sec_desc = NULL;
225 attr.sec_qos = &qos;
226
227 r.in.system_name = "\\";
228 r.in.attr = &attr;
229 r.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
230 r.out.handle = &handle;
231
232 status = dcerpc_lsa_OpenPolicy2_r(b, tctx, &r);
233 if (!NT_STATUS_IS_OK(status)) {
234 if (NT_STATUS_EQUAL(status, NT_STATUS_ACCESS_DENIED)) {
235 torture_comment(tctx,
236 "OpenPolicy2 correctly returned with "
237 "status: %s\n",
238 nt_errstr(status));
239 return true;
240 }
241
242 torture_assert_ntstatus_equal(tctx,
243 status,
244 NT_STATUS_ACCESS_DENIED,
245 "OpenPolicy2 return value should "
246 "be ACCESS_DENIED");
247 return true;
248 }
249
250 if (!NT_STATUS_IS_OK(r.out.result)) {
251 if (NT_STATUS_EQUAL(r.out.result, NT_STATUS_ACCESS_DENIED) ||
252 NT_STATUS_EQUAL(r.out.result, NT_STATUS_RPC_PROTSEQ_NOT_SUPPORTED)) {
253 torture_comment(tctx,
254 "OpenPolicy2 correctly returned with "
255 "result: %s\n",
256 nt_errstr(r.out.result));
257 return true;
258 }
259 }
260
261 torture_assert_ntstatus_equal(tctx,
262 r.out.result,
263 NT_STATUS_OK,
264 "OpenPolicy2 return value should be "
265 "ACCESS_DENIED");
266
267 return false;
268 }
269
270 static bool test_LookupNames(struct dcerpc_binding_handle *b,
271 struct torture_context *tctx,
272 struct policy_handle *handle,
273 struct lsa_TransNameArray *tnames)
274 {
275 struct lsa_LookupNames r;
276 struct lsa_TransSidArray sids;
277 struct lsa_RefDomainList *domains = NULL;
278 struct lsa_String *names;
279 uint32_t count = 0;
280 int i;
281 uint32_t *input_idx;
282
283 torture_comment(tctx, "\nTesting LookupNames with %d names\n", tnames->count);
284
285 sids.count = 0;
286 sids.sids = NULL;
287
288
289 r.in.num_names = 0;
290
291 input_idx = talloc_array(tctx, uint32_t, tnames->count);
292 names = talloc_array(tctx, struct lsa_String, tnames->count);
293
294 for (i=0;i<tnames->count;i++) {
295 if (tnames->names[i].sid_type != SID_NAME_UNKNOWN) {
296 init_lsa_String(&names[r.in.num_names], tnames->names[i].name.string);
297 input_idx[r.in.num_names] = i;
298 r.in.num_names++;
299 }
300 }
301
302 r.in.handle = handle;
303 r.in.names = names;
304 r.in.sids = &sids;
305 r.in.level = 1;
306 r.in.count = &count;
307 r.out.count = &count;
308 r.out.sids = &sids;
309 r.out.domains = &domains;
310
311 torture_assert_ntstatus_ok(tctx, dcerpc_lsa_LookupNames_r(b, tctx, &r),
312 "LookupNames failed");
313 if (NT_STATUS_EQUAL(r.out.result, STATUS_SOME_UNMAPPED) ||
314 NT_STATUS_EQUAL(r.out.result, NT_STATUS_NONE_MAPPED)) {
315 for (i=0;i< r.in.num_names;i++) {
316 if (i < count && sids.sids[i].sid_type == SID_NAME_UNKNOWN) {
317 torture_comment(tctx, "LookupName of %s was unmapped\n",
318 tnames->names[i].name.string);
319 } else if (i >=count) {
320 torture_comment(tctx, "LookupName of %s failed to return a result\n",
321 tnames->names[i].name.string);
322 }
323 }
324 torture_comment(tctx, "LookupNames failed - %s\n",
325 nt_errstr(r.out.result));
326 return false;
327 } else if (!NT_STATUS_IS_OK(r.out.result)) {
328 torture_comment(tctx, "LookupNames failed - %s\n",
329 nt_errstr(r.out.result));
330 return false;
331 }
332
333 for (i=0;i< r.in.num_names;i++) {
334 if (i < count) {
335 if (sids.sids[i].sid_type != tnames->names[input_idx[i]].sid_type) {
336 torture_comment(tctx, "LookupName of %s got unexpected name type: %s\n",
337 tnames->names[input_idx[i]].name.string,
338 sid_type_lookup(sids.sids[i].sid_type));
339 return false;
340 }
341 if ((sids.sids[i].sid_type == SID_NAME_DOMAIN) &&
342 (sids.sids[i].rid != (uint32_t)-1)) {
343 torture_comment(tctx, "LookupName of %s got unexpected rid: %d\n",
344 tnames->names[input_idx[i]].name.string, sids.sids[i].rid);
345 return false;
346 }
347 } else if (i >=count) {
348 torture_comment(tctx, "LookupName of %s failed to return a result\n",
349 tnames->names[input_idx[i]].name.string);
350 return false;
351 }
352 }
353 torture_comment(tctx, "\n");
354
355 return true;
356 }
357
358 static bool test_LookupNames_bogus(struct dcerpc_binding_handle *b,
359 struct torture_context *tctx,
360 struct policy_handle *handle)
361 {
362 struct lsa_LookupNames r;
363 struct lsa_TransSidArray sids;
364 struct lsa_RefDomainList *domains = NULL;
365 struct lsa_String names[1];
366 uint32_t count = 0;
367
368 torture_comment(tctx, "\nTesting LookupNames with bogus name\n");
369
370 sids.count = 0;
371 sids.sids = NULL;
372
373 init_lsa_String(&names[0], "NT AUTHORITY\\BOGUS");
374
375 r.in.handle = handle;
376 r.in.num_names = 1;
377 r.in.names = names;
378 r.in.sids = &sids;
379 r.in.level = 1;
380 r.in.count = &count;
381 r.out.count = &count;
382 r.out.sids = &sids;
383 r.out.domains = &domains;
384
385 torture_assert_ntstatus_ok(tctx, dcerpc_lsa_LookupNames_r(b, tctx, &r),
386 "LookupNames bogus failed");
387 if (!NT_STATUS_EQUAL(r.out.result, NT_STATUS_NONE_MAPPED)) {
388 torture_comment(tctx, "LookupNames failed - %s\n",
389 nt_errstr(r.out.result));
390 return false;
391 }
392
393 torture_comment(tctx, "\n");
394
395 return true;
396 }
397
398 static bool test_LookupNames_NULL(struct dcerpc_binding_handle *b,
399 struct torture_context *tctx,
400 struct policy_handle *handle)
401 {
402 struct lsa_LookupNames r;
403 struct lsa_TransSidArray sids;
404 struct lsa_RefDomainList *domains = NULL;
405 struct lsa_String names[1];
406 uint32_t count = 0;
407
408 torture_comment(tctx, "\nTesting LookupNames with NULL name\n");
409
410 sids.count = 0;
411 sids.sids = NULL;
412
413 names[0].string = NULL;
414
415 r.in.handle = handle;
416 r.in.num_names = 1;
417 r.in.names = names;
418 r.in.sids = &sids;
419 r.in.level = 1;
420 r.in.count = &count;
421 r.out.count = &count;
422 r.out.sids = &sids;
423 r.out.domains = &domains;
424
425 /* nt4 returns NT_STATUS_NONE_MAPPED with sid_type
426 * SID_NAME_UNKNOWN, rid 0, and sid_index -1;
427 *
428 * w2k3/w2k8 return NT_STATUS_OK with sid_type
429 * SID_NAME_DOMAIN, rid -1 and sid_index 0 and BUILTIN domain
430 */
431
432 torture_assert_ntstatus_ok(tctx, dcerpc_lsa_LookupNames_r(b, tctx, &r),
433 "LookupNames with NULL name failed");
434 torture_assert_ntstatus_ok(tctx, r.out.result,
435 "LookupNames with NULL name failed");
436
437 torture_comment(tctx, "\n");
438
439 return true;
440 }
441
442 static bool test_LookupNames_wellknown(struct dcerpc_binding_handle *b,
443 struct torture_context *tctx,
444 struct policy_handle *handle)
445 {
446 struct lsa_TranslatedName name;
447 struct lsa_TransNameArray tnames;
448 bool ret = true;
449
450 torture_comment(tctx, "Testing LookupNames with well known names\n");
451
452 tnames.names = &name;
453 tnames.count = 1;
454 name.name.string = "NT AUTHORITY\\SYSTEM";
455 name.sid_type = SID_NAME_WKN_GRP;
456 ret &= test_LookupNames(b, tctx, handle, &tnames);
457
458 name.name.string = "NT AUTHORITY\\ANONYMOUS LOGON";
459 name.sid_type = SID_NAME_WKN_GRP;
460 ret &= test_LookupNames(b, tctx, handle, &tnames);
461
462 name.name.string = "NT AUTHORITY\\Authenticated Users";
463 name.sid_type = SID_NAME_WKN_GRP;
464 ret &= test_LookupNames(b, tctx, handle, &tnames);
465
466 #if 0
467 name.name.string = "NT AUTHORITY";
468 ret &= test_LookupNames(b, tctx, handle, &tnames);
469
470 name.name.string = "NT AUTHORITY\\";
471 ret &= test_LookupNames(b, tctx, handle, &tnames);
472 #endif
473
474 name.name.string = "BUILTIN\\";
475 name.sid_type = SID_NAME_DOMAIN;
476 ret &= test_LookupNames(b, tctx, handle, &tnames);
477
478 name.name.string = "BUILTIN\\Administrators";
479 name.sid_type = SID_NAME_ALIAS;
480 ret &= test_LookupNames(b, tctx, handle, &tnames);
481
482 name.name.string = "SYSTEM";
483 name.sid_type = SID_NAME_WKN_GRP;
484 ret &= test_LookupNames(b, tctx, handle, &tnames);
485
486 name.name.string = "Everyone";
487 name.sid_type = SID_NAME_WKN_GRP;
488 ret &= test_LookupNames(b, tctx, handle, &tnames);
489 return ret;
490 }
491
492 static bool test_LookupNames2(struct dcerpc_binding_handle *b,
493 struct torture_context *tctx,
494 struct policy_handle *handle,
495 struct lsa_TransNameArray2 *tnames,
496 bool check_result)
497 {
498 struct lsa_LookupNames2 r;
499 struct lsa_TransSidArray2 sids;
500 struct lsa_RefDomainList *domains = NULL;
501 struct lsa_String *names;
502 uint32_t *input_idx;
503 uint32_t count = 0;
504 int i;
505
506 torture_comment(tctx, "\nTesting LookupNames2 with %d names\n", tnames->count);
507
508 sids.count = 0;
509 sids.sids = NULL;
510
511 r.in.num_names = 0;
512
513 input_idx = talloc_array(tctx, uint32_t, tnames->count);
514 names = talloc_array(tctx, struct lsa_String, tnames->count);
515
516 for (i=0;i<tnames->count;i++) {
517 if (tnames->names[i].sid_type != SID_NAME_UNKNOWN) {
518 init_lsa_String(&names[r.in.num_names], tnames->names[i].name.string);
519 input_idx[r.in.num_names] = i;
520 r.in.num_names++;
521 }
522 }
523
524 r.in.handle = handle;
525 r.in.names = names;
526 r.in.sids = &sids;
527 r.in.level = 1;
528 r.in.count = &count;
529 r.in.lookup_options = 0;
530 r.in.client_revision = 0;
531 r.out.count = &count;
532 r.out.sids = &sids;
533 r.out.domains = &domains;
534
535 torture_assert_ntstatus_ok(tctx, dcerpc_lsa_LookupNames2_r(b, tctx, &r),
536 "LookupNames2 failed");
537 if (!NT_STATUS_IS_OK(r.out.result)) {
538 torture_comment(tctx, "LookupNames2 failed - %s\n",
539 nt_errstr(r.out.result));
540 return false;
541 }
542
543 if (check_result) {
544 torture_assert_int_equal(tctx, count, sids.count,
545 "unexpected number of results returned");
546 if (sids.count > 0) {
547 torture_assert(tctx, sids.sids, "invalid sid buffer");
548 }
549 }
550
551 torture_comment(tctx, "\n");
552
553 return true;
554 }
555
556
557 static bool test_LookupNames3(struct dcerpc_binding_handle *b,
558 struct torture_context *tctx,
559 struct policy_handle *handle,
560 struct lsa_TransNameArray2 *tnames,
561 bool check_result)
562 {
563 struct lsa_LookupNames3 r;
564 struct lsa_TransSidArray3 sids;
565 struct lsa_RefDomainList *domains = NULL;
566 struct lsa_String *names;
567 uint32_t count = 0;
568 int i;
569 uint32_t *input_idx;
570
571 torture_comment(tctx, "\nTesting LookupNames3 with %d names\n", tnames->count);
572
573 sids.count = 0;
574 sids.sids = NULL;
575
576 r.in.num_names = 0;
577
578 input_idx = talloc_array(tctx, uint32_t, tnames->count);
579 names = talloc_array(tctx, struct lsa_String, tnames->count);
580 for (i=0;i<tnames->count;i++) {
581 if (tnames->names[i].sid_type != SID_NAME_UNKNOWN) {
582 init_lsa_String(&names[r.in.num_names], tnames->names[i].name.string);
583 input_idx[r.in.num_names] = i;
584 r.in.num_names++;
585 }
586 }
587
588 r.in.handle = handle;
589 r.in.names = names;
590 r.in.sids = &sids;
591 r.in.level = 1;
592 r.in.count = &count;
593 r.in.lookup_options = 0;
594 r.in.client_revision = 0;
595 r.out.count = &count;
596 r.out.sids = &sids;
597 r.out.domains = &domains;
598
599 torture_assert_ntstatus_ok(tctx, dcerpc_lsa_LookupNames3_r(b, tctx, &r),
600 "LookupNames3 failed");
601 if (!NT_STATUS_IS_OK(r.out.result)) {
602 torture_comment(tctx, "LookupNames3 failed - %s\n",
603 nt_errstr(r.out.result));
604 return false;
605 }
606
607 if (check_result) {
608 torture_assert_int_equal(tctx, count, sids.count,
609 "unexpected number of results returned");
610 if (sids.count > 0) {
611 torture_assert(tctx, sids.sids, "invalid sid buffer");
612 }
613 }
614
615 torture_comment(tctx, "\n");
616
617 return true;
618 }
619
620 static bool test_LookupNames4(struct dcerpc_binding_handle *b,
621 struct torture_context *tctx,
622 struct lsa_TransNameArray2 *tnames,
623 bool check_result)
624 {
625 struct lsa_LookupNames4 r;
626 struct lsa_TransSidArray3 sids;
627 struct lsa_RefDomainList *domains = NULL;
628 struct lsa_String *names;
629 uint32_t count = 0;
630 int i;
631 uint32_t *input_idx;
632
633 torture_comment(tctx, "\nTesting LookupNames4 with %d names\n", tnames->count);
634
635 sids.count = 0;
636 sids.sids = NULL;
637
638 r.in.num_names = 0;
639
640 input_idx = talloc_array(tctx, uint32_t, tnames->count);
641 names = talloc_array(tctx, struct lsa_String, tnames->count);
642 for (i=0;i<tnames->count;i++) {
643 if (tnames->names[i].sid_type != SID_NAME_UNKNOWN) {
644 init_lsa_String(&names[r.in.num_names], tnames->names[i].name.string);
645 input_idx[r.in.num_names] = i;
646 r.in.num_names++;
647 }
648 }
649
650 r.in.num_names = tnames->count;
651 r.in.names = names;
652 r.in.sids = &sids;
653 r.in.level = 1;
654 r.in.count = &count;
655 r.in.lookup_options = 0;
656 r.in.client_revision = 0;
657 r.out.count = &count;
658 r.out.sids = &sids;
659 r.out.domains = &domains;
660
661 torture_assert_ntstatus_ok(tctx, dcerpc_lsa_LookupNames4_r(b, tctx, &r),
662 "LookupNames4 failed");
663
664 if (!NT_STATUS_IS_OK(r.out.result)) {
665 if (NT_STATUS_EQUAL(r.out.result, NT_STATUS_NONE_MAPPED)) {
666 torture_comment(tctx,
667 "LookupNames4 failed: %s - not considered as an error",
668 nt_errstr(r.out.result));
669
670 return true;
671 }
672
673 torture_assert_ntstatus_ok(tctx,
674 r.out.result,
675 "LookupNames4 failed");
676
677 return false;
678 }
679
680 if (check_result) {
681 torture_assert_int_equal(tctx, count, sids.count,
682 "unexpected number of results returned");
683 if (sids.count > 0) {
684 torture_assert(tctx, sids.sids, "invalid sid buffer");
685 }
686 }
687
688 torture_comment(tctx, "\n");
689
690 return true;
691 }
692
693 static bool test_LookupNames4_fail(struct dcerpc_binding_handle *b,
694 struct torture_context *tctx)
695 {
696 struct lsa_LookupNames4 r;
697 struct lsa_TransSidArray3 sids;
698 struct lsa_RefDomainList *domains = NULL;
699 struct lsa_String *names = NULL;
700 uint32_t count = 0;
701 NTSTATUS status;
702
703 torture_comment(tctx, "\nTesting LookupNames4_fail");
704
705 sids.count = 0;
706 sids.sids = NULL;
707
708 r.in.num_names = 0;
709
710 r.in.num_names = count;
711 r.in.names = names;
712 r.in.sids = &sids;
713 r.in.level = 1;
714 r.in.count = &count;
715 r.in.lookup_options = 0;
716 r.in.client_revision = 0;
717 r.out.count = &count;
718 r.out.sids = &sids;
719 r.out.domains = &domains;
720
721 status = dcerpc_lsa_LookupNames4_r(b, tctx, &r);
722 if (!NT_STATUS_IS_OK(status)) {
723 if (NT_STATUS_EQUAL(status, NT_STATUS_ACCESS_DENIED)) {
724 torture_comment(tctx,
725 "LookupNames4 correctly returned with "
726 "status: %s\n",
727 nt_errstr(status));
728 return true;
729 }
730
731 torture_assert_ntstatus_equal(tctx,
732 status,
733 NT_STATUS_ACCESS_DENIED,
734 "LookupNames4 return value should "
735 "be ACCESS_DENIED");
736 return true;
737 }
738
739 if (!NT_STATUS_IS_OK(r.out.result)) {
740 if (NT_STATUS_EQUAL(r.out.result, NT_STATUS_ACCESS_DENIED) ||
741 NT_STATUS_EQUAL(r.out.result, NT_STATUS_RPC_PROTSEQ_NOT_SUPPORTED)) {
742 torture_comment(tctx,
743 "LookupSids3 correctly returned with "
744 "result: %s\n",
745 nt_errstr(r.out.result));
746 return true;
747 }
748 }
749
750 torture_assert_ntstatus_equal(tctx,
751 r.out.result,
752 NT_STATUS_OK,
753 "LookupNames4 return value should be "
754 "ACCESS_DENIED");
755
756 return false;
757 }
758
759
760 static bool test_LookupSids(struct dcerpc_binding_handle *b,
761 struct torture_context *tctx,
762 struct policy_handle *handle,
763 struct lsa_SidArray *sids)
764 {
765 struct lsa_LookupSids r;
766 struct lsa_TransNameArray names;
767 struct lsa_RefDomainList *domains = NULL;
768 uint32_t count = sids->num_sids;
769
770 torture_comment(tctx, "\nTesting LookupSids\n");
771
772 names.count = 0;
773 names.names = NULL;
774
775 r.in.handle = handle;
776 r.in.sids = sids;
777 r.in.names = &names;
778 r.in.level = 1;
779 r.in.count = &count;
780 r.out.count = &count;
781 r.out.names = &names;
782 r.out.domains = &domains;
783
784 torture_assert_ntstatus_ok(tctx, dcerpc_lsa_LookupSids_r(b, tctx, &r),
785 "LookupSids failed");
786 if (!NT_STATUS_IS_OK(r.out.result) &&
787 !NT_STATUS_EQUAL(r.out.result, STATUS_SOME_UNMAPPED)) {
788 torture_comment(tctx, "LookupSids failed - %s\n",
789 nt_errstr(r.out.result));
790 return false;
791 }
792
793 torture_comment(tctx, "\n");
794
795 if (!test_LookupNames(b, tctx, handle, &names)) {
796 return false;
797 }
798
799 return true;
800 }
801
802
803 static bool test_LookupSids2(struct dcerpc_binding_handle *b,
804 struct torture_context *tctx,
805 struct policy_handle *handle,
806 struct lsa_SidArray *sids)
807 {
808 struct lsa_LookupSids2 r;
809 struct lsa_TransNameArray2 names;
810 struct lsa_RefDomainList *domains = NULL;
811 uint32_t count = sids->num_sids;
812
813 torture_comment(tctx, "\nTesting LookupSids2\n");
814
815 names.count = 0;
816 names.names = NULL;
817
818 r.in.handle = handle;
819 r.in.sids = sids;
820 r.in.names = &names;
821 r.in.level = 1;
822 r.in.count = &count;
823 r.in.lookup_options = 0;
824 r.in.client_revision = 0;
825 r.out.count = &count;
826 r.out.names = &names;
827 r.out.domains = &domains;
828
829 torture_assert_ntstatus_ok(tctx, dcerpc_lsa_LookupSids2_r(b, tctx, &r),
830 "LookupSids2 failed");
831 if (!NT_STATUS_IS_OK(r.out.result) &&
832 !NT_STATUS_EQUAL(r.out.result, STATUS_SOME_UNMAPPED)) {
833 torture_comment(tctx, "LookupSids2 failed - %s\n",
834 nt_errstr(r.out.result));
835 return false;
836 }
837
838 torture_comment(tctx, "\n");
839
840 if (!test_LookupNames2(b, tctx, handle, &names, false)) {
841 return false;
842 }
843
844 if (!test_LookupNames3(b, tctx, handle, &names, false)) {
845 return false;
846 }
847
848 return true;
849 }
850
851 static bool test_LookupSids3(struct dcerpc_binding_handle *b,
852 struct torture_context *tctx,
853 struct lsa_SidArray *sids)
854 {
855 struct lsa_LookupSids3 r;
856 struct lsa_TransNameArray2 names;
857 struct lsa_RefDomainList *domains = NULL;
858 uint32_t count = sids->num_sids;
859
860 torture_comment(tctx, "\nTesting LookupSids3\n");
861
862 names.count = 0;
863 names.names = NULL;
864
865 r.in.sids = sids;
866 r.in.names = &names;
867 r.in.level = 1;
868 r.in.count = &count;
869 r.in.lookup_options = 0;
870 r.in.client_revision = 0;
871 r.out.domains = &domains;
872 r.out.count = &count;
873 r.out.names = &names;
874
875 torture_assert_ntstatus_ok(tctx, dcerpc_lsa_LookupSids3_r(b, tctx, &r),
876 "LookupSids3 failed");
877
878 if (!NT_STATUS_IS_OK(r.out.result)) {
879 if (NT_STATUS_EQUAL(r.out.result, NT_STATUS_NONE_MAPPED)) {
880 torture_comment(tctx,
881 "LookupSids3 failed: %s - not considered as an error",
882 nt_errstr(r.out.result));
883
884 return true;
885 }
886
887 torture_assert_ntstatus_ok(tctx,
888 r.out.result,
889 "LookupSids3 failed");
890
891 return false;
892 }
893
894 torture_comment(tctx, "\n");
895
896 if (!test_LookupNames4(b, tctx, &names, true)) {
897 return false;
898 }
899
900 return true;
901 }
902
903 static bool test_LookupSids3_fail(struct dcerpc_binding_handle *b,
904 struct torture_context *tctx,
905 struct lsa_SidArray *sids)
906 {
907 struct lsa_LookupSids3 r;
908 struct lsa_TransNameArray2 names;
909 struct lsa_RefDomainList *domains = NULL;
910 uint32_t count = sids->num_sids;
911 NTSTATUS status;
912
913 torture_comment(tctx, "\nTesting LookupSids3\n");
914
915 names.count = 0;
916 names.names = NULL;
917
918 r.in.sids = sids;
919 r.in.names = &names;
920 r.in.level = 1;
921 r.in.count = &count;
922 r.in.lookup_options = 0;
923 r.in.client_revision = 0;
924 r.out.domains = &domains;
925 r.out.count = &count;
926 r.out.names = &names;
927
928 status = dcerpc_lsa_LookupSids3_r(b, tctx, &r);
929 if (!NT_STATUS_IS_OK(status)) {
930 if (NT_STATUS_EQUAL(status, NT_STATUS_ACCESS_DENIED)) {
931 torture_comment(tctx,
932 "LookupSids3 correctly returned with "
933 "status: %s\n",
934 nt_errstr(status));
935 return true;
936 }
937
938 torture_assert_ntstatus_equal(tctx,
939 status,
940 NT_STATUS_ACCESS_DENIED,
941 "LookupSids3 return value should "
942 "be ACCESS_DENIED");
943 return true;
944 }
945
946 if (!NT_STATUS_IS_OK(r.out.result)) {
947 if (NT_STATUS_EQUAL(r.out.result, NT_STATUS_ACCESS_DENIED) ||
948 NT_STATUS_EQUAL(r.out.result, NT_STATUS_RPC_PROTSEQ_NOT_SUPPORTED)) {
949 torture_comment(tctx,
950 "LookupNames4 correctly returned with "
951 "result: %s\n",
952 nt_errstr(r.out.result));
953 return true;
954 }
955 }
956
957 torture_assert_ntstatus_equal(tctx,
958 r.out.result,
959 NT_STATUS_OK,
960 "LookupSids3 return value should be "
961 "ACCESS_DENIED");
962
963 return false;
964 }
965
966 bool test_many_LookupSids(struct dcerpc_pipe *p,
967 struct torture_context *tctx,
968 struct policy_handle *handle)
969 {
970 uint32_t count;
971 struct lsa_SidArray sids;
972 int i;
973 struct dcerpc_binding_handle *b = p->binding_handle;
974
975 torture_comment(tctx, "\nTesting LookupSids with lots of SIDs\n");
976
977 sids.num_sids = 100;
978
979 sids.sids = talloc_array(tctx, struct lsa_SidPtr, sids.num_sids);
980
981 for (i=0; i<sids.num_sids; i++) {
982 const char *sidstr = "S-1-5-32-545";
983 sids.sids[i].sid = dom_sid_parse_talloc(tctx, sidstr);
984 }
985
986 count = sids.num_sids;
987
988 if (handle) {
989 struct lsa_LookupSids r;
990 struct lsa_TransNameArray names;
991 struct lsa_RefDomainList *domains = NULL;
992 names.count = 0;
993 names.names = NULL;
994
995 r.in.handle = handle;
996 r.in.sids = &sids;
997 r.in.names = &names;
998 r.in.level = 1;
999 r.in.count = &names.count;
1000 r.out.count = &count;
1001 r.out.names = &names;
1002 r.out.domains = &domains;
1003
1004 torture_assert_ntstatus_ok(tctx, dcerpc_lsa_LookupSids_r(b, tctx, &r),
1005 "LookupSids failed");
1006 if (!NT_STATUS_IS_OK(r.out.result)) {
1007 torture_comment(tctx, "LookupSids failed - %s\n",
1008 nt_errstr(r.out.result));
1009 return false;
1010 }
1011
1012 torture_comment(tctx, "\n");
1013
1014 if (!test_LookupNames(b, tctx, handle, &names)) {
1015 return false;
1016 }
1017 }
1018
1019 if (p->binding->transport == NCACN_NP) {
1020 if (!test_LookupSids3_fail(b, tctx, &sids)) {
1021 return false;
1022 }
1023 if (!test_LookupNames4_fail(b, tctx)) {
1024 return false;
1025 }
1026 } else if (p->binding->transport == NCACN_IP_TCP) {
1027 struct lsa_TransNameArray2 names;
1028
1029 names.count = 0;
1030 names.names = NULL;
1031
1032 if (p->conn->security_state.auth_info->auth_type == DCERPC_AUTH_TYPE_SCHANNEL &&
1033 p->conn->security_state.auth_info->auth_level >= DCERPC_AUTH_LEVEL_INTEGRITY) {
1034 if (!test_LookupSids3(b, tctx, &sids)) {
1035 return false;
1036 }
1037 if (!test_LookupNames4(b, tctx, &names, true)) {
1038 return false;
1039 }
1040 } else {
1041 /*
1042 * If we don't have a secure channel these tests must
1043 * fail with ACCESS_DENIED.
1044 */
1045 if (!test_LookupSids3_fail(b, tctx, &sids)) {
1046 return false;
1047 }
1048 if (!test_LookupNames4_fail(b, tctx)) {
1049 return false;
1050 }
1051 }
1052 }
1053
1054 torture_comment(tctx, "\n");
1055
1056
1057
1058 return true;
1059 }
1060
1061 static void lookupsids_cb(struct tevent_req *subreq)
1062 {
1063 int *replies = (int *)tevent_req_callback_data_void(subreq);
1064 NTSTATUS status;
1065
1066 status = dcerpc_lsa_LookupSids_r_recv(subreq, subreq);
1067 TALLOC_FREE(subreq);
1068 if (!NT_STATUS_IS_OK(status)) {
1069 printf("lookupsids returned %s\n", nt_errstr(status));
1070 *replies = -1;
1071 }
1072
1073 if (*replies >= 0) {
1074 *replies += 1;
1075 }
1076 }
1077
1078 static bool test_LookupSids_async(struct dcerpc_binding_handle *b,
1079 struct torture_context *tctx,
1080 struct policy_handle *handle)
1081 {
1082 struct lsa_SidArray sids;
1083 struct lsa_SidPtr sidptr;
1084 uint32_t *count;
1085 struct lsa_TransNameArray *names;
1086 struct lsa_LookupSids *r;
1087 struct lsa_RefDomainList *domains = NULL;
1088 struct tevent_req **req;
1089 int i, replies;
1090 bool ret = true;
1091 const int num_async_requests = 50;
1092
1093 count = talloc_array(tctx, uint32_t, num_async_requests);
1094 names = talloc_array(tctx, struct lsa_TransNameArray, num_async_requests);
1095 r = talloc_array(tctx, struct lsa_LookupSids, num_async_requests);
1096
1097 torture_comment(tctx, "\nTesting %d async lookupsids request\n", num_async_requests);
1098
1099 req = talloc_array(tctx, struct tevent_req *, num_async_requests);
1100
1101 sids.num_sids = 1;
1102 sids.sids = &sidptr;
1103 sidptr.sid = dom_sid_parse_talloc(tctx, "S-1-5-32-545");
1104
1105 replies = 0;
1106
1107 for (i=0; i<num_async_requests; i++) {
1108 count[i] = 0;
1109 names[i].count = 0;
1110 names[i].names = NULL;
1111
1112 r[i].in.handle = handle;
1113 r[i].in.sids = &sids;
1114 r[i].in.names = &names[i];
1115 r[i].in.level = 1;
1116 r[i].in.count = &names[i].count;
1117 r[i].out.count = &count[i];
1118 r[i].out.names = &names[i];
1119 r[i].out.domains = &domains;
1120
1121 req[i] = dcerpc_lsa_LookupSids_r_send(tctx, tctx->ev, b, &r[i]);
1122 if (req[i] == NULL) {
1123 ret = false;
1124 break;
1125 }
1126
1127 tevent_req_set_callback(req[i], lookupsids_cb, &replies);
1128 }
1129
1130 while (replies >= 0 && replies < num_async_requests) {
1131 tevent_loop_once(tctx->ev);
1132 }
1133
1134 talloc_free(req);
1135
1136 if (replies < 0) {
1137 ret = false;
1138 }
1139
1140 return ret;
1141 }
1142
1143 static bool test_LookupPrivValue(struct dcerpc_binding_handle *b,
1144 struct torture_context *tctx,
1145 struct policy_handle *handle,
1146 struct lsa_String *name)
1147 {
1148 struct lsa_LookupPrivValue r;
1149 struct lsa_LUID luid;
1150
1151 r.in.handle = handle;
1152 r.in.name = name;
1153 r.out.luid = &luid;
1154
1155 torture_assert_ntstatus_ok(tctx, dcerpc_lsa_LookupPrivValue_r(b, tctx, &r),
1156 "LookupPrivValue failed");
1157 if (!NT_STATUS_IS_OK(r.out.result)) {
1158 torture_comment(tctx, "\nLookupPrivValue failed - %s\n",
1159 nt_errstr(r.out.result));
1160 return false;
1161 }
1162
1163 return true;
1164 }
1165
1166 static bool test_LookupPrivName(struct dcerpc_binding_handle *b,
1167 struct torture_context *tctx,
1168 struct policy_handle *handle,
1169 struct lsa_LUID *luid)
1170 {
1171 struct lsa_LookupPrivName r;
1172 struct lsa_StringLarge *name = NULL;
1173
1174 r.in.handle = handle;
1175 r.in.luid = luid;
1176 r.out.name = &name;
1177
1178 torture_assert_ntstatus_ok(tctx, dcerpc_lsa_LookupPrivName_r(b, tctx, &r),
1179 "LookupPrivName failed");
1180 if (!NT_STATUS_IS_OK(r.out.result)) {
1181 torture_comment(tctx, "\nLookupPrivName failed - %s\n",
1182 nt_errstr(r.out.result));
1183 return false;
1184 }
1185
1186 return true;
1187 }
1188
1189 static bool test_RemovePrivilegesFromAccount(struct dcerpc_binding_handle *b,
1190 struct torture_context *tctx,
1191 struct policy_handle *handle,
1192 struct policy_handle *acct_handle,
1193 struct lsa_LUID *luid)
1194 {
1195 struct lsa_RemovePrivilegesFromAccount r;
1196 struct lsa_PrivilegeSet privs;
1197 bool ret = true;
1198
1199 torture_comment(tctx, "\nTesting RemovePrivilegesFromAccount\n");
1200
1201 r.in.handle = acct_handle;
1202 r.in.remove_all = 0;
1203 r.in.privs = &privs;
1204
1205 privs.count = 1;
1206 privs.unknown = 0;
1207 privs.set = talloc_array(tctx, struct lsa_LUIDAttribute, 1);
1208 privs.set[0].luid = *luid;
1209 privs.set[0].attribute = 0;
1210
1211 torture_assert_ntstatus_ok(tctx, dcerpc_lsa_RemovePrivilegesFromAccount_r(b, tctx, &r),
1212 "RemovePrivilegesFromAccount failed");
1213 if (!NT_STATUS_IS_OK(r.out.result)) {
1214
1215 struct lsa_LookupPrivName r_name;
1216 struct lsa_StringLarge *name = NULL;
1217
1218 r_name.in.handle = handle;
1219 r_name.in.luid = luid;
1220 r_name.out.name = &name;
1221
1222 torture_assert_ntstatus_ok(tctx, dcerpc_lsa_LookupPrivName_r(b, tctx, &r_name),
1223 "LookupPrivName failed");
1224 if (!NT_STATUS_IS_OK(r_name.out.result)) {
1225 torture_comment(tctx, "\nLookupPrivName failed - %s\n",
1226 nt_errstr(r_name.out.result));
1227 return false;
1228 }
1229 /* Windows 2008 does not allow this to be removed */
1230 if (strcmp("SeAuditPrivilege", name->string) == 0) {
1231 return ret;
1232 }
1233
1234 torture_comment(tctx, "RemovePrivilegesFromAccount failed to remove %s - %s\n",
1235 name->string,
1236 nt_errstr(r.out.result));
1237 return false;
1238 }
1239
1240 return ret;
1241 }
1242
1243 static bool test_AddPrivilegesToAccount(struct dcerpc_binding_handle *b,
1244 struct torture_context *tctx,
1245 struct policy_handle *acct_handle,
1246 struct lsa_LUID *luid)
1247 {
1248 struct lsa_AddPrivilegesToAccount r;
1249 struct lsa_PrivilegeSet privs;
1250 bool ret = true;
1251
1252 torture_comment(tctx, "\nTesting AddPrivilegesToAccount\n");
1253
1254 r.in.handle = acct_handle;
1255 r.in.privs = &privs;
1256
1257 privs.count = 1;
1258 privs.unknown = 0;
1259 privs.set = talloc_array(tctx, struct lsa_LUIDAttribute, 1);
1260 privs.set[0].luid = *luid;
1261 privs.set[0].attribute = 0;
1262
1263 torture_assert_ntstatus_ok(tctx, dcerpc_lsa_AddPrivilegesToAccount_r(b, tctx, &r),
1264 "AddPrivilegesToAccount failed");
1265 if (!NT_STATUS_IS_OK(r.out.result)) {
1266 torture_comment(tctx, "AddPrivilegesToAccount failed - %s\n",
1267 nt_errstr(r.out.result));
1268 return false;
1269 }
1270
1271 return ret;
1272 }
1273
1274 static bool test_EnumPrivsAccount(struct dcerpc_binding_handle *b,
1275 struct torture_context *tctx,
1276 struct policy_handle *handle,
1277 struct policy_handle *acct_handle)
1278 {
1279 struct lsa_EnumPrivsAccount r;
1280 struct lsa_PrivilegeSet *privs = NULL;
1281 bool ret = true;
1282
1283 torture_comment(tctx, "\nTesting EnumPrivsAccount\n");
1284
1285 r.in.handle = acct_handle;
1286 r.out.privs = &privs;
1287
1288 torture_assert_ntstatus_ok(tctx, dcerpc_lsa_EnumPrivsAccount_r(b, tctx, &r),
1289 "EnumPrivsAccount failed");
1290 if (!NT_STATUS_IS_OK(r.out.result)) {
1291 torture_comment(tctx, "EnumPrivsAccount failed - %s\n",
1292 nt_errstr(r.out.result));
1293 return false;
1294 }
1295
1296 if (privs && privs->count > 0) {
1297 int i;
1298 for (i=0;i<privs->count;i++) {
1299 test_LookupPrivName(b, tctx, handle,
1300 &privs->set[i].luid);
1301 }
1302
1303 ret &= test_RemovePrivilegesFromAccount(b, tctx, handle, acct_handle,
1304 &privs->set[0].luid);
1305 ret &= test_AddPrivilegesToAccount(b, tctx, acct_handle,
1306 &privs->set[0].luid);
1307 }
1308
1309 return ret;
1310 }
1311
1312 static bool test_GetSystemAccessAccount(struct dcerpc_binding_handle *b,
1313 struct torture_context *tctx,
1314 struct policy_handle *handle,
1315 struct policy_handle *acct_handle)
1316 {
1317 uint32_t access_mask;
1318 struct lsa_GetSystemAccessAccount r;
1319
1320 torture_comment(tctx, "\nTesting GetSystemAccessAccount\n");
1321
1322 r.in.handle = acct_handle;
1323 r.out.access_mask = &access_mask;
1324
1325 torture_assert_ntstatus_ok(tctx, dcerpc_lsa_GetSystemAccessAccount_r(b, tctx, &r),
1326 "GetSystemAccessAccount failed");
1327 if (!NT_STATUS_IS_OK(r.out.result)) {
1328 torture_comment(tctx, "GetSystemAccessAccount failed - %s\n",
1329 nt_errstr(r.out.result));
1330 return false;
1331 }
1332
1333 if (r.out.access_mask != NULL) {
1334 torture_comment(tctx, "Rights:");
1335 if (*(r.out.access_mask) & LSA_POLICY_MODE_INTERACTIVE)
1336 torture_comment(tctx, " LSA_POLICY_MODE_INTERACTIVE");
1337 if (*(r.out.access_mask) & LSA_POLICY_MODE_NETWORK)
1338 torture_comment(tctx, " LSA_POLICY_MODE_NETWORK");
1339 if (*(r.out.access_mask) & LSA_POLICY_MODE_BATCH)
1340 torture_comment(tctx, " LSA_POLICY_MODE_BATCH");
1341 if (*(r.out.access_mask) & LSA_POLICY_MODE_SERVICE)
1342 torture_comment(tctx, " LSA_POLICY_MODE_SERVICE");
1343 if (*(r.out.access_mask) & LSA_POLICY_MODE_PROXY)
1344 torture_comment(tctx, " LSA_POLICY_MODE_PROXY");
1345 if (*(r.out.access_mask) & LSA_POLICY_MODE_DENY_INTERACTIVE)
1346 torture_comment(tctx, " LSA_POLICY_MODE_DENY_INTERACTIVE");
1347 if (*(r.out.access_mask) & LSA_POLICY_MODE_DENY_NETWORK)
1348 torture_comment(tctx, " LSA_POLICY_MODE_DENY_NETWORK");
1349 if (*(r.out.access_mask) & LSA_POLICY_MODE_DENY_BATCH)
1350 torture_comment(tctx, " LSA_POLICY_MODE_DENY_BATCH");
1351 if (*(r.out.access_mask) & LSA_POLICY_MODE_DENY_SERVICE)
1352 torture_comment(tctx, " LSA_POLICY_MODE_DENY_SERVICE");
1353 if (*(r.out.access_mask) & LSA_POLICY_MODE_REMOTE_INTERACTIVE)
1354 torture_comment(tctx, " LSA_POLICY_MODE_REMOTE_INTERACTIVE");
1355 if (*(r.out.access_mask) & LSA_POLICY_MODE_DENY_REMOTE_INTERACTIVE)
1356 torture_comment(tctx, " LSA_POLICY_MODE_DENY_REMOTE_INTERACTIVE");
1357 if (*(r.out.access_mask) & LSA_POLICY_MODE_ALL)
1358 torture_comment(tctx, " LSA_POLICY_MODE_ALL");
1359 if (*(r.out.access_mask) & LSA_POLICY_MODE_ALL_NT4)
1360 torture_comment(tctx, " LSA_POLICY_MODE_ALL_NT4");
1361 torture_comment(tctx, "\n");
1362 }
1363
1364 return true;
1365 }
1366
1367 static bool test_Delete(struct dcerpc_binding_handle *b,
1368 struct torture_context *tctx,
1369 struct policy_handle *handle)
1370 {
1371 struct lsa_Delete r;
1372
1373 torture_comment(tctx, "\nTesting Delete\n");
1374
1375 r.in.handle = handle;
1376 torture_assert_ntstatus_ok(tctx, dcerpc_lsa_Delete_r(b, tctx, &r),
1377 "Delete failed");
1378 if (!NT_STATUS_EQUAL(r.out.result, NT_STATUS_NOT_SUPPORTED)) {
1379 torture_comment(tctx, "Delete should have failed NT_STATUS_NOT_SUPPORTED - %s\n", nt_errstr(r.out.result));
1380 return false;
1381 }
1382
1383 return true;
1384 }
1385
1386 static bool test_DeleteObject(struct dcerpc_binding_handle *b,
1387 struct torture_context *tctx,
1388 struct policy_handle *handle)
1389 {
1390 struct lsa_DeleteObject r;
1391
1392 torture_comment(tctx, "\nTesting DeleteObject\n");
1393
1394 r.in.handle = handle;
1395 r.out.handle = handle;
1396 torture_assert_ntstatus_ok(tctx, dcerpc_lsa_DeleteObject_r(b, tctx, &r),
1397 "DeleteObject failed");
1398 if (!NT_STATUS_IS_OK(r.out.result)) {
1399 torture_comment(tctx, "DeleteObject failed - %s\n",
1400 nt_errstr(r.out.result));
1401 return false;
1402 }
1403
1404 return true;
1405 }
1406
1407
1408 static bool test_CreateAccount(struct dcerpc_binding_handle *b,
1409 struct torture_context *tctx,
1410 struct policy_handle *handle)
1411 {
1412 struct lsa_CreateAccount r;
1413 struct dom_sid2 *newsid;
1414 struct policy_handle acct_handle;
1415
1416 newsid = dom_sid_parse_talloc(tctx, "S-1-5-12349876-4321-2854");
1417
1418 torture_comment(tctx, "\nTesting CreateAccount\n");
1419
1420 r.in.handle = handle;
1421 r.in.sid = newsid;
1422 r.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
1423 r.out.acct_handle = &acct_handle;
1424
1425 torture_assert_ntstatus_ok(tctx, dcerpc_lsa_CreateAccount_r(b, tctx, &r),
1426 "CreateAccount failed");
1427 if (NT_STATUS_EQUAL(r.out.result, NT_STATUS_OBJECT_NAME_COLLISION)) {
1428 struct lsa_OpenAccount r_o;
1429 r_o.in.handle = handle;
1430 r_o.in.sid = newsid;
1431 r_o.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
1432 r_o.out.acct_handle = &acct_handle;
1433
1434 torture_assert_ntstatus_ok(tctx, dcerpc_lsa_OpenAccount_r(b, tctx, &r_o),
1435 "OpenAccount failed");
1436 if (!NT_STATUS_IS_OK(r_o.out.result)) {
1437 torture_comment(tctx, "OpenAccount failed - %s\n",
1438 nt_errstr(r_o.out.result));
1439 return false;
1440 }
1441 } else if (!NT_STATUS_IS_OK(r.out.result)) {
1442 torture_comment(tctx, "CreateAccount failed - %s\n",
1443 nt_errstr(r.out.result));
1444 return false;
1445 }
1446
1447 if (!test_Delete(b, tctx, &acct_handle)) {
1448 return false;
1449 }
1450
1451 if (!test_DeleteObject(b, tctx, &acct_handle)) {
1452 return false;
1453 }
1454
1455 return true;
1456 }
1457
1458 static bool test_DeleteTrustedDomain(struct dcerpc_binding_handle *b,
1459 struct torture_context *tctx,
1460 struct policy_handle *handle,
1461 struct lsa_StringLarge name)
1462 {
1463 struct lsa_OpenTrustedDomainByName r;
1464 struct policy_handle trustdom_handle;
1465
1466 r.in.handle = handle;
1467 r.in.name.string = name.string;
1468 r.in.access_mask = SEC_STD_DELETE;
1469 r.out.trustdom_handle = &trustdom_handle;
1470
1471 torture_assert_ntstatus_ok(tctx, dcerpc_lsa_OpenTrustedDomainByName_r(b, tctx, &r),
1472 "OpenTrustedDomainByName failed");
1473 if (!NT_STATUS_IS_OK(r.out.result)) {
1474 torture_comment(tctx, "OpenTrustedDomainByName failed - %s\n", nt_errstr(r.out.result));
1475 return false;
1476 }
1477
1478 if (!test_Delete(b, tctx, &trustdom_handle)) {
1479 return false;
1480 }
1481
1482 if (!test_DeleteObject(b, tctx, &trustdom_handle)) {
1483 return false;
1484 }
1485
1486 return true;
1487 }
1488
1489 static bool test_DeleteTrustedDomainBySid(struct dcerpc_binding_handle *b,
1490 struct torture_context *tctx,
1491 struct policy_handle *handle,
1492 struct dom_sid *sid)
1493 {
1494 struct lsa_DeleteTrustedDomain r;
1495
1496 r.in.handle = handle;
1497 r.in.dom_sid = sid;
1498
1499 torture_assert_ntstatus_ok(tctx, dcerpc_lsa_DeleteTrustedDomain_r(b, tctx, &r),
1500 "DeleteTrustedDomain failed");
1501 if (!NT_STATUS_IS_OK(r.out.result)) {
1502 torture_comment(tctx, "DeleteTrustedDomain failed - %s\n", nt_errstr(r.out.result));
1503 return false;
1504 }
1505
1506 return true;
1507 }
1508
1509
1510 static bool test_CreateSecret(struct dcerpc_pipe *p,
1511 struct torture_context *tctx,
1512 struct policy_handle *handle)
1513 {
1514 NTSTATUS status;
1515 struct lsa_CreateSecret r;
1516 struct lsa_OpenSecret r2;
1517 struct lsa_SetSecret r3;
1518 struct lsa_QuerySecret r4;
1519 struct lsa_SetSecret r5;
1520 struct lsa_QuerySecret r6;
1521 struct lsa_SetSecret r7;
1522 struct lsa_QuerySecret r8;
1523 struct policy_handle sec_handle, sec_handle2, sec_handle3;
1524 struct lsa_DeleteObject d_o;
1525 struct lsa_DATA_BUF buf1;
1526 struct lsa_DATA_BUF_PTR bufp1;
1527 struct lsa_DATA_BUF_PTR bufp2;
1528 DATA_BLOB enc_key;
1529 bool ret = true;
1530 DATA_BLOB session_key;
1531 NTTIME old_mtime, new_mtime;
1532 DATA_BLOB blob1;
1533 const char *secret1 = "abcdef12345699qwerty";
1534 char *secret2;
1535 const char *secret3 = "ABCDEF12345699QWERTY";
1536 char *secret4;
1537 const char *secret5 = "NEW-SAMBA4-SECRET";
1538 char *secret6;
1539 char *secname[2];
1540 int i;
1541 const int LOCAL = 0;
1542 const int GLOBAL = 1;
1543 struct dcerpc_binding_handle *b = p->binding_handle;
1544
1545 secname[LOCAL] = talloc_asprintf(tctx, "torturesecret-%u", (unsigned int)random());
1546 secname[GLOBAL] = talloc_asprintf(tctx, "G$torturesecret-%u", (unsigned int)random());
1547
1548 for (i=0; i< 2; i++) {
1549 torture_comment(tctx, "\nTesting CreateSecret of %s\n", secname[i]);
1550
1551 init_lsa_String(&r.in.name, secname[i]);
1552
1553 r.in.handle = handle;
1554 r.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
1555 r.out.sec_handle = &sec_handle;
1556
1557 torture_assert_ntstatus_ok(tctx, dcerpc_lsa_CreateSecret_r(b, tctx, &r),
1558 "CreateSecret failed");
1559 if (!NT_STATUS_IS_OK(r.out.result)) {
1560 torture_comment(tctx, "CreateSecret failed - %s\n", nt_errstr(r.out.result));
1561 return false;
1562 }
1563
1564 r.in.handle = handle;
1565 r.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
1566 r.out.sec_handle = &sec_handle3;
1567
1568 torture_assert_ntstatus_ok(tctx, dcerpc_lsa_CreateSecret_r(b, tctx, &r),
1569 "CreateSecret failed");
1570 if (!NT_STATUS_EQUAL(r.out.result, NT_STATUS_OBJECT_NAME_COLLISION)) {
1571 torture_comment(tctx, "CreateSecret should have failed OBJECT_NAME_COLLISION - %s\n", nt_errstr(r.out.result));
1572 return false;
1573 }
1574
1575 r2.in.handle = handle;
1576 r2.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
1577 r2.in.name = r.in.name;
1578 r2.out.sec_handle = &sec_handle2;
1579
1580 torture_comment(tctx, "Testing OpenSecret\n");
1581
1582 torture_assert_ntstatus_ok(tctx, dcerpc_lsa_OpenSecret_r(b, tctx, &r2),
1583 "OpenSecret failed");
1584 if (!NT_STATUS_IS_OK(r2.out.result)) {
1585 torture_comment(tctx, "OpenSecret failed - %s\n", nt_errstr(r2.out.result));
1586 return false;
1587 }
1588
1589 status = dcerpc_fetch_session_key(p, &session_key);
1590 if (!NT_STATUS_IS_OK(status)) {
1591 torture_comment(tctx, "dcerpc_fetch_session_key failed - %s\n", nt_errstr(status));
1592 return false;
1593 }
1594
1595 enc_key = sess_encrypt_string(secret1, &session_key);
1596
1597 r3.in.sec_handle = &sec_handle;
1598 r3.in.new_val = &buf1;
1599 r3.in.old_val = NULL;
1600 r3.in.new_val->data = enc_key.data;
1601 r3.in.new_val->length = enc_key.length;
1602 r3.in.new_val->size = enc_key.length;
1603
1604 torture_comment(tctx, "Testing SetSecret\n");
1605
1606 torture_assert_ntstatus_ok(tctx, dcerpc_lsa_SetSecret_r(b, tctx, &r3),
1607 "SetSecret failed");
1608 if (!NT_STATUS_IS_OK(r3.out.result)) {
1609 torture_comment(tctx, "SetSecret failed - %s\n", nt_errstr(r3.out.result));
1610 return false;
1611 }
1612
1613 r3.in.sec_handle = &sec_handle;
1614 r3.in.new_val = &buf1;
1615 r3.in.old_val = NULL;
1616 r3.in.new_val->data = enc_key.data;
1617 r3.in.new_val->length = enc_key.length;
1618 r3.in.new_val->size = enc_key.length;
1619
1620 /* break the encrypted data */
1621 enc_key.data[0]++;
1622
1623 torture_comment(tctx, "Testing SetSecret with broken key\n");
1624
1625 torture_assert_ntstatus_ok(tctx, dcerpc_lsa_SetSecret_r(b, tctx, &r3),
1626 "SetSecret failed");
1627 if (!NT_STATUS_EQUAL(r3.out.result, NT_STATUS_UNKNOWN_REVISION)) {
1628 torture_comment(tctx, "SetSecret should have failed UNKNOWN_REVISION - %s\n", nt_errstr(r3.out.result));
1629 ret = false;
1630 }
1631
1632 data_blob_free(&enc_key);
1633
1634 ZERO_STRUCT(new_mtime);
1635 ZERO_STRUCT(old_mtime);
1636
1637 /* fetch the secret back again */
1638 r4.in.sec_handle = &sec_handle;
1639 r4.in.new_val = &bufp1;
1640 r4.in.new_mtime = &new_mtime;
1641 r4.in.old_val = NULL;
1642 r4.in.old_mtime = NULL;
1643
1644 bufp1.buf = NULL;
1645
1646 torture_comment(tctx, "Testing QuerySecret\n");
1647 torture_assert_ntstatus_ok(tctx, dcerpc_lsa_QuerySecret_r(b, tctx, &r4),
1648 "QuerySecret failed");
1649 if (!NT_STATUS_IS_OK(r4.out.result)) {
1650 torture_comment(tctx, "QuerySecret failed - %s\n", nt_errstr(r4.out.result));
1651 ret = false;
1652 } else {
1653 if (r4.out.new_val == NULL || r4.out.new_val->buf == NULL) {
1654 torture_comment(tctx, "No secret buffer returned\n");
1655 ret = false;
1656 } else {
1657 blob1.data = r4.out.new_val->buf->data;
1658 blob1.length = r4.out.new_val->buf->size;
1659
1660 secret2 = sess_decrypt_string(tctx,
1661 &blob1, &session_key);
1662
1663 if (strcmp(secret1, secret2) != 0) {
1664 torture_comment(tctx, "Returned secret (r4) '%s' doesn't match '%s'\n",
1665 secret2, secret1);
1666 ret = false;
1667 }
1668 }
1669 }
1670
1671 enc_key = sess_encrypt_string(secret3, &session_key);
1672
1673 r5.in.sec_handle = &sec_handle;
1674 r5.in.new_val = &buf1;
1675 r5.in.old_val = NULL;
1676 r5.in.new_val->data = enc_key.data;
1677 r5.in.new_val->length = enc_key.length;
1678 r5.in.new_val->size = enc_key.length;
1679
1680
1681 smb_msleep(200);
1682 torture_comment(tctx, "Testing SetSecret (existing value should move to old)\n");
1683
1684 torture_assert_ntstatus_ok(tctx, dcerpc_lsa_SetSecret_r(b, tctx, &r5),
1685 "SetSecret failed");
1686 if (!NT_STATUS_IS_OK(r5.out.result)) {
1687 torture_comment(tctx, "SetSecret failed - %s\n", nt_errstr(r5.out.result));
1688 ret = false;
1689 }
1690
1691 data_blob_free(&enc_key);
1692
1693 ZERO_STRUCT(new_mtime);
1694 ZERO_STRUCT(old_mtime);
1695
1696 /* fetch the secret back again */
1697 r6.in.sec_handle = &sec_handle;
1698 r6.in.new_val = &bufp1;
1699 r6.in.new_mtime = &new_mtime;
1700 r6.in.old_val = &bufp2;
1701 r6.in.old_mtime = &old_mtime;
1702
1703 bufp1.buf = NULL;
1704 bufp2.buf = NULL;
1705
1706 torture_assert_ntstatus_ok(tctx, dcerpc_lsa_QuerySecret_r(b, tctx, &r6),
1707 "QuerySecret failed");
1708 if (!NT_STATUS_IS_OK(r6.out.result)) {
1709 torture_comment(tctx, "QuerySecret failed - %s\n", nt_errstr(r6.out.result));
1710 ret = false;
1711 secret4 = NULL;
1712 } else {
1713
1714 if (r6.out.new_val->buf == NULL || r6.out.old_val->buf == NULL
1715 || r6.out.new_mtime == NULL || r6.out.old_mtime == NULL) {
1716 torture_comment(tctx, "Both secret buffers and both times not returned\n");
1717 ret = false;
1718 secret4 = NULL;
1719 } else {
1720 blob1.data = r6.out.new_val->buf->data;
1721 blob1.length = r6.out.new_val->buf->size;
1722
1723 secret4 = sess_decrypt_string(tctx,
1724 &blob1, &session_key);
1725
1726 if (strcmp(secret3, secret4) != 0) {
1727 torture_comment(tctx, "Returned NEW secret %s doesn't match %s\n", secret4, secret3);
1728 ret = false;
1729 }
1730
1731 blob1.data = r6.out.old_val->buf->data;
1732 blob1.length = r6.out.old_val->buf->length;
1733
1734 secret2 = sess_decrypt_string(tctx,
1735 &blob1, &session_key);
1736
1737 if (strcmp(secret1, secret2) != 0) {
1738 torture_comment(tctx, "Returned OLD secret %s doesn't match %s\n", secret2, secret1);
1739 ret = false;
1740 }
1741
1742 if (*r6.out.new_mtime == *r6.out.old_mtime) {
1743 torture_comment(tctx, "Returned secret (r6-%d) %s must not have same mtime for both secrets: %s != %s\n",
1744 i,
1745 secname[i],
1746 nt_time_string(tctx, *r6.out.old_mtime),
1747 nt_time_string(tctx, *r6.out.new_mtime));
1748 ret = false;
1749 }
1750 }
1751 }
1752
1753 enc_key = sess_encrypt_string(secret5, &session_key);
1754
1755 r7.in.sec_handle = &sec_handle;
1756 r7.in.old_val = &buf1;
1757 r7.in.old_val->data = enc_key.data;
1758 r7.in.old_val->length = enc_key.length;
1759 r7.in.old_val->size = enc_key.length;
1760 r7.in.new_val = NULL;
1761
1762 torture_comment(tctx, "Testing SetSecret of old Secret only\n");
1763
1764 torture_assert_ntstatus_ok(tctx, dcerpc_lsa_SetSecret_r(b, tctx, &r7),
1765 "SetSecret failed");
1766 if (!NT_STATUS_IS_OK(r7.out.result)) {
1767 torture_comment(tctx, "SetSecret failed - %s\n", nt_errstr(r7.out.result));
1768 ret = false;
1769 }
1770
1771 data_blob_free(&enc_key);
1772
1773 /* fetch the secret back again */
1774 r8.in.sec_handle = &sec_handle;
1775 r8.in.new_val = &bufp1;
1776 r8.in.new_mtime = &new_mtime;
1777 r8.in.old_val = &bufp2;
1778 r8.in.old_mtime = &old_mtime;
1779
1780 bufp1.buf = NULL;
1781 bufp2.buf = NULL;
1782
1783 torture_assert_ntstatus_ok(tctx, dcerpc_lsa_QuerySecret_r(b, tctx, &r8),
1784 "QuerySecret failed");
1785 if (!NT_STATUS_IS_OK(r8.out.result)) {
1786 torture_comment(tctx, "QuerySecret failed - %s\n", nt_errstr(r8.out.result));
1787 ret = false;
1788 } else {
1789 if (!r8.out.new_val || !r8.out.old_val) {
1790 torture_comment(tctx, "in/out pointers not returned, despite being set on in for QuerySecret\n");
1791 ret = false;
1792 } else if (r8.out.new_val->buf != NULL) {
1793 torture_comment(tctx, "NEW secret buffer must not be returned after OLD set\n");
1794 ret = false;
1795 } else if (r8.out.old_val->buf == NULL) {
1796 torture_comment(tctx, "OLD secret buffer was not returned after OLD set\n");
1797 ret = false;
1798 } else if (r8.out.new_mtime == NULL || r8.out.old_mtime == NULL) {
1799 torture_comment(tctx, "Both times not returned after OLD set\n");
1800 ret = false;
1801 } else {
1802 blob1.data = r8.out.old_val->buf->data;
1803 blob1.length = r8.out.old_val->buf->size;
1804
1805 secret6 = sess_decrypt_string(tctx,
1806 &blob1, &session_key);
1807
1808 if (strcmp(secret5, secret6) != 0) {
1809 torture_comment(tctx, "Returned OLD secret %s doesn't match %s\n", secret5, secret6);
1810 ret = false;
1811 }
1812
1813 if (*r8.out.new_mtime != *r8.out.old_mtime) {
1814 torture_comment(tctx, "Returned secret (r8) %s did not had same mtime for both secrets: %s != %s\n",
1815 secname[i],
1816 nt_time_string(tctx, *r8.out.old_mtime),
1817 nt_time_string(tctx, *r8.out.new_mtime));
1818 ret = false;
1819 }
1820 }
1821 }
1822
1823 if (!test_Delete(b, tctx, &sec_handle)) {
1824 ret = false;
1825 }
1826
1827 if (!test_DeleteObject(b, tctx, &sec_handle)) {
1828 return false;
1829 }
1830
1831 d_o.in.handle = &sec_handle2;
1832 d_o.out.handle = &sec_handle2;
1833 torture_assert_ntstatus_ok(tctx, dcerpc_lsa_DeleteObject_r(b, tctx, &d_o),
1834 "DeleteObject failed");
1835 if (!NT_STATUS_EQUAL(d_o.out.result, NT_STATUS_INVALID_HANDLE)) {
1836 torture_comment(tctx, "Second delete expected INVALID_HANDLE - %s\n", nt_errstr(d_o.out.result));
1837 ret = false;
1838 } else {
1839
1840 torture_comment(tctx, "Testing OpenSecret of just-deleted secret\n");
1841
1842 torture_assert_ntstatus_ok(tctx, dcerpc_lsa_OpenSecret_r(b, tctx, &r2),
1843 "OpenSecret failed");
1844 if (!NT_STATUS_EQUAL(r2.out.result, NT_STATUS_OBJECT_NAME_NOT_FOUND)) {
1845 torture_comment(tctx, "OpenSecret expected OBJECT_NAME_NOT_FOUND - %s\n", nt_errstr(r2.out.result));
1846 ret = false;
1847 }
1848 }
1849
1850 }
1851
1852 return ret;
1853 }
1854
1855
1856 static bool test_EnumAccountRights(struct dcerpc_binding_handle *b,
1857 struct torture_context *tctx,
1858 struct policy_handle *acct_handle,
1859 struct dom_sid *sid)
1860 {
1861 struct lsa_EnumAccountRights r;
1862 struct lsa_RightSet rights;
1863
1864 torture_comment(tctx, "\nTesting EnumAccountRights\n");
1865
1866 r.in.handle = acct_handle;
1867 r.in.sid = sid;
1868 r.out.rights = &rights;
1869
1870 torture_assert_ntstatus_ok(tctx, dcerpc_lsa_EnumAccountRights_r(b, tctx, &r),
1871 "EnumAccountRights failed");
1872 if (!NT_STATUS_IS_OK(r.out.result)) {
1873 torture_comment(tctx, "EnumAccountRights of %s failed - %s\n",
1874 dom_sid_string(tctx, sid), nt_errstr(r.out.result));
1875 return false;
1876 }
1877
1878 return true;
1879 }
1880
1881
1882 static bool test_QuerySecurity(struct dcerpc_binding_handle *b,
1883 struct torture_context *tctx,
1884 struct policy_handle *handle,
1885 struct policy_handle *acct_handle)
1886 {
1887 struct lsa_QuerySecurity r;
1888 struct sec_desc_buf *sdbuf = NULL;
1889
1890 if (torture_setting_bool(tctx, "samba4", false)) {
1891 torture_comment(tctx, "\nskipping QuerySecurity test against Samba4\n");
1892 return true;
1893 }
1894
1895 torture_comment(tctx, "\nTesting QuerySecurity\n");
1896
1897 r.in.handle = acct_handle;
1898 r.in.sec_info = SECINFO_OWNER |
1899 SECINFO_GROUP |
1900 SECINFO_DACL;
1901 r.out.sdbuf = &sdbuf;
1902
1903 torture_assert_ntstatus_ok(tctx, dcerpc_lsa_QuerySecurity_r(b, tctx, &r),
1904 "QuerySecurity failed");
1905 if (!NT_STATUS_IS_OK(r.out.result)) {
1906 torture_comment(tctx, "QuerySecurity failed - %s\n", nt_errstr(r.out.result));
1907 return false;
1908 }
1909
1910 return true;
1911 }
1912
1913 static bool test_OpenAccount(struct dcerpc_binding_handle *b,
1914 struct torture_context *tctx,
1915 struct policy_handle *handle,
1916 struct dom_sid *sid)
1917 {
1918 struct lsa_OpenAccount r;
1919 struct policy_handle acct_handle;
1920
1921 torture_comment(tctx, "\nTesting OpenAccount\n");
1922
1923 r.in.handle = handle;
1924 r.in.sid = sid;
1925 r.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
1926 r.out.acct_handle = &acct_handle;
1927
1928 torture_assert_ntstatus_ok(tctx, dcerpc_lsa_OpenAccount_r(b, tctx, &r),
1929 "OpenAccount failed");
1930 if (!NT_STATUS_IS_OK(r.out.result)) {
1931 torture_comment(tctx, "OpenAccount failed - %s\n", nt_errstr(r.out.result));
1932 return false;
1933 }
1934
1935 if (!test_EnumPrivsAccount(b, tctx, handle, &acct_handle)) {
1936 return false;
1937 }
1938
1939 if (!test_GetSystemAccessAccount(b, tctx, handle, &acct_handle)) {
1940 return false;
1941 }
1942
1943 if (!test_QuerySecurity(b, tctx, handle, &acct_handle)) {
1944 return false;
1945 }
1946
1947 return true;
1948 }
1949
1950 static bool test_EnumAccounts(struct dcerpc_binding_handle *b,
1951 struct torture_context *tctx,
1952 struct policy_handle *handle)
1953 {
1954 struct lsa_EnumAccounts r;
1955 struct lsa_SidArray sids1, sids2;
1956 uint32_t resume_handle = 0;
1957 int i;
1958 bool ret = true;
1959
1960 torture_comment(tctx, "\nTesting EnumAccounts\n");
1961
1962 r.in.handle = handle;
1963 r.in.resume_handle = &resume_handle;
1964 r.in.num_entries = 100;
1965 r.out.resume_handle = &resume_handle;
1966 r.out.sids = &sids1;
1967
1968 resume_handle = 0;
1969 while (true) {
1970 torture_assert_ntstatus_ok(tctx, dcerpc_lsa_EnumAccounts_r(b, tctx, &r),
1971 "EnumAccounts failed");
1972 if (NT_STATUS_EQUAL(r.out.result, NT_STATUS_NO_MORE_ENTRIES)) {
1973 break;
1974 }
1975 if (!NT_STATUS_IS_OK(r.out.result)) {
1976 torture_comment(tctx, "EnumAccounts failed - %s\n", nt_errstr(r.out.result));
1977 return false;
1978 }
1979
1980 if (!test_LookupSids(b, tctx, handle, &sids1)) {
1981 return false;
1982 }
1983
1984 if (!test_LookupSids2(b, tctx, handle, &sids1)) {
1985 return false;
1986 }
1987
1988 /* Can't test lookupSids3 here, as clearly we must not
1989 * be on schannel, or we would not be able to do the
1990 * rest */
1991
1992 torture_comment(tctx, "Testing all accounts\n");
1993 for (i=0;i<sids1.num_sids;i++) {
1994 ret &= test_OpenAccount(b, tctx, handle, sids1.sids[i].sid);
1995 ret &= test_EnumAccountRights(b, tctx, handle, sids1.sids[i].sid);
1996 }
1997 torture_comment(tctx, "\n");
1998 }
1999
2000 if (sids1.num_sids < 3) {
2001 return ret;
2002 }
2003
2004 torture_comment(tctx, "Trying EnumAccounts partial listing (asking for 1 at 2)\n");
2005 resume_handle = 2;
2006 r.in.num_entries = 1;
2007 r.out.sids = &sids2;
2008
2009 torture_assert_ntstatus_ok(tctx, dcerpc_lsa_EnumAccounts_r(b, tctx, &r),
2010 "EnumAccounts failed");
2011 if (!NT_STATUS_IS_OK(r.out.result)) {
2012 torture_comment(tctx, "EnumAccounts failed - %s\n", nt_errstr(r.out.result));
2013 return false;
2014 }
2015
2016 if (sids2.num_sids != 1) {
2017 torture_comment(tctx, "Returned wrong number of entries (%d)\n", sids2.num_sids);
2018 return false;
2019 }
2020
2021 return true;
2022 }
2023
2024 static bool test_LookupPrivDisplayName(struct dcerpc_binding_handle *b,
2025 struct torture_context *tctx,
2026 struct policy_handle *handle,
2027 struct lsa_String *priv_name)
2028 {
2029 struct lsa_LookupPrivDisplayName r;
2030 /* produce a reasonable range of language output without screwing up
2031 terminals */
2032 uint16_t language_id = (random() % 4) + 0x409;
2033 uint16_t returned_language_id = 0;
2034 struct lsa_StringLarge *disp_name = NULL;
2035
2036 torture_comment(tctx, "\nTesting LookupPrivDisplayName(%s)\n", priv_name->string);
2037
2038 r.in.handle = handle;
2039 r.in.name = priv_name;
2040 r.in.language_id = language_id;
2041 r.in.language_id_sys = 0;
2042 r.out.returned_language_id = &returned_language_id;
2043 r.out.disp_name = &disp_name;
2044
2045 torture_assert_ntstatus_ok(tctx, dcerpc_lsa_LookupPrivDisplayName_r(b, tctx, &r),
2046 "LookupPrivDisplayName failed");
2047 if (!NT_STATUS_IS_OK(r.out.result)) {
2048 torture_comment(tctx, "LookupPrivDisplayName failed - %s\n", nt_errstr(r.out.result));
2049 return false;
2050 }
2051 torture_comment(tctx, "%s -> \"%s\" (language 0x%x/0x%x)\n",
2052 priv_name->string, disp_name->string,
2053 r.in.language_id, *r.out.returned_language_id);
2054
2055 return true;
2056 }
2057
2058 static bool test_EnumAccountsWithUserRight(struct dcerpc_binding_handle *b,
2059 struct torture_context *tctx,
2060 struct policy_handle *handle,
2061 struct lsa_String *priv_name)
2062 {
2063 struct lsa_EnumAccountsWithUserRight r;
2064 struct lsa_SidArray sids;
2065
2066 ZERO_STRUCT(sids);
2067
2068 torture_comment(tctx, "\nTesting EnumAccountsWithUserRight(%s)\n", priv_name->string);
2069
2070 r.in.handle = handle;
2071 r.in.name = priv_name;
2072 r.out.sids = &sids;
2073
2074 torture_assert_ntstatus_ok(tctx, dcerpc_lsa_EnumAccountsWithUserRight_r(b, tctx, &r),
2075 "EnumAccountsWithUserRight failed");
2076
2077 /* NT_STATUS_NO_MORE_ENTRIES means noone has this privilege */
2078 if (NT_STATUS_EQUAL(r.out.result, NT_STATUS_NO_MORE_ENTRIES)) {
2079 return true;
2080 }
2081
2082 if (!NT_STATUS_IS_OK(r.out.result)) {
2083 torture_comment(tctx, "EnumAccountsWithUserRight failed - %s\n", nt_errstr(r.out.result));
2084 return false;
2085 }
2086
2087 return true;
2088 }
2089
2090
2091 static bool test_EnumPrivs(struct dcerpc_binding_handle *b,
2092 struct torture_context *tctx,
2093 struct policy_handle *handle)
2094 {
2095 struct lsa_EnumPrivs r;
2096 struct lsa_PrivArray privs1;
2097 uint32_t resume_handle = 0;
2098 int i;
2099 bool ret = true;
2100
2101 torture_comment(tctx, "\nTesting EnumPrivs\n");
2102
2103 r.in.handle = handle;
2104 r.in.resume_handle = &resume_handle;
2105 r.in.max_count = 100;
2106 r.out.resume_handle = &resume_handle;
2107 r.out.privs = &privs1;
2108
2109 resume_handle = 0;
2110 torture_assert_ntstatus_ok(tctx, dcerpc_lsa_EnumPrivs_r(b, tctx, &r),
2111 "EnumPrivs failed");
2112 if (!NT_STATUS_IS_OK(r.out.result)) {
2113 torture_comment(tctx, "EnumPrivs failed - %s\n", nt_errstr(r.out.result));
2114 return false;
2115 }
2116
2117 for (i = 0; i< privs1.count; i++) {
2118 test_LookupPrivDisplayName(b, tctx, handle, (struct lsa_String *)&privs1.privs[i].name);
2119 test_LookupPrivValue(b, tctx, handle, (struct lsa_String *)&privs1.privs[i].name);
2120 if (!test_EnumAccountsWithUserRight(b, tctx, handle, (struct lsa_String *)&privs1.privs[i].name)) {
2121 ret = false;
2122 }
2123 }
2124
2125 return ret;
2126 }
2127
2128 static bool test_QueryForestTrustInformation(struct dcerpc_binding_handle *b,
2129 struct torture_context *tctx,
2130 struct policy_handle *handle,
2131 const char *trusted_domain_name)
2132 {
2133 bool ret = true;
2134 struct lsa_lsaRQueryForestTrustInformation r;
2135 struct lsa_String string;
2136 struct lsa_ForestTrustInformation info, *info_ptr;
2137
2138 torture_comment(tctx, "\nTesting lsaRQueryForestTrustInformation\n");
2139
2140 if (torture_setting_bool(tctx, "samba4", false)) {
2141 torture_comment(tctx, "skipping QueryForestTrustInformation against Samba4\n");
2142 return true;
2143 }
2144
2145 ZERO_STRUCT(string);
2146
2147 if (trusted_domain_name) {
2148 init_lsa_String(&string, trusted_domain_name);
2149 }
2150
2151 info_ptr = &info;
2152
2153 r.in.handle = handle;
2154 r.in.trusted_domain_name = &string;
2155 r.in.unknown = 0;
2156 r.out.forest_trust_info = &info_ptr;
2157
2158 torture_assert_ntstatus_ok(tctx, dcerpc_lsa_lsaRQueryForestTrustInformation_r(b, tctx, &r),
2159 "lsaRQueryForestTrustInformation failed");
2160
2161 if (!NT_STATUS_IS_OK(r.out.result)) {
2162 torture_comment(tctx, "lsaRQueryForestTrustInformation of %s failed - %s\n", trusted_domain_name, nt_errstr(r.out.result));
2163 ret = false;
2164 }
2165
2166 return ret;
2167 }
2168
2169 static bool test_query_each_TrustDomEx(struct dcerpc_binding_handle *b,
2170 struct torture_context *tctx,
2171 struct policy_handle *handle,
2172 struct lsa_DomainListEx *domains)
2173 {
2174 int i;
2175 bool ret = true;
2176
2177 for (i=0; i< domains->count; i++) {
2178
2179 if (domains->domains[i].trust_attributes & NETR_TRUST_ATTRIBUTE_FOREST_TRANSITIVE) {
2180 ret &= test_QueryForestTrustInformation(b, tctx, handle,
2181 domains->domains[i].domain_name.string);
2182 }
2183 }
2184
2185 return ret;
2186 }
2187
2188 static bool test_query_each_TrustDom(struct dcerpc_binding_handle *b,
2189 struct torture_context *tctx,
2190 struct policy_handle *handle,
2191 struct lsa_DomainList *domains)
2192 {
2193 int i,j;
2194 bool ret = true;
2195
2196 torture_comment(tctx, "\nTesting OpenTrustedDomain, OpenTrustedDomainByName and QueryInfoTrustedDomain\n");
2197 for (i=0; i< domains->count; i++) {
2198 struct lsa_OpenTrustedDomain trust;
2199 struct lsa_OpenTrustedDomainByName trust_by_name;
2200 struct policy_handle trustdom_handle;
2201 struct policy_handle handle2;
2202 struct lsa_Close c;
2203 struct lsa_CloseTrustedDomainEx c_trust;
2204 int levels [] = {1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13};
2205 int ok[] = {1, 0, 1, 0, 0, 1, 0, 1, 0, 0, 0, 1, 1};
2206
2207 if (domains->domains[i].sid) {
2208 trust.in.handle = handle;
2209 trust.in.sid = domains->domains[i].sid;
2210 trust.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
2211 trust.out.trustdom_handle = &trustdom_handle;
2212
2213 torture_assert_ntstatus_ok(tctx, dcerpc_lsa_OpenTrustedDomain_r(b, tctx, &trust),
2214 "OpenTrustedDomain failed");
2215
2216 if (!NT_STATUS_IS_OK(trust.out.result)) {
2217 torture_comment(tctx, "OpenTrustedDomain failed - %s\n", nt_errstr(trust.out.result));
2218 return false;
2219 }
2220
2221 c.in.handle = &trustdom_handle;
2222 c.out.handle = &handle2;
2223
2224 c_trust.in.handle = &trustdom_handle;
2225 c_trust.out.handle = &handle2;
2226
2227 for (j=0; j < ARRAY_SIZE(levels); j++) {
2228 struct lsa_QueryTrustedDomainInfo q;
2229 union lsa_TrustedDomainInfo *info = NULL;
2230 q.in.trustdom_handle = &trustdom_handle;
2231 q.in.level = levels[j];
2232 q.out.info = &info;
2233 torture_assert_ntstatus_ok(tctx, dcerpc_lsa_QueryTrustedDomainInfo_r(b, tctx, &q),
2234 "QueryTrustedDomainInfo failed");
2235 if (!NT_STATUS_IS_OK(q.out.result) && ok[j]) {
2236 torture_comment(tctx, "QueryTrustedDomainInfo level %d failed - %s\n",
2237 levels[j], nt_errstr(q.out.result));
2238 ret = false;
2239 } else if (NT_STATUS_IS_OK(q.out.result) && !ok[j]) {
2240 torture_comment(tctx, "QueryTrustedDomainInfo level %d unexpectedly succeeded - %s\n",
2241 levels[j], nt_errstr(q.out.result));
2242 ret = false;
2243 }
2244 }
2245
2246 torture_assert_ntstatus_ok(tctx, dcerpc_lsa_CloseTrustedDomainEx_r(b, tctx, &c_trust),
2247 "CloseTrustedDomainEx failed");
2248 if (!NT_STATUS_EQUAL(c_trust.out.result, NT_STATUS_NOT_IMPLEMENTED)) {
2249 torture_comment(tctx, "Expected CloseTrustedDomainEx to return NT_STATUS_NOT_IMPLEMENTED, instead - %s\n", nt_errstr(c_trust.out.result));
2250 return false;
2251 }
2252
2253 c.in.handle = &trustdom_handle;
2254 c.out.handle = &handle2;
2255
2256 torture_assert_ntstatus_ok(tctx, dcerpc_lsa_Close_r(b, tctx, &c),
2257 "Close failed");
2258 if (!NT_STATUS_IS_OK(c.out.result)) {
2259 torture_comment(tctx, "Close of trusted domain failed - %s\n", nt_errstr(c.out.result));
2260 return false;
2261 }
2262
2263 for (j=0; j < ARRAY_SIZE(levels); j++) {
2264 struct lsa_QueryTrustedDomainInfoBySid q;
2265 union lsa_TrustedDomainInfo *info = NULL;
2266
2267 if (!domains->domains[i].sid) {
2268 continue;
2269 }
2270
2271 q.in.handle = handle;
2272 q.in.dom_sid = domains->domains[i].sid;
2273 q.in.level = levels[j];
2274 q.out.info = &info;
2275
2276 torture_assert_ntstatus_ok(tctx, dcerpc_lsa_QueryTrustedDomainInfoBySid_r(b, tctx, &q),
2277 "lsa_QueryTrustedDomainInfoBySid failed");
2278 if (!NT_STATUS_IS_OK(q.out.result) && ok[j]) {
2279 torture_comment(tctx, "QueryTrustedDomainInfoBySid level %d failed - %s\n",
2280 levels[j], nt_errstr(q.out.result));
2281 ret = false;
2282 } else if (NT_STATUS_IS_OK(q.out.result) && !ok[j]) {
2283 torture_comment(tctx, "QueryTrustedDomainInfoBySid level %d unexpectedly succeeded - %s\n",
2284 levels[j], nt_errstr(q.out.result));
2285 ret = false;
2286 }
2287 }
2288 }
2289
2290 trust_by_name.in.handle = handle;
2291 trust_by_name.in.name.string = domains->domains[i].name.string;
2292 trust_by_name.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
2293 trust_by_name.out.trustdom_handle = &trustdom_handle;
2294
2295 torture_assert_ntstatus_ok(tctx, dcerpc_lsa_OpenTrustedDomainByName_r(b, tctx, &trust_by_name),
2296 "OpenTrustedDomainByName failed");
2297
2298 if (!NT_STATUS_IS_OK(trust_by_name.out.result)) {
2299 torture_comment(tctx, "OpenTrustedDomainByName failed - %s\n", nt_errstr(trust_by_name.out.result));
2300 return false;
2301 }
2302
2303 for (j=0; j < ARRAY_SIZE(levels); j++) {
2304 struct lsa_QueryTrustedDomainInfo q;
2305 union lsa_TrustedDomainInfo *info = NULL;
2306 q.in.trustdom_handle = &trustdom_handle;
2307 q.in.level = levels[j];
2308 q.out.info = &info;
2309 torture_assert_ntstatus_ok(tctx, dcerpc_lsa_QueryTrustedDomainInfo_r(b, tctx, &q),
2310 "QueryTrustedDomainInfo failed");
2311 if (!NT_STATUS_IS_OK(q.out.result) && ok[j]) {
2312 torture_comment(tctx, "QueryTrustedDomainInfo level %d failed - %s\n",
2313 levels[j], nt_errstr(q.out.result));
2314 ret = false;
2315 } else if (NT_STATUS_IS_OK(q.out.result) && !ok[j]) {
2316 torture_comment(tctx, "QueryTrustedDomainInfo level %d unexpectedly succeeded - %s\n",
2317 levels[j], nt_errstr(q.out.result));
2318 ret = false;
2319 }
2320 }
2321
2322 c.in.handle = &trustdom_handle;
2323 c.out.handle = &handle2;
2324
2325 torture_assert_ntstatus_ok(tctx, dcerpc_lsa_Close_r(b, tctx, &c),
2326 "Close failed");
2327 if (!NT_STATUS_IS_OK(c.out.result)) {
2328 torture_comment(tctx, "Close of trusted domain failed - %s\n", nt_errstr(c.out.result));
2329 return false;
2330 }
2331
2332 for (j=0; j < ARRAY_SIZE(levels); j++) {
2333 struct lsa_QueryTrustedDomainInfoByName q;
2334 union lsa_TrustedDomainInfo *info = NULL;
2335 struct lsa_String name;
2336
2337 name.string = domains->domains[i].name.string;
2338
2339 q.in.handle = handle;
2340 q.in.trusted_domain = &name;
2341 q.in.level = levels[j];
2342 q.out.info = &info;
2343 torture_assert_ntstatus_ok(tctx, dcerpc_lsa_QueryTrustedDomainInfoByName_r(b, tctx, &q),
2344 "QueryTrustedDomainInfoByName failed");
2345 if (!NT_STATUS_IS_OK(q.out.result) && ok[j]) {
2346 torture_comment(tctx, "QueryTrustedDomainInfoByName level %d failed - %s\n",
2347 levels[j], nt_errstr(q.out.result));
2348 ret = false;
2349 } else if (NT_STATUS_IS_OK(q.out.result) && !ok[j]) {
2350 torture_comment(tctx, "QueryTrustedDomainInfoByName level %d unexpectedly succeeded - %s\n",
2351 levels[j], nt_errstr(q.out.result));
2352 ret = false;
2353 }
2354 }
2355 }
2356 return ret;
2357 }
2358
2359 static bool test_EnumTrustDom(struct dcerpc_binding_handle *b,
2360 struct torture_context *tctx,
2361 struct policy_handle *handle)
2362 {
2363 struct lsa_EnumTrustDom r;
2364 uint32_t in_resume_handle = 0;
2365 uint32_t out_resume_handle;
2366 struct lsa_DomainList domains;
2367 bool ret = true;
2368
2369 torture_comment(tctx, "\nTesting EnumTrustDom\n");
2370
2371 r.in.handle = handle;
2372 r.in.resume_handle = &in_resume_handle;
2373 r.in.max_size = 0;
2374 r.out.domains = &domains;
2375 r.out.resume_handle = &out_resume_handle;
2376
2377 torture_assert_ntstatus_ok(tctx, dcerpc_lsa_EnumTrustDom_r(b, tctx, &r),
2378 "lsa_EnumTrustDom failed");
2379
2380 /* according to MS-LSAD 3.1.4.7.8 output resume handle MUST
2381 * always be larger than the previous input resume handle, in
2382 * particular when hitting the last query it is vital to set the
2383 * resume handle correctly to avoid infinite client loops, as
2384 * seen e.g. with Windows XP SP3 when resume handle is 0 and
2385 * status is NT_STATUS_OK - gd */
2386
2387 if (NT_STATUS_IS_OK(r.out.result) ||
2388 NT_STATUS_EQUAL(r.out.result, NT_STATUS_NO_MORE_ENTRIES) ||
2389 NT_STATUS_EQUAL(r.out.result, STATUS_MORE_ENTRIES))
2390 {
2391 if (out_resume_handle <= in_resume_handle) {
2392 torture_comment(tctx, "EnumTrustDom failed - should have returned output resume_handle (0x%08x) larger than input resume handle (0x%08x)\n",
2393 out_resume_handle, in_resume_handle);
2394 return false;
2395 }
2396 }
2397
2398 if (NT_STATUS_IS_OK(r.out.result)) {
2399 if (domains.count == 0) {
2400 torture_comment(tctx, "EnumTrustDom failed - should have returned 'NT_STATUS_NO_MORE_ENTRIES' for 0 trusted domains\n");
2401 return false;
2402 }
2403 } else if (!(NT_STATUS_EQUAL(r.out.result, STATUS_MORE_ENTRIES) || NT_STATUS_EQUAL(r.out.result, NT_STATUS_NO_MORE_ENTRIES))) {
2404 torture_comment(tctx, "EnumTrustDom of zero size failed - %s\n", nt_errstr(r.out.result));
2405 return false;
2406 }
2407
2408 /* Start from the bottom again */
2409 in_resume_handle = 0;
2410
2411 do {
2412 r.in.handle = handle;
2413 r.in.resume_handle = &in_resume_handle;
2414 r.in.max_size = LSA_ENUM_TRUST_DOMAIN_MULTIPLIER * 3;
2415 r.out.domains = &domains;
2416 r.out.resume_handle = &out_resume_handle;
2417
2418 torture_assert_ntstatus_ok(tctx, dcerpc_lsa_EnumTrustDom_r(b, tctx, &r),
2419 "EnumTrustDom failed");
2420
2421 /* according to MS-LSAD 3.1.4.7.8 output resume handle MUST
2422 * always be larger than the previous input resume handle, in
2423 * particular when hitting the last query it is vital to set the
2424 * resume handle correctly to avoid infinite client loops, as
2425 * seen e.g. with Windows XP SP3 when resume handle is 0 and
2426 * status is NT_STATUS_OK - gd */
2427
2428 if (NT_STATUS_IS_OK(r.out.result) ||
2429 NT_STATUS_EQUAL(r.out.result, NT_STATUS_NO_MORE_ENTRIES) ||
2430 NT_STATUS_EQUAL(r.out.result, STATUS_MORE_ENTRIES))
2431 {
2432 if (out_resume_handle <= in_resume_handle) {
2433 torture_comment(tctx, "EnumTrustDom failed - should have returned output resume_handle (0x%08x) larger than input resume handle (0x%08x)\n",
2434 out_resume_handle, in_resume_handle);
2435 return false;
2436 }
2437 }
2438
2439 /* NO_MORE_ENTRIES is allowed */
2440 if (NT_STATUS_EQUAL(r.out.result, NT_STATUS_NO_MORE_ENTRIES)) {
2441 if (domains.count == 0) {
2442 return true;
2443 }
2444 torture_comment(tctx, "EnumTrustDom failed - should have returned 0 trusted domains with 'NT_STATUS_NO_MORE_ENTRIES'\n");
2445 return false;
2446 } else if (NT_STATUS_EQUAL(r.out.result, STATUS_MORE_ENTRIES)) {
2447 /* Windows 2003 gets this off by one on the first run */
2448 if (r.out.domains->count < 3 || r.out.domains->count > 4) {
2449 torture_comment(tctx, "EnumTrustDom didn't fill the buffer we "
2450 "asked it to (got %d, expected %d / %d == %d entries)\n",
2451 r.out.domains->count, LSA_ENUM_TRUST_DOMAIN_MULTIPLIER * 3,
2452 LSA_ENUM_TRUST_DOMAIN_MULTIPLIER, r.in.max_size);
2453 ret = false;
2454 }
2455 } else if (!NT_STATUS_IS_OK(r.out.result)) {
2456 torture_comment(tctx, "EnumTrustDom failed - %s\n", nt_errstr(r.out.result));
2457 return false;
2458 }
2459
2460 if (domains.count == 0) {
2461 torture_comment(tctx, "EnumTrustDom failed - should have returned 'NT_STATUS_NO_MORE_ENTRIES' for 0 trusted domains\n");
2462 return false;
2463 }
2464
2465 ret &= test_query_each_TrustDom(b, tctx, handle, &domains);
2466
2467 in_resume_handle = out_resume_handle;
2468
2469 } while ((NT_STATUS_EQUAL(r.out.result, STATUS_MORE_ENTRIES)));
2470
2471 return ret;
2472 }
2473
2474 static bool test_EnumTrustDomEx(struct dcerpc_binding_handle *b,
2475 struct torture_context *tctx,
2476 struct policy_handle *handle)
2477 {
2478 struct lsa_EnumTrustedDomainsEx r_ex;
2479 uint32_t resume_handle = 0;
2480 struct lsa_DomainListEx domains_ex;
2481 bool ret = true;
2482
2483 torture_comment(tctx, "\nTesting EnumTrustedDomainsEx\n");
2484
2485 r_ex.in.handle = handle;
2486 r_ex.in.resume_handle = &resume_handle;
2487 r_ex.in.max_size = LSA_ENUM_TRUST_DOMAIN_EX_MULTIPLIER * 3;
2488 r_ex.out.domains = &domains_ex;
2489 r_ex.out.resume_handle = &resume_handle;
2490
2491 torture_assert_ntstatus_ok(tctx, dcerpc_lsa_EnumTrustedDomainsEx_r(b, tctx, &r_ex),
2492 "EnumTrustedDomainsEx failed");
2493
2494 if (!(NT_STATUS_EQUAL(r_ex.out.result, STATUS_MORE_ENTRIES) || NT_STATUS_EQUAL(r_ex.out.result, NT_STATUS_NO_MORE_ENTRIES))) {
2495 torture_comment(tctx, "EnumTrustedDomainEx of zero size failed - %s\n", nt_errstr(r_ex.out.result));
2496 return false;
2497 }
2498
2499 resume_handle = 0;
2500 do {
2501 r_ex.in.handle = handle;
2502 r_ex.in.resume_handle = &resume_handle;
2503 r_ex.in.max_size = LSA_ENUM_TRUST_DOMAIN_EX_MULTIPLIER * 3;
2504 r_ex.out.domains = &domains_ex;
2505 r_ex.out.resume_handle = &resume_handle;
2506
2507 torture_assert_ntstatus_ok(tctx, dcerpc_lsa_EnumTrustedDomainsEx_r(b, tctx, &r_ex),
2508 "EnumTrustedDomainsEx failed");
2509
2510 /* NO_MORE_ENTRIES is allowed */
2511 if (NT_STATUS_EQUAL(r_ex.out.result, NT_STATUS_NO_MORE_ENTRIES)) {
2512 if (domains_ex.count == 0) {
2513 return true;
2514 }
2515 torture_comment(tctx, "EnumTrustDomainsEx failed - should have returned 0 trusted domains with 'NT_STATUS_NO_MORE_ENTRIES'\n");
2516 return false;
2517 } else if (NT_STATUS_EQUAL(r_ex.out.result, STATUS_MORE_ENTRIES)) {
2518 /* Windows 2003 gets this off by one on the first run */
2519 if (r_ex.out.domains->count < 3 || r_ex.out.domains->count > 4) {
2520 torture_comment(tctx, "EnumTrustDom didn't fill the buffer we "
2521 "asked it to (got %d, expected %d / %d == %d entries)\n",
2522 r_ex.out.domains->count,
2523 r_ex.in.max_size,
2524 LSA_ENUM_TRUST_DOMAIN_EX_MULTIPLIER,
2525 r_ex.in.max_size / LSA_ENUM_TRUST_DOMAIN_EX_MULTIPLIER);
2526 }
2527 } else if (!NT_STATUS_IS_OK(r_ex.out.result)) {
2528 torture_comment(tctx, "EnumTrustedDomainEx failed - %s\n", nt_errstr(r_ex.out.result));
2529 return false;
2530 }
2531
2532 if (domains_ex.count == 0) {
2533 torture_comment(tctx, "EnumTrustDomainEx failed - should have returned 'NT_STATUS_NO_MORE_ENTRIES' for 0 trusted domains\n");
2534 return false;
2535 }
2536
2537 ret &= test_query_each_TrustDomEx(b, tctx, handle, &domains_ex);
2538
2539 } while ((NT_STATUS_EQUAL(r_ex.out.result, STATUS_MORE_ENTRIES)));
2540
2541 return ret;
2542 }
2543
2544
2545 static bool test_CreateTrustedDomain(struct dcerpc_binding_handle *b,
2546 struct torture_context *tctx,
2547 struct policy_handle *handle,
2548 uint32_t num_trusts)
2549 {
2550 bool ret = true;
2551 struct lsa_CreateTrustedDomain r;
2552 struct lsa_DomainInfo trustinfo;
2553 struct dom_sid **domsid;
2554 struct policy_handle *trustdom_handle;
2555 struct lsa_QueryTrustedDomainInfo q;
2556 union lsa_TrustedDomainInfo *info = NULL;
2557 int i;
2558
2559 torture_comment(tctx, "\nTesting CreateTrustedDomain for %d domains\n", num_trusts);
2560
2561 if (!test_EnumTrustDom(b, tctx, handle)) {
2562 ret = false;
2563 }
2564
2565 if (!test_EnumTrustDomEx(b, tctx, handle)) {
2566 ret = false;
2567 }
2568
2569 domsid = talloc_array(tctx, struct dom_sid *, num_trusts);
2570 trustdom_handle = talloc_array(tctx, struct policy_handle, num_trusts);
2571
2572 for (i=0; i< num_trusts; i++) {
2573 char *trust_name = talloc_asprintf(tctx, "torturedom%02d", i);
2574 char *trust_sid = talloc_asprintf(tctx, "S-1-5-21-97398-379795-100%02d", i);
2575
2576 domsid[i] = dom_sid_parse_talloc(tctx, trust_sid);
2577
2578 trustinfo.sid = domsid[i];
2579 init_lsa_String((struct lsa_String *)&trustinfo.name, trust_name);
2580
2581 r.in.policy_handle = handle;
2582 r.in.info = &trustinfo;
2583 r.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
2584 r.out.trustdom_handle = &trustdom_handle[i];
2585
2586 torture_assert_ntstatus_ok(tctx, dcerpc_lsa_CreateTrustedDomain_r(b, tctx, &r),
2587 "CreateTrustedDomain failed");
2588 if (NT_STATUS_EQUAL(r.out.result, NT_STATUS_OBJECT_NAME_COLLISION)) {
2589 test_DeleteTrustedDomain(b, tctx, handle, trustinfo.name);
2590 torture_assert_ntstatus_ok(tctx, dcerpc_lsa_CreateTrustedDomain_r(b, tctx, &r),
2591 "CreateTrustedDomain failed");
2592 }
2593 if (!NT_STATUS_IS_OK(r.out.result)) {
2594 torture_comment(tctx, "CreateTrustedDomain failed - %s\n", nt_errstr(r.out.result));
2595 ret = false;
2596 } else {
2597
2598 q.in.trustdom_handle = &trustdom_handle[i];
2599 q.in.level = LSA_TRUSTED_DOMAIN_INFO_INFO_EX;
2600 q.out.info = &info;
2601 torture_assert_ntstatus_ok(tctx, dcerpc_lsa_QueryTrustedDomainInfo_r(b, tctx, &q),
2602 "QueryTrustedDomainInfo failed");
2603 if (!NT_STATUS_IS_OK(q.out.result)) {
2604 torture_comment(tctx, "QueryTrustedDomainInfo level %d failed - %s\n", q.in.level, nt_errstr(q.out.result));
2605 ret = false;
2606 } else if (!q.out.info) {
2607 ret = false;
2608 } else {
2609 if (strcmp(info->info_ex.netbios_name.string, trustinfo.name.string) != 0) {
2610 torture_comment(tctx, "QueryTrustedDomainInfo returned inconsistent short name: %s != %s\n",
2611 info->info_ex.netbios_name.string, trustinfo.name.string);
2612 ret = false;
2613 }
2614 if (info->info_ex.trust_type != LSA_TRUST_TYPE_DOWNLEVEL) {
2615 torture_comment(tctx, "QueryTrustedDomainInfo of %s returned incorrect trust type %d != %d\n",
2616 trust_name, info->info_ex.trust_type, LSA_TRUST_TYPE_DOWNLEVEL);
2617 ret = false;
2618 }
2619 if (info->info_ex.trust_attributes != 0) {
2620 torture_comment(tctx, "QueryTrustedDomainInfo of %s returned incorrect trust attributes %d != %d\n",
2621 trust_name, info->info_ex.trust_attributes, 0);
2622 ret = false;
2623 }
2624 if (info->info_ex.trust_direction != LSA_TRUST_DIRECTION_OUTBOUND) {
2625 torture_comment(tctx, "QueryTrustedDomainInfo of %s returned incorrect trust direction %d != %d\n",
2626 trust_name, info->info_ex.trust_direction, LSA_TRUST_DIRECTION_OUTBOUND);
2627 ret = false;
2628 }
2629 }
2630 }
2631 }
2632
2633 /* now that we have some domains to look over, we can test the enum calls */
2634 if (!test_EnumTrustDom(b, tctx, handle)) {
2635 ret = false;
2636 }
2637
2638 if (!test_EnumTrustDomEx(b, tctx, handle)) {
2639 ret = false;
2640 }
2641
2642 for (i=0; i<num_trusts; i++) {
2643 if (!test_DeleteTrustedDomainBySid(b, tctx, handle, domsid[i])) {
2644 ret = false;
2645 }
2646 }
2647
2648 return ret;
2649 }
2650
2651 static bool gen_authinfo_internal(TALLOC_CTX *mem_ctx, const char *password,
2652 DATA_BLOB session_key,
2653 struct lsa_TrustDomainInfoAuthInfoInternal **_authinfo_internal)
2654 {
2655 struct lsa_TrustDomainInfoAuthInfoInternal *authinfo_internal;
2656 struct trustDomainPasswords auth_struct;
2657 struct AuthenticationInformation *auth_info_array;
2658 size_t converted_size;
2659 DATA_BLOB auth_blob;
2660 enum ndr_err_code ndr_err;
2661
2662 authinfo_internal = talloc_zero(mem_ctx, struct lsa_TrustDomainInfoAuthInfoInternal);
2663 if (authinfo_internal == NULL) {
2664 return false;
2665 }
2666
2667 auth_info_array = talloc_array(mem_ctx,
2668 struct AuthenticationInformation, 1);
2669 if (auth_info_array == NULL) {
2670 return false;
2671 }
2672
2673 generate_random_buffer(auth_struct.confounder, sizeof(auth_struct.confounder));
2674
2675 auth_info_array[0].AuthType = TRUST_AUTH_TYPE_CLEAR;
2676
2677 if (!convert_string_talloc(mem_ctx, CH_UNIX, CH_UTF16, password,
2678 strlen(password),
2679 &auth_info_array[0].AuthInfo.clear.password,
2680 &converted_size)) {
2681 return false;
2682 }
2683
2684 auth_info_array[0].AuthInfo.clear.size = converted_size;
2685
2686 auth_struct.outgoing.count = 1;
2687 auth_struct.outgoing.current.count = 1;
2688 auth_struct.outgoing.current.array = auth_info_array;
2689 auth_struct.outgoing.previous.count = 0;
2690 auth_struct.outgoing.previous.array = NULL;
2691
2692 auth_struct.incoming.count = 1;
2693 auth_struct.incoming.current.count = 1;
2694 auth_struct.incoming.current.array = auth_info_array;
2695 auth_struct.incoming.previous.count = 0;
2696 auth_struct.incoming.previous.array = NULL;
2697
2698
2699 ndr_err = ndr_push_struct_blob(&auth_blob, mem_ctx, &auth_struct,
2700 (ndr_push_flags_fn_t)ndr_push_trustDomainPasswords);
2701 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
2702 return false;
2703 }
2704
2705 arcfour_crypt_blob(auth_blob.data, auth_blob.length, &session_key);
2706
2707 authinfo_internal->auth_blob.size = auth_blob.length;
2708 authinfo_internal->auth_blob.data = auth_blob.data;
2709
2710 *_authinfo_internal = authinfo_internal;
2711
2712 return true;
2713 }
2714
2715 static bool gen_authinfo(TALLOC_CTX *mem_ctx, const char *password,
2716 struct lsa_TrustDomainInfoAuthInfo **_authinfo)
2717 {
2718 struct lsa_TrustDomainInfoAuthInfo *authinfo;
2719 struct lsa_TrustDomainInfoBuffer *info_buffer;
2720 size_t converted_size;
2721
2722 authinfo = talloc_zero(mem_ctx, struct lsa_TrustDomainInfoAuthInfo);
2723 if (authinfo == NULL) {
2724 return false;
2725 }
2726
2727 info_buffer = talloc_zero(mem_ctx, struct lsa_TrustDomainInfoBuffer);
2728 if (info_buffer == NULL) {
2729 return false;
2730 }
2731
2732 info_buffer->AuthType = TRUST_AUTH_TYPE_CLEAR;
2733
2734 if (!convert_string_talloc(mem_ctx, CH_UNIX, CH_UTF16, password,
2735 strlen(password),
2736 &info_buffer->data.data,
2737 &converted_size)) {
2738 return false;
2739 }
2740
2741 info_buffer->data.size = converted_size;
2742
2743 authinfo->incoming_count = 1;
2744 authinfo->incoming_current_auth_info = info_buffer;
2745 authinfo->incoming_previous_auth_info = NULL;
2746 authinfo->outgoing_count = 1;
2747 authinfo->outgoing_current_auth_info = info_buffer;
2748 authinfo->outgoing_previous_auth_info = NULL;
2749
2750 *_authinfo = authinfo;
2751
2752 return true;
2753 }
2754
2755 static bool check_pw_with_ServerAuthenticate3(struct dcerpc_pipe *p,
2756 struct torture_context *tctx,
2757 uint32_t negotiate_flags,
2758 struct cli_credentials *machine_credentials,
2759 struct netlogon_creds_CredentialState **creds_out)
2760 {
2761 struct netr_ServerReqChallenge r;
2762 struct netr_ServerAuthenticate3 a;
2763 struct netr_Credential credentials1, credentials2, credentials3;
2764 struct netlogon_creds_CredentialState *creds;
2765 struct samr_Password mach_password;
2766 uint32_t rid;
2767 const char *machine_name;
2768 const char *plain_pass;
2769 struct dcerpc_binding_handle *b = p->binding_handle;
2770
2771 machine_name = cli_credentials_get_workstation(machine_credentials);
2772 plain_pass = cli_credentials_get_password(machine_credentials);
2773
2774 r.in.server_name = NULL;
2775 r.in.computer_name = machine_name;
2776 r.in.credentials = &credentials1;
2777 r.out.return_credentials = &credentials2;
2778
2779 generate_random_buffer(credentials1.data, sizeof(credentials1.data));
2780
2781 torture_assert_ntstatus_ok(tctx, dcerpc_netr_ServerReqChallenge_r(b, tctx, &r),
2782 "ServerReqChallenge failed");
2783 torture_assert_ntstatus_ok(tctx, r.out.result, "ServerReqChallenge failed");
2784
2785 E_md4hash(plain_pass, mach_password.hash);
2786
2787 a.in.server_name = NULL;
2788 a.in.account_name = talloc_asprintf(tctx, "%s$", machine_name);
2789 a.in.secure_channel_type = cli_credentials_get_secure_channel_type(machine_credentials);
2790 a.in.computer_name = machine_name;
2791 a.in.negotiate_flags = &negotiate_flags;
2792 a.in.credentials = &credentials3;
2793 a.out.return_credentials = &credentials3;
2794 a.out.negotiate_flags = &negotiate_flags;
2795 a.out.rid = &rid;
2796
2797 creds = netlogon_creds_client_init(tctx, a.in.account_name,
2798 a.in.computer_name,
2799 &credentials1, &credentials2,
2800 &mach_password, &credentials3,
2801 negotiate_flags);
2802
2803 torture_assert(tctx, creds != NULL, "memory allocation");
2804
2805 torture_assert_ntstatus_ok(tctx, dcerpc_netr_ServerAuthenticate3_r(b, tctx, &a),
2806 "ServerAuthenticate3 failed");
2807 if (!NT_STATUS_IS_OK(a.out.result)) {
2808 if (!NT_STATUS_EQUAL(a.out.result, NT_STATUS_ACCESS_DENIED)) {
2809 torture_assert_ntstatus_ok(tctx, a.out.result,
2810 "ServerAuthenticate3 failed");
2811 }
2812 return false;
2813 }
2814 torture_assert(tctx, netlogon_creds_client_check(creds, &credentials3), "Credential chaining failed");
2815
2816 /* Prove that requesting a challenge again won't break it */
2817 torture_assert_ntstatus_ok(tctx, dcerpc_netr_ServerReqChallenge_r(b, tctx, &r),
2818 "ServerReqChallenge failed");
2819 torture_assert_ntstatus_ok(tctx, r.out.result, "ServerReqChallenge failed");
2820
2821 *creds_out = creds;
2822 return true;
2823 }
2824
2825 static bool check_dom_trust_pw(struct dcerpc_pipe *p,
2826 struct torture_context *tctx,
2827 const char *trusted_dom_name,
2828 const char *password)
2829 {
2830 struct cli_credentials *credentials;
2831 char *dummy;
2832 struct netlogon_creds_CredentialState *creds;
2833 struct dcerpc_pipe *pipe;
2834 NTSTATUS status;
2835 bool ok;
2836
2837 credentials = cli_credentials_init(tctx);
2838 if (credentials == NULL) {
2839 return false;
2840 }
2841
2842 dummy = talloc_asprintf(tctx, "%s$", trusted_dom_name);
2843 if (dummy == NULL) {
2844 return false;
2845 }
2846
2847 cli_credentials_set_username(credentials, dummy, CRED_SPECIFIED);
2848 cli_credentials_set_password(credentials, password, CRED_SPECIFIED);
2849 cli_credentials_set_workstation(credentials,
2850 trusted_dom_name, CRED_SPECIFIED);
2851 cli_credentials_set_secure_channel_type(credentials, SEC_CHAN_DOMAIN);
2852
2853 status = dcerpc_pipe_connect_b(tctx, &pipe, p->binding,
2854 &ndr_table_netlogon,
2855 cli_credentials_init_anon(tctx),
2856 tctx->ev, tctx->lp_ctx);
2857 if (!NT_STATUS_IS_OK(status)) {
2858 torture_comment(tctx, "dcerpc_pipe_connect_b failed.\n");
2859 return false;
2860 }
2861
2862 ok = check_pw_with_ServerAuthenticate3(pipe, tctx,
2863 NETLOGON_NEG_AUTH2_ADS_FLAGS,
2864 credentials, &creds);
2865 talloc_free(pipe);
2866
2867 return ok;
2868 }
2869
2870 static bool test_CreateTrustedDomainEx_common(struct dcerpc_pipe *p,
2871 struct torture_context *tctx,
2872 struct policy_handle *handle,
2873 uint32_t num_trusts,
2874 bool ex2_call)
2875 {
2876 NTSTATUS status;
2877 bool ret = true;
2878 struct lsa_CreateTrustedDomainEx r;
2879 struct lsa_CreateTrustedDomainEx2 r2;
2880 struct lsa_TrustDomainInfoInfoEx trustinfo;
2881 struct lsa_TrustDomainInfoAuthInfoInternal *authinfo_internal;
2882 struct lsa_TrustDomainInfoAuthInfo *authinfo;
2883 struct dom_sid **domsid;
2884 struct policy_handle *trustdom_handle;
2885 struct lsa_QueryTrustedDomainInfo q;
2886 union lsa_TrustedDomainInfo *info = NULL;
2887 DATA_BLOB session_key;
2888 int i;
2889 struct dcerpc_binding_handle *b = p->binding_handle;
2890
2891 if (ex2_call) {
2892 torture_comment(tctx, "\nTesting CreateTrustedDomainEx2 for %d domains\n", num_trusts);
2893 } else {
2894 torture_comment(tctx, "\nTesting CreateTrustedDomainEx for %d domains\n", num_trusts);
2895 }
2896
2897 domsid = talloc_array(tctx, struct dom_sid *, num_trusts);
2898 trustdom_handle = talloc_array(tctx, struct policy_handle, num_trusts);
2899
2900 status = dcerpc_fetch_session_key(p, &session_key);
2901 if (!NT_STATUS_IS_OK(status)) {
2902 torture_comment(tctx, "dcerpc_fetch_session_key failed - %s\n", nt_errstr(status));
2903 return false;
2904 }
2905
2906 for (i=0; i< num_trusts; i++) {
2907 char *trust_name = talloc_asprintf(tctx, "torturedom%02d", i);
2908 char *trust_name_dns = talloc_asprintf(tctx, "torturedom%02d.samba.example.com", i);
2909 char *trust_sid = talloc_asprintf(tctx, "S-1-5-21-97398-379795-100%02d", i);
2910
2911 domsid[i] = dom_sid_parse_talloc(tctx, trust_sid);
2912
2913 trustinfo.sid = domsid[i];
2914 trustinfo.netbios_name.string = trust_name;
2915 trustinfo.domain_name.string = trust_name_dns;
2916
2917 /* Create inbound, some outbound, and some
2918 * bi-directional trusts in a repeating pattern based
2919 * on i */
2920
2921 /* 1 == inbound, 2 == outbound, 3 == both */
2922 trustinfo.trust_direction = (i % 3) + 1;
2923
2924 /* Try different trust types too */
2925
2926 /* 1 == downlevel (NT4), 2 == uplevel (ADS), 3 == MIT (kerberos but not AD) */
2927 trustinfo.trust_type = (((i / 3) + 1) % 3) + 1;
2928
2929 trustinfo.trust_attributes = LSA_TRUST_ATTRIBUTE_USES_RC4_ENCRYPTION;
2930
2931 if (!gen_authinfo_internal(tctx, TRUSTPW, session_key, &authinfo_internal)) {
2932 torture_comment(tctx, "gen_authinfo_internal failed");
2933 ret = false;
2934 }
2935
2936 if (!gen_authinfo(tctx, TRUSTPW, &authinfo)) {
2937 torture_comment(tctx, "gen_authinfonfo failed");
2938 ret = false;
2939 }
2940
2941 if (ex2_call) {
2942
2943 r2.in.policy_handle = handle;
2944 r2.in.info = &trustinfo;
2945 r2.in.auth_info_internal = authinfo_internal;
2946 r2.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
2947 r2.out.trustdom_handle = &trustdom_handle[i];
2948
2949 torture_assert_ntstatus_ok(tctx,
2950 dcerpc_lsa_CreateTrustedDomainEx2_r(b, tctx, &r2),
2951 "CreateTrustedDomainEx2 failed");
2952
2953 status = r2.out.result;
2954 } else {
2955
2956 r.in.policy_handle = handle;
2957 r.in.info = &trustinfo;
2958 r.in.auth_info = authinfo;
2959 r.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
2960 r.out.trustdom_handle = &trustdom_handle[i];
2961
2962 torture_assert_ntstatus_ok(tctx,
2963 dcerpc_lsa_CreateTrustedDomainEx_r(b, tctx, &r),
2964 "CreateTrustedDomainEx failed");
2965
2966 status = r.out.result;
2967 }
2968
2969 if (NT_STATUS_EQUAL(status, NT_STATUS_OBJECT_NAME_COLLISION)) {
2970 test_DeleteTrustedDomain(b, tctx, handle, trustinfo.netbios_name);
2971 if (ex2_call) {
2972 torture_assert_ntstatus_ok(tctx,
2973 dcerpc_lsa_CreateTrustedDomainEx2_r(b, tctx, &r2),
2974 "CreateTrustedDomainEx2 failed");
2975 status = r2.out.result;
2976 } else {
2977 torture_assert_ntstatus_ok(tctx,
2978 dcerpc_lsa_CreateTrustedDomainEx_r(b, tctx, &r),
2979 "CreateTrustedDomainEx2 failed");
2980 status = r.out.result;
2981 }
2982 }
2983 if (!NT_STATUS_IS_OK(status)) {
2984 torture_comment(tctx, "CreateTrustedDomainEx failed2 - %s\n", nt_errstr(status));
2985 ret = false;
2986 } else {
2987 /* For outbound and MIT trusts there is no trust account */
2988 if (trustinfo.trust_direction != 2 &&
2989 trustinfo.trust_type != 3) {
2990
2991 if (torture_setting_bool(tctx, "samba3", false) ||
2992 torture_setting_bool(tctx, "samba4", false)) {
2993 torture_comment(tctx, "skipping trusted domain auth tests against samba");
2994 } else {
2995 if (check_dom_trust_pw(p, tctx, trust_name,
2996 "x" TRUSTPW "x")) {
2997 torture_comment(tctx, "Password check passed unexpectedly\n");
2998 ret = false;
2999 }
3000 if (!check_dom_trust_pw(p, tctx, trust_name,
3001 TRUSTPW)) {
3002 torture_comment(tctx, "Password check failed\n");
3003 ret = false;
3004 }
3005 }
3006 }
3007
3008 q.in.trustdom_handle = &trustdom_handle[i];
3009 q.in.level = LSA_TRUSTED_DOMAIN_INFO_INFO_EX;
3010 q.out.info = &info;
3011 torture_assert_ntstatus_ok(tctx, dcerpc_lsa_QueryTrustedDomainInfo_r(b, tctx, &q),
3012 "QueryTrustedDomainInfo failed");
3013 if (!NT_STATUS_IS_OK(q.out.result)) {
3014 torture_comment(tctx, "QueryTrustedDomainInfo level 1 failed - %s\n", nt_errstr(q.out.result));
3015 ret = false;
3016 } else if (!q.out.info) {
3017 torture_comment(tctx, "QueryTrustedDomainInfo level 1 failed to return an info pointer\n");
3018 ret = false;
3019 } else {
3020 if (strcmp(info->info_ex.netbios_name.string, trustinfo.netbios_name.string) != 0) {
3021 torture_comment(tctx, "QueryTrustedDomainInfo returned inconsistent short name: %s != %s\n",
3022 info->info_ex.netbios_name.string, trustinfo.netbios_name.string);
3023 ret = false;
3024 }
3025 if (info->info_ex.trust_type != trustinfo.trust_type) {
3026 torture_comment(tctx, "QueryTrustedDomainInfo of %s returned incorrect trust type %d != %d\n",
3027 trust_name, info->info_ex.trust_type, trustinfo.trust_type);
3028 ret = false;
3029 }
3030 if (info->info_ex.trust_attributes != LSA_TRUST_ATTRIBUTE_USES_RC4_ENCRYPTION) {
3031 torture_comment(tctx, "QueryTrustedDomainInfo of %s returned incorrect trust attributes %d != %d\n",
3032 trust_name, info->info_ex.trust_attributes, LSA_TRUST_ATTRIBUTE_USES_RC4_ENCRYPTION);
3033 ret = false;
3034 }
3035 if (info->info_ex.trust_direction != trustinfo.trust_direction) {
3036 torture_comment(tctx, "QueryTrustedDomainInfo of %s returned incorrect trust direction %d != %d\n",
3037 trust_name, info->info_ex.trust_direction, trustinfo.trust_direction);
3038 ret = false;
3039 }
3040 }
3041 }
3042 }
3043
3044 /* now that we have some domains to look over, we can test the enum calls */
3045 if (!test_EnumTrustDom(b, tctx, handle)) {
3046 torture_comment(tctx, "test_EnumTrustDom failed\n");
3047 ret = false;
3048 }
3049
3050 if (!test_EnumTrustDomEx(b, tctx, handle)) {
3051 torture_comment(tctx, "test_EnumTrustDomEx failed\n");
3052 ret = false;
3053 }
3054
3055 for (i=0; i<num_trusts; i++) {
3056 if (!test_DeleteTrustedDomainBySid(b, tctx, handle, domsid[i])) {
3057 torture_comment(tctx, "test_DeleteTrustedDomainBySid failed\n");
3058 ret = false;
3059 }
3060 }
3061
3062 return ret;
3063 }
3064
3065 static bool test_CreateTrustedDomainEx2(struct dcerpc_pipe *p,
3066 struct torture_context *tctx,
3067 struct policy_handle *handle,
3068 uint32_t num_trusts)
3069 {
3070 return test_CreateTrustedDomainEx_common(p, tctx, handle, num_trusts, true);
3071 }
3072
3073 static bool test_CreateTrustedDomainEx(struct dcerpc_pipe *p,
3074 struct torture_context *tctx,
3075 struct policy_handle *handle,
3076 uint32_t num_trusts)
3077 {
3078 return test_CreateTrustedDomainEx_common(p, tctx, handle, num_trusts, false);
3079 }
3080
3081 static bool test_QueryDomainInfoPolicy(struct dcerpc_binding_handle *b,
3082 struct torture_context *tctx,
3083 struct policy_handle *handle)
3084 {
3085 struct lsa_QueryDomainInformationPolicy r;
3086 union lsa_DomainInformationPolicy *info = NULL;
3087 int i;
3088 bool ret = true;
3089
3090 if (torture_setting_bool(tctx, "samba3", false)) {
3091 torture_skip(tctx, "skipping QueryDomainInformationPolicy test\n");
3092 }
3093
3094 torture_comment(tctx, "\nTesting QueryDomainInformationPolicy\n");
3095
3096 for (i=2;i<4;i++) {
3097 r.in.handle = handle;
3098 r.in.level = i;
3099 r.out.info = &info;
3100
3101 torture_comment(tctx, "\nTrying QueryDomainInformationPolicy level %d\n", i);
3102
3103 torture_assert_ntstatus_ok(tctx, dcerpc_lsa_QueryDomainInformationPolicy_r(b, tctx, &r),
3104 "QueryDomainInformationPolicy failed");
3105
3106 /* If the server does not support EFS, then this is the correct return */
3107 if (i == LSA_DOMAIN_INFO_POLICY_EFS && NT_STATUS_EQUAL(r.out.result, NT_STATUS_OBJECT_NAME_NOT_FOUND)) {
3108 continue;
3109 } else if (!NT_STATUS_IS_OK(r.out.result)) {
3110 torture_comment(tctx, "QueryDomainInformationPolicy failed - %s\n", nt_errstr(r.out.result));
3111 ret = false;
3112 continue;
3113 }
3114 }
3115
3116 return ret;
3117 }
3118
3119
3120 static bool test_QueryInfoPolicyCalls( bool version2,
3121 struct dcerpc_binding_handle *b,
3122 struct torture_context *tctx,
3123 struct policy_handle *handle)
3124 {
3125 struct lsa_QueryInfoPolicy r;
3126 union lsa_PolicyInformation *info = NULL;
3127 int i;
3128 bool ret = true;
3129 const char *call = talloc_asprintf(tctx, "QueryInfoPolicy%s", version2 ? "2":"");
3130
3131 torture_comment(tctx, "\nTesting %s\n", call);
3132
3133 if (version2 && torture_setting_bool(tctx, "samba3", false)) {
3134 torture_skip(tctx, "skipping QueryInfoPolicy2 tests\n");
3135 }
3136
3137 for (i=1;i<=14;i++) {
3138 r.in.handle = handle;
3139 r.in.level = i;
3140 r.out.info = &info;
3141
3142 torture_comment(tctx, "\nTrying %s level %d\n", call, i);
3143
3144 if (version2)
3145 /* We can perform the cast, because both types are
3146 structurally equal */
3147 torture_assert_ntstatus_ok(tctx, dcerpc_lsa_QueryInfoPolicy2_r(b, tctx,
3148 (struct lsa_QueryInfoPolicy2*) &r),
3149 "QueryInfoPolicy2 failed");
3150 else
3151 torture_assert_ntstatus_ok(tctx, dcerpc_lsa_QueryInfoPolicy_r(b, tctx, &r),
3152 "QueryInfoPolicy2 failed");
3153
3154 switch (i) {
3155 case LSA_POLICY_INFO_MOD:
3156 case LSA_POLICY_INFO_AUDIT_FULL_SET:
3157 case LSA_POLICY_INFO_AUDIT_FULL_QUERY:
3158 if (!NT_STATUS_EQUAL(r.out.result, NT_STATUS_INVALID_PARAMETER)) {
3159 torture_comment(tctx, "Server should have failed level %u: %s\n", i, nt_errstr(r.out.result));
3160 ret = false;
3161 }
3162 break;
3163 case LSA_POLICY_INFO_DOMAIN:
3164 case LSA_POLICY_INFO_ACCOUNT_DOMAIN:
3165 case LSA_POLICY_INFO_REPLICA:
3166 case LSA_POLICY_INFO_QUOTA:
3167 case LSA_POLICY_INFO_ROLE:
3168 case LSA_POLICY_INFO_AUDIT_LOG:
3169 case LSA_POLICY_INFO_AUDIT_EVENTS:
3170 case LSA_POLICY_INFO_PD:
3171 if (!NT_STATUS_IS_OK(r.out.result)) {
3172 torture_comment(tctx, "%s failed - %s\n", call, nt_errstr(r.out.result));
3173 ret = false;
3174 }
3175 break;
3176 case LSA_POLICY_INFO_L_ACCOUNT_DOMAIN:
3177 case LSA_POLICY_INFO_DNS_INT:
3178 case LSA_POLICY_INFO_DNS:
3179 if (torture_setting_bool(tctx, "samba3", false)) {
3180 /* Other levels not implemented yet */
3181 if (!NT_STATUS_EQUAL(r.out.result, NT_STATUS_INVALID_INFO_CLASS)) {
3182 torture_comment(tctx, "%s failed - %s\n", call, nt_errstr(r.out.result));
3183 ret = false;
3184 }
3185 } else if (!NT_STATUS_IS_OK(r.out.result)) {
3186 torture_comment(tctx, "%s failed - %s\n", call, nt_errstr(r.out.result));
3187 ret = false;
3188 }
3189 break;
3190 default:
3191 if (torture_setting_bool(tctx, "samba4", false)) {
3192 /* Other levels not implemented yet */
3193 if (!NT_STATUS_EQUAL(r.out.result, NT_STATUS_INVALID_INFO_CLASS)) {
3194 torture_comment(tctx, "%s failed - %s\n", call, nt_errstr(r.out.result));
3195 ret = false;
3196 }
3197 } else if (!NT_STATUS_IS_OK(r.out.result)) {
3198 torture_comment(tctx, "%s failed - %s\n", call, nt_errstr(r.out.result));
3199 ret = false;
3200 }
3201 break;
3202 }
3203
3204 if (NT_STATUS_IS_OK(r.out.result) && (i == LSA_POLICY_INFO_DNS
3205 || i == LSA_POLICY_INFO_DNS_INT)) {
3206 /* Let's look up some of these names */
3207
3208 struct lsa_TransNameArray tnames;
3209 tnames.count = 14;
3210 tnames.names = talloc_zero_array(tctx, struct lsa_TranslatedName, tnames.count);
3211 tnames.names[0].name.string = info->dns.name.string;
3212 tnames.names[0].sid_type = SID_NAME_DOMAIN;
3213 tnames.names[1].name.string = info->dns.dns_domain.string;
3214 tnames.names[1].sid_type = SID_NAME_DOMAIN;
3215 tnames.names[2].name.string = talloc_asprintf(tctx, "%s\\", info->dns.name.string);
3216 tnames.names[2].sid_type = SID_NAME_DOMAIN;
3217 tnames.names[3].name.string = talloc_asprintf(tctx, "%s\\", info->dns.dns_domain.string);
3218 tnames.names[3].sid_type = SID_NAME_DOMAIN;
3219 tnames.names[4].name.string = talloc_asprintf(tctx, "%s\\guest", info->dns.name.string);
3220 tnames.names[4].sid_type = SID_NAME_USER;
3221 tnames.names[5].name.string = talloc_asprintf(tctx, "%s\\krbtgt", info->dns.name.string);
3222 tnames.names[5].sid_type = SID_NAME_USER;
3223 tnames.names[6].name.string = talloc_asprintf(tctx, "%s\\guest", info->dns.dns_domain.string);
3224 tnames.names[6].sid_type = SID_NAME_USER;
3225 tnames.names[7].name.string = talloc_asprintf(tctx, "%s\\krbtgt", info->dns.dns_domain.string);
3226 tnames.names[7].sid_type = SID_NAME_USER;
3227 tnames.names[8].name.string = talloc_asprintf(tctx, "krbtgt@%s", info->dns.name.string);
3228 tnames.names[8].sid_type = SID_NAME_USER;
3229 tnames.names[9].name.string = talloc_asprintf(tctx, "krbtgt@%s", info->dns.dns_domain.string);
3230 tnames.names[9].sid_type = SID_NAME_USER;
3231 tnames.names[10].name.string = talloc_asprintf(tctx, "%s\\"TEST_MACHINENAME "$", info->dns.name.string);
3232 tnames.names[10].sid_type = SID_NAME_USER;
3233 tnames.names[11].name.string = talloc_asprintf(tctx, "%s\\"TEST_MACHINENAME "$", info->dns.dns_domain.string);
3234 tnames.names[11].sid_type = SID_NAME_USER;
3235 tnames.names[12].name.string = talloc_asprintf(tctx, TEST_MACHINENAME "$@%s", info->dns.name.string);
3236 tnames.names[12].sid_type = SID_NAME_USER;
3237 tnames.names[13].name.string = talloc_asprintf(tctx, TEST_MACHINENAME "$@%s", info->dns.dns_domain.string);
3238 tnames.names[13].sid_type = SID_NAME_USER;
3239 ret &= test_LookupNames(b, tctx, handle, &tnames);
3240
3241 }
3242 }
3243
3244 return ret;
3245 }
3246
3247 static bool test_QueryInfoPolicy(struct dcerpc_binding_handle *b,
3248 struct torture_context *tctx,
3249 struct policy_handle *handle)
3250 {
3251 return test_QueryInfoPolicyCalls(false, b, tctx, handle);
3252 }
3253
3254 static bool test_QueryInfoPolicy2(struct dcerpc_binding_handle *b,
3255 struct torture_context *tctx,
3256 struct policy_handle *handle)
3257 {
3258 return test_QueryInfoPolicyCalls(true, b, tctx, handle);
3259 }
3260
3261 static bool test_GetUserName(struct dcerpc_binding_handle *b,
3262 struct torture_context *tctx)
3263 {
3264 struct lsa_GetUserName r;
3265 bool ret = true;
3266 struct lsa_String *authority_name_p = NULL;
3267 struct lsa_String *account_name_p = NULL;
3268
3269 torture_comment(tctx, "\nTesting GetUserName\n");
3270
3271 r.in.system_name = "\\";
3272 r.in.account_name = &account_name_p;
3273 r.in.authority_name = NULL;
3274 r.out.account_name = &account_name_p;
3275
3276 torture_assert_ntstatus_ok(tctx, dcerpc_lsa_GetUserName_r(b, tctx, &r),
3277 "GetUserName failed");
3278
3279 if (!NT_STATUS_IS_OK(r.out.result)) {
3280 torture_comment(tctx, "GetUserName failed - %s\n", nt_errstr(r.out.result));
3281 ret = false;
3282 }
3283
3284 account_name_p = NULL;
3285 r.in.account_name = &account_name_p;
3286 r.in.authority_name = &authority_name_p;
3287 r.out.account_name = &account_name_p;
3288
3289 torture_assert_ntstatus_ok(tctx, dcerpc_lsa_GetUserName_r(b, tctx, &r),
3290 "GetUserName failed");
3291
3292 if (!NT_STATUS_IS_OK(r.out.result)) {
3293 torture_comment(tctx, "GetUserName failed - %s\n", nt_errstr(r.out.result));
3294 ret = false;
3295 }
3296
3297 return ret;
3298 }
3299
3300 static bool test_GetUserName_fail(struct dcerpc_binding_handle *b,
3301 struct torture_context *tctx)
3302 {
3303 struct lsa_GetUserName r;
3304 struct lsa_String *account_name_p = NULL;
3305 NTSTATUS status;
3306
3307 torture_comment(tctx, "\nTesting GetUserName_fail\n");
3308
3309 r.in.system_name = "\\";
3310 r.in.account_name = &account_name_p;
3311 r.in.authority_name = NULL;
3312 r.out.account_name = &account_name_p;
3313
3314 status = dcerpc_lsa_GetUserName_r(b, tctx, &r);
3315 if (!NT_STATUS_IS_OK(status)) {
3316 if (NT_STATUS_EQUAL(status, NT_STATUS_ACCESS_DENIED)) {
3317 torture_comment(tctx,
3318 "GetUserName correctly returned with "
3319 "status: %s\n",
3320 nt_errstr(status));
3321 return true;
3322 }
3323
3324 torture_assert_ntstatus_equal(tctx,
3325 status,
3326 NT_STATUS_ACCESS_DENIED,
3327 "GetUserName return value should "
3328 "be ACCESS_DENIED");
3329 return true;
3330 }
3331
3332 if (!NT_STATUS_IS_OK(r.out.result)) {
3333 if (NT_STATUS_EQUAL(r.out.result, NT_STATUS_ACCESS_DENIED) ||
3334 NT_STATUS_EQUAL(r.out.result, NT_STATUS_RPC_PROTSEQ_NOT_SUPPORTED)) {
3335 torture_comment(tctx,
3336 "GetUserName correctly returned with "
3337 "result: %s\n",
3338 nt_errstr(r.out.result));
3339 return true;
3340 }
3341 }
3342
3343 torture_assert_ntstatus_equal(tctx,
3344 r.out.result,
3345 NT_STATUS_OK,
3346 "GetUserName return value should be "
3347 "ACCESS_DENIED");
3348
3349 return false;
3350 }
3351
3352 bool test_lsa_Close(struct dcerpc_binding_handle *b,
3353 struct torture_context *tctx,
3354 struct policy_handle *handle)
3355 {
3356 struct lsa_Close r;
3357 struct policy_handle handle2;
3358
3359 torture_comment(tctx, "\nTesting Close\n");
3360
3361 r.in.handle = handle;
3362 r.out.handle = &handle2;
3363
3364 torture_assert_ntstatus_ok(tctx, dcerpc_lsa_Close_r(b, tctx, &r),
3365 "Close failed");
3366 if (!NT_STATUS_IS_OK(r.out.result)) {
3367 torture_comment(tctx, "Close failed - %s\n",
3368 nt_errstr(r.out.result));
3369 return false;
3370 }
3371
3372 torture_assert_ntstatus_equal(tctx, dcerpc_lsa_Close_r(b, tctx, &r),
3373 NT_STATUS_RPC_SS_CONTEXT_MISMATCH, "Close should failed");
3374
3375 torture_comment(tctx, "\n");
3376
3377 return true;
3378 }
3379
3380 bool torture_rpc_lsa(struct torture_context *tctx)
3381 {
3382 NTSTATUS status;
3383 struct dcerpc_pipe *p;
3384 bool ret = true;
3385 struct policy_handle *handle = NULL;
3386 struct test_join *join = NULL;
3387 struct cli_credentials *machine_creds;
3388 struct dcerpc_binding_handle *b;
3389
3390 status = torture_rpc_connection(tctx, &p, &ndr_table_lsarpc);
3391 if (!NT_STATUS_IS_OK(status)) {
3392 return false;
3393 }
3394 b = p->binding_handle;
3395
3396 /* Test lsaLookupSids3 and lsaLookupNames4 over tcpip */
3397 if (p->binding->transport == NCACN_IP_TCP) {
3398 if (!test_OpenPolicy_fail(b, tctx)) {
3399 ret = false;
3400 }
3401
3402 if (!test_OpenPolicy2_fail(b, tctx)) {
3403 ret = false;
3404 }
3405
3406 if (!test_many_LookupSids(p, tctx, handle)) {
3407 ret = false;
3408 }
3409
3410 return ret;
3411 }
3412
3413 if (!test_OpenPolicy(b, tctx)) {
3414 ret = false;
3415 }
3416
3417 if (!test_lsa_OpenPolicy2(b, tctx, &handle)) {
3418 ret = false;
3419 }
3420
3421 if (handle) {
3422 join = torture_join_domain(tctx, TEST_MACHINENAME, ACB_WSTRUST, &machine_creds);
3423 if (!join) {
3424 ret = false;
3425 }
3426
3427 if (!test_LookupSids_async(b, tctx, handle)) {
3428 ret = false;
3429 }
3430
3431 if (!test_QueryDomainInfoPolicy(b, tctx, handle)) {
3432 ret = false;
3433 }
3434
3435 if (!test_CreateSecret(p, tctx, handle)) {
3436 ret = false;
3437 }
3438
3439 if (!test_QueryInfoPolicy(b, tctx, handle)) {
3440 ret = false;
3441 }
3442
3443 if (!test_QueryInfoPolicy2(b, tctx, handle)) {
3444 ret = false;
3445 }
3446
3447 if (!test_Delete(b, tctx, handle)) {
3448 ret = false;
3449 }
3450
3451 if (!test_many_LookupSids(p, tctx, handle)) {
3452 ret = false;
3453 }
3454
3455 if (!test_lsa_Close(b, tctx, handle)) {
3456 ret = false;
3457 }
3458
3459 torture_leave_domain(tctx, join);
3460
3461 } else {
3462 if (!test_many_LookupSids(p, tctx, handle)) {
3463 ret = false;
3464 }
3465 }
3466
3467 if (!test_GetUserName(b, tctx)) {
3468 ret = false;
3469 }
3470
3471 return ret;
3472 }
3473
3474 bool torture_rpc_lsa_get_user(struct torture_context *tctx)
3475 {
3476 NTSTATUS status;
3477 struct dcerpc_pipe *p;
3478 bool ret = true;
3479 struct dcerpc_binding_handle *b;
3480
3481 status = torture_rpc_connection(tctx, &p, &ndr_table_lsarpc);
3482 if (!NT_STATUS_IS_OK(status)) {
3483 return false;
3484 }
3485 b = p->binding_handle;
3486
3487 if (p->binding->transport == NCACN_IP_TCP) {
3488 if (!test_GetUserName_fail(b, tctx)) {
3489 ret = false;
3490 }
3491 return ret;
3492 }
3493
3494 if (!test_GetUserName(b, tctx)) {
3495 ret = false;
3496 }
3497
3498 return ret;
3499 }
3500
3501 static bool testcase_LookupNames(struct torture_context *tctx,
3502 struct dcerpc_pipe *p)
3503 {
3504 bool ret = true;
3505 struct policy_handle *handle;
3506 struct lsa_TransNameArray tnames;
3507 struct lsa_TransNameArray2 tnames2;
3508 struct dcerpc_binding_handle *b = p->binding_handle;
3509
3510 if (p->binding->transport != NCACN_NP &&
3511 p->binding->transport != NCALRPC) {
3512 torture_comment(tctx, "testcase_LookupNames is only available "
3513 "over NCACN_NP or NCALRPC");
3514 return true;
3515 }
3516
3517 if (!test_OpenPolicy(b, tctx)) {
3518 ret = false;
3519 }
3520
3521 if (!test_lsa_OpenPolicy2(b, tctx, &handle)) {
3522 ret = false;
3523 }
3524
3525 if (!handle) {
3526 ret = false;
3527 }
3528
3529 tnames.count = 1;
3530 tnames.names = talloc_array(tctx, struct lsa_TranslatedName, tnames.count);
3531 ZERO_STRUCT(tnames.names[0]);
3532 tnames.names[0].name.string = "BUILTIN";
3533 tnames.names[0].sid_type = SID_NAME_DOMAIN;
3534
3535 if (!test_LookupNames(b, tctx, handle, &tnames)) {
3536 ret = false;
3537 }
3538
3539 tnames2.count = 1;
3540 tnames2.names = talloc_array(tctx, struct lsa_TranslatedName2, tnames2.count);
3541 ZERO_STRUCT(tnames2.names[0]);
3542 tnames2.names[0].name.string = "BUILTIN";
3543 tnames2.names[0].sid_type = SID_NAME_DOMAIN;
3544
3545 if (!test_LookupNames2(b, tctx, handle, &tnames2, true)) {
3546 ret = false;
3547 }
3548
3549 if (!test_LookupNames3(b, tctx, handle, &tnames2, true)) {
3550 ret = false;
3551 }
3552
3553 if (!test_LookupNames_wellknown(b, tctx, handle)) {
3554 ret = false;
3555 }
3556
3557 if (!test_LookupNames_NULL(b, tctx, handle)) {
3558 ret = false;
3559 }
3560
3561 if (!test_LookupNames_bogus(b, tctx, handle)) {
3562 ret = false;
3563 }
3564
3565 if (!test_lsa_Close(b, tctx, handle)) {
3566 ret = false;
3567 }
3568
3569 return ret;
3570 }
3571
3572 struct torture_suite *torture_rpc_lsa_lookup_names(TALLOC_CTX *mem_ctx)
3573 {
3574 struct torture_suite *suite;
3575 struct torture_rpc_tcase *tcase;
3576
3577 suite = torture_suite_create(mem_ctx, "lsa.lookupnames");
3578
3579 tcase = torture_suite_add_rpc_iface_tcase(suite, "lsa",
3580 &ndr_table_lsarpc);
3581 torture_rpc_tcase_add_test(tcase, "LookupNames",
3582 testcase_LookupNames);
3583
3584 return suite;
3585 }
3586
3587 struct lsa_trustdom_state {
3588 uint32_t num_trusts;
3589 };
3590
3591 static bool testcase_TrustedDomains(struct torture_context *tctx,
3592 struct dcerpc_pipe *p,
3593 void *data)
3594 {
3595 bool ret = true;
3596 struct policy_handle *handle;
3597 struct lsa_trustdom_state *state =
3598 talloc_get_type_abort(data, struct lsa_trustdom_state);
3599 struct dcerpc_binding_handle *b = p->binding_handle;
3600
3601 if (p->binding->transport != NCACN_NP &&
3602 p->binding->transport != NCALRPC) {
3603 torture_comment(tctx, "testcase_TrustedDomains is only available "
3604 "over NCACN_NP or NCALRPC");
3605 return true;
3606 }
3607
3608 torture_comment(tctx, "Testing %d domains\n", state->num_trusts);
3609
3610 if (!test_OpenPolicy(b, tctx)) {
3611 ret = false;
3612 }
3613
3614 if (!test_lsa_OpenPolicy2(b, tctx, &handle)) {
3615 ret = false;
3616 }
3617
3618 if (!handle) {
3619 ret = false;
3620 }
3621
3622 if (!test_CreateTrustedDomain(b, tctx, handle, state->num_trusts)) {
3623 ret = false;
3624 }
3625
3626 if (!test_CreateTrustedDomainEx(p, tctx, handle, state->num_trusts)) {
3627 ret = false;
3628 }
3629
3630 if (!test_CreateTrustedDomainEx2(p, tctx, handle, state->num_trusts)) {
3631 ret = false;
3632 }
3633
3634 if (!test_lsa_Close(b, tctx, handle)) {
3635 ret = false;
3636 }
3637
3638 return ret;
3639 }
3640
3641 struct torture_suite *torture_rpc_lsa_trusted_domains(TALLOC_CTX *mem_ctx)
3642 {
3643 struct torture_suite *suite;
3644 struct torture_rpc_tcase *tcase;
3645 struct lsa_trustdom_state *state;
3646
3647 state = talloc(mem_ctx, struct lsa_trustdom_state);
3648
3649 state->num_trusts = 12;
3650
3651 suite = torture_suite_create(mem_ctx, "lsa.trusted.domains");
3652
3653 tcase = torture_suite_add_rpc_iface_tcase(suite, "lsa",
3654 &ndr_table_lsarpc);
3655 torture_rpc_tcase_add_test_ex(tcase, "TrustedDomains",
3656 testcase_TrustedDomains,
3657 state);
3658
3659 return suite;
3660 }
3661
3662 static bool testcase_Privileges(struct torture_context *tctx,
3663 struct dcerpc_pipe *p)
3664 {
3665 bool ret = true;
3666 struct policy_handle *handle;
3667 struct dcerpc_binding_handle *b = p->binding_handle;
3668
3669 if (p->binding->transport != NCACN_NP &&
3670 p->binding->transport != NCALRPC) {
3671 torture_comment(tctx, "testcase_Privileges is only available "
3672 "over NCACN_NP or NCALRPC");
3673 return true;
3674 }
3675
3676 if (!test_OpenPolicy(b, tctx)) {
3677 ret = false;
3678 }
3679
3680 if (!test_lsa_OpenPolicy2(b, tctx, &handle)) {
3681 ret = false;
3682 }
3683
3684 if (!handle) {
3685 ret = false;
3686 }
3687
3688 if (!test_CreateAccount(b, tctx, handle)) {
3689 ret = false;
3690 }
3691
3692 if (!test_EnumAccounts(b, tctx, handle)) {
3693 ret = false;
3694 }
3695
3696 if (!test_EnumPrivs(b, tctx, handle)) {
3697 ret = false;
3698 }
3699
3700 if (!test_lsa_Close(b, tctx, handle)) {
3701 ret = false;
3702 }
3703
3704 return ret;
3705 }
3706
3707
3708 struct torture_suite *torture_rpc_lsa_privileges(TALLOC_CTX *mem_ctx)
3709 {
3710 struct torture_suite *suite;
3711 struct torture_rpc_tcase *tcase;
3712
3713 suite = torture_suite_create(mem_ctx, "lsa.privileges");
3714
3715 tcase = torture_suite_add_rpc_iface_tcase(suite, "lsa",
3716 &ndr_table_lsarpc);
3717 torture_rpc_tcase_add_test(tcase, "Privileges",
3718 testcase_Privileges);
3719
3720 return suite;
3721 }
reg import