source4/torture/rpc/winreg.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3    test suite for winreg rpc operations
   4
   5    Copyright (C) Tim Potter 2003
   6    Copyright (C) Jelmer Vernooij 2004-2007
   7    Copyright (C) Günther Deschner 2007
   8
   9    This program is free software; you can redistribute it and/or modify
  10    it under the terms of the GNU General Public License as published by
  11    the Free Software Foundation; either version 3 of the License, or
  12    (at your option) any later version.
  13
  14    This program is distributed in the hope that it will be useful,
  15    but WITHOUT ANY WARRANTY; without even the implied warranty of
  16    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  17    GNU General Public License for more details.
  18
  19    You should have received a copy of the GNU General Public License
  20    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  21 */
  22
  23 #include "includes.h"
  24 #include "librpc/gen_ndr/ndr_winreg_c.h"
  25 #include "librpc/gen_ndr/ndr_security.h"
  26 #include "libcli/security/security.h"
  27 #include "torture/rpc/rpc.h"
  28 #include "param/param.h"
  29 #include "lib/registry/registry.h"
  30
  31 #define TEST_KEY_BASE "smbtorture test"
  32 #define TEST_KEY1 TEST_KEY_BASE "\\spottyfoot"
  33 #define TEST_KEY2 TEST_KEY_BASE "\\with a SD (#1)"
  34 #define TEST_KEY3 TEST_KEY_BASE "\\with a subkey"
  35 #define TEST_KEY4 TEST_KEY_BASE "\\sd_tests"
  36 #define TEST_SUBKEY TEST_KEY3 "\\subkey"
  37 #define TEST_SUBKEY_SD  TEST_KEY4 "\\subkey_sd"
  38 #define TEST_SUBSUBKEY_SD TEST_KEY4 "\\subkey_sd\\subsubkey_sd"
  39 #define TEST_VALUE "torture_value_name"
  40
  41 #define TEST_SID "S-1-5-21-1234567890-1234567890-1234567890-500"
  42
  43 static void init_lsa_StringLarge(struct lsa_StringLarge *name, const char *s)
  44 {
  45         name->string = s;
  46 }
  47
  48 static void init_winreg_String(struct winreg_String *name, const char *s)
  49 {
  50         name->name = s;
  51         if (s) {
  52                 name->name_len = 2 * (strlen_m(s) + 1);
  53                 name->name_size = name->name_len;
  54         } else {
  55                 name->name_len = 0;
  56                 name->name_size = 0;
  57         }
  58 }
  59
  60 static bool test_GetVersion(struct dcerpc_pipe *p,
  61                             struct torture_context *tctx,
  62                             struct policy_handle *handle)
  63 {
  64         struct winreg_GetVersion r;
  65         uint32_t v;
  66
  67         ZERO_STRUCT(r);
  68         r.in.handle = handle;
  69         r.out.version = &v;
  70
  71         torture_assert_ntstatus_ok(tctx, dcerpc_winreg_GetVersion(p, tctx, &r),
  72                                    "GetVersion failed");
  73
  74         torture_assert_werr_ok(tctx, r.out.result, "GetVersion failed");
  75
  76         return true;
  77 }
  78
  79 static bool test_NotifyChangeKeyValue(struct dcerpc_pipe *p,
  80                                       struct torture_context *tctx,
  81                                       struct policy_handle *handle)
  82 {
  83         struct winreg_NotifyChangeKeyValue r;
  84
  85         ZERO_STRUCT(r);
  86         r.in.handle = handle;
  87         r.in.watch_subtree = true;
  88         r.in.notify_filter = 0;
  89         r.in.unknown = r.in.unknown2 = 0;
  90         init_winreg_String(&r.in.string1, NULL);
  91         init_winreg_String(&r.in.string2, NULL);
  92
  93         torture_assert_ntstatus_ok(tctx,
  94                                    dcerpc_winreg_NotifyChangeKeyValue(p, tctx, &r),
  95                                    "NotifyChangeKeyValue failed");
  96
  97         if (!W_ERROR_IS_OK(r.out.result)) {
  98                 torture_comment(tctx,
  99                                 "NotifyChangeKeyValue failed - %s - not considering\n",
 100                                 win_errstr(r.out.result));
 101                 return true;
 102         }
 103
 104         return true;
 105 }
 106
 107 static bool test_CreateKey(struct dcerpc_pipe *p, struct torture_context *tctx,
 108                            struct policy_handle *handle, const char *name,
 109                            const char *kclass)
 110 {
 111         struct winreg_CreateKey r;
 112         struct policy_handle newhandle;
 113         enum winreg_CreateAction action_taken = 0;
 114
 115         ZERO_STRUCT(r);
 116         r.in.handle = handle;
 117         r.out.new_handle = &newhandle;
 118         init_winreg_String(&r.in.name, name);
 119         init_winreg_String(&r.in.keyclass, kclass);
 120         r.in.options = 0x0;
 121         r.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
 122         r.in.action_taken = r.out.action_taken = &action_taken;
 123         r.in.secdesc = NULL;
 124
 125         torture_assert_ntstatus_ok(tctx, dcerpc_winreg_CreateKey(p, tctx, &r),
 126                                    "CreateKey failed");
 127
 128         torture_assert_werr_ok(tctx,  r.out.result, "CreateKey failed");
 129
 130         return true;
 131 }
 132
 133
 134 /*
 135   createkey testing with a SD
 136 */
 137 static bool test_CreateKey_sd(struct dcerpc_pipe *p,
 138                               struct torture_context *tctx,
 139                               struct policy_handle *handle, const char *name,
 140                               const char *kclass,
 141                               struct policy_handle *newhandle)
 142 {
 143         struct winreg_CreateKey r;
 144         enum winreg_CreateAction action_taken = 0;
 145         struct security_descriptor *sd;
 146         DATA_BLOB sdblob;
 147         struct winreg_SecBuf secbuf;
 148
 149         sd = security_descriptor_dacl_create(tctx,
 150                                         0,
 151                                         NULL, NULL,
 152                                         SID_NT_AUTHENTICATED_USERS,
 153                                         SEC_ACE_TYPE_ACCESS_ALLOWED,
 154                                         SEC_GENERIC_ALL,
 155                                         SEC_ACE_FLAG_OBJECT_INHERIT |
 156                                         SEC_ACE_FLAG_CONTAINER_INHERIT,
 157                                         NULL);
 158
 159         torture_assert_ndr_success(tctx,
 160                 ndr_push_struct_blob(&sdblob, tctx, NULL, sd,
 161                                      (ndr_push_flags_fn_t)ndr_push_security_descriptor),
 162                                      "Failed to push security_descriptor ?!\n");
 163
 164         secbuf.sd.data = sdblob.data;
 165         secbuf.sd.len = sdblob.length;
 166         secbuf.sd.size = sdblob.length;
 167         secbuf.length = sdblob.length-10;
 168         secbuf.inherit = 0;
 169
 170         ZERO_STRUCT(r);
 171         r.in.handle = handle;
 172         r.out.new_handle = newhandle;
 173         init_winreg_String(&r.in.name, name);
 174         init_winreg_String(&r.in.keyclass, kclass);
 175         r.in.options = 0x0;
 176         r.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
 177         r.in.action_taken = r.out.action_taken = &action_taken;
 178         r.in.secdesc = &secbuf;
 179
 180         torture_assert_ntstatus_ok(tctx, dcerpc_winreg_CreateKey(p, tctx, &r),
 181                                    "CreateKey with sd failed");
 182
 183         torture_assert_werr_ok(tctx, r.out.result, "CreateKey with sd failed");
 184
 185         return true;
 186 }
 187
 188 static bool _test_GetKeySecurity(struct dcerpc_pipe *p,
 189                                  struct torture_context *tctx,
 190                                  struct policy_handle *handle,
 191                                  uint32_t *sec_info_ptr,
 192                                  WERROR get_werr,
 193                                  struct security_descriptor **sd_out)
 194 {
 195         struct winreg_GetKeySecurity r;
 196         struct security_descriptor *sd = NULL;
 197         uint32_t sec_info;
 198         DATA_BLOB sdblob;
 199
 200         if (sec_info_ptr) {
 201                 sec_info = *sec_info_ptr;
 202         } else {
 203                 sec_info = SECINFO_OWNER | SECINFO_GROUP | SECINFO_DACL;
 204         }
 205
 206         ZERO_STRUCT(r);
 207
 208         r.in.handle = handle;
 209         r.in.sec_info = sec_info;
 210         r.in.sd = r.out.sd = talloc_zero(tctx, struct KeySecurityData);
 211         r.in.sd->size = 0x1000;
 212
 213         torture_assert_ntstatus_ok(tctx,
 214                                    dcerpc_winreg_GetKeySecurity(p, tctx, &r),
 215                                    "GetKeySecurity failed");
 216
 217         torture_assert_werr_equal(tctx, r.out.result, get_werr,
 218                                   "GetKeySecurity failed");
 219
 220         sdblob.data = r.out.sd->data;
 221         sdblob.length = r.out.sd->len;
 222
 223         sd = talloc_zero(tctx, struct security_descriptor);
 224
 225         torture_assert_ndr_success(tctx,
 226                 ndr_pull_struct_blob(&sdblob, tctx, NULL, sd,
 227                                      (ndr_pull_flags_fn_t)ndr_pull_security_descriptor),
 228                                      "pull_security_descriptor failed");
 229
 230         if (p->conn->flags & DCERPC_DEBUG_PRINT_OUT) {
 231                 NDR_PRINT_DEBUG(security_descriptor, sd);
 232         }
 233
 234         if (sd_out) {
 235                 *sd_out = sd;
 236         } else {
 237                 talloc_free(sd);
 238         }
 239
 240         return true;
 241 }
 242
 243 static bool test_GetKeySecurity(struct dcerpc_pipe *p,
 244                                 struct torture_context *tctx,
 245                                 struct policy_handle *handle,
 246                                 struct security_descriptor **sd_out)
 247 {
 248         return _test_GetKeySecurity(p, tctx, handle, NULL, WERR_OK, sd_out);
 249 }
 250
 251 static bool _test_SetKeySecurity(struct dcerpc_pipe *p,
 252                                  struct torture_context *tctx,
 253                                  struct policy_handle *handle,
 254                                  uint32_t *sec_info_ptr,
 255                                  struct security_descriptor *sd,
 256                                  WERROR werr)
 257 {
 258         struct winreg_SetKeySecurity r;
 259         struct KeySecurityData *sdata = NULL;
 260         DATA_BLOB sdblob;
 261         uint32_t sec_info;
 262
 263         ZERO_STRUCT(r);
 264
 265         if (sd && (p->conn->flags & DCERPC_DEBUG_PRINT_OUT)) {
 266                 NDR_PRINT_DEBUG(security_descriptor, sd);
 267         }
 268
 269         torture_assert_ndr_success(tctx,
 270                 ndr_push_struct_blob(&sdblob, tctx, NULL, sd,
 271                                      (ndr_push_flags_fn_t)ndr_push_security_descriptor),
 272                                      "push_security_descriptor failed");
 273
 274         sdata = talloc_zero(tctx, struct KeySecurityData);
 275         sdata->data = sdblob.data;
 276         sdata->size = sdblob.length;
 277         sdata->len = sdblob.length;
 278
 279         if (sec_info_ptr) {
 280                 sec_info = *sec_info_ptr;
 281         } else {
 282                 sec_info = SECINFO_UNPROTECTED_SACL |
 283                            SECINFO_UNPROTECTED_DACL;
 284                 if (sd->owner_sid) {
 285                         sec_info |= SECINFO_OWNER;
 286                 }
 287                 if (sd->group_sid) {
 288                         sec_info |= SECINFO_GROUP;
 289                 }
 290                 if (sd->sacl) {
 291                         sec_info |= SECINFO_SACL;
 292                 }
 293                 if (sd->dacl) {
 294                         sec_info |= SECINFO_DACL;
 295                 }
 296         }
 297
 298         r.in.handle = handle;
 299         r.in.sec_info = sec_info;
 300         r.in.sd = sdata;
 301
 302         torture_assert_ntstatus_ok(tctx,
 303                                    dcerpc_winreg_SetKeySecurity(p, tctx, &r),
 304                                    "SetKeySecurity failed");
 305
 306         torture_assert_werr_equal(tctx, r.out.result, werr,
 307                                   "SetKeySecurity failed");
 308
 309         return true;
 310 }
 311
 312 static bool test_SetKeySecurity(struct dcerpc_pipe *p,
 313                                 struct torture_context *tctx,
 314                                 struct policy_handle *handle,
 315                                 struct security_descriptor *sd)
 316 {
 317         return _test_SetKeySecurity(p, tctx, handle, NULL, sd, WERR_OK);
 318 }
 319
 320 static bool test_CloseKey(struct dcerpc_pipe *p, struct torture_context *tctx,
 321                           struct policy_handle *handle)
 322 {
 323         struct winreg_CloseKey r;
 324
 325         ZERO_STRUCT(r);
 326         r.in.handle = r.out.handle = handle;
 327
 328         torture_assert_ntstatus_ok(tctx, dcerpc_winreg_CloseKey(p, tctx, &r),
 329                                    "CloseKey failed");
 330
 331         torture_assert_werr_ok(tctx, r.out.result, "CloseKey failed");
 332
 333         return true;
 334 }
 335
 336 static bool test_FlushKey(struct dcerpc_pipe *p, struct torture_context *tctx,
 337                           struct policy_handle *handle)
 338 {
 339         struct winreg_FlushKey r;
 340
 341         ZERO_STRUCT(r);
 342         r.in.handle = handle;
 343
 344         torture_assert_ntstatus_ok(tctx, dcerpc_winreg_FlushKey(p, tctx, &r),
 345                                    "FlushKey failed");
 346
 347         torture_assert_werr_ok(tctx, r.out.result, "FlushKey failed");
 348
 349         return true;
 350 }
 351
 352 static bool _test_OpenKey(struct dcerpc_pipe *p, struct torture_context *tctx,
 353                           struct policy_handle *hive_handle,
 354                           const char *keyname, uint32_t access_mask,
 355                           struct policy_handle *key_handle,
 356                           WERROR open_werr,
 357                           bool *success)
 358 {
 359         struct winreg_OpenKey r;
 360
 361         ZERO_STRUCT(r);
 362         r.in.parent_handle = hive_handle;
 363         init_winreg_String(&r.in.keyname, keyname);
 364         r.in.options = REG_KEYTYPE_NON_VOLATILE;
 365         r.in.access_mask = access_mask;
 366         r.out.handle = key_handle;
 367
 368         torture_assert_ntstatus_ok(tctx, dcerpc_winreg_OpenKey(p, tctx, &r),
 369                                    "OpenKey failed");
 370
 371         torture_assert_werr_equal(tctx, r.out.result, open_werr,
 372                                   "OpenKey failed");
 373
 374         if (success && W_ERROR_EQUAL(r.out.result, WERR_OK)) {
 375                 *success = true;
 376         }
 377
 378         return true;
 379 }
 380
 381 static bool test_OpenKey(struct dcerpc_pipe *p, struct torture_context *tctx,
 382                          struct policy_handle *hive_handle,
 383                          const char *keyname, struct policy_handle *key_handle)
 384 {
 385         return _test_OpenKey(p, tctx, hive_handle, keyname,
 386                              SEC_FLAG_MAXIMUM_ALLOWED, key_handle,
 387                              WERR_OK, NULL);
 388 }
 389
 390 static bool test_Cleanup(struct dcerpc_pipe *p, struct torture_context *tctx,
 391                          struct policy_handle *handle, const char *key)
 392 {
 393         struct winreg_DeleteKey r;
 394
 395         ZERO_STRUCT(r);
 396         r.in.handle = handle;
 397
 398         init_winreg_String(&r.in.key, key);
 399         dcerpc_winreg_DeleteKey(p, tctx, &r);
 400
 401         return true;
 402 }
 403
 404 static bool _test_GetSetSecurityDescriptor(struct dcerpc_pipe *p,
 405                                            struct torture_context *tctx,
 406                                            struct policy_handle *handle,
 407                                            WERROR get_werr,
 408                                            WERROR set_werr)
 409 {
 410         struct security_descriptor *sd = NULL;
 411
 412         if (!_test_GetKeySecurity(p, tctx, handle, NULL, get_werr, &sd)) {
 413                 return false;
 414         }
 415
 416         if (!_test_SetKeySecurity(p, tctx, handle, NULL, sd, set_werr)) {
 417                 return false;
 418         }
 419
 420         return true;
 421 }
 422
 423 static bool test_SecurityDescriptor(struct dcerpc_pipe *p,
 424                                     struct torture_context *tctx,
 425                                     struct policy_handle *handle,
 426                                     const char *key)
 427 {
 428         struct policy_handle new_handle;
 429         bool ret = true;
 430
 431         torture_comment(tctx, "SecurityDescriptor get & set\n");
 432
 433         if (!test_OpenKey(p, tctx, handle, key, &new_handle)) {
 434                 return false;
 435         }
 436
 437         if (!_test_GetSetSecurityDescriptor(p, tctx, &new_handle,
 438                                             WERR_OK, WERR_OK)) {
 439                 ret = false;
 440         }
 441
 442         if (!test_CloseKey(p, tctx, &new_handle)) {
 443                 return false;
 444         }
 445
 446         return ret;
 447 }
 448
 449 static bool _test_SecurityDescriptor(struct dcerpc_pipe *p,
 450                                      struct torture_context *tctx,
 451                                      struct policy_handle *handle,
 452                                      uint32_t access_mask,
 453                                      const char *key,
 454                                      WERROR open_werr,
 455                                      WERROR get_werr,
 456                                      WERROR set_werr)
 457 {
 458         struct policy_handle new_handle;
 459         bool ret = true;
 460         bool got_key = false;
 461
 462         if (!_test_OpenKey(p, tctx, handle, key, access_mask, &new_handle,
 463                            open_werr, &got_key)) {
 464                 return false;
 465         }
 466
 467         if (!got_key) {
 468                 return true;
 469         }
 470
 471         if (!_test_GetSetSecurityDescriptor(p, tctx, &new_handle,
 472                                             get_werr, set_werr)) {
 473                 ret = false;
 474         }
 475
 476         if (!test_CloseKey(p, tctx, &new_handle)) {
 477                 return false;
 478         }
 479
 480         return ret;
 481 }
 482
 483 static bool test_dacl_trustee_present(struct dcerpc_pipe *p,
 484                                       struct torture_context *tctx,
 485                                       struct policy_handle *handle,
 486                                       const struct dom_sid *sid)
 487 {
 488         struct security_descriptor *sd = NULL;
 489         int i;
 490
 491         if (!test_GetKeySecurity(p, tctx, handle, &sd)) {
 492                 return false;
 493         }
 494
 495         if (!sd || !sd->dacl) {
 496                 return false;
 497         }
 498
 499         for (i = 0; i < sd->dacl->num_aces; i++) {
 500                 if (dom_sid_equal(&sd->dacl->aces[i].trustee, sid)) {
 501                         return true;
 502                 }
 503         }
 504
 505         return false;
 506 }
 507
 508 static bool _test_dacl_trustee_present(struct dcerpc_pipe *p,
 509                                        struct torture_context *tctx,
 510                                        struct policy_handle *handle,
 511                                        const char *key,
 512                                        const struct dom_sid *sid)
 513 {
 514         struct policy_handle new_handle;
 515         bool ret = true;
 516
 517         if (!test_OpenKey(p, tctx, handle, key, &new_handle)) {
 518                 return false;
 519         }
 520
 521         ret = test_dacl_trustee_present(p, tctx, &new_handle, sid);
 522
 523         test_CloseKey(p, tctx, &new_handle);
 524
 525         return ret;
 526 }
 527
 528 static bool test_sacl_trustee_present(struct dcerpc_pipe *p,
 529                                       struct torture_context *tctx,
 530                                       struct policy_handle *handle,
 531                                       const struct dom_sid *sid)
 532 {
 533         struct security_descriptor *sd = NULL;
 534         int i;
 535         uint32_t sec_info = SECINFO_SACL;
 536
 537         if (!_test_GetKeySecurity(p, tctx, handle, &sec_info, WERR_OK, &sd)) {
 538                 return false;
 539         }
 540
 541         if (!sd || !sd->sacl) {
 542                 return false;
 543         }
 544
 545         for (i = 0; i < sd->sacl->num_aces; i++) {
 546                 if (dom_sid_equal(&sd->sacl->aces[i].trustee, sid)) {
 547                         return true;
 548                 }
 549         }
 550
 551         return false;
 552 }
 553
 554 static bool _test_sacl_trustee_present(struct dcerpc_pipe *p,
 555                                        struct torture_context *tctx,
 556                                        struct policy_handle *handle,
 557                                        const char *key,
 558                                        const struct dom_sid *sid)
 559 {
 560         struct policy_handle new_handle;
 561         bool ret = true;
 562
 563         if (!_test_OpenKey(p, tctx, handle, key, SEC_FLAG_SYSTEM_SECURITY,
 564                            &new_handle, WERR_OK, NULL)) {
 565                 return false;
 566         }
 567
 568         ret = test_sacl_trustee_present(p, tctx, &new_handle, sid);
 569
 570         test_CloseKey(p, tctx, &new_handle);
 571
 572         return ret;
 573 }
 574
 575 static bool test_owner_present(struct dcerpc_pipe *p,
 576                                struct torture_context *tctx,
 577                                struct policy_handle *handle,
 578                                const struct dom_sid *sid)
 579 {
 580         struct security_descriptor *sd = NULL;
 581         uint32_t sec_info = SECINFO_OWNER;
 582
 583         if (!_test_GetKeySecurity(p, tctx, handle, &sec_info, WERR_OK, &sd)) {
 584                 return false;
 585         }
 586
 587         if (!sd || !sd->owner_sid) {
 588                 return false;
 589         }
 590
 591         return dom_sid_equal(sd->owner_sid, sid);
 592 }
 593
 594 static bool _test_owner_present(struct dcerpc_pipe *p,
 595                                 struct torture_context *tctx,
 596                                 struct policy_handle *handle,
 597                                 const char *key,
 598                                 const struct dom_sid *sid)
 599 {
 600         struct policy_handle new_handle;
 601         bool ret = true;
 602
 603         if (!test_OpenKey(p, tctx, handle, key, &new_handle)) {
 604                 return false;
 605         }
 606
 607         ret = test_owner_present(p, tctx, &new_handle, sid);
 608
 609         test_CloseKey(p, tctx, &new_handle);
 610
 611         return ret;
 612 }
 613
 614 static bool test_group_present(struct dcerpc_pipe *p,
 615                                struct torture_context *tctx,
 616                                struct policy_handle *handle,
 617                                const struct dom_sid *sid)
 618 {
 619         struct security_descriptor *sd = NULL;
 620         uint32_t sec_info = SECINFO_GROUP;
 621
 622         if (!_test_GetKeySecurity(p, tctx, handle, &sec_info, WERR_OK, &sd)) {
 623                 return false;
 624         }
 625
 626         if (!sd || !sd->group_sid) {
 627                 return false;
 628         }
 629
 630         return dom_sid_equal(sd->group_sid, sid);
 631 }
 632
 633 static bool _test_group_present(struct dcerpc_pipe *p,
 634                                 struct torture_context *tctx,
 635                                 struct policy_handle *handle,
 636                                 const char *key,
 637                                 const struct dom_sid *sid)
 638 {
 639         struct policy_handle new_handle;
 640         bool ret = true;
 641
 642         if (!test_OpenKey(p, tctx, handle, key, &new_handle)) {
 643                 return false;
 644         }
 645
 646         ret = test_group_present(p, tctx, &new_handle, sid);
 647
 648         test_CloseKey(p, tctx, &new_handle);
 649
 650         return ret;
 651 }
 652
 653 static bool test_dacl_trustee_flags_present(struct dcerpc_pipe *p,
 654                                             struct torture_context *tctx,
 655                                             struct policy_handle *handle,
 656                                             const struct dom_sid *sid,
 657                                             uint8_t flags)
 658 {
 659         struct security_descriptor *sd = NULL;
 660         int i;
 661
 662         if (!test_GetKeySecurity(p, tctx, handle, &sd)) {
 663                 return false;
 664         }
 665
 666         if (!sd || !sd->dacl) {
 667                 return false;
 668         }
 669
 670         for (i = 0; i < sd->dacl->num_aces; i++) {
 671                 if ((dom_sid_equal(&sd->dacl->aces[i].trustee, sid)) &&
 672                     (sd->dacl->aces[i].flags == flags)) {
 673                         return true;
 674                 }
 675         }
 676
 677         return false;
 678 }
 679
 680 static bool test_dacl_ace_present(struct dcerpc_pipe *p,
 681                                   struct torture_context *tctx,
 682                                   struct policy_handle *handle,
 683                                   const struct security_ace *ace)
 684 {
 685         struct security_descriptor *sd = NULL;
 686         int i;
 687
 688         if (!test_GetKeySecurity(p, tctx, handle, &sd)) {
 689                 return false;
 690         }
 691
 692         if (!sd || !sd->dacl) {
 693                 return false;
 694         }
 695
 696         for (i = 0; i < sd->dacl->num_aces; i++) {
 697                 if (security_ace_equal(&sd->dacl->aces[i], ace)) {
 698                         return true;
 699                 }
 700         }
 701
 702         return false;
 703 }
 704
 705 static bool test_RestoreSecurity(struct dcerpc_pipe *p,
 706                                  struct torture_context *tctx,
 707                                  struct policy_handle *handle,
 708                                  const char *key,
 709                                  struct security_descriptor *sd)
 710 {
 711         struct policy_handle new_handle;
 712         bool ret = true;
 713
 714         if (!test_OpenKey(p, tctx, handle, key, &new_handle)) {
 715                 return false;
 716         }
 717
 718         if (!test_SetKeySecurity(p, tctx, &new_handle, sd)) {
 719                 ret = false;
 720         }
 721
 722         if (!test_CloseKey(p, tctx, &new_handle)) {
 723                 ret = false;
 724         }
 725
 726         return ret;
 727 }
 728
 729 static bool test_BackupSecurity(struct dcerpc_pipe *p,
 730                                 struct torture_context *tctx,
 731                                 struct policy_handle *handle,
 732                                 const char *key,
 733                                 struct security_descriptor **sd)
 734 {
 735         struct policy_handle new_handle;
 736         bool ret = true;
 737
 738         if (!test_OpenKey(p, tctx, handle, key, &new_handle)) {
 739                 return false;
 740         }
 741
 742         if (!test_GetKeySecurity(p, tctx, &new_handle, sd)) {
 743                 ret = false;
 744         }
 745
 746         if (!test_CloseKey(p, tctx, &new_handle)) {
 747                 ret = false;
 748         }
 749
 750         return ret;
 751 }
 752
 753 static bool test_SecurityDescriptorInheritance(struct dcerpc_pipe *p,
 754                                                struct torture_context *tctx,
 755                                                struct policy_handle *handle,
 756                                                const char *key)
 757 {
 758         /* get sd
 759            add ace SEC_ACE_FLAG_CONTAINER_INHERIT
 760            set sd
 761            get sd
 762            check ace
 763            add subkey
 764            get sd
 765            check ace
 766            add subsubkey
 767            get sd
 768            check ace
 769            del subsubkey
 770            del subkey
 771            reset sd
 772         */
 773
 774         struct security_descriptor *sd = NULL;
 775         struct security_descriptor *sd_orig = NULL;
 776         struct security_ace *ace = NULL;
 777         struct policy_handle new_handle;
 778         bool ret = true;
 779
 780         torture_comment(tctx, "SecurityDescriptor inheritance\n");
 781
 782         if (!test_OpenKey(p, tctx, handle, key, &new_handle)) {
 783                 return false;
 784         }
 785
 786         if (!_test_GetKeySecurity(p, tctx, &new_handle, NULL, WERR_OK, &sd)) {
 787                 return false;
 788         }
 789
 790         sd_orig = security_descriptor_copy(tctx, sd);
 791         if (sd_orig == NULL) {
 792                 return false;
 793         }
 794
 795         ace = security_ace_create(tctx,
 796                                   TEST_SID,
 797                                   SEC_ACE_TYPE_ACCESS_ALLOWED,
 798                                   SEC_STD_REQUIRED,
 799                                   SEC_ACE_FLAG_CONTAINER_INHERIT);
 800
 801         torture_assert_ntstatus_ok(tctx,
 802                 security_descriptor_dacl_add(sd, ace),
 803                 "failed to add ace");
 804
 805         /* FIXME: add further tests for these flags */
 806         sd->type |= SEC_DESC_DACL_AUTO_INHERIT_REQ |
 807                     SEC_DESC_SACL_AUTO_INHERITED;
 808
 809         if (!test_SetKeySecurity(p, tctx, &new_handle, sd)) {
 810                 return false;
 811         }
 812
 813         torture_assert(tctx,
 814                 test_dacl_ace_present(p, tctx, &new_handle, ace),
 815                 "new ACE not present!");
 816
 817         if (!test_CloseKey(p, tctx, &new_handle)) {
 818                 return false;
 819         }
 820
 821         if (!test_CreateKey(p, tctx, handle, TEST_SUBKEY_SD, NULL)) {
 822                 ret = false;
 823                 goto out;
 824         }
 825
 826         if (!test_OpenKey(p, tctx, handle, TEST_SUBKEY_SD, &new_handle)) {
 827                 ret = false;
 828                 goto out;
 829         }
 830
 831         if (!test_dacl_ace_present(p, tctx, &new_handle, ace)) {
 832                 torture_comment(tctx, "inherited ACE not present!\n");
 833                 ret = false;
 834                 goto out;
 835         }
 836
 837         test_CloseKey(p, tctx, &new_handle);
 838         if (!test_CreateKey(p, tctx, handle, TEST_SUBSUBKEY_SD, NULL)) {
 839                 ret = false;
 840                 goto out;
 841         }
 842
 843         if (!test_OpenKey(p, tctx, handle, TEST_SUBSUBKEY_SD, &new_handle)) {
 844                 ret = false;
 845                 goto out;
 846         }
 847
 848         if (!test_dacl_ace_present(p, tctx, &new_handle, ace)) {
 849                 torture_comment(tctx, "inherited ACE not present!\n");
 850                 ret = false;
 851                 goto out;
 852         }
 853
 854  out:
 855         test_CloseKey(p, tctx, &new_handle);
 856         test_Cleanup(p, tctx, handle, TEST_SUBKEY_SD);
 857         test_RestoreSecurity(p, tctx, handle, key, sd_orig);
 858
 859         return true;
 860 }
 861
 862 static bool test_SecurityDescriptorBlockInheritance(struct dcerpc_pipe *p,
 863                                                     struct torture_context *tctx,
 864                                                     struct policy_handle *handle,
 865                                                     const char *key)
 866 {
 867         /* get sd
 868            add ace SEC_ACE_FLAG_NO_PROPAGATE_INHERIT
 869            set sd
 870            add subkey/subkey
 871            get sd
 872            check ace
 873            get sd from subkey
 874            check ace
 875            del subkey/subkey
 876            del subkey
 877            reset sd
 878         */
 879
 880         struct security_descriptor *sd = NULL;
 881         struct security_descriptor *sd_orig = NULL;
 882         struct security_ace *ace = NULL;
 883         struct policy_handle new_handle;
 884         struct dom_sid *sid = NULL;
 885         bool ret = true;
 886         uint8_t ace_flags = 0x0;
 887
 888         torture_comment(tctx, "SecurityDescriptor inheritance block\n");
 889
 890         if (!test_OpenKey(p, tctx, handle, key, &new_handle)) {
 891                 return false;
 892         }
 893
 894         if (!_test_GetKeySecurity(p, tctx, &new_handle, NULL, WERR_OK, &sd)) {
 895                 return false;
 896         }
 897
 898         sd_orig = security_descriptor_copy(tctx, sd);
 899         if (sd_orig == NULL) {
 900                 return false;
 901         }
 902
 903         ace = security_ace_create(tctx,
 904                                   TEST_SID,
 905                                   SEC_ACE_TYPE_ACCESS_ALLOWED,
 906                                   SEC_STD_REQUIRED,
 907                                   SEC_ACE_FLAG_CONTAINER_INHERIT |
 908                                   SEC_ACE_FLAG_NO_PROPAGATE_INHERIT);
 909
 910         torture_assert_ntstatus_ok(tctx,
 911                 security_descriptor_dacl_add(sd, ace),
 912                 "failed to add ace");
 913
 914         if (!_test_SetKeySecurity(p, tctx, &new_handle, NULL, sd, WERR_OK)) {
 915                 return false;
 916         }
 917
 918         torture_assert(tctx,
 919                 test_dacl_ace_present(p, tctx, &new_handle, ace),
 920                 "new ACE not present!");
 921
 922         if (!test_CloseKey(p, tctx, &new_handle)) {
 923                 return false;
 924         }
 925
 926         if (!test_CreateKey(p, tctx, handle, TEST_SUBSUBKEY_SD, NULL)) {
 927                 return false;
 928         }
 929
 930         if (!test_OpenKey(p, tctx, handle, TEST_SUBSUBKEY_SD, &new_handle)) {
 931                 ret = false;
 932                 goto out;
 933         }
 934
 935         if (test_dacl_ace_present(p, tctx, &new_handle, ace)) {
 936                 torture_comment(tctx, "inherited ACE present but should not!\n");
 937                 ret = false;
 938                 goto out;
 939         }
 940
 941         sid = dom_sid_parse_talloc(tctx, TEST_SID);
 942         if (sid == NULL) {
 943                 return false;
 944         }
 945
 946         if (test_dacl_trustee_present(p, tctx, &new_handle, sid)) {
 947                 torture_comment(tctx, "inherited trustee SID present but should not!\n");
 948                 ret = false;
 949                 goto out;
 950         }
 951
 952         test_CloseKey(p, tctx, &new_handle);
 953
 954         if (!test_OpenKey(p, tctx, handle, TEST_SUBKEY_SD, &new_handle)) {
 955                 ret = false;
 956                 goto out;
 957         }
 958
 959         if (test_dacl_ace_present(p, tctx, &new_handle, ace)) {
 960                 torture_comment(tctx, "inherited ACE present but should not!\n");
 961                 ret = false;
 962                 goto out;
 963         }
 964
 965         if (!test_dacl_trustee_flags_present(p, tctx, &new_handle, sid, ace_flags)) {
 966                 torture_comment(tctx, "inherited trustee SID with flags 0x%02x not present!\n",
 967                         ace_flags);
 968                 ret = false;
 969                 goto out;
 970         }
 971
 972  out:
 973         test_CloseKey(p, tctx, &new_handle);
 974         test_Cleanup(p, tctx, handle, TEST_SUBKEY_SD);
 975         test_RestoreSecurity(p, tctx, handle, key, sd_orig);
 976
 977         return ret;
 978 }
 979
 980 static bool test_SecurityDescriptorsMasks(struct dcerpc_pipe *p,
 981                                           struct torture_context *tctx,
 982                                           struct policy_handle *handle,
 983                                           const char *key)
 984 {
 985         bool ret = true;
 986         int i;
 987
 988         struct winreg_mask_result_table {
 989                 uint32_t access_mask;
 990                 WERROR open_werr;
 991                 WERROR get_werr;
 992                 WERROR set_werr;
 993         } sd_mask_tests[] = {
 994                 { 0,
 995                         WERR_ACCESS_DENIED, WERR_BADFILE, WERR_FOOBAR },
 996                 { SEC_FLAG_MAXIMUM_ALLOWED,
 997                         WERR_OK, WERR_OK, WERR_OK },
 998                 { SEC_STD_WRITE_DAC,
 999                         WERR_OK, WERR_ACCESS_DENIED, WERR_FOOBAR },
1000                 { SEC_FLAG_SYSTEM_SECURITY,
1001                         WERR_OK, WERR_ACCESS_DENIED, WERR_FOOBAR }
1002         };
1003
1004         /* FIXME: before this test can ever run successfully we need a way to
1005          * correctly read a NULL security_descritpor in ndr, get the required
1006          * length, requery, etc.
1007          */
1008
1009         return true;
1010
1011         for (i=0; i < ARRAY_SIZE(sd_mask_tests); i++) {
1012
1013                 torture_comment(tctx,
1014                                 "SecurityDescriptor get & set with access_mask: 0x%08x\n",
1015                                 sd_mask_tests[i].access_mask);
1016                 torture_comment(tctx,
1017                                 "expecting: open %s, get: %s, set: %s\n",
1018                                 win_errstr(sd_mask_tests[i].open_werr),
1019                                 win_errstr(sd_mask_tests[i].get_werr),
1020                                 win_errstr(sd_mask_tests[i].set_werr));
1021
1022                 if (_test_SecurityDescriptor(p, tctx, handle,
1023                                              sd_mask_tests[i].access_mask, key,
1024                                              sd_mask_tests[i].open_werr,
1025                                              sd_mask_tests[i].get_werr,
1026                                              sd_mask_tests[i].set_werr)) {
1027                         ret = false;
1028                 }
1029         }
1030
1031         return ret;
1032 }
1033
1034 typedef bool (*secinfo_verify_fn)(struct dcerpc_pipe *,
1035                                   struct torture_context *,
1036                                   struct policy_handle *,
1037                                   const char *,
1038                                   const struct dom_sid *);
1039
1040 static bool test_SetSecurityDescriptor_SecInfo(struct dcerpc_pipe *p,
1041                                                struct torture_context *tctx,
1042                                                struct policy_handle *handle,
1043                                                const char *key,
1044                                                const char *test,
1045                                                uint32_t access_mask,
1046                                                uint32_t sec_info,
1047                                                struct security_descriptor *sd,
1048                                                WERROR set_werr,
1049                                                bool expect_present,
1050                                                bool (*fn) (struct dcerpc_pipe *,
1051                                                            struct torture_context *,
1052                                                            struct policy_handle *,
1053                                                            const char *,
1054                                                            const struct dom_sid *),
1055                                                const struct dom_sid *sid)
1056 {
1057         struct policy_handle new_handle;
1058         bool open_success = false;
1059
1060         torture_comment(tctx, "SecurityDescriptor (%s) sets for secinfo: "
1061                         "0x%08x, access_mask: 0x%08x\n",
1062                         test, sec_info, access_mask);
1063
1064         if (!_test_OpenKey(p, tctx, handle, key,
1065                            access_mask,
1066                            &new_handle,
1067                            WERR_OK,
1068                            &open_success)) {
1069                 return false;
1070         }
1071
1072         if (!open_success) {
1073                 torture_comment(tctx, "key did not open\n");
1074                 test_CloseKey(p, tctx, &new_handle);
1075                 return false;
1076         }
1077
1078         if (!_test_SetKeySecurity(p, tctx, &new_handle, &sec_info,
1079                                   sd,
1080                                   set_werr)) {
1081                 torture_warning(tctx,
1082                                 "SetKeySecurity with secinfo: 0x%08x has failed\n",
1083                                 sec_info);
1084                 smb_panic("");
1085                 test_CloseKey(p, tctx, &new_handle);
1086                 return false;
1087         }
1088
1089         test_CloseKey(p, tctx, &new_handle);
1090
1091         if (W_ERROR_IS_OK(set_werr)) {
1092                 bool present;
1093                 present = fn(p, tctx, handle, key, sid);
1094                 if ((expect_present) && (!present)) {
1095                         torture_warning(tctx,
1096                                         "%s sid is not present!\n",
1097                                         test);
1098                         return false;
1099                 }
1100                 if ((!expect_present) && (present)) {
1101                         torture_warning(tctx,
1102                                         "%s sid is present but not expected!\n",
1103                                         test);
1104                         return false;
1105                 }
1106         }
1107
1108         return true;
1109 }
1110
1111 static bool test_SecurityDescriptorsSecInfo(struct dcerpc_pipe *p,
1112                                             struct torture_context *tctx,
1113                                             struct policy_handle *handle,
1114                                             const char *key)
1115 {
1116         struct security_descriptor *sd_orig = NULL;
1117         struct dom_sid *sid = NULL;
1118         bool ret = true;
1119         int i, a;
1120
1121         struct security_descriptor *sd_owner =
1122                 security_descriptor_dacl_create(tctx,
1123                                                 0,
1124                                                 TEST_SID, NULL, NULL);
1125
1126         struct security_descriptor *sd_group =
1127                 security_descriptor_dacl_create(tctx,
1128                                                 0,
1129                                                 NULL, TEST_SID, NULL);
1130
1131         struct security_descriptor *sd_dacl =
1132                 security_descriptor_dacl_create(tctx,
1133                                                 0,
1134                                                 NULL, NULL,
1135                                                 TEST_SID,
1136                                                 SEC_ACE_TYPE_ACCESS_ALLOWED,
1137                                                 SEC_GENERIC_ALL,
1138                                                 0,
1139                                                 SID_NT_AUTHENTICATED_USERS,
1140                                                 SEC_ACE_TYPE_ACCESS_ALLOWED,
1141                                                 SEC_GENERIC_ALL,
1142                                                 0,
1143                                                 NULL);
1144
1145         struct security_descriptor *sd_sacl =
1146                 security_descriptor_sacl_create(tctx,
1147                                                 0,
1148                                                 NULL, NULL,
1149                                                 TEST_SID,
1150                                                 SEC_ACE_TYPE_SYSTEM_AUDIT,
1151                                                 SEC_GENERIC_ALL,
1152                                                 SEC_ACE_FLAG_SUCCESSFUL_ACCESS,
1153                                                 NULL);
1154
1155         struct winreg_secinfo_table {
1156                 struct security_descriptor *sd;
1157                 uint32_t sec_info;
1158                 WERROR set_werr;
1159                 bool sid_present;
1160                 secinfo_verify_fn fn;
1161         };
1162
1163         struct winreg_secinfo_table sec_info_owner_tests[] = {
1164                 { sd_owner, 0, WERR_OK,
1165                         false, (secinfo_verify_fn)_test_owner_present },
1166                 { sd_owner, SECINFO_OWNER, WERR_OK,
1167                         true, (secinfo_verify_fn)_test_owner_present },
1168                 { sd_owner, SECINFO_GROUP, WERR_INVALID_PARAM },
1169                 { sd_owner, SECINFO_DACL, WERR_OK,
1170                         true, (secinfo_verify_fn)_test_owner_present },
1171                 { sd_owner, SECINFO_SACL, WERR_ACCESS_DENIED },
1172         };
1173
1174         uint32_t sd_owner_good_access_masks[] = {
1175                 SEC_FLAG_MAXIMUM_ALLOWED,
1176                 /* SEC_STD_WRITE_OWNER, */
1177         };
1178
1179         struct winreg_secinfo_table sec_info_group_tests[] = {
1180                 { sd_group, 0, WERR_OK,
1181                         false, (secinfo_verify_fn)_test_group_present },
1182                 { sd_group, SECINFO_OWNER, WERR_INVALID_PARAM },
1183                 { sd_group, SECINFO_GROUP, WERR_OK,
1184                         true, (secinfo_verify_fn)_test_group_present },
1185                 { sd_group, SECINFO_DACL, WERR_OK,
1186                         true, (secinfo_verify_fn)_test_group_present },
1187                 { sd_group, SECINFO_SACL, WERR_ACCESS_DENIED },
1188         };
1189
1190         uint32_t sd_group_good_access_masks[] = {
1191                 SEC_FLAG_MAXIMUM_ALLOWED,
1192         };
1193
1194         struct winreg_secinfo_table sec_info_dacl_tests[] = {
1195                 { sd_dacl, 0, WERR_OK,
1196                         false, (secinfo_verify_fn)_test_dacl_trustee_present },
1197                 { sd_dacl, SECINFO_OWNER, WERR_INVALID_PARAM },
1198                 { sd_dacl, SECINFO_GROUP, WERR_INVALID_PARAM },
1199                 { sd_dacl, SECINFO_DACL, WERR_OK,
1200                         true, (secinfo_verify_fn)_test_dacl_trustee_present },
1201                 { sd_dacl, SECINFO_SACL, WERR_ACCESS_DENIED },
1202         };
1203
1204         uint32_t sd_dacl_good_access_masks[] = {
1205                 SEC_FLAG_MAXIMUM_ALLOWED,
1206                 SEC_STD_WRITE_DAC,
1207         };
1208
1209         struct winreg_secinfo_table sec_info_sacl_tests[] = {
1210                 { sd_sacl, 0, WERR_OK,
1211                         false, (secinfo_verify_fn)_test_sacl_trustee_present },
1212                 { sd_sacl, SECINFO_OWNER, WERR_INVALID_PARAM },
1213                 { sd_sacl, SECINFO_GROUP, WERR_INVALID_PARAM },
1214                 { sd_sacl, SECINFO_DACL, WERR_OK,
1215                         false, (secinfo_verify_fn)_test_sacl_trustee_present },
1216                 { sd_sacl, SECINFO_SACL, WERR_OK,
1217                         true, (secinfo_verify_fn)_test_sacl_trustee_present },
1218         };
1219
1220         uint32_t sd_sacl_good_access_masks[] = {
1221                 SEC_FLAG_MAXIMUM_ALLOWED | SEC_FLAG_SYSTEM_SECURITY,
1222                 /* SEC_FLAG_SYSTEM_SECURITY, */
1223         };
1224
1225         sid = dom_sid_parse_talloc(tctx, TEST_SID);
1226         if (sid == NULL) {
1227                 return false;
1228         }
1229
1230         if (!test_BackupSecurity(p, tctx, handle, key, &sd_orig)) {
1231                 return false;
1232         }
1233
1234         /* OWNER */
1235
1236         for (i=0; i < ARRAY_SIZE(sec_info_owner_tests); i++) {
1237
1238                 for (a=0; a < ARRAY_SIZE(sd_owner_good_access_masks); a++) {
1239
1240                         if (!test_SetSecurityDescriptor_SecInfo(p, tctx, handle,
1241                                         key,
1242                                         "OWNER",
1243                                         sd_owner_good_access_masks[a],
1244                                         sec_info_owner_tests[i].sec_info,
1245                                         sec_info_owner_tests[i].sd,
1246                                         sec_info_owner_tests[i].set_werr,
1247                                         sec_info_owner_tests[i].sid_present,
1248                                         sec_info_owner_tests[i].fn,
1249                                         sid))
1250                         {
1251                                 torture_comment(tctx, "test_SetSecurityDescriptor_SecInfo failed for OWNER\n");
1252                                 ret = false;
1253                                 goto out;
1254                         }
1255                 }
1256         }
1257
1258         /* GROUP */
1259
1260         for (i=0; i < ARRAY_SIZE(sec_info_group_tests); i++) {
1261
1262                 for (a=0; a < ARRAY_SIZE(sd_group_good_access_masks); a++) {
1263
1264                         if (!test_SetSecurityDescriptor_SecInfo(p, tctx, handle,
1265                                         key,
1266                                         "GROUP",
1267                                         sd_group_good_access_masks[a],
1268                                         sec_info_group_tests[i].sec_info,
1269                                         sec_info_group_tests[i].sd,
1270                                         sec_info_group_tests[i].set_werr,
1271                                         sec_info_group_tests[i].sid_present,
1272                                         sec_info_group_tests[i].fn,
1273                                         sid))
1274                         {
1275                                 torture_comment(tctx, "test_SetSecurityDescriptor_SecInfo failed for GROUP\n");
1276                                 ret = false;
1277                                 goto out;
1278                         }
1279                 }
1280         }
1281
1282         /* DACL */
1283
1284         for (i=0; i < ARRAY_SIZE(sec_info_dacl_tests); i++) {
1285
1286                 for (a=0; a < ARRAY_SIZE(sd_dacl_good_access_masks); a++) {
1287
1288                         if (!test_SetSecurityDescriptor_SecInfo(p, tctx, handle,
1289                                         key,
1290                                         "DACL",
1291                                         sd_dacl_good_access_masks[a],
1292                                         sec_info_dacl_tests[i].sec_info,
1293                                         sec_info_dacl_tests[i].sd,
1294                                         sec_info_dacl_tests[i].set_werr,
1295                                         sec_info_dacl_tests[i].sid_present,
1296                                         sec_info_dacl_tests[i].fn,
1297                                         sid))
1298                         {
1299                                 torture_comment(tctx, "test_SetSecurityDescriptor_SecInfo failed for DACL\n");
1300                                 ret = false;
1301                                 goto out;
1302                         }
1303                 }
1304         }
1305
1306         /* SACL */
1307
1308         for (i=0; i < ARRAY_SIZE(sec_info_sacl_tests); i++) {
1309
1310                 for (a=0; a < ARRAY_SIZE(sd_sacl_good_access_masks); a++) {
1311
1312                         if (!test_SetSecurityDescriptor_SecInfo(p, tctx, handle,
1313                                         key,
1314                                         "SACL",
1315                                         sd_sacl_good_access_masks[a],
1316                                         sec_info_sacl_tests[i].sec_info,
1317                                         sec_info_sacl_tests[i].sd,
1318                                         sec_info_sacl_tests[i].set_werr,
1319                                         sec_info_sacl_tests[i].sid_present,
1320                                         sec_info_sacl_tests[i].fn,
1321                                         sid))
1322                         {
1323                                 torture_comment(tctx, "test_SetSecurityDescriptor_SecInfo failed for SACL\n");
1324                                 ret = false;
1325                                 goto out;
1326                         }
1327                 }
1328         }
1329
1330  out:
1331         test_RestoreSecurity(p, tctx, handle, key, sd_orig);
1332
1333         return ret;
1334 }
1335
1336 static bool test_SecurityDescriptors(struct dcerpc_pipe *p,
1337                                      struct torture_context *tctx,
1338                                      struct policy_handle *handle,
1339                                      const char *key)
1340 {
1341         bool ret = true;
1342
1343         if (!test_SecurityDescriptor(p, tctx, handle, key)) {
1344                 torture_comment(tctx, "test_SecurityDescriptor failed\n");
1345                 ret = false;
1346         }
1347
1348         if (!test_SecurityDescriptorInheritance(p, tctx, handle, key)) {
1349                 torture_comment(tctx, "test_SecurityDescriptorInheritance failed\n");
1350                 ret = false;
1351         }
1352
1353         if (!test_SecurityDescriptorBlockInheritance(p, tctx, handle, key)) {
1354                 torture_comment(tctx, "test_SecurityDescriptorBlockInheritance failed\n");
1355                 ret = false;
1356         }
1357
1358         if (!test_SecurityDescriptorsSecInfo(p, tctx, handle, key)) {
1359                 torture_comment(tctx, "test_SecurityDescriptorsSecInfo failed\n");
1360                 ret = false;
1361         }
1362
1363         if (!test_SecurityDescriptorsMasks(p, tctx, handle, key)) {
1364                 torture_comment(tctx, "test_SecurityDescriptorsMasks failed\n");
1365                 ret = false;
1366         }
1367
1368         return ret;
1369 }
1370
1371 static bool test_DeleteKey(struct dcerpc_pipe *p, struct torture_context *tctx,
1372                            struct policy_handle *handle, const char *key)
1373 {
1374         NTSTATUS status;
1375         struct winreg_DeleteKey r;
1376
1377         r.in.handle = handle;
1378         init_winreg_String(&r.in.key, key);
1379
1380         status = dcerpc_winreg_DeleteKey(p, tctx, &r);
1381
1382         torture_assert_ntstatus_ok(tctx, status, "DeleteKey failed");
1383         torture_assert_werr_ok(tctx, r.out.result, "DeleteKey failed");
1384
1385         return true;
1386 }
1387
1388 static bool test_QueryInfoKey(struct dcerpc_pipe *p,
1389                               struct torture_context *tctx,
1390                               struct policy_handle *handle, char *kclass)
1391 {
1392         struct winreg_QueryInfoKey r;
1393         uint32_t num_subkeys, max_subkeylen, max_classlen,
1394                 num_values, max_valnamelen, max_valbufsize,
1395                 secdescsize;
1396         NTTIME last_changed_time;
1397
1398         ZERO_STRUCT(r);
1399         r.in.handle = handle;
1400         r.out.num_subkeys = &num_subkeys;
1401         r.out.max_subkeylen = &max_subkeylen;
1402         r.out.max_classlen = &max_classlen;
1403         r.out.num_values = &num_values;
1404         r.out.max_valnamelen = &max_valnamelen;
1405         r.out.max_valbufsize = &max_valbufsize;
1406         r.out.secdescsize = &secdescsize;
1407         r.out.last_changed_time = &last_changed_time;
1408
1409         r.out.classname = talloc(tctx, struct winreg_String);
1410
1411         r.in.classname = talloc(tctx, struct winreg_String);
1412         init_winreg_String(r.in.classname, kclass);
1413
1414         torture_assert_ntstatus_ok(tctx,
1415                                    dcerpc_winreg_QueryInfoKey(p, tctx, &r),
1416                                    "QueryInfoKey failed");
1417
1418         torture_assert_werr_ok(tctx, r.out.result, "QueryInfoKey failed");
1419
1420         return true;
1421 }
1422
1423 static bool test_SetValue(struct dcerpc_pipe *p,
1424                           struct torture_context *tctx,
1425                           struct policy_handle *handle,
1426                           const char *value_name,
1427                           enum winreg_Type type,
1428                           uint8_t *data,
1429                           uint32_t size)
1430 {
1431         struct winreg_SetValue r;
1432         struct winreg_String name;
1433
1434         torture_comment(tctx, "Testing SetValue(%s), type: %s, offered: 0x%08x)\n",
1435                 value_name, str_regtype(type), size);
1436
1437         init_winreg_String(&name, value_name);
1438
1439         r.in.handle = handle;
1440         r.in.name = name;
1441         r.in.type = type;
1442         r.in.data = data;
1443         r.in.size = size;
1444
1445         torture_assert_ntstatus_ok(tctx, dcerpc_winreg_SetValue(p, tctx, &r),
1446                 "winreg_SetValue failed");
1447         torture_assert_werr_ok(tctx, r.out.result,
1448                 "winreg_SetValue failed");
1449
1450         return true;
1451 }
1452
1453 static bool test_DeleteValue(struct dcerpc_pipe *p,
1454                              struct torture_context *tctx,
1455                              struct policy_handle *handle,
1456                              const char *value_name)
1457 {
1458         struct winreg_DeleteValue r;
1459         struct winreg_String value;
1460
1461         torture_comment(tctx, "Testing DeleteValue(%s)\n", value_name);
1462
1463         init_winreg_String(&value, value_name);
1464
1465         r.in.handle = handle;
1466         r.in.value = value;
1467
1468         torture_assert_ntstatus_ok(tctx, dcerpc_winreg_DeleteValue(p, tctx, &r),
1469                 "winreg_DeleteValue failed");
1470         torture_assert_werr_ok(tctx, r.out.result,
1471                 "winreg_DeleteValue failed");
1472
1473         return true;
1474 }
1475
1476 static bool test_key(struct dcerpc_pipe *p, struct torture_context *tctx,
1477                      struct policy_handle *handle, int depth,
1478                      bool test_security);
1479
1480 static bool test_EnumKey(struct dcerpc_pipe *p, struct torture_context *tctx,
1481                          struct policy_handle *handle, int depth,
1482                          bool test_security)
1483 {
1484         struct winreg_EnumKey r;
1485         struct winreg_StringBuf kclass, name;
1486         NTSTATUS status;
1487         NTTIME t = 0;
1488
1489         kclass.name   = "";
1490         kclass.size   = 1024;
1491
1492         ZERO_STRUCT(r);
1493         r.in.handle = handle;
1494         r.in.enum_index = 0;
1495         r.in.name = &name;
1496         r.in.keyclass = &kclass;
1497         r.out.name = &name;
1498         r.in.last_changed_time = &t;
1499
1500         do {
1501                 name.name   = NULL;
1502                 name.size   = 1024;
1503
1504                 status = dcerpc_winreg_EnumKey(p, tctx, &r);
1505
1506                 if (NT_STATUS_IS_OK(status) && W_ERROR_IS_OK(r.out.result)) {
1507                         struct policy_handle key_handle;
1508
1509                         torture_comment(tctx, "EnumKey: %d: %s\n",
1510                                         r.in.enum_index,
1511                                         r.out.name->name);
1512
1513                         if (!test_OpenKey(p, tctx, handle, r.out.name->name,
1514                                           &key_handle)) {
1515                         } else {
1516                                 test_key(p, tctx, &key_handle,
1517                                          depth + 1, test_security);
1518                         }
1519                 }
1520
1521                 r.in.enum_index++;
1522
1523         } while (NT_STATUS_IS_OK(status) && W_ERROR_IS_OK(r.out.result));
1524
1525         torture_assert_ntstatus_ok(tctx, status, "EnumKey failed");
1526
1527         if (!W_ERROR_IS_OK(r.out.result) &&
1528                 !W_ERROR_EQUAL(r.out.result, WERR_NO_MORE_ITEMS)) {
1529                 torture_fail(tctx, "EnumKey failed");
1530         }
1531
1532         return true;
1533 }
1534
1535 static bool test_QueryMultipleValues(struct dcerpc_pipe *p,
1536                                      struct torture_context *tctx,
1537                                      struct policy_handle *handle,
1538                                      const char *valuename)
1539 {
1540         struct winreg_QueryMultipleValues r;
1541         NTSTATUS status;
1542         uint32_t bufsize=0;
1543
1544         ZERO_STRUCT(r);
1545         r.in.key_handle = handle;
1546         r.in.values = r.out.values = talloc_array(tctx, struct QueryMultipleValue, 1);
1547         r.in.values[0].name = talloc(tctx, struct winreg_String);
1548         r.in.values[0].name->name = valuename;
1549         r.in.values[0].offset = 0;
1550         r.in.values[0].length = 0;
1551         r.in.values[0].type = 0;
1552
1553         r.in.num_values = 1;
1554         r.in.buffer_size = r.out.buffer_size = talloc(tctx, uint32_t);
1555         *r.in.buffer_size = bufsize;
1556         do {
1557                 *r.in.buffer_size = bufsize;
1558                 r.in.buffer = r.out.buffer = talloc_zero_array(tctx, uint8_t,
1559                                                                *r.in.buffer_size);
1560
1561                 status = dcerpc_winreg_QueryMultipleValues(p, tctx, &r);
1562
1563                 if(NT_STATUS_IS_ERR(status))
1564                         torture_fail(tctx, "QueryMultipleValues failed");
1565
1566                 talloc_free(r.in.buffer);
1567                 bufsize += 0x20;
1568         } while (W_ERROR_EQUAL(r.out.result, WERR_MORE_DATA));
1569
1570         torture_assert_werr_ok(tctx, r.out.result, "QueryMultipleValues failed");
1571
1572         return true;
1573 }
1574
1575 static bool test_QueryValue(struct dcerpc_pipe *p,
1576                             struct torture_context *tctx,
1577                             struct policy_handle *handle,
1578                             const char *valuename)
1579 {
1580         struct winreg_QueryValue r;
1581         NTSTATUS status;
1582         enum winreg_Type zero_type = 0;
1583         uint32_t offered = 0xfff;
1584         uint32_t zero = 0;
1585
1586         ZERO_STRUCT(r);
1587         r.in.handle = handle;
1588         r.in.data = NULL;
1589         r.in.value_name = talloc_zero(tctx, struct winreg_String);
1590         r.in.value_name->name = valuename;
1591         r.in.type = &zero_type;
1592         r.in.data_size = &offered;
1593         r.in.data_length = &zero;
1594
1595         status = dcerpc_winreg_QueryValue(p, tctx, &r);
1596         if (NT_STATUS_IS_ERR(status)) {
1597                 torture_fail(tctx, "QueryValue failed");
1598         }
1599
1600         torture_assert_werr_ok(tctx, r.out.result, "QueryValue failed");
1601
1602         return true;
1603 }
1604
1605 static bool test_QueryValue_full(struct dcerpc_pipe *p,
1606                                  struct torture_context *tctx,
1607                                  struct policy_handle *handle,
1608                                  const char *valuename,
1609                                  bool existing_value)
1610 {
1611         struct winreg_QueryValue r;
1612         struct winreg_String value_name;
1613         enum winreg_Type type = REG_NONE;
1614         uint32_t data_size = 0;
1615         uint32_t real_data_size = 0;
1616         uint32_t data_length = 0;
1617         uint8_t *data = NULL;
1618         WERROR expected_error = WERR_BADFILE;
1619
1620         if (valuename == NULL) {
1621                 expected_error = WERR_INVALID_PARAM;
1622         }
1623
1624         ZERO_STRUCT(r);
1625
1626         init_winreg_String(&value_name, NULL);
1627
1628         torture_comment(tctx, "Testing QueryValue(%s)\n", valuename);
1629
1630         r.in.handle = handle;
1631         r.in.value_name = &value_name;
1632
1633         torture_assert_ntstatus_ok(tctx, dcerpc_winreg_QueryValue(p, tctx, &r), "QueryValue failed");
1634         torture_assert_werr_equal(tctx, r.out.result, WERR_INVALID_PARAM,
1635                 "expected WERR_INVALID_PARAM for NULL winreg_String.name");
1636
1637         init_winreg_String(&value_name, valuename);
1638         r.in.value_name = &value_name;
1639
1640         torture_assert_ntstatus_ok(tctx, dcerpc_winreg_QueryValue(p, tctx, &r),
1641                 "QueryValue failed");
1642         torture_assert_werr_equal(tctx, r.out.result, WERR_INVALID_PARAM,
1643                 "QueryValue failed");
1644
1645         r.in.type = &type;
1646         r.out.type = &type;
1647         torture_assert_ntstatus_ok(tctx, dcerpc_winreg_QueryValue(p, tctx, &r),
1648                 "QueryValue failed");
1649         torture_assert_werr_equal(tctx, r.out.result, WERR_INVALID_PARAM,
1650                 "QueryValue failed");
1651
1652         r.in.data_length = &data_length;
1653         r.out.data_length = &data_length;
1654         torture_assert_ntstatus_ok(tctx, dcerpc_winreg_QueryValue(p, tctx, &r),
1655                 "QueryValue failed");
1656         torture_assert_werr_equal(tctx, r.out.result, WERR_INVALID_PARAM,
1657                 "QueryValue failed");
1658
1659         r.in.data_size = &data_size;
1660         r.out.data_size = &data_size;
1661         torture_assert_ntstatus_ok(tctx, dcerpc_winreg_QueryValue(p, tctx, &r),
1662                 "QueryValue failed");
1663         if (existing_value) {
1664                 torture_assert_werr_ok(tctx, r.out.result,
1665                         "QueryValue failed");
1666         } else {
1667                 torture_assert_werr_equal(tctx, r.out.result, expected_error,
1668                         "QueryValue failed");
1669         }
1670
1671         real_data_size = *r.out.data_size;
1672
1673         data = talloc_zero_array(tctx, uint8_t, 0);
1674         r.in.data = data;
1675         r.out.data = data;
1676         *r.in.data_size = 0;
1677         *r.out.data_size = 0;
1678         torture_assert_ntstatus_ok(tctx, dcerpc_winreg_QueryValue(p, tctx, &r),
1679                 "QueryValue failed");
1680         if (existing_value) {
1681                 torture_assert_werr_equal(tctx, r.out.result, WERR_MORE_DATA,
1682                         "QueryValue failed");
1683         } else {
1684                 torture_assert_werr_equal(tctx, r.out.result, expected_error,
1685                         "QueryValue failed");
1686         }
1687
1688         data = talloc_zero_array(tctx, uint8_t, real_data_size);
1689         r.in.data = data;
1690         r.out.data = data;
1691         r.in.data_size = &real_data_size;
1692         r.out.data_size = &real_data_size;
1693         torture_assert_ntstatus_ok(tctx, dcerpc_winreg_QueryValue(p, tctx, &r),
1694                 "QueryValue failed");
1695         if (existing_value) {
1696                 torture_assert_werr_ok(tctx, r.out.result,
1697                         "QueryValue failed");
1698         } else {
1699                 torture_assert_werr_equal(tctx, r.out.result, expected_error,
1700                         "QueryValue failed");
1701         }
1702
1703         return true;
1704 }
1705
1706 static bool test_EnumValue(struct dcerpc_pipe *p, struct torture_context *tctx,
1707                            struct policy_handle *handle, int max_valnamelen,
1708                            int max_valbufsize)
1709 {
1710         struct winreg_EnumValue r;
1711         enum winreg_Type type = 0;
1712         uint32_t size = max_valbufsize, zero = 0;
1713         bool ret = true;
1714         uint8_t buf8;
1715         struct winreg_ValNameBuf name;
1716
1717         name.name   = "";
1718         name.size   = 1024;
1719
1720         ZERO_STRUCT(r);
1721         r.in.handle = handle;
1722         r.in.enum_index = 0;
1723         r.in.name = &name;
1724         r.out.name = &name;
1725         r.in.type = &type;
1726         r.in.value = &buf8;
1727         r.in.length = &zero;
1728         r.in.size = &size;
1729
1730         do {
1731                 torture_assert_ntstatus_ok(tctx,
1732                                            dcerpc_winreg_EnumValue(p, tctx, &r),
1733                                            "EnumValue failed");
1734
1735                 if (W_ERROR_IS_OK(r.out.result)) {
1736                         ret &= test_QueryValue(p, tctx, handle,
1737                                                r.out.name->name);
1738                         ret &= test_QueryMultipleValues(p, tctx, handle,
1739                                                         r.out.name->name);
1740                 }
1741
1742                 r.in.enum_index++;
1743         } while (W_ERROR_IS_OK(r.out.result));
1744
1745         torture_assert_werr_equal(tctx, r.out.result, WERR_NO_MORE_ITEMS,
1746                                   "EnumValue failed");
1747
1748         return ret;
1749 }
1750
1751 static bool test_AbortSystemShutdown(struct dcerpc_pipe *p,
1752                                      struct torture_context *tctx)
1753 {
1754         struct winreg_AbortSystemShutdown r;
1755         uint16_t server = 0x0;
1756
1757         ZERO_STRUCT(r);
1758         r.in.server = &server;
1759
1760         torture_assert_ntstatus_ok(tctx,
1761                                    dcerpc_winreg_AbortSystemShutdown(p, tctx, &r),
1762                                    "AbortSystemShutdown failed");
1763
1764         torture_assert_werr_ok(tctx, r.out.result,
1765                                "AbortSystemShutdown failed");
1766
1767         return true;
1768 }
1769
1770 static bool test_InitiateSystemShutdown(struct torture_context *tctx,
1771                                         struct dcerpc_pipe *p)
1772 {
1773         struct winreg_InitiateSystemShutdown r;
1774         uint16_t hostname = 0x0;
1775
1776         ZERO_STRUCT(r);
1777         r.in.hostname = &hostname;
1778         r.in.message = talloc(tctx, struct lsa_StringLarge);
1779         init_lsa_StringLarge(r.in.message, "spottyfood");
1780         r.in.force_apps = 1;
1781         r.in.timeout = 30;
1782         r.in.do_reboot = 1;
1783
1784         torture_assert_ntstatus_ok(tctx,
1785                                    dcerpc_winreg_InitiateSystemShutdown(p, tctx, &r),
1786                                    "InitiateSystemShutdown failed");
1787
1788         torture_assert_werr_ok(tctx, r.out.result,
1789                                "InitiateSystemShutdown failed");
1790
1791         return test_AbortSystemShutdown(p, tctx);
1792 }
1793
1794
1795 static bool test_InitiateSystemShutdownEx(struct torture_context *tctx,
1796                                           struct dcerpc_pipe *p)
1797 {
1798         struct winreg_InitiateSystemShutdownEx r;
1799         uint16_t hostname = 0x0;
1800
1801         ZERO_STRUCT(r);
1802         r.in.hostname = &hostname;
1803         r.in.message = talloc(tctx, struct lsa_StringLarge);
1804         init_lsa_StringLarge(r.in.message, "spottyfood");
1805         r.in.force_apps = 1;
1806         r.in.timeout = 30;
1807         r.in.do_reboot = 1;
1808         r.in.reason = 0;
1809
1810         torture_assert_ntstatus_ok(tctx,
1811                 dcerpc_winreg_InitiateSystemShutdownEx(p, tctx, &r),
1812                 "InitiateSystemShutdownEx failed");
1813
1814         torture_assert_werr_ok(tctx, r.out.result,
1815                                "InitiateSystemShutdownEx failed");
1816
1817         return test_AbortSystemShutdown(p, tctx);
1818 }
1819 #define MAX_DEPTH 2             /* Only go this far down the tree */
1820
1821 static bool test_key(struct dcerpc_pipe *p, struct torture_context *tctx,
1822                      struct policy_handle *handle, int depth,
1823                      bool test_security)
1824 {
1825         if (depth == MAX_DEPTH)
1826                 return true;
1827
1828         if (!test_QueryInfoKey(p, tctx, handle, NULL)) {
1829         }
1830
1831         if (!test_NotifyChangeKeyValue(p, tctx, handle)) {
1832         }
1833
1834         if (test_security && !test_GetKeySecurity(p, tctx, handle, NULL)) {
1835         }
1836
1837         if (!test_EnumKey(p, tctx, handle, depth, test_security)) {
1838         }
1839
1840         if (!test_EnumValue(p, tctx, handle, 0xFF, 0xFFFF)) {
1841         }
1842
1843         test_CloseKey(p, tctx, handle);
1844
1845         return true;
1846 }
1847
1848 static bool test_SetValue_simple(struct dcerpc_pipe *p,
1849                                  struct torture_context *tctx,
1850                                  struct policy_handle *handle)
1851 {
1852         const char *value_name = TEST_VALUE;
1853         uint32_t value = 0x12345678;
1854         const char *string = "torture";
1855         DATA_BLOB blob;
1856         enum winreg_Type types[] = {
1857                 REG_DWORD,
1858                 REG_BINARY,
1859                 REG_SZ,
1860                 REG_MULTI_SZ
1861         };
1862         int t;
1863
1864         torture_comment(tctx, "Testing SetValue (standard formats)\n");
1865
1866         for (t=0; t < ARRAY_SIZE(types); t++) {
1867
1868                 enum winreg_Type w_type;
1869                 uint32_t w_size, w_length;
1870                 uint8_t *w_data;
1871
1872                 switch (types[t]) {
1873                 case REG_DWORD:
1874                         blob = data_blob_talloc_zero(tctx, 4);
1875                         SIVAL(blob.data, 0, value);
1876                         break;
1877                 case REG_BINARY:
1878                         blob = data_blob_string_const("binary_blob");
1879                         break;
1880                 case REG_SZ:
1881                         torture_assert(tctx,
1882                                 convert_string_talloc_convenience(tctx, lp_iconv_convenience(tctx->lp_ctx),
1883                                                                   CH_UNIX, CH_UTF16,
1884                                                                   string,
1885                                                                   strlen(string)+1,
1886                                                                   (void **)&blob.data,
1887                                                                   &blob.length,
1888                                                                   false), "");
1889                         break;
1890                 case REG_MULTI_SZ:
1891                         torture_assert(tctx,
1892                                 convert_string_talloc_convenience(tctx, lp_iconv_convenience(tctx->lp_ctx),
1893                                                                   CH_UNIX, CH_UTF16,
1894                                                                   string,
1895                                                                   strlen(string)+1,
1896                                                                   (void **)&blob.data,
1897                                                                   &blob.length,
1898                                                                   false), "");
1899                         torture_assert(tctx, data_blob_realloc(tctx, &blob, blob.length + 2), "");
1900                         memset(&blob.data[blob.length - 2], '\0', 2);
1901                         break;
1902                 default:
1903                         break;
1904                 }
1905
1906                 torture_assert(tctx,
1907                         test_SetValue(p, tctx, handle, value_name, types[t], blob.data, blob.length),
1908                         "test_SetValue failed");
1909                 torture_assert(tctx,
1910                         test_QueryValue_full(p, tctx, handle, value_name, true),
1911                         talloc_asprintf(tctx, "test_QueryValue_full for %s value failed", value_name));
1912                 torture_assert(tctx,
1913                         test_winreg_QueryValue(tctx, p, handle, value_name, &w_type, &w_size, &w_length, &w_data),
1914                         "test_winreg_QueryValue failed");
1915                 torture_assert(tctx,
1916                         test_DeleteValue(p, tctx, handle, value_name),
1917                         "test_DeleteValue failed");
1918
1919                 torture_assert_int_equal(tctx, w_type, types[t], "winreg type mismatch");
1920                 torture_assert_int_equal(tctx, w_size, blob.length, "winreg size mismatch");
1921                 torture_assert_int_equal(tctx, w_length, blob.length, "winreg length mismatch");
1922                 torture_assert_mem_equal(tctx, w_data, blob.data, blob.length, "winreg buffer mismatch");
1923         }
1924
1925         torture_comment(tctx, "Testing SetValue (standard formats) succeeded\n");
1926
1927         return true;
1928 }
1929
1930 typedef NTSTATUS (*winreg_open_fn)(struct dcerpc_pipe *, TALLOC_CTX *, void *);
1931
1932 static bool test_Open_Security(struct torture_context *tctx,
1933                                struct dcerpc_pipe *p, void *userdata)
1934 {
1935         struct policy_handle handle, newhandle;
1936         bool ret = true, created2 = false;
1937         bool created4 = false;
1938         struct winreg_OpenHKLM r;
1939
1940         winreg_open_fn open_fn = userdata;
1941
1942         ZERO_STRUCT(r);
1943         r.in.system_name = 0;
1944         r.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
1945         r.out.handle = &handle;
1946
1947         torture_assert_ntstatus_ok(tctx, open_fn(p, tctx, &r),
1948                                    "open");
1949
1950         test_Cleanup(p, tctx, &handle, TEST_KEY_BASE);
1951
1952         if (!test_CreateKey(p, tctx, &handle, TEST_KEY_BASE, NULL)) {
1953                 torture_comment(tctx,
1954                                 "CreateKey (TEST_KEY_BASE) failed\n");
1955         }
1956
1957         if (test_CreateKey_sd(p, tctx, &handle, TEST_KEY2,
1958                               NULL, &newhandle)) {
1959                 created2 = true;
1960         }
1961
1962         if (created2 && !test_CloseKey(p, tctx, &newhandle)) {
1963                 torture_comment(tctx, "CloseKey failed\n");
1964                 ret = false;
1965         }
1966
1967         if (test_CreateKey_sd(p, tctx, &handle, TEST_KEY4, NULL, &newhandle)) {
1968                 created4 = true;
1969         }
1970
1971         if (created4 && !test_CloseKey(p, tctx, &newhandle)) {
1972                 torture_comment(tctx, "CloseKey failed\n");
1973                 ret = false;
1974         }
1975
1976         if (created4 && !test_SecurityDescriptors(p, tctx, &handle, TEST_KEY4)) {
1977                 ret = false;
1978         }
1979
1980         if (created4 && !test_DeleteKey(p, tctx, &handle, TEST_KEY4)) {
1981                 torture_comment(tctx, "DeleteKey failed\n");
1982                 ret = false;
1983         }
1984
1985         if (created2 && !test_DeleteKey(p, tctx, &handle, TEST_KEY2)) {
1986                 torture_comment(tctx, "DeleteKey failed\n");
1987                 ret = false;
1988         }
1989
1990         /* The HKCR hive has a very large fanout */
1991         if (open_fn == (void *)dcerpc_winreg_OpenHKCR) {
1992                 if(!test_key(p, tctx, &handle, MAX_DEPTH - 1, true)) {
1993                         ret = false;
1994                 }
1995         } else {
1996                 if (!test_key(p, tctx, &handle, 0, true)) {
1997                         ret = false;
1998                 }
1999         }
2000
2001         test_Cleanup(p, tctx, &handle, TEST_KEY_BASE);
2002
2003         return ret;
2004 }
2005
2006 static bool test_SetValue_extended(struct dcerpc_pipe *p,
2007                                    struct torture_context *tctx,
2008                                    struct policy_handle *handle)
2009 {
2010         const char *value_name = TEST_VALUE;
2011         enum winreg_Type types[] = {
2012                 REG_NONE,
2013                 REG_SZ,
2014                 REG_EXPAND_SZ,
2015                 REG_BINARY,
2016                 REG_DWORD,
2017                 REG_DWORD_BIG_ENDIAN,
2018                 REG_LINK,
2019                 REG_MULTI_SZ,
2020                 REG_RESOURCE_LIST,
2021                 REG_FULL_RESOURCE_DESCRIPTOR,
2022                 REG_RESOURCE_REQUIREMENTS_LIST,
2023                 REG_QWORD,
2024                 12,
2025                 13,
2026                 14,
2027                 55,
2028                 123456,
2029                 653210,
2030                 __LINE__
2031         };
2032         int t, l;
2033
2034         if (torture_setting_bool(tctx, "samba3", false) ||
2035             torture_setting_bool(tctx, "samba4", false)) {
2036                 torture_skip(tctx, "skipping extended SetValue test against Samba");
2037         }
2038
2039         torture_comment(tctx, "Testing SetValue (extended formats)\n");
2040
2041         for (t=0; t < ARRAY_SIZE(types); t++) {
2042         for (l=0; l < 32; l++) {
2043
2044                 enum winreg_Type w_type;
2045                 uint32_t w_size, w_length;
2046                 uint8_t *w_data;
2047
2048                 const char *string = generate_random_str(tctx, l);
2049                 DATA_BLOB blob = data_blob_string_const(string);
2050
2051                 torture_assert(tctx,
2052                         test_SetValue(p, tctx, handle, value_name, types[t], blob.data, blob.length),
2053                         "test_SetValue failed");
2054
2055                 torture_assert(tctx,
2056                         test_winreg_QueryValue(tctx, p, handle, value_name, &w_type, &w_size, &w_length, &w_data),
2057                         "test_winreg_QueryValue failed");
2058
2059                 torture_assert(tctx,
2060                         test_DeleteValue(p, tctx, handle, value_name),
2061                         "test_DeleteValue failed");
2062
2063                 torture_assert_int_equal(tctx, w_type, types[t], "winreg type mismatch");
2064                 torture_assert_int_equal(tctx, w_size, blob.length, "winreg size mismatch");
2065                 torture_assert_int_equal(tctx, w_length, blob.length, "winreg length mismatch");
2066                 torture_assert_mem_equal(tctx, w_data, blob.data, blob.length, "winreg buffer mismatch");
2067         }
2068         }
2069
2070         torture_comment(tctx, "Testing SetValue (extended formats) succeeded\n");
2071
2072         return true;
2073 }
2074
2075 #define KEY_CURRENT_VERSION "SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION"
2076 #define VALUE_CURRENT_VERSION "CurrentVersion"
2077
2078 static bool test_Open(struct torture_context *tctx, struct dcerpc_pipe *p,
2079                       void *userdata)
2080 {
2081         struct policy_handle handle, newhandle;
2082         bool ret = true, created = false, deleted = false;
2083         bool created3 = false, created_subkey = false;
2084         struct winreg_OpenHKLM r;
2085
2086         winreg_open_fn open_fn = userdata;
2087
2088         ZERO_STRUCT(r);
2089         r.in.system_name = 0;
2090         r.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
2091         r.out.handle = &handle;
2092
2093         torture_assert_ntstatus_ok(tctx, open_fn(p, tctx, &r),
2094                                    "open");
2095
2096         if (open_fn == (void *)dcerpc_winreg_OpenHKLM) {
2097 #if 0
2098                 torture_assert(tctx, test_OpenKey(p, tctx, &handle, KEY_CURRENT_VERSION, &newhandle),
2099                         "failed to open current version key");
2100 #else
2101                 torture_assert(tctx, _test_OpenKey(p, tctx, &handle, KEY_CURRENT_VERSION, KEY_QUERY_VALUE, &newhandle, WERR_OK, NULL),
2102                         "failed to open current version key");
2103 #endif
2104                 torture_assert(tctx, test_QueryValue_full(p, tctx, &newhandle, VALUE_CURRENT_VERSION, true),
2105                         "failed to query current version");
2106                 torture_assert(tctx, test_QueryValue_full(p, tctx, &newhandle, "IDoNotExist", false),
2107                         "failed to query current version");
2108                 torture_assert(tctx, test_QueryValue_full(p, tctx, &newhandle, NULL, false),
2109                         "test_QueryValue_full for NULL value failed");
2110                 torture_assert(tctx, test_QueryValue_full(p, tctx, &newhandle, "", false),
2111                         "test_QueryValue_full for \"\" value failed");
2112
2113                 torture_assert(tctx, test_CloseKey(p, tctx, &newhandle),
2114                         "failed to close current version key");
2115         }
2116
2117         test_Cleanup(p, tctx, &handle, TEST_KEY_BASE);
2118
2119         if (!test_CreateKey(p, tctx, &handle, TEST_KEY_BASE, NULL)) {
2120                 torture_comment(tctx,
2121                                 "CreateKey (TEST_KEY_BASE) failed\n");
2122         }
2123
2124         if (!test_CreateKey(p, tctx, &handle, TEST_KEY1, NULL)) {
2125                 torture_comment(tctx,
2126                                 "CreateKey failed - not considering a failure\n");
2127         } else {
2128                 created = true;
2129         }
2130
2131         if (created && !test_FlushKey(p, tctx, &handle)) {
2132                 torture_comment(tctx, "FlushKey failed\n");
2133                 ret = false;
2134         }
2135
2136         if (created && !test_OpenKey(p, tctx, &handle, TEST_KEY1, &newhandle))
2137                 torture_fail(tctx,
2138                              "CreateKey failed (OpenKey after Create didn't work)\n");
2139
2140         if (created) {
2141                 torture_assert(tctx, test_SetValue_simple(p, tctx, &newhandle),
2142                         "simple SetValue test failed");
2143                 torture_assert(tctx, test_SetValue_extended(p, tctx, &newhandle),
2144                         "extended SetValue test failed");
2145         }
2146
2147         if (created && !test_CloseKey(p, tctx, &newhandle))
2148                 torture_fail(tctx,
2149                              "CreateKey failed (CloseKey after Open didn't work)\n");
2150
2151         if (created && !test_DeleteKey(p, tctx, &handle, TEST_KEY1)) {
2152                 torture_comment(tctx, "DeleteKey failed\n");
2153                 ret = false;
2154         } else {
2155                 deleted = true;
2156         }
2157
2158         if (created && !test_FlushKey(p, tctx, &handle)) {
2159                 torture_comment(tctx, "FlushKey failed\n");
2160                 ret = false;
2161         }
2162
2163         if (created && deleted &&
2164             !_test_OpenKey(p, tctx, &handle, TEST_KEY1,
2165                            SEC_FLAG_MAXIMUM_ALLOWED, &newhandle,
2166                            WERR_BADFILE, NULL)) {
2167                 torture_comment(tctx,
2168                                 "DeleteKey failed (OpenKey after Delete "
2169                                 "did not return WERR_BADFILE)\n");
2170                 ret = false;
2171         }
2172
2173         if (!test_GetVersion(p, tctx, &handle)) {
2174                 torture_comment(tctx, "GetVersion failed\n");
2175                 ret = false;
2176         }
2177
2178         if (created && test_CreateKey(p, tctx, &handle, TEST_KEY3, NULL)) {
2179                 created3 = true;
2180         }
2181
2182         if (created3 &&
2183             test_CreateKey(p, tctx, &handle, TEST_SUBKEY, NULL)) {
2184                 created_subkey = true;
2185         }
2186
2187         if (created_subkey &&
2188             !test_DeleteKey(p, tctx, &handle, TEST_KEY3)) {
2189                 torture_comment(tctx, "DeleteKey failed\n");
2190                 ret = false;
2191         }
2192
2193         /* The HKCR hive has a very large fanout */
2194         if (open_fn == (void *)dcerpc_winreg_OpenHKCR) {
2195                 if(!test_key(p, tctx, &handle, MAX_DEPTH - 1, false)) {
2196                         ret = false;
2197                 }
2198         } else {
2199                 if (!test_key(p, tctx, &handle, 0, false)) {
2200                         ret = false;
2201                 }
2202         }
2203
2204         test_Cleanup(p, tctx, &handle, TEST_KEY_BASE);
2205
2206         return ret;
2207 }
2208
2209 struct torture_suite *torture_rpc_winreg(TALLOC_CTX *mem_ctx)
2210 {
2211         struct torture_rpc_tcase *tcase;
2212         struct torture_suite *suite = torture_suite_create(mem_ctx, "WINREG");
2213         struct torture_test *test;
2214
2215         tcase = torture_suite_add_rpc_iface_tcase(suite, "winreg",
2216                                                   &ndr_table_winreg);
2217
2218         test = torture_rpc_tcase_add_test(tcase, "InitiateSystemShutdown",
2219                                           test_InitiateSystemShutdown);
2220         test->dangerous = true;
2221
2222         test = torture_rpc_tcase_add_test(tcase, "InitiateSystemShutdownEx",
2223                                           test_InitiateSystemShutdownEx);
2224         test->dangerous = true;
2225
2226         /* Basic tests without security descriptors */
2227         torture_rpc_tcase_add_test_ex(tcase, "HKLM-basic",
2228                                       test_Open,
2229                                       (winreg_open_fn)dcerpc_winreg_OpenHKLM);
2230         torture_rpc_tcase_add_test_ex(tcase, "HKU-basic",
2231                                       test_Open,
2232                                       (winreg_open_fn)dcerpc_winreg_OpenHKU);
2233         torture_rpc_tcase_add_test_ex(tcase, "HKCR-basic",
2234                                       test_Open,
2235                                       (winreg_open_fn)dcerpc_winreg_OpenHKCR);
2236         torture_rpc_tcase_add_test_ex(tcase, "HKCU-basic",
2237                                       test_Open,
2238                                       (winreg_open_fn)dcerpc_winreg_OpenHKCU);
2239
2240         /* Security descriptor tests */
2241         torture_rpc_tcase_add_test_ex(tcase, "HKLM-security",
2242                                       test_Open_Security,
2243                                       (winreg_open_fn)dcerpc_winreg_OpenHKLM);
2244         torture_rpc_tcase_add_test_ex(tcase, "HKU-security",
2245                                       test_Open_Security,
2246                                       (winreg_open_fn)dcerpc_winreg_OpenHKU);
2247         torture_rpc_tcase_add_test_ex(tcase, "HKCR-security",
2248                                       test_Open_Security,
2249                                       (winreg_open_fn)dcerpc_winreg_OpenHKCR);
2250         torture_rpc_tcase_add_test_ex(tcase, "HKCU-security",
2251                                       test_Open_Security,
2252                                       (winreg_open_fn)dcerpc_winreg_OpenHKCU);
2253
2254         return suite;
2255 }