source4/torture/rpc/lsa.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3    test suite for lsa rpc operations
   4
   5    Copyright (C) Andrew Tridgell 2003
   6    Copyright (C) Andrew Bartlett <abartlet@samba.org> 2004-2005
   7
   8    This program is free software; you can redistribute it and/or modify
   9    it under the terms of the GNU General Public License as published by
  10    the Free Software Foundation; either version 2 of the License, or
  11    (at your option) any later version.
  12
  13    This program is distributed in the hope that it will be useful,
  14    but WITHOUT ANY WARRANTY; without even the implied warranty of
  15    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  16    GNU General Public License for more details.
  17
  18    You should have received a copy of the GNU General Public License
  19    along with this program; if not, write to the Free Software
  20    Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  21 */
  22
  23 #include "includes.h"
  24 #include "torture/torture.h"
  25 #include "librpc/gen_ndr/ndr_lsa.h"
  26 #include "lib/events/events.h"
  27
  28 static void init_lsa_String(struct lsa_String *name, const char *s)
  29 {
  30         name->string = s;
  31 }
  32
  33 static BOOL test_OpenPolicy(struct dcerpc_pipe *p, TALLOC_CTX *mem_ctx)
  34 {
  35         struct lsa_ObjectAttribute attr;
  36         struct policy_handle handle;
  37         struct lsa_QosInfo qos;
  38         struct lsa_OpenPolicy r;
  39         NTSTATUS status;
  40         uint16_t system_name = '\\';
  41
  42         printf("\ntesting OpenPolicy\n");
  43
  44         qos.len = 0;
  45         qos.impersonation_level = 2;
  46         qos.context_mode = 1;
  47         qos.effective_only = 0;
  48
  49         attr.len = 0;
  50         attr.root_dir = NULL;
  51         attr.object_name = NULL;
  52         attr.attributes = 0;
  53         attr.sec_desc = NULL;
  54         attr.sec_qos = &qos;
  55
  56         r.in.system_name = &system_name;
  57         r.in.attr = &attr;
  58         r.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
  59         r.out.handle = &handle;
  60
  61         status = dcerpc_lsa_OpenPolicy(p, mem_ctx, &r);
  62         if (!NT_STATUS_IS_OK(status)) {
  63                 if (NT_STATUS_EQUAL(status, NT_STATUS_ACCESS_DENIED) ||
  64                     NT_STATUS_EQUAL(status, NT_STATUS_RPC_PROTSEQ_NOT_SUPPORTED)) {
  65                         printf("not considering %s to be an error\n", nt_errstr(status));
  66                         return True;
  67                 }
  68                 printf("OpenPolicy failed - %s\n", nt_errstr(status));
  69                 return False;
  70         }
  71
  72         return True;
  73 }
  74
  75
  76 BOOL test_lsa_OpenPolicy2(struct dcerpc_pipe *p, TALLOC_CTX *mem_ctx,
  77                           struct policy_handle **handle)
  78 {
  79         struct lsa_ObjectAttribute attr;
  80         struct lsa_QosInfo qos;
  81         struct lsa_OpenPolicy2 r;
  82         NTSTATUS status;
  83
  84         printf("\ntesting OpenPolicy2\n");
  85
  86         *handle = talloc(mem_ctx, struct policy_handle);
  87         if (!*handle) {
  88                 return False;
  89         }
  90
  91         qos.len = 0;
  92         qos.impersonation_level = 2;
  93         qos.context_mode = 1;
  94         qos.effective_only = 0;
  95
  96         attr.len = 0;
  97         attr.root_dir = NULL;
  98         attr.object_name = NULL;
  99         attr.attributes = 0;
 100         attr.sec_desc = NULL;
 101         attr.sec_qos = &qos;
 102
 103         r.in.system_name = "\\";
 104         r.in.attr = &attr;
 105         r.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
 106         r.out.handle = *handle;
 107
 108         status = dcerpc_lsa_OpenPolicy2(p, mem_ctx, &r);
 109         if (!NT_STATUS_IS_OK(status)) {
 110                 if (NT_STATUS_EQUAL(status, NT_STATUS_ACCESS_DENIED) ||
 111                     NT_STATUS_EQUAL(status, NT_STATUS_RPC_PROTSEQ_NOT_SUPPORTED)) {
 112                         printf("not considering %s to be an error\n", nt_errstr(status));
 113                         talloc_free(*handle);
 114                         *handle = NULL;
 115                         return True;
 116                 }
 117                 printf("OpenPolicy2 failed - %s\n", nt_errstr(status));
 118                 return False;
 119         }
 120
 121         return True;
 122 }
 123
 124 static BOOL test_LookupNames(struct dcerpc_pipe *p,
 125                             TALLOC_CTX *mem_ctx,
 126                             struct policy_handle *handle,
 127                             struct lsa_TransNameArray *tnames)
 128 {
 129         struct lsa_LookupNames r;
 130         struct lsa_TransSidArray sids;
 131         struct lsa_String *names;
 132         uint32_t count = 0;
 133         NTSTATUS status;
 134         int i;
 135
 136         printf("\nTesting LookupNames with %d names\n", tnames->count);
 137
 138         sids.count = 0;
 139         sids.sids = NULL;
 140
 141         names = talloc_array(mem_ctx, struct lsa_String, tnames->count);
 142         for (i=0;i<tnames->count;i++) {
 143                 init_lsa_String(&names[i], tnames->names[i].name.string);
 144         }
 145
 146         r.in.handle = handle;
 147         r.in.num_names = tnames->count;
 148         r.in.names = names;
 149         r.in.sids = &sids;
 150         r.in.level = 1;
 151         r.in.count = &count;
 152         r.out.count = &count;
 153         r.out.sids = &sids;
 154
 155         status = dcerpc_lsa_LookupNames(p, mem_ctx, &r);
 156         if (!NT_STATUS_IS_OK(status) && !NT_STATUS_EQUAL(status, STATUS_SOME_UNMAPPED)) {
 157                 printf("LookupNames failed - %s\n", nt_errstr(status));
 158                 return False;
 159         }
 160
 161         printf("\n");
 162
 163         return True;
 164 }
 165
 166 static BOOL test_LookupNames2(struct dcerpc_pipe *p,
 167                               TALLOC_CTX *mem_ctx,
 168                               struct policy_handle *handle,
 169                               struct lsa_TransNameArray2 *tnames)
 170 {
 171         struct lsa_LookupNames2 r;
 172         struct lsa_TransSidArray2 sids;
 173         struct lsa_String *names;
 174         uint32_t count = 0;
 175         NTSTATUS status;
 176         int i;
 177
 178         printf("\nTesting LookupNames2 with %d names\n", tnames->count);
 179
 180         sids.count = 0;
 181         sids.sids = NULL;
 182
 183         names = talloc_array(mem_ctx, struct lsa_String, tnames->count);
 184         for (i=0;i<tnames->count;i++) {
 185                 init_lsa_String(&names[i], tnames->names[i].name.string);
 186         }
 187
 188         r.in.handle = handle;
 189         r.in.num_names = tnames->count;
 190         r.in.names = names;
 191         r.in.sids = &sids;
 192         r.in.level = 1;
 193         r.in.count = &count;
 194         r.in.unknown1 = 0;
 195         r.in.unknown2 = 0;
 196         r.out.count = &count;
 197         r.out.sids = &sids;
 198
 199         status = dcerpc_lsa_LookupNames2(p, mem_ctx, &r);
 200         if (!NT_STATUS_IS_OK(status) && !NT_STATUS_EQUAL(status, STATUS_SOME_UNMAPPED)) {
 201                 printf("LookupNames2 failed - %s\n", nt_errstr(status));
 202                 return False;
 203         }
 204
 205         printf("\n");
 206
 207         return True;
 208 }
 209
 210
 211 static BOOL test_LookupNames3(struct dcerpc_pipe *p,
 212                               TALLOC_CTX *mem_ctx,
 213                               struct policy_handle *handle,
 214                               struct lsa_TransNameArray2 *tnames)
 215 {
 216         struct lsa_LookupNames3 r;
 217         struct lsa_TransSidArray3 sids;
 218         struct lsa_String *names;
 219         uint32_t count = 0;
 220         NTSTATUS status;
 221         int i;
 222
 223         printf("\nTesting LookupNames3 with %d names\n", tnames->count);
 224
 225         sids.count = 0;
 226         sids.sids = NULL;
 227
 228         names = talloc_array(mem_ctx, struct lsa_String, tnames->count);
 229         for (i=0;i<tnames->count;i++) {
 230                 init_lsa_String(&names[i], tnames->names[i].name.string);
 231         }
 232
 233         r.in.handle = handle;
 234         r.in.num_names = tnames->count;
 235         r.in.names = names;
 236         r.in.sids = &sids;
 237         r.in.level = 1;
 238         r.in.count = &count;
 239         r.in.unknown1 = 0;
 240         r.in.unknown2 = 0;
 241         r.out.count = &count;
 242         r.out.sids = &sids;
 243
 244         status = dcerpc_lsa_LookupNames3(p, mem_ctx, &r);
 245         if (!NT_STATUS_IS_OK(status) && !NT_STATUS_EQUAL(status, STATUS_SOME_UNMAPPED)) {
 246                 printf("LookupNames3 failed - %s\n", nt_errstr(status));
 247                 return False;
 248         }
 249
 250         printf("\n");
 251
 252         return True;
 253 }
 254
 255 static BOOL test_LookupNames4(struct dcerpc_pipe *p,
 256                               TALLOC_CTX *mem_ctx,
 257                               struct lsa_TransNameArray2 *tnames)
 258 {
 259         struct lsa_LookupNames4 r;
 260         struct lsa_TransSidArray3 sids;
 261         struct lsa_String *names;
 262         uint32_t count = 0;
 263         NTSTATUS status;
 264         int i;
 265
 266         printf("\nTesting LookupNames4 with %d names\n", tnames->count);
 267
 268         sids.count = 0;
 269         sids.sids = NULL;
 270
 271         names = talloc_array(mem_ctx, struct lsa_String, tnames->count);
 272         for (i=0;i<tnames->count;i++) {
 273                 init_lsa_String(&names[i], tnames->names[i].name.string);
 274         }
 275
 276         r.in.num_names = tnames->count;
 277         r.in.names = names;
 278         r.in.sids = &sids;
 279         r.in.level = 1;
 280         r.in.count = &count;
 281         r.in.unknown1 = 0;
 282         r.in.unknown2 = 0;
 283         r.out.count = &count;
 284         r.out.sids = &sids;
 285
 286         status = dcerpc_lsa_LookupNames4(p, mem_ctx, &r);
 287         if (!NT_STATUS_IS_OK(status) && !NT_STATUS_EQUAL(status, STATUS_SOME_UNMAPPED)) {
 288                 printf("LookupNames4 failed - %s\n", nt_errstr(status));
 289                 return False;
 290         }
 291
 292         printf("\n");
 293
 294         return True;
 295 }
 296
 297
 298 static BOOL test_LookupSids(struct dcerpc_pipe *p,
 299                             TALLOC_CTX *mem_ctx,
 300                             struct policy_handle *handle,
 301                             struct lsa_SidArray *sids)
 302 {
 303         struct lsa_LookupSids r;
 304         struct lsa_TransNameArray names;
 305         uint32_t count = sids->num_sids;
 306         NTSTATUS status;
 307
 308         printf("\nTesting LookupSids\n");
 309
 310         names.count = 0;
 311         names.names = NULL;
 312
 313         r.in.handle = handle;
 314         r.in.sids = sids;
 315         r.in.names = &names;
 316         r.in.level = 1;
 317         r.in.count = &count;
 318         r.out.count = &count;
 319         r.out.names = &names;
 320
 321         status = dcerpc_lsa_LookupSids(p, mem_ctx, &r);
 322         if (!NT_STATUS_IS_OK(status) && !NT_STATUS_EQUAL(status, STATUS_SOME_UNMAPPED)) {
 323                 printf("LookupSids failed - %s\n", nt_errstr(status));
 324                 return False;
 325         }
 326
 327         printf("\n");
 328
 329         if (!test_LookupNames(p, mem_ctx, handle, &names)) {
 330                 return False;
 331         }
 332
 333         return True;
 334 }
 335
 336
 337 static BOOL test_LookupSids2(struct dcerpc_pipe *p,
 338                             TALLOC_CTX *mem_ctx,
 339                             struct policy_handle *handle,
 340                             struct lsa_SidArray *sids)
 341 {
 342         struct lsa_LookupSids2 r;
 343         struct lsa_TransNameArray2 names;
 344         uint32_t count = sids->num_sids;
 345         NTSTATUS status;
 346
 347         printf("\nTesting LookupSids2\n");
 348
 349         names.count = 0;
 350         names.names = NULL;
 351
 352         r.in.handle = handle;
 353         r.in.sids = sids;
 354         r.in.names = &names;
 355         r.in.level = 1;
 356         r.in.count = &count;
 357         r.in.unknown1 = 0;
 358         r.in.unknown2 = 0;
 359         r.out.count = &count;
 360         r.out.names = &names;
 361
 362         status = dcerpc_lsa_LookupSids2(p, mem_ctx, &r);
 363         if (!NT_STATUS_IS_OK(status) && !NT_STATUS_EQUAL(status, STATUS_SOME_UNMAPPED)) {
 364                 printf("LookupSids2 failed - %s\n", nt_errstr(status));
 365                 return False;
 366         }
 367
 368         printf("\n");
 369
 370         if (!test_LookupNames2(p, mem_ctx, handle, &names)) {
 371                 return False;
 372         }
 373
 374         if (!test_LookupNames3(p, mem_ctx, handle, &names)) {
 375                 return False;
 376         }
 377
 378         return True;
 379 }
 380
 381 static BOOL test_LookupSids3(struct dcerpc_pipe *p,
 382                             TALLOC_CTX *mem_ctx,
 383                             struct lsa_SidArray *sids)
 384 {
 385         struct lsa_LookupSids3 r;
 386         struct lsa_TransNameArray2 names;
 387         uint32_t count = sids->num_sids;
 388         NTSTATUS status;
 389
 390         printf("\nTesting LookupSids3\n");
 391
 392         names.count = 0;
 393         names.names = NULL;
 394
 395         r.in.sids = sids;
 396         r.in.names = &names;
 397         r.in.level = 1;
 398         r.in.count = &count;
 399         r.in.unknown1 = 0;
 400         r.in.unknown2 = 0;
 401         r.out.count = &count;
 402         r.out.names = &names;
 403
 404         status = dcerpc_lsa_LookupSids3(p, mem_ctx, &r);
 405         if (!NT_STATUS_IS_OK(status) && !NT_STATUS_EQUAL(status, STATUS_SOME_UNMAPPED)) {
 406                 if (NT_STATUS_EQUAL(status, NT_STATUS_ACCESS_DENIED) ||
 407                     NT_STATUS_EQUAL(status, NT_STATUS_RPC_PROTSEQ_NOT_SUPPORTED)) {
 408                         printf("not considering %s to be an error\n", nt_errstr(status));
 409                         return True;
 410                 }
 411                 printf("LookupSids3 failed - %s - not considered an error\n",
 412                        nt_errstr(status));
 413                 return False;
 414         }
 415
 416         printf("\n");
 417
 418         if (!test_LookupNames4(p, mem_ctx, &names)) {
 419                 return False;
 420         }
 421
 422         return True;
 423 }
 424
 425 BOOL test_many_LookupSids(struct dcerpc_pipe *p,
 426                           TALLOC_CTX *mem_ctx,
 427                           struct policy_handle *handle)
 428 {
 429         uint32_t count;
 430         NTSTATUS status;
 431         struct lsa_SidArray sids;
 432         int i;
 433
 434         printf("\nTesting LookupSids with lots of SIDs\n");
 435
 436         sids.num_sids = 100;
 437
 438         sids.sids = talloc_array(mem_ctx, struct lsa_SidPtr, sids.num_sids);
 439
 440         for (i=0; i<sids.num_sids; i++) {
 441                 const char *sidstr = "S-1-5-32-545";
 442                 sids.sids[i].sid = dom_sid_parse_talloc(mem_ctx, sidstr);
 443         }
 444
 445         count = sids.num_sids;
 446
 447         if (handle) {
 448                 struct lsa_LookupSids r;
 449                 struct lsa_TransNameArray names;
 450                 names.count = 0;
 451                 names.names = NULL;
 452
 453                 r.in.handle = handle;
 454                 r.in.sids = &sids;
 455                 r.in.names = &names;
 456                 r.in.level = 1;
 457                 r.in.count = &names.count;
 458                 r.out.count = &count;
 459                 r.out.names = &names;
 460
 461                 status = dcerpc_lsa_LookupSids(p, mem_ctx, &r);
 462                 if (!NT_STATUS_IS_OK(status) &&
 463                     !NT_STATUS_EQUAL(status, STATUS_SOME_UNMAPPED)) {
 464                         printf("LookupSids failed - %s\n", nt_errstr(status));
 465                         return False;
 466                 }
 467
 468                 printf("\n");
 469
 470                 if (!test_LookupNames(p, mem_ctx, handle, &names)) {
 471                         return False;
 472                 }
 473         } else {
 474                 struct lsa_LookupSids3 r;
 475                 struct lsa_TransNameArray2 names;
 476
 477                 names.count = 0;
 478                 names.names = NULL;
 479
 480                 printf("\nTesting LookupSids3\n");
 481
 482                 r.in.sids = &sids;
 483                 r.in.names = &names;
 484                 r.in.level = 1;
 485                 r.in.count = &count;
 486                 r.in.unknown1 = 0;
 487                 r.in.unknown2 = 0;
 488                 r.out.count = &count;
 489                 r.out.names = &names;
 490
 491                 status = dcerpc_lsa_LookupSids3(p, mem_ctx, &r);
 492                 if (!NT_STATUS_IS_OK(status) && !NT_STATUS_EQUAL(status, STATUS_SOME_UNMAPPED)) {
 493                         if (NT_STATUS_EQUAL(status, NT_STATUS_ACCESS_DENIED) ||
 494                             NT_STATUS_EQUAL(status, NT_STATUS_RPC_PROTSEQ_NOT_SUPPORTED)) {
 495                                 printf("not considering %s to be an error\n", nt_errstr(status));
 496                                 return True;
 497                         }
 498                         printf("LookupSids3 failed - %s\n",
 499                                nt_errstr(status));
 500                         return False;
 501                 }
 502                 if (!test_LookupNames4(p, mem_ctx, &names)) {
 503                         return False;
 504                 }
 505         }
 506
 507         printf("\n");
 508
 509
 510
 511         return True;
 512 }
 513
 514 #define NUM_ASYNC_REQUESTS 1000
 515
 516 static void lookupsids_cb(struct rpc_request *req)
 517 {
 518         int *replies = (int *)req->async.private;
 519         NTSTATUS status;
 520
 521         status = dcerpc_ndr_request_recv(req);
 522         DEBUG(3, ("lookupsids returned %s\n", nt_errstr(status)));
 523         if (!NT_STATUS_IS_OK(status)) {
 524                 *replies = -1;
 525         }
 526
 527         *replies += 1;
 528 }
 529
 530 static BOOL test_LookupSids_async(struct dcerpc_pipe *p,
 531                                   TALLOC_CTX *mem_ctx,
 532                                   struct policy_handle *handle)
 533 {
 534         struct lsa_SidArray sids;
 535         struct lsa_SidPtr sidptr;
 536
 537         uint32_t count[NUM_ASYNC_REQUESTS];
 538         struct lsa_TransNameArray names[NUM_ASYNC_REQUESTS];
 539         struct lsa_LookupSids r[NUM_ASYNC_REQUESTS];
 540         struct rpc_request **req;
 541
 542         int i, replies;
 543         BOOL ret = True;
 544
 545         printf("\nTesting %d async lookupsids request\n", 100);
 546
 547         req = talloc_array(mem_ctx, struct rpc_request *, NUM_ASYNC_REQUESTS);
 548
 549         sids.num_sids = 1;
 550         sids.sids = &sidptr;
 551         sidptr.sid = dom_sid_parse_talloc(mem_ctx, "S-1-5-32-545");
 552
 553         replies = 0;
 554
 555         for (i=0; i<NUM_ASYNC_REQUESTS; i++) {
 556                 count[i] = 0;
 557                 names[i].count = 0;
 558                 names[i].names = NULL;
 559
 560                 r[i].in.handle = handle;
 561                 r[i].in.sids = &sids;
 562                 r[i].in.names = &names[i];
 563                 r[i].in.level = 1;
 564                 r[i].in.count = &names[i].count;
 565                 r[i].out.count = &count[i];
 566                 r[i].out.names = &names[i];
 567
 568                 req[i] = dcerpc_lsa_LookupSids_send(p, req, &r[i]);
 569                 if (req[i] == NULL) {
 570                         ret = False;
 571                         break;
 572                 }
 573
 574                 req[i]->async.callback = lookupsids_cb;
 575                 req[i]->async.private = &replies;
 576         }
 577
 578         while (replies < NUM_ASYNC_REQUESTS) {
 579                 event_loop_once(p->conn->event_ctx);
 580                 if (replies < 0) {
 581                         ret = False;
 582                         break;
 583                 }
 584         }
 585
 586         talloc_free(req);
 587
 588         return ret;
 589 }
 590
 591 static BOOL test_LookupPrivValue(struct dcerpc_pipe *p,
 592                                  TALLOC_CTX *mem_ctx,
 593                                  struct policy_handle *handle,
 594                                  struct lsa_String *name)
 595 {
 596         NTSTATUS status;
 597         struct lsa_LookupPrivValue r;
 598         struct lsa_LUID luid;
 599
 600         r.in.handle = handle;
 601         r.in.name = name;
 602         r.out.luid = &luid;
 603
 604         status = dcerpc_lsa_LookupPrivValue(p, mem_ctx, &r);
 605         if (!NT_STATUS_IS_OK(status)) {
 606                 printf("\nLookupPrivValue failed - %s\n", nt_errstr(status));
 607                 return False;
 608         }
 609
 610         return True;
 611 }
 612
 613 static BOOL test_LookupPrivName(struct dcerpc_pipe *p,
 614                                 TALLOC_CTX *mem_ctx,
 615                                 struct policy_handle *handle,
 616                                 struct lsa_LUID *luid)
 617 {
 618         NTSTATUS status;
 619         struct lsa_LookupPrivName r;
 620
 621         r.in.handle = handle;
 622         r.in.luid = luid;
 623
 624         status = dcerpc_lsa_LookupPrivName(p, mem_ctx, &r);
 625         if (!NT_STATUS_IS_OK(status)) {
 626                 printf("\nLookupPrivName failed - %s\n", nt_errstr(status));
 627                 return False;
 628         }
 629
 630         return True;
 631 }
 632
 633 static BOOL test_RemovePrivilegesFromAccount(struct dcerpc_pipe *p,
 634                                              TALLOC_CTX *mem_ctx,
 635                                              struct policy_handle *acct_handle,
 636                                              struct lsa_LUID *luid)
 637 {
 638         NTSTATUS status;
 639         struct lsa_RemovePrivilegesFromAccount r;
 640         struct lsa_PrivilegeSet privs;
 641         BOOL ret = True;
 642
 643         printf("Testing RemovePrivilegesFromAccount\n");
 644
 645         r.in.handle = acct_handle;
 646         r.in.remove_all = 0;
 647         r.in.privs = &privs;
 648
 649         privs.count = 1;
 650         privs.unknown = 0;
 651         privs.set = talloc_array(mem_ctx, struct lsa_LUIDAttribute, 1);
 652         privs.set[0].luid = *luid;
 653         privs.set[0].attribute = 0;
 654
 655         status = dcerpc_lsa_RemovePrivilegesFromAccount(p, mem_ctx, &r);
 656         if (!NT_STATUS_IS_OK(status)) {
 657                 printf("RemovePrivilegesFromAccount failed - %s\n", nt_errstr(status));
 658                 return False;
 659         }
 660
 661         return ret;
 662 }
 663
 664 static BOOL test_AddPrivilegesToAccount(struct dcerpc_pipe *p,
 665                                         TALLOC_CTX *mem_ctx,
 666                                         struct policy_handle *acct_handle,
 667                                         struct lsa_LUID *luid)
 668 {
 669         NTSTATUS status;
 670         struct lsa_AddPrivilegesToAccount r;
 671         struct lsa_PrivilegeSet privs;
 672         BOOL ret = True;
 673
 674         printf("Testing AddPrivilegesToAccount\n");
 675
 676         r.in.handle = acct_handle;
 677         r.in.privs = &privs;
 678
 679         privs.count = 1;
 680         privs.unknown = 0;
 681         privs.set = talloc_array(mem_ctx, struct lsa_LUIDAttribute, 1);
 682         privs.set[0].luid = *luid;
 683         privs.set[0].attribute = 0;
 684
 685         status = dcerpc_lsa_AddPrivilegesToAccount(p, mem_ctx, &r);
 686         if (!NT_STATUS_IS_OK(status)) {
 687                 printf("AddPrivilegesToAccount failed - %s\n", nt_errstr(status));
 688                 return False;
 689         }
 690
 691         return ret;
 692 }
 693
 694 static BOOL test_EnumPrivsAccount(struct dcerpc_pipe *p,
 695                                   TALLOC_CTX *mem_ctx,
 696                                   struct policy_handle *handle,
 697                                   struct policy_handle *acct_handle)
 698 {
 699         NTSTATUS status;
 700         struct lsa_EnumPrivsAccount r;
 701         BOOL ret = True;
 702
 703         printf("Testing EnumPrivsAccount\n");
 704
 705         r.in.handle = acct_handle;
 706
 707         status = dcerpc_lsa_EnumPrivsAccount(p, mem_ctx, &r);
 708         if (!NT_STATUS_IS_OK(status)) {
 709                 printf("EnumPrivsAccount failed - %s\n", nt_errstr(status));
 710                 return False;
 711         }
 712
 713         if (r.out.privs && r.out.privs->count > 0) {
 714                 int i;
 715                 for (i=0;i<r.out.privs->count;i++) {
 716                         test_LookupPrivName(p, mem_ctx, handle,
 717                                             &r.out.privs->set[i].luid);
 718                 }
 719
 720                 ret &= test_RemovePrivilegesFromAccount(p, mem_ctx, acct_handle,
 721                                                         &r.out.privs->set[0].luid);
 722                 ret &= test_AddPrivilegesToAccount(p, mem_ctx, acct_handle,
 723                                                    &r.out.privs->set[0].luid);
 724         }
 725
 726         return ret;
 727 }
 728
 729 static BOOL test_Delete(struct dcerpc_pipe *p,
 730                        TALLOC_CTX *mem_ctx,
 731                        struct policy_handle *handle)
 732 {
 733         NTSTATUS status;
 734         struct lsa_Delete r;
 735
 736         printf("testing Delete\n");
 737
 738         r.in.handle = handle;
 739         status = dcerpc_lsa_Delete(p, mem_ctx, &r);
 740         if (!NT_STATUS_IS_OK(status)) {
 741                 printf("Delete failed - %s\n", nt_errstr(status));
 742                 return False;
 743         }
 744
 745         return True;
 746 }
 747
 748
 749 static BOOL test_CreateAccount(struct dcerpc_pipe *p,
 750                                TALLOC_CTX *mem_ctx,
 751                                struct policy_handle *handle)
 752 {
 753         NTSTATUS status;
 754         struct lsa_CreateAccount r;
 755         struct dom_sid2 *newsid;
 756         struct policy_handle acct_handle;
 757
 758         newsid = dom_sid_parse_talloc(mem_ctx, "S-1-5-12349876-4321-2854");
 759
 760         printf("Testing CreateAccount\n");
 761
 762         r.in.handle = handle;
 763         r.in.sid = newsid;
 764         r.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
 765         r.out.acct_handle = &acct_handle;
 766
 767         status = dcerpc_lsa_CreateAccount(p, mem_ctx, &r);
 768         if (!NT_STATUS_IS_OK(status)) {
 769                 printf("CreateAccount failed - %s\n", nt_errstr(status));
 770                 return False;
 771         }
 772
 773         if (!test_Delete(p, mem_ctx, &acct_handle)) {
 774                 return False;
 775         }
 776
 777         return True;
 778 }
 779
 780 static BOOL test_DeleteTrustedDomain(struct dcerpc_pipe *p,
 781                                      TALLOC_CTX *mem_ctx,
 782                                      struct policy_handle *handle,
 783                                      struct lsa_StringLarge name)
 784 {
 785         NTSTATUS status;
 786         struct lsa_OpenTrustedDomainByName r;
 787         struct policy_handle trustdom_handle;
 788
 789         r.in.handle = handle;
 790         r.in.name.string = name.string;
 791         r.in.access_mask = SEC_STD_DELETE;
 792         r.out.trustdom_handle = &trustdom_handle;
 793
 794         status = dcerpc_lsa_OpenTrustedDomainByName(p, mem_ctx, &r);
 795         if (!NT_STATUS_IS_OK(status)) {
 796                 printf("lsa_OpenTrustedDomainByName failed - %s\n", nt_errstr(status));
 797                 return False;
 798         }
 799
 800         if (!test_Delete(p, mem_ctx, &trustdom_handle)) {
 801                 return False;
 802         }
 803
 804         return True;
 805 }
 806
 807
 808 static BOOL test_CreateSecret(struct dcerpc_pipe *p,
 809                               TALLOC_CTX *mem_ctx,
 810                               struct policy_handle *handle)
 811 {
 812         NTSTATUS status;
 813         struct lsa_CreateSecret r;
 814         struct lsa_OpenSecret r2;
 815         struct lsa_SetSecret r3;
 816         struct lsa_QuerySecret r4;
 817         struct lsa_SetSecret r5;
 818         struct lsa_QuerySecret r6;
 819         struct lsa_SetSecret r7;
 820         struct lsa_QuerySecret r8;
 821         struct policy_handle sec_handle, sec_handle2, sec_handle3;
 822         struct lsa_Delete d;
 823         struct lsa_DATA_BUF buf1;
 824         struct lsa_DATA_BUF_PTR bufp1;
 825         struct lsa_DATA_BUF_PTR bufp2;
 826         DATA_BLOB enc_key;
 827         BOOL ret = True;
 828         DATA_BLOB session_key;
 829         NTTIME old_mtime, new_mtime;
 830         DATA_BLOB blob1, blob2;
 831         const char *secret1 = "abcdef12345699qwerty";
 832         char *secret2;
 833         const char *secret3 = "ABCDEF12345699QWERTY";
 834         char *secret4;
 835         const char *secret5 = "NEW-SAMBA4-SECRET";
 836         char *secret6;
 837         char *secname[2];
 838         int i;
 839         const int LOCAL = 0;
 840         const int GLOBAL = 1;
 841
 842         secname[LOCAL] = talloc_asprintf(mem_ctx, "torturesecret-%u", (uint_t)random());
 843         secname[GLOBAL] = talloc_asprintf(mem_ctx, "G$torturesecret-%u", (uint_t)random());
 844
 845         for (i=0; i< 2; i++) {
 846                 printf("Testing CreateSecret of %s\n", secname[i]);
 847
 848                 init_lsa_String(&r.in.name, secname[i]);
 849
 850                 r.in.handle = handle;
 851                 r.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
 852                 r.out.sec_handle = &sec_handle;
 853
 854                 status = dcerpc_lsa_CreateSecret(p, mem_ctx, &r);
 855                 if (!NT_STATUS_IS_OK(status)) {
 856                         printf("CreateSecret failed - %s\n", nt_errstr(status));
 857                         return False;
 858                 }
 859
 860                 r.in.handle = handle;
 861                 r.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
 862                 r.out.sec_handle = &sec_handle3;
 863
 864                 status = dcerpc_lsa_CreateSecret(p, mem_ctx, &r);
 865                 if (!NT_STATUS_EQUAL(status, NT_STATUS_OBJECT_NAME_COLLISION)) {
 866                         printf("CreateSecret should have failed OBJECT_NAME_COLLISION - %s\n", nt_errstr(status));
 867                         return False;
 868                 }
 869
 870                 r2.in.handle = handle;
 871                 r2.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
 872                 r2.in.name = r.in.name;
 873                 r2.out.sec_handle = &sec_handle2;
 874
 875                 printf("Testing OpenSecret\n");
 876
 877                 status = dcerpc_lsa_OpenSecret(p, mem_ctx, &r2);
 878                 if (!NT_STATUS_IS_OK(status)) {
 879                         printf("OpenSecret failed - %s\n", nt_errstr(status));
 880                         return False;
 881                 }
 882
 883                 status = dcerpc_fetch_session_key(p, &session_key);
 884                 if (!NT_STATUS_IS_OK(status)) {
 885                         printf("dcerpc_fetch_session_key failed - %s\n", nt_errstr(status));
 886                         return False;
 887                 }
 888
 889                 enc_key = sess_encrypt_string(secret1, &session_key);
 890
 891                 r3.in.sec_handle = &sec_handle;
 892                 r3.in.new_val = &buf1;
 893                 r3.in.old_val = NULL;
 894                 r3.in.new_val->data = enc_key.data;
 895                 r3.in.new_val->length = enc_key.length;
 896                 r3.in.new_val->size = enc_key.length;
 897
 898                 printf("Testing SetSecret\n");
 899
 900                 status = dcerpc_lsa_SetSecret(p, mem_ctx, &r3);
 901                 if (!NT_STATUS_IS_OK(status)) {
 902                         printf("SetSecret failed - %s\n", nt_errstr(status));
 903                         return False;
 904                 }
 905
 906                 r3.in.sec_handle = &sec_handle;
 907                 r3.in.new_val = &buf1;
 908                 r3.in.old_val = NULL;
 909                 r3.in.new_val->data = enc_key.data;
 910                 r3.in.new_val->length = enc_key.length;
 911                 r3.in.new_val->size = enc_key.length;
 912
 913                 /* break the encrypted data */
 914                 enc_key.data[0]++;
 915
 916                 printf("Testing SetSecret with broken key\n");
 917
 918                 status = dcerpc_lsa_SetSecret(p, mem_ctx, &r3);
 919                 if (!NT_STATUS_EQUAL(status, NT_STATUS_UNKNOWN_REVISION)) {
 920                         printf("SetSecret should have failed UNKNOWN_REVISION - %s\n", nt_errstr(status));
 921                         ret = False;
 922                 }
 923
 924                 data_blob_free(&enc_key);
 925
 926                 ZERO_STRUCT(new_mtime);
 927                 ZERO_STRUCT(old_mtime);
 928
 929                 /* fetch the secret back again */
 930                 r4.in.sec_handle = &sec_handle;
 931                 r4.in.new_val = &bufp1;
 932                 r4.in.new_mtime = &new_mtime;
 933                 r4.in.old_val = NULL;
 934                 r4.in.old_mtime = NULL;
 935
 936                 bufp1.buf = NULL;
 937
 938                 printf("Testing QuerySecret\n");
 939                 status = dcerpc_lsa_QuerySecret(p, mem_ctx, &r4);
 940                 if (!NT_STATUS_IS_OK(status)) {
 941                         printf("QuerySecret failed - %s\n", nt_errstr(status));
 942                         ret = False;
 943                 } else {
 944                         if (r4.out.new_val == NULL || r4.out.new_val->buf == NULL) {
 945                                 printf("No secret buffer returned\n");
 946                                 ret = False;
 947                         } else {
 948                                 blob1.data = r4.out.new_val->buf->data;
 949                                 blob1.length = r4.out.new_val->buf->size;
 950
 951                                 blob2 = data_blob_talloc(mem_ctx, NULL, blob1.length);
 952
 953                                 secret2 = sess_decrypt_string(&blob1, &session_key);
 954
 955                                 if (strcmp(secret1, secret2) != 0) {
 956                                         printf("Returned secret '%s' doesn't match '%s'\n",
 957                                                secret2, secret1);
 958                                         ret = False;
 959                                 }
 960                         }
 961                 }
 962
 963                 enc_key = sess_encrypt_string(secret3, &session_key);
 964
 965                 r5.in.sec_handle = &sec_handle;
 966                 r5.in.new_val = &buf1;
 967                 r5.in.old_val = NULL;
 968                 r5.in.new_val->data = enc_key.data;
 969                 r5.in.new_val->length = enc_key.length;
 970                 r5.in.new_val->size = enc_key.length;
 971
 972                 printf("Testing SetSecret (existing value should move to old)\n");
 973
 974                 status = dcerpc_lsa_SetSecret(p, mem_ctx, &r5);
 975                 if (!NT_STATUS_IS_OK(status)) {
 976                         printf("SetSecret failed - %s\n", nt_errstr(status));
 977                         ret = False;
 978                 }
 979
 980                 data_blob_free(&enc_key);
 981
 982                 ZERO_STRUCT(new_mtime);
 983                 ZERO_STRUCT(old_mtime);
 984
 985                 /* fetch the secret back again */
 986                 r6.in.sec_handle = &sec_handle;
 987                 r6.in.new_val = &bufp1;
 988                 r6.in.new_mtime = &new_mtime;
 989                 r6.in.old_val = &bufp2;
 990                 r6.in.old_mtime = &old_mtime;
 991
 992                 bufp1.buf = NULL;
 993                 bufp2.buf = NULL;
 994
 995                 status = dcerpc_lsa_QuerySecret(p, mem_ctx, &r6);
 996                 if (!NT_STATUS_IS_OK(status)) {
 997                         printf("QuerySecret failed - %s\n", nt_errstr(status));
 998                         ret = False;
 999                         secret4 = NULL;
1000                 } else {
1001
1002                         if (r6.out.new_val->buf == NULL || r6.out.old_val->buf == NULL
1003                                 || r6.out.new_mtime == NULL || r6.out.old_mtime == NULL) {
1004                                 printf("Both secret buffers and both times not returned\n");
1005                                 ret = False;
1006                                 secret4 = NULL;
1007                         } else {
1008                                 blob1.data = r6.out.new_val->buf->data;
1009                                 blob1.length = r6.out.new_val->buf->size;
1010
1011                                 blob2 = data_blob_talloc(mem_ctx, NULL, blob1.length);
1012
1013                                 secret4 = sess_decrypt_string(&blob1, &session_key);
1014
1015                                 if (strcmp(secret3, secret4) != 0) {
1016                                         printf("Returned NEW secret %s doesn't match %s\n", secret4, secret3);
1017                                         ret = False;
1018                                 }
1019
1020                                 blob1.data = r6.out.old_val->buf->data;
1021                                 blob1.length = r6.out.old_val->buf->length;
1022
1023                                 blob2 = data_blob_talloc(mem_ctx, NULL, blob1.length);
1024
1025                                 secret2 = sess_decrypt_string(&blob1, &session_key);
1026
1027                                 if (strcmp(secret1, secret2) != 0) {
1028                                         printf("Returned OLD secret %s doesn't match %s\n", secret2, secret1);
1029                                         ret = False;
1030                                 }
1031
1032                                 if (*r6.out.new_mtime == *r6.out.old_mtime) {
1033                                         printf("Returned secret %s had same mtime for both secrets: %s\n",
1034                                                secname[i],
1035                                                nt_time_string(mem_ctx, *r6.out.new_mtime));
1036                                         ret = False;
1037                                 }
1038                         }
1039                 }
1040
1041                 enc_key = sess_encrypt_string(secret5, &session_key);
1042
1043                 r7.in.sec_handle = &sec_handle;
1044                 r7.in.old_val = &buf1;
1045                 r7.in.old_val->data = enc_key.data;
1046                 r7.in.old_val->length = enc_key.length;
1047                 r7.in.old_val->size = enc_key.length;
1048                 r7.in.new_val = NULL;
1049
1050                 printf("Testing SetSecret of old Secret only\n");
1051
1052                 status = dcerpc_lsa_SetSecret(p, mem_ctx, &r7);
1053                 if (!NT_STATUS_IS_OK(status)) {
1054                         printf("SetSecret failed - %s\n", nt_errstr(status));
1055                         ret = False;
1056                 }
1057
1058                 data_blob_free(&enc_key);
1059
1060                 /* fetch the secret back again */
1061                 r8.in.sec_handle = &sec_handle;
1062                 r8.in.new_val = &bufp1;
1063                 r8.in.new_mtime = &new_mtime;
1064                 r8.in.old_val = &bufp2;
1065                 r8.in.old_mtime = &old_mtime;
1066
1067                 bufp1.buf = NULL;
1068                 bufp2.buf = NULL;
1069
1070                 status = dcerpc_lsa_QuerySecret(p, mem_ctx, &r8);
1071                 if (!NT_STATUS_IS_OK(status)) {
1072                         printf("QuerySecret failed - %s\n", nt_errstr(status));
1073                         ret = False;
1074                 } else {
1075                         if (!r8.out.new_val || !r8.out.old_val) {
1076                                 printf("in/out pointers not returned, despite being set on in for QuerySecret\n");
1077                                 ret = False;
1078                         } else if (r8.out.new_val->buf == NULL) {
1079                                 if (i != LOCAL) {
1080                                         printf("NEW secret buffer not returned after GLOBAL OLD set\n");
1081                                         ret = False;
1082                                 }
1083                         } else if (r8.out.old_val->buf == NULL) {
1084                                 printf("OLD secret buffer not returned after OLD set\n");
1085                                 ret = False;
1086                         } else if (r8.out.new_mtime == NULL || r8.out.old_mtime == NULL) {
1087                                 printf("Both times not returned after OLD set\n");
1088                                 ret = False;
1089                         } else {
1090                                 if (i == LOCAL) {
1091                                         printf("NEW secret buffer should not be returned after LOCAL OLD set\n");
1092                                         ret = False;
1093                                 }
1094                                 blob1.data = r8.out.new_val->buf->data;
1095                                 blob1.length = r8.out.new_val->buf->length;
1096
1097                                 blob2 = data_blob_talloc(mem_ctx, NULL, blob1.length);
1098
1099                                 secret6 = sess_decrypt_string(&blob1, &session_key);
1100
1101                                 if (strcmp(secret3, secret4) != 0) {
1102                                         printf("Returned NEW secret '%s' doesn't match '%s'\n", secret4, secret3);
1103                                         ret = False;
1104                                 }
1105
1106                                 blob1.data = r8.out.old_val->buf->data;
1107                                 blob1.length = r8.out.old_val->buf->size;
1108
1109                                 blob2 = data_blob_talloc(mem_ctx, NULL, blob1.length);
1110
1111                                 secret6 = sess_decrypt_string(&blob1, &session_key);
1112
1113                                 if (strcmp(secret5, secret6) != 0) {
1114                                         printf("Returned OLD secret %s doesn't match %s\n", secret5, secret6);
1115                                         ret = False;
1116                                 }
1117
1118                                 if (*r8.out.new_mtime == *r8.out.old_mtime) {
1119                                         if (i != GLOBAL) {
1120                                                 printf("Returned secret %s had same mtime for both secrets: %s\n",
1121                                                        secname[i],
1122                                                        nt_time_string(mem_ctx, *r8.out.new_mtime));
1123                                                 ret = False;
1124                                         }
1125                                 } else {
1126                                         printf("Returned secret %s should have had same mtime for both secrets: %s != %s\n",
1127                                                secname[i],
1128                                                nt_time_string(mem_ctx, *r8.out.old_mtime),
1129                                                nt_time_string(mem_ctx, *r8.out.new_mtime));
1130                                         ret = False;
1131                                 }
1132                         }
1133                 }
1134
1135                 if (!test_Delete(p, mem_ctx, &sec_handle)) {
1136                         ret = False;
1137                 }
1138
1139                 d.in.handle = &sec_handle2;
1140                 status = dcerpc_lsa_Delete(p, mem_ctx, &d);
1141                 if (!NT_STATUS_EQUAL(status, NT_STATUS_INVALID_HANDLE)) {
1142                         printf("Second delete expected INVALID_HANDLE - %s\n", nt_errstr(status));
1143                         ret = False;
1144                 } else {
1145
1146                         printf("Testing OpenSecret of just-deleted secret\n");
1147
1148                         status = dcerpc_lsa_OpenSecret(p, mem_ctx, &r2);
1149                         if (!NT_STATUS_EQUAL(status, NT_STATUS_OBJECT_NAME_NOT_FOUND)) {
1150                                 printf("OpenSecret expected OBJECT_NAME_NOT_FOUND - %s\n", nt_errstr(status));
1151                                 ret = False;
1152                         }
1153                 }
1154
1155         }
1156
1157         return ret;
1158 }
1159
1160
1161 static BOOL test_EnumAccountRights(struct dcerpc_pipe *p,
1162                                    TALLOC_CTX *mem_ctx,
1163                                    struct policy_handle *acct_handle,
1164                                    struct dom_sid *sid)
1165 {
1166         NTSTATUS status;
1167         struct lsa_EnumAccountRights r;
1168         struct lsa_RightSet rights;
1169
1170         printf("Testing EnumAccountRights\n");
1171
1172         r.in.handle = acct_handle;
1173         r.in.sid = sid;
1174         r.out.rights = &rights;
1175
1176         status = dcerpc_lsa_EnumAccountRights(p, mem_ctx, &r);
1177         if (!NT_STATUS_IS_OK(status)) {
1178                 printf("EnumAccountRights failed - %s\n", nt_errstr(status));
1179                 return False;
1180         }
1181
1182         return True;
1183 }
1184
1185
1186 static BOOL test_QuerySecurity(struct dcerpc_pipe *p,
1187                              TALLOC_CTX *mem_ctx,
1188                              struct policy_handle *handle,
1189                              struct policy_handle *acct_handle)
1190 {
1191         NTSTATUS status;
1192         struct lsa_QuerySecurity r;
1193
1194         printf("Testing QuerySecurity\n");
1195
1196         r.in.handle = acct_handle;
1197         r.in.sec_info = 7;
1198
1199         status = dcerpc_lsa_QuerySecurity(p, mem_ctx, &r);
1200         if (!NT_STATUS_IS_OK(status)) {
1201                 printf("QuerySecurity failed - %s\n", nt_errstr(status));
1202                 return False;
1203         }
1204
1205         return True;
1206 }
1207
1208 static BOOL test_OpenAccount(struct dcerpc_pipe *p,
1209                              TALLOC_CTX *mem_ctx,
1210                              struct policy_handle *handle,
1211                              struct dom_sid *sid)
1212 {
1213         NTSTATUS status;
1214         struct lsa_OpenAccount r;
1215         struct policy_handle acct_handle;
1216
1217         printf("Testing OpenAccount\n");
1218
1219         r.in.handle = handle;
1220         r.in.sid = sid;
1221         r.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
1222         r.out.acct_handle = &acct_handle;
1223
1224         status = dcerpc_lsa_OpenAccount(p, mem_ctx, &r);
1225         if (!NT_STATUS_IS_OK(status)) {
1226                 printf("OpenAccount failed - %s\n", nt_errstr(status));
1227                 return False;
1228         }
1229
1230         if (!test_EnumPrivsAccount(p, mem_ctx, handle, &acct_handle)) {
1231                 return False;
1232         }
1233
1234         if (!test_QuerySecurity(p, mem_ctx, handle, &acct_handle)) {
1235                 return False;
1236         }
1237
1238         return True;
1239 }
1240
1241 static BOOL test_EnumAccounts(struct dcerpc_pipe *p,
1242                           TALLOC_CTX *mem_ctx,
1243                           struct policy_handle *handle)
1244 {
1245         NTSTATUS status;
1246         struct lsa_EnumAccounts r;
1247         struct lsa_SidArray sids1, sids2;
1248         uint32_t resume_handle = 0;
1249         int i;
1250
1251         printf("\ntesting EnumAccounts\n");
1252
1253         r.in.handle = handle;
1254         r.in.resume_handle = &resume_handle;
1255         r.in.num_entries = 100;
1256         r.out.resume_handle = &resume_handle;
1257         r.out.sids = &sids1;
1258
1259         resume_handle = 0;
1260         while (True) {
1261                 status = dcerpc_lsa_EnumAccounts(p, mem_ctx, &r);
1262                 if (NT_STATUS_EQUAL(status, NT_STATUS_NO_MORE_ENTRIES)) {
1263                         break;
1264                 }
1265                 if (!NT_STATUS_IS_OK(status)) {
1266                         printf("EnumAccounts failed - %s\n", nt_errstr(status));
1267                         return False;
1268                 }
1269
1270                 if (!test_LookupSids(p, mem_ctx, handle, &sids1)) {
1271                         return False;
1272                 }
1273
1274                 if (!test_LookupSids2(p, mem_ctx, handle, &sids1)) {
1275                         return False;
1276                 }
1277
1278                 if (!test_LookupSids3(p, mem_ctx, &sids1)) {
1279                         return False;
1280                 }
1281
1282                 printf("testing all accounts\n");
1283                 for (i=0;i<sids1.num_sids;i++) {
1284                         test_OpenAccount(p, mem_ctx, handle, sids1.sids[i].sid);
1285                         test_EnumAccountRights(p, mem_ctx, handle, sids1.sids[i].sid);
1286                 }
1287                 printf("\n");
1288         }
1289
1290         if (sids1.num_sids < 3) {
1291                 return True;
1292         }
1293
1294         printf("trying EnumAccounts partial listing (asking for 1 at 2)\n");
1295         resume_handle = 2;
1296         r.in.num_entries = 1;
1297         r.out.sids = &sids2;
1298
1299         status = dcerpc_lsa_EnumAccounts(p, mem_ctx, &r);
1300         if (!NT_STATUS_IS_OK(status)) {
1301                 printf("EnumAccounts failed - %s\n", nt_errstr(status));
1302                 return False;
1303         }
1304
1305         if (sids2.num_sids != 1) {
1306                 printf("Returned wrong number of entries (%d)\n", sids2.num_sids);
1307                 return False;
1308         }
1309
1310         return True;
1311 }
1312
1313 static BOOL test_LookupPrivDisplayName(struct dcerpc_pipe *p,
1314                                 TALLOC_CTX *mem_ctx,
1315                                 struct policy_handle *handle,
1316                                 struct lsa_String *priv_name)
1317 {
1318         struct lsa_LookupPrivDisplayName r;
1319         NTSTATUS status;
1320         /* produce a reasonable range of language output without screwing up
1321            terminals */
1322         uint16_t language_id = (random() % 4) + 0x409;
1323
1324         printf("testing LookupPrivDisplayName(%s)\n", priv_name->string);
1325
1326         r.in.handle = handle;
1327         r.in.name = priv_name;
1328         r.in.language_id = &language_id;
1329         r.out.language_id = &language_id;
1330         r.in.unknown = 0;
1331
1332         status = dcerpc_lsa_LookupPrivDisplayName(p, mem_ctx, &r);
1333         if (!NT_STATUS_IS_OK(status)) {
1334                 printf("LookupPrivDisplayName failed - %s\n", nt_errstr(status));
1335                 return False;
1336         }
1337         printf("%s -> \"%s\"  (language 0x%x/0x%x)\n",
1338                priv_name->string, r.out.disp_name->string,
1339                *r.in.language_id, *r.out.language_id);
1340
1341         return True;
1342 }
1343
1344 static BOOL test_EnumAccountsWithUserRight(struct dcerpc_pipe *p,
1345                                 TALLOC_CTX *mem_ctx,
1346                                 struct policy_handle *handle,
1347                                 struct lsa_String *priv_name)
1348 {
1349         struct lsa_EnumAccountsWithUserRight r;
1350         struct lsa_SidArray sids;
1351         NTSTATUS status;
1352
1353         ZERO_STRUCT(sids);
1354
1355         printf("testing EnumAccountsWithUserRight(%s)\n", priv_name->string);
1356
1357         r.in.handle = handle;
1358         r.in.name = priv_name;
1359         r.out.sids = &sids;
1360
1361         status = dcerpc_lsa_EnumAccountsWithUserRight(p, mem_ctx, &r);
1362
1363         /* NT_STATUS_NO_MORE_ENTRIES means noone has this privilege */
1364         if (NT_STATUS_EQUAL(status, NT_STATUS_NO_MORE_ENTRIES)) {
1365                 return True;
1366         }
1367
1368         if (!NT_STATUS_IS_OK(status)) {
1369                 printf("EnumAccountsWithUserRight failed - %s\n", nt_errstr(status));
1370                 return False;
1371         }
1372
1373         return True;
1374 }
1375
1376
1377 static BOOL test_EnumPrivs(struct dcerpc_pipe *p,
1378                            TALLOC_CTX *mem_ctx,
1379                            struct policy_handle *handle)
1380 {
1381         NTSTATUS status;
1382         struct lsa_EnumPrivs r;
1383         struct lsa_PrivArray privs1;
1384         uint32_t resume_handle = 0;
1385         int i;
1386         BOOL ret = True;
1387
1388         printf("\ntesting EnumPrivs\n");
1389
1390         r.in.handle = handle;
1391         r.in.resume_handle = &resume_handle;
1392         r.in.max_count = 100;
1393         r.out.resume_handle = &resume_handle;
1394         r.out.privs = &privs1;
1395
1396         resume_handle = 0;
1397         status = dcerpc_lsa_EnumPrivs(p, mem_ctx, &r);
1398         if (!NT_STATUS_IS_OK(status)) {
1399                 printf("EnumPrivs failed - %s\n", nt_errstr(status));
1400                 return False;
1401         }
1402
1403         for (i = 0; i< privs1.count; i++) {
1404                 test_LookupPrivDisplayName(p, mem_ctx, handle, &privs1.privs[i].name);
1405                 test_LookupPrivValue(p, mem_ctx, handle, &privs1.privs[i].name);
1406                 if (!test_EnumAccountsWithUserRight(p, mem_ctx, handle, &privs1.privs[i].name)) {
1407                         ret = False;
1408                 }
1409         }
1410
1411         return ret;
1412 }
1413
1414 static BOOL test_query_each_TrustDom(struct dcerpc_pipe *p,
1415                                      TALLOC_CTX *mem_ctx,
1416                                      struct policy_handle *handle,
1417                                      struct lsa_DomainList *domains)
1418 {
1419         NTSTATUS status;
1420         int i,j;
1421         BOOL ret = True;
1422
1423         printf("\nTesting OpenTrustedDomain, OpenTrustedDomainByName and QueryInfoTrustedDomain\n");
1424         for (i=0; i< domains->count; i++) {
1425                 struct lsa_OpenTrustedDomain trust;
1426                 struct lsa_OpenTrustedDomainByName trust_by_name;
1427                 struct policy_handle trustdom_handle;
1428                 struct policy_handle handle2;
1429                 struct lsa_Close c;
1430                 int levels [] = {1, 3, 6, 8, 12};
1431
1432                 if (domains->domains[i].sid) {
1433                         trust.in.handle = handle;
1434                         trust.in.sid = domains->domains[i].sid;
1435                         trust.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
1436                         trust.out.trustdom_handle = &trustdom_handle;
1437
1438                         status = dcerpc_lsa_OpenTrustedDomain(p, mem_ctx, &trust);
1439
1440                         if (!NT_STATUS_IS_OK(status)) {
1441                                 printf("OpenTrustedDomain failed - %s\n", nt_errstr(status));
1442                                 return False;
1443                         }
1444
1445                         c.in.handle = &trustdom_handle;
1446                         c.out.handle = &handle2;
1447
1448                         for (j=0; j < ARRAY_SIZE(levels); j++) {
1449                                 struct lsa_QueryTrustedDomainInfo q;
1450                                 union lsa_TrustedDomainInfo info;
1451                                 q.in.trustdom_handle = &trustdom_handle;
1452                                 q.in.level = levels[j];
1453                                 q.out.info = &info;
1454                                 status = dcerpc_lsa_QueryTrustedDomainInfo(p, mem_ctx, &q);
1455                                 if (!NT_STATUS_IS_OK(status)) {
1456                                         printf("QueryTrustedDomainInfo level %d failed - %s\n",
1457                                                levels[j], nt_errstr(status));
1458                                         ret = False;
1459                                 }
1460                         }
1461
1462                         status = dcerpc_lsa_Close(p, mem_ctx, &c);
1463                         if (!NT_STATUS_IS_OK(status)) {
1464                                 printf("Close of trusted domain failed - %s\n", nt_errstr(status));
1465                                 return False;
1466                         }
1467                 }
1468
1469                 trust_by_name.in.handle = handle;
1470                 trust_by_name.in.name.string = domains->domains[i].name.string;
1471                 trust_by_name.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
1472                 trust_by_name.out.trustdom_handle = &trustdom_handle;
1473
1474                 status = dcerpc_lsa_OpenTrustedDomainByName(p, mem_ctx, &trust_by_name);
1475
1476                 if (!NT_STATUS_IS_OK(status)) {
1477                         printf("OpenTrustedDomainByName failed - %s\n", nt_errstr(status));
1478                         return False;
1479                 }
1480
1481                 for (j=0; j < ARRAY_SIZE(levels); j++) {
1482                         struct lsa_QueryTrustedDomainInfo q;
1483                         union lsa_TrustedDomainInfo info;
1484                         q.in.trustdom_handle = &trustdom_handle;
1485                         q.in.level = levels[j];
1486                         q.out.info = &info;
1487                         status = dcerpc_lsa_QueryTrustedDomainInfo(p, mem_ctx, &q);
1488                         if (!NT_STATUS_IS_OK(status)) {
1489                                 printf("QueryTrustedDomainInfo level %d failed - %s\n",
1490                                        levels[j], nt_errstr(status));
1491                                 ret = False;
1492                         }
1493                 }
1494
1495                 c.in.handle = &trustdom_handle;
1496                 c.out.handle = &handle2;
1497
1498                 status = dcerpc_lsa_Close(p, mem_ctx, &c);
1499                 if (!NT_STATUS_IS_OK(status)) {
1500                         printf("Close of trusted domain failed - %s\n", nt_errstr(status));
1501                         return False;
1502                 }
1503
1504                 for (j=0; j < ARRAY_SIZE(levels); j++) {
1505                         struct lsa_QueryTrustedDomainInfoBySid q;
1506                         union lsa_TrustedDomainInfo info;
1507
1508                         if (!domains->domains[i].sid) {
1509                                 continue;
1510                         }
1511
1512                         q.in.handle  = handle;
1513                         q.in.dom_sid = domains->domains[i].sid;
1514                         q.in.level   = levels[j];
1515                         q.out.info   = &info;
1516                         status = dcerpc_lsa_QueryTrustedDomainInfoBySid(p, mem_ctx, &q);
1517                         if (!NT_STATUS_IS_OK(status)) {
1518                                 printf("QueryTrustedDomainInfoBySid level %d failed - %s\n",
1519                                        levels[j], nt_errstr(status));
1520                                 ret = False;
1521                         }
1522                 }
1523
1524                 for (j=0; j < ARRAY_SIZE(levels); j++) {
1525                         struct lsa_QueryTrustedDomainInfoByName q;
1526                         union lsa_TrustedDomainInfo info;
1527                         q.in.handle         = handle;
1528                         q.in.trusted_domain.string = domains->domains[i].name.string;
1529                         q.in.level          = levels[j];
1530                         q.out.info          = &info;
1531                         status = dcerpc_lsa_QueryTrustedDomainInfoByName(p, mem_ctx, &q);
1532                         if (!NT_STATUS_IS_OK(status)) {
1533                                 printf("QueryTrustedDomainInfoByName level %d failed - %s\n",
1534                                        levels[j], nt_errstr(status));
1535                                 ret = False;
1536                         }
1537                 }
1538         }
1539         return ret;
1540 }
1541
1542 static BOOL test_EnumTrustDom(struct dcerpc_pipe *p,
1543                               TALLOC_CTX *mem_ctx,
1544                               struct policy_handle *handle)
1545 {
1546         struct lsa_EnumTrustDom r;
1547         NTSTATUS enum_status;
1548         uint32_t resume_handle = 0;
1549         struct lsa_DomainList domains;
1550         BOOL ret = True;
1551
1552         printf("\nTesting EnumTrustDom\n");
1553
1554         do {
1555                 r.in.handle = handle;
1556                 r.in.resume_handle = &resume_handle;
1557                 r.in.max_size = LSA_ENUM_TRUST_DOMAIN_MULTIPLIER * 3;
1558                 r.out.domains = &domains;
1559                 r.out.resume_handle = &resume_handle;
1560
1561                 enum_status = dcerpc_lsa_EnumTrustDom(p, mem_ctx, &r);
1562
1563                 /* NO_MORE_ENTRIES is allowed */
1564                 if (NT_STATUS_EQUAL(enum_status, NT_STATUS_NO_MORE_ENTRIES)) {
1565                         return True;
1566                 } else if (NT_STATUS_EQUAL(enum_status, STATUS_MORE_ENTRIES)) {
1567                         /* Windows 2003 gets this off by one on the first run */
1568                         if (r.out.domains->count < 3 || r.out.domains->count > 4) {
1569                                 printf("EnumTrustDom didn't fill the buffer we "
1570                                        "asked it to (got %d, expected %d / %d == %d entries)\n",
1571                                        r.out.domains->count, LSA_ENUM_TRUST_DOMAIN_MULTIPLIER * 3,
1572                                        LSA_ENUM_TRUST_DOMAIN_MULTIPLIER, r.in.max_size);
1573                                 ret = False;
1574                         }
1575                 } else if (!NT_STATUS_IS_OK(enum_status)) {
1576                         printf("EnumTrustDom failed - %s\n", nt_errstr(enum_status));
1577                         return False;
1578                 }
1579
1580                 ret &= test_query_each_TrustDom(p, mem_ctx, handle, &domains);
1581
1582         } while ((NT_STATUS_EQUAL(enum_status, STATUS_MORE_ENTRIES)));
1583
1584         return ret;
1585 }
1586
1587 static BOOL test_CreateTrustedDomain(struct dcerpc_pipe *p,
1588                                      TALLOC_CTX *mem_ctx,
1589                                      struct policy_handle *handle)
1590 {
1591         NTSTATUS status;
1592         BOOL ret = True;
1593         struct lsa_CreateTrustedDomain r;
1594         struct lsa_TrustInformation trustinfo;
1595         struct dom_sid *domsid[12];
1596         struct policy_handle trustdom_handle[12];
1597         struct lsa_QueryTrustedDomainInfo q;
1598         int i;
1599
1600         printf("Testing CreateTrustedDomain for 12 domains\n");
1601
1602         for (i=0; i< 12; i++) {
1603                 char *trust_name = talloc_asprintf(mem_ctx, "torturedom%02d", i);
1604                 char *trust_sid = talloc_asprintf(mem_ctx, "S-1-5-21-97398-379795-100%02d", i);
1605
1606                 domsid[i] = dom_sid_parse_talloc(mem_ctx, trust_sid);
1607
1608                 trustinfo.sid = domsid[i];
1609                 init_lsa_String(&trustinfo.name, trust_name);
1610
1611                 r.in.handle = handle;
1612                 r.in.info = &trustinfo;
1613                 r.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
1614                 r.out.trustdom_handle = &trustdom_handle[i];
1615
1616                 status = dcerpc_lsa_CreateTrustedDomain(p, mem_ctx, &r);
1617                 if (NT_STATUS_EQUAL(status, NT_STATUS_OBJECT_NAME_COLLISION)) {
1618                         test_DeleteTrustedDomain(p, mem_ctx, handle, trustinfo.name);
1619                         status = dcerpc_lsa_CreateTrustedDomain(p, mem_ctx, &r);
1620                 }
1621                 if (!NT_STATUS_IS_OK(status)) {
1622                         printf("CreateTrustedDomain failed - %s\n", nt_errstr(status));
1623                         ret = False;
1624                 } else {
1625
1626                         q.in.trustdom_handle = &trustdom_handle[i];
1627                         q.in.level = LSA_TRUSTED_DOMAIN_INFO_NAME;
1628                         status = dcerpc_lsa_QueryTrustedDomainInfo(p, mem_ctx, &q);
1629                         if (!NT_STATUS_IS_OK(status)) {
1630                                 printf("QueryTrustedDomainInfo level 1 failed - %s\n", nt_errstr(status));
1631                                 ret = False;
1632                         } else if (!q.out.info) {
1633                                 ret = False;
1634                         } else {
1635                                 if (strcmp(q.out.info->name.netbios_name.string, trustinfo.name.string) != 0) {
1636                                         printf("QueryTrustedDomainInfo returned inconsistant short name: %s != %s\n",
1637                                                q.out.info->name.netbios_name.string, trustinfo.name.string);
1638                                         ret = False;
1639                                 }
1640                         }
1641                 }
1642         }
1643
1644         /* now that we have some domains to look over, we can test the enum calls */
1645         if (!test_EnumTrustDom(p, mem_ctx, handle)) {
1646                 ret = False;
1647         }
1648
1649         for (i=0; i<12; i++) {
1650                 if (!test_Delete(p, mem_ctx, &trustdom_handle[i])) {
1651                         ret = False;
1652                 }
1653         }
1654
1655         return ret;
1656 }
1657
1658 static BOOL test_QueryDomainInfoPolicy(struct dcerpc_pipe *p,
1659                                  TALLOC_CTX *mem_ctx,
1660                                  struct policy_handle *handle)
1661 {
1662         struct lsa_QueryDomainInformationPolicy r;
1663         NTSTATUS status;
1664         int i;
1665         BOOL ret = True;
1666         printf("\nTesting QueryDomainInformationPolicy\n");
1667
1668         for (i=2;i<4;i++) {
1669                 r.in.handle = handle;
1670                 r.in.level = i;
1671
1672                 printf("\ntrying QueryDomainInformationPolicy level %d\n", i);
1673
1674                 status = dcerpc_lsa_QueryDomainInformationPolicy(p, mem_ctx, &r);
1675
1676                 if (!NT_STATUS_IS_OK(status)) {
1677                         printf("QueryDomainInformationPolicy failed - %s\n", nt_errstr(status));
1678                         ret = False;
1679                         continue;
1680                 }
1681         }
1682
1683         return ret;
1684 }
1685
1686
1687 static BOOL test_QueryInfoPolicy(struct dcerpc_pipe *p,
1688                                  TALLOC_CTX *mem_ctx,
1689                                  struct policy_handle *handle)
1690 {
1691         struct lsa_QueryInfoPolicy r;
1692         NTSTATUS status;
1693         int i;
1694         BOOL ret = True;
1695         printf("\nTesting QueryInfoPolicy\n");
1696
1697         for (i=1;i<13;i++) {
1698                 r.in.handle = handle;
1699                 r.in.level = i;
1700
1701                 printf("\ntrying QueryInfoPolicy level %d\n", i);
1702
1703                 status = dcerpc_lsa_QueryInfoPolicy(p, mem_ctx, &r);
1704
1705                 if ((i == 9 || i == 10 || i == 11) &&
1706                     NT_STATUS_EQUAL(status, NT_STATUS_INVALID_PARAMETER)) {
1707                         printf("server failed level %u (OK)\n", i);
1708                         continue;
1709                 }
1710
1711                 if (!NT_STATUS_IS_OK(status)) {
1712                         printf("QueryInfoPolicy failed - %s\n", nt_errstr(status));
1713                         ret = False;
1714                         continue;
1715                 }
1716         }
1717
1718         return ret;
1719 }
1720
1721 static BOOL test_QueryInfoPolicy2(struct dcerpc_pipe *p,
1722                                   TALLOC_CTX *mem_ctx,
1723                                   struct policy_handle *handle)
1724 {
1725         struct lsa_QueryInfoPolicy2 r;
1726         NTSTATUS status;
1727         int i;
1728         BOOL ret = True;
1729         printf("\nTesting QueryInfoPolicy2\n");
1730
1731         for (i=1;i<13;i++) {
1732                 r.in.handle = handle;
1733                 r.in.level = i;
1734
1735                 printf("\ntrying QueryInfoPolicy2 level %d\n", i);
1736
1737                 status = dcerpc_lsa_QueryInfoPolicy2(p, mem_ctx, &r);
1738
1739                 if ((i == 9 || i == 10 || i == 11) &&
1740                     NT_STATUS_EQUAL(status, NT_STATUS_INVALID_PARAMETER)) {
1741                         printf("server failed level %u (OK)\n", i);
1742                         continue;
1743                 }
1744
1745                 if (!NT_STATUS_IS_OK(status)) {
1746                         printf("QueryInfoPolicy2 failed - %s\n", nt_errstr(status));
1747                         ret = False;
1748                         continue;
1749                 }
1750         }
1751
1752         return ret;
1753 }
1754
1755 static BOOL test_GetUserName(struct dcerpc_pipe *p,
1756                                   TALLOC_CTX *mem_ctx,
1757                                   struct policy_handle *handle)
1758 {
1759         struct lsa_GetUserName r;
1760         NTSTATUS status;
1761         BOOL ret = True;
1762         struct lsa_StringPointer authority_name_p;
1763
1764         printf("\nTesting GetUserName\n");
1765
1766         r.in.system_name = "\\";
1767         r.in.account_name = NULL;
1768         r.in.authority_name = &authority_name_p;
1769         authority_name_p.string = NULL;
1770
1771         status = dcerpc_lsa_GetUserName(p, mem_ctx, &r);
1772
1773         if (!NT_STATUS_IS_OK(status)) {
1774                 printf("GetUserName failed - %s\n", nt_errstr(status));
1775                 ret = False;
1776         }
1777
1778         return ret;
1779 }
1780
1781 BOOL test_lsa_Close(struct dcerpc_pipe *p,
1782                     TALLOC_CTX *mem_ctx,
1783                     struct policy_handle *handle)
1784 {
1785         NTSTATUS status;
1786         struct lsa_Close r;
1787         struct policy_handle handle2;
1788
1789         printf("\ntesting Close\n");
1790
1791         r.in.handle = handle;
1792         r.out.handle = &handle2;
1793
1794         status = dcerpc_lsa_Close(p, mem_ctx, &r);
1795         if (!NT_STATUS_IS_OK(status)) {
1796                 printf("Close failed - %s\n", nt_errstr(status));
1797                 return False;
1798         }
1799
1800         status = dcerpc_lsa_Close(p, mem_ctx, &r);
1801         /* its really a fault - we need a status code for rpc fault */
1802         if (!NT_STATUS_EQUAL(status, NT_STATUS_NET_WRITE_FAULT)) {
1803                 printf("Close failed - %s\n", nt_errstr(status));
1804                 return False;
1805         }
1806
1807         printf("\n");
1808
1809         return True;
1810 }
1811
1812 BOOL torture_rpc_lsa(void)
1813 {
1814         NTSTATUS status;
1815         struct dcerpc_pipe *p;
1816         TALLOC_CTX *mem_ctx;
1817         BOOL ret = True;
1818         struct policy_handle *handle;
1819
1820         mem_ctx = talloc_init("torture_rpc_lsa");
1821
1822         status = torture_rpc_connection(mem_ctx, &p, &dcerpc_table_lsarpc);
1823         if (!NT_STATUS_IS_OK(status)) {
1824                 talloc_free(mem_ctx);
1825                 return False;
1826         }
1827
1828         if (!test_OpenPolicy(p, mem_ctx)) {
1829                 ret = False;
1830         }
1831
1832         if (!test_lsa_OpenPolicy2(p, mem_ctx, &handle)) {
1833                 ret = False;
1834         }
1835
1836         if (handle) {
1837                 if (!test_LookupSids_async(p, mem_ctx, handle)) {
1838                         ret = False;
1839                 }
1840
1841                 if (!test_QueryDomainInfoPolicy(p, mem_ctx, handle)) {
1842                         ret = False;
1843                 }
1844
1845                 if (!test_CreateAccount(p, mem_ctx, handle)) {
1846                         ret = False;
1847                 }
1848
1849                 if (!test_CreateSecret(p, mem_ctx, handle)) {
1850                         ret = False;
1851                 }
1852
1853                 if (!test_CreateTrustedDomain(p, mem_ctx, handle)) {
1854                         ret = False;
1855                 }
1856
1857                 if (!test_EnumAccounts(p, mem_ctx, handle)) {
1858                         ret = False;
1859                 }
1860
1861                 if (!test_EnumPrivs(p, mem_ctx, handle)) {
1862                         ret = False;
1863                 }
1864
1865                 if (!test_QueryInfoPolicy(p, mem_ctx, handle)) {
1866                         ret = False;
1867                 }
1868
1869                 if (!test_QueryInfoPolicy2(p, mem_ctx, handle)) {
1870                         ret = False;
1871                 }
1872
1873                 if (!test_GetUserName(p, mem_ctx, handle)) {
1874                         ret = False;
1875                 }
1876
1877 #if 0
1878                 if (!test_Delete(p, mem_ctx, handle)) {
1879                         ret = False;
1880                 }
1881 #endif
1882
1883                 if (!test_many_LookupSids(p, mem_ctx, handle)) {
1884                         ret = False;
1885                 }
1886
1887                 if (!test_lsa_Close(p, mem_ctx, handle)) {
1888                         ret = False;
1889                 }
1890         } else {
1891                 if (!test_many_LookupSids(p, mem_ctx, handle)) {
1892                         ret = False;
1893                 }
1894         }
1895
1896         talloc_free(mem_ctx);
1897
1898         return ret;
1899 }