source4/torture/rpc/lsa.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3    test suite for lsa rpc operations
   4
   5    Copyright (C) Andrew Tridgell 2003
   6    Copyright (C) Andrew Bartlett <abartlet@samba.org> 2004-2005
   7
   8    This program is free software; you can redistribute it and/or modify
   9    it under the terms of the GNU General Public License as published by
  10    the Free Software Foundation; either version 2 of the License, or
  11    (at your option) any later version.
  12
  13    This program is distributed in the hope that it will be useful,
  14    but WITHOUT ANY WARRANTY; without even the implied warranty of
  15    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  16    GNU General Public License for more details.
  17
  18    You should have received a copy of the GNU General Public License
  19    along with this program; if not, write to the Free Software
  20    Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  21 */
  22
  23 #include "includes.h"
  24 #include "torture/torture.h"
  25 #include "librpc/gen_ndr/ndr_lsa_c.h"
  26 #include "lib/events/events.h"
  27 #include "libcli/security/security.h"
  28 #include "libcli/auth/libcli_auth.h"
  29 #include "torture/rpc/rpc.h"
  30
  31 static void init_lsa_String(struct lsa_String *name, const char *s)
  32 {
  33         name->string = s;
  34 }
  35
  36 static BOOL test_OpenPolicy(struct dcerpc_pipe *p, TALLOC_CTX *mem_ctx)
  37 {
  38         struct lsa_ObjectAttribute attr;
  39         struct policy_handle handle;
  40         struct lsa_QosInfo qos;
  41         struct lsa_OpenPolicy r;
  42         NTSTATUS status;
  43         uint16_t system_name = '\\';
  44
  45         printf("\ntesting OpenPolicy\n");
  46
  47         qos.len = 0;
  48         qos.impersonation_level = 2;
  49         qos.context_mode = 1;
  50         qos.effective_only = 0;
  51
  52         attr.len = 0;
  53         attr.root_dir = NULL;
  54         attr.object_name = NULL;
  55         attr.attributes = 0;
  56         attr.sec_desc = NULL;
  57         attr.sec_qos = &qos;
  58
  59         r.in.system_name = &system_name;
  60         r.in.attr = &attr;
  61         r.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
  62         r.out.handle = &handle;
  63
  64         status = dcerpc_lsa_OpenPolicy(p, mem_ctx, &r);
  65         if (!NT_STATUS_IS_OK(status)) {
  66                 if (NT_STATUS_EQUAL(status, NT_STATUS_ACCESS_DENIED) ||
  67                     NT_STATUS_EQUAL(status, NT_STATUS_RPC_PROTSEQ_NOT_SUPPORTED)) {
  68                         printf("not considering %s to be an error\n", nt_errstr(status));
  69                         return True;
  70                 }
  71                 printf("OpenPolicy failed - %s\n", nt_errstr(status));
  72                 return False;
  73         }
  74
  75         return True;
  76 }
  77
  78
  79 BOOL test_lsa_OpenPolicy2(struct dcerpc_pipe *p, TALLOC_CTX *mem_ctx,
  80                           struct policy_handle **handle)
  81 {
  82         struct lsa_ObjectAttribute attr;
  83         struct lsa_QosInfo qos;
  84         struct lsa_OpenPolicy2 r;
  85         NTSTATUS status;
  86
  87         printf("\ntesting OpenPolicy2\n");
  88
  89         *handle = talloc(mem_ctx, struct policy_handle);
  90         if (!*handle) {
  91                 return False;
  92         }
  93
  94         qos.len = 0;
  95         qos.impersonation_level = 2;
  96         qos.context_mode = 1;
  97         qos.effective_only = 0;
  98
  99         attr.len = 0;
 100         attr.root_dir = NULL;
 101         attr.object_name = NULL;
 102         attr.attributes = 0;
 103         attr.sec_desc = NULL;
 104         attr.sec_qos = &qos;
 105
 106         r.in.system_name = "\\";
 107         r.in.attr = &attr;
 108         r.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
 109         r.out.handle = *handle;
 110
 111         status = dcerpc_lsa_OpenPolicy2(p, mem_ctx, &r);
 112         if (!NT_STATUS_IS_OK(status)) {
 113                 if (NT_STATUS_EQUAL(status, NT_STATUS_ACCESS_DENIED) ||
 114                     NT_STATUS_EQUAL(status, NT_STATUS_RPC_PROTSEQ_NOT_SUPPORTED)) {
 115                         printf("not considering %s to be an error\n", nt_errstr(status));
 116                         talloc_free(*handle);
 117                         *handle = NULL;
 118                         return True;
 119                 }
 120                 printf("OpenPolicy2 failed - %s\n", nt_errstr(status));
 121                 return False;
 122         }
 123
 124         return True;
 125 }
 126
 127 static BOOL test_LookupNames(struct dcerpc_pipe *p,
 128                             TALLOC_CTX *mem_ctx,
 129                             struct policy_handle *handle,
 130                             struct lsa_TransNameArray *tnames)
 131 {
 132         struct lsa_LookupNames r;
 133         struct lsa_TransSidArray sids;
 134         struct lsa_String *names;
 135         uint32_t count = 0;
 136         NTSTATUS status;
 137         int i;
 138
 139         printf("\nTesting LookupNames with %d names\n", tnames->count);
 140
 141         sids.count = 0;
 142         sids.sids = NULL;
 143
 144         names = talloc_array(mem_ctx, struct lsa_String, tnames->count);
 145         for (i=0;i<tnames->count;i++) {
 146                 init_lsa_String(&names[i], tnames->names[i].name.string);
 147         }
 148
 149         r.in.handle = handle;
 150         r.in.num_names = tnames->count;
 151         r.in.names = names;
 152         r.in.sids = &sids;
 153         r.in.level = 1;
 154         r.in.count = &count;
 155         r.out.count = &count;
 156         r.out.sids = &sids;
 157
 158         status = dcerpc_lsa_LookupNames(p, mem_ctx, &r);
 159         if (!NT_STATUS_IS_OK(status) && !NT_STATUS_EQUAL(status, STATUS_SOME_UNMAPPED)) {
 160                 printf("LookupNames failed - %s\n", nt_errstr(status));
 161                 return False;
 162         }
 163
 164         printf("\n");
 165
 166         return True;
 167 }
 168
 169 static BOOL test_LookupNames2(struct dcerpc_pipe *p,
 170                               TALLOC_CTX *mem_ctx,
 171                               struct policy_handle *handle,
 172                               struct lsa_TransNameArray2 *tnames)
 173 {
 174         struct lsa_LookupNames2 r;
 175         struct lsa_TransSidArray2 sids;
 176         struct lsa_String *names;
 177         uint32_t count = 0;
 178         NTSTATUS status;
 179         int i;
 180
 181         printf("\nTesting LookupNames2 with %d names\n", tnames->count);
 182
 183         sids.count = 0;
 184         sids.sids = NULL;
 185
 186         names = talloc_array(mem_ctx, struct lsa_String, tnames->count);
 187         for (i=0;i<tnames->count;i++) {
 188                 init_lsa_String(&names[i], tnames->names[i].name.string);
 189         }
 190
 191         r.in.handle = handle;
 192         r.in.num_names = tnames->count;
 193         r.in.names = names;
 194         r.in.sids = &sids;
 195         r.in.level = 1;
 196         r.in.count = &count;
 197         r.in.unknown1 = 0;
 198         r.in.unknown2 = 0;
 199         r.out.count = &count;
 200         r.out.sids = &sids;
 201
 202         status = dcerpc_lsa_LookupNames2(p, mem_ctx, &r);
 203         if (!NT_STATUS_IS_OK(status) && !NT_STATUS_EQUAL(status, STATUS_SOME_UNMAPPED)) {
 204                 printf("LookupNames2 failed - %s\n", nt_errstr(status));
 205                 return False;
 206         }
 207
 208         printf("\n");
 209
 210         return True;
 211 }
 212
 213
 214 static BOOL test_LookupNames3(struct dcerpc_pipe *p,
 215                               TALLOC_CTX *mem_ctx,
 216                               struct policy_handle *handle,
 217                               struct lsa_TransNameArray2 *tnames)
 218 {
 219         struct lsa_LookupNames3 r;
 220         struct lsa_TransSidArray3 sids;
 221         struct lsa_String *names;
 222         uint32_t count = 0;
 223         NTSTATUS status;
 224         int i;
 225
 226         printf("\nTesting LookupNames3 with %d names\n", tnames->count);
 227
 228         sids.count = 0;
 229         sids.sids = NULL;
 230
 231         names = talloc_array(mem_ctx, struct lsa_String, tnames->count);
 232         for (i=0;i<tnames->count;i++) {
 233                 init_lsa_String(&names[i], tnames->names[i].name.string);
 234         }
 235
 236         r.in.handle = handle;
 237         r.in.num_names = tnames->count;
 238         r.in.names = names;
 239         r.in.sids = &sids;
 240         r.in.level = 1;
 241         r.in.count = &count;
 242         r.in.unknown1 = 0;
 243         r.in.unknown2 = 0;
 244         r.out.count = &count;
 245         r.out.sids = &sids;
 246
 247         status = dcerpc_lsa_LookupNames3(p, mem_ctx, &r);
 248         if (!NT_STATUS_IS_OK(status) && !NT_STATUS_EQUAL(status, STATUS_SOME_UNMAPPED)) {
 249                 printf("LookupNames3 failed - %s\n", nt_errstr(status));
 250                 return False;
 251         }
 252
 253         printf("\n");
 254
 255         return True;
 256 }
 257
 258 static BOOL test_LookupNames4(struct dcerpc_pipe *p,
 259                               TALLOC_CTX *mem_ctx,
 260                               struct lsa_TransNameArray2 *tnames)
 261 {
 262         struct lsa_LookupNames4 r;
 263         struct lsa_TransSidArray3 sids;
 264         struct lsa_String *names;
 265         uint32_t count = 0;
 266         NTSTATUS status;
 267         int i;
 268
 269         printf("\nTesting LookupNames4 with %d names\n", tnames->count);
 270
 271         sids.count = 0;
 272         sids.sids = NULL;
 273
 274         names = talloc_array(mem_ctx, struct lsa_String, tnames->count);
 275         for (i=0;i<tnames->count;i++) {
 276                 init_lsa_String(&names[i], tnames->names[i].name.string);
 277         }
 278
 279         r.in.num_names = tnames->count;
 280         r.in.names = names;
 281         r.in.sids = &sids;
 282         r.in.level = 1;
 283         r.in.count = &count;
 284         r.in.unknown1 = 0;
 285         r.in.unknown2 = 0;
 286         r.out.count = &count;
 287         r.out.sids = &sids;
 288
 289         status = dcerpc_lsa_LookupNames4(p, mem_ctx, &r);
 290         if (!NT_STATUS_IS_OK(status) && !NT_STATUS_EQUAL(status, STATUS_SOME_UNMAPPED)) {
 291                 printf("LookupNames4 failed - %s\n", nt_errstr(status));
 292                 return False;
 293         }
 294
 295         printf("\n");
 296
 297         return True;
 298 }
 299
 300
 301 static BOOL test_LookupSids(struct dcerpc_pipe *p,
 302                             TALLOC_CTX *mem_ctx,
 303                             struct policy_handle *handle,
 304                             struct lsa_SidArray *sids)
 305 {
 306         struct lsa_LookupSids r;
 307         struct lsa_TransNameArray names;
 308         uint32_t count = sids->num_sids;
 309         NTSTATUS status;
 310
 311         printf("\nTesting LookupSids\n");
 312
 313         names.count = 0;
 314         names.names = NULL;
 315
 316         r.in.handle = handle;
 317         r.in.sids = sids;
 318         r.in.names = &names;
 319         r.in.level = 1;
 320         r.in.count = &count;
 321         r.out.count = &count;
 322         r.out.names = &names;
 323
 324         status = dcerpc_lsa_LookupSids(p, mem_ctx, &r);
 325         if (!NT_STATUS_IS_OK(status) && !NT_STATUS_EQUAL(status, STATUS_SOME_UNMAPPED)) {
 326                 printf("LookupSids failed - %s\n", nt_errstr(status));
 327                 return False;
 328         }
 329
 330         printf("\n");
 331
 332         if (!test_LookupNames(p, mem_ctx, handle, &names)) {
 333                 return False;
 334         }
 335
 336         return True;
 337 }
 338
 339
 340 static BOOL test_LookupSids2(struct dcerpc_pipe *p,
 341                             TALLOC_CTX *mem_ctx,
 342                             struct policy_handle *handle,
 343                             struct lsa_SidArray *sids)
 344 {
 345         struct lsa_LookupSids2 r;
 346         struct lsa_TransNameArray2 names;
 347         uint32_t count = sids->num_sids;
 348         NTSTATUS status;
 349
 350         printf("\nTesting LookupSids2\n");
 351
 352         names.count = 0;
 353         names.names = NULL;
 354
 355         r.in.handle = handle;
 356         r.in.sids = sids;
 357         r.in.names = &names;
 358         r.in.level = 1;
 359         r.in.count = &count;
 360         r.in.unknown1 = 0;
 361         r.in.unknown2 = 0;
 362         r.out.count = &count;
 363         r.out.names = &names;
 364
 365         status = dcerpc_lsa_LookupSids2(p, mem_ctx, &r);
 366         if (!NT_STATUS_IS_OK(status) && !NT_STATUS_EQUAL(status, STATUS_SOME_UNMAPPED)) {
 367                 printf("LookupSids2 failed - %s\n", nt_errstr(status));
 368                 return False;
 369         }
 370
 371         printf("\n");
 372
 373         if (!test_LookupNames2(p, mem_ctx, handle, &names)) {
 374                 return False;
 375         }
 376
 377         if (!test_LookupNames3(p, mem_ctx, handle, &names)) {
 378                 return False;
 379         }
 380
 381         return True;
 382 }
 383
 384 static BOOL test_LookupSids3(struct dcerpc_pipe *p,
 385                             TALLOC_CTX *mem_ctx,
 386                             struct lsa_SidArray *sids)
 387 {
 388         struct lsa_LookupSids3 r;
 389         struct lsa_TransNameArray2 names;
 390         uint32_t count = sids->num_sids;
 391         NTSTATUS status;
 392
 393         printf("\nTesting LookupSids3\n");
 394
 395         names.count = 0;
 396         names.names = NULL;
 397
 398         r.in.sids = sids;
 399         r.in.names = &names;
 400         r.in.level = 1;
 401         r.in.count = &count;
 402         r.in.unknown1 = 0;
 403         r.in.unknown2 = 0;
 404         r.out.count = &count;
 405         r.out.names = &names;
 406
 407         status = dcerpc_lsa_LookupSids3(p, mem_ctx, &r);
 408         if (!NT_STATUS_IS_OK(status) && !NT_STATUS_EQUAL(status, STATUS_SOME_UNMAPPED)) {
 409                 if (NT_STATUS_EQUAL(status, NT_STATUS_ACCESS_DENIED) ||
 410                     NT_STATUS_EQUAL(status, NT_STATUS_RPC_PROTSEQ_NOT_SUPPORTED)) {
 411                         printf("not considering %s to be an error\n", nt_errstr(status));
 412                         return True;
 413                 }
 414                 printf("LookupSids3 failed - %s - not considered an error\n",
 415                        nt_errstr(status));
 416                 return False;
 417         }
 418
 419         printf("\n");
 420
 421         if (!test_LookupNames4(p, mem_ctx, &names)) {
 422                 return False;
 423         }
 424
 425         return True;
 426 }
 427
 428 BOOL test_many_LookupSids(struct dcerpc_pipe *p,
 429                           TALLOC_CTX *mem_ctx,
 430                           struct policy_handle *handle)
 431 {
 432         uint32_t count;
 433         NTSTATUS status;
 434         struct lsa_SidArray sids;
 435         int i;
 436
 437         printf("\nTesting LookupSids with lots of SIDs\n");
 438
 439         sids.num_sids = 100;
 440
 441         sids.sids = talloc_array(mem_ctx, struct lsa_SidPtr, sids.num_sids);
 442
 443         for (i=0; i<sids.num_sids; i++) {
 444                 const char *sidstr = "S-1-5-32-545";
 445                 sids.sids[i].sid = dom_sid_parse_talloc(mem_ctx, sidstr);
 446         }
 447
 448         count = sids.num_sids;
 449
 450         if (handle) {
 451                 struct lsa_LookupSids r;
 452                 struct lsa_TransNameArray names;
 453                 names.count = 0;
 454                 names.names = NULL;
 455
 456                 r.in.handle = handle;
 457                 r.in.sids = &sids;
 458                 r.in.names = &names;
 459                 r.in.level = 1;
 460                 r.in.count = &names.count;
 461                 r.out.count = &count;
 462                 r.out.names = &names;
 463
 464                 status = dcerpc_lsa_LookupSids(p, mem_ctx, &r);
 465                 if (!NT_STATUS_IS_OK(status) &&
 466                     !NT_STATUS_EQUAL(status, STATUS_SOME_UNMAPPED)) {
 467                         printf("LookupSids failed - %s\n", nt_errstr(status));
 468                         return False;
 469                 }
 470
 471                 printf("\n");
 472
 473                 if (!test_LookupNames(p, mem_ctx, handle, &names)) {
 474                         return False;
 475                 }
 476         } else {
 477                 struct lsa_LookupSids3 r;
 478                 struct lsa_TransNameArray2 names;
 479
 480                 names.count = 0;
 481                 names.names = NULL;
 482
 483                 printf("\nTesting LookupSids3\n");
 484
 485                 r.in.sids = &sids;
 486                 r.in.names = &names;
 487                 r.in.level = 1;
 488                 r.in.count = &count;
 489                 r.in.unknown1 = 0;
 490                 r.in.unknown2 = 0;
 491                 r.out.count = &count;
 492                 r.out.names = &names;
 493
 494                 status = dcerpc_lsa_LookupSids3(p, mem_ctx, &r);
 495                 if (!NT_STATUS_IS_OK(status) && !NT_STATUS_EQUAL(status, STATUS_SOME_UNMAPPED)) {
 496                         if (NT_STATUS_EQUAL(status, NT_STATUS_ACCESS_DENIED) ||
 497                             NT_STATUS_EQUAL(status, NT_STATUS_RPC_PROTSEQ_NOT_SUPPORTED)) {
 498                                 printf("not considering %s to be an error\n", nt_errstr(status));
 499                                 return True;
 500                         }
 501                         printf("LookupSids3 failed - %s\n",
 502                                nt_errstr(status));
 503                         return False;
 504                 }
 505                 if (!test_LookupNames4(p, mem_ctx, &names)) {
 506                         return False;
 507                 }
 508         }
 509
 510         printf("\n");
 511
 512
 513
 514         return True;
 515 }
 516
 517 #define NUM_ASYNC_REQUESTS 1000
 518
 519 static void lookupsids_cb(struct rpc_request *req)
 520 {
 521         int *replies = (int *)req->async.private;
 522         NTSTATUS status;
 523
 524         status = dcerpc_ndr_request_recv(req);
 525         DEBUG(3, ("lookupsids returned %s\n", nt_errstr(status)));
 526         if (!NT_STATUS_IS_OK(status)) {
 527                 *replies = -1;
 528         }
 529
 530         *replies += 1;
 531 }
 532
 533 static BOOL test_LookupSids_async(struct dcerpc_pipe *p,
 534                                   TALLOC_CTX *mem_ctx,
 535                                   struct policy_handle *handle)
 536 {
 537         struct lsa_SidArray sids;
 538         struct lsa_SidPtr sidptr;
 539
 540         uint32_t count[NUM_ASYNC_REQUESTS];
 541         struct lsa_TransNameArray names[NUM_ASYNC_REQUESTS];
 542         struct lsa_LookupSids r[NUM_ASYNC_REQUESTS];
 543         struct rpc_request **req;
 544
 545         int i, replies;
 546         BOOL ret = True;
 547
 548         printf("\nTesting %d async lookupsids request\n", 100);
 549
 550         req = talloc_array(mem_ctx, struct rpc_request *, NUM_ASYNC_REQUESTS);
 551
 552         sids.num_sids = 1;
 553         sids.sids = &sidptr;
 554         sidptr.sid = dom_sid_parse_talloc(mem_ctx, "S-1-5-32-545");
 555
 556         replies = 0;
 557
 558         for (i=0; i<NUM_ASYNC_REQUESTS; i++) {
 559                 count[i] = 0;
 560                 names[i].count = 0;
 561                 names[i].names = NULL;
 562
 563                 r[i].in.handle = handle;
 564                 r[i].in.sids = &sids;
 565                 r[i].in.names = &names[i];
 566                 r[i].in.level = 1;
 567                 r[i].in.count = &names[i].count;
 568                 r[i].out.count = &count[i];
 569                 r[i].out.names = &names[i];
 570
 571                 req[i] = dcerpc_lsa_LookupSids_send(p, req, &r[i]);
 572                 if (req[i] == NULL) {
 573                         ret = False;
 574                         break;
 575                 }
 576
 577                 req[i]->async.callback = lookupsids_cb;
 578                 req[i]->async.private = &replies;
 579         }
 580
 581         while (replies < NUM_ASYNC_REQUESTS) {
 582                 event_loop_once(p->conn->event_ctx);
 583                 if (replies < 0) {
 584                         ret = False;
 585                         break;
 586                 }
 587         }
 588
 589         talloc_free(req);
 590
 591         return ret;
 592 }
 593
 594 static BOOL test_LookupPrivValue(struct dcerpc_pipe *p,
 595                                  TALLOC_CTX *mem_ctx,
 596                                  struct policy_handle *handle,
 597                                  struct lsa_String *name)
 598 {
 599         NTSTATUS status;
 600         struct lsa_LookupPrivValue r;
 601         struct lsa_LUID luid;
 602
 603         r.in.handle = handle;
 604         r.in.name = name;
 605         r.out.luid = &luid;
 606
 607         status = dcerpc_lsa_LookupPrivValue(p, mem_ctx, &r);
 608         if (!NT_STATUS_IS_OK(status)) {
 609                 printf("\nLookupPrivValue failed - %s\n", nt_errstr(status));
 610                 return False;
 611         }
 612
 613         return True;
 614 }
 615
 616 static BOOL test_LookupPrivName(struct dcerpc_pipe *p,
 617                                 TALLOC_CTX *mem_ctx,
 618                                 struct policy_handle *handle,
 619                                 struct lsa_LUID *luid)
 620 {
 621         NTSTATUS status;
 622         struct lsa_LookupPrivName r;
 623
 624         r.in.handle = handle;
 625         r.in.luid = luid;
 626
 627         status = dcerpc_lsa_LookupPrivName(p, mem_ctx, &r);
 628         if (!NT_STATUS_IS_OK(status)) {
 629                 printf("\nLookupPrivName failed - %s\n", nt_errstr(status));
 630                 return False;
 631         }
 632
 633         return True;
 634 }
 635
 636 static BOOL test_RemovePrivilegesFromAccount(struct dcerpc_pipe *p,
 637                                              TALLOC_CTX *mem_ctx,
 638                                              struct policy_handle *acct_handle,
 639                                              struct lsa_LUID *luid)
 640 {
 641         NTSTATUS status;
 642         struct lsa_RemovePrivilegesFromAccount r;
 643         struct lsa_PrivilegeSet privs;
 644         BOOL ret = True;
 645
 646         printf("Testing RemovePrivilegesFromAccount\n");
 647
 648         r.in.handle = acct_handle;
 649         r.in.remove_all = 0;
 650         r.in.privs = &privs;
 651
 652         privs.count = 1;
 653         privs.unknown = 0;
 654         privs.set = talloc_array(mem_ctx, struct lsa_LUIDAttribute, 1);
 655         privs.set[0].luid = *luid;
 656         privs.set[0].attribute = 0;
 657
 658         status = dcerpc_lsa_RemovePrivilegesFromAccount(p, mem_ctx, &r);
 659         if (!NT_STATUS_IS_OK(status)) {
 660                 printf("RemovePrivilegesFromAccount failed - %s\n", nt_errstr(status));
 661                 return False;
 662         }
 663
 664         return ret;
 665 }
 666
 667 static BOOL test_AddPrivilegesToAccount(struct dcerpc_pipe *p,
 668                                         TALLOC_CTX *mem_ctx,
 669                                         struct policy_handle *acct_handle,
 670                                         struct lsa_LUID *luid)
 671 {
 672         NTSTATUS status;
 673         struct lsa_AddPrivilegesToAccount r;
 674         struct lsa_PrivilegeSet privs;
 675         BOOL ret = True;
 676
 677         printf("Testing AddPrivilegesToAccount\n");
 678
 679         r.in.handle = acct_handle;
 680         r.in.privs = &privs;
 681
 682         privs.count = 1;
 683         privs.unknown = 0;
 684         privs.set = talloc_array(mem_ctx, struct lsa_LUIDAttribute, 1);
 685         privs.set[0].luid = *luid;
 686         privs.set[0].attribute = 0;
 687
 688         status = dcerpc_lsa_AddPrivilegesToAccount(p, mem_ctx, &r);
 689         if (!NT_STATUS_IS_OK(status)) {
 690                 printf("AddPrivilegesToAccount failed - %s\n", nt_errstr(status));
 691                 return False;
 692         }
 693
 694         return ret;
 695 }
 696
 697 static BOOL test_EnumPrivsAccount(struct dcerpc_pipe *p,
 698                                   TALLOC_CTX *mem_ctx,
 699                                   struct policy_handle *handle,
 700                                   struct policy_handle *acct_handle)
 701 {
 702         NTSTATUS status;
 703         struct lsa_EnumPrivsAccount r;
 704         BOOL ret = True;
 705
 706         printf("Testing EnumPrivsAccount\n");
 707
 708         r.in.handle = acct_handle;
 709
 710         status = dcerpc_lsa_EnumPrivsAccount(p, mem_ctx, &r);
 711         if (!NT_STATUS_IS_OK(status)) {
 712                 printf("EnumPrivsAccount failed - %s\n", nt_errstr(status));
 713                 return False;
 714         }
 715
 716         if (r.out.privs && r.out.privs->count > 0) {
 717                 int i;
 718                 for (i=0;i<r.out.privs->count;i++) {
 719                         test_LookupPrivName(p, mem_ctx, handle,
 720                                             &r.out.privs->set[i].luid);
 721                 }
 722
 723                 ret &= test_RemovePrivilegesFromAccount(p, mem_ctx, acct_handle,
 724                                                         &r.out.privs->set[0].luid);
 725                 ret &= test_AddPrivilegesToAccount(p, mem_ctx, acct_handle,
 726                                                    &r.out.privs->set[0].luid);
 727         }
 728
 729         return ret;
 730 }
 731
 732 static BOOL test_Delete(struct dcerpc_pipe *p,
 733                        TALLOC_CTX *mem_ctx,
 734                        struct policy_handle *handle)
 735 {
 736         NTSTATUS status;
 737         struct lsa_Delete r;
 738
 739         printf("testing Delete\n");
 740
 741         r.in.handle = handle;
 742         status = dcerpc_lsa_Delete(p, mem_ctx, &r);
 743         if (!NT_STATUS_IS_OK(status)) {
 744                 printf("Delete failed - %s\n", nt_errstr(status));
 745                 return False;
 746         }
 747
 748         return True;
 749 }
 750
 751
 752 static BOOL test_CreateAccount(struct dcerpc_pipe *p,
 753                                TALLOC_CTX *mem_ctx,
 754                                struct policy_handle *handle)
 755 {
 756         NTSTATUS status;
 757         struct lsa_CreateAccount r;
 758         struct dom_sid2 *newsid;
 759         struct policy_handle acct_handle;
 760
 761         newsid = dom_sid_parse_talloc(mem_ctx, "S-1-5-12349876-4321-2854");
 762
 763         printf("Testing CreateAccount\n");
 764
 765         r.in.handle = handle;
 766         r.in.sid = newsid;
 767         r.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
 768         r.out.acct_handle = &acct_handle;
 769
 770         status = dcerpc_lsa_CreateAccount(p, mem_ctx, &r);
 771         if (!NT_STATUS_IS_OK(status)) {
 772                 printf("CreateAccount failed - %s\n", nt_errstr(status));
 773                 return False;
 774         }
 775
 776         if (!test_Delete(p, mem_ctx, &acct_handle)) {
 777                 return False;
 778         }
 779
 780         return True;
 781 }
 782
 783 static BOOL test_DeleteTrustedDomain(struct dcerpc_pipe *p,
 784                                      TALLOC_CTX *mem_ctx,
 785                                      struct policy_handle *handle,
 786                                      struct lsa_StringLarge name)
 787 {
 788         NTSTATUS status;
 789         struct lsa_OpenTrustedDomainByName r;
 790         struct policy_handle trustdom_handle;
 791
 792         r.in.handle = handle;
 793         r.in.name.string = name.string;
 794         r.in.access_mask = SEC_STD_DELETE;
 795         r.out.trustdom_handle = &trustdom_handle;
 796
 797         status = dcerpc_lsa_OpenTrustedDomainByName(p, mem_ctx, &r);
 798         if (!NT_STATUS_IS_OK(status)) {
 799                 printf("lsa_OpenTrustedDomainByName failed - %s\n", nt_errstr(status));
 800                 return False;
 801         }
 802
 803         if (!test_Delete(p, mem_ctx, &trustdom_handle)) {
 804                 return False;
 805         }
 806
 807         return True;
 808 }
 809
 810
 811 static BOOL test_CreateSecret(struct dcerpc_pipe *p,
 812                               TALLOC_CTX *mem_ctx,
 813                               struct policy_handle *handle)
 814 {
 815         NTSTATUS status;
 816         struct lsa_CreateSecret r;
 817         struct lsa_OpenSecret r2;
 818         struct lsa_SetSecret r3;
 819         struct lsa_QuerySecret r4;
 820         struct lsa_SetSecret r5;
 821         struct lsa_QuerySecret r6;
 822         struct lsa_SetSecret r7;
 823         struct lsa_QuerySecret r8;
 824         struct policy_handle sec_handle, sec_handle2, sec_handle3;
 825         struct lsa_Delete d;
 826         struct lsa_DATA_BUF buf1;
 827         struct lsa_DATA_BUF_PTR bufp1;
 828         struct lsa_DATA_BUF_PTR bufp2;
 829         DATA_BLOB enc_key;
 830         BOOL ret = True;
 831         DATA_BLOB session_key;
 832         NTTIME old_mtime, new_mtime;
 833         DATA_BLOB blob1, blob2;
 834         const char *secret1 = "abcdef12345699qwerty";
 835         char *secret2;
 836         const char *secret3 = "ABCDEF12345699QWERTY";
 837         char *secret4;
 838         const char *secret5 = "NEW-SAMBA4-SECRET";
 839         char *secret6;
 840         char *secname[2];
 841         int i;
 842         const int LOCAL = 0;
 843         const int GLOBAL = 1;
 844
 845         secname[LOCAL] = talloc_asprintf(mem_ctx, "torturesecret-%u", (uint_t)random());
 846         secname[GLOBAL] = talloc_asprintf(mem_ctx, "G$torturesecret-%u", (uint_t)random());
 847
 848         for (i=0; i< 2; i++) {
 849                 printf("Testing CreateSecret of %s\n", secname[i]);
 850
 851                 init_lsa_String(&r.in.name, secname[i]);
 852
 853                 r.in.handle = handle;
 854                 r.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
 855                 r.out.sec_handle = &sec_handle;
 856
 857                 status = dcerpc_lsa_CreateSecret(p, mem_ctx, &r);
 858                 if (!NT_STATUS_IS_OK(status)) {
 859                         printf("CreateSecret failed - %s\n", nt_errstr(status));
 860                         return False;
 861                 }
 862
 863                 r.in.handle = handle;
 864                 r.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
 865                 r.out.sec_handle = &sec_handle3;
 866
 867                 status = dcerpc_lsa_CreateSecret(p, mem_ctx, &r);
 868                 if (!NT_STATUS_EQUAL(status, NT_STATUS_OBJECT_NAME_COLLISION)) {
 869                         printf("CreateSecret should have failed OBJECT_NAME_COLLISION - %s\n", nt_errstr(status));
 870                         return False;
 871                 }
 872
 873                 r2.in.handle = handle;
 874                 r2.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
 875                 r2.in.name = r.in.name;
 876                 r2.out.sec_handle = &sec_handle2;
 877
 878                 printf("Testing OpenSecret\n");
 879
 880                 status = dcerpc_lsa_OpenSecret(p, mem_ctx, &r2);
 881                 if (!NT_STATUS_IS_OK(status)) {
 882                         printf("OpenSecret failed - %s\n", nt_errstr(status));
 883                         return False;
 884                 }
 885
 886                 status = dcerpc_fetch_session_key(p, &session_key);
 887                 if (!NT_STATUS_IS_OK(status)) {
 888                         printf("dcerpc_fetch_session_key failed - %s\n", nt_errstr(status));
 889                         return False;
 890                 }
 891
 892                 enc_key = sess_encrypt_string(secret1, &session_key);
 893
 894                 r3.in.sec_handle = &sec_handle;
 895                 r3.in.new_val = &buf1;
 896                 r3.in.old_val = NULL;
 897                 r3.in.new_val->data = enc_key.data;
 898                 r3.in.new_val->length = enc_key.length;
 899                 r3.in.new_val->size = enc_key.length;
 900
 901                 printf("Testing SetSecret\n");
 902
 903                 status = dcerpc_lsa_SetSecret(p, mem_ctx, &r3);
 904                 if (!NT_STATUS_IS_OK(status)) {
 905                         printf("SetSecret failed - %s\n", nt_errstr(status));
 906                         return False;
 907                 }
 908
 909                 r3.in.sec_handle = &sec_handle;
 910                 r3.in.new_val = &buf1;
 911                 r3.in.old_val = NULL;
 912                 r3.in.new_val->data = enc_key.data;
 913                 r3.in.new_val->length = enc_key.length;
 914                 r3.in.new_val->size = enc_key.length;
 915
 916                 /* break the encrypted data */
 917                 enc_key.data[0]++;
 918
 919                 printf("Testing SetSecret with broken key\n");
 920
 921                 status = dcerpc_lsa_SetSecret(p, mem_ctx, &r3);
 922                 if (!NT_STATUS_EQUAL(status, NT_STATUS_UNKNOWN_REVISION)) {
 923                         printf("SetSecret should have failed UNKNOWN_REVISION - %s\n", nt_errstr(status));
 924                         ret = False;
 925                 }
 926
 927                 data_blob_free(&enc_key);
 928
 929                 ZERO_STRUCT(new_mtime);
 930                 ZERO_STRUCT(old_mtime);
 931
 932                 /* fetch the secret back again */
 933                 r4.in.sec_handle = &sec_handle;
 934                 r4.in.new_val = &bufp1;
 935                 r4.in.new_mtime = &new_mtime;
 936                 r4.in.old_val = NULL;
 937                 r4.in.old_mtime = NULL;
 938
 939                 bufp1.buf = NULL;
 940
 941                 printf("Testing QuerySecret\n");
 942                 status = dcerpc_lsa_QuerySecret(p, mem_ctx, &r4);
 943                 if (!NT_STATUS_IS_OK(status)) {
 944                         printf("QuerySecret failed - %s\n", nt_errstr(status));
 945                         ret = False;
 946                 } else {
 947                         if (r4.out.new_val == NULL || r4.out.new_val->buf == NULL) {
 948                                 printf("No secret buffer returned\n");
 949                                 ret = False;
 950                         } else {
 951                                 blob1.data = r4.out.new_val->buf->data;
 952                                 blob1.length = r4.out.new_val->buf->size;
 953
 954                                 blob2 = data_blob_talloc(mem_ctx, NULL, blob1.length);
 955
 956                                 secret2 = sess_decrypt_string(&blob1, &session_key);
 957
 958                                 if (strcmp(secret1, secret2) != 0) {
 959                                         printf("Returned secret '%s' doesn't match '%s'\n",
 960                                                secret2, secret1);
 961                                         ret = False;
 962                                 }
 963                         }
 964                 }
 965
 966                 enc_key = sess_encrypt_string(secret3, &session_key);
 967
 968                 r5.in.sec_handle = &sec_handle;
 969                 r5.in.new_val = &buf1;
 970                 r5.in.old_val = NULL;
 971                 r5.in.new_val->data = enc_key.data;
 972                 r5.in.new_val->length = enc_key.length;
 973                 r5.in.new_val->size = enc_key.length;
 974
 975                 printf("Testing SetSecret (existing value should move to old)\n");
 976
 977                 status = dcerpc_lsa_SetSecret(p, mem_ctx, &r5);
 978                 if (!NT_STATUS_IS_OK(status)) {
 979                         printf("SetSecret failed - %s\n", nt_errstr(status));
 980                         ret = False;
 981                 }
 982
 983                 data_blob_free(&enc_key);
 984
 985                 ZERO_STRUCT(new_mtime);
 986                 ZERO_STRUCT(old_mtime);
 987
 988                 /* fetch the secret back again */
 989                 r6.in.sec_handle = &sec_handle;
 990                 r6.in.new_val = &bufp1;
 991                 r6.in.new_mtime = &new_mtime;
 992                 r6.in.old_val = &bufp2;
 993                 r6.in.old_mtime = &old_mtime;
 994
 995                 bufp1.buf = NULL;
 996                 bufp2.buf = NULL;
 997
 998                 status = dcerpc_lsa_QuerySecret(p, mem_ctx, &r6);
 999                 if (!NT_STATUS_IS_OK(status)) {
1000                         printf("QuerySecret failed - %s\n", nt_errstr(status));
1001                         ret = False;
1002                         secret4 = NULL;
1003                 } else {
1004
1005                         if (r6.out.new_val->buf == NULL || r6.out.old_val->buf == NULL
1006                                 || r6.out.new_mtime == NULL || r6.out.old_mtime == NULL) {
1007                                 printf("Both secret buffers and both times not returned\n");
1008                                 ret = False;
1009                                 secret4 = NULL;
1010                         } else {
1011                                 blob1.data = r6.out.new_val->buf->data;
1012                                 blob1.length = r6.out.new_val->buf->size;
1013
1014                                 blob2 = data_blob_talloc(mem_ctx, NULL, blob1.length);
1015
1016                                 secret4 = sess_decrypt_string(&blob1, &session_key);
1017
1018                                 if (strcmp(secret3, secret4) != 0) {
1019                                         printf("Returned NEW secret %s doesn't match %s\n", secret4, secret3);
1020                                         ret = False;
1021                                 }
1022
1023                                 blob1.data = r6.out.old_val->buf->data;
1024                                 blob1.length = r6.out.old_val->buf->length;
1025
1026                                 blob2 = data_blob_talloc(mem_ctx, NULL, blob1.length);
1027
1028                                 secret2 = sess_decrypt_string(&blob1, &session_key);
1029
1030                                 if (strcmp(secret1, secret2) != 0) {
1031                                         printf("Returned OLD secret %s doesn't match %s\n", secret2, secret1);
1032                                         ret = False;
1033                                 }
1034
1035                                 if (*r6.out.new_mtime == *r6.out.old_mtime) {
1036                                         printf("Returned secret %s had same mtime for both secrets: %s\n",
1037                                                secname[i],
1038                                                nt_time_string(mem_ctx, *r6.out.new_mtime));
1039                                         ret = False;
1040                                 }
1041                         }
1042                 }
1043
1044                 enc_key = sess_encrypt_string(secret5, &session_key);
1045
1046                 r7.in.sec_handle = &sec_handle;
1047                 r7.in.old_val = &buf1;
1048                 r7.in.old_val->data = enc_key.data;
1049                 r7.in.old_val->length = enc_key.length;
1050                 r7.in.old_val->size = enc_key.length;
1051                 r7.in.new_val = NULL;
1052
1053                 printf("Testing SetSecret of old Secret only\n");
1054
1055                 status = dcerpc_lsa_SetSecret(p, mem_ctx, &r7);
1056                 if (!NT_STATUS_IS_OK(status)) {
1057                         printf("SetSecret failed - %s\n", nt_errstr(status));
1058                         ret = False;
1059                 }
1060
1061                 data_blob_free(&enc_key);
1062
1063                 /* fetch the secret back again */
1064                 r8.in.sec_handle = &sec_handle;
1065                 r8.in.new_val = &bufp1;
1066                 r8.in.new_mtime = &new_mtime;
1067                 r8.in.old_val = &bufp2;
1068                 r8.in.old_mtime = &old_mtime;
1069
1070                 bufp1.buf = NULL;
1071                 bufp2.buf = NULL;
1072
1073                 status = dcerpc_lsa_QuerySecret(p, mem_ctx, &r8);
1074                 if (!NT_STATUS_IS_OK(status)) {
1075                         printf("QuerySecret failed - %s\n", nt_errstr(status));
1076                         ret = False;
1077                 } else {
1078                         if (!r8.out.new_val || !r8.out.old_val) {
1079                                 printf("in/out pointers not returned, despite being set on in for QuerySecret\n");
1080                                 ret = False;
1081                         } else if (r8.out.new_val->buf == NULL) {
1082                                 if (i != LOCAL) {
1083                                         printf("NEW secret buffer not returned after GLOBAL OLD set\n");
1084                                         ret = False;
1085                                 }
1086                         } else if (r8.out.old_val->buf == NULL) {
1087                                 printf("OLD secret buffer not returned after OLD set\n");
1088                                 ret = False;
1089                         } else if (r8.out.new_mtime == NULL || r8.out.old_mtime == NULL) {
1090                                 printf("Both times not returned after OLD set\n");
1091                                 ret = False;
1092                         } else {
1093                                 if (i == LOCAL) {
1094                                         printf("NEW secret buffer should not be returned after LOCAL OLD set\n");
1095                                         ret = False;
1096                                 }
1097                                 blob1.data = r8.out.new_val->buf->data;
1098                                 blob1.length = r8.out.new_val->buf->length;
1099
1100                                 blob2 = data_blob_talloc(mem_ctx, NULL, blob1.length);
1101
1102                                 secret6 = sess_decrypt_string(&blob1, &session_key);
1103
1104                                 if (strcmp(secret3, secret4) != 0) {
1105                                         printf("Returned NEW secret '%s' doesn't match '%s'\n", secret4, secret3);
1106                                         ret = False;
1107                                 }
1108
1109                                 blob1.data = r8.out.old_val->buf->data;
1110                                 blob1.length = r8.out.old_val->buf->size;
1111
1112                                 blob2 = data_blob_talloc(mem_ctx, NULL, blob1.length);
1113
1114                                 secret6 = sess_decrypt_string(&blob1, &session_key);
1115
1116                                 if (strcmp(secret5, secret6) != 0) {
1117                                         printf("Returned OLD secret %s doesn't match %s\n", secret5, secret6);
1118                                         ret = False;
1119                                 }
1120
1121                                 if (*r8.out.new_mtime == *r8.out.old_mtime) {
1122                                         if (i != GLOBAL) {
1123                                                 printf("Returned secret %s had same mtime for both secrets: %s\n",
1124                                                        secname[i],
1125                                                        nt_time_string(mem_ctx, *r8.out.new_mtime));
1126                                                 ret = False;
1127                                         }
1128                                 } else {
1129                                         printf("Returned secret %s should have had same mtime for both secrets: %s != %s\n",
1130                                                secname[i],
1131                                                nt_time_string(mem_ctx, *r8.out.old_mtime),
1132                                                nt_time_string(mem_ctx, *r8.out.new_mtime));
1133                                         ret = False;
1134                                 }
1135                         }
1136                 }
1137
1138                 if (!test_Delete(p, mem_ctx, &sec_handle)) {
1139                         ret = False;
1140                 }
1141
1142                 d.in.handle = &sec_handle2;
1143                 status = dcerpc_lsa_Delete(p, mem_ctx, &d);
1144                 if (!NT_STATUS_EQUAL(status, NT_STATUS_INVALID_HANDLE)) {
1145                         printf("Second delete expected INVALID_HANDLE - %s\n", nt_errstr(status));
1146                         ret = False;
1147                 } else {
1148
1149                         printf("Testing OpenSecret of just-deleted secret\n");
1150
1151                         status = dcerpc_lsa_OpenSecret(p, mem_ctx, &r2);
1152                         if (!NT_STATUS_EQUAL(status, NT_STATUS_OBJECT_NAME_NOT_FOUND)) {
1153                                 printf("OpenSecret expected OBJECT_NAME_NOT_FOUND - %s\n", nt_errstr(status));
1154                                 ret = False;
1155                         }
1156                 }
1157
1158         }
1159
1160         return ret;
1161 }
1162
1163
1164 static BOOL test_EnumAccountRights(struct dcerpc_pipe *p,
1165                                    TALLOC_CTX *mem_ctx,
1166                                    struct policy_handle *acct_handle,
1167                                    struct dom_sid *sid)
1168 {
1169         NTSTATUS status;
1170         struct lsa_EnumAccountRights r;
1171         struct lsa_RightSet rights;
1172
1173         printf("Testing EnumAccountRights\n");
1174
1175         r.in.handle = acct_handle;
1176         r.in.sid = sid;
1177         r.out.rights = &rights;
1178
1179         status = dcerpc_lsa_EnumAccountRights(p, mem_ctx, &r);
1180         if (!NT_STATUS_IS_OK(status)) {
1181                 printf("EnumAccountRights of %s failed - %s\n",
1182                        dom_sid_string(mem_ctx, sid), nt_errstr(status));
1183                 return False;
1184         }
1185
1186         return True;
1187 }
1188
1189
1190 static BOOL test_QuerySecurity(struct dcerpc_pipe *p,
1191                              TALLOC_CTX *mem_ctx,
1192                              struct policy_handle *handle,
1193                              struct policy_handle *acct_handle)
1194 {
1195         NTSTATUS status;
1196         struct lsa_QuerySecurity r;
1197
1198         if (lp_parm_bool(-1, "target", "samba4", False)) {
1199                 printf("skipping QuerySecurity test against Samba4\n");
1200                 return True;
1201         }
1202
1203         printf("Testing QuerySecurity\n");
1204
1205         r.in.handle = acct_handle;
1206         r.in.sec_info = 7;
1207
1208         status = dcerpc_lsa_QuerySecurity(p, mem_ctx, &r);
1209         if (!NT_STATUS_IS_OK(status)) {
1210                 printf("QuerySecurity failed - %s\n", nt_errstr(status));
1211                 return False;
1212         }
1213
1214         return True;
1215 }
1216
1217 static BOOL test_OpenAccount(struct dcerpc_pipe *p,
1218                              TALLOC_CTX *mem_ctx,
1219                              struct policy_handle *handle,
1220                              struct dom_sid *sid)
1221 {
1222         NTSTATUS status;
1223         struct lsa_OpenAccount r;
1224         struct policy_handle acct_handle;
1225
1226         printf("Testing OpenAccount\n");
1227
1228         r.in.handle = handle;
1229         r.in.sid = sid;
1230         r.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
1231         r.out.acct_handle = &acct_handle;
1232
1233         status = dcerpc_lsa_OpenAccount(p, mem_ctx, &r);
1234         if (!NT_STATUS_IS_OK(status)) {
1235                 printf("OpenAccount failed - %s\n", nt_errstr(status));
1236                 return False;
1237         }
1238
1239         if (!test_EnumPrivsAccount(p, mem_ctx, handle, &acct_handle)) {
1240                 return False;
1241         }
1242
1243         if (!test_QuerySecurity(p, mem_ctx, handle, &acct_handle)) {
1244                 return False;
1245         }
1246
1247         return True;
1248 }
1249
1250 static BOOL test_EnumAccounts(struct dcerpc_pipe *p,
1251                           TALLOC_CTX *mem_ctx,
1252                           struct policy_handle *handle)
1253 {
1254         NTSTATUS status;
1255         struct lsa_EnumAccounts r;
1256         struct lsa_SidArray sids1, sids2;
1257         uint32_t resume_handle = 0;
1258         int i;
1259         BOOL ret = True;
1260
1261         printf("\ntesting EnumAccounts\n");
1262
1263         r.in.handle = handle;
1264         r.in.resume_handle = &resume_handle;
1265         r.in.num_entries = 100;
1266         r.out.resume_handle = &resume_handle;
1267         r.out.sids = &sids1;
1268
1269         resume_handle = 0;
1270         while (True) {
1271                 status = dcerpc_lsa_EnumAccounts(p, mem_ctx, &r);
1272                 if (NT_STATUS_EQUAL(status, NT_STATUS_NO_MORE_ENTRIES)) {
1273                         break;
1274                 }
1275                 if (!NT_STATUS_IS_OK(status)) {
1276                         printf("EnumAccounts failed - %s\n", nt_errstr(status));
1277                         return False;
1278                 }
1279
1280                 if (!test_LookupSids(p, mem_ctx, handle, &sids1)) {
1281                         return False;
1282                 }
1283
1284                 if (!test_LookupSids2(p, mem_ctx, handle, &sids1)) {
1285                         return False;
1286                 }
1287
1288                 if (!test_LookupSids3(p, mem_ctx, &sids1)) {
1289                         return False;
1290                 }
1291
1292                 printf("testing all accounts\n");
1293                 for (i=0;i<sids1.num_sids;i++) {
1294                         ret &= test_OpenAccount(p, mem_ctx, handle, sids1.sids[i].sid);
1295                         ret &= test_EnumAccountRights(p, mem_ctx, handle, sids1.sids[i].sid);
1296                 }
1297                 printf("\n");
1298         }
1299
1300         if (sids1.num_sids < 3) {
1301                 return ret;
1302         }
1303
1304         printf("trying EnumAccounts partial listing (asking for 1 at 2)\n");
1305         resume_handle = 2;
1306         r.in.num_entries = 1;
1307         r.out.sids = &sids2;
1308
1309         status = dcerpc_lsa_EnumAccounts(p, mem_ctx, &r);
1310         if (!NT_STATUS_IS_OK(status)) {
1311                 printf("EnumAccounts failed - %s\n", nt_errstr(status));
1312                 return False;
1313         }
1314
1315         if (sids2.num_sids != 1) {
1316                 printf("Returned wrong number of entries (%d)\n", sids2.num_sids);
1317                 return False;
1318         }
1319
1320         return True;
1321 }
1322
1323 static BOOL test_LookupPrivDisplayName(struct dcerpc_pipe *p,
1324                                 TALLOC_CTX *mem_ctx,
1325                                 struct policy_handle *handle,
1326                                 struct lsa_String *priv_name)
1327 {
1328         struct lsa_LookupPrivDisplayName r;
1329         NTSTATUS status;
1330         /* produce a reasonable range of language output without screwing up
1331            terminals */
1332         uint16_t language_id = (random() % 4) + 0x409;
1333
1334         printf("testing LookupPrivDisplayName(%s)\n", priv_name->string);
1335
1336         r.in.handle = handle;
1337         r.in.name = priv_name;
1338         r.in.language_id = &language_id;
1339         r.out.language_id = &language_id;
1340         r.in.unknown = 0;
1341
1342         status = dcerpc_lsa_LookupPrivDisplayName(p, mem_ctx, &r);
1343         if (!NT_STATUS_IS_OK(status)) {
1344                 printf("LookupPrivDisplayName failed - %s\n", nt_errstr(status));
1345                 return False;
1346         }
1347         printf("%s -> \"%s\"  (language 0x%x/0x%x)\n",
1348                priv_name->string, r.out.disp_name->string,
1349                *r.in.language_id, *r.out.language_id);
1350
1351         return True;
1352 }
1353
1354 static BOOL test_EnumAccountsWithUserRight(struct dcerpc_pipe *p,
1355                                 TALLOC_CTX *mem_ctx,
1356                                 struct policy_handle *handle,
1357                                 struct lsa_String *priv_name)
1358 {
1359         struct lsa_EnumAccountsWithUserRight r;
1360         struct lsa_SidArray sids;
1361         NTSTATUS status;
1362
1363         ZERO_STRUCT(sids);
1364
1365         printf("testing EnumAccountsWithUserRight(%s)\n", priv_name->string);
1366
1367         r.in.handle = handle;
1368         r.in.name = priv_name;
1369         r.out.sids = &sids;
1370
1371         status = dcerpc_lsa_EnumAccountsWithUserRight(p, mem_ctx, &r);
1372
1373         /* NT_STATUS_NO_MORE_ENTRIES means noone has this privilege */
1374         if (NT_STATUS_EQUAL(status, NT_STATUS_NO_MORE_ENTRIES)) {
1375                 return True;
1376         }
1377
1378         if (!NT_STATUS_IS_OK(status)) {
1379                 printf("EnumAccountsWithUserRight failed - %s\n", nt_errstr(status));
1380                 return False;
1381         }
1382
1383         return True;
1384 }
1385
1386
1387 static BOOL test_EnumPrivs(struct dcerpc_pipe *p,
1388                            TALLOC_CTX *mem_ctx,
1389                            struct policy_handle *handle)
1390 {
1391         NTSTATUS status;
1392         struct lsa_EnumPrivs r;
1393         struct lsa_PrivArray privs1;
1394         uint32_t resume_handle = 0;
1395         int i;
1396         BOOL ret = True;
1397
1398         printf("\ntesting EnumPrivs\n");
1399
1400         r.in.handle = handle;
1401         r.in.resume_handle = &resume_handle;
1402         r.in.max_count = 100;
1403         r.out.resume_handle = &resume_handle;
1404         r.out.privs = &privs1;
1405
1406         resume_handle = 0;
1407         status = dcerpc_lsa_EnumPrivs(p, mem_ctx, &r);
1408         if (!NT_STATUS_IS_OK(status)) {
1409                 printf("EnumPrivs failed - %s\n", nt_errstr(status));
1410                 return False;
1411         }
1412
1413         for (i = 0; i< privs1.count; i++) {
1414                 test_LookupPrivDisplayName(p, mem_ctx, handle, (struct lsa_String *)&privs1.privs[i].name);
1415                 test_LookupPrivValue(p, mem_ctx, handle, (struct lsa_String *)&privs1.privs[i].name);
1416                 if (!test_EnumAccountsWithUserRight(p, mem_ctx, handle, (struct lsa_String *)&privs1.privs[i].name)) {
1417                         ret = False;
1418                 }
1419         }
1420
1421         return ret;
1422 }
1423
1424 static BOOL test_query_each_TrustDom(struct dcerpc_pipe *p,
1425                                      TALLOC_CTX *mem_ctx,
1426                                      struct policy_handle *handle,
1427                                      struct lsa_DomainList *domains)
1428 {
1429         NTSTATUS status;
1430         int i,j;
1431         BOOL ret = True;
1432
1433         printf("\nTesting OpenTrustedDomain, OpenTrustedDomainByName and QueryInfoTrustedDomain\n");
1434         for (i=0; i< domains->count; i++) {
1435                 struct lsa_OpenTrustedDomain trust;
1436                 struct lsa_OpenTrustedDomainByName trust_by_name;
1437                 struct policy_handle trustdom_handle;
1438                 struct policy_handle handle2;
1439                 struct lsa_Close c;
1440                 int levels [] = {1, 3, 6, 8, 12};
1441
1442                 if (domains->domains[i].sid) {
1443                         trust.in.handle = handle;
1444                         trust.in.sid = domains->domains[i].sid;
1445                         trust.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
1446                         trust.out.trustdom_handle = &trustdom_handle;
1447
1448                         status = dcerpc_lsa_OpenTrustedDomain(p, mem_ctx, &trust);
1449
1450                         if (!NT_STATUS_IS_OK(status)) {
1451                                 printf("OpenTrustedDomain failed - %s\n", nt_errstr(status));
1452                                 return False;
1453                         }
1454
1455                         c.in.handle = &trustdom_handle;
1456                         c.out.handle = &handle2;
1457
1458                         for (j=0; j < ARRAY_SIZE(levels); j++) {
1459                                 struct lsa_QueryTrustedDomainInfo q;
1460                                 union lsa_TrustedDomainInfo info;
1461                                 q.in.trustdom_handle = &trustdom_handle;
1462                                 q.in.level = levels[j];
1463                                 q.out.info = &info;
1464                                 status = dcerpc_lsa_QueryTrustedDomainInfo(p, mem_ctx, &q);
1465                                 if (!NT_STATUS_IS_OK(status)) {
1466                                         printf("QueryTrustedDomainInfo level %d failed - %s\n",
1467                                                levels[j], nt_errstr(status));
1468                                         ret = False;
1469                                 }
1470                         }
1471
1472                         status = dcerpc_lsa_Close(p, mem_ctx, &c);
1473                         if (!NT_STATUS_IS_OK(status)) {
1474                                 printf("Close of trusted domain failed - %s\n", nt_errstr(status));
1475                                 return False;
1476                         }
1477                 }
1478
1479                 trust_by_name.in.handle = handle;
1480                 trust_by_name.in.name.string = domains->domains[i].name.string;
1481                 trust_by_name.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
1482                 trust_by_name.out.trustdom_handle = &trustdom_handle;
1483
1484                 status = dcerpc_lsa_OpenTrustedDomainByName(p, mem_ctx, &trust_by_name);
1485
1486                 if (!NT_STATUS_IS_OK(status)) {
1487                         printf("OpenTrustedDomainByName failed - %s\n", nt_errstr(status));
1488                         return False;
1489                 }
1490
1491                 for (j=0; j < ARRAY_SIZE(levels); j++) {
1492                         struct lsa_QueryTrustedDomainInfo q;
1493                         union lsa_TrustedDomainInfo info;
1494                         q.in.trustdom_handle = &trustdom_handle;
1495                         q.in.level = levels[j];
1496                         q.out.info = &info;
1497                         status = dcerpc_lsa_QueryTrustedDomainInfo(p, mem_ctx, &q);
1498                         if (!NT_STATUS_IS_OK(status)) {
1499                                 printf("QueryTrustedDomainInfo level %d failed - %s\n",
1500                                        levels[j], nt_errstr(status));
1501                                 ret = False;
1502                         }
1503                 }
1504
1505                 c.in.handle = &trustdom_handle;
1506                 c.out.handle = &handle2;
1507
1508                 status = dcerpc_lsa_Close(p, mem_ctx, &c);
1509                 if (!NT_STATUS_IS_OK(status)) {
1510                         printf("Close of trusted domain failed - %s\n", nt_errstr(status));
1511                         return False;
1512                 }
1513
1514                 for (j=0; j < ARRAY_SIZE(levels); j++) {
1515                         struct lsa_QueryTrustedDomainInfoBySid q;
1516                         union lsa_TrustedDomainInfo info;
1517
1518                         if (!domains->domains[i].sid) {
1519                                 continue;
1520                         }
1521
1522                         q.in.handle  = handle;
1523                         q.in.dom_sid = domains->domains[i].sid;
1524                         q.in.level   = levels[j];
1525                         q.out.info   = &info;
1526                         status = dcerpc_lsa_QueryTrustedDomainInfoBySid(p, mem_ctx, &q);
1527                         if (!NT_STATUS_IS_OK(status)) {
1528                                 printf("QueryTrustedDomainInfoBySid level %d failed - %s\n",
1529                                        levels[j], nt_errstr(status));
1530                                 ret = False;
1531                         }
1532                 }
1533
1534                 for (j=0; j < ARRAY_SIZE(levels); j++) {
1535                         struct lsa_QueryTrustedDomainInfoByName q;
1536                         union lsa_TrustedDomainInfo info;
1537                         q.in.handle         = handle;
1538                         q.in.trusted_domain.string = domains->domains[i].name.string;
1539                         q.in.level          = levels[j];
1540                         q.out.info          = &info;
1541                         status = dcerpc_lsa_QueryTrustedDomainInfoByName(p, mem_ctx, &q);
1542                         if (!NT_STATUS_IS_OK(status)) {
1543                                 printf("QueryTrustedDomainInfoByName level %d failed - %s\n",
1544                                        levels[j], nt_errstr(status));
1545                                 ret = False;
1546                         }
1547                 }
1548         }
1549         return ret;
1550 }
1551
1552 static BOOL test_EnumTrustDom(struct dcerpc_pipe *p,
1553                               TALLOC_CTX *mem_ctx,
1554                               struct policy_handle *handle)
1555 {
1556         struct lsa_EnumTrustDom r;
1557         NTSTATUS enum_status;
1558         uint32_t resume_handle = 0;
1559         struct lsa_DomainList domains;
1560         BOOL ret = True;
1561
1562         printf("\nTesting EnumTrustDom\n");
1563
1564         do {
1565                 r.in.handle = handle;
1566                 r.in.resume_handle = &resume_handle;
1567                 r.in.max_size = LSA_ENUM_TRUST_DOMAIN_MULTIPLIER * 3;
1568                 r.out.domains = &domains;
1569                 r.out.resume_handle = &resume_handle;
1570
1571                 enum_status = dcerpc_lsa_EnumTrustDom(p, mem_ctx, &r);
1572
1573                 /* NO_MORE_ENTRIES is allowed */
1574                 if (NT_STATUS_EQUAL(enum_status, NT_STATUS_NO_MORE_ENTRIES)) {
1575                         return True;
1576                 } else if (NT_STATUS_EQUAL(enum_status, STATUS_MORE_ENTRIES)) {
1577                         /* Windows 2003 gets this off by one on the first run */
1578                         if (r.out.domains->count < 3 || r.out.domains->count > 4) {
1579                                 printf("EnumTrustDom didn't fill the buffer we "
1580                                        "asked it to (got %d, expected %d / %d == %d entries)\n",
1581                                        r.out.domains->count, LSA_ENUM_TRUST_DOMAIN_MULTIPLIER * 3,
1582                                        LSA_ENUM_TRUST_DOMAIN_MULTIPLIER, r.in.max_size);
1583                                 ret = False;
1584                         }
1585                 } else if (!NT_STATUS_IS_OK(enum_status)) {
1586                         printf("EnumTrustDom failed - %s\n", nt_errstr(enum_status));
1587                         return False;
1588                 }
1589
1590                 if (lp_parm_bool(-1, "target", "samba4", False)) {
1591                         printf("skipping 'each' Trusted Domains tests against Samba4\n");
1592                 } else {
1593                         ret &= test_query_each_TrustDom(p, mem_ctx, handle, &domains);
1594                 }
1595
1596         } while ((NT_STATUS_EQUAL(enum_status, STATUS_MORE_ENTRIES)));
1597
1598         return ret;
1599 }
1600
1601 static BOOL test_CreateTrustedDomain(struct dcerpc_pipe *p,
1602                                      TALLOC_CTX *mem_ctx,
1603                                      struct policy_handle *handle)
1604 {
1605         NTSTATUS status;
1606         BOOL ret = True;
1607         struct lsa_CreateTrustedDomain r;
1608         struct lsa_TrustInformation trustinfo;
1609         struct dom_sid *domsid[12];
1610         struct policy_handle trustdom_handle[12];
1611         struct lsa_QueryTrustedDomainInfo q;
1612         int i;
1613
1614         printf("Testing CreateTrustedDomain for 12 domains\n");
1615
1616         for (i=0; i< 12; i++) {
1617                 char *trust_name = talloc_asprintf(mem_ctx, "torturedom%02d", i);
1618                 char *trust_sid = talloc_asprintf(mem_ctx, "S-1-5-21-97398-379795-100%02d", i);
1619
1620                 domsid[i] = dom_sid_parse_talloc(mem_ctx, trust_sid);
1621
1622                 trustinfo.sid = domsid[i];
1623                 init_lsa_String((struct lsa_String *)&trustinfo.name, trust_name);
1624
1625                 r.in.handle = handle;
1626                 r.in.info = &trustinfo;
1627                 r.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
1628                 r.out.trustdom_handle = &trustdom_handle[i];
1629
1630                 status = dcerpc_lsa_CreateTrustedDomain(p, mem_ctx, &r);
1631                 if (NT_STATUS_EQUAL(status, NT_STATUS_OBJECT_NAME_COLLISION)) {
1632                         test_DeleteTrustedDomain(p, mem_ctx, handle, trustinfo.name);
1633                         status = dcerpc_lsa_CreateTrustedDomain(p, mem_ctx, &r);
1634                 }
1635                 if (!NT_STATUS_IS_OK(status)) {
1636                         printf("CreateTrustedDomain failed - %s\n", nt_errstr(status));
1637                         ret = False;
1638                 } else {
1639
1640                         q.in.trustdom_handle = &trustdom_handle[i];
1641                         q.in.level = LSA_TRUSTED_DOMAIN_INFO_NAME;
1642                         status = dcerpc_lsa_QueryTrustedDomainInfo(p, mem_ctx, &q);
1643                         if (!NT_STATUS_IS_OK(status)) {
1644                                 printf("QueryTrustedDomainInfo level 1 failed - %s\n", nt_errstr(status));
1645                                 ret = False;
1646                         } else if (!q.out.info) {
1647                                 ret = False;
1648                         } else {
1649                                 if (strcmp(q.out.info->name.netbios_name.string, trustinfo.name.string) != 0) {
1650                                         printf("QueryTrustedDomainInfo returned inconsistant short name: %s != %s\n",
1651                                                q.out.info->name.netbios_name.string, trustinfo.name.string);
1652                                         ret = False;
1653                                 }
1654                         }
1655                 }
1656         }
1657
1658         /* now that we have some domains to look over, we can test the enum calls */
1659         if (!test_EnumTrustDom(p, mem_ctx, handle)) {
1660                 ret = False;
1661         }
1662
1663         for (i=0; i<12; i++) {
1664                 if (!test_Delete(p, mem_ctx, &trustdom_handle[i])) {
1665                         ret = False;
1666                 }
1667         }
1668
1669         return ret;
1670 }
1671
1672 static BOOL test_QueryDomainInfoPolicy(struct dcerpc_pipe *p,
1673                                  TALLOC_CTX *mem_ctx,
1674                                  struct policy_handle *handle)
1675 {
1676         struct lsa_QueryDomainInformationPolicy r;
1677         NTSTATUS status;
1678         int i;
1679         BOOL ret = True;
1680         if (lp_parm_bool(-1, "target", "samba4", False)) {
1681                 printf("skipping QueryDomainInformationPolicy test against Samba4\n");
1682                 return True;
1683         }
1684
1685         printf("\nTesting QueryDomainInformationPolicy\n");
1686
1687         for (i=2;i<4;i++) {
1688                 r.in.handle = handle;
1689                 r.in.level = i;
1690
1691                 printf("\ntrying QueryDomainInformationPolicy level %d\n", i);
1692
1693                 status = dcerpc_lsa_QueryDomainInformationPolicy(p, mem_ctx, &r);
1694
1695                 if (!NT_STATUS_IS_OK(status)) {
1696                         printf("QueryDomainInformationPolicy failed - %s\n", nt_errstr(status));
1697                         ret = False;
1698                         continue;
1699                 }
1700         }
1701
1702         return ret;
1703 }
1704
1705
1706 static BOOL test_QueryInfoPolicy(struct dcerpc_pipe *p,
1707                                  TALLOC_CTX *mem_ctx,
1708                                  struct policy_handle *handle)
1709 {
1710         struct lsa_QueryInfoPolicy r;
1711         NTSTATUS status;
1712         int i;
1713         BOOL ret = True;
1714         printf("\nTesting QueryInfoPolicy\n");
1715
1716         if (lp_parm_bool(-1, "target", "samba4", False)) {
1717                 printf("skipping QueryInfoPolicy2 against Samba4\n");
1718                 return True;
1719         }
1720
1721         for (i=1;i<13;i++) {
1722                 r.in.handle = handle;
1723                 r.in.level = i;
1724
1725                 printf("\ntrying QueryInfoPolicy level %d\n", i);
1726
1727                 status = dcerpc_lsa_QueryInfoPolicy(p, mem_ctx, &r);
1728
1729                 if ((i == 9 || i == 10 || i == 11) &&
1730                     NT_STATUS_EQUAL(status, NT_STATUS_INVALID_PARAMETER)) {
1731                         printf("server failed level %u (OK)\n", i);
1732                         continue;
1733                 }
1734
1735                 if (!NT_STATUS_IS_OK(status)) {
1736                         printf("QueryInfoPolicy failed - %s\n", nt_errstr(status));
1737                         ret = False;
1738                         continue;
1739                 }
1740         }
1741
1742         return ret;
1743 }
1744
1745 static BOOL test_QueryInfoPolicy2(struct dcerpc_pipe *p,
1746                                   TALLOC_CTX *mem_ctx,
1747                                   struct policy_handle *handle)
1748 {
1749         struct lsa_QueryInfoPolicy2 r;
1750         NTSTATUS status;
1751         int i;
1752         BOOL ret = True;
1753         printf("\nTesting QueryInfoPolicy2\n");
1754         if (lp_parm_bool(-1, "target", "samba4", False)) {
1755                 printf("skipping QueryInfoPolicy2 against Samba4\n");
1756                 return True;
1757         }
1758
1759         for (i=1;i<13;i++) {
1760                 r.in.handle = handle;
1761                 r.in.level = i;
1762
1763                 printf("\ntrying QueryInfoPolicy2 level %d\n", i);
1764
1765                 status = dcerpc_lsa_QueryInfoPolicy2(p, mem_ctx, &r);
1766
1767                 if ((i == 9 || i == 10 || i == 11) &&
1768                     NT_STATUS_EQUAL(status, NT_STATUS_INVALID_PARAMETER)) {
1769                         printf("server failed level %u (OK)\n", i);
1770                         continue;
1771                 }
1772
1773                 if (!NT_STATUS_IS_OK(status)) {
1774                         printf("QueryInfoPolicy2 failed - %s\n", nt_errstr(status));
1775                         ret = False;
1776                         continue;
1777                 }
1778         }
1779
1780         return ret;
1781 }
1782
1783 static BOOL test_GetUserName(struct dcerpc_pipe *p, TALLOC_CTX *mem_ctx)
1784 {
1785         struct lsa_GetUserName r;
1786         NTSTATUS status;
1787         BOOL ret = True;
1788         struct lsa_StringPointer authority_name_p;
1789
1790         printf("\nTesting GetUserName\n");
1791
1792         r.in.system_name = "\\";
1793         r.in.account_name = NULL;
1794         r.in.authority_name = &authority_name_p;
1795         authority_name_p.string = NULL;
1796
1797         status = dcerpc_lsa_GetUserName(p, mem_ctx, &r);
1798
1799         if (!NT_STATUS_IS_OK(status)) {
1800                 printf("GetUserName failed - %s\n", nt_errstr(status));
1801                 ret = False;
1802         }
1803
1804         return ret;
1805 }
1806
1807 BOOL test_lsa_Close(struct dcerpc_pipe *p,
1808                     TALLOC_CTX *mem_ctx,
1809                     struct policy_handle *handle)
1810 {
1811         NTSTATUS status;
1812         struct lsa_Close r;
1813         struct policy_handle handle2;
1814
1815         printf("\ntesting Close\n");
1816
1817         r.in.handle = handle;
1818         r.out.handle = &handle2;
1819
1820         status = dcerpc_lsa_Close(p, mem_ctx, &r);
1821         if (!NT_STATUS_IS_OK(status)) {
1822                 printf("Close failed - %s\n", nt_errstr(status));
1823                 return False;
1824         }
1825
1826         status = dcerpc_lsa_Close(p, mem_ctx, &r);
1827         /* its really a fault - we need a status code for rpc fault */
1828         if (!NT_STATUS_EQUAL(status, NT_STATUS_NET_WRITE_FAULT)) {
1829                 printf("Close failed - %s\n", nt_errstr(status));
1830                 return False;
1831         }
1832
1833         printf("\n");
1834
1835         return True;
1836 }
1837
1838 BOOL torture_rpc_lsa(struct torture_context *torture)
1839 {
1840         NTSTATUS status;
1841         struct dcerpc_pipe *p;
1842         TALLOC_CTX *mem_ctx;
1843         BOOL ret = True;
1844         struct policy_handle *handle;
1845
1846         mem_ctx = talloc_init("torture_rpc_lsa");
1847
1848         status = torture_rpc_connection(mem_ctx, &p, &dcerpc_table_lsarpc);
1849         if (!NT_STATUS_IS_OK(status)) {
1850                 talloc_free(mem_ctx);
1851                 return False;
1852         }
1853
1854         if (!test_OpenPolicy(p, mem_ctx)) {
1855                 ret = False;
1856         }
1857
1858         if (!test_lsa_OpenPolicy2(p, mem_ctx, &handle)) {
1859                 ret = False;
1860         }
1861
1862         if (handle) {
1863                 if (!test_LookupSids_async(p, mem_ctx, handle)) {
1864                         ret = False;
1865                 }
1866
1867                 if (!test_QueryDomainInfoPolicy(p, mem_ctx, handle)) {
1868                         ret = False;
1869                 }
1870
1871                 if (!test_CreateAccount(p, mem_ctx, handle)) {
1872                         ret = False;
1873                 }
1874
1875                 if (!test_CreateSecret(p, mem_ctx, handle)) {
1876                         ret = False;
1877                 }
1878
1879                 if (!test_CreateTrustedDomain(p, mem_ctx, handle)) {
1880                         ret = False;
1881                 }
1882
1883                 if (!test_EnumAccounts(p, mem_ctx, handle)) {
1884                         ret = False;
1885                 }
1886
1887                 if (!test_EnumPrivs(p, mem_ctx, handle)) {
1888                         ret = False;
1889                 }
1890
1891                 if (!test_QueryInfoPolicy(p, mem_ctx, handle)) {
1892                         ret = False;
1893                 }
1894
1895                 if (!test_QueryInfoPolicy2(p, mem_ctx, handle)) {
1896                         ret = False;
1897                 }
1898
1899 #if 0
1900                 if (!test_Delete(p, mem_ctx, handle)) {
1901                         ret = False;
1902                 }
1903 #endif
1904
1905                 if (!test_many_LookupSids(p, mem_ctx, handle)) {
1906                         ret = False;
1907                 }
1908
1909                 if (!test_lsa_Close(p, mem_ctx, handle)) {
1910                         ret = False;
1911                 }
1912         } else {
1913                 if (!test_many_LookupSids(p, mem_ctx, handle)) {
1914                         ret = False;
1915                 }
1916         }
1917
1918         if (!test_GetUserName(p, mem_ctx)) {
1919                 ret = False;
1920         }
1921
1922         talloc_free(mem_ctx);
1923
1924         return ret;
1925 }
1926
1927 BOOL torture_rpc_lsa_get_user(struct torture_context *torture)
1928 {
1929         NTSTATUS status;
1930         struct dcerpc_pipe *p;
1931         TALLOC_CTX *mem_ctx;
1932         BOOL ret = True;
1933
1934         mem_ctx = talloc_init("torture_rpc_lsa_get_user");
1935
1936         status = torture_rpc_connection(mem_ctx, &p, &dcerpc_table_lsarpc);
1937         if (!NT_STATUS_IS_OK(status)) {
1938                 talloc_free(mem_ctx);
1939                 return False;
1940         }
1941
1942         if (!test_GetUserName(p, mem_ctx)) {
1943                 ret = False;
1944         }
1945
1946         talloc_free(mem_ctx);
1947
1948         return ret;
1949 }