source4/torture/rpc/samba3rpc.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3
   4    dcerpc torture tests, designed to walk Samba3 code paths
   5
   6    Copyright (C) Volker Lendecke 2006
   7
   8    This program is free software; you can redistribute it and/or modify
   9    it under the terms of the GNU General Public License as published by
  10    the Free Software Foundation; either version 3 of the License, or
  11    (at your option) any later version.
  12
  13    This program is distributed in the hope that it will be useful,
  14    but WITHOUT ANY WARRANTY; without even the implied warranty of
  15    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  16    GNU General Public License for more details.
  17
  18    You should have received a copy of the GNU General Public License
  19    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  20 */
  21
  22 #include "includes.h"
  23 #include "libcli/raw/libcliraw.h"
  24 #include "libcli/raw/raw_proto.h"
  25 #include "libcli/rap/rap.h"
  26 #include "torture/torture.h"
  27 #include "torture/util.h"
  28 #include "torture/rap/proto.h"
  29 #include "librpc/gen_ndr/ndr_lsa.h"
  30 #include "librpc/gen_ndr/ndr_lsa_c.h"
  31 #include "librpc/gen_ndr/ndr_samr.h"
  32 #include "librpc/gen_ndr/ndr_samr_c.h"
  33 #include "librpc/gen_ndr/ndr_netlogon.h"
  34 #include "librpc/gen_ndr/ndr_netlogon_c.h"
  35 #include "librpc/gen_ndr/ndr_srvsvc.h"
  36 #include "librpc/gen_ndr/ndr_srvsvc_c.h"
  37 #include "librpc/gen_ndr/ndr_spoolss.h"
  38 #include "librpc/gen_ndr/ndr_spoolss_c.h"
  39 #include "librpc/gen_ndr/ndr_winreg.h"
  40 #include "librpc/gen_ndr/ndr_winreg_c.h"
  41 #include "librpc/gen_ndr/ndr_wkssvc.h"
  42 #include "librpc/gen_ndr/ndr_wkssvc_c.h"
  43 #include "lib/cmdline/popt_common.h"
  44 #include "librpc/rpc/dcerpc.h"
  45 #include "torture/rpc/rpc.h"
  46 #include "libcli/libcli.h"
  47 #include "libcli/composite/composite.h"
  48 #include "libcli/smb_composite/smb_composite.h"
  49 #include "libcli/auth/libcli_auth.h"
  50 #include "../lib/crypto/crypto.h"
  51 #include "auth/ntlmssp/ntlmssp.h"
  52 #include "libcli/security/proto.h"
  53 #include "param/param.h"
  54 #include "lib/registry/registry.h"
  55 #include "libcli/resolve/resolve.h"
  56
  57 /*
  58  * This tests a RPC call using an invalid vuid
  59  */
  60
  61 bool torture_bind_authcontext(struct torture_context *torture)
  62 {
  63         TALLOC_CTX *mem_ctx;
  64         NTSTATUS status;
  65         bool ret = false;
  66         struct lsa_ObjectAttribute objectattr;
  67         struct lsa_OpenPolicy2 openpolicy;
  68         struct policy_handle handle;
  69         struct lsa_Close close_handle;
  70         struct smbcli_session *tmp;
  71         struct smbcli_session *session2;
  72         struct smbcli_state *cli;
  73         struct dcerpc_pipe *lsa_pipe;
  74         struct cli_credentials *anon_creds;
  75         struct smb_composite_sesssetup setup;
  76         struct smbcli_options options;
  77         struct smbcli_session_options session_options;
  78
  79         mem_ctx = talloc_init("torture_bind_authcontext");
  80
  81         if (mem_ctx == NULL) {
  82                 d_printf("talloc_init failed\n");
  83                 return false;
  84         }
  85
  86         lp_smbcli_options(torture->lp_ctx, &options);
  87         lp_smbcli_session_options(torture->lp_ctx, &session_options);
  88
  89         status = smbcli_full_connection(mem_ctx, &cli,
  90                                         torture_setting_string(torture, "host", NULL),
  91                                         lp_smb_ports(torture->lp_ctx),
  92                                         "IPC$", NULL, cmdline_credentials,
  93                                         lp_resolve_context(torture->lp_ctx),
  94                                         torture->ev, &options, &session_options,
  95                                         lp_iconv_convenience(torture->lp_ctx));
  96         if (!NT_STATUS_IS_OK(status)) {
  97                 d_printf("smbcli_full_connection failed: %s\n",
  98                          nt_errstr(status));
  99                 goto done;
 100         }
 101
 102         lsa_pipe = dcerpc_pipe_init(mem_ctx, cli->transport->socket->event.ctx,
 103                                     lp_iconv_convenience(torture->lp_ctx));
 104         if (lsa_pipe == NULL) {
 105                 d_printf("dcerpc_pipe_init failed\n");
 106                 goto done;
 107         }
 108
 109         status = dcerpc_pipe_open_smb(lsa_pipe, cli->tree, "\\lsarpc");
 110         if (!NT_STATUS_IS_OK(status)) {
 111                 d_printf("dcerpc_pipe_open_smb failed: %s\n",
 112                          nt_errstr(status));
 113                 goto done;
 114         }
 115
 116         status = dcerpc_bind_auth_none(lsa_pipe, &ndr_table_lsarpc);
 117         if (!NT_STATUS_IS_OK(status)) {
 118                 d_printf("dcerpc_bind_auth_none failed: %s\n",
 119                          nt_errstr(status));
 120                 goto done;
 121         }
 122
 123         openpolicy.in.system_name =talloc_asprintf(
 124                 mem_ctx, "\\\\%s", dcerpc_server_name(lsa_pipe));
 125         ZERO_STRUCT(objectattr);
 126         openpolicy.in.attr = &objectattr;
 127         openpolicy.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
 128         openpolicy.out.handle = &handle;
 129
 130         status = dcerpc_lsa_OpenPolicy2(lsa_pipe, mem_ctx, &openpolicy);
 131
 132         if (!NT_STATUS_IS_OK(status)) {
 133                 d_printf("dcerpc_lsa_OpenPolicy2 failed: %s\n",
 134                          nt_errstr(status));
 135                 goto done;
 136         }
 137
 138         close_handle.in.handle = &handle;
 139         close_handle.out.handle = &handle;
 140
 141         status = dcerpc_lsa_Close(lsa_pipe, mem_ctx, &close_handle);
 142         if (!NT_STATUS_IS_OK(status)) {
 143                 d_printf("dcerpc_lsa_Close failed: %s\n",
 144                          nt_errstr(status));
 145                 goto done;
 146         }
 147
 148         session2 = smbcli_session_init(cli->transport, mem_ctx, false, session_options);
 149         if (session2 == NULL) {
 150                 d_printf("smbcli_session_init failed\n");
 151                 goto done;
 152         }
 153
 154         if (!(anon_creds = cli_credentials_init_anon(mem_ctx))) {
 155                 d_printf("create_anon_creds failed\n");
 156                 goto done;
 157         }
 158
 159         setup.in.sesskey = cli->transport->negotiate.sesskey;
 160         setup.in.capabilities = cli->transport->negotiate.capabilities;
 161         setup.in.workgroup = "";
 162         setup.in.credentials = anon_creds;
 163
 164         status = smb_composite_sesssetup(session2, &setup);
 165         if (!NT_STATUS_IS_OK(status)) {
 166                 d_printf("anon session setup failed: %s\n",
 167                          nt_errstr(status));
 168                 goto done;
 169         }
 170         session2->vuid = setup.out.vuid;
 171
 172         tmp = cli->tree->session;
 173         cli->tree->session = session2;
 174
 175         status = dcerpc_lsa_OpenPolicy2(lsa_pipe, mem_ctx, &openpolicy);
 176
 177         cli->tree->session = tmp;
 178         talloc_free(lsa_pipe);
 179         lsa_pipe = NULL;
 180
 181         if (!NT_STATUS_EQUAL(status, NT_STATUS_INVALID_HANDLE)) {
 182                 d_printf("dcerpc_lsa_OpenPolicy2 with wrong vuid gave %s, "
 183                          "expected NT_STATUS_INVALID_HANDLE\n",
 184                          nt_errstr(status));
 185                 goto done;
 186         }
 187
 188         ret = true;
 189  done:
 190         talloc_free(mem_ctx);
 191         return ret;
 192 }
 193
 194 /*
 195  * Bind to lsa using a specific auth method
 196  */
 197
 198 static bool bindtest(struct smbcli_state *cli,
 199                      struct cli_credentials *credentials,
 200                      struct loadparm_context *lp_ctx,
 201                      uint8_t auth_type, uint8_t auth_level)
 202 {
 203         TALLOC_CTX *mem_ctx;
 204         bool ret = false;
 205         NTSTATUS status;
 206
 207         struct dcerpc_pipe *lsa_pipe;
 208         struct lsa_ObjectAttribute objectattr;
 209         struct lsa_OpenPolicy2 openpolicy;
 210         struct lsa_QueryInfoPolicy query;
 211         union lsa_PolicyInformation *info = NULL;
 212         struct policy_handle handle;
 213         struct lsa_Close close_handle;
 214
 215         if ((mem_ctx = talloc_init("bindtest")) == NULL) {
 216                 d_printf("talloc_init failed\n");
 217                 return false;
 218         }
 219
 220         lsa_pipe = dcerpc_pipe_init(mem_ctx,
 221                                     cli->transport->socket->event.ctx,
 222                                     lp_iconv_convenience(lp_ctx));
 223         if (lsa_pipe == NULL) {
 224                 d_printf("dcerpc_pipe_init failed\n");
 225                 goto done;
 226         }
 227
 228         status = dcerpc_pipe_open_smb(lsa_pipe, cli->tree, "\\lsarpc");
 229         if (!NT_STATUS_IS_OK(status)) {
 230                 d_printf("dcerpc_pipe_open_smb failed: %s\n",
 231                          nt_errstr(status));
 232                 goto done;
 233         }
 234
 235         status = dcerpc_bind_auth(lsa_pipe, &ndr_table_lsarpc,
 236                                   credentials, lp_ctx, auth_type, auth_level,
 237                                   NULL);
 238         if (!NT_STATUS_IS_OK(status)) {
 239                 d_printf("dcerpc_bind_auth failed: %s\n", nt_errstr(status));
 240                 goto done;
 241         }
 242
 243         openpolicy.in.system_name =talloc_asprintf(
 244                 mem_ctx, "\\\\%s", dcerpc_server_name(lsa_pipe));
 245         ZERO_STRUCT(objectattr);
 246         openpolicy.in.attr = &objectattr;
 247         openpolicy.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
 248         openpolicy.out.handle = &handle;
 249
 250         status = dcerpc_lsa_OpenPolicy2(lsa_pipe, mem_ctx, &openpolicy);
 251
 252         if (!NT_STATUS_IS_OK(status)) {
 253                 d_printf("dcerpc_lsa_OpenPolicy2 failed: %s\n",
 254                          nt_errstr(status));
 255                 goto done;
 256         }
 257
 258         query.in.handle = &handle;
 259         query.in.level = LSA_POLICY_INFO_DOMAIN;
 260         query.out.info = &info;
 261
 262         status = dcerpc_lsa_QueryInfoPolicy(lsa_pipe, mem_ctx, &query);
 263         if (!NT_STATUS_IS_OK(status)) {
 264                 d_printf("dcerpc_lsa_QueryInfoPolicy failed: %s\n",
 265                          nt_errstr(status));
 266                 goto done;
 267         }
 268
 269         close_handle.in.handle = &handle;
 270         close_handle.out.handle = &handle;
 271
 272         status = dcerpc_lsa_Close(lsa_pipe, mem_ctx, &close_handle);
 273         if (!NT_STATUS_IS_OK(status)) {
 274                 d_printf("dcerpc_lsa_Close failed: %s\n",
 275                          nt_errstr(status));
 276                 goto done;
 277         }
 278
 279         ret = true;
 280  done:
 281         talloc_free(mem_ctx);
 282         return ret;
 283 }
 284
 285 /*
 286  * test authenticated RPC binds with the variants Samba3 does support
 287  */
 288
 289 bool torture_bind_samba3(struct torture_context *torture)
 290 {
 291         TALLOC_CTX *mem_ctx;
 292         NTSTATUS status;
 293         bool ret = false;
 294         struct smbcli_state *cli;
 295         struct smbcli_options options;
 296         struct smbcli_session_options session_options;
 297
 298         mem_ctx = talloc_init("torture_bind_authcontext");
 299
 300         if (mem_ctx == NULL) {
 301                 d_printf("talloc_init failed\n");
 302                 return false;
 303         }
 304
 305         lp_smbcli_options(torture->lp_ctx, &options);
 306         lp_smbcli_session_options(torture->lp_ctx, &session_options);
 307
 308         status = smbcli_full_connection(mem_ctx, &cli,
 309                                         torture_setting_string(torture, "host", NULL),
 310                                         lp_smb_ports(torture->lp_ctx),
 311                                         "IPC$", NULL, cmdline_credentials,
 312                                         lp_resolve_context(torture->lp_ctx),
 313                                         torture->ev, &options, &session_options,
 314                                         lp_iconv_convenience(torture->lp_ctx));
 315         if (!NT_STATUS_IS_OK(status)) {
 316                 d_printf("smbcli_full_connection failed: %s\n",
 317                          nt_errstr(status));
 318                 goto done;
 319         }
 320
 321         ret = true;
 322
 323         ret &= bindtest(cli, cmdline_credentials, torture->lp_ctx, DCERPC_AUTH_TYPE_NTLMSSP,
 324                         DCERPC_AUTH_LEVEL_INTEGRITY);
 325         ret &= bindtest(cli, cmdline_credentials, torture->lp_ctx, DCERPC_AUTH_TYPE_NTLMSSP,
 326                         DCERPC_AUTH_LEVEL_PRIVACY);
 327         ret &= bindtest(cli, cmdline_credentials, torture->lp_ctx, DCERPC_AUTH_TYPE_SPNEGO,
 328                         DCERPC_AUTH_LEVEL_INTEGRITY);
 329         ret &= bindtest(cli, cmdline_credentials, torture->lp_ctx, DCERPC_AUTH_TYPE_SPNEGO,
 330                         DCERPC_AUTH_LEVEL_PRIVACY);
 331
 332  done:
 333         talloc_free(mem_ctx);
 334         return ret;
 335 }
 336
 337 /*
 338  * Lookup or create a user and return all necessary info
 339  */
 340
 341 static NTSTATUS get_usr_handle(struct smbcli_state *cli,
 342                                TALLOC_CTX *mem_ctx,
 343                                struct loadparm_context *lp_ctx,
 344                                struct cli_credentials *admin_creds,
 345                                uint8_t auth_type,
 346                                uint8_t auth_level,
 347                                const char *username,
 348                                char **domain,
 349                                struct dcerpc_pipe **result_pipe,
 350                                struct policy_handle **result_handle,
 351                                struct dom_sid **sid)
 352 {
 353         struct dcerpc_pipe *samr_pipe;
 354         NTSTATUS status;
 355         struct policy_handle conn_handle;
 356         struct policy_handle domain_handle;
 357         struct policy_handle *user_handle;
 358         struct samr_Connect2 conn;
 359         struct samr_EnumDomains enumdom;
 360         uint32_t resume_handle = 0;
 361         struct samr_LookupDomain l;
 362         int dom_idx;
 363         struct lsa_String domain_name;
 364         struct lsa_String user_name;
 365         struct samr_OpenDomain o;
 366         struct samr_CreateUser2 c;
 367         uint32_t user_rid,access_granted;
 368
 369         samr_pipe = dcerpc_pipe_init(mem_ctx,
 370                                      cli->transport->socket->event.ctx,
 371                                      lp_iconv_convenience(lp_ctx));
 372         if (samr_pipe == NULL) {
 373                 d_printf("dcerpc_pipe_init failed\n");
 374                 status = NT_STATUS_NO_MEMORY;
 375                 goto fail;
 376         }
 377
 378         status = dcerpc_pipe_open_smb(samr_pipe, cli->tree, "\\samr");
 379         if (!NT_STATUS_IS_OK(status)) {
 380                 d_printf("dcerpc_pipe_open_smb failed: %s\n",
 381                          nt_errstr(status));
 382                 goto fail;
 383         }
 384
 385         if (admin_creds != NULL) {
 386                 status = dcerpc_bind_auth(samr_pipe, &ndr_table_samr,
 387                                           admin_creds, lp_ctx, auth_type, auth_level,
 388                                           NULL);
 389                 if (!NT_STATUS_IS_OK(status)) {
 390                         d_printf("dcerpc_bind_auth failed: %s\n",
 391                                  nt_errstr(status));
 392                         goto fail;
 393                 }
 394         } else {
 395                 /* We must have an authenticated SMB connection */
 396                 status = dcerpc_bind_auth_none(samr_pipe, &ndr_table_samr);
 397                 if (!NT_STATUS_IS_OK(status)) {
 398                         d_printf("dcerpc_bind_auth_none failed: %s\n",
 399                                  nt_errstr(status));
 400                         goto fail;
 401                 }
 402         }
 403
 404         conn.in.system_name = talloc_asprintf(
 405                 mem_ctx, "\\\\%s", dcerpc_server_name(samr_pipe));
 406         conn.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
 407         conn.out.connect_handle = &conn_handle;
 408
 409         status = dcerpc_samr_Connect2(samr_pipe, mem_ctx, &conn);
 410         if (!NT_STATUS_IS_OK(status)) {
 411                 d_printf("samr_Connect2 failed: %s\n", nt_errstr(status));
 412                 goto fail;
 413         }
 414
 415         enumdom.in.connect_handle = &conn_handle;
 416         enumdom.in.resume_handle = &resume_handle;
 417         enumdom.in.buf_size = (uint32_t)-1;
 418         enumdom.out.resume_handle = &resume_handle;
 419
 420         status = dcerpc_samr_EnumDomains(samr_pipe, mem_ctx, &enumdom);
 421         if (!NT_STATUS_IS_OK(status)) {
 422                 d_printf("samr_EnumDomains failed: %s\n", nt_errstr(status));
 423                 goto fail;
 424         }
 425
 426         if (enumdom.out.num_entries != 2) {
 427                 d_printf("samr_EnumDomains returned %d entries, expected 2\n",
 428                          enumdom.out.num_entries);
 429                 status = NT_STATUS_UNSUCCESSFUL;
 430                 goto fail;
 431         }
 432
 433         dom_idx = strequal(enumdom.out.sam->entries[0].name.string,
 434                            "builtin") ? 1:0;
 435
 436         l.in.connect_handle = &conn_handle;
 437         domain_name.string = enumdom.out.sam->entries[dom_idx].name.string;
 438         *domain = talloc_strdup(mem_ctx, domain_name.string);
 439         l.in.domain_name = &domain_name;
 440
 441         status = dcerpc_samr_LookupDomain(samr_pipe, mem_ctx, &l);
 442         if (!NT_STATUS_IS_OK(status)) {
 443                 d_printf("samr_LookupDomain failed: %s\n", nt_errstr(status));
 444                 goto fail;
 445         }
 446
 447         o.in.connect_handle = &conn_handle;
 448         o.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
 449         o.in.sid = l.out.sid;
 450         o.out.domain_handle = &domain_handle;
 451
 452         status = dcerpc_samr_OpenDomain(samr_pipe, mem_ctx, &o);
 453         if (!NT_STATUS_IS_OK(status)) {
 454                 d_printf("samr_OpenDomain failed: %s\n", nt_errstr(status));
 455                 goto fail;
 456         }
 457
 458         c.in.domain_handle = &domain_handle;
 459         user_name.string = username;
 460         c.in.account_name = &user_name;
 461         c.in.acct_flags = ACB_NORMAL;
 462         c.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
 463         user_handle = talloc(mem_ctx, struct policy_handle);
 464         c.out.user_handle = user_handle;
 465         c.out.access_granted = &access_granted;
 466         c.out.rid = &user_rid;
 467
 468         status = dcerpc_samr_CreateUser2(samr_pipe, mem_ctx, &c);
 469
 470         if (NT_STATUS_EQUAL(status, NT_STATUS_USER_EXISTS)) {
 471                 struct samr_LookupNames ln;
 472                 struct samr_OpenUser ou;
 473
 474                 ln.in.domain_handle = &domain_handle;
 475                 ln.in.num_names = 1;
 476                 ln.in.names = &user_name;
 477
 478                 status = dcerpc_samr_LookupNames(samr_pipe, mem_ctx, &ln);
 479                 if (!NT_STATUS_IS_OK(status)) {
 480                         d_printf("samr_LookupNames failed: %s\n",
 481                                  nt_errstr(status));
 482                         goto fail;
 483                 }
 484
 485                 ou.in.domain_handle = &domain_handle;
 486                 ou.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
 487                 user_rid = ou.in.rid = ln.out.rids.ids[0];
 488                 ou.out.user_handle = user_handle;
 489
 490                 status = dcerpc_samr_OpenUser(samr_pipe, mem_ctx, &ou);
 491                 if (!NT_STATUS_IS_OK(status)) {
 492                         d_printf("samr_OpenUser failed: %s\n",
 493                                  nt_errstr(status));
 494                         goto fail;
 495                 }
 496         }
 497
 498         if (!NT_STATUS_IS_OK(status)) {
 499                 d_printf("samr_CreateUser failed: %s\n", nt_errstr(status));
 500                 goto fail;
 501         }
 502
 503         *result_pipe = samr_pipe;
 504         *result_handle = user_handle;
 505         if (sid != NULL) {
 506                 *sid = dom_sid_add_rid(mem_ctx, l.out.sid, user_rid);
 507         }
 508         return NT_STATUS_OK;
 509
 510  fail:
 511         return status;
 512 }
 513
 514 /*
 515  * Create a test user
 516  */
 517
 518 static bool create_user(TALLOC_CTX *mem_ctx, struct smbcli_state *cli,
 519                         struct loadparm_context *lp_ctx,
 520                         struct cli_credentials *admin_creds,
 521                         const char *username, const char *password,
 522                         char **domain_name,
 523                         struct dom_sid **user_sid)
 524 {
 525         TALLOC_CTX *tmp_ctx;
 526         NTSTATUS status;
 527         struct dcerpc_pipe *samr_pipe;
 528         struct policy_handle *wks_handle;
 529         bool ret = false;
 530
 531         if (!(tmp_ctx = talloc_new(mem_ctx))) {
 532                 d_printf("talloc_init failed\n");
 533                 return false;
 534         }
 535
 536         status = get_usr_handle(cli, tmp_ctx, lp_ctx, admin_creds,
 537                                 DCERPC_AUTH_TYPE_NTLMSSP,
 538                                 DCERPC_AUTH_LEVEL_INTEGRITY,
 539                                 username, domain_name, &samr_pipe, &wks_handle,
 540                                 user_sid);
 541         if (!NT_STATUS_IS_OK(status)) {
 542                 d_printf("get_usr_handle failed: %s\n", nt_errstr(status));
 543                 goto done;
 544         }
 545
 546         {
 547                 struct samr_SetUserInfo2 sui2;
 548                 struct samr_SetUserInfo sui;
 549                 struct samr_QueryUserInfo qui;
 550                 union samr_UserInfo u_info;
 551                 DATA_BLOB session_key;
 552
 553
 554                 ZERO_STRUCT(u_info);
 555                 encode_pw_buffer(u_info.info23.password.data, password,
 556                                  STR_UNICODE);
 557
 558                 status = dcerpc_fetch_session_key(samr_pipe, &session_key);
 559                 if (!NT_STATUS_IS_OK(status)) {
 560                         d_printf("dcerpc_fetch_session_key failed\n");
 561                         goto done;
 562                 }
 563                 arcfour_crypt_blob(u_info.info23.password.data, 516,
 564                                    &session_key);
 565                 u_info.info23.info.password_expired = 0;
 566                 u_info.info23.info.fields_present = SAMR_FIELD_PASSWORD |
 567                                                     SAMR_FIELD_PASSWORD2 |
 568                                                     SAMR_FIELD_EXPIRED_FLAG;
 569                 sui2.in.user_handle = wks_handle;
 570                 sui2.in.info = &u_info;
 571                 sui2.in.level = 23;
 572
 573                 status = dcerpc_samr_SetUserInfo2(samr_pipe, tmp_ctx, &sui2);
 574                 if (!NT_STATUS_IS_OK(status)) {
 575                         d_printf("samr_SetUserInfo(23) failed: %s\n",
 576                                  nt_errstr(status));
 577                         goto done;
 578                 }
 579
 580                 u_info.info16.acct_flags = ACB_NORMAL;
 581                 sui.in.user_handle = wks_handle;
 582                 sui.in.info = &u_info;
 583                 sui.in.level = 16;
 584
 585                 status = dcerpc_samr_SetUserInfo(samr_pipe, tmp_ctx, &sui);
 586                 if (!NT_STATUS_IS_OK(status)) {
 587                         d_printf("samr_SetUserInfo(16) failed\n");
 588                         goto done;
 589                 }
 590
 591                 qui.in.user_handle = wks_handle;
 592                 qui.in.level = 21;
 593
 594                 status = dcerpc_samr_QueryUserInfo(samr_pipe, tmp_ctx, &qui);
 595                 if (!NT_STATUS_IS_OK(status)) {
 596                         d_printf("samr_QueryUserInfo(21) failed\n");
 597                         goto done;
 598                 }
 599
 600                 qui.out.info->info21.allow_password_change = 0;
 601                 qui.out.info->info21.force_password_change = 0;
 602                 qui.out.info->info21.account_name.string = NULL;
 603                 qui.out.info->info21.rid = 0;
 604                 qui.out.info->info21.acct_expiry = 0;
 605                 qui.out.info->info21.fields_present = 0x81827fa; /* copy usrmgr.exe */
 606
 607                 u_info.info21 = qui.out.info->info21;
 608                 sui.in.user_handle = wks_handle;
 609                 sui.in.info = &u_info;
 610                 sui.in.level = 21;
 611
 612                 status = dcerpc_samr_SetUserInfo(samr_pipe, tmp_ctx, &sui);
 613                 if (!NT_STATUS_IS_OK(status)) {
 614                         d_printf("samr_SetUserInfo(21) failed\n");
 615                         goto done;
 616                 }
 617         }
 618
 619         *domain_name= talloc_steal(mem_ctx, *domain_name);
 620         *user_sid = talloc_steal(mem_ctx, *user_sid);
 621         ret = true;
 622  done:
 623         talloc_free(tmp_ctx);
 624         return ret;
 625 }
 626
 627 /*
 628  * Delete a test user
 629  */
 630
 631 static bool delete_user(struct smbcli_state *cli,
 632                         struct loadparm_context *lp_ctx,
 633                         struct cli_credentials *admin_creds,
 634                         const char *username)
 635 {
 636         TALLOC_CTX *mem_ctx;
 637         NTSTATUS status;
 638         char *dom_name;
 639         struct dcerpc_pipe *samr_pipe;
 640         struct policy_handle *user_handle;
 641         bool ret = false;
 642
 643         if ((mem_ctx = talloc_init("leave")) == NULL) {
 644                 d_printf("talloc_init failed\n");
 645                 return false;
 646         }
 647
 648         status = get_usr_handle(cli, mem_ctx, lp_ctx, admin_creds,
 649                                 DCERPC_AUTH_TYPE_NTLMSSP,
 650                                 DCERPC_AUTH_LEVEL_INTEGRITY,
 651                                 username, &dom_name, &samr_pipe,
 652                                 &user_handle, NULL);
 653
 654         if (!NT_STATUS_IS_OK(status)) {
 655                 d_printf("get_wks_handle failed: %s\n", nt_errstr(status));
 656                 goto done;
 657         }
 658
 659         {
 660                 struct samr_DeleteUser d;
 661
 662                 d.in.user_handle = user_handle;
 663                 d.out.user_handle = user_handle;
 664
 665                 status = dcerpc_samr_DeleteUser(samr_pipe, mem_ctx, &d);
 666                 if (!NT_STATUS_IS_OK(status)) {
 667                         d_printf("samr_DeleteUser failed %s\n", nt_errstr(status));
 668                         goto done;
 669                 }
 670         }
 671
 672         ret = true;
 673
 674  done:
 675         talloc_free(mem_ctx);
 676         return ret;
 677 }
 678
 679 /*
 680  * Do a Samba3-style join
 681  */
 682
 683 static bool join3(struct smbcli_state *cli,
 684                   struct loadparm_context *lp_ctx,
 685                   bool use_level25,
 686                   struct cli_credentials *admin_creds,
 687                   struct cli_credentials *wks_creds)
 688 {
 689         TALLOC_CTX *mem_ctx;
 690         NTSTATUS status;
 691         char *dom_name;
 692         struct dcerpc_pipe *samr_pipe;
 693         struct policy_handle *wks_handle;
 694         bool ret = false;
 695         NTTIME last_password_change;
 696
 697         if ((mem_ctx = talloc_init("join3")) == NULL) {
 698                 d_printf("talloc_init failed\n");
 699                 return false;
 700         }
 701
 702         status = get_usr_handle(
 703                 cli, mem_ctx, lp_ctx, admin_creds,
 704                 DCERPC_AUTH_TYPE_NTLMSSP,
 705                 DCERPC_AUTH_LEVEL_PRIVACY,
 706                 talloc_asprintf(mem_ctx, "%s$",
 707                                 cli_credentials_get_workstation(wks_creds)),
 708                 &dom_name, &samr_pipe, &wks_handle, NULL);
 709
 710         if (!NT_STATUS_IS_OK(status)) {
 711                 d_printf("get_wks_handle failed: %s\n", nt_errstr(status));
 712                 goto done;
 713         }
 714
 715         {
 716                 struct samr_QueryUserInfo q;
 717
 718                 q.in.user_handle = wks_handle;
 719                 q.in.level = 21;
 720
 721                 status = dcerpc_samr_QueryUserInfo(samr_pipe, mem_ctx, &q);
 722                 if (!NT_STATUS_IS_OK(status)) {
 723                         d_printf("(%s) QueryUserInfo failed: %s\n",
 724                                   __location__, nt_errstr(status));
 725                         goto done;
 726                 }
 727
 728                 last_password_change = q.out.info->info21.last_password_change;
 729         }
 730
 731         cli_credentials_set_domain(wks_creds, dom_name, CRED_SPECIFIED);
 732
 733         if (use_level25) {
 734                 struct samr_SetUserInfo2 sui2;
 735                 union samr_UserInfo u_info;
 736                 struct samr_UserInfo21 *i21 = &u_info.info25.info;
 737                 DATA_BLOB session_key;
 738                 DATA_BLOB confounded_session_key = data_blob_talloc(
 739                         mem_ctx, NULL, 16);
 740                 struct MD5Context ctx;
 741                 uint8_t confounder[16];
 742
 743                 ZERO_STRUCT(u_info);
 744
 745                 i21->full_name.string = talloc_asprintf(
 746                         mem_ctx, "%s$",
 747                         cli_credentials_get_workstation(wks_creds));
 748                 i21->acct_flags = ACB_WSTRUST;
 749                 i21->fields_present = SAMR_FIELD_FULL_NAME |
 750                         SAMR_FIELD_ACCT_FLAGS | SAMR_FIELD_PASSWORD;
 751
 752                 encode_pw_buffer(u_info.info25.password.data,
 753                                  cli_credentials_get_password(wks_creds),
 754                                  STR_UNICODE);
 755                 status = dcerpc_fetch_session_key(samr_pipe, &session_key);
 756                 if (!NT_STATUS_IS_OK(status)) {
 757                         d_printf("dcerpc_fetch_session_key failed: %s\n",
 758                                  nt_errstr(status));
 759                         goto done;
 760                 }
 761                 generate_random_buffer((uint8_t *)confounder, 16);
 762
 763                 MD5Init(&ctx);
 764                 MD5Update(&ctx, confounder, 16);
 765                 MD5Update(&ctx, session_key.data, session_key.length);
 766                 MD5Final(confounded_session_key.data, &ctx);
 767
 768                 arcfour_crypt_blob(u_info.info25.password.data, 516,
 769                                    &confounded_session_key);
 770                 memcpy(&u_info.info25.password.data[516], confounder, 16);
 771
 772                 sui2.in.user_handle = wks_handle;
 773                 sui2.in.level = 25;
 774                 sui2.in.info = &u_info;
 775
 776                 status = dcerpc_samr_SetUserInfo2(samr_pipe, mem_ctx, &sui2);
 777                 if (!NT_STATUS_IS_OK(status)) {
 778                         d_printf("samr_SetUserInfo2(25) failed: %s\n",
 779                                  nt_errstr(status));
 780                         goto done;
 781                 }
 782         } else {
 783                 struct samr_SetUserInfo2 sui2;
 784                 struct samr_SetUserInfo sui;
 785                 union samr_UserInfo u_info;
 786                 DATA_BLOB session_key;
 787
 788                 encode_pw_buffer(u_info.info24.password.data,
 789                                  cli_credentials_get_password(wks_creds),
 790                                  STR_UNICODE);
 791                 u_info.info24.pw_len =
 792                         strlen_m(cli_credentials_get_password(wks_creds))*2;
 793
 794                 status = dcerpc_fetch_session_key(samr_pipe, &session_key);
 795                 if (!NT_STATUS_IS_OK(status)) {
 796                         d_printf("dcerpc_fetch_session_key failed\n");
 797                         goto done;
 798                 }
 799                 arcfour_crypt_blob(u_info.info24.password.data, 516,
 800                                    &session_key);
 801                 sui2.in.user_handle = wks_handle;
 802                 sui2.in.info = &u_info;
 803                 sui2.in.level = 24;
 804
 805                 status = dcerpc_samr_SetUserInfo2(samr_pipe, mem_ctx, &sui2);
 806                 if (!NT_STATUS_IS_OK(status)) {
 807                         d_printf("samr_SetUserInfo(24) failed: %s\n",
 808                                  nt_errstr(status));
 809                         goto done;
 810                 }
 811
 812                 u_info.info16.acct_flags = ACB_WSTRUST;
 813                 sui.in.user_handle = wks_handle;
 814                 sui.in.info = &u_info;
 815                 sui.in.level = 16;
 816
 817                 status = dcerpc_samr_SetUserInfo(samr_pipe, mem_ctx, &sui);
 818                 if (!NT_STATUS_IS_OK(status)) {
 819                         d_printf("samr_SetUserInfo(16) failed\n");
 820                         goto done;
 821                 }
 822         }
 823
 824         {
 825                 struct samr_QueryUserInfo q;
 826
 827                 q.in.user_handle = wks_handle;
 828                 q.in.level = 21;
 829
 830                 status = dcerpc_samr_QueryUserInfo(samr_pipe, mem_ctx, &q);
 831                 if (!NT_STATUS_IS_OK(status)) {
 832                         d_printf("(%s) QueryUserInfo failed: %s\n",
 833                                   __location__, nt_errstr(status));
 834                         goto done;
 835                 }
 836
 837                 if (use_level25) {
 838                         if (last_password_change
 839                             == q.out.info->info21.last_password_change) {
 840                                 d_printf("(%s) last_password_change unchanged "
 841                                          "during join, level25 must change "
 842                                          "it\n", __location__);
 843                                 goto done;
 844                         }
 845                 }
 846                 else {
 847                         if (last_password_change
 848                             != q.out.info->info21.last_password_change) {
 849                                 d_printf("(%s) last_password_change changed "
 850                                          "during join, level24 doesn't "
 851                                          "change it\n", __location__);
 852                                 goto done;
 853                         }
 854                 }
 855         }
 856
 857         ret = true;
 858
 859  done:
 860         talloc_free(mem_ctx);
 861         return ret;
 862 }
 863
 864 /*
 865  * Do a ReqChallenge/Auth2 and get the wks creds
 866  */
 867
 868 static bool auth2(struct smbcli_state *cli,
 869                   struct loadparm_context *lp_ctx,
 870                   struct cli_credentials *wks_cred)
 871 {
 872         TALLOC_CTX *mem_ctx;
 873         struct dcerpc_pipe *net_pipe;
 874         bool result = false;
 875         NTSTATUS status;
 876         struct netr_ServerReqChallenge r;
 877         struct netr_Credential netr_cli_creds;
 878         struct netr_Credential netr_srv_creds;
 879         uint32_t negotiate_flags;
 880         struct netr_ServerAuthenticate2 a;
 881         struct creds_CredentialState *creds_state;
 882         struct netr_Credential netr_cred;
 883         struct samr_Password mach_pw;
 884
 885         mem_ctx = talloc_new(NULL);
 886         if (mem_ctx == NULL) {
 887                 d_printf("talloc_new failed\n");
 888                 return false;
 889         }
 890
 891         net_pipe = dcerpc_pipe_init(mem_ctx,
 892                                     cli->transport->socket->event.ctx,
 893                                     lp_iconv_convenience(lp_ctx));
 894         if (net_pipe == NULL) {
 895                 d_printf("dcerpc_pipe_init failed\n");
 896                 goto done;
 897         }
 898
 899         status = dcerpc_pipe_open_smb(net_pipe, cli->tree, "\\netlogon");
 900         if (!NT_STATUS_IS_OK(status)) {
 901                 d_printf("dcerpc_pipe_open_smb failed: %s\n",
 902                          nt_errstr(status));
 903                 goto done;
 904         }
 905
 906         status = dcerpc_bind_auth_none(net_pipe, &ndr_table_netlogon);
 907         if (!NT_STATUS_IS_OK(status)) {
 908                 d_printf("dcerpc_bind_auth_none failed: %s\n",
 909                          nt_errstr(status));
 910                 goto done;
 911         }
 912
 913         r.in.computer_name = cli_credentials_get_workstation(wks_cred);
 914         r.in.server_name = talloc_asprintf(
 915                 mem_ctx, "\\\\%s", dcerpc_server_name(net_pipe));
 916         if (r.in.server_name == NULL) {
 917                 d_printf("talloc_asprintf failed\n");
 918                 goto done;
 919         }
 920         generate_random_buffer(netr_cli_creds.data,
 921                                sizeof(netr_cli_creds.data));
 922         r.in.credentials = &netr_cli_creds;
 923         r.out.credentials = &netr_srv_creds;
 924
 925         status = dcerpc_netr_ServerReqChallenge(net_pipe, mem_ctx, &r);
 926         if (!NT_STATUS_IS_OK(status)) {
 927                 d_printf("netr_ServerReqChallenge failed: %s\n",
 928                          nt_errstr(status));
 929                 goto done;
 930         }
 931
 932         negotiate_flags = NETLOGON_NEG_AUTH2_FLAGS;
 933         E_md4hash(cli_credentials_get_password(wks_cred), mach_pw.hash);
 934
 935         creds_state = talloc(mem_ctx, struct creds_CredentialState);
 936         creds_client_init(creds_state, r.in.credentials,
 937                           r.out.credentials, &mach_pw,
 938                           &netr_cred, negotiate_flags);
 939
 940         a.in.server_name = talloc_asprintf(
 941                 mem_ctx, "\\\\%s", dcerpc_server_name(net_pipe));
 942         a.in.account_name = talloc_asprintf(
 943                 mem_ctx, "%s$", cli_credentials_get_workstation(wks_cred));
 944         a.in.computer_name = cli_credentials_get_workstation(wks_cred);
 945         a.in.secure_channel_type = SEC_CHAN_WKSTA;
 946         a.in.negotiate_flags = &negotiate_flags;
 947         a.out.negotiate_flags = &negotiate_flags;
 948         a.in.credentials = &netr_cred;
 949         a.out.credentials = &netr_cred;
 950
 951         status = dcerpc_netr_ServerAuthenticate2(net_pipe, mem_ctx, &a);
 952         if (!NT_STATUS_IS_OK(status)) {
 953                 d_printf("netr_ServerServerAuthenticate2 failed: %s\n",
 954                          nt_errstr(status));
 955                 goto done;
 956         }
 957
 958         if (!creds_client_check(creds_state, a.out.credentials)) {
 959                 d_printf("creds_client_check failed\n");
 960                 goto done;
 961         }
 962
 963         cli_credentials_set_netlogon_creds(wks_cred, creds_state);
 964
 965         result = true;
 966
 967  done:
 968         talloc_free(mem_ctx);
 969         return result;
 970 }
 971
 972 /*
 973  * Do a couple of schannel protected Netlogon ops: Interactive and Network
 974  * login, and change the wks password
 975  */
 976
 977 static bool schan(struct smbcli_state *cli,
 978                   struct loadparm_context *lp_ctx,
 979                   struct cli_credentials *wks_creds,
 980                   struct cli_credentials *user_creds)
 981 {
 982         TALLOC_CTX *mem_ctx;
 983         NTSTATUS status;
 984         bool ret = false;
 985         struct dcerpc_pipe *net_pipe;
 986         int i;
 987
 988         mem_ctx = talloc_new(NULL);
 989         if (mem_ctx == NULL) {
 990                 d_printf("talloc_new failed\n");
 991                 return false;
 992         }
 993
 994         net_pipe = dcerpc_pipe_init(mem_ctx,
 995                                     cli->transport->socket->event.ctx,
 996                                     lp_iconv_convenience(lp_ctx));
 997         if (net_pipe == NULL) {
 998                 d_printf("dcerpc_pipe_init failed\n");
 999                 goto done;
1000         }
1001
1002         status = dcerpc_pipe_open_smb(net_pipe, cli->tree, "\\netlogon");
1003         if (!NT_STATUS_IS_OK(status)) {
1004                 d_printf("dcerpc_pipe_open_smb failed: %s\n",
1005                          nt_errstr(status));
1006                 goto done;
1007         }
1008
1009 #if 0
1010         net_pipe->conn->flags |= DCERPC_DEBUG_PRINT_IN |
1011                 DCERPC_DEBUG_PRINT_OUT;
1012 #endif
1013 #if 1
1014         net_pipe->conn->flags |= (DCERPC_SIGN | DCERPC_SEAL);
1015         status = dcerpc_bind_auth(net_pipe, &ndr_table_netlogon,
1016                                   wks_creds, lp_ctx, DCERPC_AUTH_TYPE_SCHANNEL,
1017                                   DCERPC_AUTH_LEVEL_PRIVACY,
1018                                   NULL);
1019 #else
1020         status = dcerpc_bind_auth_none(net_pipe, &ndr_table_netlogon);
1021 #endif
1022         if (!NT_STATUS_IS_OK(status)) {
1023                 d_printf("schannel bind failed: %s\n", nt_errstr(status));
1024                 goto done;
1025         }
1026
1027
1028         for (i=2; i<4; i++) {
1029                 int flags;
1030                 DATA_BLOB chal, nt_resp, lm_resp, names_blob, session_key;
1031                 struct creds_CredentialState *creds_state;
1032                 struct netr_Authenticator netr_auth, netr_auth2;
1033                 struct netr_NetworkInfo ninfo;
1034                 struct netr_PasswordInfo pinfo;
1035                 struct netr_LogonSamLogon r;
1036
1037                 flags = CLI_CRED_LANMAN_AUTH | CLI_CRED_NTLM_AUTH |
1038                         CLI_CRED_NTLMv2_AUTH;
1039
1040                 chal = data_blob_talloc(mem_ctx, NULL, 8);
1041                 if (chal.data == NULL) {
1042                         d_printf("data_blob_talloc failed\n");
1043                         goto done;
1044                 }
1045
1046                 generate_random_buffer(chal.data, chal.length);
1047                 names_blob = NTLMv2_generate_names_blob(
1048                         mem_ctx,
1049                         cli_credentials_get_workstation(user_creds),
1050                         cli_credentials_get_domain(user_creds));
1051                 status = cli_credentials_get_ntlm_response(
1052                         user_creds, mem_ctx, &flags, chal, names_blob,
1053                         &lm_resp, &nt_resp, NULL, NULL);
1054                 if (!NT_STATUS_IS_OK(status)) {
1055                         d_printf("cli_credentials_get_ntlm_response failed:"
1056                                  " %s\n", nt_errstr(status));
1057                         goto done;
1058                 }
1059
1060                 creds_state = cli_credentials_get_netlogon_creds(wks_creds);
1061                 creds_client_authenticator(creds_state, &netr_auth);
1062
1063                 ninfo.identity_info.account_name.string =
1064                         cli_credentials_get_username(user_creds);
1065                 ninfo.identity_info.domain_name.string =
1066                         cli_credentials_get_domain(user_creds);
1067                 ninfo.identity_info.parameter_control = 0;
1068                 ninfo.identity_info.logon_id_low = 0;
1069                 ninfo.identity_info.logon_id_high = 0;
1070                 ninfo.identity_info.workstation.string =
1071                         cli_credentials_get_workstation(user_creds);
1072                 memcpy(ninfo.challenge, chal.data, sizeof(ninfo.challenge));
1073                 ninfo.nt.length = nt_resp.length;
1074                 ninfo.nt.data = nt_resp.data;
1075                 ninfo.lm.length = lm_resp.length;
1076                 ninfo.lm.data = lm_resp.data;
1077
1078                 r.in.server_name = talloc_asprintf(
1079                         mem_ctx, "\\\\%s", dcerpc_server_name(net_pipe));
1080                 ZERO_STRUCT(netr_auth2);
1081                 r.in.computer_name =
1082                         cli_credentials_get_workstation(wks_creds);
1083                 r.in.credential = &netr_auth;
1084                 r.in.return_authenticator = &netr_auth2;
1085                 r.in.logon_level = 2;
1086                 r.in.validation_level = i;
1087                 r.in.logon.network = &ninfo;
1088                 r.out.return_authenticator = NULL;
1089
1090                 status = dcerpc_netr_LogonSamLogon(net_pipe, mem_ctx, &r);
1091                 if (!NT_STATUS_IS_OK(status)) {
1092                         d_printf("netr_LogonSamLogon failed: %s\n",
1093                                  nt_errstr(status));
1094                         goto done;
1095                 }
1096
1097                 if ((r.out.return_authenticator == NULL) ||
1098                     (!creds_client_check(creds_state,
1099                                          &r.out.return_authenticator->cred))) {
1100                         d_printf("Credentials check failed!\n");
1101                         goto done;
1102                 }
1103
1104                 creds_client_authenticator(creds_state, &netr_auth);
1105
1106                 pinfo.identity_info = ninfo.identity_info;
1107                 ZERO_STRUCT(pinfo.lmpassword.hash);
1108                 E_md4hash(cli_credentials_get_password(user_creds),
1109                           pinfo.ntpassword.hash);
1110                 session_key = data_blob_talloc(mem_ctx,
1111                                                creds_state->session_key, 16);
1112                 arcfour_crypt_blob(pinfo.ntpassword.hash,
1113                                    sizeof(pinfo.ntpassword.hash),
1114                                    &session_key);
1115
1116                 r.in.logon_level = 1;
1117                 r.in.logon.password = &pinfo;
1118                 r.out.return_authenticator = NULL;
1119
1120                 status = dcerpc_netr_LogonSamLogon(net_pipe, mem_ctx, &r);
1121                 if (!NT_STATUS_IS_OK(status)) {
1122                         d_printf("netr_LogonSamLogon failed: %s\n",
1123                                  nt_errstr(status));
1124                         goto done;
1125                 }
1126
1127                 if ((r.out.return_authenticator == NULL) ||
1128                     (!creds_client_check(creds_state,
1129                                          &r.out.return_authenticator->cred))) {
1130                         d_printf("Credentials check failed!\n");
1131                         goto done;
1132                 }
1133         }
1134
1135         {
1136                 struct netr_ServerPasswordSet s;
1137                 char *password = generate_random_str(wks_creds, 8);
1138                 struct creds_CredentialState *creds_state;
1139
1140                 s.in.server_name = talloc_asprintf(
1141                         mem_ctx, "\\\\%s", dcerpc_server_name(net_pipe));
1142                 s.in.computer_name = cli_credentials_get_workstation(wks_creds);
1143                 s.in.account_name = talloc_asprintf(
1144                         mem_ctx, "%s$", s.in.computer_name);
1145                 s.in.secure_channel_type = SEC_CHAN_WKSTA;
1146                 E_md4hash(password, s.in.new_password.hash);
1147
1148                 creds_state = cli_credentials_get_netlogon_creds(wks_creds);
1149                 creds_des_encrypt(creds_state, &s.in.new_password);
1150                 creds_client_authenticator(creds_state, &s.in.credential);
1151
1152                 status = dcerpc_netr_ServerPasswordSet(net_pipe, mem_ctx, &s);
1153                 if (!NT_STATUS_IS_OK(status)) {
1154                         printf("ServerPasswordSet - %s\n", nt_errstr(status));
1155                         goto done;
1156                 }
1157
1158                 if (!creds_client_check(creds_state,
1159                                         &s.out.return_authenticator.cred)) {
1160                         printf("Credential chaining failed\n");
1161                 }
1162
1163                 cli_credentials_set_password(wks_creds, password,
1164                                              CRED_SPECIFIED);
1165         }
1166
1167         ret = true;
1168  done:
1169         talloc_free(mem_ctx);
1170         return ret;
1171 }
1172
1173 /*
1174  * Delete the wks account again
1175  */
1176
1177 static bool leave(struct smbcli_state *cli,
1178                   struct loadparm_context *lp_ctx,
1179                   struct cli_credentials *admin_creds,
1180                   struct cli_credentials *wks_creds)
1181 {
1182         char *wks_name = talloc_asprintf(
1183                 NULL, "%s$", cli_credentials_get_workstation(wks_creds));
1184         bool ret;
1185
1186         ret = delete_user(cli, lp_ctx, admin_creds, wks_name);
1187         talloc_free(wks_name);
1188         return ret;
1189 }
1190
1191 /*
1192  * Test the Samba3 DC code a bit. Join, do some schan netlogon ops, leave
1193  */
1194
1195 bool torture_netlogon_samba3(struct torture_context *torture)
1196 {
1197         TALLOC_CTX *mem_ctx;
1198         NTSTATUS status;
1199         bool ret = false;
1200         struct smbcli_state *cli;
1201         struct cli_credentials *anon_creds;
1202         struct cli_credentials *wks_creds;
1203         const char *wks_name;
1204         int i;
1205         struct smbcli_options options;
1206         struct smbcli_session_options session_options;
1207
1208         wks_name = torture_setting_string(torture, "wksname", NULL);
1209         if (wks_name == NULL) {
1210                 wks_name = get_myname();
1211         }
1212
1213         mem_ctx = talloc_init("torture_netlogon_samba3");
1214
1215         if (mem_ctx == NULL) {
1216                 d_printf("talloc_init failed\n");
1217                 return false;
1218         }
1219
1220         if (!(anon_creds = cli_credentials_init_anon(mem_ctx))) {
1221                 d_printf("create_anon_creds failed\n");
1222                 goto done;
1223         }
1224
1225         lp_smbcli_options(torture->lp_ctx, &options);
1226         lp_smbcli_session_options(torture->lp_ctx, &session_options);
1227
1228         status = smbcli_full_connection(mem_ctx, &cli,
1229                                         torture_setting_string(torture, "host", NULL),
1230                                         lp_smb_ports(torture->lp_ctx),
1231                                         "IPC$", NULL, anon_creds,
1232                                         lp_resolve_context(torture->lp_ctx),
1233                                         torture->ev, &options, &session_options,
1234                                         lp_iconv_convenience(torture->lp_ctx));
1235         if (!NT_STATUS_IS_OK(status)) {
1236                 d_printf("smbcli_full_connection failed: %s\n",
1237                          nt_errstr(status));
1238                 goto done;
1239         }
1240
1241         wks_creds = cli_credentials_init(mem_ctx);
1242         if (wks_creds == NULL) {
1243                 d_printf("cli_credentials_init failed\n");
1244                 goto done;
1245         }
1246
1247         cli_credentials_set_conf(wks_creds, torture->lp_ctx);
1248         cli_credentials_set_secure_channel_type(wks_creds, SEC_CHAN_WKSTA);
1249         cli_credentials_set_username(wks_creds, wks_name, CRED_SPECIFIED);
1250         cli_credentials_set_workstation(wks_creds, wks_name, CRED_SPECIFIED);
1251         cli_credentials_set_password(wks_creds,
1252                                      generate_random_str(wks_creds, 8),
1253                                      CRED_SPECIFIED);
1254
1255         if (!join3(cli, torture->lp_ctx, false, cmdline_credentials, wks_creds)) {
1256                 d_printf("join failed\n");
1257                 goto done;
1258         }
1259
1260         cli_credentials_set_domain(
1261                 cmdline_credentials, cli_credentials_get_domain(wks_creds),
1262                 CRED_SPECIFIED);
1263
1264         for (i=0; i<2; i++) {
1265
1266                 /* Do this more than once, the routine "schan" changes
1267                  * the workstation password using the netlogon
1268                  * password change routine */
1269
1270                 int j;
1271
1272                 if (!auth2(cli, torture->lp_ctx, wks_creds)) {
1273                         d_printf("auth2 failed\n");
1274                         goto done;
1275                 }
1276
1277                 for (j=0; j<2; j++) {
1278                         if (!schan(cli, torture->lp_ctx, wks_creds, cmdline_credentials)) {
1279                                 d_printf("schan failed\n");
1280                                 goto done;
1281                         }
1282                 }
1283         }
1284
1285         if (!leave(cli, torture->lp_ctx, cmdline_credentials, wks_creds)) {
1286                 d_printf("leave failed\n");
1287                 goto done;
1288         }
1289
1290         ret = true;
1291
1292  done:
1293         talloc_free(mem_ctx);
1294         return ret;
1295 }
1296
1297 /*
1298  * Do a simple join, testjoin and leave using specified smb and samr
1299  * credentials
1300  */
1301
1302 static bool test_join3(struct torture_context *tctx,
1303                        bool use_level25,
1304                        struct cli_credentials *smb_creds,
1305                        struct cli_credentials *samr_creds,
1306                        const char *wks_name)
1307 {
1308         NTSTATUS status;
1309         bool ret = false;
1310         struct smbcli_state *cli;
1311         struct cli_credentials *wks_creds;
1312         struct smbcli_options options;
1313         struct smbcli_session_options session_options;
1314
1315         lp_smbcli_options(tctx->lp_ctx, &options);
1316         lp_smbcli_session_options(tctx->lp_ctx, &session_options);
1317
1318         status = smbcli_full_connection(tctx, &cli,
1319                                         torture_setting_string(tctx, "host", NULL),
1320                                         lp_smb_ports(tctx->lp_ctx),
1321                                         "IPC$", NULL, smb_creds,
1322                                         lp_resolve_context(tctx->lp_ctx),
1323                                         tctx->ev, &options, &session_options,
1324                                         lp_iconv_convenience(tctx->lp_ctx));
1325         if (!NT_STATUS_IS_OK(status)) {
1326                 d_printf("smbcli_full_connection failed: %s\n",
1327                          nt_errstr(status));
1328                 goto done;
1329         }
1330
1331         wks_creds = cli_credentials_init(cli);
1332         if (wks_creds == NULL) {
1333                 d_printf("cli_credentials_init failed\n");
1334                 goto done;
1335         }
1336
1337         cli_credentials_set_conf(wks_creds, tctx->lp_ctx);
1338         cli_credentials_set_secure_channel_type(wks_creds, SEC_CHAN_WKSTA);
1339         cli_credentials_set_username(wks_creds, wks_name, CRED_SPECIFIED);
1340         cli_credentials_set_workstation(wks_creds, wks_name, CRED_SPECIFIED);
1341         cli_credentials_set_password(wks_creds,
1342                                      generate_random_str(wks_creds, 8),
1343                                      CRED_SPECIFIED);
1344
1345         if (!join3(cli, tctx->lp_ctx, use_level25, samr_creds, wks_creds)) {
1346                 d_printf("join failed\n");
1347                 goto done;
1348         }
1349
1350         cli_credentials_set_domain(
1351                 cmdline_credentials, cli_credentials_get_domain(wks_creds),
1352                 CRED_SPECIFIED);
1353
1354         if (!auth2(cli, tctx->lp_ctx, wks_creds)) {
1355                 d_printf("auth2 failed\n");
1356                 goto done;
1357         }
1358
1359         if (!leave(cli, tctx->lp_ctx, samr_creds, wks_creds)) {
1360                 d_printf("leave failed\n");
1361                 goto done;
1362         }
1363
1364         talloc_free(cli);
1365
1366         ret = true;
1367
1368  done:
1369         return ret;
1370 }
1371
1372 /*
1373  * Test the different session key variants. Do it by joining, this uses the
1374  * session key in the setpassword routine. Test the join by doing the auth2.
1375  */
1376
1377 bool torture_samba3_sessionkey(struct torture_context *torture)
1378 {
1379         bool ret = false;
1380         struct cli_credentials *anon_creds;
1381         const char *wks_name;
1382
1383         wks_name = torture_setting_string(torture, "wksname", get_myname());
1384
1385         if (!(anon_creds = cli_credentials_init_anon(torture))) {
1386                 d_printf("create_anon_creds failed\n");
1387                 goto done;
1388         }
1389
1390         cli_credentials_set_workstation(anon_creds, wks_name, CRED_SPECIFIED);
1391
1392         ret = true;
1393
1394         if (!torture_setting_bool(torture, "samba3", false)) {
1395
1396                 /* Samba3 in the build farm right now does this happily. Need
1397                  * to fix :-) */
1398
1399                 if (test_join3(torture, false, anon_creds, NULL, wks_name)) {
1400                         d_printf("join using anonymous bind on an anonymous smb "
1401                                  "connection succeeded -- HUH??\n");
1402                         ret = false;
1403                 }
1404         }
1405
1406         if (!test_join3(torture, false, anon_creds, cmdline_credentials,
1407                         wks_name)) {
1408                 d_printf("join using ntlmssp bind on an anonymous smb "
1409                          "connection failed\n");
1410                 ret = false;
1411         }
1412
1413         if (!test_join3(torture, false, cmdline_credentials, NULL, wks_name)) {
1414                 d_printf("join using anonymous bind on an authenticated smb "
1415                          "connection failed\n");
1416                 ret = false;
1417         }
1418
1419         if (!test_join3(torture, false, cmdline_credentials,
1420                         cmdline_credentials,
1421                         wks_name)) {
1422                 d_printf("join using ntlmssp bind on an authenticated smb "
1423                          "connection failed\n");
1424                 ret = false;
1425         }
1426
1427         /*
1428          * The following two are tests for setuserinfolevel 25
1429          */
1430
1431         if (!test_join3(torture, true, anon_creds, cmdline_credentials,
1432                         wks_name)) {
1433                 d_printf("join using ntlmssp bind on an anonymous smb "
1434                          "connection failed\n");
1435                 ret = false;
1436         }
1437
1438         if (!test_join3(torture, true, cmdline_credentials, NULL, wks_name)) {
1439                 d_printf("join using anonymous bind on an authenticated smb "
1440                          "connection failed\n");
1441                 ret = false;
1442         }
1443
1444  done:
1445
1446         return ret;
1447 }
1448
1449 /*
1450  * open pipe and bind, given an IPC$ context
1451  */
1452
1453 static NTSTATUS pipe_bind_smb(TALLOC_CTX *mem_ctx,
1454                               struct loadparm_context *lp_ctx,
1455                               struct smbcli_tree *tree,
1456                               const char *pipe_name,
1457                               const struct ndr_interface_table *iface,
1458                               struct dcerpc_pipe **p)
1459 {
1460         struct dcerpc_pipe *result;
1461         NTSTATUS status;
1462
1463         if (!(result = dcerpc_pipe_init(
1464                       mem_ctx, tree->session->transport->socket->event.ctx,
1465                       lp_iconv_convenience(lp_ctx)))) {
1466                 return NT_STATUS_NO_MEMORY;
1467         }
1468
1469         status = dcerpc_pipe_open_smb(result, tree, pipe_name);
1470         if (!NT_STATUS_IS_OK(status)) {
1471                 d_printf("dcerpc_pipe_open_smb failed: %s\n",
1472                          nt_errstr(status));
1473                 talloc_free(result);
1474                 return status;
1475         }
1476
1477         status = dcerpc_bind_auth_none(result, iface);
1478         if (!NT_STATUS_IS_OK(status)) {
1479                 d_printf("schannel bind failed: %s\n", nt_errstr(status));
1480                 talloc_free(result);
1481                 return status;
1482         }
1483
1484         *p = result;
1485         return NT_STATUS_OK;
1486 }
1487
1488 /*
1489  * Sane wrapper around lsa_LookupNames
1490  */
1491
1492 static struct dom_sid *name2sid(TALLOC_CTX *mem_ctx,
1493                                 struct dcerpc_pipe *p,
1494                                 const char *name,
1495                                 const char *domain)
1496 {
1497         struct lsa_ObjectAttribute attr;
1498         struct lsa_QosInfo qos;
1499         struct lsa_OpenPolicy2 r;
1500         struct lsa_Close c;
1501         NTSTATUS status;
1502         struct policy_handle handle;
1503         struct lsa_LookupNames l;
1504         struct lsa_TransSidArray sids;
1505         struct lsa_RefDomainList *domains = NULL;
1506         struct lsa_String lsa_name;
1507         uint32_t count = 0;
1508         struct dom_sid *result;
1509         TALLOC_CTX *tmp_ctx;
1510
1511         if (!(tmp_ctx = talloc_new(mem_ctx))) {
1512                 return NULL;
1513         }
1514
1515         qos.len = 0;
1516         qos.impersonation_level = 2;
1517         qos.context_mode = 1;
1518         qos.effective_only = 0;
1519
1520         attr.len = 0;
1521         attr.root_dir = NULL;
1522         attr.object_name = NULL;
1523         attr.attributes = 0;
1524         attr.sec_desc = NULL;
1525         attr.sec_qos = &qos;
1526
1527         r.in.system_name = "\\";
1528         r.in.attr = &attr;
1529         r.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
1530         r.out.handle = &handle;
1531
1532         status = dcerpc_lsa_OpenPolicy2(p, tmp_ctx, &r);
1533         if (!NT_STATUS_IS_OK(status)) {
1534                 printf("OpenPolicy2 failed - %s\n", nt_errstr(status));
1535                 talloc_free(tmp_ctx);
1536                 return NULL;
1537         }
1538
1539         sids.count = 0;
1540         sids.sids = NULL;
1541
1542         lsa_name.string = talloc_asprintf(tmp_ctx, "%s\\%s", domain, name);
1543
1544         l.in.handle = &handle;
1545         l.in.num_names = 1;
1546         l.in.names = &lsa_name;
1547         l.in.sids = &sids;
1548         l.in.level = 1;
1549         l.in.count = &count;
1550         l.out.count = &count;
1551         l.out.sids = &sids;
1552         l.out.domains = &domains;
1553
1554         status = dcerpc_lsa_LookupNames(p, tmp_ctx, &l);
1555         if (!NT_STATUS_IS_OK(status)) {
1556                 printf("LookupNames of %s failed - %s\n", lsa_name.string,
1557                        nt_errstr(status));
1558                 talloc_free(tmp_ctx);
1559                 return NULL;
1560         }
1561
1562         result = dom_sid_add_rid(mem_ctx, domains->domains[0].sid,
1563                                  l.out.sids->sids[0].rid);
1564
1565         c.in.handle = &handle;
1566         c.out.handle = &handle;
1567
1568         status = dcerpc_lsa_Close(p, tmp_ctx, &c);
1569         if (!NT_STATUS_IS_OK(status)) {
1570                 printf("dcerpc_lsa_Close failed - %s\n", nt_errstr(status));
1571                 talloc_free(tmp_ctx);
1572                 return NULL;
1573         }
1574
1575         talloc_free(tmp_ctx);
1576         return result;
1577 }
1578
1579 /*
1580  * Find out the user SID on this connection
1581  */
1582
1583 static struct dom_sid *whoami(TALLOC_CTX *mem_ctx,
1584                               struct loadparm_context *lp_ctx,
1585                               struct smbcli_tree *tree)
1586 {
1587         struct dcerpc_pipe *lsa;
1588         struct lsa_GetUserName r;
1589         NTSTATUS status;
1590         struct lsa_String *authority_name_p = NULL;
1591         struct lsa_String *account_name_p = NULL;
1592         struct dom_sid *result;
1593
1594         status = pipe_bind_smb(mem_ctx, lp_ctx, tree, "\\pipe\\lsarpc",
1595                                &ndr_table_lsarpc, &lsa);
1596         if (!NT_STATUS_IS_OK(status)) {
1597                 d_printf("(%s) Could not bind to LSA: %s\n",
1598                          __location__, nt_errstr(status));
1599                 return NULL;
1600         }
1601
1602         r.in.system_name = "\\";
1603         r.in.account_name = &account_name_p;
1604         r.in.authority_name = &authority_name_p;
1605         r.out.account_name = &account_name_p;
1606
1607         status = dcerpc_lsa_GetUserName(lsa, mem_ctx, &r);
1608
1609         authority_name_p = *r.out.authority_name;
1610
1611         if (!NT_STATUS_IS_OK(status)) {
1612                 printf("(%s) GetUserName failed - %s\n",
1613                        __location__, nt_errstr(status));
1614                 talloc_free(lsa);
1615                 return NULL;
1616         }
1617
1618         result = name2sid(mem_ctx, lsa, account_name_p->string,
1619                           authority_name_p->string);
1620
1621         talloc_free(lsa);
1622         return result;
1623 }
1624
1625 static int destroy_tree(struct smbcli_tree *tree)
1626 {
1627         smb_tree_disconnect(tree);
1628         return 0;
1629 }
1630
1631 /*
1632  * Do a tcon, given a session
1633  */
1634
1635 NTSTATUS secondary_tcon(TALLOC_CTX *mem_ctx,
1636                         struct smbcli_session *session,
1637                         const char *sharename,
1638                         struct smbcli_tree **res)
1639 {
1640         struct smbcli_tree *result;
1641         TALLOC_CTX *tmp_ctx;
1642         union smb_tcon tcon;
1643         NTSTATUS status;
1644
1645         if (!(tmp_ctx = talloc_new(mem_ctx))) {
1646                 return NT_STATUS_NO_MEMORY;
1647         }
1648
1649         if (!(result = smbcli_tree_init(session, mem_ctx, false))) {
1650                 talloc_free(tmp_ctx);
1651                 return NT_STATUS_NO_MEMORY;
1652         }
1653
1654         tcon.generic.level = RAW_TCON_TCONX;
1655         tcon.tconx.in.flags = 0;
1656         tcon.tconx.in.password = data_blob(NULL, 0);
1657         tcon.tconx.in.path = sharename;
1658         tcon.tconx.in.device = "?????";
1659
1660         status = smb_raw_tcon(result, tmp_ctx, &tcon);
1661         if (!NT_STATUS_IS_OK(status)) {
1662                 d_printf("(%s) smb_raw_tcon failed: %s\n", __location__,
1663                          nt_errstr(status));
1664                 talloc_free(tmp_ctx);
1665                 return status;
1666         }
1667
1668         result->tid = tcon.tconx.out.tid;
1669         result = talloc_steal(mem_ctx, result);
1670         talloc_set_destructor(result, destroy_tree);
1671         talloc_free(tmp_ctx);
1672         *res = result;
1673         return NT_STATUS_OK;
1674 }
1675
1676 /*
1677  * Test the getusername behaviour
1678  */
1679
1680 bool torture_samba3_rpc_getusername(struct torture_context *torture)
1681 {
1682         NTSTATUS status;
1683         struct smbcli_state *cli;
1684         TALLOC_CTX *mem_ctx;
1685         bool ret = true;
1686         struct dom_sid *user_sid;
1687         struct dom_sid *created_sid;
1688         struct cli_credentials *anon_creds;
1689         struct cli_credentials *user_creds;
1690         char *domain_name;
1691         struct smbcli_options options;
1692         struct smbcli_session_options session_options;
1693
1694         if (!(mem_ctx = talloc_new(torture))) {
1695                 return false;
1696         }
1697
1698         lp_smbcli_options(torture->lp_ctx, &options);
1699         lp_smbcli_session_options(torture->lp_ctx, &session_options);
1700
1701         status = smbcli_full_connection(
1702                 mem_ctx, &cli, torture_setting_string(torture, "host", NULL),
1703                 lp_smb_ports(torture->lp_ctx),
1704                 "IPC$", NULL, cmdline_credentials,
1705                 lp_resolve_context(torture->lp_ctx),
1706                 torture->ev, &options, &session_options,
1707                 lp_iconv_convenience(torture->lp_ctx));
1708         if (!NT_STATUS_IS_OK(status)) {
1709                 d_printf("(%s) smbcli_full_connection failed: %s\n",
1710                          __location__, nt_errstr(status));
1711                 ret = false;
1712                 goto done;
1713         }
1714
1715         if (!(user_sid = whoami(mem_ctx, torture->lp_ctx, cli->tree))) {
1716                 d_printf("(%s) whoami on auth'ed connection failed\n",
1717                          __location__);
1718                 ret = false;
1719         }
1720
1721         talloc_free(cli);
1722
1723         if (!(anon_creds = cli_credentials_init_anon(mem_ctx))) {
1724                 d_printf("(%s) create_anon_creds failed\n", __location__);
1725                 ret = false;
1726                 goto done;
1727         }
1728
1729         status = smbcli_full_connection(
1730                 mem_ctx, &cli, torture_setting_string(torture, "host", NULL),
1731                 lp_smb_ports(torture->lp_ctx),
1732                 "IPC$", NULL, anon_creds,
1733                 lp_resolve_context(torture->lp_ctx),
1734                 torture->ev, &options, &session_options,
1735                 lp_iconv_convenience(torture->lp_ctx));
1736         if (!NT_STATUS_IS_OK(status)) {
1737                 d_printf("(%s) anon smbcli_full_connection failed: %s\n",
1738                          __location__, nt_errstr(status));
1739                 ret = false;
1740                 goto done;
1741         }
1742
1743         if (!(user_sid = whoami(mem_ctx, torture->lp_ctx, cli->tree))) {
1744                 d_printf("(%s) whoami on anon connection failed\n",
1745                          __location__);
1746                 ret = false;
1747                 goto done;
1748         }
1749
1750         if (!dom_sid_equal(user_sid,
1751                            dom_sid_parse_talloc(mem_ctx, "s-1-5-7"))) {
1752                 d_printf("(%s) Anon lsa_GetUserName returned %s, expected "
1753                          "S-1-5-7", __location__,
1754                          dom_sid_string(mem_ctx, user_sid));
1755                 ret = false;
1756         }
1757
1758         if (!(user_creds = cli_credentials_init(mem_ctx))) {
1759                 d_printf("(%s) cli_credentials_init failed\n", __location__);
1760                 ret = false;
1761                 goto done;
1762         }
1763
1764         cli_credentials_set_conf(user_creds, torture->lp_ctx);
1765         cli_credentials_set_username(user_creds, "torture_username",
1766                                      CRED_SPECIFIED);
1767         cli_credentials_set_password(user_creds,
1768                                      generate_random_str(user_creds, 8),
1769                                      CRED_SPECIFIED);
1770
1771         if (!create_user(mem_ctx, cli, torture->lp_ctx, cmdline_credentials,
1772                          cli_credentials_get_username(user_creds),
1773                          cli_credentials_get_password(user_creds),
1774                          &domain_name, &created_sid)) {
1775                 d_printf("(%s) create_user failed\n", __location__);
1776                 ret = false;
1777                 goto done;
1778         }
1779
1780         cli_credentials_set_domain(user_creds, domain_name,
1781                                    CRED_SPECIFIED);
1782
1783         {
1784                 struct smbcli_session *session2;
1785                 struct smb_composite_sesssetup setup;
1786                 struct smbcli_tree *tree;
1787
1788                 session2 = smbcli_session_init(cli->transport, mem_ctx, false, session_options);
1789                 if (session2 == NULL) {
1790                         d_printf("(%s) smbcli_session_init failed\n",
1791                                  __location__);
1792                         goto done;
1793                 }
1794
1795                 setup.in.sesskey = cli->transport->negotiate.sesskey;
1796                 setup.in.capabilities = cli->transport->negotiate.capabilities;
1797                 setup.in.workgroup = "";
1798                 setup.in.credentials = user_creds;
1799
1800                 status = smb_composite_sesssetup(session2, &setup);
1801                 if (!NT_STATUS_IS_OK(status)) {
1802                         d_printf("(%s) session setup with new user failed: "
1803                                  "%s\n", __location__, nt_errstr(status));
1804                         ret = false;
1805                         goto done;
1806                 }
1807                 session2->vuid = setup.out.vuid;
1808
1809                 if (!NT_STATUS_IS_OK(secondary_tcon(mem_ctx, session2,
1810                                                     "IPC$", &tree))) {
1811                         d_printf("(%s) secondary_tcon failed\n",
1812                                  __location__);
1813                         ret = false;
1814                         goto done;
1815                 }
1816
1817                 if (!(user_sid = whoami(mem_ctx, torture->lp_ctx, tree))) {
1818                         d_printf("(%s) whoami on user connection failed\n",
1819                                  __location__);
1820                         ret = false;
1821                         goto delete;
1822                 }
1823
1824                 talloc_free(tree);
1825         }
1826
1827         d_printf("Created %s, found %s\n",
1828                  dom_sid_string(mem_ctx, created_sid),
1829                  dom_sid_string(mem_ctx, user_sid));
1830
1831         if (!dom_sid_equal(created_sid, user_sid)) {
1832                 ret = false;
1833         }
1834
1835  delete:
1836         if (!delete_user(cli, torture->lp_ctx,
1837                          cmdline_credentials,
1838                          cli_credentials_get_username(user_creds))) {
1839                 d_printf("(%s) delete_user failed\n", __location__);
1840                 ret = false;
1841         }
1842
1843  done:
1844         talloc_free(mem_ctx);
1845         return ret;
1846 }
1847
1848 static bool test_NetShareGetInfo(struct dcerpc_pipe *p, TALLOC_CTX *mem_ctx,
1849                                  const char *sharename)
1850 {
1851         NTSTATUS status;
1852         struct srvsvc_NetShareGetInfo r;
1853         uint32_t levels[] = { 0, 1, 2, 501, 502, 1004, 1005, 1006, 1007, 1501 };
1854         int i;
1855         bool ret = true;
1856
1857         r.in.server_unc = talloc_asprintf(mem_ctx, "\\\\%s",
1858                                           dcerpc_server_name(p));
1859         r.in.share_name = sharename;
1860
1861         for (i=0;i<ARRAY_SIZE(levels);i++) {
1862                 r.in.level = levels[i];
1863
1864                 ZERO_STRUCT(r.out);
1865
1866                 printf("testing NetShareGetInfo level %u on share '%s'\n",
1867                        r.in.level, r.in.share_name);
1868
1869                 status = dcerpc_srvsvc_NetShareGetInfo(p, mem_ctx, &r);
1870                 if (!NT_STATUS_IS_OK(status)) {
1871                         printf("NetShareGetInfo level %u on share '%s' failed"
1872                                " - %s\n", r.in.level, r.in.share_name,
1873                                nt_errstr(status));
1874                         ret = false;
1875                         continue;
1876                 }
1877                 if (!W_ERROR_IS_OK(r.out.result)) {
1878                         printf("NetShareGetInfo level %u on share '%s' failed "
1879                                "- %s\n", r.in.level, r.in.share_name,
1880                                win_errstr(r.out.result));
1881                         ret = false;
1882                         continue;
1883                 }
1884         }
1885
1886         return ret;
1887 }
1888
1889 static bool test_NetShareEnum(struct dcerpc_pipe *p, TALLOC_CTX *mem_ctx,
1890                               const char **one_sharename)
1891 {
1892         NTSTATUS status;
1893         struct srvsvc_NetShareEnum r;
1894         struct srvsvc_NetShareCtr0 c0;
1895         uint32_t levels[] = { 0, 1, 2, 501, 502, 1004, 1005, 1006, 1007 };
1896         int i;
1897         bool ret = true;
1898
1899         r.in.server_unc = talloc_asprintf(mem_ctx,"\\\\%s",dcerpc_server_name(p));
1900         r.in.ctr.ctr0 = &c0;
1901         r.in.ctr.ctr0->count = 0;
1902         r.in.ctr.ctr0->array = NULL;
1903         r.in.max_buffer = (uint32_t)-1;
1904         r.in.resume_handle = NULL;
1905
1906         for (i=0;i<ARRAY_SIZE(levels);i++) {
1907                 r.in.level = levels[i];
1908
1909                 ZERO_STRUCT(r.out);
1910
1911                 printf("testing NetShareEnum level %u\n", r.in.level);
1912                 status = dcerpc_srvsvc_NetShareEnum(p, mem_ctx, &r);
1913                 if (!NT_STATUS_IS_OK(status)) {
1914                         printf("NetShareEnum level %u failed - %s\n",
1915                                r.in.level, nt_errstr(status));
1916                         ret = false;
1917                         continue;
1918                 }
1919                 if (!W_ERROR_IS_OK(r.out.result)) {
1920                         printf("NetShareEnum level %u failed - %s\n",
1921                                r.in.level, win_errstr(r.out.result));
1922                         continue;
1923                 }
1924                 if (r.in.level == 0) {
1925                         struct srvsvc_NetShareCtr0 *ctr = r.out.ctr.ctr0;
1926                         if (ctr->count > 0) {
1927                                 *one_sharename = ctr->array[0].name;
1928                         }
1929                 }
1930         }
1931
1932         return ret;
1933 }
1934
1935 bool torture_samba3_rpc_srvsvc(struct torture_context *torture)
1936 {
1937         struct dcerpc_pipe *p;
1938         TALLOC_CTX *mem_ctx;
1939         bool ret = true;
1940         const char *sharename = NULL;
1941         struct smbcli_state *cli;
1942         NTSTATUS status;
1943
1944         if (!(mem_ctx = talloc_new(torture))) {
1945                 return false;
1946         }
1947
1948         if (!(torture_open_connection_share(
1949                       mem_ctx, &cli, torture, torture_setting_string(torture, "host", NULL),
1950                       "IPC$", torture->ev))) {
1951                 talloc_free(mem_ctx);
1952                 return false;
1953         }
1954
1955         status = pipe_bind_smb(mem_ctx, torture->lp_ctx, cli->tree,
1956                                "\\pipe\\srvsvc", &ndr_table_srvsvc, &p);
1957         if (!NT_STATUS_IS_OK(status)) {
1958                 d_printf("(%s) could not bind to srvsvc pipe: %s\n",
1959                          __location__, nt_errstr(status));
1960                 ret = false;
1961                 goto done;
1962         }
1963
1964         ret &= test_NetShareEnum(p, mem_ctx, &sharename);
1965         if (sharename == NULL) {
1966                 printf("did not get sharename\n");
1967         } else {
1968                 ret &= test_NetShareGetInfo(p, mem_ctx, sharename);
1969         }
1970
1971  done:
1972         talloc_free(mem_ctx);
1973         return ret;
1974 }
1975
1976 /*
1977  * Do a ReqChallenge/Auth2 with a random wks name, make sure it returns
1978  * NT_STATUS_NO_SAM_ACCOUNT
1979  */
1980
1981 bool torture_samba3_rpc_randomauth2(struct torture_context *torture)
1982 {
1983         TALLOC_CTX *mem_ctx;
1984         struct dcerpc_pipe *net_pipe;
1985         char *wksname;
1986         bool result = false;
1987         NTSTATUS status;
1988         struct netr_ServerReqChallenge r;
1989         struct netr_Credential netr_cli_creds;
1990         struct netr_Credential netr_srv_creds;
1991         uint32_t negotiate_flags;
1992         struct netr_ServerAuthenticate2 a;
1993         struct creds_CredentialState *creds_state;
1994         struct netr_Credential netr_cred;
1995         struct samr_Password mach_pw;
1996         struct smbcli_state *cli;
1997
1998         if (!(mem_ctx = talloc_new(torture))) {
1999                 d_printf("talloc_new failed\n");
2000                 return false;
2001         }
2002
2003         if (!(wksname = generate_random_str_list(
2004                       mem_ctx, 14, "ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789"))) {
2005                 d_printf("generate_random_str_list failed\n");
2006                 goto done;
2007         }
2008
2009         if (!(torture_open_connection_share(
2010                       mem_ctx, &cli,
2011                       torture, torture_setting_string(torture, "host", NULL),
2012                       "IPC$", torture->ev))) {
2013                 d_printf("IPC$ connection failed\n");
2014                 goto done;
2015         }
2016
2017         if (!(net_pipe = dcerpc_pipe_init(
2018                       mem_ctx, cli->transport->socket->event.ctx,
2019                       lp_iconv_convenience(torture->lp_ctx)))) {
2020                 d_printf("dcerpc_pipe_init failed\n");
2021                 goto done;
2022         }
2023
2024         status = dcerpc_pipe_open_smb(net_pipe, cli->tree, "\\netlogon");
2025         if (!NT_STATUS_IS_OK(status)) {
2026                 d_printf("dcerpc_pipe_open_smb failed: %s\n",
2027                          nt_errstr(status));
2028                 goto done;
2029         }
2030
2031         status = dcerpc_bind_auth_none(net_pipe, &ndr_table_netlogon);
2032         if (!NT_STATUS_IS_OK(status)) {
2033                 d_printf("dcerpc_bind_auth_none failed: %s\n",
2034                          nt_errstr(status));
2035                 goto done;
2036         }
2037
2038         r.in.computer_name = wksname;
2039         r.in.server_name = talloc_asprintf(
2040                 mem_ctx, "\\\\%s", dcerpc_server_name(net_pipe));
2041         if (r.in.server_name == NULL) {
2042                 d_printf("talloc_asprintf failed\n");
2043                 goto done;
2044         }
2045         generate_random_buffer(netr_cli_creds.data,
2046                                sizeof(netr_cli_creds.data));
2047         r.in.credentials = &netr_cli_creds;
2048         r.out.credentials = &netr_srv_creds;
2049
2050         status = dcerpc_netr_ServerReqChallenge(net_pipe, mem_ctx, &r);
2051         if (!NT_STATUS_IS_OK(status)) {
2052                 d_printf("netr_ServerReqChallenge failed: %s\n",
2053                          nt_errstr(status));
2054                 goto done;
2055         }
2056
2057         negotiate_flags = NETLOGON_NEG_AUTH2_FLAGS;
2058         E_md4hash("foobar", mach_pw.hash);
2059
2060         creds_state = talloc(mem_ctx, struct creds_CredentialState);
2061         creds_client_init(creds_state, r.in.credentials,
2062                           r.out.credentials, &mach_pw,
2063                           &netr_cred, negotiate_flags);
2064
2065         a.in.server_name = talloc_asprintf(
2066                 mem_ctx, "\\\\%s", dcerpc_server_name(net_pipe));
2067         a.in.account_name = talloc_asprintf(
2068                 mem_ctx, "%s$", wksname);
2069         a.in.computer_name = wksname;
2070         a.in.secure_channel_type = SEC_CHAN_WKSTA;
2071         a.in.negotiate_flags = &negotiate_flags;
2072         a.out.negotiate_flags = &negotiate_flags;
2073         a.in.credentials = &netr_cred;
2074         a.out.credentials = &netr_cred;
2075
2076         status = dcerpc_netr_ServerAuthenticate2(net_pipe, mem_ctx, &a);
2077
2078         if (!NT_STATUS_EQUAL(status, NT_STATUS_NO_TRUST_SAM_ACCOUNT)) {
2079                 d_printf("dcerpc_netr_ServerAuthenticate2 returned %s, "
2080                          "expected NT_STATUS_NO_TRUST_SAM_ACCOUNT\n",
2081                          nt_errstr(status));
2082                 goto done;
2083         }
2084
2085         result = true;
2086  done:
2087         talloc_free(mem_ctx);
2088         return result;
2089 }
2090
2091 static struct security_descriptor *get_sharesec(TALLOC_CTX *mem_ctx,
2092                                                 struct loadparm_context *lp_ctx,
2093                                                 struct smbcli_session *sess,
2094                                                 const char *sharename)
2095 {
2096         struct smbcli_tree *tree;
2097         TALLOC_CTX *tmp_ctx;
2098         struct dcerpc_pipe *p;
2099         NTSTATUS status;
2100         struct srvsvc_NetShareGetInfo r;
2101         struct security_descriptor *result;
2102
2103         if (!(tmp_ctx = talloc_new(mem_ctx))) {
2104                 d_printf("talloc_new failed\n");
2105                 return NULL;
2106         }
2107
2108         if (!NT_STATUS_IS_OK(secondary_tcon(tmp_ctx, sess, "IPC$", &tree))) {
2109                 d_printf("secondary_tcon failed\n");
2110                 talloc_free(tmp_ctx);
2111                 return NULL;
2112         }
2113
2114         status = pipe_bind_smb(mem_ctx, lp_ctx, tree, "\\pipe\\srvsvc",
2115                                &ndr_table_srvsvc, &p);
2116         if (!NT_STATUS_IS_OK(status)) {
2117                 d_printf("(%s) could not bind to srvsvc pipe: %s\n",
2118                          __location__, nt_errstr(status));
2119                 talloc_free(tmp_ctx);
2120                 return NULL;
2121         }
2122
2123 #if 0
2124         p->conn->flags |= DCERPC_DEBUG_PRINT_IN | DCERPC_DEBUG_PRINT_OUT;
2125 #endif
2126
2127         r.in.server_unc = talloc_asprintf(tmp_ctx, "\\\\%s",
2128                                           dcerpc_server_name(p));
2129         r.in.share_name = sharename;
2130         r.in.level = 502;
2131
2132         status = dcerpc_srvsvc_NetShareGetInfo(p, tmp_ctx, &r);
2133         if (!NT_STATUS_IS_OK(status)) {
2134                 d_printf("srvsvc_NetShareGetInfo failed: %s\n",
2135                          nt_errstr(status));
2136                 talloc_free(tmp_ctx);
2137                 return NULL;
2138         }
2139
2140         result = talloc_steal(mem_ctx, r.out.info.info502->sd);
2141         talloc_free(tmp_ctx);
2142         return result;
2143 }
2144
2145 static NTSTATUS set_sharesec(TALLOC_CTX *mem_ctx,
2146                              struct loadparm_context *lp_ctx,
2147                              struct smbcli_session *sess,
2148                              const char *sharename,
2149                              struct security_descriptor *sd)
2150 {
2151         struct smbcli_tree *tree;
2152         TALLOC_CTX *tmp_ctx;
2153         struct dcerpc_pipe *p;
2154         NTSTATUS status;
2155         struct sec_desc_buf i;
2156         struct srvsvc_NetShareSetInfo r;
2157         uint32_t error = 0;
2158
2159         if (!(tmp_ctx = talloc_new(mem_ctx))) {
2160                 d_printf("talloc_new failed\n");
2161                 return NT_STATUS_NO_MEMORY;
2162         }
2163
2164         if (!NT_STATUS_IS_OK(secondary_tcon(tmp_ctx, sess, "IPC$", &tree))) {
2165                 d_printf("secondary_tcon failed\n");
2166                 talloc_free(tmp_ctx);
2167                 return NT_STATUS_UNSUCCESSFUL;
2168         }
2169
2170         status = pipe_bind_smb(mem_ctx, lp_ctx, tree, "\\pipe\\srvsvc",
2171                                &ndr_table_srvsvc, &p);
2172         if (!NT_STATUS_IS_OK(status)) {
2173                 d_printf("(%s) could not bind to srvsvc pipe: %s\n",
2174                          __location__, nt_errstr(status));
2175                 talloc_free(tmp_ctx);
2176                 return NT_STATUS_UNSUCCESSFUL;
2177         }
2178
2179 #if 0
2180         p->conn->flags |= DCERPC_DEBUG_PRINT_IN | DCERPC_DEBUG_PRINT_OUT;
2181 #endif
2182
2183         r.in.server_unc = talloc_asprintf(tmp_ctx, "\\\\%s",
2184                                           dcerpc_server_name(p));
2185         r.in.share_name = sharename;
2186         r.in.level = 1501;
2187         i.sd = sd;
2188         r.in.info.info1501 = &i;
2189         r.in.parm_error = &error;
2190
2191         status = dcerpc_srvsvc_NetShareSetInfo(p, tmp_ctx, &r);
2192         if (!NT_STATUS_IS_OK(status)) {
2193                 d_printf("srvsvc_NetShareGetInfo failed: %s\n",
2194                          nt_errstr(status));
2195         }
2196
2197         talloc_free(tmp_ctx);
2198         return status;
2199 }
2200
2201 bool try_tcon(TALLOC_CTX *mem_ctx,
2202               struct loadparm_context *lp_ctx,
2203               struct security_descriptor *orig_sd,
2204               struct smbcli_session *session,
2205               const char *sharename, const struct dom_sid *user_sid,
2206               unsigned int access_mask, NTSTATUS expected_tcon,
2207               NTSTATUS expected_mkdir)
2208 {
2209         TALLOC_CTX *tmp_ctx;
2210         struct smbcli_tree *rmdir_tree, *tree;
2211         struct dom_sid *domain_sid;
2212         uint32_t rid;
2213         struct security_descriptor *sd;
2214         NTSTATUS status;
2215         bool ret = true;
2216
2217         if (!(tmp_ctx = talloc_new(mem_ctx))) {
2218                 d_printf("talloc_new failed\n");
2219                 return false;
2220         }
2221
2222         status = secondary_tcon(tmp_ctx, session, sharename, &rmdir_tree);
2223         if (!NT_STATUS_IS_OK(status)) {
2224                 d_printf("first tcon to delete dir failed\n");
2225                 talloc_free(tmp_ctx);
2226                 return false;
2227         }
2228
2229         smbcli_rmdir(rmdir_tree, "sharesec_testdir");
2230
2231         if (!NT_STATUS_IS_OK(dom_sid_split_rid(tmp_ctx, user_sid,
2232                                                &domain_sid, &rid))) {
2233                 d_printf("dom_sid_split_rid failed\n");
2234                 talloc_free(tmp_ctx);
2235                 return false;
2236         }
2237
2238         sd = security_descriptor_dacl_create(
2239                 tmp_ctx, 0, "S-1-5-32-544",
2240                 dom_sid_string(mem_ctx, dom_sid_add_rid(mem_ctx, domain_sid,
2241                                                         DOMAIN_RID_USERS)),
2242                 dom_sid_string(mem_ctx, user_sid),
2243                 SEC_ACE_TYPE_ACCESS_ALLOWED, access_mask, 0, NULL);
2244         if (sd == NULL) {
2245                 d_printf("security_descriptor_dacl_create failed\n");
2246                 talloc_free(tmp_ctx);
2247                 return false;
2248         }
2249
2250         status = set_sharesec(mem_ctx, lp_ctx, session, sharename, sd);
2251         if (!NT_STATUS_IS_OK(status)) {
2252                 d_printf("custom set_sharesec failed: %s\n",
2253                          nt_errstr(status));
2254                 talloc_free(tmp_ctx);
2255                 return false;
2256         }
2257
2258         status = secondary_tcon(tmp_ctx, session, sharename, &tree);
2259         if (!NT_STATUS_EQUAL(status, expected_tcon)) {
2260                 d_printf("Expected %s, got %s\n", nt_errstr(expected_tcon),
2261                          nt_errstr(status));
2262                 ret = false;
2263                 goto done;
2264         }
2265
2266         if (!NT_STATUS_IS_OK(status)) {
2267                 /* An expected non-access, no point in trying to write */
2268                 goto done;
2269         }
2270
2271         status = smbcli_mkdir(tree, "sharesec_testdir");
2272         if (!NT_STATUS_EQUAL(status, expected_mkdir)) {
2273                 d_printf("(%s) Expected %s, got %s\n", __location__,
2274                          nt_errstr(expected_mkdir), nt_errstr(status));
2275                 ret = false;
2276         }
2277
2278  done:
2279         smbcli_rmdir(rmdir_tree, "sharesec_testdir");
2280
2281         status = set_sharesec(mem_ctx, lp_ctx, session, sharename, orig_sd);
2282         if (!NT_STATUS_IS_OK(status)) {
2283                 d_printf("custom set_sharesec failed: %s\n",
2284                          nt_errstr(status));
2285                 talloc_free(tmp_ctx);
2286                 return false;
2287         }
2288
2289         talloc_free(tmp_ctx);
2290         return ret;
2291 }
2292
2293 bool torture_samba3_rpc_sharesec(struct torture_context *torture)
2294 {
2295         TALLOC_CTX *mem_ctx;
2296         bool ret = true;
2297         struct smbcli_state *cli;
2298         struct security_descriptor *sd;
2299         struct dom_sid *user_sid;
2300
2301         if (!(mem_ctx = talloc_new(torture))) {
2302                 return false;
2303         }
2304
2305         if (!(torture_open_connection_share(
2306                       mem_ctx, &cli, torture, torture_setting_string(torture, "host", NULL),
2307                       "IPC$", torture->ev))) {
2308                 d_printf("IPC$ connection failed\n");
2309                 talloc_free(mem_ctx);
2310                 return false;
2311         }
2312
2313         if (!(user_sid = whoami(mem_ctx, torture->lp_ctx, cli->tree))) {
2314                 d_printf("whoami failed\n");
2315                 talloc_free(mem_ctx);
2316                 return false;
2317         }
2318
2319         sd = get_sharesec(mem_ctx, torture->lp_ctx, cli->session,
2320                           torture_setting_string(torture, "share", NULL));
2321
2322         ret &= try_tcon(mem_ctx, torture->lp_ctx, sd, cli->session,
2323                         torture_setting_string(torture, "share", NULL),
2324                         user_sid, 0, NT_STATUS_ACCESS_DENIED, NT_STATUS_OK);
2325
2326         ret &= try_tcon(mem_ctx, torture->lp_ctx, sd, cli->session,
2327                         torture_setting_string(torture, "share", NULL),
2328                         user_sid, SEC_FILE_READ_DATA, NT_STATUS_OK,
2329                         NT_STATUS_MEDIA_WRITE_PROTECTED);
2330
2331         ret &= try_tcon(mem_ctx, torture->lp_ctx, sd, cli->session,
2332                         torture_setting_string(torture, "share", NULL),
2333                         user_sid, SEC_FILE_ALL, NT_STATUS_OK, NT_STATUS_OK);
2334
2335         talloc_free(mem_ctx);
2336         return ret;
2337 }
2338
2339 bool torture_samba3_rpc_lsa(struct torture_context *torture)
2340 {
2341         TALLOC_CTX *mem_ctx;
2342         bool ret = true;
2343         struct smbcli_state *cli;
2344         struct dcerpc_pipe *p;
2345         struct policy_handle lsa_handle;
2346         NTSTATUS status;
2347         struct dom_sid *domain_sid;
2348
2349         if (!(mem_ctx = talloc_new(torture))) {
2350                 return false;
2351         }
2352
2353         if (!(torture_open_connection_share(
2354                       mem_ctx, &cli, torture, torture_setting_string(torture, "host", NULL),
2355                       "IPC$", torture->ev))) {
2356                 d_printf("IPC$ connection failed\n");
2357                 talloc_free(mem_ctx);
2358                 return false;
2359         }
2360
2361         status = pipe_bind_smb(mem_ctx, torture->lp_ctx, cli->tree, "\\lsarpc",
2362                                &ndr_table_lsarpc, &p);
2363         if (!NT_STATUS_IS_OK(status)) {
2364                 d_printf("(%s) pipe_bind_smb failed: %s\n", __location__,
2365                          nt_errstr(status));
2366                 talloc_free(mem_ctx);
2367                 return false;
2368         }
2369
2370         {
2371                 struct lsa_ObjectAttribute attr;
2372                 struct lsa_OpenPolicy2 o;
2373                 o.in.system_name = talloc_asprintf(
2374                         mem_ctx, "\\\\%s", dcerpc_server_name(p));
2375                 ZERO_STRUCT(attr);
2376                 o.in.attr = &attr;
2377                 o.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
2378                 o.out.handle = &lsa_handle;
2379                 status = dcerpc_lsa_OpenPolicy2(p, mem_ctx, &o);
2380                 if (!NT_STATUS_IS_OK(status)) {
2381                         d_printf("(%s) dcerpc_lsa_OpenPolicy2 failed: %s\n",
2382                                  __location__, nt_errstr(status));
2383                         talloc_free(mem_ctx);
2384                         return false;
2385                 }
2386         }
2387
2388 #if 0
2389         p->conn->flags |= DCERPC_DEBUG_PRINT_IN | DCERPC_DEBUG_PRINT_OUT;
2390 #endif
2391
2392         {
2393                 int i;
2394                 int levels[] = { 2,3,5,6 };
2395
2396                 for (i=0; i<ARRAY_SIZE(levels); i++) {
2397                         struct lsa_QueryInfoPolicy r;
2398                         union lsa_PolicyInformation *info = NULL;
2399                         r.in.handle = &lsa_handle;
2400                         r.in.level = levels[i];
2401                         r.out.info = &info;
2402                         status = dcerpc_lsa_QueryInfoPolicy(p, mem_ctx, &r);
2403                         if (!NT_STATUS_IS_OK(status)) {
2404                                 d_printf("(%s) dcerpc_lsa_QueryInfoPolicy %d "
2405                                          "failed: %s\n", __location__,
2406                                          levels[i], nt_errstr(status));
2407                                 talloc_free(mem_ctx);
2408                                 return false;
2409                         }
2410                         if (levels[i] == 5) {
2411                                 domain_sid = info->account_domain.sid;
2412                         }
2413                 }
2414         }
2415
2416         return ret;
2417 }
2418
2419 static NTSTATUS get_servername(TALLOC_CTX *mem_ctx, struct smbcli_tree *tree,
2420                                struct smb_iconv_convenience *iconv_convenience,
2421                                char **name)
2422 {
2423         struct rap_WserverGetInfo r;
2424         NTSTATUS status;
2425         char servername[17];
2426
2427         r.in.level = 0;
2428         r.in.bufsize = 0xffff;
2429
2430         status = smbcli_rap_netservergetinfo(tree, iconv_convenience, mem_ctx, &r);
2431         if (!NT_STATUS_IS_OK(status)) {
2432                 return status;
2433         }
2434
2435         memcpy(servername, r.out.info.info0.name, 16);
2436         servername[16] = '\0';
2437
2438         if (pull_ascii_talloc(mem_ctx, name, servername) < 0) {
2439                 return NT_STATUS_NO_MEMORY;
2440         }
2441
2442         return NT_STATUS_OK;
2443 }
2444
2445
2446 static NTSTATUS find_printers(TALLOC_CTX *ctx, struct loadparm_context *lp_ctx,
2447                               struct smbcli_tree *tree,
2448                               const char ***printers, int *num_printers)
2449 {
2450         TALLOC_CTX *mem_ctx;
2451         NTSTATUS status;
2452         struct dcerpc_pipe *p;
2453         struct srvsvc_NetShareEnum r;
2454         struct srvsvc_NetShareCtr1 c1_in;
2455         struct srvsvc_NetShareCtr1 *c1;
2456         int i;
2457
2458         mem_ctx = talloc_new(ctx);
2459         if (mem_ctx == NULL) {
2460                 return NT_STATUS_NO_MEMORY;
2461         }
2462
2463         status = pipe_bind_smb(mem_ctx, lp_ctx,
2464                                tree, "\\srvsvc", &ndr_table_srvsvc,
2465                                &p);
2466         if (!NT_STATUS_IS_OK(status)) {
2467                 d_printf("could not bind to srvsvc pipe\n");
2468                 talloc_free(mem_ctx);
2469                 return status;
2470         }
2471
2472         r.in.server_unc = talloc_asprintf(
2473                 mem_ctx, "\\\\%s", dcerpc_server_name(p));
2474         r.in.level = 1;
2475         ZERO_STRUCT(c1_in);
2476         r.in.ctr.ctr1 = &c1_in;
2477         r.in.max_buffer = (uint32_t)-1;
2478         r.in.resume_handle = NULL;
2479
2480         status = dcerpc_srvsvc_NetShareEnum(p, mem_ctx, &r);
2481         if (!NT_STATUS_IS_OK(status)) {
2482                 d_printf("NetShareEnum level %u failed - %s\n",
2483                          r.in.level, nt_errstr(status));
2484                 talloc_free(mem_ctx);
2485                 return status;
2486         }
2487
2488         *printers = NULL;
2489         *num_printers = 0;
2490         c1 = r.out.ctr.ctr1;
2491         for (i=0; i<c1->count; i++) {
2492                 if (c1->array[i].type != STYPE_PRINTQ) {
2493                         continue;
2494                 }
2495                 if (!add_string_to_array(ctx, c1->array[i].name,
2496                                          printers, num_printers)) {
2497                         talloc_free(ctx);
2498                         return NT_STATUS_NO_MEMORY;
2499                 }
2500         }
2501
2502         talloc_free(mem_ctx);
2503         return NT_STATUS_OK;
2504 }
2505
2506 static bool enumprinters(TALLOC_CTX *mem_ctx, struct dcerpc_pipe *pipe,
2507                          const char *servername, int level, int *num_printers)
2508 {
2509         struct spoolss_EnumPrinters r;
2510         NTSTATUS status;
2511         DATA_BLOB blob;
2512
2513         r.in.flags = PRINTER_ENUM_LOCAL;
2514         r.in.server = talloc_asprintf(mem_ctx, "\\\\%s", servername);
2515         r.in.level = level;
2516         r.in.buffer = NULL;
2517         r.in.offered = 0;
2518
2519         status = dcerpc_spoolss_EnumPrinters(pipe, mem_ctx, &r);
2520         if (!NT_STATUS_IS_OK(status)) {
2521                 d_printf("(%s) dcerpc_spoolss_EnumPrinters failed: %s\n",
2522                          __location__, nt_errstr(status));
2523                 return false;
2524         }
2525
2526         if (!W_ERROR_EQUAL(r.out.result, WERR_INSUFFICIENT_BUFFER)) {
2527                 d_printf("(%s) EnumPrinters unexpected return code %s, should "
2528                          "be WERR_INSUFFICIENT_BUFFER\n", __location__,
2529                          win_errstr(r.out.result));
2530                 return false;
2531         }
2532
2533         blob = data_blob_talloc_zero(mem_ctx, r.out.needed);
2534         if (blob.data == NULL) {
2535                 d_printf("(%s) data_blob_talloc failed\n", __location__);
2536                 return false;
2537         }
2538
2539         r.in.buffer = &blob;
2540         r.in.offered = r.out.needed;
2541
2542         status = dcerpc_spoolss_EnumPrinters(pipe, mem_ctx, &r);
2543         if (!NT_STATUS_IS_OK(status) || !W_ERROR_IS_OK(r.out.result)) {
2544                 d_printf("(%s) dcerpc_spoolss_EnumPrinters failed: %s, "
2545                          "%s\n", __location__, nt_errstr(status),
2546                          win_errstr(r.out.result));
2547                 return false;
2548         }
2549
2550         *num_printers = r.out.count;
2551
2552         return true;
2553 }
2554
2555 static NTSTATUS getprinterinfo(TALLOC_CTX *ctx, struct dcerpc_pipe *pipe,
2556                                struct policy_handle *handle, int level,
2557                                union spoolss_PrinterInfo **res)
2558 {
2559         TALLOC_CTX *mem_ctx;
2560         struct spoolss_GetPrinter r;
2561         DATA_BLOB blob;
2562         NTSTATUS status;
2563
2564         mem_ctx = talloc_new(ctx);
2565         if (mem_ctx == NULL) {
2566                 return NT_STATUS_NO_MEMORY;
2567         }
2568
2569         r.in.handle = handle;
2570         r.in.level = level;
2571         r.in.buffer = NULL;
2572         r.in.offered = 0;
2573
2574         status = dcerpc_spoolss_GetPrinter(pipe, mem_ctx, &r);
2575         if (!NT_STATUS_IS_OK(status)) {
2576                 d_printf("(%s) dcerpc_spoolss_GetPrinter failed: %s\n",
2577                          __location__, nt_errstr(status));
2578                 talloc_free(mem_ctx);
2579                 return status;
2580         }
2581
2582         if (!W_ERROR_EQUAL(r.out.result, WERR_INSUFFICIENT_BUFFER)) {
2583                 printf("GetPrinter unexpected return code %s, should "
2584                        "be WERR_INSUFFICIENT_BUFFER\n",
2585                        win_errstr(r.out.result));
2586                 talloc_free(mem_ctx);
2587                 return NT_STATUS_UNSUCCESSFUL;
2588         }
2589
2590         r.in.handle = handle;
2591         r.in.level = level;
2592         blob = data_blob_talloc(mem_ctx, NULL, r.out.needed);
2593         if (blob.data == NULL) {
2594                 talloc_free(mem_ctx);
2595                 return NT_STATUS_NO_MEMORY;
2596         }
2597         memset(blob.data, 0, blob.length);
2598         r.in.buffer = &blob;
2599         r.in.offered = r.out.needed;
2600
2601         status = dcerpc_spoolss_GetPrinter(pipe, mem_ctx, &r);
2602         if (!NT_STATUS_IS_OK(status) || !W_ERROR_IS_OK(r.out.result)) {
2603                 d_printf("(%s) dcerpc_spoolss_GetPrinter failed: %s, "
2604                          "%s\n", __location__, nt_errstr(status),
2605                          win_errstr(r.out.result));
2606                 talloc_free(mem_ctx);
2607                 return NT_STATUS_IS_OK(status) ?
2608                         NT_STATUS_UNSUCCESSFUL : status;
2609         }
2610
2611         if (res != NULL) {
2612                 *res = talloc_steal(ctx, r.out.info);
2613         }
2614
2615         talloc_free(mem_ctx);
2616         return NT_STATUS_OK;
2617 }
2618
2619 bool torture_samba3_rpc_spoolss(struct torture_context *torture)
2620 {
2621         TALLOC_CTX *mem_ctx;
2622         bool ret = true;
2623         struct smbcli_state *cli;
2624         struct dcerpc_pipe *p;
2625         NTSTATUS status;
2626         struct policy_handle server_handle, printer_handle;
2627         const char **printers;
2628         int num_printers;
2629         struct spoolss_UserLevel1 userlevel1;
2630         char *servername;
2631
2632         if (!(mem_ctx = talloc_new(torture))) {
2633                 return false;
2634         }
2635
2636         if (!(torture_open_connection_share(
2637                       mem_ctx, &cli, torture, torture_setting_string(torture, "host", NULL),
2638                       "IPC$", torture->ev))) {
2639                 d_printf("IPC$ connection failed\n");
2640                 talloc_free(mem_ctx);
2641                 return false;
2642         }
2643
2644         status = get_servername(mem_ctx, cli->tree, lp_iconv_convenience(torture->lp_ctx), &servername);
2645         if (!NT_STATUS_IS_OK(status)) {
2646                 d_fprintf(stderr, "(%s) get_servername returned %s\n",
2647                           __location__, nt_errstr(status));
2648                 talloc_free(mem_ctx);
2649                 return false;
2650         }
2651
2652         if (!NT_STATUS_IS_OK(find_printers(mem_ctx, torture->lp_ctx, cli->tree,
2653                                            &printers, &num_printers))) {
2654                 talloc_free(mem_ctx);
2655                 return false;
2656         }
2657
2658         if (num_printers == 0) {
2659                 d_printf("Did not find printers\n");
2660                 talloc_free(mem_ctx);
2661                 return true;
2662         }
2663
2664         status = pipe_bind_smb(mem_ctx, torture->lp_ctx, cli->tree, "\\spoolss",
2665                                &ndr_table_spoolss, &p);
2666         if (!NT_STATUS_IS_OK(status)) {
2667                 d_printf("(%s) pipe_bind_smb failed: %s\n", __location__,
2668                          nt_errstr(status));
2669                 talloc_free(mem_ctx);
2670                 return false;
2671         }
2672
2673         ZERO_STRUCT(userlevel1);
2674         userlevel1.client = talloc_asprintf(
2675                 mem_ctx, "\\\\%s", lp_netbios_name(torture->lp_ctx));
2676         userlevel1.user = cli_credentials_get_username(cmdline_credentials);
2677         userlevel1.build = 2600;
2678         userlevel1.major = 3;
2679         userlevel1.minor = 0;
2680         userlevel1.processor = 0;
2681
2682         {
2683                 struct spoolss_OpenPrinterEx r;
2684
2685                 ZERO_STRUCT(r);
2686                 r.in.printername = talloc_asprintf(mem_ctx, "\\\\%s",
2687                                                    servername);
2688                 r.in.datatype = NULL;
2689                 r.in.access_mask = 0;
2690                 r.in.level = 1;
2691                 r.in.userlevel.level1 = &userlevel1;
2692                 r.out.handle = &server_handle;
2693
2694                 status = dcerpc_spoolss_OpenPrinterEx(p, mem_ctx, &r);
2695                 if (!NT_STATUS_IS_OK(status) || !W_ERROR_IS_OK(r.out.result)) {
2696                         d_printf("(%s) dcerpc_spoolss_OpenPrinterEx failed: "
2697                                  "%s, %s\n", __location__, nt_errstr(status),
2698                                  win_errstr(r.out.result));
2699                         talloc_free(mem_ctx);
2700                         return false;
2701                 }
2702         }
2703
2704         {
2705                 struct spoolss_ClosePrinter r;
2706
2707                 r.in.handle = &server_handle;
2708                 r.out.handle = &server_handle;
2709
2710                 status = dcerpc_spoolss_ClosePrinter(p, mem_ctx, &r);
2711                 if (!NT_STATUS_IS_OK(status) || !W_ERROR_IS_OK(r.out.result)) {
2712                         d_printf("(%s) dcerpc_spoolss_ClosePrinter failed: "
2713                                  "%s, %s\n", __location__, nt_errstr(status),
2714                                  win_errstr(r.out.result));
2715                         talloc_free(mem_ctx);
2716                         return false;
2717                 }
2718         }
2719
2720         {
2721                 struct spoolss_OpenPrinterEx r;
2722
2723                 ZERO_STRUCT(r);
2724                 r.in.printername = talloc_asprintf(
2725                         mem_ctx, "\\\\%s\\%s", servername, printers[0]);
2726                 r.in.datatype = NULL;
2727                 r.in.access_mask = 0;
2728                 r.in.level = 1;
2729                 r.in.userlevel.level1 = &userlevel1;
2730                 r.out.handle = &printer_handle;
2731
2732                 status = dcerpc_spoolss_OpenPrinterEx(p, mem_ctx, &r);
2733                 if (!NT_STATUS_IS_OK(status) || !W_ERROR_IS_OK(r.out.result)) {
2734                         d_printf("(%s) dcerpc_spoolss_OpenPrinterEx failed: "
2735                                  "%s, %s\n", __location__, nt_errstr(status),
2736                                  win_errstr(r.out.result));
2737                         talloc_free(mem_ctx);
2738                         return false;
2739                 }
2740         }
2741
2742         {
2743                 int i;
2744
2745                 for (i=0; i<8; i++) {
2746                         status = getprinterinfo(mem_ctx, p, &printer_handle,
2747                                                 i, NULL);
2748                         if (!NT_STATUS_IS_OK(status)) {
2749                                 d_printf("(%s) getprinterinfo %d failed: %s\n",
2750                                          __location__, i, nt_errstr(status));
2751                                 ret = false;
2752                         }
2753                 }
2754         }
2755
2756         {
2757                 struct spoolss_ClosePrinter r;
2758
2759                 r.in.handle = &printer_handle;
2760                 r.out.handle = &printer_handle;
2761
2762                 status = dcerpc_spoolss_ClosePrinter(p, mem_ctx, &r);
2763                 if (!NT_STATUS_IS_OK(status)) {
2764                         d_printf("(%s) dcerpc_spoolss_ClosePrinter failed: "
2765                                  "%s\n", __location__, nt_errstr(status));
2766                         talloc_free(mem_ctx);
2767                         return false;
2768                 }
2769         }
2770
2771         {
2772                 int num_enumerated;
2773                 if (!enumprinters(mem_ctx, p, servername, 1,
2774                                   &num_enumerated)) {
2775                         d_printf("(%s) enumprinters failed\n", __location__);
2776                         talloc_free(mem_ctx);
2777                         return false;
2778                 }
2779                 if (num_printers != num_enumerated) {
2780                         d_printf("(%s) netshareenum gave %d printers, "
2781                                  "enumprinters lvl 1 gave %d\n", __location__,
2782                                  num_printers, num_enumerated);
2783                         talloc_free(mem_ctx);
2784                         return false;
2785                 }
2786         }
2787
2788         {
2789                 int num_enumerated;
2790                 if (!enumprinters(mem_ctx, p, servername, 2,
2791                                   &num_enumerated)) {
2792                         d_printf("(%s) enumprinters failed\n", __location__);
2793                         talloc_free(mem_ctx);
2794                         return false;
2795                 }
2796                 if (num_printers != num_enumerated) {
2797                         d_printf("(%s) netshareenum gave %d printers, "
2798                                  "enumprinters lvl 2 gave %d\n", __location__,
2799                                  num_printers, num_enumerated);
2800                         talloc_free(mem_ctx);
2801                         return false;
2802                 }
2803         }
2804
2805         talloc_free(mem_ctx);
2806
2807         return ret;
2808 }
2809
2810 bool torture_samba3_rpc_wkssvc(struct torture_context *torture)
2811 {
2812         TALLOC_CTX *mem_ctx;
2813         struct smbcli_state *cli;
2814         struct dcerpc_pipe *p;
2815         NTSTATUS status;
2816         char *servername;
2817
2818         if (!(mem_ctx = talloc_new(torture))) {
2819                 return false;
2820         }
2821
2822         if (!(torture_open_connection_share(
2823                       mem_ctx, &cli, torture, torture_setting_string(torture, "host", NULL),
2824                       "IPC$", torture->ev))) {
2825                 d_printf("IPC$ connection failed\n");
2826                 talloc_free(mem_ctx);
2827                 return false;
2828         }
2829
2830         status = get_servername(mem_ctx, cli->tree, lp_iconv_convenience(torture->lp_ctx), &servername);
2831         if (!NT_STATUS_IS_OK(status)) {
2832                 d_fprintf(stderr, "(%s) get_servername returned %s\n",
2833                           __location__, nt_errstr(status));
2834                 talloc_free(mem_ctx);
2835                 return false;
2836         }
2837
2838         status = pipe_bind_smb(mem_ctx, torture->lp_ctx, cli->tree, "\\wkssvc",
2839                                &ndr_table_wkssvc, &p);
2840         if (!NT_STATUS_IS_OK(status)) {
2841                 d_printf("(%s) pipe_bind_smb failed: %s\n", __location__,
2842                          nt_errstr(status));
2843                 talloc_free(mem_ctx);
2844                 return false;
2845         }
2846
2847         {
2848                 struct wkssvc_NetWkstaInfo100 wks100;
2849                 union wkssvc_NetWkstaInfo info;
2850                 struct wkssvc_NetWkstaGetInfo r;
2851
2852                 r.in.server_name = "\\foo";
2853                 r.in.level = 100;
2854                 info.info100 = &wks100;
2855                 r.out.info = &info;
2856
2857                 status = dcerpc_wkssvc_NetWkstaGetInfo(p, mem_ctx, &r);
2858                 if (!NT_STATUS_IS_OK(status) || !W_ERROR_IS_OK(r.out.result)) {
2859                         d_printf("(%s) dcerpc_wkssvc_NetWksGetInfo failed: "
2860                                  "%s, %s\n", __location__, nt_errstr(status),
2861                                  win_errstr(r.out.result));
2862                         talloc_free(mem_ctx);
2863                         return false;
2864                 }
2865
2866                 if (strcmp(servername,
2867                            r.out.info->info100->server_name) != 0) {
2868                         d_printf("(%s) servername inconsistency: RAP=%s, "
2869                                  "dcerpc_wkssvc_NetWksGetInfo=%s",
2870                                  __location__, servername,
2871                                  r.out.info->info100->server_name);
2872                         talloc_free(mem_ctx);
2873                         return false;
2874                 }
2875         }
2876
2877         talloc_free(mem_ctx);
2878         return true;
2879 }
2880
2881 static NTSTATUS winreg_close(struct dcerpc_pipe *p,
2882                              struct policy_handle *handle)
2883 {
2884         struct winreg_CloseKey c;
2885         NTSTATUS status;
2886         TALLOC_CTX *mem_ctx;
2887
2888         c.in.handle = c.out.handle = handle;
2889
2890         if (!(mem_ctx = talloc_new(p))) {
2891                 return NT_STATUS_NO_MEMORY;
2892         }
2893
2894         status = dcerpc_winreg_CloseKey(p, mem_ctx, &c);
2895         talloc_free(mem_ctx);
2896
2897         if (!NT_STATUS_IS_OK(status)) {
2898                 return status;
2899         }
2900
2901         if (!W_ERROR_IS_OK(c.out.result)) {
2902                 return werror_to_ntstatus(c.out.result);
2903         }
2904
2905         return NT_STATUS_OK;
2906 }
2907
2908 static NTSTATUS enumvalues(struct dcerpc_pipe *p, struct policy_handle *handle,
2909                            TALLOC_CTX *mem_ctx)
2910 {
2911         uint32_t enum_index = 0;
2912
2913         while (1) {
2914                 struct winreg_EnumValue r;
2915                 struct winreg_StringBuf name;
2916                 enum winreg_Type type = 0;
2917                 uint8_t buf8[1024];
2918                 NTSTATUS status;
2919                 uint32_t size, length;
2920
2921                 r.in.handle = handle;
2922                 r.in.enum_index = enum_index;
2923                 name.name = "";
2924                 name.size = 1024;
2925                 r.in.name = r.out.name = &name;
2926                 size = 1024;
2927                 length = 5;
2928                 r.in.type = &type;
2929                 r.in.value = buf8;
2930                 r.in.size = &size;
2931                 r.in.length = &length;
2932
2933                 status = dcerpc_winreg_EnumValue(p, mem_ctx, &r);
2934                 if (!NT_STATUS_IS_OK(status) || !W_ERROR_IS_OK(r.out.result)) {
2935                         return NT_STATUS_OK;
2936                 }
2937                 enum_index += 1;
2938         }
2939 }
2940
2941 static NTSTATUS enumkeys(struct dcerpc_pipe *p, struct policy_handle *handle,
2942                          TALLOC_CTX *mem_ctx, int depth)
2943 {
2944         struct winreg_EnumKey r;
2945         struct winreg_StringBuf class, name;
2946         NTSTATUS status;
2947         NTTIME t = 0;
2948
2949         if (depth <= 0) {
2950                 return NT_STATUS_OK;
2951         }
2952
2953         class.name   = "";
2954         class.size   = 1024;
2955
2956         r.in.handle = handle;
2957         r.in.enum_index = 0;
2958         r.in.name = &name;
2959         r.in.keyclass = &class;
2960         r.out.name = &name;
2961         r.in.last_changed_time = &t;
2962
2963         do {
2964                 TALLOC_CTX *tmp_ctx;
2965                 struct winreg_OpenKey o;
2966                 struct policy_handle key_handle;
2967                 int i;
2968
2969                 if (!(tmp_ctx = talloc_new(mem_ctx))) {
2970                         return NT_STATUS_NO_MEMORY;
2971                 }
2972
2973                 name.name = NULL;
2974                 name.size = 1024;
2975
2976                 status = dcerpc_winreg_EnumKey(p, tmp_ctx, &r);
2977                 if (!NT_STATUS_IS_OK(status) || !W_ERROR_IS_OK(r.out.result)) {
2978                         /* We're done enumerating */
2979                         talloc_free(tmp_ctx);
2980                         return NT_STATUS_OK;
2981                 }
2982
2983                 for (i=0; i<10-depth; i++)
2984                         printf(" ");
2985                 printf("%s\n", r.out.name->name);
2986
2987
2988                 o.in.parent_handle = handle;
2989                 o.in.keyname.name = r.out.name->name;
2990                 o.in.unknown = 0;
2991                 o.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
2992                 o.out.handle = &key_handle;
2993
2994                 status = dcerpc_winreg_OpenKey(p, tmp_ctx, &o);
2995                 if (NT_STATUS_IS_OK(status) && W_ERROR_IS_OK(o.out.result)) {
2996                         enumkeys(p, &key_handle, tmp_ctx, depth-1);
2997                         enumvalues(p, &key_handle, tmp_ctx);
2998                         status = winreg_close(p, &key_handle);
2999                         if (!NT_STATUS_IS_OK(status)) {
3000                                 return status;
3001                         }
3002                 }
3003
3004                 talloc_free(tmp_ctx);
3005
3006                 r.in.enum_index += 1;
3007         } while(true);
3008
3009         return NT_STATUS_OK;
3010 }
3011
3012 typedef NTSTATUS (*winreg_open_fn)(struct dcerpc_pipe *, TALLOC_CTX *, void *);
3013
3014 static bool test_Open3(struct dcerpc_pipe *p, TALLOC_CTX *mem_ctx,
3015                        const char *name, winreg_open_fn open_fn)
3016 {
3017         struct policy_handle handle;
3018         struct winreg_OpenHKLM r;
3019         NTSTATUS status;
3020
3021         r.in.system_name = 0;
3022         r.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
3023         r.out.handle = &handle;
3024
3025         status = open_fn(p, mem_ctx, &r);
3026         if (!NT_STATUS_IS_OK(status) || !W_ERROR_IS_OK(r.out.result)) {
3027                 d_printf("(%s) %s failed: %s, %s\n", __location__, name,
3028                          nt_errstr(status), win_errstr(r.out.result));
3029                 return false;
3030         }
3031
3032         enumkeys(p, &handle, mem_ctx, 4);
3033
3034         status = winreg_close(p, &handle);
3035         if (!NT_STATUS_IS_OK(status)) {
3036                 d_printf("(%s) dcerpc_CloseKey failed: %s\n",
3037                          __location__, nt_errstr(status));
3038                 return false;
3039         }
3040
3041         return true;
3042 }
3043
3044 bool torture_samba3_rpc_winreg(struct torture_context *torture)
3045 {
3046         NTSTATUS status;
3047         struct dcerpc_pipe *p;
3048         TALLOC_CTX *mem_ctx;
3049         bool ret = true;
3050         struct {
3051                 const char *name;
3052                 winreg_open_fn fn;
3053         } open_fns[] = {
3054                 {"OpenHKLM", (winreg_open_fn)dcerpc_winreg_OpenHKLM },
3055                 {"OpenHKU",  (winreg_open_fn)dcerpc_winreg_OpenHKU },
3056                 {"OpenHKPD", (winreg_open_fn)dcerpc_winreg_OpenHKPD },
3057                 {"OpenHKPT", (winreg_open_fn)dcerpc_winreg_OpenHKPT },
3058                 {"OpenHKCR", (winreg_open_fn)dcerpc_winreg_OpenHKCR }};
3059 #if 0
3060         int i;
3061 #endif
3062
3063         mem_ctx = talloc_init("torture_rpc_winreg");
3064
3065         status = torture_rpc_connection(torture, &p, &ndr_table_winreg);
3066
3067         if (!NT_STATUS_IS_OK(status)) {
3068                 talloc_free(mem_ctx);
3069                 return false;
3070         }
3071
3072 #if 1
3073         ret = test_Open3(p, mem_ctx, open_fns[0].name, open_fns[0].fn);
3074 #else
3075         for (i = 0; i < ARRAY_SIZE(open_fns); i++) {
3076                 if (!test_Open3(p, mem_ctx, open_fns[i].name, open_fns[i].fn))
3077                         ret = false;
3078         }
3079 #endif
3080
3081         talloc_free(mem_ctx);
3082
3083         return ret;
3084 }
3085
3086 static NTSTATUS get_shareinfo(TALLOC_CTX *mem_ctx,
3087                               struct loadparm_context *lp_ctx,
3088                               struct smbcli_state *cli,
3089                               const char *share,
3090                               struct srvsvc_NetShareInfo502 **info)
3091 {
3092         struct smbcli_tree *ipc;
3093         struct dcerpc_pipe *p;
3094         struct srvsvc_NetShareGetInfo r;
3095         NTSTATUS status;
3096
3097         if (!(p = dcerpc_pipe_init(cli,
3098                                    cli->transport->socket->event.ctx,
3099                                    lp_iconv_convenience(lp_ctx)))) {
3100                 status = NT_STATUS_NO_MEMORY;
3101                 goto fail;
3102         }
3103
3104         status = secondary_tcon(p, cli->session, "IPC$", &ipc);
3105         if (!NT_STATUS_IS_OK(status)) {
3106                 goto fail;
3107         }
3108
3109         status = dcerpc_pipe_open_smb(p, ipc, "\\pipe\\srvsvc");
3110         if (!NT_STATUS_IS_OK(status)) {
3111                 d_printf("dcerpc_pipe_open_smb failed: %s\n",
3112                          nt_errstr(status));
3113                 goto fail;
3114         }
3115
3116         status = dcerpc_bind_auth_none(p, &ndr_table_srvsvc);
3117         if (!NT_STATUS_IS_OK(status)) {
3118                 d_printf("dcerpc_bind_auth_none failed: %s\n",
3119                          nt_errstr(status));
3120                 goto fail;
3121         }
3122
3123         r.in.server_unc = talloc_asprintf(mem_ctx, "\\\\%s",
3124                                           dcerpc_server_name(p));
3125         r.in.share_name = share;
3126         r.in.level = 502;
3127
3128         status = dcerpc_srvsvc_NetShareGetInfo(p, p, &r);
3129         if (!NT_STATUS_IS_OK(status) || !W_ERROR_IS_OK(r.out.result)) {
3130                 d_printf("(%s) OpenHKLM failed: %s, %s\n", __location__,
3131                          nt_errstr(status), win_errstr(r.out.result));
3132                 goto fail;
3133         }
3134
3135         *info = talloc_move(mem_ctx, &r.out.info.info502);
3136         return NT_STATUS_OK;
3137
3138  fail:
3139         talloc_free(p);
3140         return status;
3141 }
3142
3143 /*
3144  * Get us a handle on HKLM\
3145  */
3146
3147 static NTSTATUS get_hklm_handle(TALLOC_CTX *mem_ctx,
3148                                 struct smbcli_state *cli,
3149                                 struct smb_iconv_convenience *iconv_convenience,
3150                                 struct dcerpc_pipe **pipe_p,
3151                                 struct policy_handle **handle)
3152 {
3153         struct smbcli_tree *ipc;
3154         struct dcerpc_pipe *p;
3155         struct winreg_OpenHKLM r;
3156         NTSTATUS status;
3157         struct policy_handle *result;
3158
3159         result = talloc(mem_ctx, struct policy_handle);
3160
3161         if (result == NULL) {
3162                 return NT_STATUS_NO_MEMORY;
3163         }
3164
3165         if (!(p = dcerpc_pipe_init(result,
3166                                    cli->transport->socket->event.ctx,
3167                                    iconv_convenience))) {
3168                 status = NT_STATUS_NO_MEMORY;
3169                 goto fail;
3170         }
3171
3172         status = secondary_tcon(p, cli->session, "IPC$", &ipc);
3173         if (!NT_STATUS_IS_OK(status)) {
3174                 goto fail;
3175         }
3176
3177         status = dcerpc_pipe_open_smb(p, ipc, "\\winreg");
3178         if (!NT_STATUS_IS_OK(status)) {
3179                 d_printf("dcerpc_pipe_open_smb failed: %s\n",
3180                          nt_errstr(status));
3181                 goto fail;
3182         }
3183
3184         status = dcerpc_bind_auth_none(p, &ndr_table_winreg);
3185         if (!NT_STATUS_IS_OK(status)) {
3186                 d_printf("dcerpc_bind_auth_none failed: %s\n",
3187                          nt_errstr(status));
3188                 goto fail;
3189         }
3190
3191         r.in.system_name = 0;
3192         r.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
3193         r.out.handle = result;
3194
3195         status = dcerpc_winreg_OpenHKLM(p, p, &r);
3196         if (!NT_STATUS_IS_OK(status) || !W_ERROR_IS_OK(r.out.result)) {
3197                 d_printf("(%s) OpenHKLM failed: %s, %s\n", __location__,
3198                          nt_errstr(status), win_errstr(r.out.result));
3199                 goto fail;
3200         }
3201
3202         *pipe_p = p;
3203         *handle = result;
3204         return NT_STATUS_OK;
3205
3206  fail:
3207         talloc_free(result);
3208         return status;
3209 }
3210
3211 static NTSTATUS torture_samba3_createshare(struct smbcli_state *cli,
3212                                            struct smb_iconv_convenience *iconv_convenience,
3213                                            const char *sharename)
3214 {
3215         struct dcerpc_pipe *p;
3216         struct policy_handle *hklm = NULL;
3217         struct policy_handle new_handle;
3218         struct winreg_CreateKey c;
3219         struct winreg_CloseKey cl;
3220         enum winreg_CreateAction action_taken;
3221         NTSTATUS status;
3222         TALLOC_CTX *mem_ctx;
3223
3224         mem_ctx = talloc_new(cli);
3225         NT_STATUS_HAVE_NO_MEMORY(mem_ctx);
3226
3227         status = get_hklm_handle(mem_ctx, cli, iconv_convenience, &p, &hklm);
3228         if (!NT_STATUS_IS_OK(status)) {
3229                 d_printf("get_hklm_handle failed: %s\n", nt_errstr(status));
3230                 goto fail;
3231         }
3232
3233         c.in.handle = hklm;
3234         c.in.name.name = talloc_asprintf(
3235                 mem_ctx, "software\\samba\\smbconf\\%s", sharename);
3236         if (c.in.name.name == NULL) {
3237                 d_printf("talloc_asprintf failed\n");
3238                 status = NT_STATUS_NO_MEMORY;
3239                 goto fail;
3240         }
3241         c.in.keyclass.name = "";
3242         c.in.options = 0;
3243         c.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
3244         c.in.secdesc = NULL;
3245         c.in.action_taken = &action_taken;
3246         c.out.new_handle = &new_handle;
3247         c.out.action_taken = &action_taken;
3248
3249         status = dcerpc_winreg_CreateKey(p, p, &c);
3250         if (!NT_STATUS_IS_OK(status) || !W_ERROR_IS_OK(c.out.result)) {
3251                 d_printf("(%s) OpenKey failed: %s, %s\n", __location__,
3252                          nt_errstr(status), win_errstr(c.out.result));
3253                 goto fail;
3254         }
3255
3256         cl.in.handle = &new_handle;
3257         cl.out.handle = &new_handle;
3258         status = dcerpc_winreg_CloseKey(p, p, &cl);
3259         if (!NT_STATUS_IS_OK(status) || !W_ERROR_IS_OK(cl.out.result)) {
3260                 d_printf("(%s) OpenKey failed: %s, %s\n", __location__,
3261                          nt_errstr(status), win_errstr(cl.out.result));
3262                 goto fail;
3263         }
3264
3265
3266  fail:
3267         talloc_free(mem_ctx);
3268         return status;
3269 }
3270
3271 static NTSTATUS torture_samba3_deleteshare(struct torture_context *torture,
3272                                            struct smbcli_state *cli,
3273                                            const char *sharename)
3274 {
3275         struct dcerpc_pipe *p;
3276         struct policy_handle *hklm = NULL;
3277         struct winreg_DeleteKey d;
3278         NTSTATUS status;
3279         TALLOC_CTX *mem_ctx;
3280
3281         mem_ctx = talloc_new(cli);
3282         NT_STATUS_HAVE_NO_MEMORY(mem_ctx);
3283
3284         status = get_hklm_handle(cli, cli, lp_iconv_convenience(torture->lp_ctx),
3285                                  &p, &hklm);
3286         if (!NT_STATUS_IS_OK(status)) {
3287                 d_printf("get_hklm_handle failed: %s\n", nt_errstr(status));
3288                 goto fail;
3289         }
3290
3291         d.in.handle = hklm;
3292         d.in.key.name = talloc_asprintf(
3293                 mem_ctx, "software\\samba\\smbconf\\%s", sharename);
3294         if (d.in.key.name == NULL) {
3295                 d_printf("talloc_asprintf failed\n");
3296                 status = NT_STATUS_NO_MEMORY;
3297                 goto fail;
3298         }
3299         status = dcerpc_winreg_DeleteKey(p, p, &d);
3300         if (!NT_STATUS_IS_OK(status) || !W_ERROR_IS_OK(d.out.result)) {
3301                 d_printf("(%s) OpenKey failed: %s, %s\n", __location__,
3302                          nt_errstr(status), win_errstr(d.out.result));
3303                 goto fail;
3304         }
3305
3306  fail:
3307         talloc_free(mem_ctx);
3308         return status;
3309 }
3310
3311 static NTSTATUS torture_samba3_setconfig(struct smbcli_state *cli,
3312                                          struct loadparm_context *lp_ctx,
3313                                          const char *sharename,
3314                                          const char *parameter,
3315                                          const char *value)
3316 {
3317         struct dcerpc_pipe *p = NULL;
3318         struct policy_handle *hklm = NULL, key_handle;
3319         struct winreg_OpenKey o;
3320         struct winreg_SetValue s;
3321         uint32_t type;
3322         DATA_BLOB val;
3323         NTSTATUS status;
3324
3325         status = get_hklm_handle(cli, cli, lp_iconv_convenience(lp_ctx), &p, &hklm);
3326         if (!NT_STATUS_IS_OK(status)) {
3327                 d_printf("get_hklm_handle failed: %s\n", nt_errstr(status));
3328                 return status;;
3329         }
3330
3331         o.in.parent_handle = hklm;
3332         o.in.keyname.name = talloc_asprintf(
3333                 hklm, "software\\samba\\smbconf\\%s", sharename);
3334         if (o.in.keyname.name == NULL) {
3335                 d_printf("talloc_asprintf failed\n");
3336                 status = NT_STATUS_NO_MEMORY;
3337                 goto done;
3338         }
3339         o.in.unknown = 0;
3340         o.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
3341         o.out.handle = &key_handle;
3342
3343         status = dcerpc_winreg_OpenKey(p, p, &o);
3344         if (!NT_STATUS_IS_OK(status) || !W_ERROR_IS_OK(o.out.result)) {
3345                 d_printf("(%s) OpenKey failed: %s, %s\n", __location__,
3346                          nt_errstr(status), win_errstr(o.out.result));
3347                 goto done;
3348         }
3349
3350         if (!reg_string_to_val(hklm, lp_iconv_convenience(lp_ctx), "REG_SZ",
3351                                value, &type, &val)) {
3352                 d_printf("(%s) reg_string_to_val failed\n", __location__);
3353                 goto done;
3354         }
3355
3356         s.in.handle = &key_handle;
3357         s.in.name.name = parameter;
3358         s.in.type = type;
3359         s.in.data = val.data;
3360         s.in.size = val.length;
3361
3362         status = dcerpc_winreg_SetValue(p, p, &s);
3363         if (!NT_STATUS_IS_OK(status) || !W_ERROR_IS_OK(s.out.result)) {
3364                 d_printf("(%s) SetValue failed: %s, %s\n", __location__,
3365                          nt_errstr(status), win_errstr(s.out.result));
3366                 goto done;
3367         }
3368
3369  done:
3370         talloc_free(hklm);
3371         return status;
3372 }
3373
3374 bool torture_samba3_regconfig(struct torture_context *torture)
3375 {
3376         struct smbcli_state *cli;
3377         struct srvsvc_NetShareInfo502 *i = NULL;
3378         NTSTATUS status;
3379         bool ret = false;
3380         const char *comment = "Dummer Kommentar";
3381
3382         if (!(torture_open_connection(&cli, torture, 0))) {
3383                 return false;
3384         }
3385
3386         status = torture_samba3_createshare(cli, lp_iconv_convenience(torture->lp_ctx), "blubber");
3387         if (!NT_STATUS_IS_OK(status)) {
3388                 torture_warning(torture, "torture_samba3_createshare failed: "
3389                                 "%s\n", nt_errstr(status));
3390                 goto done;
3391         }
3392
3393         status = torture_samba3_setconfig(cli, torture->lp_ctx, "blubber", "comment", comment);
3394         if (!NT_STATUS_IS_OK(status)) {
3395                 torture_warning(torture, "torture_samba3_setconfig failed: "
3396                                 "%s\n", nt_errstr(status));
3397                 goto done;
3398         }
3399
3400         status = get_shareinfo(torture, torture->lp_ctx, cli, "blubber", &i);
3401         if (!NT_STATUS_IS_OK(status)) {
3402                 torture_warning(torture, "get_shareinfo failed: "
3403                                 "%s\n", nt_errstr(status));
3404                 goto done;
3405         }
3406
3407         if (strcmp(comment, i->comment) != 0) {
3408                 torture_warning(torture, "Expected comment [%s], got [%s]\n",
3409                                 comment, i->comment);
3410                 goto done;
3411         }
3412
3413         status = torture_samba3_deleteshare(torture, cli, "blubber");
3414         if (!NT_STATUS_IS_OK(status)) {
3415                 torture_warning(torture, "torture_samba3_deleteshare failed: "
3416                                 "%s\n", nt_errstr(status));
3417                 goto done;
3418         }
3419
3420         ret = true;
3421  done:
3422         talloc_free(cli);
3423         return ret;
3424 }