source4/torture/rpc/handles.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3
   4    test suite for behaviour of rpc policy handles
   5
   6    Copyright (C) Andrew Tridgell 2007
   7
   8    This program is free software; you can redistribute it and/or modify
   9    it under the terms of the GNU General Public License as published by
  10    the Free Software Foundation; either version 3 of the License, or
  11    (at your option) any later version.
  12
  13    This program is distributed in the hope that it will be useful,
  14    but WITHOUT ANY WARRANTY; without even the implied warranty of
  15    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  16    GNU General Public License for more details.
  17
  18    You should have received a copy of the GNU General Public License
  19    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  20 */
  21
  22 #include "includes.h"
  23 #include "librpc/gen_ndr/ndr_samr_c.h"
  24 #include "librpc/gen_ndr/ndr_lsa_c.h"
  25 #include "librpc/gen_ndr/ndr_drsuapi_c.h"
  26 #include "torture/rpc/rpc.h"
  27
  28 /*
  29   this tests the use of policy handles between connections
  30 */
  31
  32 static bool test_handles_lsa(struct torture_context *torture)
  33 {
  34         NTSTATUS status;
  35         struct dcerpc_pipe *p1, *p2;
  36         struct dcerpc_binding_handle *b1, *b2;
  37         struct policy_handle handle;
  38         struct policy_handle handle2;
  39         struct lsa_ObjectAttribute attr;
  40         struct lsa_QosInfo qos;
  41         struct lsa_OpenPolicy r;
  42         struct lsa_Close c;
  43         uint16_t system_name = '\\';
  44         TALLOC_CTX *mem_ctx = talloc_new(torture);
  45
  46         torture_comment(torture, "RPC-HANDLE-LSARPC\n");
  47
  48         status = torture_rpc_connection(torture, &p1, &ndr_table_lsarpc);
  49         torture_assert_ntstatus_ok(torture, status, "opening lsa pipe1");
  50         b1 = p1->binding_handle;
  51
  52         status = torture_rpc_connection(torture, &p2, &ndr_table_lsarpc);
  53         torture_assert_ntstatus_ok(torture, status, "opening lsa pipe1");
  54         b2 = p2->binding_handle;
  55
  56         qos.len = 0;
  57         qos.impersonation_level = 2;
  58         qos.context_mode = 1;
  59         qos.effective_only = 0;
  60
  61         attr.len = 0;
  62         attr.root_dir = NULL;
  63         attr.object_name = NULL;
  64         attr.attributes = 0;
  65         attr.sec_desc = NULL;
  66         attr.sec_qos = &qos;
  67
  68         r.in.system_name = &system_name;
  69         r.in.attr = &attr;
  70         r.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
  71         r.out.handle = &handle;
  72
  73         torture_assert_ntstatus_ok(torture, dcerpc_lsa_OpenPolicy_r(b1, mem_ctx, &r),
  74                 "OpenPolicy failed");
  75         if (!NT_STATUS_IS_OK(r.out.result)) {
  76                 torture_comment(torture, "lsa_OpenPolicy not supported - skipping\n");
  77                 talloc_free(mem_ctx);
  78                 return true;
  79         }
  80
  81         c.in.handle = &handle;
  82         c.out.handle = &handle2;
  83
  84         status = dcerpc_lsa_Close_r(b2, mem_ctx, &c);
  85         torture_assert_ntstatus_equal(torture, status, NT_STATUS_NET_WRITE_FAULT,
  86                                       "closing policy handle on p2");
  87         torture_assert_int_equal(torture, p2->last_fault_code, DCERPC_FAULT_CONTEXT_MISMATCH,
  88                                       "closing policy handle on p2");
  89
  90         torture_assert_ntstatus_ok(torture, dcerpc_lsa_Close_r(b1, mem_ctx, &c),
  91                 "Close failed");
  92         torture_assert_ntstatus_ok(torture, c.out.result, "closing policy handle on p1");
  93
  94         status = dcerpc_lsa_Close_r(b1, mem_ctx, &c);
  95         torture_assert_ntstatus_equal(torture, status, NT_STATUS_NET_WRITE_FAULT,
  96                                       "closing policy handle on p1 again");
  97         torture_assert_int_equal(torture, p1->last_fault_code, DCERPC_FAULT_CONTEXT_MISMATCH,
  98                                       "closing policy handle on p1 again");
  99
 100         talloc_free(mem_ctx);
 101
 102         return true;
 103 }
 104
 105 static bool test_handles_lsa_shared(struct torture_context *torture)
 106 {
 107         NTSTATUS status;
 108         struct dcerpc_pipe *p1, *p2, *p3, *p4, *p5;
 109         struct dcerpc_binding_handle *b1, *b2, *b3, *b4;
 110         struct policy_handle handle;
 111         struct policy_handle handle2;
 112         struct lsa_ObjectAttribute attr;
 113         struct lsa_QosInfo qos;
 114         struct lsa_OpenPolicy r;
 115         struct lsa_Close c;
 116         struct lsa_QuerySecurity qsec;
 117         struct sec_desc_buf *sdbuf = NULL;
 118         uint16_t system_name = '\\';
 119         TALLOC_CTX *mem_ctx = talloc_new(torture);
 120         enum dcerpc_transport_t transport;
 121         uint32_t assoc_group_id;
 122
 123         torture_comment(torture, "RPC-HANDLE-LSARPC-SHARED\n");
 124
 125         torture_comment(torture, "connect lsa pipe1\n");
 126         status = torture_rpc_connection(torture, &p1, &ndr_table_lsarpc);
 127         torture_assert_ntstatus_ok(torture, status, "opening lsa pipe1");
 128         b1 = p1->binding_handle;
 129
 130         transport       = p1->conn->transport.transport;
 131         assoc_group_id  = p1->assoc_group_id;
 132
 133         torture_comment(torture, "use assoc_group_id[0x%08X] for new connections\n", assoc_group_id);
 134
 135         torture_comment(torture, "connect lsa pipe2\n");
 136         status = torture_rpc_connection_transport(torture, &p2, &ndr_table_lsarpc,
 137                                                   transport,
 138                                                   assoc_group_id);
 139         torture_assert_ntstatus_ok(torture, status, "opening lsa pipe2");
 140         b2 = p2->binding_handle;
 141
 142         torture_comment(torture, "got assoc_group_id[0x%08X] for p2\n",
 143                         p2->assoc_group_id);
 144
 145         qos.len = 0;
 146         qos.impersonation_level = 2;
 147         qos.context_mode = 1;
 148         qos.effective_only = 0;
 149
 150         attr.len = 0;
 151         attr.root_dir = NULL;
 152         attr.object_name = NULL;
 153         attr.attributes = 0;
 154         attr.sec_desc = NULL;
 155         attr.sec_qos = &qos;
 156
 157         r.in.system_name = &system_name;
 158         r.in.attr = &attr;
 159         r.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
 160         r.out.handle = &handle;
 161
 162         torture_comment(torture, "open lsa policy handle\n");
 163         torture_assert_ntstatus_ok(torture, dcerpc_lsa_OpenPolicy_r(b1, mem_ctx, &r),
 164                 "OpenPolicy failed");
 165         if (!NT_STATUS_IS_OK(r.out.result)) {
 166                 torture_comment(torture, "lsa_OpenPolicy not supported - skipping\n");
 167                 talloc_free(mem_ctx);
 168                 return true;
 169         }
 170
 171         /*
 172          * connect p3 after the policy handle is opened
 173          */
 174         torture_comment(torture, "connect lsa pipe3 after the policy handle is opened\n");
 175         status = torture_rpc_connection_transport(torture, &p3, &ndr_table_lsarpc,
 176                                                   transport,
 177                                                   assoc_group_id);
 178         torture_assert_ntstatus_ok(torture, status, "opening lsa pipe3");
 179         b3 = p3->binding_handle;
 180
 181         qsec.in.handle          = &handle;
 182         qsec.in.sec_info        = 0;
 183         qsec.out.sdbuf          = &sdbuf;
 184         c.in.handle = &handle;
 185         c.out.handle = &handle2;
 186
 187         /*
 188          * use policy handle on all 3 connections
 189          */
 190         torture_comment(torture, "use the policy handle on p1,p2,p3\n");
 191         torture_assert_ntstatus_ok(torture, dcerpc_lsa_QuerySecurity_r(b1, mem_ctx, &qsec),
 192                 "QuerySecurity failed");
 193         torture_assert_ntstatus_equal(torture, qsec.out.result, NT_STATUS_OK,
 194                                       "use policy handle on p1");
 195
 196         torture_assert_ntstatus_ok(torture, dcerpc_lsa_QuerySecurity_r(b2, mem_ctx, &qsec),
 197                 "QuerySecurity failed");
 198         torture_assert_ntstatus_equal(torture, qsec.out.result, NT_STATUS_OK,
 199                                       "use policy handle on p2");
 200
 201         torture_assert_ntstatus_ok(torture, dcerpc_lsa_QuerySecurity_r(b3, mem_ctx, &qsec),
 202                 "QuerySecurity failed");
 203         torture_assert_ntstatus_equal(torture, qsec.out.result, NT_STATUS_OK,
 204                                       "use policy handle on p3");
 205
 206         /*
 207          * close policy handle on connection 2 and the others get a fault
 208          */
 209         torture_comment(torture, "close the policy handle on p2 others get a fault\n");
 210         torture_assert_ntstatus_ok(torture, dcerpc_lsa_Close_r(b2, mem_ctx, &c),
 211                 "Close failed");
 212         torture_assert_ntstatus_equal(torture, c.out.result, NT_STATUS_OK,
 213                                       "closing policy handle on p2");
 214
 215         status = dcerpc_lsa_Close_r(b1, mem_ctx, &c);
 216
 217         torture_assert_ntstatus_equal(torture, status, NT_STATUS_NET_WRITE_FAULT,
 218                                       "closing policy handle on p1 again");
 219         torture_assert_int_equal(torture, p1->last_fault_code, DCERPC_FAULT_CONTEXT_MISMATCH,
 220                                       "closing policy handle on p1 again");
 221
 222         status = dcerpc_lsa_Close_r(b3, mem_ctx, &c);
 223         torture_assert_ntstatus_equal(torture, status, NT_STATUS_NET_WRITE_FAULT,
 224                                       "closing policy handle on p3");
 225         torture_assert_int_equal(torture, p3->last_fault_code, DCERPC_FAULT_CONTEXT_MISMATCH,
 226                                       "closing policy handle on p3");
 227
 228         status = dcerpc_lsa_Close_r(b2, mem_ctx, &c);
 229         torture_assert_ntstatus_equal(torture, status, NT_STATUS_NET_WRITE_FAULT,
 230                                       "closing policy handle on p2 again");
 231         torture_assert_int_equal(torture, p2->last_fault_code, DCERPC_FAULT_CONTEXT_MISMATCH,
 232                                       "closing policy handle on p2 again");
 233
 234         /*
 235          * open a new policy handle on p3
 236          */
 237         torture_comment(torture, "open a new policy handle on p3\n");
 238         torture_assert_ntstatus_ok(torture, dcerpc_lsa_OpenPolicy_r(b3, mem_ctx, &r),
 239                 "OpenPolicy failed");
 240         torture_assert_ntstatus_equal(torture, r.out.result, NT_STATUS_OK,
 241                                       "open policy handle on p3");
 242
 243         /*
 244          * use policy handle on all 3 connections
 245          */
 246         torture_comment(torture, "use the policy handle on p1,p2,p3\n");
 247         torture_assert_ntstatus_ok(torture, dcerpc_lsa_QuerySecurity_r(b1, mem_ctx, &qsec),
 248                 "Query Security failed");
 249         torture_assert_ntstatus_equal(torture, status, NT_STATUS_OK,
 250                                       "use policy handle on p1");
 251
 252         torture_assert_ntstatus_ok(torture, dcerpc_lsa_QuerySecurity_r(b2, mem_ctx, &qsec),
 253                 "Query Security failed");
 254         torture_assert_ntstatus_equal(torture, status, NT_STATUS_OK,
 255                                       "use policy handle on p2");
 256
 257         torture_assert_ntstatus_ok(torture, dcerpc_lsa_QuerySecurity_r(b3, mem_ctx, &qsec),
 258                 "Query Security failed");
 259         torture_assert_ntstatus_equal(torture, status, NT_STATUS_OK,
 260                                       "use policy handle on p3");
 261
 262         /*
 263          * close policy handle on connection 2 and the others get a fault
 264          */
 265         torture_comment(torture, "close the policy handle on p2 others get a fault\n");
 266         torture_assert_ntstatus_ok(torture, dcerpc_lsa_Close_r(b2, mem_ctx, &c),
 267                 "Close failed");
 268         torture_assert_ntstatus_equal(torture, c.out.result, NT_STATUS_OK,
 269                                       "closing policy handle on p2");
 270
 271         status = dcerpc_lsa_Close_r(b1, mem_ctx, &c);
 272         torture_assert_ntstatus_equal(torture, status, NT_STATUS_NET_WRITE_FAULT,
 273                                       "closing policy handle on p1 again");
 274         torture_assert_int_equal(torture, p1->last_fault_code, DCERPC_FAULT_CONTEXT_MISMATCH,
 275                                       "closing policy handle on p1 again");
 276
 277         status = dcerpc_lsa_Close_r(b3, mem_ctx, &c);
 278         torture_assert_ntstatus_equal(torture, status, NT_STATUS_NET_WRITE_FAULT,
 279                                       "closing policy handle on p3");
 280         torture_assert_int_equal(torture, p3->last_fault_code, DCERPC_FAULT_CONTEXT_MISMATCH,
 281                                       "closing policy handle on p3");
 282
 283         status = dcerpc_lsa_Close_r(b2, mem_ctx, &c);
 284         torture_assert_ntstatus_equal(torture, status, NT_STATUS_NET_WRITE_FAULT,
 285                                       "closing policy handle on p2 again");
 286         torture_assert_int_equal(torture, p2->last_fault_code, DCERPC_FAULT_CONTEXT_MISMATCH,
 287                                       "closing policy handle on p2 again");
 288
 289         /*
 290          * open a new policy handle
 291          */
 292         torture_comment(torture, "open a new policy handle on p1 and use it\n");
 293         torture_assert_ntstatus_ok(torture, dcerpc_lsa_OpenPolicy_r(b1, mem_ctx, &r),
 294                 "OpenPolicy failed");
 295         torture_assert_ntstatus_equal(torture, r.out.result, NT_STATUS_OK,
 296                                       "open 2nd policy handle on p1");
 297
 298         torture_assert_ntstatus_ok(torture, dcerpc_lsa_QuerySecurity_r(b1, mem_ctx, &qsec),
 299                 "QuerySecurity failed");
 300         torture_assert_ntstatus_equal(torture, qsec.out.result, NT_STATUS_OK,
 301                                       "QuerySecurity handle on p1");
 302
 303         /* close first connection */
 304         torture_comment(torture, "disconnect p1\n");
 305         talloc_free(p1);
 306         msleep(5);
 307
 308         /*
 309          * and it's still available on p2,p3
 310          */
 311         torture_comment(torture, "use policy handle on p2,p3\n");
 312         torture_assert_ntstatus_ok(torture, dcerpc_lsa_QuerySecurity_r(b2, mem_ctx, &qsec),
 313                 "QuerySecurity failed");
 314         torture_assert_ntstatus_equal(torture, qsec.out.result, NT_STATUS_OK,
 315                                       "QuerySecurity handle on p2 after p1 was disconnected");
 316
 317         torture_assert_ntstatus_ok(torture, dcerpc_lsa_QuerySecurity_r(b3, mem_ctx, &qsec),
 318                 "QuerySecurity failed");
 319         torture_assert_ntstatus_equal(torture, qsec.out.result, NT_STATUS_OK,
 320                                       "QuerySecurity handle on p3 after p1 was disconnected");
 321
 322         /*
 323          * now open p4
 324          * and use the handle on it
 325          */
 326         torture_comment(torture, "connect lsa pipe4 and use policy handle\n");
 327         status = torture_rpc_connection_transport(torture, &p4, &ndr_table_lsarpc,
 328                                                   transport,
 329                                                   assoc_group_id);
 330         torture_assert_ntstatus_ok(torture, status, "opening lsa pipe4");
 331         b4 = p4->binding_handle;
 332
 333         torture_assert_ntstatus_ok(torture, dcerpc_lsa_QuerySecurity_r(b4, mem_ctx, &qsec),
 334                 "QuerySecurity failed");
 335         torture_assert_ntstatus_equal(torture, qsec.out.result, NT_STATUS_OK,
 336                                       "using policy handle on p4");
 337
 338         /*
 339          * now close p2,p3,p4
 340          * without closing the policy handle
 341          */
 342         torture_comment(torture, "disconnect p2,p3,p4\n");
 343         talloc_free(p2);
 344         talloc_free(p3);
 345         talloc_free(p4);
 346         msleep(10);
 347
 348         /*
 349          * now open p5
 350          */
 351         torture_comment(torture, "connect lsa pipe5 - should fail\n");
 352         status = torture_rpc_connection_transport(torture, &p5, &ndr_table_lsarpc,
 353                                                   transport,
 354                                                   assoc_group_id);
 355         torture_assert_ntstatus_equal(torture, status, NT_STATUS_UNSUCCESSFUL,
 356                                       "opening lsa pipe5");
 357
 358         talloc_free(mem_ctx);
 359
 360         return true;
 361 }
 362
 363
 364 static bool test_handles_samr(struct torture_context *torture)
 365 {
 366         NTSTATUS status;
 367         struct dcerpc_pipe *p1, *p2;
 368         struct dcerpc_binding_handle *b1, *b2;
 369         struct policy_handle handle;
 370         struct policy_handle handle2;
 371         struct samr_Connect r;
 372         struct samr_Close c;
 373         TALLOC_CTX *mem_ctx = talloc_new(torture);
 374
 375         torture_comment(torture, "RPC-HANDLE-SAMR\n");
 376
 377         status = torture_rpc_connection(torture, &p1, &ndr_table_samr);
 378         torture_assert_ntstatus_ok(torture, status, "opening samr pipe1");
 379         b1 = p1->binding_handle;
 380
 381         status = torture_rpc_connection(torture, &p2, &ndr_table_samr);
 382         torture_assert_ntstatus_ok(torture, status, "opening samr pipe1");
 383         b2 = p2->binding_handle;
 384
 385         r.in.system_name = 0;
 386         r.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
 387         r.out.connect_handle = &handle;
 388
 389         torture_assert_ntstatus_ok(torture, dcerpc_samr_Connect_r(b1, mem_ctx, &r),
 390                 "Connect failed");
 391         torture_assert_ntstatus_ok(torture, r.out.result, "opening policy handle on p1");
 392
 393         c.in.handle = &handle;
 394         c.out.handle = &handle2;
 395
 396         status = dcerpc_samr_Close_r(b2, mem_ctx, &c);
 397         torture_assert_ntstatus_equal(torture, status, NT_STATUS_NET_WRITE_FAULT,
 398                                       "closing policy handle on p2");
 399         torture_assert_int_equal(torture, p2->last_fault_code, DCERPC_FAULT_CONTEXT_MISMATCH,
 400                                       "closing policy handle on p2");
 401
 402         torture_assert_ntstatus_ok(torture, dcerpc_samr_Close_r(b1, mem_ctx, &c),
 403                 "Close failed");
 404         torture_assert_ntstatus_ok(torture, c.out.result, "closing policy handle on p1");
 405
 406         status = dcerpc_samr_Close_r(b1, mem_ctx, &c);
 407         torture_assert_ntstatus_equal(torture, status, NT_STATUS_NET_WRITE_FAULT,
 408                                       "closing policy handle on p1 again");
 409         torture_assert_int_equal(torture, p1->last_fault_code, DCERPC_FAULT_CONTEXT_MISMATCH,
 410                                       "closing policy handle on p1 again");
 411
 412         talloc_free(mem_ctx);
 413
 414         return true;
 415 }
 416
 417 static bool test_handles_mixed_shared(struct torture_context *torture)
 418 {
 419         NTSTATUS status;
 420         struct dcerpc_pipe *p1, *p2, *p3, *p4, *p5, *p6;
 421         struct dcerpc_binding_handle *b1, *b2;
 422         struct policy_handle handle;
 423         struct policy_handle handle2;
 424         struct samr_Connect r;
 425         struct lsa_Close lc;
 426         struct samr_Close sc;
 427         TALLOC_CTX *mem_ctx = talloc_new(torture);
 428         enum dcerpc_transport_t transport;
 429         uint32_t assoc_group_id;
 430
 431         torture_comment(torture, "RPC-HANDLE-MIXED-SHARED\n");
 432
 433         torture_comment(torture, "connect samr pipe1\n");
 434         status = torture_rpc_connection(torture, &p1, &ndr_table_samr);
 435         torture_assert_ntstatus_ok(torture, status, "opening samr pipe1");
 436         b1 = p1->binding_handle;
 437
 438         transport       = p1->conn->transport.transport;
 439         assoc_group_id  = p1->assoc_group_id;
 440
 441         torture_comment(torture, "use assoc_group_id[0x%08X] for new connections\n", assoc_group_id);
 442
 443         torture_comment(torture, "connect lsa pipe2\n");
 444         status = torture_rpc_connection_transport(torture, &p2, &ndr_table_lsarpc,
 445                                                   transport,
 446                                                   assoc_group_id);
 447         torture_assert_ntstatus_ok(torture, status, "opening lsa pipe2");
 448         b2 = p2->binding_handle;
 449
 450         torture_comment(torture, "got assoc_group_id[0x%08X] for p2\n",
 451                         p2->assoc_group_id);
 452         r.in.system_name = 0;
 453         r.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
 454         r.out.connect_handle = &handle;
 455
 456         torture_comment(torture, "samr_Connect to open a policy handle on samr p1\n");
 457         torture_assert_ntstatus_ok(torture, dcerpc_samr_Connect_r(b1, mem_ctx, &r),
 458                 "Connect failed");
 459         torture_assert_ntstatus_ok(torture, r.out.result, "opening policy handle on p1");
 460
 461         lc.in.handle            = &handle;
 462         lc.out.handle           = &handle2;
 463         sc.in.handle            = &handle;
 464         sc.out.handle           = &handle2;
 465
 466         torture_comment(torture, "use policy handle on lsa p2 - should fail\n");
 467         status = dcerpc_lsa_Close_r(b2, mem_ctx, &lc);
 468         torture_assert_ntstatus_equal(torture, status, NT_STATUS_NET_WRITE_FAULT,
 469                                       "closing handle on lsa p2");
 470         torture_assert_int_equal(torture, p2->last_fault_code, DCERPC_FAULT_CONTEXT_MISMATCH,
 471                                       "closing handle on lsa p2");
 472
 473         torture_comment(torture, "closing policy handle on samr p1\n");
 474         torture_assert_ntstatus_ok(torture, dcerpc_samr_Close_r(b1, mem_ctx, &sc),
 475                 "Close failed");
 476         torture_assert_ntstatus_ok(torture, sc.out.result, "closing policy handle on p1");
 477
 478         talloc_free(p1);
 479         talloc_free(p2);
 480         msleep(10);
 481
 482         torture_comment(torture, "connect samr pipe3 - should fail\n");
 483         status = torture_rpc_connection_transport(torture, &p3, &ndr_table_samr,
 484                                                   transport,
 485                                                   assoc_group_id);
 486         torture_assert_ntstatus_equal(torture, status, NT_STATUS_UNSUCCESSFUL,
 487                                       "opening samr pipe3");
 488
 489         torture_comment(torture, "connect lsa pipe4 - should fail\n");
 490         status = torture_rpc_connection_transport(torture, &p4, &ndr_table_lsarpc,
 491                                                   transport,
 492                                                   assoc_group_id);
 493         torture_assert_ntstatus_equal(torture, status, NT_STATUS_UNSUCCESSFUL,
 494                                       "opening lsa pipe4");
 495
 496         torture_comment(torture, "connect samr pipe5 with assoc_group_id[0x%08X]- should fail\n", ++assoc_group_id);
 497         status = torture_rpc_connection_transport(torture, &p5, &ndr_table_samr,
 498                                                   transport,
 499                                                   assoc_group_id);
 500         torture_assert_ntstatus_equal(torture, status, NT_STATUS_UNSUCCESSFUL,
 501                                       "opening samr pipe5");
 502
 503         torture_comment(torture, "connect lsa pipe6 with assoc_group_id[0x%08X]- should fail\n", ++assoc_group_id);
 504         status = torture_rpc_connection_transport(torture, &p6, &ndr_table_lsarpc,
 505                                                   transport,
 506                                                   assoc_group_id);
 507         torture_assert_ntstatus_equal(torture, status, NT_STATUS_UNSUCCESSFUL,
 508                                       "opening lsa pipe6");
 509
 510         talloc_free(mem_ctx);
 511
 512         return true;
 513 }
 514
 515 static bool test_handles_random_assoc(struct torture_context *torture)
 516 {
 517         NTSTATUS status;
 518         struct dcerpc_pipe *p1, *p2, *p3;
 519         TALLOC_CTX *mem_ctx = talloc_new(torture);
 520         enum dcerpc_transport_t transport;
 521         uint32_t assoc_group_id;
 522
 523         torture_comment(torture, "RPC-HANDLE-RANDOM-ASSOC\n");
 524
 525         torture_comment(torture, "connect samr pipe1\n");
 526         status = torture_rpc_connection(torture, &p1, &ndr_table_samr);
 527         torture_assert_ntstatus_ok(torture, status, "opening samr pipe1");
 528
 529         transport       = p1->conn->transport.transport;
 530         assoc_group_id  = p1->assoc_group_id;
 531
 532         torture_comment(torture, "pip1 use assoc_group_id[0x%08X]\n", assoc_group_id);
 533
 534         torture_comment(torture, "connect samr pipe2 with assoc_group_id[0x%08X]- should fail\n", ++assoc_group_id);
 535         status = torture_rpc_connection_transport(torture, &p2, &ndr_table_samr,
 536                                                   transport,
 537                                                   assoc_group_id);
 538         torture_assert_ntstatus_equal(torture, status, NT_STATUS_UNSUCCESSFUL,
 539                                       "opening samr pipe2");
 540
 541         torture_comment(torture, "connect samr pipe3 with assoc_group_id[0x%08X]- should fail\n", ++assoc_group_id);
 542         status = torture_rpc_connection_transport(torture, &p3, &ndr_table_samr,
 543                                                   transport,
 544                                                   assoc_group_id);
 545         torture_assert_ntstatus_equal(torture, status, NT_STATUS_UNSUCCESSFUL,
 546                                       "opening samr pipe3");
 547
 548         talloc_free(mem_ctx);
 549
 550         return true;
 551 }
 552
 553
 554 static bool test_handles_drsuapi(struct torture_context *torture)
 555 {
 556         NTSTATUS status;
 557         struct dcerpc_pipe *p1, *p2;
 558         struct dcerpc_binding_handle *b1, *b2;
 559         struct policy_handle handle;
 560         struct policy_handle handle2;
 561         struct GUID bind_guid;
 562         struct drsuapi_DsBind r;
 563         struct drsuapi_DsUnbind c;
 564         TALLOC_CTX *mem_ctx = talloc_new(torture);
 565
 566         torture_comment(torture, "RPC-HANDLE-DRSUAPI\n");
 567
 568         status = torture_rpc_connection(torture, &p1, &ndr_table_drsuapi);
 569         torture_assert_ntstatus_ok(torture, status, "opening drsuapi pipe1");
 570         b1 = p1->binding_handle;
 571
 572         status = torture_rpc_connection(torture, &p2, &ndr_table_drsuapi);
 573         torture_assert_ntstatus_ok(torture, status, "opening drsuapi pipe1");
 574         b2 = p2->binding_handle;
 575
 576         GUID_from_string(DRSUAPI_DS_BIND_GUID, &bind_guid);
 577
 578         r.in.bind_guid = &bind_guid;
 579         r.in.bind_info = NULL;
 580         r.out.bind_handle = &handle;
 581
 582         status = dcerpc_drsuapi_DsBind_r(b1, mem_ctx, &r);
 583         if (!NT_STATUS_IS_OK(status)) {
 584                 torture_comment(torture, "drsuapi_DsBind not supported - skipping\n");
 585                 talloc_free(mem_ctx);
 586                 return true;
 587         }
 588
 589         c.in.bind_handle = &handle;
 590         c.out.bind_handle = &handle2;
 591
 592         status = dcerpc_drsuapi_DsUnbind_r(b2, mem_ctx, &c);
 593         torture_assert_ntstatus_equal(torture, status, NT_STATUS_NET_WRITE_FAULT,
 594                                       "closing policy handle on p2");
 595         torture_assert_int_equal(torture, p2->last_fault_code, DCERPC_FAULT_CONTEXT_MISMATCH,
 596                                       "closing policy handle on p2");
 597
 598         status = dcerpc_drsuapi_DsUnbind_r(b1, mem_ctx, &c);
 599         torture_assert_ntstatus_ok(torture, status, "closing policy handle on p1");
 600
 601         status = dcerpc_drsuapi_DsUnbind_r(b1, mem_ctx, &c);
 602         torture_assert_ntstatus_equal(torture, status, NT_STATUS_NET_WRITE_FAULT,
 603                                       "closing policy handle on p1 again");
 604         torture_assert_int_equal(torture, p1->last_fault_code, DCERPC_FAULT_CONTEXT_MISMATCH,
 605                                       "closing policy handle on p1 again");
 606
 607         talloc_free(mem_ctx);
 608
 609         return true;
 610 }
 611
 612 struct torture_suite *torture_rpc_handles(TALLOC_CTX *mem_ctx)
 613 {
 614         struct torture_suite *suite;
 615
 616         suite = torture_suite_create(mem_ctx, "HANDLES");
 617         torture_suite_add_simple_test(suite, "lsarpc", test_handles_lsa);
 618         torture_suite_add_simple_test(suite, "lsarpc-shared", test_handles_lsa_shared);
 619         torture_suite_add_simple_test(suite, "samr", test_handles_samr);
 620         torture_suite_add_simple_test(suite, "mixed-shared", test_handles_mixed_shared);
 621         torture_suite_add_simple_test(suite, "random-assoc", test_handles_random_assoc);
 622         torture_suite_add_simple_test(suite, "drsuapi", test_handles_drsuapi);
 623         return suite;
 624 }