cfdf483f8d613cf4e90b827cabd3dde5510e0de4
[gd/samba-autobuild/.git] / source4 / torture / rpc / lsa.c
1 /* 
2    Unix SMB/CIFS implementation.
3    test suite for lsa rpc operations
4
5    Copyright (C) Andrew Tridgell 2003
6    Copyright (C) Andrew Bartlett <abartlet@samba.org> 2004-2005
7    
8    This program is free software; you can redistribute it and/or modify
9    it under the terms of the GNU General Public License as published by
10    the Free Software Foundation; either version 3 of the License, or
11    (at your option) any later version.
12    
13    This program is distributed in the hope that it will be useful,
14    but WITHOUT ANY WARRANTY; without even the implied warranty of
15    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
16    GNU General Public License for more details.
17    
18    You should have received a copy of the GNU General Public License
19    along with this program.  If not, see <http://www.gnu.org/licenses/>.
20 */
21
22 #include "includes.h"
23 #include "torture/torture.h"
24 #include "librpc/gen_ndr/ndr_lsa_c.h"
25 #include "librpc/gen_ndr/netlogon.h"
26 #include "lib/events/events.h"
27 #include "libcli/security/security.h"
28 #include "libcli/auth/libcli_auth.h"
29 #include "torture/rpc/rpc.h"
30
31 static void init_lsa_String(struct lsa_String *name, const char *s)
32 {
33         name->string = s;
34 }
35
36 static BOOL test_OpenPolicy(struct dcerpc_pipe *p, TALLOC_CTX *mem_ctx)
37 {
38         struct lsa_ObjectAttribute attr;
39         struct policy_handle handle;
40         struct lsa_QosInfo qos;
41         struct lsa_OpenPolicy r;
42         NTSTATUS status;
43         uint16_t system_name = '\\';
44
45         printf("\ntesting OpenPolicy\n");
46
47         qos.len = 0;
48         qos.impersonation_level = 2;
49         qos.context_mode = 1;
50         qos.effective_only = 0;
51
52         attr.len = 0;
53         attr.root_dir = NULL;
54         attr.object_name = NULL;
55         attr.attributes = 0;
56         attr.sec_desc = NULL;
57         attr.sec_qos = &qos;
58
59         r.in.system_name = &system_name;
60         r.in.attr = &attr;
61         r.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
62         r.out.handle = &handle;
63
64         status = dcerpc_lsa_OpenPolicy(p, mem_ctx, &r);
65         if (!NT_STATUS_IS_OK(status)) {
66                 if (NT_STATUS_EQUAL(status, NT_STATUS_ACCESS_DENIED) ||
67                     NT_STATUS_EQUAL(status, NT_STATUS_RPC_PROTSEQ_NOT_SUPPORTED)) {
68                         printf("not considering %s to be an error\n", nt_errstr(status));
69                         return True;
70                 }
71                 printf("OpenPolicy failed - %s\n", nt_errstr(status));
72                 return False;
73         }
74
75         return True;
76 }
77
78
79 BOOL test_lsa_OpenPolicy2(struct dcerpc_pipe *p, TALLOC_CTX *mem_ctx, 
80                           struct policy_handle **handle)
81 {
82         struct lsa_ObjectAttribute attr;
83         struct lsa_QosInfo qos;
84         struct lsa_OpenPolicy2 r;
85         NTSTATUS status;
86
87         printf("\ntesting OpenPolicy2\n");
88
89         *handle = talloc(mem_ctx, struct policy_handle);
90         if (!*handle) {
91                 return False;
92         }
93
94         qos.len = 0;
95         qos.impersonation_level = 2;
96         qos.context_mode = 1;
97         qos.effective_only = 0;
98
99         attr.len = 0;
100         attr.root_dir = NULL;
101         attr.object_name = NULL;
102         attr.attributes = 0;
103         attr.sec_desc = NULL;
104         attr.sec_qos = &qos;
105
106         r.in.system_name = "\\";
107         r.in.attr = &attr;
108         r.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
109         r.out.handle = *handle;
110
111         status = dcerpc_lsa_OpenPolicy2(p, mem_ctx, &r);
112         if (!NT_STATUS_IS_OK(status)) {
113                 if (NT_STATUS_EQUAL(status, NT_STATUS_ACCESS_DENIED) ||
114                     NT_STATUS_EQUAL(status, NT_STATUS_RPC_PROTSEQ_NOT_SUPPORTED)) {
115                         printf("not considering %s to be an error\n", nt_errstr(status));
116                         talloc_free(*handle);
117                         *handle = NULL;
118                         return True;
119                 }
120                 printf("OpenPolicy2 failed - %s\n", nt_errstr(status));
121                 return False;
122         }
123
124         return True;
125 }
126
127 static BOOL test_LookupNames(struct dcerpc_pipe *p, 
128                             TALLOC_CTX *mem_ctx, 
129                             struct policy_handle *handle,
130                             struct lsa_TransNameArray *tnames)
131 {
132         struct lsa_LookupNames r;
133         struct lsa_TransSidArray sids;
134         struct lsa_String *names;
135         uint32_t count = 0;
136         NTSTATUS status;
137         int i;
138
139         printf("\nTesting LookupNames with %d names\n", tnames->count);
140
141         sids.count = 0;
142         sids.sids = NULL;
143
144         names = talloc_array(mem_ctx, struct lsa_String, tnames->count);
145         for (i=0;i<tnames->count;i++) {
146                 init_lsa_String(&names[i], tnames->names[i].name.string);
147         }
148
149         r.in.handle = handle;
150         r.in.num_names = tnames->count;
151         r.in.names = names;
152         r.in.sids = &sids;
153         r.in.level = 1;
154         r.in.count = &count;
155         r.out.count = &count;
156         r.out.sids = &sids;
157
158         status = dcerpc_lsa_LookupNames(p, mem_ctx, &r);
159         if (!NT_STATUS_IS_OK(status) && !NT_STATUS_EQUAL(status, STATUS_SOME_UNMAPPED)) {
160                 printf("LookupNames failed - %s\n", nt_errstr(status));
161                 return False;
162         }
163
164         printf("\n");
165
166         return True;
167 }
168
169 static BOOL test_LookupNames2(struct dcerpc_pipe *p, 
170                               TALLOC_CTX *mem_ctx, 
171                               struct policy_handle *handle,
172                               struct lsa_TransNameArray2 *tnames)
173 {
174         struct lsa_LookupNames2 r;
175         struct lsa_TransSidArray2 sids;
176         struct lsa_String *names;
177         uint32_t count = 0;
178         NTSTATUS status;
179         int i;
180
181         printf("\nTesting LookupNames2 with %d names\n", tnames->count);
182
183         sids.count = 0;
184         sids.sids = NULL;
185
186         names = talloc_array(mem_ctx, struct lsa_String, tnames->count);
187         for (i=0;i<tnames->count;i++) {
188                 init_lsa_String(&names[i], tnames->names[i].name.string);
189         }
190
191         r.in.handle = handle;
192         r.in.num_names = tnames->count;
193         r.in.names = names;
194         r.in.sids = &sids;
195         r.in.level = 1;
196         r.in.count = &count;
197         r.in.unknown1 = 0;
198         r.in.unknown2 = 0;
199         r.out.count = &count;
200         r.out.sids = &sids;
201
202         status = dcerpc_lsa_LookupNames2(p, mem_ctx, &r);
203         if (!NT_STATUS_IS_OK(status) && !NT_STATUS_EQUAL(status, STATUS_SOME_UNMAPPED)) {
204                 printf("LookupNames2 failed - %s\n", nt_errstr(status));
205                 return False;
206         }
207
208         printf("\n");
209
210         return True;
211 }
212
213
214 static BOOL test_LookupNames3(struct dcerpc_pipe *p, 
215                               TALLOC_CTX *mem_ctx, 
216                               struct policy_handle *handle,
217                               struct lsa_TransNameArray2 *tnames)
218 {
219         struct lsa_LookupNames3 r;
220         struct lsa_TransSidArray3 sids;
221         struct lsa_String *names;
222         uint32_t count = 0;
223         NTSTATUS status;
224         int i;
225
226         printf("\nTesting LookupNames3 with %d names\n", tnames->count);
227
228         sids.count = 0;
229         sids.sids = NULL;
230
231         names = talloc_array(mem_ctx, struct lsa_String, tnames->count);
232         for (i=0;i<tnames->count;i++) {
233                 init_lsa_String(&names[i], tnames->names[i].name.string);
234         }
235
236         r.in.handle = handle;
237         r.in.num_names = tnames->count;
238         r.in.names = names;
239         r.in.sids = &sids;
240         r.in.level = 1;
241         r.in.count = &count;
242         r.in.unknown1 = 0;
243         r.in.unknown2 = 0;
244         r.out.count = &count;
245         r.out.sids = &sids;
246
247         status = dcerpc_lsa_LookupNames3(p, mem_ctx, &r);
248         if (!NT_STATUS_IS_OK(status) && !NT_STATUS_EQUAL(status, STATUS_SOME_UNMAPPED)) {
249                 printf("LookupNames3 failed - %s\n", nt_errstr(status));
250                 return False;
251         }
252
253         printf("\n");
254
255         return True;
256 }
257
258 static BOOL test_LookupNames4(struct dcerpc_pipe *p, 
259                               TALLOC_CTX *mem_ctx, 
260                               struct lsa_TransNameArray2 *tnames)
261 {
262         struct lsa_LookupNames4 r;
263         struct lsa_TransSidArray3 sids;
264         struct lsa_String *names;
265         uint32_t count = 0;
266         NTSTATUS status;
267         int i;
268
269         printf("\nTesting LookupNames4 with %d names\n", tnames->count);
270
271         sids.count = 0;
272         sids.sids = NULL;
273
274         names = talloc_array(mem_ctx, struct lsa_String, tnames->count);
275         for (i=0;i<tnames->count;i++) {
276                 init_lsa_String(&names[i], tnames->names[i].name.string);
277         }
278
279         r.in.num_names = tnames->count;
280         r.in.names = names;
281         r.in.sids = &sids;
282         r.in.level = 1;
283         r.in.count = &count;
284         r.in.unknown1 = 0;
285         r.in.unknown2 = 0;
286         r.out.count = &count;
287         r.out.sids = &sids;
288
289         status = dcerpc_lsa_LookupNames4(p, mem_ctx, &r);
290         if (!NT_STATUS_IS_OK(status) && !NT_STATUS_EQUAL(status, STATUS_SOME_UNMAPPED)) {
291                 printf("LookupNames4 failed - %s\n", nt_errstr(status));
292                 return False;
293         }
294
295         printf("\n");
296
297         return True;
298 }
299
300
301 static BOOL test_LookupSids(struct dcerpc_pipe *p, 
302                             TALLOC_CTX *mem_ctx, 
303                             struct policy_handle *handle,
304                             struct lsa_SidArray *sids)
305 {
306         struct lsa_LookupSids r;
307         struct lsa_TransNameArray names;
308         uint32_t count = sids->num_sids;
309         NTSTATUS status;
310
311         printf("\nTesting LookupSids\n");
312
313         names.count = 0;
314         names.names = NULL;
315
316         r.in.handle = handle;
317         r.in.sids = sids;
318         r.in.names = &names;
319         r.in.level = 1;
320         r.in.count = &count;
321         r.out.count = &count;
322         r.out.names = &names;
323
324         status = dcerpc_lsa_LookupSids(p, mem_ctx, &r);
325         if (!NT_STATUS_IS_OK(status) && !NT_STATUS_EQUAL(status, STATUS_SOME_UNMAPPED)) {
326                 printf("LookupSids failed - %s\n", nt_errstr(status));
327                 return False;
328         }
329
330         printf("\n");
331
332         if (!test_LookupNames(p, mem_ctx, handle, &names)) {
333                 return False;
334         }
335
336         return True;
337 }
338
339
340 static BOOL test_LookupSids2(struct dcerpc_pipe *p, 
341                             TALLOC_CTX *mem_ctx, 
342                             struct policy_handle *handle,
343                             struct lsa_SidArray *sids)
344 {
345         struct lsa_LookupSids2 r;
346         struct lsa_TransNameArray2 names;
347         uint32_t count = sids->num_sids;
348         NTSTATUS status;
349
350         printf("\nTesting LookupSids2\n");
351
352         names.count = 0;
353         names.names = NULL;
354
355         r.in.handle = handle;
356         r.in.sids = sids;
357         r.in.names = &names;
358         r.in.level = 1;
359         r.in.count = &count;
360         r.in.unknown1 = 0;
361         r.in.unknown2 = 0;
362         r.out.count = &count;
363         r.out.names = &names;
364
365         status = dcerpc_lsa_LookupSids2(p, mem_ctx, &r);
366         if (!NT_STATUS_IS_OK(status) && !NT_STATUS_EQUAL(status, STATUS_SOME_UNMAPPED)) {
367                 printf("LookupSids2 failed - %s\n", nt_errstr(status));
368                 return False;
369         }
370
371         printf("\n");
372
373         if (!test_LookupNames2(p, mem_ctx, handle, &names)) {
374                 return False;
375         }
376
377         if (!test_LookupNames3(p, mem_ctx, handle, &names)) {
378                 return False;
379         }
380
381         return True;
382 }
383
384 static BOOL test_LookupSids3(struct dcerpc_pipe *p, 
385                             TALLOC_CTX *mem_ctx, 
386                             struct lsa_SidArray *sids)
387 {
388         struct lsa_LookupSids3 r;
389         struct lsa_TransNameArray2 names;
390         uint32_t count = sids->num_sids;
391         NTSTATUS status;
392
393         printf("\nTesting LookupSids3\n");
394
395         names.count = 0;
396         names.names = NULL;
397
398         r.in.sids = sids;
399         r.in.names = &names;
400         r.in.level = 1;
401         r.in.count = &count;
402         r.in.unknown1 = 0;
403         r.in.unknown2 = 0;
404         r.out.count = &count;
405         r.out.names = &names;
406
407         status = dcerpc_lsa_LookupSids3(p, mem_ctx, &r);
408         if (!NT_STATUS_IS_OK(status) && !NT_STATUS_EQUAL(status, STATUS_SOME_UNMAPPED)) {
409                 if (NT_STATUS_EQUAL(status, NT_STATUS_ACCESS_DENIED) ||
410                     NT_STATUS_EQUAL(status, NT_STATUS_RPC_PROTSEQ_NOT_SUPPORTED)) {
411                         printf("not considering %s to be an error\n", nt_errstr(status));
412                         return True;
413                 }
414                 printf("LookupSids3 failed - %s - not considered an error\n", 
415                        nt_errstr(status));
416                 return False;
417         }
418
419         printf("\n");
420
421         if (!test_LookupNames4(p, mem_ctx, &names)) {
422                 return False;
423         }
424
425         return True;
426 }
427
428 BOOL test_many_LookupSids(struct dcerpc_pipe *p, 
429                           TALLOC_CTX *mem_ctx, 
430                           struct policy_handle *handle)
431 {
432         uint32_t count;
433         NTSTATUS status;
434         struct lsa_SidArray sids;
435         int i;
436
437         printf("\nTesting LookupSids with lots of SIDs\n");
438
439         sids.num_sids = 100;
440
441         sids.sids = talloc_array(mem_ctx, struct lsa_SidPtr, sids.num_sids);
442
443         for (i=0; i<sids.num_sids; i++) {
444                 const char *sidstr = "S-1-5-32-545";
445                 sids.sids[i].sid = dom_sid_parse_talloc(mem_ctx, sidstr);
446         }
447
448         count = sids.num_sids;
449
450         if (handle) {
451                 struct lsa_LookupSids r;
452                 struct lsa_TransNameArray names;
453                 names.count = 0;
454                 names.names = NULL;
455
456                 r.in.handle = handle;
457                 r.in.sids = &sids;
458                 r.in.names = &names;
459                 r.in.level = 1;
460                 r.in.count = &names.count;
461                 r.out.count = &count;
462                 r.out.names = &names;
463                 
464                 status = dcerpc_lsa_LookupSids(p, mem_ctx, &r);
465                 if (!NT_STATUS_IS_OK(status) &&
466                     !NT_STATUS_EQUAL(status, STATUS_SOME_UNMAPPED)) {
467                         printf("LookupSids failed - %s\n", nt_errstr(status));
468                         return False;
469                 }
470                 
471                 printf("\n");
472                 
473                 if (!test_LookupNames(p, mem_ctx, handle, &names)) {
474                         return False;
475                 }
476         } else {
477                 struct lsa_LookupSids3 r;
478                 struct lsa_TransNameArray2 names;
479
480                 names.count = 0;
481                 names.names = NULL;
482
483                 printf("\nTesting LookupSids3\n");
484                 
485                 r.in.sids = &sids;
486                 r.in.names = &names;
487                 r.in.level = 1;
488                 r.in.count = &count;
489                 r.in.unknown1 = 0;
490                 r.in.unknown2 = 0;
491                 r.out.count = &count;
492                 r.out.names = &names;
493                 
494                 status = dcerpc_lsa_LookupSids3(p, mem_ctx, &r);
495                 if (!NT_STATUS_IS_OK(status) && !NT_STATUS_EQUAL(status, STATUS_SOME_UNMAPPED)) {
496                         if (NT_STATUS_EQUAL(status, NT_STATUS_ACCESS_DENIED) ||
497                             NT_STATUS_EQUAL(status, NT_STATUS_RPC_PROTSEQ_NOT_SUPPORTED)) {
498                                 printf("not considering %s to be an error\n", nt_errstr(status));
499                                 return True;
500                         }
501                         printf("LookupSids3 failed - %s\n", 
502                                nt_errstr(status));
503                         return False;
504                 }
505                 if (!test_LookupNames4(p, mem_ctx, &names)) {
506                         return False;
507                 }
508         }
509
510         printf("\n");
511
512
513
514         return True;
515 }
516
517 static void lookupsids_cb(struct rpc_request *req)
518 {
519         int *replies = (int *)req->async.private_data;
520         NTSTATUS status;
521
522         status = dcerpc_ndr_request_recv(req);
523         if (!NT_STATUS_IS_OK(status)) {
524                 printf("lookupsids returned %s\n", nt_errstr(status));
525                 *replies = -1;
526         }
527
528         if (*replies >= 0) {
529                 *replies += 1;
530         }
531 }
532
533 static BOOL test_LookupSids_async(struct dcerpc_pipe *p, 
534                                   TALLOC_CTX *mem_ctx, 
535                                   struct policy_handle *handle)
536 {
537         struct lsa_SidArray sids;
538         struct lsa_SidPtr sidptr;
539         uint32_t *count;
540         struct lsa_TransNameArray *names;
541         struct lsa_LookupSids *r;
542         struct rpc_request **req;
543         int i, replies;
544         BOOL ret = True;
545         const int num_async_requests = 50;
546
547         count = talloc_array(mem_ctx, uint32_t, num_async_requests);
548         names = talloc_array(mem_ctx, struct lsa_TransNameArray, num_async_requests);
549         r = talloc_array(mem_ctx, struct lsa_LookupSids, num_async_requests);
550
551         printf("\nTesting %d async lookupsids request\n", num_async_requests);
552
553         req = talloc_array(mem_ctx, struct rpc_request *, num_async_requests);
554
555         sids.num_sids = 1;
556         sids.sids = &sidptr;
557         sidptr.sid = dom_sid_parse_talloc(mem_ctx, "S-1-5-32-545");
558
559         replies = 0;
560
561         for (i=0; i<num_async_requests; i++) {
562                 count[i] = 0;
563                 names[i].count = 0;
564                 names[i].names = NULL;
565
566                 r[i].in.handle = handle;
567                 r[i].in.sids = &sids;
568                 r[i].in.names = &names[i];
569                 r[i].in.level = 1;
570                 r[i].in.count = &names[i].count;
571                 r[i].out.count = &count[i];
572                 r[i].out.names = &names[i];
573                 
574                 req[i] = dcerpc_lsa_LookupSids_send(p, req, &r[i]);
575                 if (req[i] == NULL) {
576                         ret = False;
577                         break;
578                 }
579
580                 req[i]->async.callback = lookupsids_cb;
581                 req[i]->async.private_data = &replies;
582         }
583
584         while (replies >= 0 && replies < num_async_requests) {
585                 event_loop_once(p->conn->event_ctx);
586         }
587
588         talloc_free(req);
589
590         if (replies < 0) {
591                 ret = False;
592         }
593
594         return ret;
595 }
596
597 static BOOL test_LookupPrivValue(struct dcerpc_pipe *p, 
598                                  TALLOC_CTX *mem_ctx, 
599                                  struct policy_handle *handle,
600                                  struct lsa_String *name)
601 {
602         NTSTATUS status;
603         struct lsa_LookupPrivValue r;
604         struct lsa_LUID luid;
605
606         r.in.handle = handle;
607         r.in.name = name;
608         r.out.luid = &luid;
609
610         status = dcerpc_lsa_LookupPrivValue(p, mem_ctx, &r);
611         if (!NT_STATUS_IS_OK(status)) {
612                 printf("\nLookupPrivValue failed - %s\n", nt_errstr(status));
613                 return False;
614         }
615
616         return True;
617 }
618
619 static BOOL test_LookupPrivName(struct dcerpc_pipe *p, 
620                                 TALLOC_CTX *mem_ctx, 
621                                 struct policy_handle *handle,
622                                 struct lsa_LUID *luid)
623 {
624         NTSTATUS status;
625         struct lsa_LookupPrivName r;
626
627         r.in.handle = handle;
628         r.in.luid = luid;
629
630         status = dcerpc_lsa_LookupPrivName(p, mem_ctx, &r);
631         if (!NT_STATUS_IS_OK(status)) {
632                 printf("\nLookupPrivName failed - %s\n", nt_errstr(status));
633                 return False;
634         }
635
636         return True;
637 }
638
639 static BOOL test_RemovePrivilegesFromAccount(struct dcerpc_pipe *p, 
640                                              TALLOC_CTX *mem_ctx,                                 
641                                              struct policy_handle *acct_handle,
642                                              struct lsa_LUID *luid)
643 {
644         NTSTATUS status;
645         struct lsa_RemovePrivilegesFromAccount r;
646         struct lsa_PrivilegeSet privs;
647         BOOL ret = True;
648
649         printf("Testing RemovePrivilegesFromAccount\n");
650
651         r.in.handle = acct_handle;
652         r.in.remove_all = 0;
653         r.in.privs = &privs;
654
655         privs.count = 1;
656         privs.unknown = 0;
657         privs.set = talloc_array(mem_ctx, struct lsa_LUIDAttribute, 1);
658         privs.set[0].luid = *luid;
659         privs.set[0].attribute = 0;
660
661         status = dcerpc_lsa_RemovePrivilegesFromAccount(p, mem_ctx, &r);
662         if (!NT_STATUS_IS_OK(status)) {
663                 printf("RemovePrivilegesFromAccount failed - %s\n", nt_errstr(status));
664                 return False;
665         }
666
667         return ret;
668 }
669
670 static BOOL test_AddPrivilegesToAccount(struct dcerpc_pipe *p, 
671                                         TALLOC_CTX *mem_ctx,                              
672                                         struct policy_handle *acct_handle,
673                                         struct lsa_LUID *luid)
674 {
675         NTSTATUS status;
676         struct lsa_AddPrivilegesToAccount r;
677         struct lsa_PrivilegeSet privs;
678         BOOL ret = True;
679
680         printf("Testing AddPrivilegesToAccount\n");
681
682         r.in.handle = acct_handle;
683         r.in.privs = &privs;
684
685         privs.count = 1;
686         privs.unknown = 0;
687         privs.set = talloc_array(mem_ctx, struct lsa_LUIDAttribute, 1);
688         privs.set[0].luid = *luid;
689         privs.set[0].attribute = 0;
690
691         status = dcerpc_lsa_AddPrivilegesToAccount(p, mem_ctx, &r);
692         if (!NT_STATUS_IS_OK(status)) {
693                 printf("AddPrivilegesToAccount failed - %s\n", nt_errstr(status));
694                 return False;
695         }
696
697         return ret;
698 }
699
700 static BOOL test_EnumPrivsAccount(struct dcerpc_pipe *p, 
701                                   TALLOC_CTX *mem_ctx,                            
702                                   struct policy_handle *handle,
703                                   struct policy_handle *acct_handle)
704 {
705         NTSTATUS status;
706         struct lsa_EnumPrivsAccount r;
707         BOOL ret = True;
708
709         printf("Testing EnumPrivsAccount\n");
710
711         r.in.handle = acct_handle;
712
713         status = dcerpc_lsa_EnumPrivsAccount(p, mem_ctx, &r);
714         if (!NT_STATUS_IS_OK(status)) {
715                 printf("EnumPrivsAccount failed - %s\n", nt_errstr(status));
716                 return False;
717         }
718
719         if (r.out.privs && r.out.privs->count > 0) {
720                 int i;
721                 for (i=0;i<r.out.privs->count;i++) {
722                         test_LookupPrivName(p, mem_ctx, handle, 
723                                             &r.out.privs->set[i].luid);
724                 }
725
726                 ret &= test_RemovePrivilegesFromAccount(p, mem_ctx, acct_handle, 
727                                                         &r.out.privs->set[0].luid);
728                 ret &= test_AddPrivilegesToAccount(p, mem_ctx, acct_handle, 
729                                                    &r.out.privs->set[0].luid);
730         }
731
732         return ret;
733 }
734
735 static BOOL test_Delete(struct dcerpc_pipe *p, 
736                        TALLOC_CTX *mem_ctx, 
737                        struct policy_handle *handle)
738 {
739         NTSTATUS status;
740         struct lsa_Delete r;
741
742         printf("testing Delete\n");
743
744         r.in.handle = handle;
745         status = dcerpc_lsa_Delete(p, mem_ctx, &r);
746         if (!NT_STATUS_IS_OK(status)) {
747                 printf("Delete failed - %s\n", nt_errstr(status));
748                 return False;
749         }
750
751         return True;
752 }
753
754
755 static BOOL test_CreateAccount(struct dcerpc_pipe *p, 
756                                TALLOC_CTX *mem_ctx, 
757                                struct policy_handle *handle)
758 {
759         NTSTATUS status;
760         struct lsa_CreateAccount r;
761         struct dom_sid2 *newsid;
762         struct policy_handle acct_handle;
763
764         newsid = dom_sid_parse_talloc(mem_ctx, "S-1-5-12349876-4321-2854");
765
766         printf("Testing CreateAccount\n");
767
768         r.in.handle = handle;
769         r.in.sid = newsid;
770         r.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
771         r.out.acct_handle = &acct_handle;
772
773         status = dcerpc_lsa_CreateAccount(p, mem_ctx, &r);
774         if (!NT_STATUS_IS_OK(status)) {
775                 printf("CreateAccount failed - %s\n", nt_errstr(status));
776                 return False;
777         }
778
779         if (!test_Delete(p, mem_ctx, &acct_handle)) {
780                 return False;
781         }
782
783         return True;
784 }
785
786 static BOOL test_DeleteTrustedDomain(struct dcerpc_pipe *p, 
787                                      TALLOC_CTX *mem_ctx, 
788                                      struct policy_handle *handle,
789                                      struct lsa_StringLarge name)
790 {
791         NTSTATUS status;
792         struct lsa_OpenTrustedDomainByName r;
793         struct policy_handle trustdom_handle;
794
795         r.in.handle = handle;
796         r.in.name.string = name.string;
797         r.in.access_mask = SEC_STD_DELETE;
798         r.out.trustdom_handle = &trustdom_handle;
799
800         status = dcerpc_lsa_OpenTrustedDomainByName(p, mem_ctx, &r);
801         if (!NT_STATUS_IS_OK(status)) {
802                 printf("lsa_OpenTrustedDomainByName failed - %s\n", nt_errstr(status));
803                 return False;
804         }
805
806         if (!test_Delete(p, mem_ctx, &trustdom_handle)) {
807                 return False;
808         }
809
810         return True;
811 }
812
813 static BOOL test_DeleteTrustedDomainBySid(struct dcerpc_pipe *p, 
814                                           TALLOC_CTX *mem_ctx, 
815                                           struct policy_handle *handle,
816                                           struct dom_sid *sid)
817 {
818         NTSTATUS status;
819         struct lsa_DeleteTrustedDomain r;
820
821         r.in.handle = handle;
822         r.in.dom_sid = sid;
823
824         status = dcerpc_lsa_DeleteTrustedDomain(p, mem_ctx, &r);
825         if (!NT_STATUS_IS_OK(status)) {
826                 printf("lsa_DeleteTrustedDomain failed - %s\n", nt_errstr(status));
827                 return False;
828         }
829
830         return True;
831 }
832
833
834 static BOOL test_CreateSecret(struct dcerpc_pipe *p, 
835                               TALLOC_CTX *mem_ctx, 
836                               struct policy_handle *handle)
837 {
838         NTSTATUS status;
839         struct lsa_CreateSecret r;
840         struct lsa_OpenSecret r2;
841         struct lsa_SetSecret r3;
842         struct lsa_QuerySecret r4;
843         struct lsa_SetSecret r5;
844         struct lsa_QuerySecret r6;
845         struct lsa_SetSecret r7;
846         struct lsa_QuerySecret r8;
847         struct policy_handle sec_handle, sec_handle2, sec_handle3;
848         struct lsa_Delete d;
849         struct lsa_DATA_BUF buf1;
850         struct lsa_DATA_BUF_PTR bufp1;
851         struct lsa_DATA_BUF_PTR bufp2;
852         DATA_BLOB enc_key;
853         BOOL ret = True;
854         DATA_BLOB session_key;
855         NTTIME old_mtime, new_mtime;
856         DATA_BLOB blob1, blob2;
857         const char *secret1 = "abcdef12345699qwerty";
858         char *secret2;
859         const char *secret3 = "ABCDEF12345699QWERTY";
860         char *secret4;
861         const char *secret5 = "NEW-SAMBA4-SECRET";
862         char *secret6;
863         char *secname[2];
864         int i;
865         const int LOCAL = 0;
866         const int GLOBAL = 1;
867
868         secname[LOCAL] = talloc_asprintf(mem_ctx, "torturesecret-%u", (uint_t)random());
869         secname[GLOBAL] = talloc_asprintf(mem_ctx, "G$torturesecret-%u", (uint_t)random());
870
871         for (i=0; i< 2; i++) {
872                 printf("Testing CreateSecret of %s\n", secname[i]);
873                 
874                 init_lsa_String(&r.in.name, secname[i]);
875                 
876                 r.in.handle = handle;
877                 r.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
878                 r.out.sec_handle = &sec_handle;
879                 
880                 status = dcerpc_lsa_CreateSecret(p, mem_ctx, &r);
881                 if (!NT_STATUS_IS_OK(status)) {
882                         printf("CreateSecret failed - %s\n", nt_errstr(status));
883                         return False;
884                 }
885                 
886                 r.in.handle = handle;
887                 r.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
888                 r.out.sec_handle = &sec_handle3;
889                 
890                 status = dcerpc_lsa_CreateSecret(p, mem_ctx, &r);
891                 if (!NT_STATUS_EQUAL(status, NT_STATUS_OBJECT_NAME_COLLISION)) {
892                         printf("CreateSecret should have failed OBJECT_NAME_COLLISION - %s\n", nt_errstr(status));
893                         return False;
894                 }
895                 
896                 r2.in.handle = handle;
897                 r2.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
898                 r2.in.name = r.in.name;
899                 r2.out.sec_handle = &sec_handle2;
900                 
901                 printf("Testing OpenSecret\n");
902                 
903                 status = dcerpc_lsa_OpenSecret(p, mem_ctx, &r2);
904                 if (!NT_STATUS_IS_OK(status)) {
905                         printf("OpenSecret failed - %s\n", nt_errstr(status));
906                         return False;
907                 }
908                 
909                 status = dcerpc_fetch_session_key(p, &session_key);
910                 if (!NT_STATUS_IS_OK(status)) {
911                         printf("dcerpc_fetch_session_key failed - %s\n", nt_errstr(status));
912                         return False;
913                 }
914                 
915                 enc_key = sess_encrypt_string(secret1, &session_key);
916                 
917                 r3.in.sec_handle = &sec_handle;
918                 r3.in.new_val = &buf1;
919                 r3.in.old_val = NULL;
920                 r3.in.new_val->data = enc_key.data;
921                 r3.in.new_val->length = enc_key.length;
922                 r3.in.new_val->size = enc_key.length;
923                 
924                 printf("Testing SetSecret\n");
925                 
926                 status = dcerpc_lsa_SetSecret(p, mem_ctx, &r3);
927                 if (!NT_STATUS_IS_OK(status)) {
928                         printf("SetSecret failed - %s\n", nt_errstr(status));
929                         return False;
930                 }
931                 
932                 r3.in.sec_handle = &sec_handle;
933                 r3.in.new_val = &buf1;
934                 r3.in.old_val = NULL;
935                 r3.in.new_val->data = enc_key.data;
936                 r3.in.new_val->length = enc_key.length;
937                 r3.in.new_val->size = enc_key.length;
938                 
939                 /* break the encrypted data */
940                 enc_key.data[0]++;
941
942                 printf("Testing SetSecret with broken key\n");
943                 
944                 status = dcerpc_lsa_SetSecret(p, mem_ctx, &r3);
945                 if (!NT_STATUS_EQUAL(status, NT_STATUS_UNKNOWN_REVISION)) {
946                         printf("SetSecret should have failed UNKNOWN_REVISION - %s\n", nt_errstr(status));
947                         ret = False;
948                 }
949                 
950                 data_blob_free(&enc_key);
951                 
952                 ZERO_STRUCT(new_mtime);
953                 ZERO_STRUCT(old_mtime);
954                 
955                 /* fetch the secret back again */
956                 r4.in.sec_handle = &sec_handle;
957                 r4.in.new_val = &bufp1;
958                 r4.in.new_mtime = &new_mtime;
959                 r4.in.old_val = NULL;
960                 r4.in.old_mtime = NULL;
961                 
962                 bufp1.buf = NULL;
963                 
964                 printf("Testing QuerySecret\n");
965                 status = dcerpc_lsa_QuerySecret(p, mem_ctx, &r4);
966                 if (!NT_STATUS_IS_OK(status)) {
967                         printf("QuerySecret failed - %s\n", nt_errstr(status));
968                         ret = False;
969                 } else {
970                         if (r4.out.new_val == NULL || r4.out.new_val->buf == NULL) {
971                                 printf("No secret buffer returned\n");
972                                 ret = False;
973                         } else {
974                                 blob1.data = r4.out.new_val->buf->data;
975                                 blob1.length = r4.out.new_val->buf->size;
976                                 
977                                 blob2 = data_blob_talloc(mem_ctx, NULL, blob1.length);
978                                 
979                                 secret2 = sess_decrypt_string(mem_ctx, 
980                                                               &blob1, &session_key);
981                                 
982                                 if (strcmp(secret1, secret2) != 0) {
983                                         printf("Returned secret '%s' doesn't match '%s'\n", 
984                                                secret2, secret1);
985                                         ret = False;
986                                 }
987                         }
988                 }
989                 
990                 enc_key = sess_encrypt_string(secret3, &session_key);
991                 
992                 r5.in.sec_handle = &sec_handle;
993                 r5.in.new_val = &buf1;
994                 r5.in.old_val = NULL;
995                 r5.in.new_val->data = enc_key.data;
996                 r5.in.new_val->length = enc_key.length;
997                 r5.in.new_val->size = enc_key.length;
998                 
999                 printf("Testing SetSecret (existing value should move to old)\n");
1000                 
1001                 status = dcerpc_lsa_SetSecret(p, mem_ctx, &r5);
1002                 if (!NT_STATUS_IS_OK(status)) {
1003                         printf("SetSecret failed - %s\n", nt_errstr(status));
1004                         ret = False;
1005                 }
1006                 
1007                 data_blob_free(&enc_key);
1008                 
1009                 ZERO_STRUCT(new_mtime);
1010                 ZERO_STRUCT(old_mtime);
1011                 
1012                 /* fetch the secret back again */
1013                 r6.in.sec_handle = &sec_handle;
1014                 r6.in.new_val = &bufp1;
1015                 r6.in.new_mtime = &new_mtime;
1016                 r6.in.old_val = &bufp2;
1017                 r6.in.old_mtime = &old_mtime;
1018                 
1019                 bufp1.buf = NULL;
1020                 bufp2.buf = NULL;
1021                 
1022                 status = dcerpc_lsa_QuerySecret(p, mem_ctx, &r6);
1023                 if (!NT_STATUS_IS_OK(status)) {
1024                         printf("QuerySecret failed - %s\n", nt_errstr(status));
1025                         ret = False;
1026                         secret4 = NULL;
1027                 } else {
1028
1029                         if (r6.out.new_val->buf == NULL || r6.out.old_val->buf == NULL 
1030                                 || r6.out.new_mtime == NULL || r6.out.old_mtime == NULL) {
1031                                 printf("Both secret buffers and both times not returned\n");
1032                                 ret = False;
1033                                 secret4 = NULL;
1034                         } else {
1035                                 blob1.data = r6.out.new_val->buf->data;
1036                                 blob1.length = r6.out.new_val->buf->size;
1037                                 
1038                                 blob2 = data_blob_talloc(mem_ctx, NULL, blob1.length);
1039                                 
1040                                 secret4 = sess_decrypt_string(mem_ctx, 
1041                                                               &blob1, &session_key);
1042                                 
1043                                 if (strcmp(secret3, secret4) != 0) {
1044                                         printf("Returned NEW secret %s doesn't match %s\n", secret4, secret3);
1045                                         ret = False;
1046                                 }
1047
1048                                 blob1.data = r6.out.old_val->buf->data;
1049                                 blob1.length = r6.out.old_val->buf->length;
1050                                 
1051                                 blob2 = data_blob_talloc(mem_ctx, NULL, blob1.length);
1052                                 
1053                                 secret2 = sess_decrypt_string(mem_ctx, 
1054                                                               &blob1, &session_key);
1055                                 
1056                                 if (strcmp(secret1, secret2) != 0) {
1057                                         printf("Returned OLD secret %s doesn't match %s\n", secret2, secret1);
1058                                         ret = False;
1059                                 }
1060                                 
1061                                 if (*r6.out.new_mtime == *r6.out.old_mtime) {
1062                                         printf("Returned secret %s had same mtime for both secrets: %s\n", 
1063                                                secname[i],
1064                                                nt_time_string(mem_ctx, *r6.out.new_mtime));
1065                                         ret = False;
1066                                 }
1067                         }
1068                 }
1069
1070                 enc_key = sess_encrypt_string(secret5, &session_key);
1071                 
1072                 r7.in.sec_handle = &sec_handle;
1073                 r7.in.old_val = &buf1;
1074                 r7.in.old_val->data = enc_key.data;
1075                 r7.in.old_val->length = enc_key.length;
1076                 r7.in.old_val->size = enc_key.length;
1077                 r7.in.new_val = NULL;
1078                 
1079                 printf("Testing SetSecret of old Secret only\n");
1080                 
1081                 status = dcerpc_lsa_SetSecret(p, mem_ctx, &r7);
1082                 if (!NT_STATUS_IS_OK(status)) {
1083                         printf("SetSecret failed - %s\n", nt_errstr(status));
1084                         ret = False;
1085                 }
1086                 
1087                 data_blob_free(&enc_key);
1088                 
1089                 /* fetch the secret back again */
1090                 r8.in.sec_handle = &sec_handle;
1091                 r8.in.new_val = &bufp1;
1092                 r8.in.new_mtime = &new_mtime;
1093                 r8.in.old_val = &bufp2;
1094                 r8.in.old_mtime = &old_mtime;
1095                 
1096                 bufp1.buf = NULL;
1097                 bufp2.buf = NULL;
1098                 
1099                 status = dcerpc_lsa_QuerySecret(p, mem_ctx, &r8);
1100                 if (!NT_STATUS_IS_OK(status)) {
1101                         printf("QuerySecret failed - %s\n", nt_errstr(status));
1102                         ret = False;
1103                 } else {
1104                         if (!r8.out.new_val || !r8.out.old_val) {
1105                                 printf("in/out pointers not returned, despite being set on in for QuerySecret\n");
1106                                 ret = False;
1107                         } else if (r8.out.new_val->buf == NULL) {
1108                                 if (i != LOCAL) { 
1109                                         printf("NEW secret buffer not returned after GLOBAL OLD set\n");
1110                                         ret = False;
1111                                 }
1112                         } else if (r8.out.old_val->buf == NULL) {
1113                                 printf("OLD secret buffer not returned after OLD set\n");
1114                                 ret = False;
1115                         } else if (r8.out.new_mtime == NULL || r8.out.old_mtime == NULL) {
1116                                 printf("Both times not returned after OLD set\n");
1117                                 ret = False;
1118                         } else {
1119                                 if (i == LOCAL) { 
1120                                         printf("NEW secret buffer should not be returned after LOCAL OLD set\n");
1121                                         ret = False;
1122                                 }
1123                                 blob1.data = r8.out.new_val->buf->data;
1124                                 blob1.length = r8.out.new_val->buf->length;
1125                                 
1126                                 blob2 = data_blob_talloc(mem_ctx, NULL, blob1.length);
1127                                 
1128                                 secret6 = sess_decrypt_string(mem_ctx,
1129                                                               &blob1, &session_key);
1130                                 
1131                                 if (strcmp(secret3, secret4) != 0) {
1132                                         printf("Returned NEW secret '%s' doesn't match '%s'\n", secret4, secret3);
1133                                         ret = False;
1134                                 }
1135
1136                                 blob1.data = r8.out.old_val->buf->data;
1137                                 blob1.length = r8.out.old_val->buf->size;
1138                                 
1139                                 blob2 = data_blob_talloc(mem_ctx, NULL, blob1.length);
1140                                 
1141                                 secret6 = sess_decrypt_string(mem_ctx,
1142                                                               &blob1, &session_key);
1143                                 
1144                                 if (strcmp(secret5, secret6) != 0) {
1145                                         printf("Returned OLD secret %s doesn't match %s\n", secret5, secret6);
1146                                         ret = False;
1147                                 }
1148                                 
1149                                 if (*r8.out.new_mtime == *r8.out.old_mtime) {
1150                                         if (i != GLOBAL) { 
1151                                                 printf("Returned secret %s had same mtime for both secrets: %s\n", 
1152                                                        secname[i],
1153                                                        nt_time_string(mem_ctx, *r8.out.new_mtime));
1154                                                 ret = False;
1155                                         }
1156                                 } else {
1157                                         printf("Returned secret %s should have had same mtime for both secrets: %s != %s\n", 
1158                                                secname[i],
1159                                                nt_time_string(mem_ctx, *r8.out.old_mtime),
1160                                                nt_time_string(mem_ctx, *r8.out.new_mtime));
1161                                         ret = False;
1162                                 }
1163                         }
1164                 }
1165
1166                 if (!test_Delete(p, mem_ctx, &sec_handle)) {
1167                         ret = False;
1168                 }
1169                 
1170                 d.in.handle = &sec_handle2;
1171                 status = dcerpc_lsa_Delete(p, mem_ctx, &d);
1172                 if (!NT_STATUS_EQUAL(status, NT_STATUS_INVALID_HANDLE)) {
1173                         printf("Second delete expected INVALID_HANDLE - %s\n", nt_errstr(status));
1174                         ret = False;
1175                 } else {
1176
1177                         printf("Testing OpenSecret of just-deleted secret\n");
1178                         
1179                         status = dcerpc_lsa_OpenSecret(p, mem_ctx, &r2);
1180                         if (!NT_STATUS_EQUAL(status, NT_STATUS_OBJECT_NAME_NOT_FOUND)) {
1181                                 printf("OpenSecret expected OBJECT_NAME_NOT_FOUND - %s\n", nt_errstr(status));
1182                                 ret = False;
1183                         }
1184                 }
1185                 
1186         }
1187
1188         return ret;
1189 }
1190
1191
1192 static BOOL test_EnumAccountRights(struct dcerpc_pipe *p, 
1193                                    TALLOC_CTX *mem_ctx, 
1194                                    struct policy_handle *acct_handle,
1195                                    struct dom_sid *sid)
1196 {
1197         NTSTATUS status;
1198         struct lsa_EnumAccountRights r;
1199         struct lsa_RightSet rights;
1200
1201         printf("Testing EnumAccountRights\n");
1202
1203         r.in.handle = acct_handle;
1204         r.in.sid = sid;
1205         r.out.rights = &rights;
1206
1207         status = dcerpc_lsa_EnumAccountRights(p, mem_ctx, &r);
1208         if (!NT_STATUS_IS_OK(status)) {
1209                 printf("EnumAccountRights of %s failed - %s\n", 
1210                        dom_sid_string(mem_ctx, sid), nt_errstr(status));
1211                 return False;
1212         }
1213
1214         return True;
1215 }
1216
1217
1218 static BOOL test_QuerySecurity(struct dcerpc_pipe *p, 
1219                              TALLOC_CTX *mem_ctx, 
1220                              struct policy_handle *handle,
1221                              struct policy_handle *acct_handle)
1222 {
1223         NTSTATUS status;
1224         struct lsa_QuerySecurity r;
1225
1226         if (lp_parm_bool(-1, "torture", "samba4", False)) {
1227                 printf("skipping QuerySecurity test against Samba4\n");
1228                 return True;
1229         }
1230
1231         printf("Testing QuerySecurity\n");
1232
1233         r.in.handle = acct_handle;
1234         r.in.sec_info = 7;
1235
1236         status = dcerpc_lsa_QuerySecurity(p, mem_ctx, &r);
1237         if (!NT_STATUS_IS_OK(status)) {
1238                 printf("QuerySecurity failed - %s\n", nt_errstr(status));
1239                 return False;
1240         }
1241
1242         return True;
1243 }
1244
1245 static BOOL test_OpenAccount(struct dcerpc_pipe *p, 
1246                              TALLOC_CTX *mem_ctx, 
1247                              struct policy_handle *handle,
1248                              struct dom_sid *sid)
1249 {
1250         NTSTATUS status;
1251         struct lsa_OpenAccount r;
1252         struct policy_handle acct_handle;
1253
1254         printf("Testing OpenAccount\n");
1255
1256         r.in.handle = handle;
1257         r.in.sid = sid;
1258         r.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
1259         r.out.acct_handle = &acct_handle;
1260
1261         status = dcerpc_lsa_OpenAccount(p, mem_ctx, &r);
1262         if (!NT_STATUS_IS_OK(status)) {
1263                 printf("OpenAccount failed - %s\n", nt_errstr(status));
1264                 return False;
1265         }
1266
1267         if (!test_EnumPrivsAccount(p, mem_ctx, handle, &acct_handle)) {
1268                 return False;
1269         }
1270
1271         if (!test_QuerySecurity(p, mem_ctx, handle, &acct_handle)) {
1272                 return False;
1273         }
1274
1275         return True;
1276 }
1277
1278 static BOOL test_EnumAccounts(struct dcerpc_pipe *p, 
1279                           TALLOC_CTX *mem_ctx, 
1280                           struct policy_handle *handle)
1281 {
1282         NTSTATUS status;
1283         struct lsa_EnumAccounts r;
1284         struct lsa_SidArray sids1, sids2;
1285         uint32_t resume_handle = 0;
1286         int i;
1287         BOOL ret = True;
1288
1289         printf("\ntesting EnumAccounts\n");
1290
1291         r.in.handle = handle;
1292         r.in.resume_handle = &resume_handle;
1293         r.in.num_entries = 100;
1294         r.out.resume_handle = &resume_handle;
1295         r.out.sids = &sids1;
1296
1297         resume_handle = 0;
1298         while (True) {
1299                 status = dcerpc_lsa_EnumAccounts(p, mem_ctx, &r);
1300                 if (NT_STATUS_EQUAL(status, NT_STATUS_NO_MORE_ENTRIES)) {
1301                         break;
1302                 }
1303                 if (!NT_STATUS_IS_OK(status)) {
1304                         printf("EnumAccounts failed - %s\n", nt_errstr(status));
1305                         return False;
1306                 }
1307
1308                 if (!test_LookupSids(p, mem_ctx, handle, &sids1)) {
1309                         return False;
1310                 }
1311
1312                 if (!test_LookupSids2(p, mem_ctx, handle, &sids1)) {
1313                         return False;
1314                 }
1315
1316                 if (!test_LookupSids3(p, mem_ctx, &sids1)) {
1317                         return False;
1318                 }
1319
1320                 printf("testing all accounts\n");
1321                 for (i=0;i<sids1.num_sids;i++) {
1322                         ret &= test_OpenAccount(p, mem_ctx, handle, sids1.sids[i].sid);
1323                         ret &= test_EnumAccountRights(p, mem_ctx, handle, sids1.sids[i].sid);
1324                 }
1325                 printf("\n");
1326         }
1327
1328         if (sids1.num_sids < 3) {
1329                 return ret;
1330         }
1331         
1332         printf("trying EnumAccounts partial listing (asking for 1 at 2)\n");
1333         resume_handle = 2;
1334         r.in.num_entries = 1;
1335         r.out.sids = &sids2;
1336
1337         status = dcerpc_lsa_EnumAccounts(p, mem_ctx, &r);
1338         if (!NT_STATUS_IS_OK(status)) {
1339                 printf("EnumAccounts failed - %s\n", nt_errstr(status));
1340                 return False;
1341         }
1342
1343         if (sids2.num_sids != 1) {
1344                 printf("Returned wrong number of entries (%d)\n", sids2.num_sids);
1345                 return False;
1346         }
1347
1348         return True;
1349 }
1350
1351 static BOOL test_LookupPrivDisplayName(struct dcerpc_pipe *p,
1352                                 TALLOC_CTX *mem_ctx,
1353                                 struct policy_handle *handle,
1354                                 struct lsa_String *priv_name)
1355 {
1356         struct lsa_LookupPrivDisplayName r;
1357         NTSTATUS status;
1358         /* produce a reasonable range of language output without screwing up
1359            terminals */
1360         uint16_t language_id = (random() % 4) + 0x409;
1361
1362         printf("testing LookupPrivDisplayName(%s)\n", priv_name->string);
1363         
1364         r.in.handle = handle;
1365         r.in.name = priv_name;
1366         r.in.language_id = &language_id;
1367         r.out.language_id = &language_id;
1368         r.in.unknown = 0;
1369
1370         status = dcerpc_lsa_LookupPrivDisplayName(p, mem_ctx, &r);
1371         if (!NT_STATUS_IS_OK(status)) {
1372                 printf("LookupPrivDisplayName failed - %s\n", nt_errstr(status));
1373                 return False;
1374         }
1375         printf("%s -> \"%s\"  (language 0x%x/0x%x)\n", 
1376                priv_name->string, r.out.disp_name->string, 
1377                *r.in.language_id, *r.out.language_id);
1378
1379         return True;
1380 }
1381
1382 static BOOL test_EnumAccountsWithUserRight(struct dcerpc_pipe *p, 
1383                                 TALLOC_CTX *mem_ctx,
1384                                 struct policy_handle *handle,
1385                                 struct lsa_String *priv_name)
1386 {
1387         struct lsa_EnumAccountsWithUserRight r;
1388         struct lsa_SidArray sids;
1389         NTSTATUS status;
1390
1391         ZERO_STRUCT(sids);
1392         
1393         printf("testing EnumAccountsWithUserRight(%s)\n", priv_name->string);
1394         
1395         r.in.handle = handle;
1396         r.in.name = priv_name;
1397         r.out.sids = &sids;
1398
1399         status = dcerpc_lsa_EnumAccountsWithUserRight(p, mem_ctx, &r);
1400
1401         /* NT_STATUS_NO_MORE_ENTRIES means noone has this privilege */
1402         if (NT_STATUS_EQUAL(status, NT_STATUS_NO_MORE_ENTRIES)) {
1403                 return True;
1404         }
1405
1406         if (!NT_STATUS_IS_OK(status)) {
1407                 printf("EnumAccountsWithUserRight failed - %s\n", nt_errstr(status));
1408                 return False;
1409         }
1410         
1411         return True;
1412 }
1413
1414
1415 static BOOL test_EnumPrivs(struct dcerpc_pipe *p, 
1416                            TALLOC_CTX *mem_ctx, 
1417                            struct policy_handle *handle)
1418 {
1419         NTSTATUS status;
1420         struct lsa_EnumPrivs r;
1421         struct lsa_PrivArray privs1;
1422         uint32_t resume_handle = 0;
1423         int i;
1424         BOOL ret = True;
1425
1426         printf("\ntesting EnumPrivs\n");
1427
1428         r.in.handle = handle;
1429         r.in.resume_handle = &resume_handle;
1430         r.in.max_count = 100;
1431         r.out.resume_handle = &resume_handle;
1432         r.out.privs = &privs1;
1433
1434         resume_handle = 0;
1435         status = dcerpc_lsa_EnumPrivs(p, mem_ctx, &r);
1436         if (!NT_STATUS_IS_OK(status)) {
1437                 printf("EnumPrivs failed - %s\n", nt_errstr(status));
1438                 return False;
1439         }
1440
1441         for (i = 0; i< privs1.count; i++) {
1442                 test_LookupPrivDisplayName(p, mem_ctx, handle, (struct lsa_String *)&privs1.privs[i].name);
1443                 test_LookupPrivValue(p, mem_ctx, handle, (struct lsa_String *)&privs1.privs[i].name);
1444                 if (!test_EnumAccountsWithUserRight(p, mem_ctx, handle, (struct lsa_String *)&privs1.privs[i].name)) {
1445                         ret = False;
1446                 }
1447         }
1448
1449         return ret;
1450 }
1451
1452 static BOOL test_QueryForestTrustInformation(struct dcerpc_pipe *p, 
1453                                              TALLOC_CTX *mem_ctx, 
1454                                              struct policy_handle *handle,
1455                                              const char *trusted_domain_name)
1456 {
1457         BOOL ret = True;
1458         struct lsa_lsaRQueryForestTrustInformation r;
1459         NTSTATUS status;
1460         struct lsa_String string;
1461         struct lsa_ForestTrustInformation info, *info_ptr;
1462
1463         printf("\nTesting lsaRQueryForestTrustInformation\n");
1464
1465         if (lp_parm_bool(-1, "torture", "samba4", False)) {
1466                 printf("skipping QueryForestTrustInformation against Samba4\n");
1467                 return True;
1468         }
1469
1470         ZERO_STRUCT(string);
1471
1472         if (trusted_domain_name) {
1473                 init_lsa_String(&string, trusted_domain_name);
1474         }
1475
1476         info_ptr = &info;
1477
1478         r.in.handle = handle;
1479         r.in.trusted_domain_name = &string;
1480         r.in.unknown = 0;
1481         r.out.forest_trust_info = &info_ptr;
1482
1483         status = dcerpc_lsa_lsaRQueryForestTrustInformation(p, mem_ctx, &r);
1484
1485         if (!NT_STATUS_IS_OK(status)) {
1486                 printf("lsaRQueryForestTrustInformation failed - %s\n", nt_errstr(status));
1487                 ret = False;
1488         }
1489
1490         return ret;
1491 }
1492
1493 static BOOL test_query_each_TrustDomEx(struct dcerpc_pipe *p, 
1494                                        TALLOC_CTX *mem_ctx, 
1495                                        struct policy_handle *handle, 
1496                                        struct lsa_DomainListEx *domains) 
1497 {
1498         int i;
1499         BOOL ret = True;
1500
1501         for (i=0; i< domains->count; i++) {
1502
1503                 if (domains->domains[i].trust_attributes & NETR_TRUST_ATTRIBUTE_FOREST_TRANSITIVE) {
1504                         ret &= test_QueryForestTrustInformation(p, mem_ctx, handle, 
1505                                                                 domains->domains[i].domain_name.string);
1506                 }
1507         }
1508
1509         return ret;
1510 }
1511
1512 static BOOL test_query_each_TrustDom(struct dcerpc_pipe *p, 
1513                                      TALLOC_CTX *mem_ctx, 
1514                                      struct policy_handle *handle, 
1515                                      struct lsa_DomainList *domains) 
1516 {
1517         NTSTATUS status;
1518         int i,j;
1519         BOOL ret = True;
1520                 
1521         printf("\nTesting OpenTrustedDomain, OpenTrustedDomainByName and QueryInfoTrustedDomain\n");
1522         for (i=0; i< domains->count; i++) {
1523                 struct lsa_OpenTrustedDomain trust;
1524                 struct lsa_OpenTrustedDomainByName trust_by_name;
1525                 struct policy_handle trustdom_handle;
1526                 struct policy_handle handle2;
1527                 struct lsa_Close c;
1528                 struct lsa_CloseTrustedDomainEx c_trust;
1529                 int levels [] = {1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12};
1530                 int ok[]      = {1, 0, 1, 0, 0, 1, 0, 1, 0,  0,  0,  1};
1531
1532                 if (domains->domains[i].sid) {
1533                         trust.in.handle = handle;
1534                         trust.in.sid = domains->domains[i].sid;
1535                         trust.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
1536                         trust.out.trustdom_handle = &trustdom_handle;
1537                         
1538                         status = dcerpc_lsa_OpenTrustedDomain(p, mem_ctx, &trust);
1539                         
1540                         if (!NT_STATUS_IS_OK(status)) {
1541                                 printf("OpenTrustedDomain failed - %s\n", nt_errstr(status));
1542                                 return False;
1543                         }
1544                         
1545                         c.in.handle = &trustdom_handle;
1546                         c.out.handle = &handle2;
1547                         
1548                         c_trust.in.handle = &trustdom_handle;
1549                         c_trust.out.handle = &handle2;
1550                         
1551                         for (j=0; j < ARRAY_SIZE(levels); j++) {
1552                                 struct lsa_QueryTrustedDomainInfo q;
1553                                 union lsa_TrustedDomainInfo info;
1554                                 q.in.trustdom_handle = &trustdom_handle;
1555                                 q.in.level = levels[j];
1556                                 q.out.info = &info;
1557                                 status = dcerpc_lsa_QueryTrustedDomainInfo(p, mem_ctx, &q);
1558                                 if (!NT_STATUS_IS_OK(status) && ok[j]) {
1559                                         printf("QueryTrustedDomainInfo level %d failed - %s\n", 
1560                                                levels[j], nt_errstr(status));
1561                                         ret = False;
1562                                 } else if (NT_STATUS_IS_OK(status) && !ok[j]) {
1563                                         printf("QueryTrustedDomainInfo level %d unexpectedly succeeded - %s\n", 
1564                                                levels[j], nt_errstr(status));
1565                                         ret = False;
1566                                 }
1567                         }
1568                         
1569                         status = dcerpc_lsa_CloseTrustedDomainEx(p, mem_ctx, &c_trust);
1570                         if (!NT_STATUS_EQUAL(status, NT_STATUS_NOT_IMPLEMENTED)) {
1571                                 printf("Expected CloseTrustedDomainEx to return NT_STATUS_NOT_IMPLEMENTED, instead - %s\n", nt_errstr(status));
1572                                 return False;
1573                         }
1574                         
1575                         c.in.handle = &trustdom_handle;
1576                         c.out.handle = &handle2;
1577                         
1578                         status = dcerpc_lsa_Close(p, mem_ctx, &c);
1579                         if (!NT_STATUS_IS_OK(status)) {
1580                                 printf("Close of trusted domain failed - %s\n", nt_errstr(status));
1581                                 return False;
1582                         }
1583
1584                         for (j=0; j < ARRAY_SIZE(levels); j++) {
1585                                 struct lsa_QueryTrustedDomainInfoBySid q;
1586                                 union lsa_TrustedDomainInfo info;
1587                                 
1588                                 if (!domains->domains[i].sid) {
1589                                         continue;
1590                                 }
1591                                 
1592                                 q.in.handle  = handle;
1593                                 q.in.dom_sid = domains->domains[i].sid;
1594                                 q.in.level   = levels[j];
1595                                 q.out.info   = &info;
1596                                 status = dcerpc_lsa_QueryTrustedDomainInfoBySid(p, mem_ctx, &q);
1597                                 if (!NT_STATUS_IS_OK(status) && ok[j]) {
1598                                         printf("QueryTrustedDomainInfoBySid level %d failed - %s\n", 
1599                                                levels[j], nt_errstr(status));
1600                                         ret = False;
1601                                 } else if (NT_STATUS_IS_OK(status) && !ok[j]) {
1602                                         printf("QueryTrustedDomainInfoBySid level %d unexpectedly succeeded - %s\n", 
1603                                                levels[j], nt_errstr(status));
1604                                         ret = False;
1605                                 }
1606                         }
1607                 }
1608
1609                 trust_by_name.in.handle = handle;
1610                 trust_by_name.in.name.string = domains->domains[i].name.string;
1611                 trust_by_name.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
1612                 trust_by_name.out.trustdom_handle = &trustdom_handle;
1613                         
1614                 status = dcerpc_lsa_OpenTrustedDomainByName(p, mem_ctx, &trust_by_name);
1615                         
1616                 if (!NT_STATUS_IS_OK(status)) {
1617                         printf("OpenTrustedDomainByName failed - %s\n", nt_errstr(status));
1618                         return False;
1619                 }
1620
1621                 for (j=0; j < ARRAY_SIZE(levels); j++) {
1622                         struct lsa_QueryTrustedDomainInfo q;
1623                         union lsa_TrustedDomainInfo info;
1624                         q.in.trustdom_handle = &trustdom_handle;
1625                         q.in.level = levels[j];
1626                         q.out.info = &info;
1627                         status = dcerpc_lsa_QueryTrustedDomainInfo(p, mem_ctx, &q);
1628                         if (!NT_STATUS_IS_OK(status) && ok[j]) {
1629                                 printf("QueryTrustedDomainInfo level %d failed - %s\n", 
1630                                        levels[j], nt_errstr(status));
1631                                 ret = False;
1632                         } else if (NT_STATUS_IS_OK(status) && !ok[j]) {
1633                                 printf("QueryTrustedDomainInfo level %d unexpectedly succeeded - %s\n", 
1634                                        levels[j], nt_errstr(status));
1635                                 ret = False;
1636                         }
1637                 }
1638                 
1639                 c.in.handle = &trustdom_handle;
1640                 c.out.handle = &handle2;
1641
1642                 status = dcerpc_lsa_Close(p, mem_ctx, &c);
1643                 if (!NT_STATUS_IS_OK(status)) {
1644                         printf("Close of trusted domain failed - %s\n", nt_errstr(status));
1645                         return False;
1646                 }
1647
1648                 for (j=0; j < ARRAY_SIZE(levels); j++) {
1649                         struct lsa_QueryTrustedDomainInfoByName q;
1650                         union lsa_TrustedDomainInfo info;
1651                         q.in.handle         = handle;
1652                         q.in.trusted_domain.string = domains->domains[i].name.string;
1653                         q.in.level          = levels[j];
1654                         q.out.info          = &info;
1655                         status = dcerpc_lsa_QueryTrustedDomainInfoByName(p, mem_ctx, &q);
1656                         if (!NT_STATUS_IS_OK(status) && ok[j]) {
1657                                 printf("QueryTrustedDomainInfoByName level %d failed - %s\n", 
1658                                        levels[j], nt_errstr(status));
1659                                 ret = False;
1660                         } else if (NT_STATUS_IS_OK(status) && !ok[j]) {
1661                                 printf("QueryTrustedDomainInfoByName level %d unexpectedly succeeded - %s\n", 
1662                                        levels[j], nt_errstr(status));
1663                                 ret = False;
1664                         }
1665                 }
1666         }
1667         return ret;
1668 }
1669
1670 static BOOL test_EnumTrustDom(struct dcerpc_pipe *p, 
1671                               TALLOC_CTX *mem_ctx, 
1672                               struct policy_handle *handle)
1673 {
1674         struct lsa_EnumTrustDom r;
1675         struct lsa_EnumTrustedDomainsEx r_ex;
1676         NTSTATUS enum_status;
1677         uint32_t resume_handle = 0;
1678         struct lsa_DomainList domains;
1679         struct lsa_DomainListEx domains_ex;
1680         BOOL ret = True;
1681
1682         printf("\nTesting EnumTrustDom\n");
1683
1684         do {
1685                 r.in.handle = handle;
1686                 r.in.resume_handle = &resume_handle;
1687                 r.in.max_size = LSA_ENUM_TRUST_DOMAIN_MULTIPLIER * 3;
1688                 r.out.domains = &domains;
1689                 r.out.resume_handle = &resume_handle;
1690                 
1691                 enum_status = dcerpc_lsa_EnumTrustDom(p, mem_ctx, &r);
1692                 
1693                 /* NO_MORE_ENTRIES is allowed */
1694                 if (NT_STATUS_EQUAL(enum_status, NT_STATUS_NO_MORE_ENTRIES)) {
1695                         return True;
1696                 } else if (NT_STATUS_EQUAL(enum_status, STATUS_MORE_ENTRIES)) {
1697                         /* Windows 2003 gets this off by one on the first run */
1698                         if (r.out.domains->count < 3 || r.out.domains->count > 4) {
1699                                 printf("EnumTrustDom didn't fill the buffer we "
1700                                        "asked it to (got %d, expected %d / %d == %d entries)\n",
1701                                        r.out.domains->count, LSA_ENUM_TRUST_DOMAIN_MULTIPLIER * 3, 
1702                                        LSA_ENUM_TRUST_DOMAIN_MULTIPLIER, r.in.max_size);
1703                                 ret = False;
1704                         }
1705                 } else if (!NT_STATUS_IS_OK(enum_status)) {
1706                         printf("EnumTrustDom failed - %s\n", nt_errstr(enum_status));
1707                         return False;
1708                 }
1709                 
1710                 ret &= test_query_each_TrustDom(p, mem_ctx, handle, &domains);
1711                 
1712         } while ((NT_STATUS_EQUAL(enum_status, STATUS_MORE_ENTRIES)));
1713
1714         printf("\nTesting EnumTrustedDomainsEx\n");
1715
1716         resume_handle = 0;
1717         do {
1718                 r_ex.in.handle = handle;
1719                 r_ex.in.resume_handle = &resume_handle;
1720                 r_ex.in.max_size = LSA_ENUM_TRUST_DOMAIN_EX_MULTIPLIER * 3;
1721                 r_ex.out.domains = &domains_ex;
1722                 r_ex.out.resume_handle = &resume_handle;
1723                 
1724                 enum_status = dcerpc_lsa_EnumTrustedDomainsEx(p, mem_ctx, &r_ex);
1725                 
1726                 /* NO_MORE_ENTRIES is allowed */
1727                 if (NT_STATUS_EQUAL(enum_status, NT_STATUS_NO_MORE_ENTRIES)) {
1728                         return True;
1729                 } else if (NT_STATUS_EQUAL(enum_status, STATUS_MORE_ENTRIES)) {
1730                         /* Windows 2003 gets this off by one on the first run */
1731                         if (r_ex.out.domains->count < 3 || r_ex.out.domains->count > 4) {
1732                                 printf("EnumTrustDom didn't fill the buffer we "
1733                                        "asked it to (got %d, expected %d / %d == %d entries)\n",
1734                                        r_ex.out.domains->count, 
1735                                        r_ex.in.max_size,
1736                                        LSA_ENUM_TRUST_DOMAIN_EX_MULTIPLIER, 
1737                                        r_ex.in.max_size / LSA_ENUM_TRUST_DOMAIN_EX_MULTIPLIER);
1738                                 ret = False;
1739                                 exit(1);
1740                         }
1741                 } else if (!NT_STATUS_IS_OK(enum_status)) {
1742                         printf("EnumTrustedDomainEx failed - %s\n", nt_errstr(enum_status));
1743                         return False;
1744                 }
1745
1746                 ret &= test_query_each_TrustDomEx(p, mem_ctx, handle, &domains_ex);
1747                 
1748         } while ((NT_STATUS_EQUAL(enum_status, STATUS_MORE_ENTRIES)));
1749
1750         return ret;
1751 }
1752
1753 static BOOL test_CreateTrustedDomain(struct dcerpc_pipe *p, 
1754                                      TALLOC_CTX *mem_ctx, 
1755                                      struct policy_handle *handle)
1756 {
1757         NTSTATUS status;
1758         BOOL ret = True;
1759         struct lsa_CreateTrustedDomain r;
1760         struct lsa_DomainInfo trustinfo;
1761         struct dom_sid *domsid[12];
1762         struct policy_handle trustdom_handle[12];
1763         struct lsa_QueryTrustedDomainInfo q;
1764         int i;
1765
1766         printf("Testing CreateTrustedDomain for 12 domains\n");
1767
1768         for (i=0; i< 12; i++) {
1769                 char *trust_name = talloc_asprintf(mem_ctx, "torturedom%02d", i);
1770                 char *trust_sid = talloc_asprintf(mem_ctx, "S-1-5-21-97398-379795-100%02d", i);
1771                 
1772                 domsid[i] = dom_sid_parse_talloc(mem_ctx, trust_sid);
1773
1774                 trustinfo.sid = domsid[i];
1775                 init_lsa_String((struct lsa_String *)&trustinfo.name, trust_name);
1776
1777                 r.in.handle = handle;
1778                 r.in.info = &trustinfo;
1779                 r.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
1780                 r.out.trustdom_handle = &trustdom_handle[i];
1781                 
1782                 status = dcerpc_lsa_CreateTrustedDomain(p, mem_ctx, &r);
1783                 if (NT_STATUS_EQUAL(status, NT_STATUS_OBJECT_NAME_COLLISION)) {
1784                         test_DeleteTrustedDomain(p, mem_ctx, handle, trustinfo.name);
1785                         status = dcerpc_lsa_CreateTrustedDomain(p, mem_ctx, &r);
1786                 }
1787                 if (!NT_STATUS_IS_OK(status)) {
1788                         printf("CreateTrustedDomain failed - %s\n", nt_errstr(status));
1789                         ret = False;
1790                 } else {
1791                 
1792                         q.in.trustdom_handle = &trustdom_handle[i];
1793                         q.in.level = LSA_TRUSTED_DOMAIN_INFO_NAME;
1794                         status = dcerpc_lsa_QueryTrustedDomainInfo(p, mem_ctx, &q);
1795                         if (!NT_STATUS_IS_OK(status)) {
1796                                 printf("QueryTrustedDomainInfo level 1 failed - %s\n", nt_errstr(status));
1797                                 ret = False;
1798                         } else if (!q.out.info) {
1799                                 ret = False;
1800                         } else {
1801                                 if (strcmp(q.out.info->name.netbios_name.string, trustinfo.name.string) != 0) {
1802                                         printf("QueryTrustedDomainInfo returned inconsistant short name: %s != %s\n",
1803                                                q.out.info->name.netbios_name.string, trustinfo.name.string);
1804                                         ret = False;
1805                                 }
1806                         }
1807                 }
1808         }
1809
1810         /* now that we have some domains to look over, we can test the enum calls */
1811         if (!test_EnumTrustDom(p, mem_ctx, handle)) {
1812                 ret = False;
1813         }
1814         
1815         for (i=0; i<12; i++) {
1816                 if (!test_DeleteTrustedDomainBySid(p, mem_ctx, handle, domsid[i])) {
1817                         ret = False;
1818                 }
1819         }
1820
1821         return ret;
1822 }
1823
1824 static BOOL test_QueryDomainInfoPolicy(struct dcerpc_pipe *p, 
1825                                  TALLOC_CTX *mem_ctx, 
1826                                  struct policy_handle *handle)
1827 {
1828         struct lsa_QueryDomainInformationPolicy r;
1829         NTSTATUS status;
1830         int i;
1831         BOOL ret = True;
1832         if (lp_parm_bool(-1, "torture", "samba4", False)) {
1833                 printf("skipping QueryDomainInformationPolicy test against Samba4\n");
1834                 return True;
1835         }
1836
1837         printf("\nTesting QueryDomainInformationPolicy\n");
1838
1839         for (i=2;i<4;i++) {
1840                 r.in.handle = handle;
1841                 r.in.level = i;
1842
1843                 printf("\ntrying QueryDomainInformationPolicy level %d\n", i);
1844
1845                 status = dcerpc_lsa_QueryDomainInformationPolicy(p, mem_ctx, &r);
1846
1847                 if (!NT_STATUS_IS_OK(status)) {
1848                         printf("QueryDomainInformationPolicy failed - %s\n", nt_errstr(status));
1849                         ret = False;
1850                         continue;
1851                 }
1852         }
1853
1854         return ret;
1855 }
1856
1857
1858 static BOOL test_QueryInfoPolicy(struct dcerpc_pipe *p, 
1859                                  TALLOC_CTX *mem_ctx, 
1860                                  struct policy_handle *handle)
1861 {
1862         struct lsa_QueryInfoPolicy r;
1863         NTSTATUS status;
1864         int i;
1865         BOOL ret = True;
1866         printf("\nTesting QueryInfoPolicy\n");
1867
1868         if (lp_parm_bool(-1, "torture", "samba4", False)) {
1869                 printf("skipping QueryInfoPolicy against Samba4\n");
1870                 return True;
1871         }
1872
1873         for (i=1;i<13;i++) {
1874                 r.in.handle = handle;
1875                 r.in.level = i;
1876
1877                 printf("\ntrying QueryInfoPolicy level %d\n", i);
1878
1879                 status = dcerpc_lsa_QueryInfoPolicy(p, mem_ctx, &r);
1880
1881                 if ((i == 9 || i == 10 || i == 11) &&
1882                     NT_STATUS_EQUAL(status, NT_STATUS_INVALID_PARAMETER)) {
1883                         printf("server failed level %u (OK)\n", i);
1884                         continue;
1885                 }
1886
1887                 if (!NT_STATUS_IS_OK(status)) {
1888                         printf("QueryInfoPolicy failed - %s\n", nt_errstr(status));
1889                         ret = False;
1890                         continue;
1891                 }
1892         }
1893
1894         return ret;
1895 }
1896
1897 static BOOL test_QueryInfoPolicy2(struct dcerpc_pipe *p, 
1898                                   TALLOC_CTX *mem_ctx, 
1899                                   struct policy_handle *handle)
1900 {
1901         struct lsa_QueryInfoPolicy2 r;
1902         NTSTATUS status;
1903         int i;
1904         BOOL ret = True;
1905         printf("\nTesting QueryInfoPolicy2\n");
1906         if (lp_parm_bool(-1, "torture", "samba4", False)) {
1907                 printf("skipping QueryInfoPolicy2 against Samba4\n");
1908                 return True;
1909         }
1910
1911         for (i=1;i<13;i++) {
1912                 r.in.handle = handle;
1913                 r.in.level = i;
1914
1915                 printf("\ntrying QueryInfoPolicy2 level %d\n", i);
1916
1917                 status = dcerpc_lsa_QueryInfoPolicy2(p, mem_ctx, &r);
1918
1919                 if ((i == 9 || i == 10 || i == 11) &&
1920                     NT_STATUS_EQUAL(status, NT_STATUS_INVALID_PARAMETER)) {
1921                         printf("server failed level %u (OK)\n", i);
1922                         continue;
1923                 }
1924
1925                 if (!NT_STATUS_IS_OK(status)) {
1926                         printf("QueryInfoPolicy2 failed - %s\n", nt_errstr(status));
1927                         ret = False;
1928                         continue;
1929                 }
1930         }
1931
1932         return ret;
1933 }
1934
1935 static BOOL test_GetUserName(struct dcerpc_pipe *p, TALLOC_CTX *mem_ctx)
1936 {
1937         struct lsa_GetUserName r;
1938         NTSTATUS status;
1939         BOOL ret = True;
1940         struct lsa_StringPointer authority_name_p;
1941
1942         printf("\nTesting GetUserName\n");
1943
1944         r.in.system_name = "\\";
1945         r.in.account_name = NULL;
1946         r.in.authority_name = &authority_name_p;
1947         authority_name_p.string = NULL;
1948
1949         status = dcerpc_lsa_GetUserName(p, mem_ctx, &r);
1950
1951         if (!NT_STATUS_IS_OK(status)) {
1952                 printf("GetUserName failed - %s\n", nt_errstr(status));
1953                 ret = False;
1954         }
1955
1956         return ret;
1957 }
1958
1959 BOOL test_lsa_Close(struct dcerpc_pipe *p, 
1960                     TALLOC_CTX *mem_ctx, 
1961                     struct policy_handle *handle)
1962 {
1963         NTSTATUS status;
1964         struct lsa_Close r;
1965         struct policy_handle handle2;
1966
1967         printf("\ntesting Close\n");
1968
1969         r.in.handle = handle;
1970         r.out.handle = &handle2;
1971
1972         status = dcerpc_lsa_Close(p, mem_ctx, &r);
1973         if (!NT_STATUS_IS_OK(status)) {
1974                 printf("Close failed - %s\n", nt_errstr(status));
1975                 return False;
1976         }
1977
1978         status = dcerpc_lsa_Close(p, mem_ctx, &r);
1979         /* its really a fault - we need a status code for rpc fault */
1980         if (!NT_STATUS_EQUAL(status, NT_STATUS_NET_WRITE_FAULT)) {
1981                 printf("Close failed - %s\n", nt_errstr(status));
1982                 return False;
1983         }
1984
1985         printf("\n");
1986
1987         return True;
1988 }
1989
1990 BOOL torture_rpc_lsa(struct torture_context *torture)
1991 {
1992         NTSTATUS status;
1993         struct dcerpc_pipe *p;
1994         TALLOC_CTX *mem_ctx;
1995         BOOL ret = True;
1996         struct policy_handle *handle;
1997
1998         mem_ctx = talloc_init("torture_rpc_lsa");
1999
2000         status = torture_rpc_connection(torture, &p, &ndr_table_lsarpc);
2001         if (!NT_STATUS_IS_OK(status)) {
2002                 talloc_free(mem_ctx);
2003                 return False;
2004         }
2005
2006         if (!test_OpenPolicy(p, mem_ctx)) {
2007                 ret = False;
2008         }
2009
2010         if (!test_lsa_OpenPolicy2(p, mem_ctx, &handle)) {
2011                 ret = False;
2012         }
2013
2014         if (handle) {
2015                 if (!test_LookupSids_async(p, mem_ctx, handle)) {
2016                         ret = False;
2017                 }
2018
2019                 if (!test_QueryDomainInfoPolicy(p, mem_ctx, handle)) {
2020                         ret = False;
2021                 }
2022                 
2023                 if (!test_CreateAccount(p, mem_ctx, handle)) {
2024                         ret = False;
2025                 }
2026                 
2027                 if (!test_CreateSecret(p, mem_ctx, handle)) {
2028                         ret = False;
2029                 }
2030                 
2031                 if (!test_CreateTrustedDomain(p, mem_ctx, handle)) {
2032                         ret = False;
2033                 }
2034                 
2035                 if (!test_EnumAccounts(p, mem_ctx, handle)) {
2036                         ret = False;
2037                 }
2038                 
2039                 if (!test_EnumPrivs(p, mem_ctx, handle)) {
2040                         ret = False;
2041                 }
2042                 
2043                 if (!test_QueryInfoPolicy(p, mem_ctx, handle)) {
2044                         ret = False;
2045                 }
2046                 
2047                 if (!test_QueryInfoPolicy2(p, mem_ctx, handle)) {
2048                         ret = False;
2049                 }
2050                 
2051 #if 0
2052                 if (!test_Delete(p, mem_ctx, handle)) {
2053                         ret = False;
2054                 }
2055 #endif
2056                 
2057                 if (!test_many_LookupSids(p, mem_ctx, handle)) {
2058                         ret = False;
2059                 }
2060                 
2061                 if (!test_lsa_Close(p, mem_ctx, handle)) {
2062                         ret = False;
2063                 }
2064         } else {
2065                 if (!test_many_LookupSids(p, mem_ctx, handle)) {
2066                         ret = False;
2067                 }
2068         }
2069
2070         if (!test_GetUserName(p, mem_ctx)) {
2071                 ret = False;
2072         }
2073                 
2074         talloc_free(mem_ctx);
2075
2076         return ret;
2077 }
2078
2079 BOOL torture_rpc_lsa_get_user(struct torture_context *torture)
2080 {
2081         NTSTATUS status;
2082         struct dcerpc_pipe *p;
2083         TALLOC_CTX *mem_ctx;
2084         BOOL ret = True;
2085
2086         mem_ctx = talloc_init("torture_rpc_lsa_get_user");
2087
2088         status = torture_rpc_connection(torture, &p, &ndr_table_lsarpc);
2089         if (!NT_STATUS_IS_OK(status)) {
2090                 talloc_free(mem_ctx);
2091                 return False;
2092         }
2093
2094         if (!test_GetUserName(p, mem_ctx)) {
2095                 ret = False;
2096         }
2097                 
2098         talloc_free(mem_ctx);
2099
2100         return ret;
2101 }