source4/torture/rpc/samr.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3    test suite for samr rpc operations
   4
   5    Copyright (C) Andrew Tridgell 2003
   6    Copyright (C) Andrew Bartlett <abartlet@samba.org> 2003
   7
   8    This program is free software; you can redistribute it and/or modify
   9    it under the terms of the GNU General Public License as published by
  10    the Free Software Foundation; either version 3 of the License, or
  11    (at your option) any later version.
  12
  13    This program is distributed in the hope that it will be useful,
  14    but WITHOUT ANY WARRANTY; without even the implied warranty of
  15    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  16    GNU General Public License for more details.
  17
  18    You should have received a copy of the GNU General Public License
  19    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  20 */
  21
  22 #include "includes.h"
  23 #include "torture/torture.h"
  24 #include "system/time.h"
  25 #include "librpc/gen_ndr/lsa.h"
  26 #include "librpc/gen_ndr/ndr_netlogon.h"
  27 #include "librpc/gen_ndr/ndr_netlogon_c.h"
  28 #include "librpc/gen_ndr/ndr_samr_c.h"
  29 #include "../lib/crypto/crypto.h"
  30 #include "libcli/auth/libcli_auth.h"
  31 #include "libcli/security/security.h"
  32 #include "torture/rpc/rpc.h"
  33 #include "param/param.h"
  34
  35 #include <unistd.h>
  36
  37 #define TEST_ACCOUNT_NAME "samrtorturetest"
  38 #define TEST_ACCOUNT_NAME_PWD "samrpwdlastset"
  39 #define TEST_ALIASNAME "samrtorturetestalias"
  40 #define TEST_GROUPNAME "samrtorturetestgroup"
  41 #define TEST_MACHINENAME "samrtestmach$"
  42 #define TEST_DOMAINNAME "samrtestdom$"
  43
  44 enum torture_samr_choice {
  45         TORTURE_SAMR_PASSWORDS,
  46         TORTURE_SAMR_PASSWORDS_PWDLASTSET,
  47         TORTURE_SAMR_USER_ATTRIBUTES,
  48         TORTURE_SAMR_OTHER
  49 };
  50
  51 static bool test_QueryUserInfo(struct dcerpc_pipe *p, TALLOC_CTX *mem_ctx,
  52                                struct policy_handle *handle);
  53
  54 static bool test_QueryUserInfo2(struct dcerpc_pipe *p, TALLOC_CTX *mem_ctx,
  55                                 struct policy_handle *handle);
  56
  57 static bool test_QueryAliasInfo(struct dcerpc_pipe *p, TALLOC_CTX *mem_ctx,
  58                                struct policy_handle *handle);
  59
  60 static bool test_ChangePassword(struct dcerpc_pipe *p, TALLOC_CTX *mem_ctx,
  61                                 const char *acct_name,
  62                                 struct policy_handle *domain_handle, char **password);
  63
  64 static void init_lsa_String(struct lsa_String *string, const char *s)
  65 {
  66         string->string = s;
  67 }
  68
  69 static void init_lsa_BinaryString(struct lsa_BinaryString *string, const char *s, uint32_t length)
  70 {
  71         string->length = length;
  72         string->size = length;
  73         string->array = (uint16_t *)discard_const(s);
  74 }
  75
  76 bool test_samr_handle_Close(struct dcerpc_pipe *p, struct torture_context *tctx,
  77                                    struct policy_handle *handle)
  78 {
  79         NTSTATUS status;
  80         struct samr_Close r;
  81
  82         r.in.handle = handle;
  83         r.out.handle = handle;
  84
  85         status = dcerpc_samr_Close(p, tctx, &r);
  86         torture_assert_ntstatus_ok(tctx, status, "Close");
  87
  88         return true;
  89 }
  90
  91 static bool test_Shutdown(struct dcerpc_pipe *p, struct torture_context *tctx,
  92                        struct policy_handle *handle)
  93 {
  94         NTSTATUS status;
  95         struct samr_Shutdown r;
  96
  97         if (!torture_setting_bool(tctx, "dangerous", false)) {
  98                 torture_skip(tctx, "samr_Shutdown disabled - enable dangerous tests to use\n");
  99                 return true;
 100         }
 101
 102         r.in.connect_handle = handle;
 103
 104         torture_comment(tctx, "testing samr_Shutdown\n");
 105
 106         status = dcerpc_samr_Shutdown(p, tctx, &r);
 107         torture_assert_ntstatus_ok(tctx, status, "samr_Shutdown");
 108
 109         return true;
 110 }
 111
 112 static bool test_SetDsrmPassword(struct dcerpc_pipe *p, struct torture_context *tctx,
 113                                  struct policy_handle *handle)
 114 {
 115         NTSTATUS status;
 116         struct samr_SetDsrmPassword r;
 117         struct lsa_String string;
 118         struct samr_Password hash;
 119
 120         if (!torture_setting_bool(tctx, "dangerous", false)) {
 121                 torture_skip(tctx, "samr_SetDsrmPassword disabled - enable dangerous tests to use");
 122         }
 123
 124         E_md4hash("TeSTDSRM123", hash.hash);
 125
 126         init_lsa_String(&string, "Administrator");
 127
 128         r.in.name = &string;
 129         r.in.unknown = 0;
 130         r.in.hash = &hash;
 131
 132         torture_comment(tctx, "testing samr_SetDsrmPassword\n");
 133
 134         status = dcerpc_samr_SetDsrmPassword(p, tctx, &r);
 135         torture_assert_ntstatus_equal(tctx, status, NT_STATUS_NOT_SUPPORTED, "samr_SetDsrmPassword");
 136
 137         return true;
 138 }
 139
 140
 141 static bool test_QuerySecurity(struct dcerpc_pipe *p,
 142                                struct torture_context *tctx,
 143                                struct policy_handle *handle)
 144 {
 145         NTSTATUS status;
 146         struct samr_QuerySecurity r;
 147         struct samr_SetSecurity s;
 148         struct sec_desc_buf *sdbuf = NULL;
 149
 150         r.in.handle = handle;
 151         r.in.sec_info = 7;
 152         r.out.sdbuf = &sdbuf;
 153
 154         status = dcerpc_samr_QuerySecurity(p, tctx, &r);
 155         torture_assert_ntstatus_ok(tctx, status, "QuerySecurity");
 156
 157         torture_assert(tctx, sdbuf != NULL, "sdbuf is NULL");
 158
 159         s.in.handle = handle;
 160         s.in.sec_info = 7;
 161         s.in.sdbuf = sdbuf;
 162
 163         if (torture_setting_bool(tctx, "samba4", false)) {
 164                 torture_skip(tctx, "skipping SetSecurity test against Samba4\n");
 165         }
 166
 167         status = dcerpc_samr_SetSecurity(p, tctx, &s);
 168         torture_assert_ntstatus_ok(tctx, status, "SetSecurity");
 169
 170         status = dcerpc_samr_QuerySecurity(p, tctx, &r);
 171         torture_assert_ntstatus_ok(tctx, status, "QuerySecurity");
 172
 173         return true;
 174 }
 175
 176
 177 static bool test_SetUserInfo(struct dcerpc_pipe *p, struct torture_context *tctx,
 178                              struct policy_handle *handle, uint32_t base_acct_flags,
 179                              const char *base_account_name)
 180 {
 181         NTSTATUS status;
 182         struct samr_SetUserInfo s;
 183         struct samr_SetUserInfo2 s2;
 184         struct samr_QueryUserInfo q;
 185         struct samr_QueryUserInfo q0;
 186         union samr_UserInfo u;
 187         union samr_UserInfo *info;
 188         bool ret = true;
 189         const char *test_account_name;
 190
 191         uint32_t user_extra_flags = 0;
 192
 193         if (!torture_setting_bool(tctx, "samba3", false)) {
 194                 if (base_acct_flags == ACB_NORMAL) {
 195                         /* When created, accounts are expired by default */
 196                         user_extra_flags = ACB_PW_EXPIRED;
 197                 }
 198         }
 199
 200         s.in.user_handle = handle;
 201         s.in.info = &u;
 202
 203         s2.in.user_handle = handle;
 204         s2.in.info = &u;
 205
 206         q.in.user_handle = handle;
 207         q.out.info = &info;
 208         q0 = q;
 209
 210 #define TESTCALL(call, r) \
 211                 status = dcerpc_samr_ ##call(p, tctx, &r); \
 212                 if (!NT_STATUS_IS_OK(status)) { \
 213                         torture_comment(tctx, #call " level %u failed - %s (%s)\n", \
 214                                r.in.level, nt_errstr(status), __location__); \
 215                         ret = false; \
 216                         break; \
 217                 }
 218
 219 #define STRING_EQUAL(s1, s2, field) \
 220                 if ((s1 && !s2) || (s2 && !s1) || strcmp(s1, s2)) { \
 221                         torture_comment(tctx, "Failed to set %s to '%s' (%s)\n", \
 222                                #field, s2, __location__); \
 223                         ret = false; \
 224                         break; \
 225                 }
 226
 227 #define MEM_EQUAL(s1, s2, length, field) \
 228                 if ((s1 && !s2) || (s2 && !s1) || memcmp(s1, s2, length)) { \
 229                         torture_comment(tctx, "Failed to set %s to '%s' (%s)\n", \
 230                                #field, (const char *)s2, __location__); \
 231                         ret = false; \
 232                         break; \
 233                 }
 234
 235 #define INT_EQUAL(i1, i2, field) \
 236                 if (i1 != i2) { \
 237                         torture_comment(tctx, "Failed to set %s to 0x%llx - got 0x%llx (%s)\n", \
 238                                #field, (unsigned long long)i2, (unsigned long long)i1, __location__); \
 239                         ret = false; \
 240                         break; \
 241                 }
 242
 243 #define TEST_USERINFO_STRING(lvl1, field1, lvl2, field2, value, fpval) do { \
 244                 torture_comment(tctx, "field test %d/%s vs %d/%s\n", lvl1, #field1, lvl2, #field2); \
 245                 q.in.level = lvl1; \
 246                 TESTCALL(QueryUserInfo, q) \
 247                 s.in.level = lvl1; \
 248                 s2.in.level = lvl1; \
 249                 u = *info; \
 250                 if (lvl1 == 21) { \
 251                         ZERO_STRUCT(u.info21); \
 252                         u.info21.fields_present = fpval; \
 253                 } \
 254                 init_lsa_String(&u.info ## lvl1.field1, value); \
 255                 TESTCALL(SetUserInfo, s) \
 256                 TESTCALL(SetUserInfo2, s2) \
 257                 init_lsa_String(&u.info ## lvl1.field1, ""); \
 258                 TESTCALL(QueryUserInfo, q); \
 259                 u = *info; \
 260                 STRING_EQUAL(u.info ## lvl1.field1.string, value, field1); \
 261                 q.in.level = lvl2; \
 262                 TESTCALL(QueryUserInfo, q) \
 263                 u = *info; \
 264                 STRING_EQUAL(u.info ## lvl2.field2.string, value, field2); \
 265         } while (0)
 266
 267 #define TEST_USERINFO_BINARYSTRING(lvl1, field1, lvl2, field2, value, fpval) do { \
 268                 torture_comment(tctx, "field test %d/%s vs %d/%s\n", lvl1, #field1, lvl2, #field2); \
 269                 q.in.level = lvl1; \
 270                 TESTCALL(QueryUserInfo, q) \
 271                 s.in.level = lvl1; \
 272                 s2.in.level = lvl1; \
 273                 u = *info; \
 274                 if (lvl1 == 21) { \
 275                         ZERO_STRUCT(u.info21); \
 276                         u.info21.fields_present = fpval; \
 277                 } \
 278                 init_lsa_BinaryString(&u.info ## lvl1.field1, value, strlen(value)); \
 279                 TESTCALL(SetUserInfo, s) \
 280                 TESTCALL(SetUserInfo2, s2) \
 281                 init_lsa_BinaryString(&u.info ## lvl1.field1, "", 1); \
 282                 TESTCALL(QueryUserInfo, q); \
 283                 u = *info; \
 284                 MEM_EQUAL(u.info ## lvl1.field1.array, value, strlen(value), field1); \
 285                 q.in.level = lvl2; \
 286                 TESTCALL(QueryUserInfo, q) \
 287                 u = *info; \
 288                 MEM_EQUAL(u.info ## lvl2.field2.array, value, strlen(value), field2); \
 289         } while (0)
 290
 291 #define TEST_USERINFO_INT_EXP(lvl1, field1, lvl2, field2, value, exp_value, fpval) do { \
 292                 torture_comment(tctx, "field test %d/%s vs %d/%s\n", lvl1, #field1, lvl2, #field2); \
 293                 q.in.level = lvl1; \
 294                 TESTCALL(QueryUserInfo, q) \
 295                 s.in.level = lvl1; \
 296                 s2.in.level = lvl1; \
 297                 u = *info; \
 298                 if (lvl1 == 21) { \
 299                         uint8_t *bits = u.info21.logon_hours.bits; \
 300                         ZERO_STRUCT(u.info21); \
 301                         if (fpval == SAMR_FIELD_LOGON_HOURS) { \
 302                                 u.info21.logon_hours.units_per_week = 168; \
 303                                 u.info21.logon_hours.bits = bits; \
 304                         } \
 305                         u.info21.fields_present = fpval; \
 306                 } \
 307                 u.info ## lvl1.field1 = value; \
 308                 TESTCALL(SetUserInfo, s) \
 309                 TESTCALL(SetUserInfo2, s2) \
 310                 u.info ## lvl1.field1 = 0; \
 311                 TESTCALL(QueryUserInfo, q); \
 312                 u = *info; \
 313                 INT_EQUAL(u.info ## lvl1.field1, exp_value, field1); \
 314                 q.in.level = lvl2; \
 315                 TESTCALL(QueryUserInfo, q) \
 316                 u = *info; \
 317                 INT_EQUAL(u.info ## lvl2.field2, exp_value, field1); \
 318         } while (0)
 319
 320 #define TEST_USERINFO_INT(lvl1, field1, lvl2, field2, value, fpval) do { \
 321         TEST_USERINFO_INT_EXP(lvl1, field1, lvl2, field2, value, value, fpval); \
 322         } while (0)
 323
 324         q0.in.level = 12;
 325         do { TESTCALL(QueryUserInfo, q0) } while (0);
 326
 327         /* Samba 3 cannot store comment fields atm. - gd */
 328         if (!torture_setting_bool(tctx, "samba3", false)) {
 329                 TEST_USERINFO_STRING(2, comment,  1, comment, "xx2-1 comment", 0);
 330                 TEST_USERINFO_STRING(2, comment, 21, comment, "xx2-21 comment", 0);
 331                 TEST_USERINFO_STRING(21, comment, 21, comment, "xx21-21 comment",
 332                                    SAMR_FIELD_COMMENT);
 333         }
 334
 335         test_account_name = talloc_asprintf(tctx, "%sxx7-1", base_account_name);
 336         TEST_USERINFO_STRING(7, account_name,  1, account_name, base_account_name, 0);
 337         test_account_name = talloc_asprintf(tctx, "%sxx7-3", base_account_name);
 338         TEST_USERINFO_STRING(7, account_name,  3, account_name, base_account_name, 0);
 339         test_account_name = talloc_asprintf(tctx, "%sxx7-5", base_account_name);
 340         TEST_USERINFO_STRING(7, account_name,  5, account_name, base_account_name, 0);
 341         test_account_name = talloc_asprintf(tctx, "%sxx7-6", base_account_name);
 342         TEST_USERINFO_STRING(7, account_name,  6, account_name, base_account_name, 0);
 343         test_account_name = talloc_asprintf(tctx, "%sxx7-7", base_account_name);
 344         TEST_USERINFO_STRING(7, account_name,  7, account_name, base_account_name, 0);
 345         test_account_name = talloc_asprintf(tctx, "%sxx7-21", base_account_name);
 346         TEST_USERINFO_STRING(7, account_name, 21, account_name, base_account_name, 0);
 347         test_account_name = base_account_name;
 348         TEST_USERINFO_STRING(21, account_name, 21, account_name, base_account_name,
 349                            SAMR_FIELD_ACCOUNT_NAME);
 350
 351         TEST_USERINFO_STRING(6, full_name,  1, full_name, "xx6-1 full_name", 0);
 352         TEST_USERINFO_STRING(6, full_name,  3, full_name, "xx6-3 full_name", 0);
 353         TEST_USERINFO_STRING(6, full_name,  5, full_name, "xx6-5 full_name", 0);
 354         TEST_USERINFO_STRING(6, full_name,  6, full_name, "xx6-6 full_name", 0);
 355         TEST_USERINFO_STRING(6, full_name,  8, full_name, "xx6-8 full_name", 0);
 356         TEST_USERINFO_STRING(6, full_name, 21, full_name, "xx6-21 full_name", 0);
 357         TEST_USERINFO_STRING(8, full_name, 21, full_name, "xx8-21 full_name", 0);
 358         TEST_USERINFO_STRING(21, full_name, 21, full_name, "xx21-21 full_name",
 359                            SAMR_FIELD_FULL_NAME);
 360
 361         TEST_USERINFO_STRING(6, full_name,  1, full_name, "", 0);
 362         TEST_USERINFO_STRING(6, full_name,  3, full_name, "", 0);
 363         TEST_USERINFO_STRING(6, full_name,  5, full_name, "", 0);
 364         TEST_USERINFO_STRING(6, full_name,  6, full_name, "", 0);
 365         TEST_USERINFO_STRING(6, full_name,  8, full_name, "", 0);
 366         TEST_USERINFO_STRING(6, full_name, 21, full_name, "", 0);
 367         TEST_USERINFO_STRING(8, full_name, 21, full_name, "", 0);
 368         TEST_USERINFO_STRING(21, full_name, 21, full_name, "",
 369                            SAMR_FIELD_FULL_NAME);
 370
 371         TEST_USERINFO_STRING(11, logon_script, 3, logon_script, "xx11-3 logon_script", 0);
 372         TEST_USERINFO_STRING(11, logon_script, 5, logon_script, "xx11-5 logon_script", 0);
 373         TEST_USERINFO_STRING(11, logon_script, 21, logon_script, "xx11-21 logon_script", 0);
 374         TEST_USERINFO_STRING(21, logon_script, 21, logon_script, "xx21-21 logon_script",
 375                            SAMR_FIELD_LOGON_SCRIPT);
 376
 377         TEST_USERINFO_STRING(12, profile_path,  3, profile_path, "xx12-3 profile_path", 0);
 378         TEST_USERINFO_STRING(12, profile_path,  5, profile_path, "xx12-5 profile_path", 0);
 379         TEST_USERINFO_STRING(12, profile_path, 21, profile_path, "xx12-21 profile_path", 0);
 380         TEST_USERINFO_STRING(21, profile_path, 21, profile_path, "xx21-21 profile_path",
 381                            SAMR_FIELD_PROFILE_PATH);
 382
 383         TEST_USERINFO_STRING(10, home_directory, 3, home_directory, "xx10-3 home_directory", 0);
 384         TEST_USERINFO_STRING(10, home_directory, 5, home_directory, "xx10-5 home_directory", 0);
 385         TEST_USERINFO_STRING(10, home_directory, 21, home_directory, "xx10-21 home_directory", 0);
 386         TEST_USERINFO_STRING(21, home_directory, 21, home_directory, "xx21-21 home_directory",
 387                              SAMR_FIELD_HOME_DIRECTORY);
 388         TEST_USERINFO_STRING(21, home_directory, 10, home_directory, "xx21-10 home_directory",
 389                              SAMR_FIELD_HOME_DIRECTORY);
 390
 391         TEST_USERINFO_STRING(10, home_drive, 3, home_drive, "xx10-3 home_drive", 0);
 392         TEST_USERINFO_STRING(10, home_drive, 5, home_drive, "xx10-5 home_drive", 0);
 393         TEST_USERINFO_STRING(10, home_drive, 21, home_drive, "xx10-21 home_drive", 0);
 394         TEST_USERINFO_STRING(21, home_drive, 21, home_drive, "xx21-21 home_drive",
 395                              SAMR_FIELD_HOME_DRIVE);
 396         TEST_USERINFO_STRING(21, home_drive, 10, home_drive, "xx21-10 home_drive",
 397                              SAMR_FIELD_HOME_DRIVE);
 398
 399         TEST_USERINFO_STRING(13, description,  1, description, "xx13-1 description", 0);
 400         TEST_USERINFO_STRING(13, description,  5, description, "xx13-5 description", 0);
 401         TEST_USERINFO_STRING(13, description, 21, description, "xx13-21 description", 0);
 402         TEST_USERINFO_STRING(21, description, 21, description, "xx21-21 description",
 403                            SAMR_FIELD_DESCRIPTION);
 404
 405         TEST_USERINFO_STRING(14, workstations,  3, workstations, "14workstation3", 0);
 406         TEST_USERINFO_STRING(14, workstations,  5, workstations, "14workstation4", 0);
 407         TEST_USERINFO_STRING(14, workstations, 21, workstations, "14workstation21", 0);
 408         TEST_USERINFO_STRING(21, workstations, 21, workstations, "21workstation21",
 409                            SAMR_FIELD_WORKSTATIONS);
 410         TEST_USERINFO_STRING(21, workstations, 3, workstations, "21workstation3",
 411                            SAMR_FIELD_WORKSTATIONS);
 412         TEST_USERINFO_STRING(21, workstations, 5, workstations, "21workstation5",
 413                            SAMR_FIELD_WORKSTATIONS);
 414         TEST_USERINFO_STRING(21, workstations, 14, workstations, "21workstation14",
 415                            SAMR_FIELD_WORKSTATIONS);
 416
 417         TEST_USERINFO_BINARYSTRING(20, parameters, 21, parameters, "xx20-21 parameters", 0);
 418         TEST_USERINFO_BINARYSTRING(21, parameters, 21, parameters, "xx21-21 parameters",
 419                            SAMR_FIELD_PARAMETERS);
 420         TEST_USERINFO_BINARYSTRING(21, parameters, 20, parameters, "xx21-20 parameters",
 421                            SAMR_FIELD_PARAMETERS);
 422         /* also empty user parameters are allowed */
 423         TEST_USERINFO_BINARYSTRING(20, parameters, 21, parameters, "", 0);
 424         TEST_USERINFO_BINARYSTRING(21, parameters, 21, parameters, "",
 425                            SAMR_FIELD_PARAMETERS);
 426         TEST_USERINFO_BINARYSTRING(21, parameters, 20, parameters, "",
 427                            SAMR_FIELD_PARAMETERS);
 428
 429         /* Samba 3 cannot store country_code and copy_page atm. - gd */
 430         if (!torture_setting_bool(tctx, "samba3", false)) {
 431                 TEST_USERINFO_INT(2, country_code, 2, country_code, __LINE__, 0);
 432                 TEST_USERINFO_INT(2, country_code, 21, country_code, __LINE__, 0);
 433                 TEST_USERINFO_INT(21, country_code, 21, country_code, __LINE__,
 434                                   SAMR_FIELD_COUNTRY_CODE);
 435                 TEST_USERINFO_INT(21, country_code, 2, country_code, __LINE__,
 436                                   SAMR_FIELD_COUNTRY_CODE);
 437
 438                 TEST_USERINFO_INT(2, code_page, 21, code_page, __LINE__, 0);
 439                 TEST_USERINFO_INT(21, code_page, 21, code_page, __LINE__,
 440                                   SAMR_FIELD_CODE_PAGE);
 441                 TEST_USERINFO_INT(21, code_page, 2, code_page, __LINE__,
 442                                   SAMR_FIELD_CODE_PAGE);
 443         }
 444
 445         if (!torture_setting_bool(tctx, "samba3", false)) {
 446                 TEST_USERINFO_INT(17, acct_expiry, 21, acct_expiry, __LINE__, 0);
 447                 TEST_USERINFO_INT(17, acct_expiry, 5, acct_expiry, __LINE__, 0);
 448                 TEST_USERINFO_INT(21, acct_expiry, 21, acct_expiry, __LINE__,
 449                                   SAMR_FIELD_ACCT_EXPIRY);
 450                 TEST_USERINFO_INT(21, acct_expiry, 5, acct_expiry, __LINE__,
 451                                   SAMR_FIELD_ACCT_EXPIRY);
 452                 TEST_USERINFO_INT(21, acct_expiry, 17, acct_expiry, __LINE__,
 453                                   SAMR_FIELD_ACCT_EXPIRY);
 454         } else {
 455                 /* Samba 3 can only store seconds / time_t in passdb - gd */
 456                 NTTIME nt;
 457                 unix_to_nt_time(&nt, time(NULL) + __LINE__);
 458                 TEST_USERINFO_INT(17, acct_expiry, 21, acct_expiry, nt, 0);
 459                 unix_to_nt_time(&nt, time(NULL) + __LINE__);
 460                 TEST_USERINFO_INT(17, acct_expiry, 5, acct_expiry, nt, 0);
 461                 unix_to_nt_time(&nt, time(NULL) + __LINE__);
 462                 TEST_USERINFO_INT(21, acct_expiry, 21, acct_expiry, nt, SAMR_FIELD_ACCT_EXPIRY);
 463                 unix_to_nt_time(&nt, time(NULL) + __LINE__);
 464                 TEST_USERINFO_INT(21, acct_expiry, 5, acct_expiry, nt, SAMR_FIELD_ACCT_EXPIRY);
 465                 unix_to_nt_time(&nt, time(NULL) + __LINE__);
 466                 TEST_USERINFO_INT(21, acct_expiry, 17, acct_expiry, nt, SAMR_FIELD_ACCT_EXPIRY);
 467         }
 468
 469         TEST_USERINFO_INT(4, logon_hours.bits[3],  3, logon_hours.bits[3], 1, 0);
 470         TEST_USERINFO_INT(4, logon_hours.bits[3],  5, logon_hours.bits[3], 2, 0);
 471         TEST_USERINFO_INT(4, logon_hours.bits[3], 21, logon_hours.bits[3], 3, 0);
 472         TEST_USERINFO_INT(21, logon_hours.bits[3], 21, logon_hours.bits[3], 4,
 473                           SAMR_FIELD_LOGON_HOURS);
 474
 475         TEST_USERINFO_INT_EXP(16, acct_flags, 5, acct_flags,
 476                               (base_acct_flags  | ACB_DISABLED | ACB_HOMDIRREQ),
 477                               (base_acct_flags  | ACB_DISABLED | ACB_HOMDIRREQ | user_extra_flags),
 478                               0);
 479         TEST_USERINFO_INT_EXP(16, acct_flags, 5, acct_flags,
 480                               (base_acct_flags  | ACB_DISABLED),
 481                               (base_acct_flags  | ACB_DISABLED | user_extra_flags),
 482                               0);
 483
 484         /* Setting PWNOEXP clears the magic ACB_PW_EXPIRED flag */
 485         TEST_USERINFO_INT_EXP(16, acct_flags, 5, acct_flags,
 486                               (base_acct_flags  | ACB_DISABLED | ACB_PWNOEXP),
 487                               (base_acct_flags  | ACB_DISABLED | ACB_PWNOEXP),
 488                               0);
 489         TEST_USERINFO_INT_EXP(16, acct_flags, 21, acct_flags,
 490                               (base_acct_flags | ACB_DISABLED | ACB_HOMDIRREQ),
 491                               (base_acct_flags | ACB_DISABLED | ACB_HOMDIRREQ | user_extra_flags),
 492                               0);
 493
 494
 495         /* The 'autolock' flag doesn't stick - check this */
 496         TEST_USERINFO_INT_EXP(16, acct_flags, 21, acct_flags,
 497                               (base_acct_flags | ACB_DISABLED | ACB_AUTOLOCK),
 498                               (base_acct_flags | ACB_DISABLED | user_extra_flags),
 499                               0);
 500 #if 0
 501         /* Removing the 'disabled' flag doesn't stick - check this */
 502         TEST_USERINFO_INT_EXP(16, acct_flags, 21, acct_flags,
 503                               (base_acct_flags),
 504                               (base_acct_flags | ACB_DISABLED | user_extra_flags),
 505                               0);
 506 #endif
 507
 508         /* Samba3 cannot store these atm */
 509         if (!torture_setting_bool(tctx, "samba3", false)) {
 510         /* The 'store plaintext' flag does stick */
 511         TEST_USERINFO_INT_EXP(16, acct_flags, 21, acct_flags,
 512                               (base_acct_flags | ACB_DISABLED | ACB_ENC_TXT_PWD_ALLOWED),
 513                               (base_acct_flags | ACB_DISABLED | ACB_ENC_TXT_PWD_ALLOWED | user_extra_flags),
 514                               0);
 515         /* The 'use DES' flag does stick */
 516         TEST_USERINFO_INT_EXP(16, acct_flags, 21, acct_flags,
 517                               (base_acct_flags | ACB_DISABLED | ACB_USE_DES_KEY_ONLY),
 518                               (base_acct_flags | ACB_DISABLED | ACB_USE_DES_KEY_ONLY | user_extra_flags),
 519                               0);
 520         /* The 'don't require kerberos pre-authentication flag does stick */
 521         TEST_USERINFO_INT_EXP(16, acct_flags, 21, acct_flags,
 522                               (base_acct_flags | ACB_DISABLED | ACB_DONT_REQUIRE_PREAUTH),
 523                               (base_acct_flags | ACB_DISABLED | ACB_DONT_REQUIRE_PREAUTH | user_extra_flags),
 524                               0);
 525         /* The 'no kerberos PAC required' flag sticks */
 526         TEST_USERINFO_INT_EXP(16, acct_flags, 21, acct_flags,
 527                               (base_acct_flags | ACB_DISABLED | ACB_NO_AUTH_DATA_REQD),
 528                               (base_acct_flags | ACB_DISABLED | ACB_NO_AUTH_DATA_REQD | user_extra_flags),
 529                               0);
 530         }
 531         TEST_USERINFO_INT_EXP(21, acct_flags, 21, acct_flags,
 532                               (base_acct_flags | ACB_DISABLED),
 533                               (base_acct_flags | ACB_DISABLED | user_extra_flags),
 534                               SAMR_FIELD_ACCT_FLAGS);
 535
 536 #if 0
 537         /* these fail with win2003 - it appears you can't set the primary gid?
 538            the set succeeds, but the gid isn't changed. Very weird! */
 539         TEST_USERINFO_INT(9, primary_gid,  1, primary_gid, 513);
 540         TEST_USERINFO_INT(9, primary_gid,  3, primary_gid, 513);
 541         TEST_USERINFO_INT(9, primary_gid,  5, primary_gid, 513);
 542         TEST_USERINFO_INT(9, primary_gid, 21, primary_gid, 513);
 543 #endif
 544
 545         return ret;
 546 }
 547
 548 /*
 549   generate a random password for password change tests
 550 */
 551 static char *samr_rand_pass_silent(TALLOC_CTX *mem_ctx, int min_len)
 552 {
 553         size_t len = MAX(8, min_len) + (random() % 6);
 554         char *s = generate_random_str(mem_ctx, len);
 555         return s;
 556 }
 557
 558 static char *samr_rand_pass(TALLOC_CTX *mem_ctx, int min_len)
 559 {
 560         char *s = samr_rand_pass_silent(mem_ctx, min_len);
 561         printf("Generated password '%s'\n", s);
 562         return s;
 563
 564 }
 565
 566 /*
 567   generate a random password for password change tests
 568 */
 569 static DATA_BLOB samr_very_rand_pass(TALLOC_CTX *mem_ctx, int len)
 570 {
 571         int i;
 572         DATA_BLOB password = data_blob_talloc(mem_ctx, NULL, len * 2 /* number of unicode chars */);
 573         generate_random_buffer(password.data, password.length);
 574
 575         for (i=0; i < len; i++) {
 576                 if (((uint16_t *)password.data)[i] == 0) {
 577                         ((uint16_t *)password.data)[i] = 1;
 578                 }
 579         }
 580
 581         return password;
 582 }
 583
 584 /*
 585   generate a random password for password change tests (fixed length)
 586 */
 587 static char *samr_rand_pass_fixed_len(TALLOC_CTX *mem_ctx, int len)
 588 {
 589         char *s = generate_random_str(mem_ctx, len);
 590         printf("Generated password '%s'\n", s);
 591         return s;
 592 }
 593
 594 static bool test_SetUserPass(struct dcerpc_pipe *p, struct torture_context *tctx,
 595                              struct policy_handle *handle, char **password)
 596 {
 597         NTSTATUS status;
 598         struct samr_SetUserInfo s;
 599         union samr_UserInfo u;
 600         bool ret = true;
 601         DATA_BLOB session_key;
 602         char *newpass;
 603         struct samr_GetUserPwInfo pwp;
 604         struct samr_PwInfo info;
 605         int policy_min_pw_len = 0;
 606         pwp.in.user_handle = handle;
 607         pwp.out.info = &info;
 608
 609         status = dcerpc_samr_GetUserPwInfo(p, tctx, &pwp);
 610         if (NT_STATUS_IS_OK(status)) {
 611                 policy_min_pw_len = pwp.out.info->min_password_length;
 612         }
 613         newpass = samr_rand_pass(tctx, policy_min_pw_len);
 614
 615         s.in.user_handle = handle;
 616         s.in.info = &u;
 617         s.in.level = 24;
 618
 619         encode_pw_buffer(u.info24.password.data, newpass, STR_UNICODE);
 620         u.info24.password_expired = 0;
 621
 622         status = dcerpc_fetch_session_key(p, &session_key);
 623         if (!NT_STATUS_IS_OK(status)) {
 624                 printf("SetUserInfo level %u - no session key - %s\n",
 625                        s.in.level, nt_errstr(status));
 626                 return false;
 627         }
 628
 629         arcfour_crypt_blob(u.info24.password.data, 516, &session_key);
 630
 631         torture_comment(tctx, "Testing SetUserInfo level 24 (set password)\n");
 632
 633         status = dcerpc_samr_SetUserInfo(p, tctx, &s);
 634         if (!NT_STATUS_IS_OK(status)) {
 635                 printf("SetUserInfo level %u failed - %s\n",
 636                        s.in.level, nt_errstr(status));
 637                 ret = false;
 638         } else {
 639                 *password = newpass;
 640         }
 641
 642         return ret;
 643 }
 644
 645
 646 static bool test_SetUserPass_23(struct dcerpc_pipe *p, struct torture_context *tctx,
 647                                 struct policy_handle *handle, uint32_t fields_present,
 648                                 char **password)
 649 {
 650         NTSTATUS status;
 651         struct samr_SetUserInfo s;
 652         union samr_UserInfo u;
 653         bool ret = true;
 654         DATA_BLOB session_key;
 655         char *newpass;
 656         struct samr_GetUserPwInfo pwp;
 657         struct samr_PwInfo info;
 658         int policy_min_pw_len = 0;
 659         pwp.in.user_handle = handle;
 660         pwp.out.info = &info;
 661
 662         status = dcerpc_samr_GetUserPwInfo(p, tctx, &pwp);
 663         if (NT_STATUS_IS_OK(status)) {
 664                 policy_min_pw_len = pwp.out.info->min_password_length;
 665         }
 666         newpass = samr_rand_pass(tctx, policy_min_pw_len);
 667
 668         s.in.user_handle = handle;
 669         s.in.info = &u;
 670         s.in.level = 23;
 671
 672         ZERO_STRUCT(u);
 673
 674         u.info23.info.fields_present = fields_present;
 675
 676         encode_pw_buffer(u.info23.password.data, newpass, STR_UNICODE);
 677
 678         status = dcerpc_fetch_session_key(p, &session_key);
 679         if (!NT_STATUS_IS_OK(status)) {
 680                 printf("SetUserInfo level %u - no session key - %s\n",
 681                        s.in.level, nt_errstr(status));
 682                 return false;
 683         }
 684
 685         arcfour_crypt_blob(u.info23.password.data, 516, &session_key);
 686
 687         torture_comment(tctx, "Testing SetUserInfo level 23 (set password)\n");
 688
 689         status = dcerpc_samr_SetUserInfo(p, tctx, &s);
 690         if (!NT_STATUS_IS_OK(status)) {
 691                 printf("SetUserInfo level %u failed - %s\n",
 692                        s.in.level, nt_errstr(status));
 693                 ret = false;
 694         } else {
 695                 *password = newpass;
 696         }
 697
 698         encode_pw_buffer(u.info23.password.data, newpass, STR_UNICODE);
 699
 700         status = dcerpc_fetch_session_key(p, &session_key);
 701         if (!NT_STATUS_IS_OK(status)) {
 702                 printf("SetUserInfo level %u - no session key - %s\n",
 703                        s.in.level, nt_errstr(status));
 704                 return false;
 705         }
 706
 707         /* This should break the key nicely */
 708         session_key.length--;
 709         arcfour_crypt_blob(u.info23.password.data, 516, &session_key);
 710
 711         torture_comment(tctx, "Testing SetUserInfo level 23 (set password) with wrong password\n");
 712
 713         status = dcerpc_samr_SetUserInfo(p, tctx, &s);
 714         if (!NT_STATUS_EQUAL(status, NT_STATUS_WRONG_PASSWORD)) {
 715                 printf("SetUserInfo level %u should have failed with WRONG_PASSWORD- %s\n",
 716                        s.in.level, nt_errstr(status));
 717                 ret = false;
 718         }
 719
 720         return ret;
 721 }
 722
 723
 724 static bool test_SetUserPassEx(struct dcerpc_pipe *p, struct torture_context *tctx,
 725                                struct policy_handle *handle, bool makeshort,
 726                                char **password)
 727 {
 728         NTSTATUS status;
 729         struct samr_SetUserInfo s;
 730         union samr_UserInfo u;
 731         bool ret = true;
 732         DATA_BLOB session_key;
 733         DATA_BLOB confounded_session_key = data_blob_talloc(tctx, NULL, 16);
 734         uint8_t confounder[16];
 735         char *newpass;
 736         struct MD5Context ctx;
 737         struct samr_GetUserPwInfo pwp;
 738         struct samr_PwInfo info;
 739         int policy_min_pw_len = 0;
 740         pwp.in.user_handle = handle;
 741         pwp.out.info = &info;
 742
 743         status = dcerpc_samr_GetUserPwInfo(p, tctx, &pwp);
 744         if (NT_STATUS_IS_OK(status)) {
 745                 policy_min_pw_len = pwp.out.info->min_password_length;
 746         }
 747         if (makeshort && policy_min_pw_len) {
 748                 newpass = samr_rand_pass_fixed_len(tctx, policy_min_pw_len - 1);
 749         } else {
 750                 newpass = samr_rand_pass(tctx, policy_min_pw_len);
 751         }
 752
 753         s.in.user_handle = handle;
 754         s.in.info = &u;
 755         s.in.level = 26;
 756
 757         encode_pw_buffer(u.info26.password.data, newpass, STR_UNICODE);
 758         u.info26.password_expired = 0;
 759
 760         status = dcerpc_fetch_session_key(p, &session_key);
 761         if (!NT_STATUS_IS_OK(status)) {
 762                 printf("SetUserInfo level %u - no session key - %s\n",
 763                        s.in.level, nt_errstr(status));
 764                 return false;
 765         }
 766
 767         generate_random_buffer((uint8_t *)confounder, 16);
 768
 769         MD5Init(&ctx);
 770         MD5Update(&ctx, confounder, 16);
 771         MD5Update(&ctx, session_key.data, session_key.length);
 772         MD5Final(confounded_session_key.data, &ctx);
 773
 774         arcfour_crypt_blob(u.info26.password.data, 516, &confounded_session_key);
 775         memcpy(&u.info26.password.data[516], confounder, 16);
 776
 777         torture_comment(tctx, "Testing SetUserInfo level 26 (set password ex)\n");
 778
 779         status = dcerpc_samr_SetUserInfo(p, tctx, &s);
 780         if (!NT_STATUS_IS_OK(status)) {
 781                 printf("SetUserInfo level %u failed - %s\n",
 782                        s.in.level, nt_errstr(status));
 783                 ret = false;
 784         } else {
 785                 *password = newpass;
 786         }
 787
 788         /* This should break the key nicely */
 789         confounded_session_key.data[0]++;
 790
 791         arcfour_crypt_blob(u.info26.password.data, 516, &confounded_session_key);
 792         memcpy(&u.info26.password.data[516], confounder, 16);
 793
 794         torture_comment(tctx, "Testing SetUserInfo level 26 (set password ex) with wrong session key\n");
 795
 796         status = dcerpc_samr_SetUserInfo(p, tctx, &s);
 797         if (!NT_STATUS_EQUAL(status, NT_STATUS_WRONG_PASSWORD)) {
 798                 printf("SetUserInfo level %u should have failed with WRONG_PASSWORD: %s\n",
 799                        s.in.level, nt_errstr(status));
 800                 ret = false;
 801         } else {
 802                 *password = newpass;
 803         }
 804
 805         return ret;
 806 }
 807
 808 static bool test_SetUserPass_25(struct dcerpc_pipe *p, struct torture_context *tctx,
 809                                 struct policy_handle *handle, uint32_t fields_present,
 810                                 char **password)
 811 {
 812         NTSTATUS status;
 813         struct samr_SetUserInfo s;
 814         union samr_UserInfo u;
 815         bool ret = true;
 816         DATA_BLOB session_key;
 817         DATA_BLOB confounded_session_key = data_blob_talloc(tctx, NULL, 16);
 818         struct MD5Context ctx;
 819         uint8_t confounder[16];
 820         char *newpass;
 821         struct samr_GetUserPwInfo pwp;
 822         struct samr_PwInfo info;
 823         int policy_min_pw_len = 0;
 824         pwp.in.user_handle = handle;
 825         pwp.out.info = &info;
 826
 827         status = dcerpc_samr_GetUserPwInfo(p, tctx, &pwp);
 828         if (NT_STATUS_IS_OK(status)) {
 829                 policy_min_pw_len = pwp.out.info->min_password_length;
 830         }
 831         newpass = samr_rand_pass(tctx, policy_min_pw_len);
 832
 833         s.in.user_handle = handle;
 834         s.in.info = &u;
 835         s.in.level = 25;
 836
 837         ZERO_STRUCT(u);
 838
 839         u.info25.info.fields_present = fields_present;
 840
 841         encode_pw_buffer(u.info25.password.data, newpass, STR_UNICODE);
 842
 843         status = dcerpc_fetch_session_key(p, &session_key);
 844         if (!NT_STATUS_IS_OK(status)) {
 845                 printf("SetUserInfo level %u - no session key - %s\n",
 846                        s.in.level, nt_errstr(status));
 847                 return false;
 848         }
 849
 850         generate_random_buffer((uint8_t *)confounder, 16);
 851
 852         MD5Init(&ctx);
 853         MD5Update(&ctx, confounder, 16);
 854         MD5Update(&ctx, session_key.data, session_key.length);
 855         MD5Final(confounded_session_key.data, &ctx);
 856
 857         arcfour_crypt_blob(u.info25.password.data, 516, &confounded_session_key);
 858         memcpy(&u.info25.password.data[516], confounder, 16);
 859
 860         torture_comment(tctx, "Testing SetUserInfo level 25 (set password ex)\n");
 861
 862         status = dcerpc_samr_SetUserInfo(p, tctx, &s);
 863         if (!NT_STATUS_IS_OK(status)) {
 864                 printf("SetUserInfo level %u failed - %s\n",
 865                        s.in.level, nt_errstr(status));
 866                 ret = false;
 867         } else {
 868                 *password = newpass;
 869         }
 870
 871         /* This should break the key nicely */
 872         confounded_session_key.data[0]++;
 873
 874         arcfour_crypt_blob(u.info25.password.data, 516, &confounded_session_key);
 875         memcpy(&u.info25.password.data[516], confounder, 16);
 876
 877         torture_comment(tctx, "Testing SetUserInfo level 25 (set password ex) with wrong session key\n");
 878
 879         status = dcerpc_samr_SetUserInfo(p, tctx, &s);
 880         if (!NT_STATUS_EQUAL(status, NT_STATUS_WRONG_PASSWORD)) {
 881                 printf("SetUserInfo level %u should have failed with WRONG_PASSWORD- %s\n",
 882                        s.in.level, nt_errstr(status));
 883                 ret = false;
 884         }
 885
 886         return ret;
 887 }
 888
 889 static bool test_SetUserPass_18(struct dcerpc_pipe *p, struct torture_context *tctx,
 890                                 struct policy_handle *handle, char **password)
 891 {
 892         NTSTATUS status;
 893         struct samr_SetUserInfo s;
 894         union samr_UserInfo u;
 895         bool ret = true;
 896         DATA_BLOB session_key;
 897         char *newpass;
 898         struct samr_GetUserPwInfo pwp;
 899         struct samr_PwInfo info;
 900         int policy_min_pw_len = 0;
 901         uint8_t lm_hash[16], nt_hash[16];
 902
 903         pwp.in.user_handle = handle;
 904         pwp.out.info = &info;
 905
 906         status = dcerpc_samr_GetUserPwInfo(p, tctx, &pwp);
 907         if (NT_STATUS_IS_OK(status)) {
 908                 policy_min_pw_len = pwp.out.info->min_password_length;
 909         }
 910         newpass = samr_rand_pass(tctx, policy_min_pw_len);
 911
 912         s.in.user_handle = handle;
 913         s.in.info = &u;
 914         s.in.level = 18;
 915
 916         ZERO_STRUCT(u);
 917
 918         u.info18.nt_pwd_active = true;
 919         u.info18.lm_pwd_active = true;
 920
 921         E_md4hash(newpass, nt_hash);
 922         E_deshash(newpass, lm_hash);
 923
 924         status = dcerpc_fetch_session_key(p, &session_key);
 925         if (!NT_STATUS_IS_OK(status)) {
 926                 printf("SetUserInfo level %u - no session key - %s\n",
 927                        s.in.level, nt_errstr(status));
 928                 return false;
 929         }
 930
 931         {
 932                 DATA_BLOB in,out;
 933                 in = data_blob_const(nt_hash, 16);
 934                 out = data_blob_talloc_zero(tctx, 16);
 935                 sess_crypt_blob(&out, &in, &session_key, true);
 936                 memcpy(u.info18.nt_pwd.hash, out.data, out.length);
 937         }
 938         {
 939                 DATA_BLOB in,out;
 940                 in = data_blob_const(lm_hash, 16);
 941                 out = data_blob_talloc_zero(tctx, 16);
 942                 sess_crypt_blob(&out, &in, &session_key, true);
 943                 memcpy(u.info18.lm_pwd.hash, out.data, out.length);
 944         }
 945
 946         torture_comment(tctx, "Testing SetUserInfo level 18 (set password hash)\n");
 947
 948         status = dcerpc_samr_SetUserInfo(p, tctx, &s);
 949         if (!NT_STATUS_IS_OK(status)) {
 950                 printf("SetUserInfo level %u failed - %s\n",
 951                        s.in.level, nt_errstr(status));
 952                 ret = false;
 953         } else {
 954                 *password = newpass;
 955         }
 956
 957         return ret;
 958 }
 959
 960 static bool test_SetUserPass_21(struct dcerpc_pipe *p, struct torture_context *tctx,
 961                                 struct policy_handle *handle, uint32_t fields_present,
 962                                 char **password)
 963 {
 964         NTSTATUS status;
 965         struct samr_SetUserInfo s;
 966         union samr_UserInfo u;
 967         bool ret = true;
 968         DATA_BLOB session_key;
 969         char *newpass;
 970         struct samr_GetUserPwInfo pwp;
 971         struct samr_PwInfo info;
 972         int policy_min_pw_len = 0;
 973         uint8_t lm_hash[16], nt_hash[16];
 974
 975         pwp.in.user_handle = handle;
 976         pwp.out.info = &info;
 977
 978         status = dcerpc_samr_GetUserPwInfo(p, tctx, &pwp);
 979         if (NT_STATUS_IS_OK(status)) {
 980                 policy_min_pw_len = pwp.out.info->min_password_length;
 981         }
 982         newpass = samr_rand_pass(tctx, policy_min_pw_len);
 983
 984         s.in.user_handle = handle;
 985         s.in.info = &u;
 986         s.in.level = 21;
 987
 988         E_md4hash(newpass, nt_hash);
 989         E_deshash(newpass, lm_hash);
 990
 991         ZERO_STRUCT(u);
 992
 993         u.info21.fields_present = fields_present;
 994
 995         if (fields_present & SAMR_FIELD_LM_PASSWORD_PRESENT) {
 996                 u.info21.lm_owf_password.length = 16;
 997                 u.info21.lm_owf_password.size = 16;
 998                 u.info21.lm_owf_password.array = (uint16_t *)lm_hash;
 999                 u.info21.lm_password_set = true;
1000         }
1001
1002         if (fields_present & SAMR_FIELD_NT_PASSWORD_PRESENT) {
1003                 u.info21.nt_owf_password.length = 16;
1004                 u.info21.nt_owf_password.size = 16;
1005                 u.info21.nt_owf_password.array = (uint16_t *)nt_hash;
1006                 u.info21.nt_password_set = true;
1007         }
1008
1009         status = dcerpc_fetch_session_key(p, &session_key);
1010         if (!NT_STATUS_IS_OK(status)) {
1011                 printf("SetUserInfo level %u - no session key - %s\n",
1012                        s.in.level, nt_errstr(status));
1013                 return false;
1014         }
1015
1016         if (fields_present & SAMR_FIELD_LM_PASSWORD_PRESENT) {
1017                 DATA_BLOB in,out;
1018                 in = data_blob_const(u.info21.lm_owf_password.array,
1019                                      u.info21.lm_owf_password.length);
1020                 out = data_blob_talloc_zero(tctx, 16);
1021                 sess_crypt_blob(&out, &in, &session_key, true);
1022                 u.info21.lm_owf_password.array = (uint16_t *)out.data;
1023         }
1024
1025         if (fields_present & SAMR_FIELD_NT_PASSWORD_PRESENT) {
1026                 DATA_BLOB in,out;
1027                 in = data_blob_const(u.info21.nt_owf_password.array,
1028                                      u.info21.nt_owf_password.length);
1029                 out = data_blob_talloc_zero(tctx, 16);
1030                 sess_crypt_blob(&out, &in, &session_key, true);
1031                 u.info21.nt_owf_password.array = (uint16_t *)out.data;
1032         }
1033
1034         torture_comment(tctx, "Testing SetUserInfo level 21 (set password hash)\n");
1035
1036         status = dcerpc_samr_SetUserInfo(p, tctx, &s);
1037         if (!NT_STATUS_IS_OK(status)) {
1038                 printf("SetUserInfo level %u failed - %s\n",
1039                        s.in.level, nt_errstr(status));
1040                 ret = false;
1041         } else {
1042                 *password = newpass;
1043         }
1044
1045         /* try invalid length */
1046         if (fields_present & SAMR_FIELD_NT_PASSWORD_PRESENT) {
1047
1048                 u.info21.nt_owf_password.length++;
1049
1050                 status = dcerpc_samr_SetUserInfo(p, tctx, &s);
1051
1052                 if (!NT_STATUS_EQUAL(status, NT_STATUS_INVALID_PARAMETER)) {
1053                         printf("SetUserInfo level %u should have failed with NT_STATUS_INVALID_PARAMETER - %s\n",
1054                                s.in.level, nt_errstr(status));
1055                         ret = false;
1056                 }
1057         }
1058
1059         if (fields_present & SAMR_FIELD_LM_PASSWORD_PRESENT) {
1060
1061                 u.info21.lm_owf_password.length++;
1062
1063                 status = dcerpc_samr_SetUserInfo(p, tctx, &s);
1064
1065                 if (!NT_STATUS_EQUAL(status, NT_STATUS_INVALID_PARAMETER)) {
1066                         printf("SetUserInfo level %u should have failed with NT_STATUS_INVALID_PARAMETER - %s\n",
1067                                s.in.level, nt_errstr(status));
1068                         ret = false;
1069                 }
1070         }
1071
1072         return ret;
1073 }
1074
1075 static bool test_SetUserPass_level_ex(struct dcerpc_pipe *p,
1076                                       struct torture_context *tctx,
1077                                       struct policy_handle *handle,
1078                                       uint16_t level,
1079                                       uint32_t fields_present,
1080                                       char **password, uint8_t password_expired,
1081                                       bool use_setinfo2,
1082                                       bool *matched_expected_error)
1083 {
1084         NTSTATUS status;
1085         NTSTATUS expected_error = NT_STATUS_OK;
1086         struct samr_SetUserInfo s;
1087         struct samr_SetUserInfo2 s2;
1088         union samr_UserInfo u;
1089         bool ret = true;
1090         DATA_BLOB session_key;
1091         DATA_BLOB confounded_session_key = data_blob_talloc(tctx, NULL, 16);
1092         struct MD5Context ctx;
1093         uint8_t confounder[16];
1094         char *newpass;
1095         struct samr_GetUserPwInfo pwp;
1096         struct samr_PwInfo info;
1097         int policy_min_pw_len = 0;
1098         const char *comment = NULL;
1099         uint8_t lm_hash[16], nt_hash[16];
1100
1101         pwp.in.user_handle = handle;
1102         pwp.out.info = &info;
1103
1104         status = dcerpc_samr_GetUserPwInfo(p, tctx, &pwp);
1105         if (NT_STATUS_IS_OK(status)) {
1106                 policy_min_pw_len = pwp.out.info->min_password_length;
1107         }
1108         newpass = samr_rand_pass_silent(tctx, policy_min_pw_len);
1109
1110         if (use_setinfo2) {
1111                 s2.in.user_handle = handle;
1112                 s2.in.info = &u;
1113                 s2.in.level = level;
1114         } else {
1115                 s.in.user_handle = handle;
1116                 s.in.info = &u;
1117                 s.in.level = level;
1118         }
1119
1120         if (fields_present & SAMR_FIELD_COMMENT) {
1121                 comment = talloc_asprintf(tctx, "comment: %ld\n", time(NULL));
1122         }
1123
1124         ZERO_STRUCT(u);
1125
1126         switch (level) {
1127         case 18:
1128                 E_md4hash(newpass, nt_hash);
1129                 E_deshash(newpass, lm_hash);
1130
1131                 u.info18.nt_pwd_active = true;
1132                 u.info18.lm_pwd_active = true;
1133                 u.info18.password_expired = password_expired;
1134
1135                 memcpy(u.info18.lm_pwd.hash, lm_hash, 16);
1136                 memcpy(u.info18.nt_pwd.hash, nt_hash, 16);
1137
1138                 break;
1139         case 21:
1140                 E_md4hash(newpass, nt_hash);
1141                 E_deshash(newpass, lm_hash);
1142
1143                 u.info21.fields_present = fields_present;
1144                 u.info21.password_expired = password_expired;
1145                 u.info21.comment.string = comment;
1146
1147                 if (fields_present & SAMR_FIELD_LM_PASSWORD_PRESENT) {
1148                         u.info21.lm_owf_password.length = 16;
1149                         u.info21.lm_owf_password.size = 16;
1150                         u.info21.lm_owf_password.array = (uint16_t *)lm_hash;
1151                         u.info21.lm_password_set = true;
1152                 }
1153
1154                 if (fields_present & SAMR_FIELD_NT_PASSWORD_PRESENT) {
1155                         u.info21.nt_owf_password.length = 16;
1156                         u.info21.nt_owf_password.size = 16;
1157                         u.info21.nt_owf_password.array = (uint16_t *)nt_hash;
1158                         u.info21.nt_password_set = true;
1159                 }
1160
1161                 break;
1162         case 23:
1163                 u.info23.info.fields_present = fields_present;
1164                 u.info23.info.password_expired = password_expired;
1165                 u.info23.info.comment.string = comment;
1166
1167                 encode_pw_buffer(u.info23.password.data, newpass, STR_UNICODE);
1168
1169                 break;
1170         case 24:
1171                 u.info24.password_expired = password_expired;
1172
1173                 encode_pw_buffer(u.info24.password.data, newpass, STR_UNICODE);
1174
1175                 break;
1176         case 25:
1177                 u.info25.info.fields_present = fields_present;
1178                 u.info25.info.password_expired = password_expired;
1179                 u.info25.info.comment.string = comment;
1180
1181                 encode_pw_buffer(u.info25.password.data, newpass, STR_UNICODE);
1182
1183                 break;
1184         case 26:
1185                 u.info26.password_expired = password_expired;
1186
1187                 encode_pw_buffer(u.info26.password.data, newpass, STR_UNICODE);
1188
1189                 break;
1190         }
1191
1192         status = dcerpc_fetch_session_key(p, &session_key);
1193         if (!NT_STATUS_IS_OK(status)) {
1194                 printf("SetUserInfo level %u - no session key - %s\n",
1195                        s.in.level, nt_errstr(status));
1196                 return false;
1197         }
1198
1199         generate_random_buffer((uint8_t *)confounder, 16);
1200
1201         MD5Init(&ctx);
1202         MD5Update(&ctx, confounder, 16);
1203         MD5Update(&ctx, session_key.data, session_key.length);
1204         MD5Final(confounded_session_key.data, &ctx);
1205
1206         switch (level) {
1207         case 18:
1208                 {
1209                         DATA_BLOB in,out;
1210                         in = data_blob_const(u.info18.nt_pwd.hash, 16);
1211                         out = data_blob_talloc_zero(tctx, 16);
1212                         sess_crypt_blob(&out, &in, &session_key, true);
1213                         memcpy(u.info18.nt_pwd.hash, out.data, out.length);
1214                 }
1215                 {
1216                         DATA_BLOB in,out;
1217                         in = data_blob_const(u.info18.lm_pwd.hash, 16);
1218                         out = data_blob_talloc_zero(tctx, 16);
1219                         sess_crypt_blob(&out, &in, &session_key, true);
1220                         memcpy(u.info18.lm_pwd.hash, out.data, out.length);
1221                 }
1222
1223                 break;
1224         case 21:
1225                 if (fields_present & SAMR_FIELD_LM_PASSWORD_PRESENT) {
1226                         DATA_BLOB in,out;
1227                         in = data_blob_const(u.info21.lm_owf_password.array,
1228                                              u.info21.lm_owf_password.length);
1229                         out = data_blob_talloc_zero(tctx, 16);
1230                         sess_crypt_blob(&out, &in, &session_key, true);
1231                         u.info21.lm_owf_password.array = (uint16_t *)out.data;
1232                 }
1233                 if (fields_present & SAMR_FIELD_NT_PASSWORD_PRESENT) {
1234                         DATA_BLOB in,out;
1235                         in = data_blob_const(u.info21.nt_owf_password.array,
1236                                              u.info21.nt_owf_password.length);
1237                         out = data_blob_talloc_zero(tctx, 16);
1238                         sess_crypt_blob(&out, &in, &session_key, true);
1239                         u.info21.nt_owf_password.array = (uint16_t *)out.data;
1240                 }
1241                 break;
1242         case 23:
1243                 arcfour_crypt_blob(u.info23.password.data, 516, &session_key);
1244                 break;
1245         case 24:
1246                 arcfour_crypt_blob(u.info24.password.data, 516, &session_key);
1247                 break;
1248         case 25:
1249                 arcfour_crypt_blob(u.info25.password.data, 516, &confounded_session_key);
1250                 memcpy(&u.info25.password.data[516], confounder, 16);
1251                 break;
1252         case 26:
1253                 arcfour_crypt_blob(u.info26.password.data, 516, &confounded_session_key);
1254                 memcpy(&u.info26.password.data[516], confounder, 16);
1255                 break;
1256         }
1257
1258         if (use_setinfo2) {
1259                 status = dcerpc_samr_SetUserInfo2(p, tctx, &s2);
1260         } else {
1261                 status = dcerpc_samr_SetUserInfo(p, tctx, &s);
1262         }
1263
1264         if (!NT_STATUS_IS_OK(status)) {
1265                 if (fields_present == 0) {
1266                         expected_error = NT_STATUS_INVALID_PARAMETER;
1267                 }
1268                 if (fields_present & SAMR_FIELD_LAST_PWD_CHANGE) {
1269                         expected_error = NT_STATUS_ACCESS_DENIED;
1270                 }
1271         }
1272
1273         if (!NT_STATUS_IS_OK(expected_error)) {
1274                 if (use_setinfo2) {
1275                         torture_assert_ntstatus_equal(tctx,
1276                                 s2.out.result,
1277                                 expected_error, "SetUserInfo2 failed");
1278                 } else {
1279                         torture_assert_ntstatus_equal(tctx,
1280                                 s.out.result,
1281                                 expected_error, "SetUserInfo failed");
1282                 }
1283                 *matched_expected_error = true;
1284                 return true;
1285         }
1286
1287         if (!NT_STATUS_IS_OK(status)) {
1288                 printf("SetUserInfo%s level %u failed - %s\n",
1289                        use_setinfo2 ? "2":"", level, nt_errstr(status));
1290                 ret = false;
1291         } else {
1292                 *password = newpass;
1293         }
1294
1295         return ret;
1296 }
1297
1298 static bool test_SetAliasInfo(struct dcerpc_pipe *p, struct torture_context *tctx,
1299                                struct policy_handle *handle)
1300 {
1301         NTSTATUS status;
1302         struct samr_SetAliasInfo r;
1303         struct samr_QueryAliasInfo q;
1304         union samr_AliasInfo *info;
1305         uint16_t levels[] = {2, 3};
1306         int i;
1307         bool ret = true;
1308
1309         /* Ignoring switch level 1, as that includes the number of members for the alias
1310          * and setting this to a wrong value might have negative consequences
1311          */
1312
1313         for (i=0;i<ARRAY_SIZE(levels);i++) {
1314                 torture_comment(tctx, "Testing SetAliasInfo level %u\n", levels[i]);
1315
1316                 r.in.alias_handle = handle;
1317                 r.in.level = levels[i];
1318                 r.in.info  = talloc(tctx, union samr_AliasInfo);
1319                 switch (r.in.level) {
1320                     case ALIASINFONAME: init_lsa_String(&r.in.info->name,TEST_ALIASNAME); break;
1321                     case ALIASINFODESCRIPTION: init_lsa_String(&r.in.info->description,
1322                                 "Test Description, should test I18N as well"); break;
1323                     case ALIASINFOALL: printf("ALIASINFOALL ignored\n"); break;
1324                 }
1325
1326                 status = dcerpc_samr_SetAliasInfo(p, tctx, &r);
1327                 if (!NT_STATUS_IS_OK(status)) {
1328                         printf("SetAliasInfo level %u failed - %s\n",
1329                                levels[i], nt_errstr(status));
1330                         ret = false;
1331                 }
1332
1333                 q.in.alias_handle = handle;
1334                 q.in.level = levels[i];
1335                 q.out.info = &info;
1336
1337                 status = dcerpc_samr_QueryAliasInfo(p, tctx, &q);
1338                 if (!NT_STATUS_IS_OK(status)) {
1339                         printf("QueryAliasInfo level %u failed - %s\n",
1340                                levels[i], nt_errstr(status));
1341                         ret = false;
1342                 }
1343         }
1344
1345         return ret;
1346 }
1347
1348 static bool test_GetGroupsForUser(struct dcerpc_pipe *p, struct torture_context *tctx,
1349                                   struct policy_handle *user_handle)
1350 {
1351         struct samr_GetGroupsForUser r;
1352         struct samr_RidWithAttributeArray *rids = NULL;
1353         NTSTATUS status;
1354
1355         torture_comment(tctx, "testing GetGroupsForUser\n");
1356
1357         r.in.user_handle = user_handle;
1358         r.out.rids = &rids;
1359
1360         status = dcerpc_samr_GetGroupsForUser(p, tctx, &r);
1361         torture_assert_ntstatus_ok(tctx, status, "GetGroupsForUser");
1362
1363         return true;
1364
1365 }
1366
1367 static bool test_GetDomPwInfo(struct dcerpc_pipe *p, struct torture_context *tctx,
1368                               struct lsa_String *domain_name)
1369 {
1370         NTSTATUS status;
1371         struct samr_GetDomPwInfo r;
1372         struct samr_PwInfo info;
1373
1374         r.in.domain_name = domain_name;
1375         r.out.info = &info;
1376
1377         torture_comment(tctx, "Testing GetDomPwInfo with name %s\n", r.in.domain_name->string);
1378
1379         status = dcerpc_samr_GetDomPwInfo(p, tctx, &r);
1380         torture_assert_ntstatus_ok(tctx, status, "GetDomPwInfo");
1381
1382         r.in.domain_name->string = talloc_asprintf(tctx, "\\\\%s", dcerpc_server_name(p));
1383         torture_comment(tctx, "Testing GetDomPwInfo with name %s\n", r.in.domain_name->string);
1384
1385         status = dcerpc_samr_GetDomPwInfo(p, tctx, &r);
1386         torture_assert_ntstatus_ok(tctx, status, "GetDomPwInfo");
1387
1388         r.in.domain_name->string = "\\\\__NONAME__";
1389         torture_comment(tctx, "Testing GetDomPwInfo with name %s\n", r.in.domain_name->string);
1390
1391         status = dcerpc_samr_GetDomPwInfo(p, tctx, &r);
1392         torture_assert_ntstatus_ok(tctx, status, "GetDomPwInfo");
1393
1394         r.in.domain_name->string = "\\\\Builtin";
1395         torture_comment(tctx, "Testing GetDomPwInfo with name %s\n", r.in.domain_name->string);
1396
1397         status = dcerpc_samr_GetDomPwInfo(p, tctx, &r);
1398         torture_assert_ntstatus_ok(tctx, status, "GetDomPwInfo");
1399
1400         return true;
1401 }
1402
1403 static bool test_GetUserPwInfo(struct dcerpc_pipe *p, struct torture_context *tctx,
1404                                struct policy_handle *handle)
1405 {
1406         NTSTATUS status;
1407         struct samr_GetUserPwInfo r;
1408         struct samr_PwInfo info;
1409
1410         torture_comment(tctx, "Testing GetUserPwInfo\n");
1411
1412         r.in.user_handle = handle;
1413         r.out.info = &info;
1414
1415         status = dcerpc_samr_GetUserPwInfo(p, tctx, &r);
1416         torture_assert_ntstatus_ok(tctx, status, "GetUserPwInfo");
1417
1418         return true;
1419 }
1420
1421 static NTSTATUS test_LookupName(struct dcerpc_pipe *p, struct torture_context *tctx,
1422                                 struct policy_handle *domain_handle, const char *name,
1423                                 uint32_t *rid)
1424 {
1425         NTSTATUS status;
1426         struct samr_LookupNames n;
1427         struct lsa_String sname[2];
1428         struct samr_Ids rids, types;
1429
1430         init_lsa_String(&sname[0], name);
1431
1432         n.in.domain_handle = domain_handle;
1433         n.in.num_names = 1;
1434         n.in.names = sname;
1435         n.out.rids = &rids;
1436         n.out.types = &types;
1437         status = dcerpc_samr_LookupNames(p, tctx, &n);
1438         if (NT_STATUS_IS_OK(status)) {
1439                 *rid = n.out.rids->ids[0];
1440         } else {
1441                 return status;
1442         }
1443
1444         init_lsa_String(&sname[1], "xxNONAMExx");
1445         n.in.num_names = 2;
1446         status = dcerpc_samr_LookupNames(p, tctx, &n);
1447         if (!NT_STATUS_EQUAL(status, STATUS_SOME_UNMAPPED)) {
1448                 printf("LookupNames[2] failed - %s\n", nt_errstr(status));
1449                 if (NT_STATUS_IS_OK(status)) {
1450                         return NT_STATUS_UNSUCCESSFUL;
1451                 }
1452                 return status;
1453         }
1454
1455         n.in.num_names = 0;
1456         status = dcerpc_samr_LookupNames(p, tctx, &n);
1457         if (!NT_STATUS_IS_OK(status)) {
1458                 printf("LookupNames[0] failed - %s\n", nt_errstr(status));
1459                 return status;
1460         }
1461
1462         init_lsa_String(&sname[0], "xxNONAMExx");
1463         n.in.num_names = 1;
1464         status = dcerpc_samr_LookupNames(p, tctx, &n);
1465         if (!NT_STATUS_EQUAL(status, NT_STATUS_NONE_MAPPED)) {
1466                 printf("LookupNames[1 bad name] failed - %s\n", nt_errstr(status));
1467                 if (NT_STATUS_IS_OK(status)) {
1468                         return NT_STATUS_UNSUCCESSFUL;
1469                 }
1470                 return status;
1471         }
1472
1473         init_lsa_String(&sname[0], "xxNONAMExx");
1474         init_lsa_String(&sname[1], "xxNONAME2xx");
1475         n.in.num_names = 2;
1476         status = dcerpc_samr_LookupNames(p, tctx, &n);
1477         if (!NT_STATUS_EQUAL(status, NT_STATUS_NONE_MAPPED)) {
1478                 printf("LookupNames[2 bad names] failed - %s\n", nt_errstr(status));
1479                 if (NT_STATUS_IS_OK(status)) {
1480                         return NT_STATUS_UNSUCCESSFUL;
1481                 }
1482                 return status;
1483         }
1484
1485         return NT_STATUS_OK;
1486 }
1487
1488 static NTSTATUS test_OpenUser_byname(struct dcerpc_pipe *p, TALLOC_CTX *mem_ctx,
1489                                      struct policy_handle *domain_handle,
1490                                      const char *name, struct policy_handle *user_handle)
1491 {
1492         NTSTATUS status;
1493         struct samr_OpenUser r;
1494         uint32_t rid;
1495
1496         status = test_LookupName(p, mem_ctx, domain_handle, name, &rid);
1497         if (!NT_STATUS_IS_OK(status)) {
1498                 return status;
1499         }
1500
1501         r.in.domain_handle = domain_handle;
1502         r.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
1503         r.in.rid = rid;
1504         r.out.user_handle = user_handle;
1505         status = dcerpc_samr_OpenUser(p, mem_ctx, &r);
1506         if (!NT_STATUS_IS_OK(status)) {
1507                 printf("OpenUser_byname(%s -> %d) failed - %s\n", name, rid, nt_errstr(status));
1508         }
1509
1510         return status;
1511 }
1512
1513 #if 0
1514 static bool test_ChangePasswordNT3(struct dcerpc_pipe *p, TALLOC_CTX *mem_ctx,
1515                                    struct policy_handle *handle)
1516 {
1517         NTSTATUS status;
1518         struct samr_ChangePasswordUser r;
1519         bool ret = true;
1520         struct samr_Password hash1, hash2, hash3, hash4, hash5, hash6;
1521         struct policy_handle user_handle;
1522         char *oldpass = "test";
1523         char *newpass = "test2";
1524         uint8_t old_nt_hash[16], new_nt_hash[16];
1525         uint8_t old_lm_hash[16], new_lm_hash[16];
1526
1527         status = test_OpenUser_byname(p, mem_ctx, handle, "testuser", &user_handle);
1528         if (!NT_STATUS_IS_OK(status)) {
1529                 return false;
1530         }
1531
1532         printf("Testing ChangePasswordUser for user 'testuser'\n");
1533
1534         printf("old password: %s\n", oldpass);
1535         printf("new password: %s\n", newpass);
1536
1537         E_md4hash(oldpass, old_nt_hash);
1538         E_md4hash(newpass, new_nt_hash);
1539         E_deshash(oldpass, old_lm_hash);
1540         E_deshash(newpass, new_lm_hash);
1541
1542         E_old_pw_hash(new_lm_hash, old_lm_hash, hash1.hash);
1543         E_old_pw_hash(old_lm_hash, new_lm_hash, hash2.hash);
1544         E_old_pw_hash(new_nt_hash, old_nt_hash, hash3.hash);
1545         E_old_pw_hash(old_nt_hash, new_nt_hash, hash4.hash);
1546         E_old_pw_hash(old_lm_hash, new_nt_hash, hash5.hash);
1547         E_old_pw_hash(old_nt_hash, new_lm_hash, hash6.hash);
1548
1549         r.in.handle = &user_handle;
1550         r.in.lm_present = 1;
1551         r.in.old_lm_crypted = &hash1;
1552         r.in.new_lm_crypted = &hash2;
1553         r.in.nt_present = 1;
1554         r.in.old_nt_crypted = &hash3;
1555         r.in.new_nt_crypted = &hash4;
1556         r.in.cross1_present = 1;
1557         r.in.nt_cross = &hash5;
1558         r.in.cross2_present = 1;
1559         r.in.lm_cross = &hash6;
1560
1561         status = dcerpc_samr_ChangePasswordUser(p, mem_ctx, &r);
1562         if (!NT_STATUS_IS_OK(status)) {
1563                 printf("ChangePasswordUser failed - %s\n", nt_errstr(status));
1564                 ret = false;
1565         }
1566
1567         if (!test_samr_handle_Close(p, mem_ctx, &user_handle)) {
1568                 ret = false;
1569         }
1570
1571         return ret;
1572 }
1573 #endif
1574
1575 static bool test_ChangePasswordUser(struct dcerpc_pipe *p, struct torture_context *tctx,
1576                                     const char *acct_name,
1577                                     struct policy_handle *handle, char **password)
1578 {
1579         NTSTATUS status;
1580         struct samr_ChangePasswordUser r;
1581         bool ret = true;
1582         struct samr_Password hash1, hash2, hash3, hash4, hash5, hash6;
1583         struct policy_handle user_handle;
1584         char *oldpass;
1585         uint8_t old_nt_hash[16], new_nt_hash[16];
1586         uint8_t old_lm_hash[16], new_lm_hash[16];
1587         bool changed = true;
1588
1589         char *newpass;
1590         struct samr_GetUserPwInfo pwp;
1591         struct samr_PwInfo info;
1592         int policy_min_pw_len = 0;
1593
1594         status = test_OpenUser_byname(p, tctx, handle, acct_name, &user_handle);
1595         if (!NT_STATUS_IS_OK(status)) {
1596                 return false;
1597         }
1598         pwp.in.user_handle = &user_handle;
1599         pwp.out.info = &info;
1600
1601         status = dcerpc_samr_GetUserPwInfo(p, tctx, &pwp);
1602         if (NT_STATUS_IS_OK(status)) {
1603                 policy_min_pw_len = pwp.out.info->min_password_length;
1604         }
1605         newpass = samr_rand_pass(tctx, policy_min_pw_len);
1606
1607         torture_comment(tctx, "Testing ChangePasswordUser\n");
1608
1609         torture_assert(tctx, *password != NULL,
1610                                    "Failing ChangePasswordUser as old password was NULL.  Previous test failed?");
1611
1612         oldpass = *password;
1613
1614         E_md4hash(oldpass, old_nt_hash);
1615         E_md4hash(newpass, new_nt_hash);
1616         E_deshash(oldpass, old_lm_hash);
1617         E_deshash(newpass, new_lm_hash);
1618
1619         E_old_pw_hash(new_lm_hash, old_lm_hash, hash1.hash);
1620         E_old_pw_hash(old_lm_hash, new_lm_hash, hash2.hash);
1621         E_old_pw_hash(new_nt_hash, old_nt_hash, hash3.hash);
1622         E_old_pw_hash(old_nt_hash, new_nt_hash, hash4.hash);
1623         E_old_pw_hash(old_lm_hash, new_nt_hash, hash5.hash);
1624         E_old_pw_hash(old_nt_hash, new_lm_hash, hash6.hash);
1625
1626         r.in.user_handle = &user_handle;
1627         r.in.lm_present = 1;
1628         /* Break the LM hash */
1629         hash1.hash[0]++;
1630         r.in.old_lm_crypted = &hash1;
1631         r.in.new_lm_crypted = &hash2;
1632         r.in.nt_present = 1;
1633         r.in.old_nt_crypted = &hash3;
1634         r.in.new_nt_crypted = &hash4;
1635         r.in.cross1_present = 1;
1636         r.in.nt_cross = &hash5;
1637         r.in.cross2_present = 1;
1638         r.in.lm_cross = &hash6;
1639
1640         status = dcerpc_samr_ChangePasswordUser(p, tctx, &r);
1641         torture_assert_ntstatus_equal(tctx, status, NT_STATUS_WRONG_PASSWORD,
1642                 "ChangePasswordUser failed: expected NT_STATUS_WRONG_PASSWORD because we broke the LM hash");
1643
1644         /* Unbreak the LM hash */
1645         hash1.hash[0]--;
1646
1647         r.in.user_handle = &user_handle;
1648         r.in.lm_present = 1;
1649         r.in.old_lm_crypted = &hash1;
1650         r.in.new_lm_crypted = &hash2;
1651         /* Break the NT hash */
1652         hash3.hash[0]--;
1653         r.in.nt_present = 1;
1654         r.in.old_nt_crypted = &hash3;
1655         r.in.new_nt_crypted = &hash4;
1656         r.in.cross1_present = 1;
1657         r.in.nt_cross = &hash5;
1658         r.in.cross2_present = 1;
1659         r.in.lm_cross = &hash6;
1660
1661         status = dcerpc_samr_ChangePasswordUser(p, tctx, &r);
1662         torture_assert_ntstatus_equal(tctx, status, NT_STATUS_WRONG_PASSWORD,
1663                 "expected NT_STATUS_WRONG_PASSWORD because we broke the NT hash");
1664
1665         /* Unbreak the NT hash */
1666         hash3.hash[0]--;
1667
1668         r.in.user_handle = &user_handle;
1669         r.in.lm_present = 1;
1670         r.in.old_lm_crypted = &hash1;
1671         r.in.new_lm_crypted = &hash2;
1672         r.in.nt_present = 1;
1673         r.in.old_nt_crypted = &hash3;
1674         r.in.new_nt_crypted = &hash4;
1675         r.in.cross1_present = 1;
1676         r.in.nt_cross = &hash5;
1677         r.in.cross2_present = 1;
1678         /* Break the LM cross */
1679         hash6.hash[0]++;
1680         r.in.lm_cross = &hash6;
1681
1682         status = dcerpc_samr_ChangePasswordUser(p, tctx, &r);
1683         if (!NT_STATUS_EQUAL(status, NT_STATUS_WRONG_PASSWORD)) {
1684                 printf("ChangePasswordUser failed: expected NT_STATUS_WRONG_PASSWORD because we broke the LM cross-hash, got %s\n", nt_errstr(status));
1685                 ret = false;
1686         }
1687
1688         /* Unbreak the LM cross */
1689         hash6.hash[0]--;
1690
1691         r.in.user_handle = &user_handle;
1692         r.in.lm_present = 1;
1693         r.in.old_lm_crypted = &hash1;
1694         r.in.new_lm_crypted = &hash2;
1695         r.in.nt_present = 1;
1696         r.in.old_nt_crypted = &hash3;
1697         r.in.new_nt_crypted = &hash4;
1698         r.in.cross1_present = 1;
1699         /* Break the NT cross */
1700         hash5.hash[0]++;
1701         r.in.nt_cross = &hash5;
1702         r.in.cross2_present = 1;
1703         r.in.lm_cross = &hash6;
1704
1705         status = dcerpc_samr_ChangePasswordUser(p, tctx, &r);
1706         if (!NT_STATUS_EQUAL(status, NT_STATUS_WRONG_PASSWORD)) {
1707                 printf("ChangePasswordUser failed: expected NT_STATUS_WRONG_PASSWORD because we broke the NT cross-hash, got %s\n", nt_errstr(status));
1708                 ret = false;
1709         }
1710
1711         /* Unbreak the NT cross */
1712         hash5.hash[0]--;
1713
1714
1715         /* Reset the hashes to not broken values */
1716         E_old_pw_hash(new_lm_hash, old_lm_hash, hash1.hash);
1717         E_old_pw_hash(old_lm_hash, new_lm_hash, hash2.hash);
1718         E_old_pw_hash(new_nt_hash, old_nt_hash, hash3.hash);
1719         E_old_pw_hash(old_nt_hash, new_nt_hash, hash4.hash);
1720         E_old_pw_hash(old_lm_hash, new_nt_hash, hash5.hash);
1721         E_old_pw_hash(old_nt_hash, new_lm_hash, hash6.hash);
1722
1723         r.in.user_handle = &user_handle;
1724         r.in.lm_present = 1;
1725         r.in.old_lm_crypted = &hash1;
1726         r.in.new_lm_crypted = &hash2;
1727         r.in.nt_present = 1;
1728         r.in.old_nt_crypted = &hash3;
1729         r.in.new_nt_crypted = &hash4;
1730         r.in.cross1_present = 1;
1731         r.in.nt_cross = &hash5;
1732         r.in.cross2_present = 0;
1733         r.in.lm_cross = NULL;
1734
1735         status = dcerpc_samr_ChangePasswordUser(p, tctx, &r);
1736         if (NT_STATUS_IS_OK(status)) {
1737                 changed = true;
1738                 *password = newpass;
1739         } else if (!NT_STATUS_EQUAL(NT_STATUS_PASSWORD_RESTRICTION, status)) {
1740                 printf("ChangePasswordUser failed: expected NT_STATUS_OK, or at least NT_STATUS_PASSWORD_RESTRICTION, got %s\n", nt_errstr(status));
1741                 ret = false;
1742         }
1743
1744         oldpass = newpass;
1745         newpass = samr_rand_pass(tctx, policy_min_pw_len);
1746
1747         E_md4hash(oldpass, old_nt_hash);
1748         E_md4hash(newpass, new_nt_hash);
1749         E_deshash(oldpass, old_lm_hash);
1750         E_deshash(newpass, new_lm_hash);
1751
1752
1753         /* Reset the hashes to not broken values */
1754         E_old_pw_hash(new_lm_hash, old_lm_hash, hash1.hash);
1755         E_old_pw_hash(old_lm_hash, new_lm_hash, hash2.hash);
1756         E_old_pw_hash(new_nt_hash, old_nt_hash, hash3.hash);
1757         E_old_pw_hash(old_nt_hash, new_nt_hash, hash4.hash);
1758         E_old_pw_hash(old_lm_hash, new_nt_hash, hash5.hash);
1759         E_old_pw_hash(old_nt_hash, new_lm_hash, hash6.hash);
1760
1761         r.in.user_handle = &user_handle;
1762         r.in.lm_present = 1;
1763         r.in.old_lm_crypted = &hash1;
1764         r.in.new_lm_crypted = &hash2;
1765         r.in.nt_present = 1;
1766         r.in.old_nt_crypted = &hash3;
1767         r.in.new_nt_crypted = &hash4;
1768         r.in.cross1_present = 0;
1769         r.in.nt_cross = NULL;
1770         r.in.cross2_present = 1;
1771         r.in.lm_cross = &hash6;
1772
1773         status = dcerpc_samr_ChangePasswordUser(p, tctx, &r);
1774         if (NT_STATUS_IS_OK(status)) {
1775                 changed = true;
1776                 *password = newpass;
1777         } else if (!NT_STATUS_EQUAL(NT_STATUS_PASSWORD_RESTRICTION, status)) {
1778                 printf("ChangePasswordUser failed: expected NT_STATUS_NT_CROSS_ENCRYPTION_REQUIRED, got %s\n", nt_errstr(status));
1779                 ret = false;
1780         }
1781
1782         oldpass = newpass;
1783         newpass = samr_rand_pass(tctx, policy_min_pw_len);
1784
1785         E_md4hash(oldpass, old_nt_hash);
1786         E_md4hash(newpass, new_nt_hash);
1787         E_deshash(oldpass, old_lm_hash);
1788         E_deshash(newpass, new_lm_hash);
1789
1790
1791         /* Reset the hashes to not broken values */
1792         E_old_pw_hash(new_lm_hash, old_lm_hash, hash1.hash);
1793         E_old_pw_hash(old_lm_hash, new_lm_hash, hash2.hash);
1794         E_old_pw_hash(new_nt_hash, old_nt_hash, hash3.hash);
1795         E_old_pw_hash(old_nt_hash, new_nt_hash, hash4.hash);
1796         E_old_pw_hash(old_lm_hash, new_nt_hash, hash5.hash);
1797         E_old_pw_hash(old_nt_hash, new_lm_hash, hash6.hash);
1798
1799         r.in.user_handle = &user_handle;
1800         r.in.lm_present = 1;
1801         r.in.old_lm_crypted = &hash1;
1802         r.in.new_lm_crypted = &hash2;
1803         r.in.nt_present = 1;
1804         r.in.old_nt_crypted = &hash3;
1805         r.in.new_nt_crypted = &hash4;
1806         r.in.cross1_present = 1;
1807         r.in.nt_cross = &hash5;
1808         r.in.cross2_present = 1;
1809         r.in.lm_cross = &hash6;
1810
1811         status = dcerpc_samr_ChangePasswordUser(p, tctx, &r);
1812         if (NT_STATUS_EQUAL(status, NT_STATUS_PASSWORD_RESTRICTION)) {
1813                 printf("ChangePasswordUser returned: %s perhaps min password age? (not fatal)\n", nt_errstr(status));
1814         } else  if (!NT_STATUS_IS_OK(status)) {
1815                 printf("ChangePasswordUser failed - %s\n", nt_errstr(status));
1816                 ret = false;
1817         } else {
1818                 changed = true;
1819                 *password = newpass;
1820         }
1821
1822         r.in.user_handle = &user_handle;
1823         r.in.lm_present = 1;
1824         r.in.old_lm_crypted = &hash1;
1825         r.in.new_lm_crypted = &hash2;
1826         r.in.nt_present = 1;
1827         r.in.old_nt_crypted = &hash3;
1828         r.in.new_nt_crypted = &hash4;
1829         r.in.cross1_present = 1;
1830         r.in.nt_cross = &hash5;
1831         r.in.cross2_present = 1;
1832         r.in.lm_cross = &hash6;
1833
1834         if (changed) {
1835                 status = dcerpc_samr_ChangePasswordUser(p, tctx, &r);
1836                 if (NT_STATUS_EQUAL(status, NT_STATUS_PASSWORD_RESTRICTION)) {
1837                         printf("ChangePasswordUser returned: %s perhaps min password age? (not fatal)\n", nt_errstr(status));
1838                 } else if (!NT_STATUS_EQUAL(status, NT_STATUS_WRONG_PASSWORD)) {
1839                         printf("ChangePasswordUser failed: expected NT_STATUS_WRONG_PASSWORD because we already changed the password, got %s\n", nt_errstr(status));
1840                         ret = false;
1841                 }
1842         }
1843
1844
1845         if (!test_samr_handle_Close(p, tctx, &user_handle)) {
1846                 ret = false;
1847         }
1848
1849         return ret;
1850 }
1851
1852
1853 static bool test_OemChangePasswordUser2(struct dcerpc_pipe *p, struct torture_context *tctx,
1854                                         const char *acct_name,
1855                                         struct policy_handle *handle, char **password)
1856 {
1857         NTSTATUS status;
1858         struct samr_OemChangePasswordUser2 r;
1859         bool ret = true;
1860         struct samr_Password lm_verifier;
1861         struct samr_CryptPassword lm_pass;
1862         struct lsa_AsciiString server, account, account_bad;
1863         char *oldpass;
1864         char *newpass;
1865         uint8_t old_lm_hash[16], new_lm_hash[16];
1866
1867         struct samr_GetDomPwInfo dom_pw_info;
1868         struct samr_PwInfo info;
1869         int policy_min_pw_len = 0;
1870
1871         struct lsa_String domain_name;
1872
1873         domain_name.string = "";
1874         dom_pw_info.in.domain_name = &domain_name;
1875         dom_pw_info.out.info = &info;
1876
1877         torture_comment(tctx, "Testing OemChangePasswordUser2\n");
1878
1879         torture_assert(tctx, *password != NULL,
1880                                    "Failing OemChangePasswordUser2 as old password was NULL.  Previous test failed?");
1881
1882         oldpass = *password;
1883
1884         status = dcerpc_samr_GetDomPwInfo(p, tctx, &dom_pw_info);
1885         if (NT_STATUS_IS_OK(status)) {
1886                 policy_min_pw_len = dom_pw_info.out.info->min_password_length;
1887         }
1888
1889         newpass = samr_rand_pass(tctx, policy_min_pw_len);
1890
1891         server.string = talloc_asprintf(tctx, "\\\\%s", dcerpc_server_name(p));
1892         account.string = acct_name;
1893
1894         E_deshash(oldpass, old_lm_hash);
1895         E_deshash(newpass, new_lm_hash);
1896
1897         encode_pw_buffer(lm_pass.data, newpass, STR_ASCII);
1898         arcfour_crypt(lm_pass.data, old_lm_hash, 516);
1899         E_old_pw_hash(new_lm_hash, old_lm_hash, lm_verifier.hash);
1900
1901         r.in.server = &server;
1902         r.in.account = &account;
1903         r.in.password = &lm_pass;
1904         r.in.hash = &lm_verifier;
1905
1906         /* Break the verification */
1907         lm_verifier.hash[0]++;
1908
1909         status = dcerpc_samr_OemChangePasswordUser2(p, tctx, &r);
1910
1911         if (!NT_STATUS_EQUAL(status, NT_STATUS_PASSWORD_RESTRICTION)
1912             && !NT_STATUS_EQUAL(status, NT_STATUS_WRONG_PASSWORD)) {
1913                 printf("OemChangePasswordUser2 failed, should have returned WRONG_PASSWORD (or at least 'PASSWORD_RESTRICTON') for invalid password verifier - %s\n",
1914                         nt_errstr(status));
1915                 ret = false;
1916         }
1917
1918         encode_pw_buffer(lm_pass.data, newpass, STR_ASCII);
1919         /* Break the old password */
1920         old_lm_hash[0]++;
1921         arcfour_crypt(lm_pass.data, old_lm_hash, 516);
1922         /* unbreak it for the next operation */
1923         old_lm_hash[0]--;
1924         E_old_pw_hash(new_lm_hash, old_lm_hash, lm_verifier.hash);
1925
1926         r.in.server = &server;
1927         r.in.account = &account;
1928         r.in.password = &lm_pass;
1929         r.in.hash = &lm_verifier;
1930
1931         status = dcerpc_samr_OemChangePasswordUser2(p, tctx, &r);
1932
1933         if (!NT_STATUS_EQUAL(status, NT_STATUS_PASSWORD_RESTRICTION)
1934             && !NT_STATUS_EQUAL(status, NT_STATUS_WRONG_PASSWORD)) {
1935                 printf("OemChangePasswordUser2 failed, should have returned WRONG_PASSWORD (or at least 'PASSWORD_RESTRICTON') for invalidly encrpted password - %s\n",
1936                         nt_errstr(status));
1937                 ret = false;
1938         }
1939
1940         encode_pw_buffer(lm_pass.data, newpass, STR_ASCII);
1941         arcfour_crypt(lm_pass.data, old_lm_hash, 516);
1942
1943         r.in.server = &server;
1944         r.in.account = &account;
1945         r.in.password = &lm_pass;
1946         r.in.hash = NULL;
1947
1948         status = dcerpc_samr_OemChangePasswordUser2(p, tctx, &r);
1949
1950         if (!NT_STATUS_EQUAL(status, NT_STATUS_PASSWORD_RESTRICTION)
1951             && !NT_STATUS_EQUAL(status, NT_STATUS_INVALID_PARAMETER)) {
1952                 printf("OemChangePasswordUser2 failed, should have returned INVALID_PARAMETER (or at least 'PASSWORD_RESTRICTON') for no supplied validation hash - %s\n",
1953                         nt_errstr(status));
1954                 ret = false;
1955         }
1956
1957         /* This shouldn't be a valid name */
1958         account_bad.string = TEST_ACCOUNT_NAME "XX";
1959         r.in.account = &account_bad;
1960
1961         status = dcerpc_samr_OemChangePasswordUser2(p, tctx, &r);
1962
1963         if (!NT_STATUS_EQUAL(status, NT_STATUS_INVALID_PARAMETER)) {
1964                 printf("OemChangePasswordUser2 failed, should have returned INVALID_PARAMETER for no supplied validation hash and invalid user - %s\n",
1965                         nt_errstr(status));
1966                 ret = false;
1967         }
1968
1969         /* This shouldn't be a valid name */
1970         account_bad.string = TEST_ACCOUNT_NAME "XX";
1971         r.in.account = &account_bad;
1972         r.in.password = &lm_pass;
1973         r.in.hash = &lm_verifier;
1974
1975         status = dcerpc_samr_OemChangePasswordUser2(p, tctx, &r);
1976
1977         if (!NT_STATUS_EQUAL(status, NT_STATUS_WRONG_PASSWORD)) {
1978                 printf("OemChangePasswordUser2 failed, should have returned WRONG_PASSWORD for invalid user - %s\n",
1979                         nt_errstr(status));
1980                 ret = false;
1981         }
1982
1983         /* This shouldn't be a valid name */
1984         account_bad.string = TEST_ACCOUNT_NAME "XX";
1985         r.in.account = &account_bad;
1986         r.in.password = NULL;
1987         r.in.hash = &lm_verifier;
1988
1989         status = dcerpc_samr_OemChangePasswordUser2(p, tctx, &r);
1990
1991         if (!NT_STATUS_EQUAL(status, NT_STATUS_INVALID_PARAMETER)) {
1992                 printf("OemChangePasswordUser2 failed, should have returned INVALID_PARAMETER for no supplied password and invalid user - %s\n",
1993                         nt_errstr(status));
1994                 ret = false;
1995         }
1996
1997         E_deshash(oldpass, old_lm_hash);
1998         E_deshash(newpass, new_lm_hash);
1999
2000         encode_pw_buffer(lm_pass.data, newpass, STR_ASCII);
2001         arcfour_crypt(lm_pass.data, old_lm_hash, 516);
2002         E_old_pw_hash(new_lm_hash, old_lm_hash, lm_verifier.hash);
2003
2004         r.in.server = &server;
2005         r.in.account = &account;
2006         r.in.password = &lm_pass;
2007         r.in.hash = &lm_verifier;
2008
2009         status = dcerpc_samr_OemChangePasswordUser2(p, tctx, &r);
2010         if (NT_STATUS_EQUAL(status, NT_STATUS_PASSWORD_RESTRICTION)) {
2011                 printf("OemChangePasswordUser2 returned: %s perhaps min password age? (not fatal)\n", nt_errstr(status));
2012         } else if (!NT_STATUS_IS_OK(status)) {
2013                 printf("OemChangePasswordUser2 failed - %s\n", nt_errstr(status));
2014                 ret = false;
2015         } else {
2016                 *password = newpass;
2017         }
2018
2019         return ret;
2020 }
2021
2022
2023 static bool test_ChangePasswordUser2(struct dcerpc_pipe *p, struct torture_context *tctx,
2024                                      const char *acct_name,
2025                                      char **password,
2026                                      char *newpass, bool allow_password_restriction)
2027 {
2028         NTSTATUS status;
2029         struct samr_ChangePasswordUser2 r;
2030         bool ret = true;
2031         struct lsa_String server, account;
2032         struct samr_CryptPassword nt_pass, lm_pass;
2033         struct samr_Password nt_verifier, lm_verifier;
2034         char *oldpass;
2035         uint8_t old_nt_hash[16], new_nt_hash[16];
2036         uint8_t old_lm_hash[16], new_lm_hash[16];
2037
2038         struct samr_GetDomPwInfo dom_pw_info;
2039         struct samr_PwInfo info;
2040
2041         struct lsa_String domain_name;
2042
2043         domain_name.string = "";
2044         dom_pw_info.in.domain_name = &domain_name;
2045         dom_pw_info.out.info = &info;
2046
2047         torture_comment(tctx, "Testing ChangePasswordUser2 on %s\n", acct_name);
2048
2049         torture_assert(tctx, *password != NULL,
2050                                    "Failing ChangePasswordUser2 as old password was NULL.  Previous test failed?");
2051         oldpass = *password;
2052
2053         if (!newpass) {
2054                 int policy_min_pw_len = 0;
2055                 status = dcerpc_samr_GetDomPwInfo(p, tctx, &dom_pw_info);
2056                 if (NT_STATUS_IS_OK(status)) {
2057                         policy_min_pw_len = dom_pw_info.out.info->min_password_length;
2058                 }
2059
2060                 newpass = samr_rand_pass(tctx, policy_min_pw_len);
2061         }
2062
2063         server.string = talloc_asprintf(tctx, "\\\\%s", dcerpc_server_name(p));
2064         init_lsa_String(&account, acct_name);
2065
2066         E_md4hash(oldpass, old_nt_hash);
2067         E_md4hash(newpass, new_nt_hash);
2068
2069         E_deshash(oldpass, old_lm_hash);
2070         E_deshash(newpass, new_lm_hash);
2071
2072         encode_pw_buffer(lm_pass.data, newpass, STR_ASCII|STR_TERMINATE);
2073         arcfour_crypt(lm_pass.data, old_lm_hash, 516);
2074         E_old_pw_hash(new_nt_hash, old_lm_hash, lm_verifier.hash);
2075
2076         encode_pw_buffer(nt_pass.data, newpass, STR_UNICODE);
2077         arcfour_crypt(nt_pass.data, old_nt_hash, 516);
2078         E_old_pw_hash(new_nt_hash, old_nt_hash, nt_verifier.hash);
2079
2080         r.in.server = &server;
2081         r.in.account = &account;
2082         r.in.nt_password = &nt_pass;
2083         r.in.nt_verifier = &nt_verifier;
2084         r.in.lm_change = 1;
2085         r.in.lm_password = &lm_pass;
2086         r.in.lm_verifier = &lm_verifier;
2087
2088         status = dcerpc_samr_ChangePasswordUser2(p, tctx, &r);
2089         if (allow_password_restriction && NT_STATUS_EQUAL(status, NT_STATUS_PASSWORD_RESTRICTION)) {
2090                 printf("ChangePasswordUser2 returned: %s perhaps min password age? (not fatal)\n", nt_errstr(status));
2091         } else if (!NT_STATUS_IS_OK(status)) {
2092                 printf("ChangePasswordUser2 failed - %s\n", nt_errstr(status));
2093                 ret = false;
2094         } else {
2095                 *password = newpass;
2096         }
2097
2098         return ret;
2099 }
2100
2101
2102 bool test_ChangePasswordUser3(struct dcerpc_pipe *p, struct torture_context *tctx,
2103                               const char *account_string,
2104                               int policy_min_pw_len,
2105                               char **password,
2106                               const char *newpass,
2107                               NTTIME last_password_change,
2108                               bool handle_reject_reason)
2109 {
2110         NTSTATUS status;
2111         struct samr_ChangePasswordUser3 r;
2112         bool ret = true;
2113         struct lsa_String server, account, account_bad;
2114         struct samr_CryptPassword nt_pass, lm_pass;
2115         struct samr_Password nt_verifier, lm_verifier;
2116         char *oldpass;
2117         uint8_t old_nt_hash[16], new_nt_hash[16];
2118         uint8_t old_lm_hash[16], new_lm_hash[16];
2119         NTTIME t;
2120         struct samr_DomInfo1 *dominfo = NULL;
2121         struct samr_ChangeReject *reject = NULL;
2122
2123         torture_comment(tctx, "Testing ChangePasswordUser3\n");
2124
2125         if (newpass == NULL) {
2126                 do {
2127                         if (policy_min_pw_len == 0) {
2128                                 newpass = samr_rand_pass(tctx, policy_min_pw_len);
2129                         } else {
2130                                 newpass = samr_rand_pass_fixed_len(tctx, policy_min_pw_len);
2131                         }
2132                 } while (check_password_quality(newpass) == false);
2133         } else {
2134                 torture_comment(tctx, "Using password '%s'\n", newpass);
2135         }
2136
2137         torture_assert(tctx, *password != NULL,
2138                                    "Failing ChangePasswordUser3 as old password was NULL.  Previous test failed?");
2139
2140         oldpass = *password;
2141         server.string = talloc_asprintf(tctx, "\\\\%s", dcerpc_server_name(p));
2142         init_lsa_String(&account, account_string);
2143
2144         E_md4hash(oldpass, old_nt_hash);
2145         E_md4hash(newpass, new_nt_hash);
2146
2147         E_deshash(oldpass, old_lm_hash);
2148         E_deshash(newpass, new_lm_hash);
2149
2150         encode_pw_buffer(lm_pass.data, newpass, STR_UNICODE);
2151         arcfour_crypt(lm_pass.data, old_nt_hash, 516);
2152         E_old_pw_hash(new_nt_hash, old_lm_hash, lm_verifier.hash);
2153
2154         encode_pw_buffer(nt_pass.data, newpass, STR_UNICODE);
2155         arcfour_crypt(nt_pass.data, old_nt_hash, 516);
2156         E_old_pw_hash(new_nt_hash, old_nt_hash, nt_verifier.hash);
2157
2158         /* Break the verification */
2159         nt_verifier.hash[0]++;
2160
2161         r.in.server = &server;
2162         r.in.account = &account;
2163         r.in.nt_password = &nt_pass;
2164         r.in.nt_verifier = &nt_verifier;
2165         r.in.lm_change = 1;
2166         r.in.lm_password = &lm_pass;
2167         r.in.lm_verifier = &lm_verifier;
2168         r.in.password3 = NULL;
2169         r.out.dominfo = &dominfo;
2170         r.out.reject = &reject;
2171
2172         status = dcerpc_samr_ChangePasswordUser3(p, tctx, &r);
2173         if (!NT_STATUS_EQUAL(status, NT_STATUS_PASSWORD_RESTRICTION) &&
2174             (!NT_STATUS_EQUAL(status, NT_STATUS_WRONG_PASSWORD))) {
2175                 printf("ChangePasswordUser3 failed, should have returned WRONG_PASSWORD (or at least 'PASSWORD_RESTRICTON') for invalid password verifier - %s\n",
2176                         nt_errstr(status));
2177                 ret = false;
2178         }
2179
2180         encode_pw_buffer(lm_pass.data, newpass, STR_UNICODE);
2181         arcfour_crypt(lm_pass.data, old_nt_hash, 516);
2182         E_old_pw_hash(new_nt_hash, old_lm_hash, lm_verifier.hash);
2183
2184         encode_pw_buffer(nt_pass.data, newpass, STR_UNICODE);
2185         /* Break the NT hash */
2186         old_nt_hash[0]++;
2187         arcfour_crypt(nt_pass.data, old_nt_hash, 516);
2188         /* Unbreak it again */
2189         old_nt_hash[0]--;
2190         E_old_pw_hash(new_nt_hash, old_nt_hash, nt_verifier.hash);
2191
2192         r.in.server = &server;
2193         r.in.account = &account;
2194         r.in.nt_password = &nt_pass;
2195         r.in.nt_verifier = &nt_verifier;
2196         r.in.lm_change = 1;
2197         r.in.lm_password = &lm_pass;
2198         r.in.lm_verifier = &lm_verifier;
2199         r.in.password3 = NULL;
2200         r.out.dominfo = &dominfo;
2201         r.out.reject = &reject;
2202
2203         status = dcerpc_samr_ChangePasswordUser3(p, tctx, &r);
2204         if (!NT_STATUS_EQUAL(status, NT_STATUS_PASSWORD_RESTRICTION) &&
2205             (!NT_STATUS_EQUAL(status, NT_STATUS_WRONG_PASSWORD))) {
2206                 printf("ChangePasswordUser3 failed, should have returned WRONG_PASSWORD (or at least 'PASSWORD_RESTRICTON') for invalidly encrpted password - %s\n",
2207                         nt_errstr(status));
2208                 ret = false;
2209         }
2210
2211         /* This shouldn't be a valid name */
2212         init_lsa_String(&account_bad, talloc_asprintf(tctx, "%sXX", account_string));
2213
2214         r.in.account = &account_bad;
2215         status = dcerpc_samr_ChangePasswordUser3(p, tctx, &r);
2216         if (!NT_STATUS_EQUAL(status, NT_STATUS_WRONG_PASSWORD)) {
2217                 printf("ChangePasswordUser3 failed, should have returned WRONG_PASSWORD for invalid username - %s\n",
2218                         nt_errstr(status));
2219                 ret = false;
2220         }
2221
2222         E_md4hash(oldpass, old_nt_hash);
2223         E_md4hash(newpass, new_nt_hash);
2224
2225         E_deshash(oldpass, old_lm_hash);
2226         E_deshash(newpass, new_lm_hash);
2227
2228         encode_pw_buffer(lm_pass.data, newpass, STR_UNICODE);
2229         arcfour_crypt(lm_pass.data, old_nt_hash, 516);
2230         E_old_pw_hash(new_nt_hash, old_lm_hash, lm_verifier.hash);
2231
2232         encode_pw_buffer(nt_pass.data, newpass, STR_UNICODE);
2233         arcfour_crypt(nt_pass.data, old_nt_hash, 516);
2234         E_old_pw_hash(new_nt_hash, old_nt_hash, nt_verifier.hash);
2235
2236         r.in.server = &server;
2237         r.in.account = &account;
2238         r.in.nt_password = &nt_pass;
2239         r.in.nt_verifier = &nt_verifier;
2240         r.in.lm_change = 1;
2241         r.in.lm_password = &lm_pass;
2242         r.in.lm_verifier = &lm_verifier;
2243         r.in.password3 = NULL;
2244         r.out.dominfo = &dominfo;
2245         r.out.reject = &reject;
2246
2247         unix_to_nt_time(&t, time(NULL));
2248
2249         status = dcerpc_samr_ChangePasswordUser3(p, tctx, &r);
2250
2251         if (NT_STATUS_EQUAL(status, NT_STATUS_PASSWORD_RESTRICTION)
2252             && dominfo
2253             && reject
2254             && handle_reject_reason
2255             && (!null_nttime(last_password_change) || !dominfo->min_password_age)) {
2256                 if (dominfo->password_properties & DOMAIN_REFUSE_PASSWORD_CHANGE ) {
2257
2258                         if (reject && (reject->reason != SAMR_REJECT_OTHER)) {
2259                                 printf("expected SAMR_REJECT_OTHER (%d), got %d\n",
2260                                         SAMR_REJECT_OTHER, reject->reason);
2261                                 return false;
2262                         }
2263                 }
2264
2265                 /* We tested the order of precendence which is as follows:
2266
2267                 * pwd min_age
2268                 * pwd length
2269                 * pwd complexity
2270                 * pwd history
2271
2272                 Guenther */
2273
2274                 if ((dominfo->min_password_age > 0) && !null_nttime(last_password_change) &&
2275                            (last_password_change + dominfo->min_password_age > t)) {
2276
2277                         if (reject->reason != SAMR_REJECT_OTHER) {
2278                                 printf("expected SAMR_REJECT_OTHER (%d), got %d\n",
2279                                         SAMR_REJECT_OTHER, reject->reason);
2280                                 return false;
2281                         }
2282
2283                 } else if ((dominfo->min_password_length > 0) &&
2284                            (strlen(newpass) < dominfo->min_password_length)) {
2285
2286                         if (reject->reason != SAMR_REJECT_TOO_SHORT) {
2287                                 printf("expected SAMR_REJECT_TOO_SHORT (%d), got %d\n",
2288                                         SAMR_REJECT_TOO_SHORT, reject->reason);
2289                                 return false;
2290                         }
2291
2292                 } else if ((dominfo->password_history_length > 0) &&
2293                             strequal(oldpass, newpass)) {
2294
2295                         if (reject->reason != SAMR_REJECT_IN_HISTORY) {
2296                                 printf("expected SAMR_REJECT_IN_HISTORY (%d), got %d\n",
2297                                         SAMR_REJECT_IN_HISTORY, reject->reason);
2298                                 return false;
2299                         }
2300                 } else if (dominfo->password_properties & DOMAIN_PASSWORD_COMPLEX) {
2301
2302                         if (reject->reason != SAMR_REJECT_COMPLEXITY) {
2303                                 printf("expected SAMR_REJECT_COMPLEXITY (%d), got %d\n",
2304                                         SAMR_REJECT_COMPLEXITY, reject->reason);
2305                                 return false;
2306                         }
2307
2308                 }
2309
2310                 if (reject->reason == SAMR_REJECT_TOO_SHORT) {
2311                         /* retry with adjusted size */
2312                         return test_ChangePasswordUser3(p, tctx, account_string,
2313                                                         dominfo->min_password_length,
2314                                                         password, NULL, 0, false);
2315
2316                 }
2317
2318         } else if (NT_STATUS_EQUAL(status, NT_STATUS_PASSWORD_RESTRICTION)) {
2319                 if (reject && reject->reason != SAMR_REJECT_OTHER) {
2320                         printf("expected SAMR_REJECT_OTHER (%d), got %d\n",
2321                                SAMR_REJECT_OTHER, reject->reason);
2322                         return false;
2323                 }
2324                 /* Perhaps the server has a 'min password age' set? */
2325
2326         } else {
2327                 torture_assert_ntstatus_ok(tctx, status, "ChangePasswordUser3");
2328                 *password = talloc_strdup(tctx, newpass);
2329         }
2330
2331         return ret;
2332 }
2333
2334 bool test_ChangePasswordRandomBytes(struct dcerpc_pipe *p, struct torture_context *tctx,
2335                                     const char *account_string,
2336                                     struct policy_handle *handle,
2337                                     char **password)
2338 {
2339         NTSTATUS status;
2340         struct samr_ChangePasswordUser3 r;
2341         struct samr_SetUserInfo s;
2342         union samr_UserInfo u;
2343         DATA_BLOB session_key;
2344         DATA_BLOB confounded_session_key = data_blob_talloc(tctx, NULL, 16);
2345         uint8_t confounder[16];
2346         struct MD5Context ctx;
2347
2348         bool ret = true;
2349         struct lsa_String server, account;
2350         struct samr_CryptPassword nt_pass;
2351         struct samr_Password nt_verifier;
2352         DATA_BLOB new_random_pass;
2353         char *newpass;
2354         char *oldpass;
2355         uint8_t old_nt_hash[16], new_nt_hash[16];
2356         NTTIME t;
2357         struct samr_DomInfo1 *dominfo = NULL;
2358         struct samr_ChangeReject *reject = NULL;
2359
2360         new_random_pass = samr_very_rand_pass(tctx, 128);
2361
2362         torture_assert(tctx, *password != NULL,
2363                                    "Failing ChangePasswordUser3 as old password was NULL.  Previous test failed?");
2364
2365         oldpass = *password;
2366         server.string = talloc_asprintf(tctx, "\\\\%s", dcerpc_server_name(p));
2367         init_lsa_String(&account, account_string);
2368
2369         s.in.user_handle = handle;
2370         s.in.info = &u;
2371         s.in.level = 25;
2372
2373         ZERO_STRUCT(u);
2374
2375         u.info25.info.fields_present = SAMR_FIELD_NT_PASSWORD_PRESENT;
2376
2377         set_pw_in_buffer(u.info25.password.data, &new_random_pass);
2378
2379         status = dcerpc_fetch_session_key(p, &session_key);
2380         if (!NT_STATUS_IS_OK(status)) {
2381                 printf("SetUserInfo level %u - no session key - %s\n",
2382                        s.in.level, nt_errstr(status));
2383                 return false;
2384         }
2385
2386         generate_random_buffer((uint8_t *)confounder, 16);
2387
2388         MD5Init(&ctx);
2389         MD5Update(&ctx, confounder, 16);
2390         MD5Update(&ctx, session_key.data, session_key.length);
2391         MD5Final(confounded_session_key.data, &ctx);
2392
2393         arcfour_crypt_blob(u.info25.password.data, 516, &confounded_session_key);
2394         memcpy(&u.info25.password.data[516], confounder, 16);
2395
2396         torture_comment(tctx, "Testing SetUserInfo level 25 (set password ex) with a password made up of only random bytes\n");
2397
2398         status = dcerpc_samr_SetUserInfo(p, tctx, &s);
2399         if (!NT_STATUS_IS_OK(status)) {
2400                 printf("SetUserInfo level %u failed - %s\n",
2401                        s.in.level, nt_errstr(status));
2402                 ret = false;
2403         }
2404
2405         torture_comment(tctx, "Testing ChangePasswordUser3 with a password made up of only random bytes\n");
2406
2407         mdfour(old_nt_hash, new_random_pass.data, new_random_pass.length);
2408
2409         new_random_pass = samr_very_rand_pass(tctx, 128);
2410
2411         mdfour(new_nt_hash, new_random_pass.data, new_random_pass.length);
2412
2413         set_pw_in_buffer(nt_pass.data, &new_random_pass);
2414         arcfour_crypt(nt_pass.data, old_nt_hash, 516);
2415         E_old_pw_hash(new_nt_hash, old_nt_hash, nt_verifier.hash);
2416
2417         r.in.server = &server;
2418         r.in.account = &account;
2419         r.in.nt_password = &nt_pass;
2420         r.in.nt_verifier = &nt_verifier;
2421         r.in.lm_change = 0;
2422         r.in.lm_password = NULL;
2423         r.in.lm_verifier = NULL;
2424         r.in.password3 = NULL;
2425         r.out.dominfo = &dominfo;
2426         r.out.reject = &reject;
2427
2428         unix_to_nt_time(&t, time(NULL));
2429
2430         status = dcerpc_samr_ChangePasswordUser3(p, tctx, &r);
2431
2432         if (NT_STATUS_EQUAL(status, NT_STATUS_PASSWORD_RESTRICTION)) {
2433                 if (reject && reject->reason != SAMR_REJECT_OTHER) {
2434                         printf("expected SAMR_REJECT_OTHER (%d), got %d\n",
2435                                SAMR_REJECT_OTHER, reject->reason);
2436                         return false;
2437                 }
2438                 /* Perhaps the server has a 'min password age' set? */
2439
2440         } else if (!NT_STATUS_IS_OK(status)) {
2441                 printf("ChangePasswordUser3 failed - %s\n", nt_errstr(status));
2442                 ret = false;
2443         }
2444
2445         newpass = samr_rand_pass(tctx, 128);
2446
2447         mdfour(old_nt_hash, new_random_pass.data, new_random_pass.length);
2448
2449         E_md4hash(newpass, new_nt_hash);
2450
2451         encode_pw_buffer(nt_pass.data, newpass, STR_UNICODE);
2452         arcfour_crypt(nt_pass.data, old_nt_hash, 516);
2453         E_old_pw_hash(new_nt_hash, old_nt_hash, nt_verifier.hash);
2454
2455         r.in.server = &server;
2456         r.in.account = &account;
2457         r.in.nt_password = &nt_pass;
2458         r.in.nt_verifier = &nt_verifier;
2459         r.in.lm_change = 0;
2460         r.in.lm_password = NULL;
2461         r.in.lm_verifier = NULL;
2462         r.in.password3 = NULL;
2463         r.out.dominfo = &dominfo;
2464         r.out.reject = &reject;
2465
2466         unix_to_nt_time(&t, time(NULL));
2467
2468         status = dcerpc_samr_ChangePasswordUser3(p, tctx, &r);
2469
2470         if (NT_STATUS_EQUAL(status, NT_STATUS_PASSWORD_RESTRICTION)) {
2471                 if (reject && reject->reason != SAMR_REJECT_OTHER) {
2472                         printf("expected SAMR_REJECT_OTHER (%d), got %d\n",
2473                                SAMR_REJECT_OTHER, reject->reason);
2474                         return false;
2475                 }
2476                 /* Perhaps the server has a 'min password age' set? */
2477
2478         } else {
2479                 torture_assert_ntstatus_ok(tctx, status, "ChangePasswordUser3 (on second random password)");
2480                 *password = talloc_strdup(tctx, newpass);
2481         }
2482
2483         return ret;
2484 }
2485
2486
2487 static bool test_GetMembersInAlias(struct dcerpc_pipe *p, struct torture_context *tctx,
2488                                   struct policy_handle *alias_handle)
2489 {
2490         struct samr_GetMembersInAlias r;
2491         struct lsa_SidArray sids;
2492         NTSTATUS status;
2493
2494         torture_comment(tctx, "Testing GetMembersInAlias\n");
2495
2496         r.in.alias_handle = alias_handle;
2497         r.out.sids = &sids;
2498
2499         status = dcerpc_samr_GetMembersInAlias(p, tctx, &r);
2500         torture_assert_ntstatus_ok(tctx, status, "GetMembersInAlias");
2501
2502         return true;
2503 }
2504
2505 static bool test_AddMemberToAlias(struct dcerpc_pipe *p, struct torture_context *tctx,
2506                                   struct policy_handle *alias_handle,
2507                                   const struct dom_sid *domain_sid)
2508 {
2509         struct samr_AddAliasMember r;
2510         struct samr_DeleteAliasMember d;
2511         NTSTATUS status;
2512         struct dom_sid *sid;
2513
2514         sid = dom_sid_add_rid(tctx, domain_sid, 512);
2515
2516         torture_comment(tctx, "testing AddAliasMember\n");
2517         r.in.alias_handle = alias_handle;
2518         r.in.sid = sid;
2519
2520         status = dcerpc_samr_AddAliasMember(p, tctx, &r);
2521         torture_assert_ntstatus_ok(tctx, status, "AddAliasMember");
2522
2523         d.in.alias_handle = alias_handle;
2524         d.in.sid = sid;
2525
2526         status = dcerpc_samr_DeleteAliasMember(p, tctx, &d);
2527         torture_assert_ntstatus_ok(tctx, status, "DelAliasMember");
2528
2529         return true;
2530 }
2531
2532 static bool test_AddMultipleMembersToAlias(struct dcerpc_pipe *p, struct torture_context *tctx,
2533                                            struct policy_handle *alias_handle)
2534 {
2535         struct samr_AddMultipleMembersToAlias a;
2536         struct samr_RemoveMultipleMembersFromAlias r;
2537         NTSTATUS status;
2538         struct lsa_SidArray sids;
2539
2540         torture_comment(tctx, "testing AddMultipleMembersToAlias\n");
2541         a.in.alias_handle = alias_handle;
2542         a.in.sids = &sids;
2543
2544         sids.num_sids = 3;
2545         sids.sids = talloc_array(tctx, struct lsa_SidPtr, 3);
2546
2547         sids.sids[0].sid = dom_sid_parse_talloc(tctx, "S-1-5-32-1-2-3-1");
2548         sids.sids[1].sid = dom_sid_parse_talloc(tctx, "S-1-5-32-1-2-3-2");
2549         sids.sids[2].sid = dom_sid_parse_talloc(tctx, "S-1-5-32-1-2-3-3");
2550
2551         status = dcerpc_samr_AddMultipleMembersToAlias(p, tctx, &a);
2552         torture_assert_ntstatus_ok(tctx, status, "AddMultipleMembersToAlias");
2553
2554
2555         torture_comment(tctx, "testing RemoveMultipleMembersFromAlias\n");
2556         r.in.alias_handle = alias_handle;
2557         r.in.sids = &sids;
2558
2559         status = dcerpc_samr_RemoveMultipleMembersFromAlias(p, tctx, &r);
2560         torture_assert_ntstatus_ok(tctx, status, "RemoveMultipleMembersFromAlias");
2561
2562         /* strange! removing twice doesn't give any error */
2563         status = dcerpc_samr_RemoveMultipleMembersFromAlias(p, tctx, &r);
2564         torture_assert_ntstatus_ok(tctx, status, "RemoveMultipleMembersFromAlias");
2565
2566         /* but removing an alias that isn't there does */
2567         sids.sids[2].sid = dom_sid_parse_talloc(tctx, "S-1-5-32-1-2-3-4");
2568
2569         status = dcerpc_samr_RemoveMultipleMembersFromAlias(p, tctx, &r);
2570         torture_assert_ntstatus_equal(tctx, status, NT_STATUS_OBJECT_NAME_NOT_FOUND, "RemoveMultipleMembersFromAlias");
2571
2572         return true;
2573 }
2574
2575 static bool test_TestPrivateFunctionsUser(struct dcerpc_pipe *p, struct torture_context *tctx,
2576                                             struct policy_handle *user_handle)
2577 {
2578         struct samr_TestPrivateFunctionsUser r;
2579         NTSTATUS status;
2580
2581         torture_comment(tctx, "Testing TestPrivateFunctionsUser\n");
2582
2583         r.in.user_handle = user_handle;
2584
2585         status = dcerpc_samr_TestPrivateFunctionsUser(p, tctx, &r);
2586         torture_assert_ntstatus_equal(tctx, status, NT_STATUS_NOT_IMPLEMENTED, "TestPrivateFunctionsUser");
2587
2588         return true;
2589 }
2590
2591 static bool test_QueryUserInfo_pwdlastset(struct dcerpc_pipe *p,
2592                                           struct torture_context *tctx,
2593                                           struct policy_handle *handle,
2594                                           bool use_info2,
2595                                           NTTIME *pwdlastset)
2596 {
2597         NTSTATUS status;
2598         uint16_t levels[] = { /* 3, */ 5, 21 };
2599         int i;
2600         NTTIME pwdlastset3 = 0;
2601         NTTIME pwdlastset5 = 0;
2602         NTTIME pwdlastset21 = 0;
2603
2604         torture_comment(tctx, "Testing QueryUserInfo%s level 5 and 21 call ",
2605                         use_info2 ? "2":"");
2606
2607         for (i=0; i<ARRAY_SIZE(levels); i++) {
2608
2609                 struct samr_QueryUserInfo r;
2610                 struct samr_QueryUserInfo2 r2;
2611                 union samr_UserInfo *info;
2612
2613                 if (use_info2) {
2614                         r2.in.user_handle = handle;
2615                         r2.in.level = levels[i];
2616                         r2.out.info = &info;
2617                         status = dcerpc_samr_QueryUserInfo2(p, tctx, &r2);
2618
2619                 } else {
2620                         r.in.user_handle = handle;
2621                         r.in.level = levels[i];
2622                         r.out.info = &info;
2623                         status = dcerpc_samr_QueryUserInfo(p, tctx, &r);
2624                 }
2625
2626                 if (!NT_STATUS_IS_OK(status) &&
2627                     !NT_STATUS_EQUAL(status, NT_STATUS_INVALID_INFO_CLASS)) {
2628                         printf("QueryUserInfo%s level %u failed - %s\n",
2629                                use_info2 ? "2":"", levels[i], nt_errstr(status));
2630                         return false;
2631                 }
2632
2633                 switch (levels[i]) {
2634                 case 3:
2635                         pwdlastset3 = info->info3.last_password_change;
2636                         break;
2637                 case 5:
2638                         pwdlastset5 = info->info5.last_password_change;
2639                         break;
2640                 case 21:
2641                         pwdlastset21 = info->info21.last_password_change;
2642                         break;
2643                 default:
2644                         return false;
2645                 }
2646         }
2647         /* torture_assert_int_equal(tctx, pwdlastset3, pwdlastset5,
2648                                     "pwdlastset mixup"); */
2649         torture_assert_int_equal(tctx, pwdlastset5, pwdlastset21,
2650                                  "pwdlastset mixup");
2651
2652         *pwdlastset = pwdlastset21;
2653
2654         torture_comment(tctx, "(pwdlastset: %lld)\n", *pwdlastset);
2655
2656         return true;
2657 }
2658
2659 static bool test_SamLogon_Creds(struct dcerpc_pipe *p, struct torture_context *tctx,
2660                                 struct cli_credentials *machine_credentials,
2661                                 struct cli_credentials *test_credentials,
2662                                 struct netlogon_creds_CredentialState *creds,
2663                                 NTSTATUS expected_result)
2664 {
2665         NTSTATUS status;
2666         struct netr_LogonSamLogon r;
2667         struct netr_Authenticator auth, auth2;
2668         union netr_LogonLevel logon;
2669         union netr_Validation validation;
2670         uint8_t authoritative;
2671         struct netr_NetworkInfo ninfo;
2672         DATA_BLOB names_blob, chal, lm_resp, nt_resp;
2673         int flags = CLI_CRED_NTLM_AUTH;
2674
2675         if (lp_client_lanman_auth(tctx->lp_ctx)) {
2676                 flags |= CLI_CRED_LANMAN_AUTH;
2677         }
2678
2679         if (lp_client_ntlmv2_auth(tctx->lp_ctx)) {
2680                 flags |= CLI_CRED_NTLMv2_AUTH;
2681         }
2682
2683         cli_credentials_get_ntlm_username_domain(test_credentials, tctx,
2684                                                  &ninfo.identity_info.account_name.string,
2685                                                  &ninfo.identity_info.domain_name.string);
2686
2687         generate_random_buffer(ninfo.challenge,
2688                                sizeof(ninfo.challenge));
2689         chal = data_blob_const(ninfo.challenge,
2690                                sizeof(ninfo.challenge));
2691
2692         names_blob = NTLMv2_generate_names_blob(tctx, cli_credentials_get_workstation(machine_credentials),
2693                                                 cli_credentials_get_domain(machine_credentials));
2694
2695         status = cli_credentials_get_ntlm_response(test_credentials, tctx,
2696                                                    &flags,
2697                                                    chal,
2698                                                    names_blob,
2699                                                    &lm_resp, &nt_resp,
2700                                                    NULL, NULL);
2701         torture_assert_ntstatus_ok(tctx, status, "cli_credentials_get_ntlm_response failed");
2702
2703         ninfo.lm.data = lm_resp.data;
2704         ninfo.lm.length = lm_resp.length;
2705
2706         ninfo.nt.data = nt_resp.data;
2707         ninfo.nt.length = nt_resp.length;
2708
2709         ninfo.identity_info.parameter_control =
2710                 MSV1_0_ALLOW_SERVER_TRUST_ACCOUNT |
2711                 MSV1_0_ALLOW_WORKSTATION_TRUST_ACCOUNT;
2712         ninfo.identity_info.logon_id_low = 0;
2713         ninfo.identity_info.logon_id_high = 0;
2714         ninfo.identity_info.workstation.string = cli_credentials_get_workstation(machine_credentials);
2715
2716         logon.network = &ninfo;
2717
2718         r.in.server_name = talloc_asprintf(tctx, "\\\\%s", dcerpc_server_name(p));
2719         r.in.computer_name = cli_credentials_get_workstation(machine_credentials);
2720         r.in.credential = &auth;
2721         r.in.return_authenticator = &auth2;
2722         r.in.logon_level = 2;
2723         r.in.logon = &logon;
2724         r.out.validation = &validation;
2725         r.out.authoritative = &authoritative;
2726
2727         d_printf("Testing LogonSamLogon with name %s\n", ninfo.identity_info.account_name.string);
2728
2729         ZERO_STRUCT(auth2);
2730         netlogon_creds_client_authenticator(creds, &auth);
2731
2732         r.in.validation_level = 2;
2733
2734         status = dcerpc_netr_LogonSamLogon(p, tctx, &r);
2735         if (!NT_STATUS_IS_OK(status)) {
2736                 torture_assert_ntstatus_equal(tctx, status, expected_result, "LogonSamLogon failed");
2737                 return true;
2738         } else {
2739                 torture_assert_ntstatus_ok(tctx, status, "LogonSamLogon failed");
2740         }
2741
2742         torture_assert(tctx, netlogon_creds_client_check(creds, &r.out.return_authenticator->cred),
2743                         "Credential chaining failed");
2744
2745         return true;
2746 }
2747
2748 static bool test_SamLogon(struct torture_context *tctx,
2749                           struct dcerpc_pipe *p,
2750                           struct cli_credentials *machine_credentials,
2751                           struct cli_credentials *test_credentials,
2752                           NTSTATUS expected_result)
2753 {
2754         struct netlogon_creds_CredentialState *creds;
2755
2756         if (!test_SetupCredentials(p, tctx, machine_credentials, &creds)) {
2757                 return false;
2758         }
2759
2760         return test_SamLogon_Creds(p, tctx, machine_credentials, test_credentials,
2761                                    creds, expected_result);
2762 }
2763
2764 static bool test_SamLogon_with_creds(struct torture_context *tctx,
2765                                      struct dcerpc_pipe *p,
2766                                      struct cli_credentials *machine_creds,
2767                                      const char *acct_name,
2768                                      char *password,
2769                                      NTSTATUS expected_samlogon_result)
2770 {
2771         bool ret = true;
2772         struct cli_credentials *test_credentials;
2773
2774         test_credentials = cli_credentials_init(tctx);
2775
2776         cli_credentials_set_workstation(test_credentials,
2777                                         TEST_ACCOUNT_NAME_PWD, CRED_SPECIFIED);
2778         cli_credentials_set_domain(test_credentials,
2779                                    lp_workgroup(tctx->lp_ctx), CRED_SPECIFIED);
2780         cli_credentials_set_username(test_credentials,
2781                                      acct_name, CRED_SPECIFIED);
2782         cli_credentials_set_password(test_credentials,
2783                                      password, CRED_SPECIFIED);
2784         cli_credentials_set_secure_channel_type(test_credentials, SEC_CHAN_BDC);
2785
2786         printf("testing samlogon as %s@%s password: %s\n",
2787                 acct_name, TEST_ACCOUNT_NAME_PWD, password);
2788
2789         if (!test_SamLogon(tctx, p, machine_creds, test_credentials,
2790                            expected_samlogon_result)) {
2791                 torture_warning(tctx, "new password did not work\n");
2792                 ret = false;
2793         }
2794
2795         return ret;
2796 }
2797
2798 static bool test_SetPassword_level(struct dcerpc_pipe *p,
2799                                    struct dcerpc_pipe *np,
2800                                    struct torture_context *tctx,
2801                                    struct policy_handle *handle,
2802                                    uint16_t level,
2803                                    uint32_t fields_present,
2804                                    uint8_t password_expired,
2805                                    bool *matched_expected_error,
2806                                    bool use_setinfo2,
2807                                    const char *acct_name,
2808                                    char **password,
2809                                    struct cli_credentials *machine_creds,
2810                                    bool use_queryinfo2,
2811                                    NTTIME *pwdlastset,
2812                                    NTSTATUS expected_samlogon_result)
2813 {
2814         const char *fields = NULL;
2815         bool ret = true;
2816
2817         switch (level) {
2818         case 21:
2819         case 23:
2820         case 25:
2821                 fields = talloc_asprintf(tctx, "(fields_present: 0x%08x)",
2822                                          fields_present);
2823                 break;
2824         default:
2825                 break;
2826         }
2827
2828         torture_comment(tctx, "Testing SetUserInfo%s level %d call "
2829                 "(password_expired: %d) %s\n",
2830                 use_setinfo2 ? "2":"", level, password_expired,
2831                 fields ? fields : "");
2832
2833         if (!test_SetUserPass_level_ex(p, tctx, handle, level,
2834                                        fields_present,
2835                                        password,
2836                                        password_expired,
2837                                        use_setinfo2,
2838                                        matched_expected_error)) {
2839                 ret = false;
2840         }
2841
2842         if (!test_QueryUserInfo_pwdlastset(p, tctx, handle,
2843                                            use_queryinfo2,
2844                                            pwdlastset)) {
2845                 ret = false;
2846         }
2847
2848         if (*matched_expected_error == true) {
2849                 return ret;
2850         }
2851
2852         if (!test_SamLogon_with_creds(tctx, np,
2853                                       machine_creds,
2854                                       acct_name,
2855                                       *password,
2856                                       expected_samlogon_result)) {
2857                 ret = false;
2858         }
2859
2860         return ret;
2861 }
2862
2863 static bool test_SetPassword_pwdlastset(struct dcerpc_pipe *p,
2864                                         struct torture_context *tctx,
2865                                         uint32_t acct_flags,
2866                                         const char *acct_name,
2867                                         struct policy_handle *handle,
2868                                         char **password,
2869                                         struct cli_credentials *machine_credentials)
2870 {
2871         int s = 0, q = 0, f = 0, l = 0, z = 0;
2872         bool ret = true;
2873         int delay = 500000;
2874         bool set_levels[] = { false, true };
2875         bool query_levels[] = { false, true };
2876         uint32_t levels[] = { 18, 21, 23, 24, 25, 26 };
2877         uint32_t nonzeros[] = { 1, 24 };
2878         uint32_t fields_present[] = {
2879                 0,
2880                 SAMR_FIELD_EXPIRED_FLAG,
2881                 SAMR_FIELD_LAST_PWD_CHANGE,
2882                 SAMR_FIELD_EXPIRED_FLAG | SAMR_FIELD_LAST_PWD_CHANGE,
2883                 SAMR_FIELD_COMMENT,
2884                 SAMR_FIELD_NT_PASSWORD_PRESENT,
2885                 SAMR_FIELD_NT_PASSWORD_PRESENT | SAMR_FIELD_LAST_PWD_CHANGE,
2886                 SAMR_FIELD_NT_PASSWORD_PRESENT | SAMR_FIELD_LM_PASSWORD_PRESENT,
2887                 SAMR_FIELD_NT_PASSWORD_PRESENT | SAMR_FIELD_LM_PASSWORD_PRESENT | SAMR_FIELD_LAST_PWD_CHANGE,
2888                 SAMR_FIELD_NT_PASSWORD_PRESENT | SAMR_FIELD_EXPIRED_FLAG,
2889                 SAMR_FIELD_NT_PASSWORD_PRESENT | SAMR_FIELD_LM_PASSWORD_PRESENT | SAMR_FIELD_EXPIRED_FLAG,
2890                 SAMR_FIELD_NT_PASSWORD_PRESENT | SAMR_FIELD_LM_PASSWORD_PRESENT | SAMR_FIELD_LAST_PWD_CHANGE | SAMR_FIELD_EXPIRED_FLAG
2891         };
2892         NTSTATUS status;
2893         struct dcerpc_pipe *np = NULL;
2894
2895         if (torture_setting_bool(tctx, "samba3", false)) {
2896                 delay = 1000000;
2897                 printf("Samba3 has second granularity, setting delay to: %d\n",
2898                         delay);
2899         }
2900
2901         status = torture_rpc_connection(tctx, &np, &ndr_table_netlogon);
2902         if (!NT_STATUS_IS_OK(status)) {
2903                 return false;
2904         }
2905
2906         /* set to 1 to enable testing for all possible opcode
2907            (SetUserInfo, SetUserInfo2, QueryUserInfo, QueryUserInfo2)
2908            combinations */
2909 #if 0
2910 #define TEST_SET_LEVELS 1
2911 #define TEST_QUERY_LEVELS 1
2912 #endif
2913         for (l=0; l<ARRAY_SIZE(levels); l++) {
2914         for (z=0; z<ARRAY_SIZE(nonzeros); z++) {
2915         for (f=0; f<ARRAY_SIZE(fields_present); f++) {
2916 #ifdef TEST_SET_LEVELS
2917         for (s=0; s<ARRAY_SIZE(set_levels); s++) {
2918 #endif
2919 #ifdef TEST_QUERY_LEVELS
2920         for (q=0; q<ARRAY_SIZE(query_levels); q++) {
2921 #endif
2922                 NTTIME pwdlastset_old = 0;
2923                 NTTIME pwdlastset_new = 0;
2924                 bool matched_expected_error = false;
2925                 NTSTATUS expected_samlogon_result = NT_STATUS_ACCOUNT_DISABLED;
2926
2927                 torture_comment(tctx, "------------------------------\n"
2928                                 "Testing pwdLastSet attribute for flags: 0x%08x "
2929                                 "(s: %d (l: %d), q: %d)\n",
2930                                 acct_flags, s, levels[l], q);
2931
2932                 switch (levels[l]) {
2933                 case 21:
2934                 case 23:
2935                 case 25:
2936                         if (!((fields_present[f] & SAMR_FIELD_NT_PASSWORD_PRESENT) ||
2937                               (fields_present[f] & SAMR_FIELD_LM_PASSWORD_PRESENT))) {
2938                                 expected_samlogon_result = NT_STATUS_WRONG_PASSWORD;
2939                         }
2940                         break;
2941                 }
2942
2943
2944                 /* set #1 */
2945
2946                 /* set a password and force password change (pwdlastset 0) by
2947                  * setting the password expired flag to a non-0 value */
2948
2949                 if (!test_SetPassword_level(p, np, tctx, handle,
2950                                             levels[l],
2951                                             fields_present[f],
2952                                             nonzeros[z],
2953                                             &matched_expected_error,
2954                                             set_levels[s],
2955                                             acct_name,
2956                                             password,
2957                                             machine_credentials,
2958                                             query_levels[q],
2959                                             &pwdlastset_old,
2960                                             expected_samlogon_result)) {
2961                         ret = false;
2962                 }
2963
2964                 if (matched_expected_error == true) {
2965                         /* skipping on expected failure */
2966                         continue;
2967                 }
2968
2969                 /* pwdlastset must be 0 afterwards, except for a level 21, 23 and 25
2970                  * set without the SAMR_FIELD_EXPIRED_FLAG */
2971
2972                 switch (levels[l]) {
2973                 case 21:
2974                 case 23:
2975                 case 25:
2976                         if ((pwdlastset_new != 0) &&
2977                             !(fields_present[f] & SAMR_FIELD_EXPIRED_FLAG)) {
2978                                 torture_comment(tctx, "not considering a non-0 "
2979                                         "pwdLastSet as a an error as the "
2980                                         "SAMR_FIELD_EXPIRED_FLAG has not "
2981                                         "been set\n");
2982                                 break;
2983                         }
2984                 default:
2985                         if (pwdlastset_new != 0) {
2986                                 torture_warning(tctx, "pwdLastSet test failed: "
2987                                         "expected pwdLastSet 0 but got %lld\n",
2988                                         pwdlastset_old);
2989                                 ret = false;
2990                         }
2991                         break;
2992                 }
2993
2994                 switch (levels[l]) {
2995                 case 21:
2996                 case 23:
2997                 case 25:
2998                         if (((fields_present[f] & SAMR_FIELD_NT_PASSWORD_PRESENT) ||
2999                              (fields_present[f] & SAMR_FIELD_LM_PASSWORD_PRESENT)) &&
3000                              (pwdlastset_old > 0) && (pwdlastset_new > 0) &&
3001                              (pwdlastset_old >= pwdlastset_new)) {
3002                                 torture_warning(tctx, "pwdlastset not increasing\n");
3003                                 ret = false;
3004                         }
3005                         break;
3006                 default:
3007                         if ((pwdlastset_old > 0) && (pwdlastset_new > 0) &&
3008                             (pwdlastset_old >= pwdlastset_new)) {
3009                                 torture_warning(tctx, "pwdlastset not increasing\n");
3010                                 ret = false;
3011                         }
3012                         break;
3013                 }
3014
3015                 usleep(delay);
3016
3017                 /* set #2 */
3018
3019                 /* set a password, pwdlastset needs to get updated (increased
3020                  * value), password_expired value used here is 0 */
3021
3022                 if (!test_SetPassword_level(p, np, tctx, handle,
3023                                             levels[l],
3024                                             fields_present[f],
3025                                             0,
3026                                             &matched_expected_error,
3027                                             set_levels[s],
3028                                             acct_name,
3029                                             password,
3030                                             machine_credentials,
3031                                             query_levels[q],
3032                                             &pwdlastset_new,
3033                                             expected_samlogon_result)) {
3034                         ret = false;
3035                 }
3036
3037                 /* when a password has been changed, pwdlastset must not be 0 afterwards
3038                  * and must be larger then the old value */
3039
3040                 switch (levels[l]) {
3041                 case 21:
3042                 case 23:
3043                 case 25:
3044
3045                         /* SAMR_FIELD_EXPIRED_FLAG has not been set and no
3046                          * password has been changed, old and new pwdlastset
3047                          * need to be the same value */
3048
3049                         if (!(fields_present[f] & SAMR_FIELD_EXPIRED_FLAG) &&
3050                             !((fields_present[f] & SAMR_FIELD_NT_PASSWORD_PRESENT) ||
3051                               (fields_present[f] & SAMR_FIELD_LM_PASSWORD_PRESENT)))
3052                         {
3053                                 torture_assert_int_equal(tctx, pwdlastset_old,
3054                                         pwdlastset_new, "pwdlastset must be equal");
3055                                 break;
3056                         }
3057                 default:
3058                         if (pwdlastset_old >= pwdlastset_new) {
3059                                 torture_warning(tctx, "pwdLastSet test failed: "
3060                                         "expected last pwdlastset (%lld) < new pwdlastset (%lld)\n",
3061                                         pwdlastset_old, pwdlastset_new);
3062                                 ret = false;
3063                         }
3064                         if (pwdlastset_new == 0) {
3065                                 torture_warning(tctx, "pwdLastSet test failed: "
3066                                         "expected non-0 pwdlastset, got: %lld\n",
3067                                         pwdlastset_new);
3068                                 ret = false;
3069                         }
3070                 }
3071
3072                 switch (levels[l]) {
3073                 case 21:
3074                 case 23:
3075                 case 25:
3076                         if (((fields_present[f] & SAMR_FIELD_NT_PASSWORD_PRESENT) ||
3077                              (fields_present[f] & SAMR_FIELD_LM_PASSWORD_PRESENT)) &&
3078                              (pwdlastset_old > 0) && (pwdlastset_new > 0) &&
3079                              (pwdlastset_old >= pwdlastset_new)) {
3080                                 torture_warning(tctx, "pwdlastset not increasing\n");
3081                                 ret = false;
3082                         }
3083                         break;
3084                 default:
3085                         if ((pwdlastset_old > 0) && (pwdlastset_new > 0) &&
3086                             (pwdlastset_old >= pwdlastset_new)) {
3087                                 torture_warning(tctx, "pwdlastset not increasing\n");
3088                                 ret = false;
3089                         }
3090                         break;
3091                 }
3092
3093                 pwdlastset_old = pwdlastset_new;
3094
3095                 usleep(delay);
3096
3097                 /* set #2b */
3098
3099                 /* set a password, pwdlastset needs to get updated (increased
3100                  * value), password_expired value used here is 0 */
3101
3102                 if (!test_SetPassword_level(p, np, tctx, handle,
3103                                             levels[l],
3104                                             fields_present[f],
3105                                             0,
3106                                             &matched_expected_error,
3107                                             set_levels[s],
3108                                             acct_name,
3109                                             password,
3110                                             machine_credentials,
3111                                             query_levels[q],
3112                                             &pwdlastset_new,
3113                                             expected_samlogon_result)) {
3114                         ret = false;
3115                 }
3116
3117                 /* when a password has been changed, pwdlastset must not be 0 afterwards
3118                  * and must be larger then the old value */
3119
3120                 switch (levels[l]) {
3121                 case 21:
3122                 case 23:
3123                 case 25:
3124
3125                         /* if no password has been changed, old and new pwdlastset
3126                          * need to be the same value */
3127
3128                         if (!((fields_present[f] & SAMR_FIELD_NT_PASSWORD_PRESENT) ||
3129                               (fields_present[f] & SAMR_FIELD_LM_PASSWORD_PRESENT)))
3130                         {
3131                                 torture_assert_int_equal(tctx, pwdlastset_old,
3132                                         pwdlastset_new, "pwdlastset must be equal");
3133                                 break;
3134                         }
3135                 default:
3136                         if (pwdlastset_old >= pwdlastset_new) {
3137                                 torture_warning(tctx, "pwdLastSet test failed: "
3138                                         "expected last pwdlastset (%lld) < new pwdlastset (%lld)\n",
3139                                         pwdlastset_old, pwdlastset_new);
3140                                 ret = false;
3141                         }
3142                         if (pwdlastset_new == 0) {
3143                                 torture_warning(tctx, "pwdLastSet test failed: "
3144                                         "expected non-0 pwdlastset, got: %lld\n",
3145                                         pwdlastset_new);
3146                                 ret = false;
3147                         }
3148                 }
3149
3150                 /* set #3 */
3151
3152                 /* set a password and force password change (pwdlastset 0) by
3153                  * setting the password expired flag to a non-0 value */
3154
3155                 if (!test_SetPassword_level(p, np, tctx, handle,
3156                                             levels[l],
3157                                             fields_present[f],
3158                                             nonzeros[z],
3159                                             &matched_expected_error,
3160                                             set_levels[s],
3161                                             acct_name,
3162                                             password,
3163                                             machine_credentials,
3164                                             query_levels[q],
3165                                             &pwdlastset_new,
3166                                             expected_samlogon_result)) {
3167                         ret = false;
3168                 }
3169
3170                 /* pwdlastset must be 0 afterwards, except for a level 21, 23 and 25
3171                  * set without the SAMR_FIELD_EXPIRED_FLAG */
3172
3173                 switch (levels[l]) {
3174                 case 21:
3175                 case 23:
3176                 case 25:
3177                         if ((pwdlastset_new != 0) &&
3178                             !(fields_present[f] & SAMR_FIELD_EXPIRED_FLAG)) {
3179                                 torture_comment(tctx, "not considering a non-0 "
3180                                         "pwdLastSet as a an error as the "
3181                                         "SAMR_FIELD_EXPIRED_FLAG has not "
3182                                         "been set\n");
3183                                 break;
3184                         }
3185
3186                         /* SAMR_FIELD_EXPIRED_FLAG has not been set and no
3187                          * password has been changed, old and new pwdlastset
3188                          * need to be the same value */
3189
3190                         if (!(fields_present[f] & SAMR_FIELD_EXPIRED_FLAG) &&
3191                             !((fields_present[f] & SAMR_FIELD_NT_PASSWORD_PRESENT) ||
3192                               (fields_present[f] & SAMR_FIELD_LM_PASSWORD_PRESENT)))
3193                         {
3194                                 torture_assert_int_equal(tctx, pwdlastset_old,
3195                                         pwdlastset_new, "pwdlastset must be equal");
3196                                 break;
3197                         }
3198                 default:
3199
3200                         if (pwdlastset_old == pwdlastset_new) {
3201                                 torture_warning(tctx, "pwdLastSet test failed: "
3202                                         "expected last pwdlastset (%lld) != new pwdlastset (%lld)\n",
3203                                         pwdlastset_old, pwdlastset_new);
3204                                 ret = false;
3205                         }
3206
3207                         if (pwdlastset_new != 0) {
3208                                 torture_warning(tctx, "pwdLastSet test failed: "
3209                                         "expected pwdLastSet 0, got %lld\n",
3210                                         pwdlastset_old);
3211                                 ret = false;
3212                         }
3213                         break;
3214                 }
3215
3216                 switch (levels[l]) {
3217                 case 21:
3218                 case 23:
3219                 case 25:
3220                         if (((fields_present[f] & SAMR_FIELD_NT_PASSWORD_PRESENT) ||
3221                              (fields_present[f] & SAMR_FIELD_LM_PASSWORD_PRESENT)) &&
3222                              (pwdlastset_old > 0) && (pwdlastset_new > 0) &&
3223                              (pwdlastset_old >= pwdlastset_new)) {
3224                                 torture_warning(tctx, "pwdlastset not increasing\n");
3225                                 ret = false;
3226                         }
3227                         break;
3228                 default:
3229                         if ((pwdlastset_old > 0) && (pwdlastset_new > 0) &&
3230                             (pwdlastset_old >= pwdlastset_new)) {
3231                                 torture_warning(tctx, "pwdlastset not increasing\n");
3232                                 ret = false;
3233                         }
3234                         break;
3235                 }
3236
3237                 /* if the level we are testing does not have a fields_present
3238                  * field, skip all fields present tests by setting f to to
3239                  * arraysize */
3240                 switch (levels[l]) {
3241                 case 18:
3242                 case 24:
3243                 case 26:
3244                         f = ARRAY_SIZE(fields_present);
3245                         break;
3246                 }
3247
3248 #ifdef TEST_QUERY_LEVELS
3249         }
3250 #endif
3251 #ifdef TEST_SET_LEVELS
3252         }
3253 #endif
3254         } /* fields present */
3255         } /* nonzeros */
3256         } /* levels */
3257
3258 #undef TEST_SET_LEVELS
3259 #undef TEST_QUERY_LEVELS
3260
3261         return ret;
3262 }
3263
3264 static bool test_user_ops(struct dcerpc_pipe *p,
3265                           struct torture_context *tctx,
3266                           struct policy_handle *user_handle,
3267                           struct policy_handle *domain_handle,
3268                           uint32_t base_acct_flags,
3269                           const char *base_acct_name, enum torture_samr_choice which_ops,
3270                           struct cli_credentials *machine_credentials)
3271 {
3272         char *password = NULL;
3273         struct samr_QueryUserInfo q;
3274         union samr_UserInfo *info;
3275         NTSTATUS status;
3276
3277         bool ret = true;
3278         int i;
3279         uint32_t rid;
3280         const uint32_t password_fields[] = {
3281                 SAMR_FIELD_NT_PASSWORD_PRESENT,
3282                 SAMR_FIELD_LM_PASSWORD_PRESENT,
3283                 SAMR_FIELD_NT_PASSWORD_PRESENT | SAMR_FIELD_LM_PASSWORD_PRESENT,
3284                 0
3285         };
3286
3287         status = test_LookupName(p, tctx, domain_handle, base_acct_name, &rid);
3288         if (!NT_STATUS_IS_OK(status)) {
3289                 ret = false;
3290         }
3291
3292         switch (which_ops) {
3293         case TORTURE_SAMR_USER_ATTRIBUTES:
3294                 if (!test_QuerySecurity(p, tctx, user_handle)) {
3295                         ret = false;
3296                 }
3297
3298                 if (!test_QueryUserInfo(p, tctx, user_handle)) {
3299                         ret = false;
3300                 }
3301
3302                 if (!test_QueryUserInfo2(p, tctx, user_handle)) {
3303                         ret = false;
3304                 }
3305
3306                 if (!test_SetUserInfo(p, tctx, user_handle, base_acct_flags,
3307                                       base_acct_name)) {
3308                         ret = false;
3309                 }
3310
3311                 if (!test_GetUserPwInfo(p, tctx, user_handle)) {
3312                         ret = false;
3313                 }
3314
3315                 if (!test_TestPrivateFunctionsUser(p, tctx, user_handle)) {
3316                         ret = false;
3317                 }
3318
3319                 if (!test_SetUserPass(p, tctx, user_handle, &password)) {
3320                         ret = false;
3321                 }
3322                 break;
3323         case TORTURE_SAMR_PASSWORDS:
3324                 if (base_acct_flags & (ACB_WSTRUST|ACB_DOMTRUST|ACB_SVRTRUST)) {
3325                         char simple_pass[9];
3326                         char *v = generate_random_str(tctx, 1);
3327
3328                         ZERO_STRUCT(simple_pass);
3329                         memset(simple_pass, *v, sizeof(simple_pass) - 1);
3330
3331                         printf("Testing machine account password policy rules\n");
3332
3333                         /* Workstation trust accounts don't seem to need to honour password quality policy */
3334                         if (!test_SetUserPassEx(p, tctx, user_handle, true, &password)) {
3335                                 ret = false;
3336                         }
3337
3338                         if (!test_ChangePasswordUser2(p, tctx, base_acct_name, &password, simple_pass, false)) {
3339                                 ret = false;
3340                         }
3341
3342                         /* reset again, to allow another 'user' password change */
3343                         if (!test_SetUserPassEx(p, tctx, user_handle, true, &password)) {
3344                                 ret = false;
3345                         }
3346
3347                         /* Try a 'short' password */
3348                         if (!test_ChangePasswordUser2(p, tctx, base_acct_name, &password, samr_rand_pass(tctx, 4), false)) {
3349                                 ret = false;
3350                         }
3351
3352                         /* Try a compleatly random password */
3353                         if (!test_ChangePasswordRandomBytes(p, tctx, base_acct_name, user_handle, &password)) {
3354                                 ret = false;
3355                         }
3356                 }
3357
3358                 for (i = 0; password_fields[i]; i++) {
3359                         if (!test_SetUserPass_23(p, tctx, user_handle, password_fields[i], &password)) {
3360                                 ret = false;
3361                         }
3362
3363                         /* check it was set right */
3364                         if (!test_ChangePasswordUser3(p, tctx, base_acct_name, 0, &password, NULL, 0, false)) {
3365                                 ret = false;
3366                         }
3367                 }
3368
3369                 for (i = 0; password_fields[i]; i++) {
3370                         if (!test_SetUserPass_25(p, tctx, user_handle, password_fields[i], &password)) {
3371                                 ret = false;
3372                         }
3373
3374                         /* check it was set right */
3375                         if (!test_ChangePasswordUser3(p, tctx, base_acct_name, 0, &password, NULL, 0, false)) {
3376                                 ret = false;
3377                         }
3378                 }
3379
3380                 if (!test_SetUserPassEx(p, tctx, user_handle, false, &password)) {
3381                         ret = false;
3382                 }
3383
3384                 if (!test_ChangePassword(p, tctx, base_acct_name, domain_handle, &password)) {
3385                         ret = false;
3386                 }
3387
3388                 if (torture_setting_bool(tctx, "samba4", false)) {
3389                         printf("skipping Set Password level 18 and 21 against Samba4\n");
3390                 } else {
3391
3392                         if (!test_SetUserPass_18(p, tctx, user_handle, &password)) {
3393                                 ret = false;
3394                         }
3395
3396                         if (!test_ChangePasswordUser3(p, tctx, base_acct_name, 0, &password, NULL, 0, false)) {
3397                                 ret = false;
3398                         }
3399
3400                         for (i = 0; password_fields[i]; i++) {
3401
3402                                 if (password_fields[i] == SAMR_FIELD_LM_PASSWORD_PRESENT) {
3403                                         /* we need to skip as that would break
3404                                          * the ChangePasswordUser3 verify */
3405                                         continue;
3406                                 }
3407
3408                                 if (!test_SetUserPass_21(p, tctx, user_handle, password_fields[i], &password)) {
3409                                         ret = false;
3410                                 }
3411
3412                                 /* check it was set right */
3413                                 if (!test_ChangePasswordUser3(p, tctx, base_acct_name, 0, &password, NULL, 0, false)) {
3414                                         ret = false;
3415                                 }
3416                         }
3417                 }
3418
3419                 q.in.user_handle = user_handle;
3420                 q.in.level = 5;
3421                 q.out.info = &info;
3422
3423                 status = dcerpc_samr_QueryUserInfo(p, tctx, &q);
3424                 if (!NT_STATUS_IS_OK(status)) {
3425                         printf("QueryUserInfo level %u failed - %s\n",
3426                                q.in.level, nt_errstr(status));
3427                         ret = false;
3428                 } else {
3429                         uint32_t expected_flags = (base_acct_flags | ACB_PWNOTREQ | ACB_DISABLED);
3430                         if ((info->info5.acct_flags) != expected_flags) {
3431                                 printf("QuerUserInfo level 5 failed, it returned 0x%08x when we expected flags of 0x%08x\n",
3432                                        info->info5.acct_flags,
3433                                        expected_flags);
3434                                 /* FIXME: GD */
3435                                 if (!torture_setting_bool(tctx, "samba3", false)) {
3436                                         ret = false;
3437                                 }
3438                         }
3439                         if (info->info5.rid != rid) {
3440                                 printf("QuerUserInfo level 5 failed, it returned %u when we expected rid of %u\n",
3441                                        info->info5.rid, rid);
3442
3443                         }
3444                 }
3445
3446                 break;
3447
3448         case TORTURE_SAMR_PASSWORDS_PWDLASTSET:
3449
3450                 /* test last password change timestamp behaviour */
3451                 if (!test_SetPassword_pwdlastset(p, tctx, base_acct_flags,
3452                                                  base_acct_name,
3453                                                  user_handle, &password,
3454                                                  machine_credentials)) {
3455                         ret = false;
3456                 }
3457
3458                 if (ret == true) {
3459                         torture_comment(tctx, "pwdLastSet test succeeded\n");
3460                 } else {
3461                         torture_warning(tctx, "pwdLastSet test failed\n");
3462                 }
3463
3464                 break;
3465
3466         case TORTURE_SAMR_OTHER:
3467                 /* We just need the account to exist */
3468                 break;
3469         }
3470         return ret;
3471 }
3472
3473 static bool test_alias_ops(struct dcerpc_pipe *p, struct torture_context *tctx,
3474                            struct policy_handle *alias_handle,
3475                            const struct dom_sid *domain_sid)
3476 {
3477         bool ret = true;
3478
3479         if (!test_QuerySecurity(p, tctx, alias_handle)) {
3480                 ret = false;
3481         }
3482
3483         if (!test_QueryAliasInfo(p, tctx, alias_handle)) {
3484                 ret = false;
3485         }
3486
3487         if (!test_SetAliasInfo(p, tctx, alias_handle)) {
3488                 ret = false;
3489         }
3490
3491         if (!test_AddMemberToAlias(p, tctx, alias_handle, domain_sid)) {
3492                 ret = false;
3493         }
3494
3495         if (torture_setting_bool(tctx, "samba4", false)) {
3496                 printf("skipping MultipleMembers Alias tests against Samba4\n");
3497                 return ret;
3498         }
3499
3500         if (!test_AddMultipleMembersToAlias(p, tctx, alias_handle)) {
3501                 ret = false;
3502         }
3503
3504         return ret;
3505 }
3506
3507
3508 static bool test_DeleteUser(struct dcerpc_pipe *p, struct torture_context *tctx,
3509                                      struct policy_handle *user_handle)
3510 {
3511         struct samr_DeleteUser d;
3512         NTSTATUS status;
3513         torture_comment(tctx, "Testing DeleteUser\n");
3514
3515         d.in.user_handle = user_handle;
3516         d.out.user_handle = user_handle;
3517
3518         status = dcerpc_samr_DeleteUser(p, tctx, &d);
3519         torture_assert_ntstatus_ok(tctx, status, "DeleteUser");
3520
3521         return true;
3522 }
3523
3524 bool test_DeleteUser_byname(struct dcerpc_pipe *p, TALLOC_CTX *mem_ctx,
3525                             struct policy_handle *handle, const char *name)
3526 {
3527         NTSTATUS status;
3528         struct samr_DeleteUser d;
3529         struct policy_handle user_handle;
3530         uint32_t rid;
3531
3532         status = test_LookupName(p, mem_ctx, handle, name, &rid);
3533         if (!NT_STATUS_IS_OK(status)) {
3534                 goto failed;
3535         }
3536
3537         status = test_OpenUser_byname(p, mem_ctx, handle, name, &user_handle);
3538         if (!NT_STATUS_IS_OK(status)) {
3539                 goto failed;
3540         }
3541
3542         d.in.user_handle = &user_handle;
3543         d.out.user_handle = &user_handle;
3544         status = dcerpc_samr_DeleteUser(p, mem_ctx, &d);
3545         if (!NT_STATUS_IS_OK(status)) {
3546                 goto failed;
3547         }
3548
3549         return true;
3550
3551 failed:
3552         printf("DeleteUser_byname(%s) failed - %s\n", name, nt_errstr(status));
3553         return false;
3554 }
3555
3556
3557 static bool test_DeleteGroup_byname(struct dcerpc_pipe *p, TALLOC_CTX *mem_ctx,
3558                                     struct policy_handle *handle, const char *name)
3559 {
3560         NTSTATUS status;
3561         struct samr_OpenGroup r;
3562         struct samr_DeleteDomainGroup d;
3563         struct policy_handle group_handle;
3564         uint32_t rid;
3565
3566         status = test_LookupName(p, mem_ctx, handle, name, &rid);
3567         if (!NT_STATUS_IS_OK(status)) {
3568                 goto failed;
3569         }
3570
3571         r.in.domain_handle = handle;
3572         r.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
3573         r.in.rid = rid;
3574         r.out.group_handle = &group_handle;
3575         status = dcerpc_samr_OpenGroup(p, mem_ctx, &r);
3576         if (!NT_STATUS_IS_OK(status)) {
3577                 goto failed;
3578         }
3579
3580         d.in.group_handle = &group_handle;
3581         d.out.group_handle = &group_handle;
3582         status = dcerpc_samr_DeleteDomainGroup(p, mem_ctx, &d);
3583         if (!NT_STATUS_IS_OK(status)) {
3584                 goto failed;
3585         }
3586
3587         return true;
3588
3589 failed:
3590         printf("DeleteGroup_byname(%s) failed - %s\n", name, nt_errstr(status));
3591         return false;
3592 }
3593
3594
3595 static bool test_DeleteAlias_byname(struct dcerpc_pipe *p, TALLOC_CTX *mem_ctx,
3596                                    struct policy_handle *domain_handle, const char *name)
3597 {
3598         NTSTATUS status;
3599         struct samr_OpenAlias r;
3600         struct samr_DeleteDomAlias d;
3601         struct policy_handle alias_handle;
3602         uint32_t rid;
3603
3604         printf("testing DeleteAlias_byname\n");
3605
3606         status = test_LookupName(p, mem_ctx, domain_handle, name, &rid);
3607         if (!NT_STATUS_IS_OK(status)) {
3608                 goto failed;
3609         }
3610
3611         r.in.domain_handle = domain_handle;
3612         r.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
3613         r.in.rid = rid;
3614         r.out.alias_handle = &alias_handle;
3615         status = dcerpc_samr_OpenAlias(p, mem_ctx, &r);
3616         if (!NT_STATUS_IS_OK(status)) {
3617                 goto failed;
3618         }
3619
3620         d.in.alias_handle = &alias_handle;
3621         d.out.alias_handle = &alias_handle;
3622         status = dcerpc_samr_DeleteDomAlias(p, mem_ctx, &d);
3623         if (!NT_STATUS_IS_OK(status)) {
3624                 goto failed;
3625         }
3626
3627         return true;
3628
3629 failed:
3630         printf("DeleteAlias_byname(%s) failed - %s\n", name, nt_errstr(status));
3631         return false;
3632 }
3633
3634 static bool test_DeleteAlias(struct dcerpc_pipe *p, TALLOC_CTX *mem_ctx,
3635                                      struct policy_handle *alias_handle)
3636 {
3637         struct samr_DeleteDomAlias d;
3638         NTSTATUS status;
3639         bool ret = true;
3640         printf("Testing DeleteAlias\n");
3641
3642         d.in.alias_handle = alias_handle;
3643         d.out.alias_handle = alias_handle;
3644
3645         status = dcerpc_samr_DeleteDomAlias(p, mem_ctx, &d);
3646         if (!NT_STATUS_IS_OK(status)) {
3647                 printf("DeleteAlias failed - %s\n", nt_errstr(status));
3648                 ret = false;
3649         }
3650
3651         return ret;
3652 }
3653
3654 static bool test_CreateAlias(struct dcerpc_pipe *p, struct torture_context *tctx,
3655                             struct policy_handle *domain_handle,
3656                              struct policy_handle *alias_handle,
3657                              const struct dom_sid *domain_sid)
3658 {
3659         NTSTATUS status;
3660         struct samr_CreateDomAlias r;
3661         struct lsa_String name;
3662         uint32_t rid;
3663         bool ret = true;
3664
3665         init_lsa_String(&name, TEST_ALIASNAME);
3666         r.in.domain_handle = domain_handle;
3667         r.in.alias_name = &name;
3668         r.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
3669         r.out.alias_handle = alias_handle;
3670         r.out.rid = &rid;
3671
3672         printf("Testing CreateAlias (%s)\n", r.in.alias_name->string);
3673
3674         status = dcerpc_samr_CreateDomAlias(p, tctx, &r);
3675
3676         if (dom_sid_equal(domain_sid, dom_sid_parse_talloc(tctx, SID_BUILTIN))) {
3677                 if (NT_STATUS_EQUAL(status, NT_STATUS_ACCESS_DENIED)) {
3678                         printf("Server correctly refused create of '%s'\n", r.in.alias_name->string);
3679                         return true;
3680                 } else {
3681                         printf("Server should have refused create of '%s', got %s instead\n", r.in.alias_name->string,
3682                                nt_errstr(status));
3683                         return false;
3684                 }
3685         }
3686
3687         if (NT_STATUS_EQUAL(status, NT_STATUS_ALIAS_EXISTS)) {
3688                 if (!test_DeleteAlias_byname(p, tctx, domain_handle, r.in.alias_name->string)) {
3689                         return false;
3690                 }
3691                 status = dcerpc_samr_CreateDomAlias(p, tctx, &r);
3692         }
3693
3694         if (!NT_STATUS_IS_OK(status)) {
3695                 printf("CreateAlias failed - %s\n", nt_errstr(status));
3696                 return false;
3697         }
3698
3699         if (!test_alias_ops(p, tctx, alias_handle, domain_sid)) {
3700                 ret = false;
3701         }
3702
3703         return ret;
3704 }
3705
3706 static bool test_ChangePassword(struct dcerpc_pipe *p, TALLOC_CTX *mem_ctx,
3707                                 const char *acct_name,
3708                                 struct policy_handle *domain_handle, char **password)
3709 {
3710         bool ret = true;
3711
3712         if (!*password) {
3713                 return false;
3714         }
3715
3716         if (!test_ChangePasswordUser(p, mem_ctx, acct_name, domain_handle, password)) {
3717                 ret = false;
3718         }
3719
3720         if (!test_ChangePasswordUser2(p, mem_ctx, acct_name, password, 0, true)) {
3721                 ret = false;
3722         }
3723
3724         if (!test_OemChangePasswordUser2(p, mem_ctx, acct_name, domain_handle, password)) {
3725                 ret = false;
3726         }
3727
3728         /* test what happens when setting the old password again */
3729         if (!test_ChangePasswordUser3(p, mem_ctx, acct_name, 0, password, *password, 0, true)) {
3730                 ret = false;
3731         }
3732
3733         {
3734                 char simple_pass[9];
3735                 char *v = generate_random_str(mem_ctx, 1);
3736
3737                 ZERO_STRUCT(simple_pass);
3738                 memset(simple_pass, *v, sizeof(simple_pass) - 1);
3739
3740                 /* test what happens when picking a simple password */
3741                 if (!test_ChangePasswordUser3(p, mem_ctx, acct_name, 0, password, simple_pass, 0, true)) {
3742                         ret = false;
3743                 }
3744         }
3745
3746         /* set samr_SetDomainInfo level 1 with min_length 5 */
3747         {
3748                 struct samr_QueryDomainInfo r;
3749                 union samr_DomainInfo *info = NULL;
3750                 struct samr_SetDomainInfo s;
3751                 uint16_t len_old, len;
3752                 uint32_t pwd_prop_old;
3753                 int64_t min_pwd_age_old;
3754                 NTSTATUS status;
3755
3756                 len = 5;
3757
3758                 r.in.domain_handle = domain_handle;
3759                 r.in.level = 1;
3760                 r.out.info = &info;
3761
3762                 printf("testing samr_QueryDomainInfo level 1\n");
3763                 status = dcerpc_samr_QueryDomainInfo(p, mem_ctx, &r);
3764                 if (!NT_STATUS_IS_OK(status)) {
3765                         return false;
3766                 }
3767
3768                 s.in.domain_handle = domain_handle;
3769                 s.in.level = 1;
3770                 s.in.info = info;
3771
3772                 /* remember the old min length, so we can reset it */
3773                 len_old = s.in.info->info1.min_password_length;
3774                 s.in.info->info1.min_password_length = len;
3775                 pwd_prop_old = s.in.info->info1.password_properties;
3776                 /* turn off password complexity checks for this test */
3777                 s.in.info->info1.password_properties &= ~DOMAIN_PASSWORD_COMPLEX;
3778
3779                 min_pwd_age_old = s.in.info->info1.min_password_age;
3780                 s.in.info->info1.min_password_age = 0;
3781
3782                 printf("testing samr_SetDomainInfo level 1\n");
3783                 status = dcerpc_samr_SetDomainInfo(p, mem_ctx, &s);
3784                 if (!NT_STATUS_IS_OK(status)) {
3785                         return false;
3786                 }
3787
3788                 printf("calling test_ChangePasswordUser3 with too short password\n");
3789
3790                 if (!test_ChangePasswordUser3(p, mem_ctx, acct_name, len - 1, password, NULL, 0, true)) {
3791                         ret = false;
3792                 }
3793
3794                 s.in.info->info1.min_password_length = len_old;
3795                 s.in.info->info1.password_properties = pwd_prop_old;
3796                 s.in.info->info1.min_password_age = min_pwd_age_old;
3797
3798                 printf("testing samr_SetDomainInfo level 1\n");
3799                 status = dcerpc_samr_SetDomainInfo(p, mem_ctx, &s);
3800                 if (!NT_STATUS_IS_OK(status)) {
3801                         return false;
3802                 }
3803
3804         }
3805
3806         {
3807                 NTSTATUS status;
3808                 struct samr_OpenUser r;
3809                 struct samr_QueryUserInfo q;
3810                 union samr_UserInfo *info;
3811                 struct samr_LookupNames n;
3812                 struct policy_handle user_handle;
3813                 struct samr_Ids rids, types;
3814
3815                 n.in.domain_handle = domain_handle;
3816                 n.in.num_names = 1;
3817                 n.in.names = talloc_array(mem_ctx, struct lsa_String, 1);
3818                 n.in.names[0].string = acct_name;
3819                 n.out.rids = &rids;
3820                 n.out.types = &types;
3821
3822                 status = dcerpc_samr_LookupNames(p, mem_ctx, &n);
3823                 if (!NT_STATUS_IS_OK(status)) {
3824                         printf("LookupNames failed - %s\n", nt_errstr(status));
3825                         return false;
3826                 }
3827
3828                 r.in.domain_handle = domain_handle;
3829                 r.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
3830                 r.in.rid = n.out.rids->ids[0];
3831                 r.out.user_handle = &user_handle;
3832
3833                 status = dcerpc_samr_OpenUser(p, mem_ctx, &r);
3834                 if (!NT_STATUS_IS_OK(status)) {
3835                         printf("OpenUser(%u) failed - %s\n", n.out.rids->ids[0], nt_errstr(status));
3836                         return false;
3837                 }
3838
3839                 q.in.user_handle = &user_handle;
3840                 q.in.level = 5;
3841                 q.out.info = &info;
3842
3843                 status = dcerpc_samr_QueryUserInfo(p, mem_ctx, &q);
3844                 if (!NT_STATUS_IS_OK(status)) {
3845                         printf("QueryUserInfo failed - %s\n", nt_errstr(status));
3846                         return false;
3847                 }
3848
3849                 printf("calling test_ChangePasswordUser3 with too early password change\n");
3850
3851                 if (!test_ChangePasswordUser3(p, mem_ctx, acct_name, 0, password, NULL,
3852                                               info->info5.last_password_change, true)) {
3853                         ret = false;
3854                 }
3855         }
3856
3857         /* we change passwords twice - this has the effect of verifying
3858            they were changed correctly for the final call */
3859         if (!test_ChangePasswordUser3(p, mem_ctx, acct_name, 0, password, NULL, 0, true)) {
3860                 ret = false;
3861         }
3862
3863         if (!test_ChangePasswordUser3(p, mem_ctx, acct_name, 0, password, NULL, 0, true)) {
3864                 ret = false;
3865         }
3866
3867         return ret;
3868 }
3869
3870 static bool test_CreateUser(struct dcerpc_pipe *p, struct torture_context *tctx,
3871                             struct policy_handle *domain_handle,
3872                             struct policy_handle *user_handle_out,
3873                             struct dom_sid *domain_sid,
3874                             enum torture_samr_choice which_ops,
3875                             struct cli_credentials *machine_credentials)
3876 {
3877
3878         TALLOC_CTX *user_ctx;
3879
3880         NTSTATUS status;
3881         struct samr_CreateUser r;
3882         struct samr_QueryUserInfo q;
3883         union samr_UserInfo *info;
3884         struct samr_DeleteUser d;
3885         uint32_t rid;
3886
3887         /* This call creates a 'normal' account - check that it really does */
3888         const uint32_t acct_flags = ACB_NORMAL;
3889         struct lsa_String name;
3890         bool ret = true;
3891
3892         struct policy_handle user_handle;
3893         user_ctx = talloc_named(tctx, 0, "test_CreateUser2 per-user context");
3894         init_lsa_String(&name, TEST_ACCOUNT_NAME);
3895
3896         r.in.domain_handle = domain_handle;
3897         r.in.account_name = &name;
3898         r.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
3899         r.out.user_handle = &user_handle;
3900         r.out.rid = &rid;
3901
3902         printf("Testing CreateUser(%s)\n", r.in.account_name->string);
3903
3904         status = dcerpc_samr_CreateUser(p, user_ctx, &r);
3905
3906         if (dom_sid_equal(domain_sid, dom_sid_parse_talloc(tctx, SID_BUILTIN))) {
3907                 if (NT_STATUS_EQUAL(status, NT_STATUS_ACCESS_DENIED) || NT_STATUS_EQUAL(status, NT_STATUS_INVALID_PARAMETER)) {
3908                         printf("Server correctly refused create of '%s'\n", r.in.account_name->string);
3909                         return true;
3910                 } else {
3911                         printf("Server should have refused create of '%s', got %s instead\n", r.in.account_name->string,
3912                                nt_errstr(status));
3913                         return false;
3914                 }
3915         }
3916
3917         if (NT_STATUS_EQUAL(status, NT_STATUS_USER_EXISTS)) {
3918                 if (!test_DeleteUser_byname(p, user_ctx, domain_handle, r.in.account_name->string)) {
3919                         talloc_free(user_ctx);
3920                         return false;
3921                 }
3922                 status = dcerpc_samr_CreateUser(p, user_ctx, &r);
3923         }
3924         if (!NT_STATUS_IS_OK(status)) {
3925                 talloc_free(user_ctx);
3926                 printf("CreateUser failed - %s\n", nt_errstr(status));
3927                 return false;
3928         } else {
3929                 q.in.user_handle = &user_handle;
3930                 q.in.level = 16;
3931                 q.out.info = &info;
3932
3933                 status = dcerpc_samr_QueryUserInfo(p, user_ctx, &q);
3934                 if (!NT_STATUS_IS_OK(status)) {
3935                         printf("QueryUserInfo level %u failed - %s\n",
3936                                q.in.level, nt_errstr(status));
3937                         ret = false;
3938                 } else {
3939                         if ((info->info16.acct_flags & acct_flags) != acct_flags) {
3940                                 printf("QuerUserInfo level 16 failed, it returned 0x%08x when we expected flags of 0x%08x\n",
3941                                        info->info16.acct_flags,
3942                                        acct_flags);
3943                                 ret = false;
3944                         }
3945                 }
3946
3947                 if (!test_user_ops(p, tctx, &user_handle, domain_handle,
3948                                    acct_flags, name.string, which_ops,
3949                                    machine_credentials)) {
3950                         ret = false;
3951                 }
3952
3953                 if (user_handle_out) {
3954                         *user_handle_out = user_handle;
3955                 } else {
3956                         printf("Testing DeleteUser (createuser test)\n");
3957
3958                         d.in.user_handle = &user_handle;
3959                         d.out.user_handle = &user_handle;
3960
3961                         status = dcerpc_samr_DeleteUser(p, user_ctx, &d);
3962                         if (!NT_STATUS_IS_OK(status)) {
3963                                 printf("DeleteUser failed - %s\n", nt_errstr(status));
3964                                 ret = false;
3965                         }
3966                 }
3967
3968         }
3969
3970         talloc_free(user_ctx);
3971
3972         return ret;
3973 }
3974
3975
3976 static bool test_CreateUser2(struct dcerpc_pipe *p, struct torture_context *tctx,
3977                              struct policy_handle *domain_handle,
3978                              struct dom_sid *domain_sid,
3979                              enum torture_samr_choice which_ops,
3980                              struct cli_credentials *machine_credentials)
3981 {
3982         NTSTATUS status;
3983         struct samr_CreateUser2 r;
3984         struct samr_QueryUserInfo q;
3985         union samr_UserInfo *info;
3986         struct samr_DeleteUser d;
3987         struct policy_handle user_handle;
3988         uint32_t rid;
3989         struct lsa_String name;
3990         bool ret = true;
3991         int i;
3992
3993         struct {
3994                 uint32_t acct_flags;
3995                 const char *account_name;
3996                 NTSTATUS nt_status;
3997         } account_types[] = {
3998                 { ACB_NORMAL, TEST_ACCOUNT_NAME, NT_STATUS_OK },
3999                 { ACB_NORMAL | ACB_DISABLED, TEST_ACCOUNT_NAME, NT_STATUS_INVALID_PARAMETER },
4000                 { ACB_NORMAL | ACB_PWNOEXP, TEST_ACCOUNT_NAME, NT_STATUS_INVALID_PARAMETER },
4001                 { ACB_WSTRUST, TEST_MACHINENAME, NT_STATUS_OK },
4002                 { ACB_WSTRUST | ACB_DISABLED, TEST_MACHINENAME, NT_STATUS_INVALID_PARAMETER },
4003                 { ACB_WSTRUST | ACB_PWNOEXP, TEST_MACHINENAME, NT_STATUS_INVALID_PARAMETER },
4004                 { ACB_SVRTRUST, TEST_MACHINENAME, NT_STATUS_OK },
4005                 { ACB_SVRTRUST | ACB_DISABLED, TEST_MACHINENAME, NT_STATUS_INVALID_PARAMETER },
4006                 { ACB_SVRTRUST | ACB_PWNOEXP, TEST_MACHINENAME, NT_STATUS_INVALID_PARAMETER },
4007                 { ACB_DOMTRUST, TEST_DOMAINNAME, NT_STATUS_OK },
4008                 { ACB_DOMTRUST | ACB_DISABLED, TEST_DOMAINNAME, NT_STATUS_INVALID_PARAMETER },
4009                 { ACB_DOMTRUST | ACB_PWNOEXP, TEST_DOMAINNAME, NT_STATUS_INVALID_PARAMETER },
4010                 { 0, TEST_ACCOUNT_NAME, NT_STATUS_INVALID_PARAMETER },
4011                 { ACB_DISABLED, TEST_ACCOUNT_NAME, NT_STATUS_INVALID_PARAMETER },
4012                 { 0, NULL, NT_STATUS_INVALID_PARAMETER }
4013         };
4014
4015         for (i = 0; account_types[i].account_name; i++) {
4016                 TALLOC_CTX *user_ctx;
4017                 uint32_t acct_flags = account_types[i].acct_flags;
4018                 uint32_t access_granted;
4019                 user_ctx = talloc_named(tctx, 0, "test_CreateUser2 per-user context");
4020                 init_lsa_String(&name, account_types[i].account_name);
4021
4022                 r.in.domain_handle = domain_handle;
4023                 r.in.account_name = &name;
4024                 r.in.acct_flags = acct_flags;
4025                 r.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
4026                 r.out.user_handle = &user_handle;
4027                 r.out.access_granted = &access_granted;
4028                 r.out.rid = &rid;
4029
4030                 printf("Testing CreateUser2(%s, 0x%x)\n", r.in.account_name->string, acct_flags);
4031
4032                 status = dcerpc_samr_CreateUser2(p, user_ctx, &r);
4033
4034                 if (dom_sid_equal(domain_sid, dom_sid_parse_talloc(tctx, SID_BUILTIN))) {
4035                         if (NT_STATUS_EQUAL(status, NT_STATUS_ACCESS_DENIED) || NT_STATUS_EQUAL(status, NT_STATUS_INVALID_PARAMETER)) {
4036                                 printf("Server correctly refused create of '%s'\n", r.in.account_name->string);
4037                                 continue;
4038                         } else {
4039                                 printf("Server should have refused create of '%s', got %s instead\n", r.in.account_name->string,
4040                                        nt_errstr(status));
4041                                 ret = false;
4042                                 continue;
4043                         }
4044                 }
4045
4046                 if (NT_STATUS_EQUAL(status, NT_STATUS_USER_EXISTS)) {
4047                         if (!test_DeleteUser_byname(p, user_ctx, domain_handle, r.in.account_name->string)) {
4048                                 talloc_free(user_ctx);
4049                                 ret = false;
4050                                 continue;
4051                         }
4052                         status = dcerpc_samr_CreateUser2(p, user_ctx, &r);
4053
4054                 }
4055                 if (!NT_STATUS_EQUAL(status, account_types[i].nt_status)) {
4056                         printf("CreateUser2 failed gave incorrect error return - %s (should be %s)\n",
4057                                nt_errstr(status), nt_errstr(account_types[i].nt_status));
4058                         ret = false;
4059                 }
4060
4061                 if (NT_STATUS_IS_OK(status)) {
4062                         q.in.user_handle = &user_handle;
4063                         q.in.level = 5;
4064                         q.out.info = &info;
4065
4066                         status = dcerpc_samr_QueryUserInfo(p, user_ctx, &q);
4067                         if (!NT_STATUS_IS_OK(status)) {
4068                                 printf("QueryUserInfo level %u failed - %s\n",
4069                                        q.in.level, nt_errstr(status));
4070                                 ret = false;
4071                         } else {
4072                                 uint32_t expected_flags = (acct_flags | ACB_PWNOTREQ | ACB_DISABLED);
4073                                 if (acct_flags == ACB_NORMAL) {
4074                                         expected_flags |= ACB_PW_EXPIRED;
4075                                 }
4076                                 if ((info->info5.acct_flags) != expected_flags) {
4077                                         printf("QuerUserInfo level 5 failed, it returned 0x%08x when we expected flags of 0x%08x\n",
4078                                                info->info5.acct_flags,
4079                                                expected_flags);
4080                                         ret = false;
4081                                 }
4082                                 switch (acct_flags) {
4083                                 case ACB_SVRTRUST:
4084                                         if (info->info5.primary_gid != DOMAIN_RID_DCS) {
4085                                                 printf("QuerUserInfo level 5: DC should have had Primary Group %d, got %d\n",
4086                                                        DOMAIN_RID_DCS, info->info5.primary_gid);
4087                                                 ret = false;
4088                                         }
4089                                         break;
4090                                 case ACB_WSTRUST:
4091                                         if (info->info5.primary_gid != DOMAIN_RID_DOMAIN_MEMBERS) {
4092                                                 printf("QuerUserInfo level 5: Domain Member should have had Primary Group %d, got %d\n",
4093                                                        DOMAIN_RID_DOMAIN_MEMBERS, info->info5.primary_gid);
4094                                                 ret = false;
4095                                         }
4096                                         break;
4097                                 case ACB_NORMAL:
4098                                         if (info->info5.primary_gid != DOMAIN_RID_USERS) {
4099                                                 printf("QuerUserInfo level 5: Users should have had Primary Group %d, got %d\n",
4100                                                        DOMAIN_RID_USERS, info->info5.primary_gid);
4101                                                 ret = false;
4102                                         }
4103                                         break;
4104                                 }
4105                         }
4106
4107                         if (!test_user_ops(p, tctx, &user_handle, domain_handle,
4108                                            acct_flags, name.string, which_ops,
4109                                            machine_credentials)) {
4110                                 ret = false;
4111                         }
4112
4113                         printf("Testing DeleteUser (createuser2 test)\n");
4114
4115                         d.in.user_handle = &user_handle;
4116                         d.out.user_handle = &user_handle;
4117
4118                         status = dcerpc_samr_DeleteUser(p, user_ctx, &d);
4119                         if (!NT_STATUS_IS_OK(status)) {
4120                                 printf("DeleteUser failed - %s\n", nt_errstr(status));
4121                                 ret = false;
4122                         }
4123                 }
4124                 talloc_free(user_ctx);
4125         }
4126
4127         return ret;
4128 }
4129
4130 static bool test_QueryAliasInfo(struct dcerpc_pipe *p, TALLOC_CTX *mem_ctx,
4131                                 struct policy_handle *handle)
4132 {
4133         NTSTATUS status;
4134         struct samr_QueryAliasInfo r;
4135         union samr_AliasInfo *info;
4136         uint16_t levels[] = {1, 2, 3};
4137         int i;
4138         bool ret = true;
4139
4140         for (i=0;i<ARRAY_SIZE(levels);i++) {
4141                 printf("Testing QueryAliasInfo level %u\n", levels[i]);
4142
4143                 r.in.alias_handle = handle;
4144                 r.in.level = levels[i];
4145                 r.out.info = &info;
4146
4147                 status = dcerpc_samr_QueryAliasInfo(p, mem_ctx, &r);
4148                 if (!NT_STATUS_IS_OK(status)) {
4149                         printf("QueryAliasInfo level %u failed - %s\n",
4150                                levels[i], nt_errstr(status));
4151                         ret = false;
4152                 }
4153         }
4154
4155         return ret;
4156 }
4157
4158 static bool test_QueryGroupInfo(struct dcerpc_pipe *p, TALLOC_CTX *mem_ctx,
4159                                 struct policy_handle *handle)
4160 {
4161         NTSTATUS status;
4162         struct samr_QueryGroupInfo r;
4163         union samr_GroupInfo *info;
4164         uint16_t levels[] = {1, 2, 3, 4, 5};
4165         int i;
4166         bool ret = true;
4167
4168         for (i=0;i<ARRAY_SIZE(levels);i++) {
4169                 printf("Testing QueryGroupInfo level %u\n", levels[i]);
4170
4171                 r.in.group_handle = handle;
4172                 r.in.level = levels[i];
4173                 r.out.info = &info;
4174
4175                 status = dcerpc_samr_QueryGroupInfo(p, mem_ctx, &r);
4176                 if (!NT_STATUS_IS_OK(status)) {
4177                         printf("QueryGroupInfo level %u failed - %s\n",
4178                                levels[i], nt_errstr(status));
4179                         ret = false;
4180                 }
4181         }
4182
4183         return ret;
4184 }
4185
4186 static bool test_QueryGroupMember(struct dcerpc_pipe *p, TALLOC_CTX *mem_ctx,
4187                                   struct policy_handle *handle)
4188 {
4189         NTSTATUS status;
4190         struct samr_QueryGroupMember r;
4191         struct samr_RidTypeArray *rids = NULL;
4192         bool ret = true;
4193
4194         printf("Testing QueryGroupMember\n");
4195
4196         r.in.group_handle = handle;
4197         r.out.rids = &rids;
4198
4199         status = dcerpc_samr_QueryGroupMember(p, mem_ctx, &r);
4200         if (!NT_STATUS_IS_OK(status)) {
4201                 printf("QueryGroupInfo failed - %s\n", nt_errstr(status));
4202                 ret = false;
4203         }
4204
4205         return ret;
4206 }
4207
4208
4209 static bool test_SetGroupInfo(struct dcerpc_pipe *p, TALLOC_CTX *mem_ctx,
4210                               struct policy_handle *handle)
4211 {
4212         NTSTATUS status;
4213         struct samr_QueryGroupInfo r;
4214         union samr_GroupInfo *info;
4215         struct samr_SetGroupInfo s;
4216         uint16_t levels[] = {1, 2, 3, 4};
4217         uint16_t set_ok[] = {0, 1, 1, 1};
4218         int i;
4219         bool ret = true;
4220
4221         for (i=0;i<ARRAY_SIZE(levels);i++) {
4222                 printf("Testing QueryGroupInfo level %u\n", levels[i]);
4223
4224                 r.in.group_handle = handle;
4225                 r.in.level = levels[i];
4226                 r.out.info = &info;
4227
4228                 status = dcerpc_samr_QueryGroupInfo(p, mem_ctx, &r);
4229                 if (!NT_STATUS_IS_OK(status)) {
4230                         printf("QueryGroupInfo level %u failed - %s\n",
4231                                levels[i], nt_errstr(status));
4232                         ret = false;
4233                 }
4234
4235                 printf("Testing SetGroupInfo level %u\n", levels[i]);
4236
4237                 s.in.group_handle = handle;
4238                 s.in.level = levels[i];
4239                 s.in.info = *r.out.info;
4240
4241 #if 0
4242                 /* disabled this, as it changes the name only from the point of view of samr,
4243                    but leaves the name from the point of view of w2k3 internals (and ldap). This means
4244                    the name is still reserved, so creating the old name fails, but deleting by the old name
4245                    also fails */
4246                 if (s.in.level == 2) {
4247                         init_lsa_String(&s.in.info->string, "NewName");
4248                 }
4249 #endif
4250
4251                 if (s.in.level == 4) {
4252                         init_lsa_String(&s.in.info->description, "test description");
4253                 }
4254
4255                 status = dcerpc_samr_SetGroupInfo(p, mem_ctx, &s);
4256                 if (set_ok[i]) {
4257                         if (!NT_STATUS_IS_OK(status)) {
4258                                 printf("SetGroupInfo level %u failed - %s\n",
4259                                        r.in.level, nt_errstr(status));
4260                                 ret = false;
4261                                 continue;
4262                         }
4263                 } else {
4264                         if (!NT_STATUS_EQUAL(NT_STATUS_INVALID_INFO_CLASS, status)) {
4265                                 printf("SetGroupInfo level %u gave %s - should have been NT_STATUS_INVALID_INFO_CLASS\n",
4266                                        r.in.level, nt_errstr(status));
4267                                 ret = false;
4268                                 continue;
4269                         }
4270                 }
4271         }
4272
4273         return ret;
4274 }
4275
4276 static bool test_QueryUserInfo(struct dcerpc_pipe *p, TALLOC_CTX *mem_ctx,
4277                                struct policy_handle *handle)
4278 {
4279         NTSTATUS status;
4280         struct samr_QueryUserInfo r;
4281         union samr_UserInfo *info;
4282         uint16_t levels[] = {1, 2, 3, 4, 5, 6, 7, 8, 9, 10,
4283                            11, 12, 13, 14, 16, 17, 20, 21};
4284         int i;
4285         bool ret = true;
4286
4287         for (i=0;i<ARRAY_SIZE(levels);i++) {
4288                 printf("Testing QueryUserInfo level %u\n", levels[i]);
4289
4290                 r.in.user_handle = handle;
4291                 r.in.level = levels[i];
4292                 r.out.info = &info;
4293
4294                 status = dcerpc_samr_QueryUserInfo(p, mem_ctx, &r);
4295                 if (!NT_STATUS_IS_OK(status)) {
4296                         printf("QueryUserInfo level %u failed - %s\n",
4297                                levels[i], nt_errstr(status));
4298                         ret = false;
4299                 }
4300         }
4301
4302         return ret;
4303 }
4304
4305 static bool test_QueryUserInfo2(struct dcerpc_pipe *p, TALLOC_CTX *mem_ctx,
4306                                 struct policy_handle *handle)
4307 {
4308         NTSTATUS status;
4309         struct samr_QueryUserInfo2 r;
4310         union samr_UserInfo *info;
4311         uint16_t levels[] = {1, 2, 3, 4, 5, 6, 7, 8, 9, 10,
4312                            11, 12, 13, 14, 16, 17, 20, 21};
4313         int i;
4314         bool ret = true;
4315
4316         for (i=0;i<ARRAY_SIZE(levels);i++) {
4317                 printf("Testing QueryUserInfo2 level %u\n", levels[i]);
4318
4319                 r.in.user_handle = handle;
4320                 r.in.level = levels[i];
4321                 r.out.info = &info;
4322
4323                 status = dcerpc_samr_QueryUserInfo2(p, mem_ctx, &r);
4324                 if (!NT_STATUS_IS_OK(status)) {
4325                         printf("QueryUserInfo2 level %u failed - %s\n",
4326                                levels[i], nt_errstr(status));
4327                         ret = false;
4328                 }
4329         }
4330
4331         return ret;
4332 }
4333
4334 static bool test_OpenUser(struct dcerpc_pipe *p, TALLOC_CTX *mem_ctx,
4335                           struct policy_handle *handle, uint32_t rid)
4336 {
4337         NTSTATUS status;
4338         struct samr_OpenUser r;
4339         struct policy_handle user_handle;
4340         bool ret = true;
4341
4342         printf("Testing OpenUser(%u)\n", rid);
4343
4344         r.in.domain_handle = handle;
4345         r.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
4346         r.in.rid = rid;
4347         r.out.user_handle = &user_handle;
4348
4349         status = dcerpc_samr_OpenUser(p, mem_ctx, &r);
4350         if (!NT_STATUS_IS_OK(status)) {
4351                 printf("OpenUser(%u) failed - %s\n", rid, nt_errstr(status));
4352                 return false;
4353         }
4354
4355         if (!test_QuerySecurity(p, mem_ctx, &user_handle)) {
4356                 ret = false;
4357         }
4358
4359         if (!test_QueryUserInfo(p, mem_ctx, &user_handle)) {
4360                 ret = false;
4361         }
4362
4363         if (!test_QueryUserInfo2(p, mem_ctx, &user_handle)) {
4364                 ret = false;
4365         }
4366
4367         if (!test_GetUserPwInfo(p, mem_ctx, &user_handle)) {
4368                 ret = false;
4369         }
4370
4371         if (!test_GetGroupsForUser(p,mem_ctx, &user_handle)) {
4372                 ret = false;
4373         }
4374
4375         if (!test_samr_handle_Close(p, mem_ctx, &user_handle)) {
4376                 ret = false;
4377         }
4378
4379         return ret;
4380 }
4381
4382 static bool test_OpenGroup(struct dcerpc_pipe *p, TALLOC_CTX *mem_ctx,
4383                            struct policy_handle *handle, uint32_t rid)
4384 {
4385         NTSTATUS status;
4386         struct samr_OpenGroup r;
4387         struct policy_handle group_handle;
4388         bool ret = true;
4389
4390         printf("Testing OpenGroup(%u)\n", rid);
4391
4392         r.in.domain_handle = handle;
4393         r.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
4394         r.in.rid = rid;
4395         r.out.group_handle = &group_handle;
4396
4397         status = dcerpc_samr_OpenGroup(p, mem_ctx, &r);
4398         if (!NT_STATUS_IS_OK(status)) {
4399                 printf("OpenGroup(%u) failed - %s\n", rid, nt_errstr(status));
4400                 return false;
4401         }
4402
4403         if (!test_QuerySecurity(p, mem_ctx, &group_handle)) {
4404                 ret = false;
4405         }
4406
4407         if (!test_QueryGroupInfo(p, mem_ctx, &group_handle)) {
4408                 ret = false;
4409         }
4410
4411         if (!test_QueryGroupMember(p, mem_ctx, &group_handle)) {
4412                 ret = false;
4413         }
4414
4415         if (!test_samr_handle_Close(p, mem_ctx, &group_handle)) {
4416                 ret = false;
4417         }
4418
4419         return ret;
4420 }
4421
4422 static bool test_OpenAlias(struct dcerpc_pipe *p, struct torture_context *tctx,
4423                            struct policy_handle *handle, uint32_t rid)
4424 {
4425         NTSTATUS status;
4426         struct samr_OpenAlias r;
4427         struct policy_handle alias_handle;
4428         bool ret = true;
4429
4430         torture_comment(tctx, "Testing OpenAlias(%u)\n", rid);
4431
4432         r.in.domain_handle = handle;
4433         r.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
4434         r.in.rid = rid;
4435         r.out.alias_handle = &alias_handle;
4436
4437         status = dcerpc_samr_OpenAlias(p, tctx, &r);
4438         if (!NT_STATUS_IS_OK(status)) {
4439                 printf("OpenAlias(%u) failed - %s\n", rid, nt_errstr(status));
4440                 return false;
4441         }
4442
4443         if (!test_QuerySecurity(p, tctx, &alias_handle)) {
4444                 ret = false;
4445         }
4446
4447         if (!test_QueryAliasInfo(p, tctx, &alias_handle)) {
4448                 ret = false;
4449         }
4450
4451         if (!test_GetMembersInAlias(p, tctx, &alias_handle)) {
4452                 ret = false;
4453         }
4454
4455         if (!test_samr_handle_Close(p, tctx, &alias_handle)) {
4456                 ret = false;
4457         }
4458
4459         return ret;
4460 }
4461
4462 static bool check_mask(struct dcerpc_pipe *p, struct torture_context *tctx,
4463                        struct policy_handle *handle, uint32_t rid,
4464                        uint32_t acct_flag_mask)
4465 {
4466         NTSTATUS status;
4467         struct samr_OpenUser r;
4468         struct samr_QueryUserInfo q;
4469         union samr_UserInfo *info;
4470         struct policy_handle user_handle;
4471         bool ret = true;
4472
4473         torture_comment(tctx, "Testing OpenUser(%u)\n", rid);
4474
4475         r.in.domain_handle = handle;
4476         r.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
4477         r.in.rid = rid;
4478         r.out.user_handle = &user_handle;
4479
4480         status = dcerpc_samr_OpenUser(p, tctx, &r);
4481         if (!NT_STATUS_IS_OK(status)) {
4482                 printf("OpenUser(%u) failed - %s\n", rid, nt_errstr(status));
4483                 return false;
4484         }
4485
4486         q.in.user_handle = &user_handle;
4487         q.in.level = 16;
4488         q.out.info = &info;
4489
4490         status = dcerpc_samr_QueryUserInfo(p, tctx, &q);
4491         if (!NT_STATUS_IS_OK(status)) {
4492                 printf("QueryUserInfo level 16 failed - %s\n",
4493                        nt_errstr(status));
4494                 ret = false;
4495         } else {
4496                 if ((acct_flag_mask & info->info16.acct_flags) == 0) {
4497                         printf("Server failed to filter for 0x%x, allowed 0x%x (%d) on EnumDomainUsers\n",
4498                                acct_flag_mask, info->info16.acct_flags, rid);
4499                         ret = false;
4500                 }
4501         }
4502
4503         if (!test_samr_handle_Close(p, tctx, &user_handle)) {
4504                 ret = false;
4505         }
4506
4507         return ret;
4508 }
4509
4510 static bool test_EnumDomainUsers(struct dcerpc_pipe *p, struct torture_context *tctx,
4511                                  struct policy_handle *handle)
4512 {
4513         NTSTATUS status = STATUS_MORE_ENTRIES;
4514         struct samr_EnumDomainUsers r;
4515         uint32_t mask, resume_handle=0;
4516         int i, mask_idx;
4517         bool ret = true;
4518         struct samr_LookupNames n;
4519         struct samr_LookupRids  lr ;
4520         struct lsa_Strings names;
4521         struct samr_Ids rids, types;
4522         struct samr_SamArray *sam = NULL;
4523         uint32_t num_entries = 0;
4524
4525         uint32_t masks[] = {ACB_NORMAL, ACB_DOMTRUST, ACB_WSTRUST,
4526                             ACB_DISABLED, ACB_NORMAL | ACB_DISABLED,
4527                             ACB_SVRTRUST | ACB_DOMTRUST | ACB_WSTRUST,
4528                             ACB_PWNOEXP, 0};
4529
4530         printf("Testing EnumDomainUsers\n");
4531
4532         for (mask_idx=0;mask_idx<ARRAY_SIZE(masks);mask_idx++) {
4533                 r.in.domain_handle = handle;
4534                 r.in.resume_handle = &resume_handle;
4535                 r.in.acct_flags = mask = masks[mask_idx];
4536                 r.in.max_size = (uint32_t)-1;
4537                 r.out.resume_handle = &resume_handle;
4538                 r.out.num_entries = &num_entries;
4539                 r.out.sam = &sam;
4540
4541                 status = dcerpc_samr_EnumDomainUsers(p, tctx, &r);
4542                 if (!NT_STATUS_EQUAL(status, STATUS_MORE_ENTRIES) &&
4543                     !NT_STATUS_IS_OK(status)) {
4544                         printf("EnumDomainUsers failed - %s\n", nt_errstr(status));
4545                         return false;
4546                 }
4547
4548                 torture_assert(tctx, sam, "EnumDomainUsers failed: r.out.sam unexpectedly NULL");
4549
4550                 if (sam->count == 0) {
4551                         continue;
4552                 }
4553
4554                 for (i=0;i<sam->count;i++) {
4555                         if (mask) {
4556                                 if (!check_mask(p, tctx, handle, sam->entries[i].idx, mask)) {
4557                                         ret = false;
4558                                 }
4559                         } else if (!test_OpenUser(p, tctx, handle, sam->entries[i].idx)) {
4560                                 ret = false;
4561                         }
4562                 }
4563         }
4564
4565         printf("Testing LookupNames\n");
4566         n.in.domain_handle = handle;
4567         n.in.num_names = sam->count;
4568         n.in.names = talloc_array(tctx, struct lsa_String, sam->count);
4569         n.out.rids = &rids;
4570         n.out.types = &types;
4571         for (i=0;i<sam->count;i++) {
4572                 n.in.names[i].string = sam->entries[i].name.string;
4573         }
4574         status = dcerpc_samr_LookupNames(p, tctx, &n);
4575         if (!NT_STATUS_IS_OK(status)) {
4576                 printf("LookupNames failed - %s\n", nt_errstr(status));
4577                 ret = false;
4578         }
4579
4580
4581         printf("Testing LookupRids\n");
4582         lr.in.domain_handle = handle;
4583         lr.in.num_rids = sam->count;
4584         lr.in.rids = talloc_array(tctx, uint32_t, sam->count);
4585         lr.out.names = &names;
4586         lr.out.types = &types;
4587         for (i=0;i<sam->count;i++) {
4588                 lr.in.rids[i] = sam->entries[i].idx;
4589         }
4590         status = dcerpc_samr_LookupRids(p, tctx, &lr);
4591         torture_assert_ntstatus_ok(tctx, status, "LookupRids");
4592
4593         return ret;
4594 }
4595
4596 /*
4597   try blasting the server with a bunch of sync requests
4598 */
4599 static bool test_EnumDomainUsers_async(struct dcerpc_pipe *p, struct torture_context *tctx,
4600                                        struct policy_handle *handle)
4601 {
4602         NTSTATUS status;
4603         struct samr_EnumDomainUsers r;
4604         uint32_t resume_handle=0;
4605         int i;
4606 #define ASYNC_COUNT 100
4607         struct rpc_request *req[ASYNC_COUNT];
4608
4609         if (!torture_setting_bool(tctx, "dangerous", false)) {
4610                 torture_skip(tctx, "samr async test disabled - enable dangerous tests to use\n");
4611         }
4612
4613         torture_comment(tctx, "Testing EnumDomainUsers_async\n");
4614
4615         r.in.domain_handle = handle;
4616         r.in.resume_handle = &resume_handle;
4617         r.in.acct_flags = 0;
4618         r.in.max_size = (uint32_t)-1;
4619         r.out.resume_handle = &resume_handle;
4620
4621         for (i=0;i<ASYNC_COUNT;i++) {
4622                 req[i] = dcerpc_samr_EnumDomainUsers_send(p, tctx, &r);
4623         }
4624
4625         for (i=0;i<ASYNC_COUNT;i++) {
4626                 status = dcerpc_ndr_request_recv(req[i]);
4627                 if (!NT_STATUS_IS_OK(status)) {
4628                         printf("EnumDomainUsers[%d] failed - %s\n",
4629                                i, nt_errstr(status));
4630                         return false;
4631                 }
4632         }
4633
4634         torture_comment(tctx, "%d async requests OK\n", i);
4635
4636         return true;
4637 }
4638
4639 static bool test_EnumDomainGroups(struct dcerpc_pipe *p, TALLOC_CTX *mem_ctx,
4640                                   struct policy_handle *handle)
4641 {
4642         NTSTATUS status;
4643         struct samr_EnumDomainGroups r;
4644         uint32_t resume_handle=0;
4645         struct samr_SamArray *sam = NULL;
4646         uint32_t num_entries = 0;
4647         int i;
4648         bool ret = true;
4649
4650         printf("Testing EnumDomainGroups\n");
4651
4652         r.in.domain_handle = handle;
4653         r.in.resume_handle = &resume_handle;
4654         r.in.max_size = (uint32_t)-1;
4655         r.out.resume_handle = &resume_handle;
4656         r.out.num_entries = &num_entries;
4657         r.out.sam = &sam;
4658
4659         status = dcerpc_samr_EnumDomainGroups(p, mem_ctx, &r);
4660         if (!NT_STATUS_IS_OK(status)) {
4661                 printf("EnumDomainGroups failed - %s\n", nt_errstr(status));
4662                 return false;
4663         }
4664
4665         if (!sam) {
4666                 return false;
4667         }
4668
4669         for (i=0;i<sam->count;i++) {
4670                 if (!test_OpenGroup(p, mem_ctx, handle, sam->entries[i].idx)) {
4671                         ret = false;
4672                 }
4673         }
4674
4675         return ret;
4676 }
4677
4678 static bool test_EnumDomainAliases(struct dcerpc_pipe *p, TALLOC_CTX *mem_ctx,
4679                                    struct policy_handle *handle)
4680 {
4681         NTSTATUS status;
4682         struct samr_EnumDomainAliases r;
4683         uint32_t resume_handle=0;
4684         struct samr_SamArray *sam = NULL;
4685         uint32_t num_entries = 0;
4686         int i;
4687         bool ret = true;
4688
4689         printf("Testing EnumDomainAliases\n");
4690
4691         r.in.domain_handle = handle;
4692         r.in.resume_handle = &resume_handle;
4693         r.in.max_size = (uint32_t)-1;
4694         r.out.sam = &sam;
4695         r.out.num_entries = &num_entries;
4696         r.out.resume_handle = &resume_handle;
4697
4698         status = dcerpc_samr_EnumDomainAliases(p, mem_ctx, &r);
4699         if (!NT_STATUS_IS_OK(status)) {
4700                 printf("EnumDomainAliases failed - %s\n", nt_errstr(status));
4701                 return false;
4702         }
4703
4704         if (!sam) {
4705                 return false;
4706         }
4707
4708         for (i=0;i<sam->count;i++) {
4709                 if (!test_OpenAlias(p, mem_ctx, handle, sam->entries[i].idx)) {
4710                         ret = false;
4711                 }
4712         }
4713
4714         return ret;
4715 }
4716
4717 static bool test_GetDisplayEnumerationIndex(struct dcerpc_pipe *p, TALLOC_CTX *mem_ctx,
4718                                             struct policy_handle *handle)
4719 {
4720         NTSTATUS status;
4721         struct samr_GetDisplayEnumerationIndex r;
4722         bool ret = true;
4723         uint16_t levels[] = {1, 2, 3, 4, 5};
4724         uint16_t ok_lvl[] = {1, 1, 1, 0, 0};
4725         struct lsa_String name;
4726         uint32_t idx = 0;
4727         int i;
4728
4729         for (i=0;i<ARRAY_SIZE(levels);i++) {
4730                 printf("Testing GetDisplayEnumerationIndex level %u\n", levels[i]);
4731
4732                 init_lsa_String(&name, TEST_ACCOUNT_NAME);
4733
4734                 r.in.domain_handle = handle;
4735                 r.in.level = levels[i];
4736                 r.in.name = &name;
4737                 r.out.idx = &idx;
4738
4739                 status = dcerpc_samr_GetDisplayEnumerationIndex(p, mem_ctx, &r);
4740
4741                 if (ok_lvl[i] &&
4742                     !NT_STATUS_IS_OK(status) &&
4743                     !NT_STATUS_EQUAL(NT_STATUS_NO_MORE_ENTRIES, status)) {
4744                         printf("GetDisplayEnumerationIndex level %u failed - %s\n",
4745                                levels[i], nt_errstr(status));
4746                         ret = false;
4747                 }
4748
4749                 init_lsa_String(&name, "zzzzzzzz");
4750
4751                 status = dcerpc_samr_GetDisplayEnumerationIndex(p, mem_ctx, &r);
4752
4753                 if (ok_lvl[i] && !NT_STATUS_EQUAL(NT_STATUS_NO_MORE_ENTRIES, status)) {
4754                         printf("GetDisplayEnumerationIndex level %u failed - %s\n",
4755                                levels[i], nt_errstr(status));
4756                         ret = false;
4757                 }
4758         }
4759
4760         return ret;
4761 }
4762
4763 static bool test_GetDisplayEnumerationIndex2(struct dcerpc_pipe *p, TALLOC_CTX *mem_ctx,
4764                                              struct policy_handle *handle)
4765 {
4766         NTSTATUS status;
4767         struct samr_GetDisplayEnumerationIndex2 r;
4768         bool ret = true;
4769         uint16_t levels[] = {1, 2, 3, 4, 5};
4770         uint16_t ok_lvl[] = {1, 1, 1, 0, 0};
4771         struct lsa_String name;
4772         uint32_t idx = 0;
4773         int i;
4774
4775         for (i=0;i<ARRAY_SIZE(levels);i++) {
4776                 printf("Testing GetDisplayEnumerationIndex2 level %u\n", levels[i]);
4777
4778                 init_lsa_String(&name, TEST_ACCOUNT_NAME);
4779
4780                 r.in.domain_handle = handle;
4781                 r.in.level = levels[i];
4782                 r.in.name = &name;
4783                 r.out.idx = &idx;
4784
4785                 status = dcerpc_samr_GetDisplayEnumerationIndex2(p, mem_ctx, &r);
4786                 if (ok_lvl[i] &&
4787                     !NT_STATUS_IS_OK(status) &&
4788                     !NT_STATUS_EQUAL(NT_STATUS_NO_MORE_ENTRIES, status)) {
4789                         printf("GetDisplayEnumerationIndex2 level %u failed - %s\n",
4790                                levels[i], nt_errstr(status));
4791                         ret = false;
4792                 }
4793
4794                 init_lsa_String(&name, "zzzzzzzz");
4795
4796                 status = dcerpc_samr_GetDisplayEnumerationIndex2(p, mem_ctx, &r);
4797                 if (ok_lvl[i] && !NT_STATUS_EQUAL(NT_STATUS_NO_MORE_ENTRIES, status)) {
4798                         printf("GetDisplayEnumerationIndex2 level %u failed - %s\n",
4799                                levels[i], nt_errstr(status));
4800                         ret = false;
4801                 }
4802         }
4803
4804         return ret;
4805 }
4806
4807 #define STRING_EQUAL_QUERY(s1, s2, user)                                        \
4808         if (s1.string == NULL && s2.string != NULL && s2.string[0] == '\0') { \
4809                 /* odd, but valid */                                            \
4810         } else if ((s1.string && !s2.string) || (s2.string && !s1.string) || strcmp(s1.string, s2.string)) { \
4811                         printf("%s mismatch for %s: %s != %s (%s)\n", \
4812                                #s1, user.string,  s1.string, s2.string, __location__);   \
4813                         ret = false; \
4814         }
4815 #define INT_EQUAL_QUERY(s1, s2, user)           \
4816                 if (s1 != s2) { \
4817                         printf("%s mismatch for %s: 0x%llx != 0x%llx (%s)\n", \
4818                                #s1, user.string, (unsigned long long)s1, (unsigned long long)s2, __location__); \
4819                         ret = false; \
4820                 }
4821
4822 static bool test_each_DisplayInfo_user(struct dcerpc_pipe *p, TALLOC_CTX *mem_ctx,
4823                                        struct samr_QueryDisplayInfo *querydisplayinfo,
4824                                        bool *seen_testuser)
4825 {
4826         struct samr_OpenUser r;
4827         struct samr_QueryUserInfo q;
4828         union samr_UserInfo *info;
4829         struct policy_handle user_handle;
4830         int i, ret = true;
4831         NTSTATUS status;
4832         r.in.domain_handle = querydisplayinfo->in.domain_handle;
4833         r.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
4834         for (i = 0; ; i++) {
4835                 switch (querydisplayinfo->in.level) {
4836                 case 1:
4837                         if (i >= querydisplayinfo->out.info->info1.count) {
4838                                 return ret;
4839                         }
4840                         r.in.rid = querydisplayinfo->out.info->info1.entries[i].rid;
4841                         break;
4842                 case 2:
4843                         if (i >= querydisplayinfo->out.info->info2.count) {
4844                                 return ret;
4845                         }
4846                         r.in.rid = querydisplayinfo->out.info->info2.entries[i].rid;
4847                         break;
4848                 case 3:
4849                         /* Groups */
4850                 case 4:
4851                 case 5:
4852                         /* Not interested in validating just the account name */
4853                         return true;
4854                 }
4855
4856                 r.out.user_handle = &user_handle;
4857
4858                 switch (querydisplayinfo->in.level) {
4859                 case 1:
4860                 case 2:
4861                         status = dcerpc_samr_OpenUser(p, mem_ctx, &r);
4862                         if (!NT_STATUS_IS_OK(status)) {
4863                                 printf("OpenUser(%u) failed - %s\n", r.in.rid, nt_errstr(status));
4864                                 return false;
4865                         }
4866                 }
4867
4868                 q.in.user_handle = &user_handle;
4869                 q.in.level = 21;
4870                 q.out.info = &info;
4871                 status = dcerpc_samr_QueryUserInfo(p, mem_ctx, &q);
4872                 if (!NT_STATUS_IS_OK(status)) {
4873                         printf("QueryUserInfo(%u) failed - %s\n", r.in.rid, nt_errstr(status));
4874                         return false;
4875                 }
4876
4877                 switch (querydisplayinfo->in.level) {
4878                 case 1:
4879                         if (seen_testuser && strcmp(info->info21.account_name.string, TEST_ACCOUNT_NAME) == 0) {
4880                                 *seen_testuser = true;
4881                         }
4882                         STRING_EQUAL_QUERY(querydisplayinfo->out.info->info1.entries[i].full_name,
4883                                            info->info21.full_name, info->info21.account_name);
4884                         STRING_EQUAL_QUERY(querydisplayinfo->out.info->info1.entries[i].account_name,
4885                                            info->info21.account_name, info->info21.account_name);
4886                         STRING_EQUAL_QUERY(querydisplayinfo->out.info->info1.entries[i].description,
4887                                            info->info21.description, info->info21.account_name);
4888                         INT_EQUAL_QUERY(querydisplayinfo->out.info->info1.entries[i].rid,
4889                                         info->info21.rid, info->info21.account_name);
4890                         INT_EQUAL_QUERY(querydisplayinfo->out.info->info1.entries[i].acct_flags,
4891                                         info->info21.acct_flags, info->info21.account_name);
4892
4893                         break;
4894                 case 2:
4895                         STRING_EQUAL_QUERY(querydisplayinfo->out.info->info2.entries[i].account_name,
4896                                            info->info21.account_name, info->info21.account_name);
4897                         STRING_EQUAL_QUERY(querydisplayinfo->out.info->info2.entries[i].description,
4898                                            info->info21.description, info->info21.account_name);
4899                         INT_EQUAL_QUERY(querydisplayinfo->out.info->info2.entries[i].rid,
4900                                         info->info21.rid, info->info21.account_name);
4901                         INT_EQUAL_QUERY((querydisplayinfo->out.info->info2.entries[i].acct_flags & ~ACB_NORMAL),
4902                                         info->info21.acct_flags, info->info21.account_name);
4903
4904                         if (!(querydisplayinfo->out.info->info2.entries[i].acct_flags & ACB_NORMAL)) {
4905                                 printf("Missing ACB_NORMAL in querydisplayinfo->out.info.info2.entries[i].acct_flags on %s\n",
4906                                        info->info21.account_name.string);
4907                         }
4908
4909                         if (!(info->info21.acct_flags & (ACB_WSTRUST | ACB_SVRTRUST))) {
4910                                 printf("Found non-trust account %s in trust account listing: 0x%x 0x%x\n",
4911                                        info->info21.account_name.string,
4912                                        querydisplayinfo->out.info->info2.entries[i].acct_flags,
4913                                        info->info21.acct_flags);
4914                                 return false;
4915                         }
4916
4917                         break;
4918                 }
4919
4920                 if (!test_samr_handle_Close(p, mem_ctx, &user_handle)) {
4921                         return false;
4922                 }
4923         }
4924         return ret;
4925 }
4926
4927 static bool test_QueryDisplayInfo(struct dcerpc_pipe *p, TALLOC_CTX *mem_ctx,
4928                                   struct policy_handle *handle)
4929 {
4930         NTSTATUS status;
4931         struct samr_QueryDisplayInfo r;
4932         struct samr_QueryDomainInfo dom_info;
4933         union samr_DomainInfo *info = NULL;
4934         bool ret = true;
4935         uint16_t levels[] = {1, 2, 3, 4, 5};
4936         int i;
4937         bool seen_testuser = false;
4938         uint32_t total_size;
4939         uint32_t returned_size;
4940         union samr_DispInfo disp_info;
4941
4942
4943         for (i=0;i<ARRAY_SIZE(levels);i++) {
4944                 printf("Testing QueryDisplayInfo level %u\n", levels[i]);
4945
4946                 r.in.start_idx = 0;
4947                 status = STATUS_MORE_ENTRIES;
4948                 while (NT_STATUS_EQUAL(status, STATUS_MORE_ENTRIES)) {
4949                         r.in.domain_handle = handle;
4950                         r.in.level = levels[i];
4951                         r.in.max_entries = 2;
4952                         r.in.buf_size = (uint32_t)-1;
4953                         r.out.total_size = &total_size;
4954                         r.out.returned_size = &returned_size;
4955                         r.out.info = &disp_info;
4956
4957                         status = dcerpc_samr_QueryDisplayInfo(p, mem_ctx, &r);
4958                         if (!NT_STATUS_EQUAL(status, STATUS_MORE_ENTRIES) && !NT_STATUS_IS_OK(status)) {
4959                                 printf("QueryDisplayInfo level %u failed - %s\n",
4960                                        levels[i], nt_errstr(status));
4961                                 ret = false;
4962                         }
4963                         switch (r.in.level) {
4964                         case 1:
4965                                 if (!test_each_DisplayInfo_user(p, mem_ctx, &r, &seen_testuser)) {
4966                                         ret = false;
4967                                 }
4968                                 r.in.start_idx += r.out.info->info1.count;
4969                                 break;
4970                         case 2:
4971                                 if (!test_each_DisplayInfo_user(p, mem_ctx, &r, NULL)) {
4972                                         ret = false;
4973                                 }
4974                                 r.in.start_idx += r.out.info->info2.count;
4975                                 break;
4976                         case 3:
4977                                 r.in.start_idx += r.out.info->info3.count;
4978                                 break;
4979                         case 4:
4980                                 r.in.start_idx += r.out.info->info4.count;
4981                                 break;
4982                         case 5:
4983                                 r.in.start_idx += r.out.info->info5.count;
4984                                 break;
4985                         }
4986                 }
4987                 dom_info.in.domain_handle = handle;
4988                 dom_info.in.level = 2;
4989                 dom_info.out.info = &info;
4990
4991                 /* Check number of users returned is correct */
4992                 status = dcerpc_samr_QueryDomainInfo(p, mem_ctx, &dom_info);
4993                 if (!NT_STATUS_IS_OK(status)) {
4994                         printf("QueryDomainInfo level %u failed - %s\n",
4995                                r.in.level, nt_errstr(status));
4996                                 ret = false;
4997                                 break;
4998                 }
4999                 switch (r.in.level) {
5000                 case 1:
5001                 case 4:
5002                         if (info->general.num_users < r.in.start_idx) {
5003                                 printf("QueryDomainInfo indicates that QueryDisplayInfo returned more users (%d/%d) than the domain %s is said to contain!\n",
5004                                        r.in.start_idx, info->general.num_groups,
5005                                        info->general.domain_name.string);
5006                                 ret = false;
5007                         }
5008                         if (!seen_testuser) {
5009                                 struct policy_handle user_handle;
5010                                 if (NT_STATUS_IS_OK(test_OpenUser_byname(p, mem_ctx, handle, TEST_ACCOUNT_NAME, &user_handle))) {
5011                                         printf("Didn't find test user " TEST_ACCOUNT_NAME " in enumeration of %s\n",
5012                                                info->general.domain_name.string);
5013                                         ret = false;
5014                                         test_samr_handle_Close(p, mem_ctx, &user_handle);
5015                                 }
5016                         }
5017                         break;
5018                 case 3:
5019                 case 5:
5020                         if (info->general.num_groups != r.in.start_idx) {
5021                                 printf("QueryDomainInfo indicates that QueryDisplayInfo didn't return all (%d/%d) the groups in %s\n",
5022                                        r.in.start_idx, info->general.num_groups,
5023                                        info->general.domain_name.string);
5024                                 ret = false;
5025                         }
5026
5027                         break;
5028                 }
5029
5030         }
5031
5032         return ret;
5033 }
5034
5035 static bool test_QueryDisplayInfo2(struct dcerpc_pipe *p, TALLOC_CTX *mem_ctx,
5036                                   struct policy_handle *handle)
5037 {
5038         NTSTATUS status;
5039         struct samr_QueryDisplayInfo2 r;
5040         bool ret = true;
5041         uint16_t levels[] = {1, 2, 3, 4, 5};
5042         int i;
5043         uint32_t total_size;
5044         uint32_t returned_size;
5045         union samr_DispInfo info;
5046
5047         for (i=0;i<ARRAY_SIZE(levels);i++) {
5048                 printf("Testing QueryDisplayInfo2 level %u\n", levels[i]);
5049
5050                 r.in.domain_handle = handle;
5051                 r.in.level = levels[i];
5052                 r.in.start_idx = 0;
5053                 r.in.max_entries = 1000;
5054                 r.in.buf_size = (uint32_t)-1;
5055                 r.out.total_size = &total_size;
5056                 r.out.returned_size = &returned_size;
5057                 r.out.info = &info;
5058
5059                 status = dcerpc_samr_QueryDisplayInfo2(p, mem_ctx, &r);
5060                 if (!NT_STATUS_IS_OK(status)) {
5061                         printf("QueryDisplayInfo2 level %u failed - %s\n",
5062                                levels[i], nt_errstr(status));
5063                         ret = false;
5064                 }
5065         }
5066
5067         return ret;
5068 }
5069
5070 static bool test_QueryDisplayInfo3(struct dcerpc_pipe *p, struct torture_context *tctx,
5071                                   struct policy_handle *handle)
5072 {
5073         NTSTATUS status;
5074         struct samr_QueryDisplayInfo3 r;
5075         bool ret = true;
5076         uint16_t levels[] = {1, 2, 3, 4, 5};
5077         int i;
5078         uint32_t total_size;
5079         uint32_t returned_size;
5080         union samr_DispInfo info;
5081
5082         for (i=0;i<ARRAY_SIZE(levels);i++) {
5083                 torture_comment(tctx, "Testing QueryDisplayInfo3 level %u\n", levels[i]);
5084
5085                 r.in.domain_handle = handle;
5086                 r.in.level = levels[i];
5087                 r.in.start_idx = 0;
5088                 r.in.max_entries = 1000;
5089                 r.in.buf_size = (uint32_t)-1;
5090                 r.out.total_size = &total_size;
5091                 r.out.returned_size = &returned_size;
5092                 r.out.info = &info;
5093
5094                 status = dcerpc_samr_QueryDisplayInfo3(p, tctx, &r);
5095                 if (!NT_STATUS_IS_OK(status)) {
5096                         printf("QueryDisplayInfo3 level %u failed - %s\n",
5097                                levels[i], nt_errstr(status));
5098                         ret = false;
5099                 }
5100         }
5101
5102         return ret;
5103 }
5104
5105
5106 static bool test_QueryDisplayInfo_continue(struct dcerpc_pipe *p, TALLOC_CTX *mem_ctx,
5107                                            struct policy_handle *handle)
5108 {
5109         NTSTATUS status;
5110         struct samr_QueryDisplayInfo r;
5111         bool ret = true;
5112         uint32_t total_size;
5113         uint32_t returned_size;
5114         union samr_DispInfo info;
5115
5116         printf("Testing QueryDisplayInfo continuation\n");
5117
5118         r.in.domain_handle = handle;
5119         r.in.level = 1;
5120         r.in.start_idx = 0;
5121         r.in.max_entries = 1;
5122         r.in.buf_size = (uint32_t)-1;
5123         r.out.total_size = &total_size;
5124         r.out.returned_size = &returned_size;
5125         r.out.info = &info;
5126
5127         do {
5128                 status = dcerpc_samr_QueryDisplayInfo(p, mem_ctx, &r);
5129                 if (NT_STATUS_IS_OK(status) && *r.out.returned_size != 0) {
5130                         if (r.out.info->info1.entries[0].idx != r.in.start_idx + 1) {
5131                                 printf("expected idx %d but got %d\n",
5132                                        r.in.start_idx + 1,
5133                                        r.out.info->info1.entries[0].idx);
5134                                 break;
5135                         }
5136                 }
5137                 if (!NT_STATUS_EQUAL(status, STATUS_MORE_ENTRIES) &&
5138                     !NT_STATUS_IS_OK(status)) {
5139                         printf("QueryDisplayInfo level %u failed - %s\n",
5140                                r.in.level, nt_errstr(status));
5141                         ret = false;
5142                         break;
5143                 }
5144                 r.in.start_idx++;
5145         } while ((NT_STATUS_EQUAL(status, STATUS_MORE_ENTRIES) ||
5146                   NT_STATUS_IS_OK(status)) &&
5147                  *r.out.returned_size != 0);
5148
5149         return ret;
5150 }
5151
5152 static bool test_QueryDomainInfo(struct dcerpc_pipe *p, struct torture_context *tctx,
5153                                  struct policy_handle *handle)
5154 {
5155         NTSTATUS status;
5156         struct samr_QueryDomainInfo r;
5157         union samr_DomainInfo *info = NULL;
5158         struct samr_SetDomainInfo s;
5159         uint16_t levels[] = {1, 2, 3, 4, 5, 6, 7, 8, 9, 11, 12, 13};
5160         uint16_t set_ok[] = {1, 0, 1, 1, 0, 1, 1, 0, 1,  0,  1,  0};
5161         int i;
5162         bool ret = true;
5163         const char *domain_comment = talloc_asprintf(tctx,
5164                                   "Tortured by Samba4 RPC-SAMR: %s",
5165                                   timestring(tctx, time(NULL)));
5166
5167         s.in.domain_handle = handle;
5168         s.in.level = 4;
5169         s.in.info = talloc(tctx, union samr_DomainInfo);
5170
5171         s.in.info->oem.oem_information.string = domain_comment;
5172         status = dcerpc_samr_SetDomainInfo(p, tctx, &s);
5173         if (!NT_STATUS_IS_OK(status)) {
5174                 printf("SetDomainInfo level %u (set comment) failed - %s\n",
5175                        s.in.level, nt_errstr(status));
5176                 return false;
5177         }
5178
5179         for (i=0;i<ARRAY_SIZE(levels);i++) {
5180                 torture_comment(tctx, "Testing QueryDomainInfo level %u\n", levels[i]);
5181
5182                 r.in.domain_handle = handle;
5183                 r.in.level = levels[i];
5184                 r.out.info = &info;
5185
5186                 status = dcerpc_samr_QueryDomainInfo(p, tctx, &r);
5187                 if (!NT_STATUS_IS_OK(status)) {
5188                         printf("QueryDomainInfo level %u failed - %s\n",
5189                                r.in.level, nt_errstr(status));
5190                         ret = false;
5191                         continue;
5192                 }
5193
5194                 switch (levels[i]) {
5195                 case 2:
5196                         if (strcmp(info->general.oem_information.string, domain_comment) != 0) {
5197                                 printf("QueryDomainInfo level %u returned different oem_information (comment) (%s, expected %s)\n",
5198                                        levels[i], info->general.oem_information.string, domain_comment);
5199                                 ret = false;
5200                         }
5201                         if (!info->general.primary.string) {
5202                                 printf("QueryDomainInfo level %u returned no PDC name\n",
5203                                        levels[i]);
5204                                 ret = false;
5205                         } else if (info->general.role == SAMR_ROLE_DOMAIN_PDC) {
5206                                 if (dcerpc_server_name(p) && strcasecmp_m(dcerpc_server_name(p), info->general.primary.string) != 0) {
5207                                         printf("QueryDomainInfo level %u returned different PDC name (%s) compared to server name (%s), despite claiming to be the PDC\n",
5208                                                levels[i], info->general.primary.string, dcerpc_server_name(p));
5209                                 }
5210                         }
5211                         break;
5212                 case 4:
5213                         if (strcmp(info->oem.oem_information.string, domain_comment) != 0) {
5214                                 printf("QueryDomainInfo level %u returned different oem_information (comment) (%s, expected %s)\n",
5215                                        levels[i], info->oem.oem_information.string, domain_comment);
5216                                 ret = false;
5217                         }
5218                         break;
5219                 case 6:
5220                         if (!info->info6.primary.string) {
5221                                 printf("QueryDomainInfo level %u returned no PDC name\n",
5222                                        levels[i]);
5223                                 ret = false;
5224                         }
5225                         break;
5226                 case 11:
5227                         if (strcmp(info->general2.general.oem_information.string, domain_comment) != 0) {
5228                                 printf("QueryDomainInfo level %u returned different comment (%s, expected %s)\n",
5229                                        levels[i], info->general2.general.oem_information.string, domain_comment);
5230                                 ret = false;
5231                         }
5232                         break;
5233                 }
5234
5235                 torture_comment(tctx, "Testing SetDomainInfo level %u\n", levels[i]);
5236
5237                 s.in.domain_handle = handle;
5238                 s.in.level = levels[i];
5239                 s.in.info = info;
5240
5241                 status = dcerpc_samr_SetDomainInfo(p, tctx, &s);
5242                 if (set_ok[i]) {
5243                         if (!NT_STATUS_IS_OK(status)) {
5244                                 printf("SetDomainInfo level %u failed - %s\n",
5245                                        r.in.level, nt_errstr(status));
5246                                 ret = false;
5247                                 continue;
5248                         }
5249                 } else {
5250                         if (!NT_STATUS_EQUAL(NT_STATUS_INVALID_INFO_CLASS, status)) {
5251                                 printf("SetDomainInfo level %u gave %s - should have been NT_STATUS_INVALID_INFO_CLASS\n",
5252                                        r.in.level, nt_errstr(status));
5253                                 ret = false;
5254                                 continue;
5255                         }
5256                 }
5257
5258                 status = dcerpc_samr_QueryDomainInfo(p, tctx, &r);
5259                 if (!NT_STATUS_IS_OK(status)) {
5260                         printf("QueryDomainInfo level %u failed - %s\n",
5261                                r.in.level, nt_errstr(status));
5262                         ret = false;
5263                         continue;
5264                 }
5265         }
5266
5267         return ret;
5268 }
5269
5270
5271 static bool test_QueryDomainInfo2(struct dcerpc_pipe *p, struct torture_context *tctx,
5272                                   struct policy_handle *handle)
5273 {
5274         NTSTATUS status;
5275         struct samr_QueryDomainInfo2 r;
5276         union samr_DomainInfo *info = NULL;
5277         uint16_t levels[] = {1, 2, 3, 4, 5, 6, 7, 8, 9, 11, 12, 13};
5278         int i;
5279         bool ret = true;
5280
5281         for (i=0;i<ARRAY_SIZE(levels);i++) {
5282                 printf("Testing QueryDomainInfo2 level %u\n", levels[i]);
5283
5284                 r.in.domain_handle = handle;
5285                 r.in.level = levels[i];
5286                 r.out.info = &info;
5287
5288                 status = dcerpc_samr_QueryDomainInfo2(p, tctx, &r);
5289                 if (!NT_STATUS_IS_OK(status)) {
5290                         printf("QueryDomainInfo2 level %u failed - %s\n",
5291                                r.in.level, nt_errstr(status));
5292                         ret = false;
5293                         continue;
5294                 }
5295         }
5296
5297         return true;
5298 }
5299
5300 /* Test whether querydispinfo level 5 and enumdomgroups return the same
5301    set of group names. */
5302 static bool test_GroupList(struct dcerpc_pipe *p, struct torture_context *tctx,
5303                            struct policy_handle *handle)
5304 {
5305         struct samr_EnumDomainGroups q1;
5306         struct samr_QueryDisplayInfo q2;
5307         NTSTATUS status;
5308         uint32_t resume_handle=0;
5309         struct samr_SamArray *sam = NULL;
5310         uint32_t num_entries = 0;
5311         int i;
5312         bool ret = true;
5313         uint32_t total_size;
5314         uint32_t returned_size;
5315         union samr_DispInfo info;
5316
5317         int num_names = 0;
5318         const char **names = NULL;
5319
5320         torture_comment(tctx, "Testing coherency of querydispinfo vs enumdomgroups\n");
5321
5322         q1.in.domain_handle = handle;
5323         q1.in.resume_handle = &resume_handle;
5324         q1.in.max_size = 5;
5325         q1.out.resume_handle = &resume_handle;
5326         q1.out.num_entries = &num_entries;
5327         q1.out.sam = &sam;
5328
5329         status = STATUS_MORE_ENTRIES;
5330         while (NT_STATUS_EQUAL(status, STATUS_MORE_ENTRIES)) {
5331                 status = dcerpc_samr_EnumDomainGroups(p, tctx, &q1);
5332
5333                 if (!NT_STATUS_IS_OK(status) &&
5334                     !NT_STATUS_EQUAL(status, STATUS_MORE_ENTRIES))
5335                         break;
5336
5337                 for (i=0; i<*q1.out.num_entries; i++) {
5338                         add_string_to_array(tctx,
5339                                             sam->entries[i].name.string,
5340                                             &names, &num_names);
5341                 }
5342         }
5343
5344         torture_assert_ntstatus_ok(tctx, status, "EnumDomainGroups");
5345
5346         torture_assert(tctx, sam, "EnumDomainGroups failed to return sam");
5347
5348         q2.in.domain_handle = handle;
5349         q2.in.level = 5;
5350         q2.in.start_idx = 0;
5351         q2.in.max_entries = 5;
5352         q2.in.buf_size = (uint32_t)-1;
5353         q2.out.total_size = &total_size;
5354         q2.out.returned_size = &returned_size;
5355         q2.out.info = &info;
5356
5357         status = STATUS_MORE_ENTRIES;
5358         while (NT_STATUS_EQUAL(status, STATUS_MORE_ENTRIES)) {
5359                 status = dcerpc_samr_QueryDisplayInfo(p, tctx, &q2);
5360
5361                 if (!NT_STATUS_IS_OK(status) &&
5362                     !NT_STATUS_EQUAL(status, STATUS_MORE_ENTRIES))
5363                         break;
5364
5365                 for (i=0; i<q2.out.info->info5.count; i++) {
5366                         int j;
5367                         const char *name = q2.out.info->info5.entries[i].account_name.string;
5368                         bool found = false;
5369                         for (j=0; j<num_names; j++) {
5370                                 if (names[j] == NULL)
5371                                         continue;
5372                                 if (strequal(names[j], name)) {
5373                                         names[j] = NULL;
5374                                         found = true;
5375                                         break;
5376                                 }
5377                         }
5378
5379                         if (!found) {
5380                                 printf("QueryDisplayInfo gave name [%s] that EnumDomainGroups did not\n",
5381                                        name);
5382                                 ret = false;
5383                         }
5384                 }
5385                 q2.in.start_idx += q2.out.info->info5.count;
5386         }
5387
5388         if (!NT_STATUS_IS_OK(status)) {
5389                 printf("QueryDisplayInfo level 5 failed - %s\n",
5390                        nt_errstr(status));
5391                 ret = false;
5392         }
5393
5394         for (i=0; i<num_names; i++) {
5395                 if (names[i] != NULL) {
5396                         printf("EnumDomainGroups gave name [%s] that QueryDisplayInfo did not\n",
5397                                names[i]);
5398                         ret = false;
5399                 }
5400         }
5401
5402         return ret;
5403 }
5404
5405 static bool test_DeleteDomainGroup(struct dcerpc_pipe *p, struct torture_context *tctx,
5406                                    struct policy_handle *group_handle)
5407 {
5408         struct samr_DeleteDomainGroup d;
5409         NTSTATUS status;
5410
5411         torture_comment(tctx, "Testing DeleteDomainGroup\n");
5412
5413         d.in.group_handle = group_handle;
5414         d.out.group_handle = group_handle;
5415
5416         status = dcerpc_samr_DeleteDomainGroup(p, tctx, &d);
5417         torture_assert_ntstatus_ok(tctx, status, "DeleteDomainGroup");
5418
5419         return true;
5420 }
5421
5422 static bool test_TestPrivateFunctionsDomain(struct dcerpc_pipe *p, struct torture_context *tctx,
5423                                             struct policy_handle *domain_handle)
5424 {
5425         struct samr_TestPrivateFunctionsDomain r;
5426         NTSTATUS status;
5427         bool ret = true;
5428
5429         torture_comment(tctx, "Testing TestPrivateFunctionsDomain\n");
5430
5431         r.in.domain_handle = domain_handle;
5432
5433         status = dcerpc_samr_TestPrivateFunctionsDomain(p, tctx, &r);
5434         torture_assert_ntstatus_equal(tctx, NT_STATUS_NOT_IMPLEMENTED, status, "TestPrivateFunctionsDomain");
5435
5436         return ret;
5437 }
5438
5439 static bool test_RidToSid(struct dcerpc_pipe *p, struct torture_context *tctx,
5440                           struct dom_sid *domain_sid,
5441                           struct policy_handle *domain_handle)
5442 {
5443         struct samr_RidToSid r;
5444         NTSTATUS status;
5445         bool ret = true;
5446         struct dom_sid *calc_sid, *out_sid;
5447         int rids[] = { 0, 42, 512, 10200 };
5448         int i;
5449
5450         for (i=0;i<ARRAY_SIZE(rids);i++) {
5451                 torture_comment(tctx, "Testing RidToSid\n");
5452
5453                 calc_sid = dom_sid_dup(tctx, domain_sid);
5454                 r.in.domain_handle = domain_handle;
5455                 r.in.rid = rids[i];
5456                 r.out.sid = &out_sid;
5457
5458                 status = dcerpc_samr_RidToSid(p, tctx, &r);
5459                 if (!NT_STATUS_IS_OK(status)) {
5460                         printf("RidToSid for %d failed - %s\n", rids[i], nt_errstr(status));
5461                         ret = false;
5462                 } else {
5463                         calc_sid = dom_sid_add_rid(calc_sid, calc_sid, rids[i]);
5464
5465                         if (!dom_sid_equal(calc_sid, out_sid)) {
5466                                 printf("RidToSid for %d failed - got %s, expected %s\n", rids[i],
5467                                        dom_sid_string(tctx, out_sid),
5468                                        dom_sid_string(tctx, calc_sid));
5469                                 ret = false;
5470                         }
5471                 }
5472         }
5473
5474         return ret;
5475 }
5476
5477 static bool test_GetBootKeyInformation(struct dcerpc_pipe *p, struct torture_context *tctx,
5478                                        struct policy_handle *domain_handle)
5479 {
5480         struct samr_GetBootKeyInformation r;
5481         NTSTATUS status;
5482         bool ret = true;
5483         uint32_t unknown = 0;
5484
5485         torture_comment(tctx, "Testing GetBootKeyInformation\n");
5486
5487         r.in.domain_handle = domain_handle;
5488         r.out.unknown = &unknown;
5489
5490         status = dcerpc_samr_GetBootKeyInformation(p, tctx, &r);
5491         if (!NT_STATUS_IS_OK(status)) {
5492                 /* w2k3 seems to fail this sometimes and pass it sometimes */
5493                 torture_comment(tctx, "GetBootKeyInformation (ignored) - %s\n", nt_errstr(status));
5494         }
5495
5496         return ret;
5497 }
5498
5499 static bool test_AddGroupMember(struct dcerpc_pipe *p, struct torture_context *tctx,
5500                                 struct policy_handle *domain_handle,
5501                                 struct policy_handle *group_handle)
5502 {
5503         NTSTATUS status;
5504         struct samr_AddGroupMember r;
5505         struct samr_DeleteGroupMember d;
5506         struct samr_QueryGroupMember q;
5507         struct samr_RidTypeArray *rids = NULL;
5508         struct samr_SetMemberAttributesOfGroup s;
5509         uint32_t rid;
5510
5511         status = test_LookupName(p, tctx, domain_handle, TEST_ACCOUNT_NAME, &rid);
5512         torture_assert_ntstatus_ok(tctx, status, "test_AddGroupMember looking up name " TEST_ACCOUNT_NAME);
5513
5514         r.in.group_handle = group_handle;
5515         r.in.rid = rid;
5516         r.in.flags = 0; /* ??? */
5517
5518         torture_comment(tctx, "Testing AddGroupMember and DeleteGroupMember\n");
5519
5520         d.in.group_handle = group_handle;
5521         d.in.rid = rid;
5522
5523         status = dcerpc_samr_DeleteGroupMember(p, tctx, &d);
5524         torture_assert_ntstatus_equal(tctx, NT_STATUS_MEMBER_NOT_IN_GROUP, status, "DeleteGroupMember");
5525
5526         status = dcerpc_samr_AddGroupMember(p, tctx, &r);
5527         torture_assert_ntstatus_ok(tctx, status, "AddGroupMember");
5528
5529         status = dcerpc_samr_AddGroupMember(p, tctx, &r);
5530         torture_assert_ntstatus_equal(tctx, NT_STATUS_MEMBER_IN_GROUP, status, "AddGroupMember");
5531
5532         if (torture_setting_bool(tctx, "samba4", false)) {
5533                 torture_comment(tctx, "skipping SetMemberAttributesOfGroup test against Samba4\n");
5534         } else {
5535                 /* this one is quite strange. I am using random inputs in the
5536                    hope of triggering an error that might give us a clue */
5537
5538                 s.in.group_handle = group_handle;
5539                 s.in.unknown1 = random();
5540                 s.in.unknown2 = random();
5541
5542                 status = dcerpc_samr_SetMemberAttributesOfGroup(p, tctx, &s);
5543                 torture_assert_ntstatus_ok(tctx, status, "SetMemberAttributesOfGroup");
5544         }
5545
5546         q.in.group_handle = group_handle;
5547         q.out.rids = &rids;
5548
5549         status = dcerpc_samr_QueryGroupMember(p, tctx, &q);
5550         torture_assert_ntstatus_ok(tctx, status, "QueryGroupMember");
5551
5552         status = dcerpc_samr_DeleteGroupMember(p, tctx, &d);
5553         torture_assert_ntstatus_ok(tctx, status, "DeleteGroupMember");
5554
5555         status = dcerpc_samr_AddGroupMember(p, tctx, &r);
5556         torture_assert_ntstatus_ok(tctx, status, "AddGroupMember");
5557
5558         return true;
5559 }
5560
5561
5562 static bool test_CreateDomainGroup(struct dcerpc_pipe *p,
5563                                                                    struct torture_context *tctx,
5564                                    struct policy_handle *domain_handle,
5565                                    struct policy_handle *group_handle,
5566                                    struct dom_sid *domain_sid)
5567 {
5568         NTSTATUS status;
5569         struct samr_CreateDomainGroup r;
5570         uint32_t rid;
5571         struct lsa_String name;
5572         bool ret = true;
5573
5574         init_lsa_String(&name, TEST_GROUPNAME);
5575
5576         r.in.domain_handle = domain_handle;
5577         r.in.name = &name;
5578         r.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
5579         r.out.group_handle = group_handle;
5580         r.out.rid = &rid;
5581
5582         printf("Testing CreateDomainGroup(%s)\n", r.in.name->string);
5583
5584         status = dcerpc_samr_CreateDomainGroup(p, tctx, &r);
5585
5586         if (dom_sid_equal(domain_sid, dom_sid_parse_talloc(tctx, SID_BUILTIN))) {
5587                 if (NT_STATUS_EQUAL(status, NT_STATUS_ACCESS_DENIED)) {
5588                         torture_comment(tctx, "Server correctly refused create of '%s'\n", r.in.name->string);
5589                         return true;
5590                 } else {
5591                         printf("Server should have refused create of '%s', got %s instead\n", r.in.name->string,
5592                                nt_errstr(status));
5593                         return false;
5594                 }
5595         }
5596
5597         if (NT_STATUS_EQUAL(status, NT_STATUS_GROUP_EXISTS)) {
5598                 if (!test_DeleteGroup_byname(p, tctx, domain_handle, r.in.name->string)) {
5599                         printf("CreateDomainGroup failed: Could not delete domain group %s - %s\n", r.in.name->string,
5600                                nt_errstr(status));
5601                         return false;
5602                 }
5603                 status = dcerpc_samr_CreateDomainGroup(p, tctx, &r);
5604         }
5605         if (NT_STATUS_EQUAL(status, NT_STATUS_USER_EXISTS)) {
5606                 if (!test_DeleteUser_byname(p, tctx, domain_handle, r.in.name->string)) {
5607
5608                         printf("CreateDomainGroup failed: Could not delete user %s - %s\n", r.in.name->string,
5609                                nt_errstr(status));
5610                         return false;
5611                 }
5612                 status = dcerpc_samr_CreateDomainGroup(p, tctx, &r);
5613         }
5614         torture_assert_ntstatus_ok(tctx, status, "CreateDomainGroup");
5615
5616         if (!test_AddGroupMember(p, tctx, domain_handle, group_handle)) {
5617                 printf("CreateDomainGroup failed - %s\n", nt_errstr(status));
5618                 ret = false;
5619         }
5620
5621         if (!test_SetGroupInfo(p, tctx, group_handle)) {
5622                 ret = false;
5623         }
5624
5625         return ret;
5626 }
5627
5628
5629 /*
5630   its not totally clear what this does. It seems to accept any sid you like.
5631 */
5632 static bool test_RemoveMemberFromForeignDomain(struct dcerpc_pipe *p,
5633                                                struct torture_context *tctx,
5634                                                struct policy_handle *domain_handle)
5635 {
5636         NTSTATUS status;
5637         struct samr_RemoveMemberFromForeignDomain r;
5638
5639         r.in.domain_handle = domain_handle;
5640         r.in.sid = dom_sid_parse_talloc(tctx, "S-1-5-32-12-34-56-78");
5641
5642         status = dcerpc_samr_RemoveMemberFromForeignDomain(p, tctx, &r);
5643         torture_assert_ntstatus_ok(tctx, status, "RemoveMemberFromForeignDomain");
5644
5645         return true;
5646 }
5647
5648
5649
5650 static bool test_Connect(struct dcerpc_pipe *p, struct torture_context *tctx,
5651                          struct policy_handle *handle);
5652
5653 static bool test_OpenDomain(struct dcerpc_pipe *p, struct torture_context *tctx,
5654                             struct policy_handle *handle, struct dom_sid *sid,
5655                             enum torture_samr_choice which_ops,
5656                             struct cli_credentials *machine_credentials)
5657 {
5658         NTSTATUS status;
5659         struct samr_OpenDomain r;
5660         struct policy_handle domain_handle;
5661         struct policy_handle alias_handle;
5662         struct policy_handle user_handle;
5663         struct policy_handle group_handle;
5664         bool ret = true;
5665
5666         ZERO_STRUCT(alias_handle);
5667         ZERO_STRUCT(user_handle);
5668         ZERO_STRUCT(group_handle);
5669         ZERO_STRUCT(domain_handle);
5670
5671         torture_comment(tctx, "Testing OpenDomain of %s\n", dom_sid_string(tctx, sid));
5672
5673         r.in.connect_handle = handle;
5674         r.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
5675         r.in.sid = sid;
5676         r.out.domain_handle = &domain_handle;
5677
5678         status = dcerpc_samr_OpenDomain(p, tctx, &r);
5679         torture_assert_ntstatus_ok(tctx, status, "OpenDomain");
5680
5681         /* run the domain tests with the main handle closed - this tests
5682            the servers reference counting */
5683         ret &= test_samr_handle_Close(p, tctx, handle);
5684
5685         switch (which_ops) {
5686         case TORTURE_SAMR_USER_ATTRIBUTES:
5687         case TORTURE_SAMR_PASSWORDS:
5688                 if (!torture_setting_bool(tctx, "samba3", false)) {
5689                         ret &= test_CreateUser2(p, tctx, &domain_handle, sid, which_ops, NULL);
5690                 }
5691                 ret &= test_CreateUser(p, tctx, &domain_handle, &user_handle, sid, which_ops, NULL);
5692                 /* This test needs 'complex' users to validate */
5693                 ret &= test_QueryDisplayInfo(p, tctx, &domain_handle);
5694                 if (!ret) {
5695                         printf("Testing PASSWORDS or ATTRIBUTES on domain %s failed!\n", dom_sid_string(tctx, sid));
5696                 }
5697                 break;
5698         case TORTURE_SAMR_PASSWORDS_PWDLASTSET:
5699                 if (!torture_setting_bool(tctx, "samba3", false)) {
5700                         ret &= test_CreateUser2(p, tctx, &domain_handle, sid, which_ops, machine_credentials);
5701                 }
5702                 ret &= test_CreateUser(p, tctx, &domain_handle, &user_handle, sid, which_ops, machine_credentials);
5703                 if (!ret) {
5704                         printf("Testing PASSWORDS PWDLASTSET on domain %s failed!\n", dom_sid_string(tctx, sid));
5705                 }
5706                 break;
5707         case TORTURE_SAMR_OTHER:
5708                 ret &= test_CreateUser(p, tctx, &domain_handle, &user_handle, sid, which_ops, NULL);
5709                 if (!ret) {
5710                         printf("Failed to CreateUser in SAMR-OTHER on domain %s!\n", dom_sid_string(tctx, sid));
5711                 }
5712                 ret &= test_QuerySecurity(p, tctx, &domain_handle);
5713                 ret &= test_RemoveMemberFromForeignDomain(p, tctx, &domain_handle);
5714                 ret &= test_CreateAlias(p, tctx, &domain_handle, &alias_handle, sid);
5715                 ret &= test_CreateDomainGroup(p, tctx, &domain_handle, &group_handle, sid);
5716                 ret &= test_QueryDomainInfo(p, tctx, &domain_handle);
5717                 ret &= test_QueryDomainInfo2(p, tctx, &domain_handle);
5718                 ret &= test_EnumDomainUsers(p, tctx, &domain_handle);
5719                 ret &= test_EnumDomainUsers_async(p, tctx, &domain_handle);
5720                 ret &= test_EnumDomainGroups(p, tctx, &domain_handle);
5721                 ret &= test_EnumDomainAliases(p, tctx, &domain_handle);
5722                 ret &= test_QueryDisplayInfo2(p, tctx, &domain_handle);
5723                 ret &= test_QueryDisplayInfo3(p, tctx, &domain_handle);
5724                 ret &= test_QueryDisplayInfo_continue(p, tctx, &domain_handle);
5725
5726                 if (torture_setting_bool(tctx, "samba4", false)) {
5727                         torture_comment(tctx, "skipping GetDisplayEnumerationIndex test against Samba4\n");
5728                 } else {
5729                         ret &= test_GetDisplayEnumerationIndex(p, tctx, &domain_handle);
5730                         ret &= test_GetDisplayEnumerationIndex2(p, tctx, &domain_handle);
5731                 }
5732                 ret &= test_GroupList(p, tctx, &domain_handle);
5733                 ret &= test_TestPrivateFunctionsDomain(p, tctx, &domain_handle);
5734                 ret &= test_RidToSid(p, tctx, sid, &domain_handle);
5735                 ret &= test_GetBootKeyInformation(p, tctx, &domain_handle);
5736                 if (!ret) {
5737                         torture_comment(tctx, "Testing SAMR-OTHER on domain %s failed!\n", dom_sid_string(tctx, sid));
5738                 }
5739                 break;
5740         }
5741
5742         if (!policy_handle_empty(&user_handle) &&
5743             !test_DeleteUser(p, tctx, &user_handle)) {
5744                 ret = false;
5745         }
5746
5747         if (!policy_handle_empty(&alias_handle) &&
5748             !test_DeleteAlias(p, tctx, &alias_handle)) {
5749                 ret = false;
5750         }
5751
5752         if (!policy_handle_empty(&group_handle) &&
5753             !test_DeleteDomainGroup(p, tctx, &group_handle)) {
5754                 ret = false;
5755         }
5756
5757         ret &= test_samr_handle_Close(p, tctx, &domain_handle);
5758
5759         /* reconnect the main handle */
5760         ret &= test_Connect(p, tctx, handle);
5761
5762         if (!ret) {
5763                 printf("Testing domain %s failed!\n", dom_sid_string(tctx, sid));
5764         }
5765
5766         return ret;
5767 }
5768
5769 static bool test_LookupDomain(struct dcerpc_pipe *p, struct torture_context *tctx,
5770                               struct policy_handle *handle, const char *domain,
5771                               enum torture_samr_choice which_ops,
5772                               struct cli_credentials *machine_credentials)
5773 {
5774         NTSTATUS status;
5775         struct samr_LookupDomain r;
5776         struct dom_sid2 *sid = NULL;
5777         struct lsa_String n1;
5778         struct lsa_String n2;
5779         bool ret = true;
5780
5781         torture_comment(tctx, "Testing LookupDomain(%s)\n", domain);
5782
5783         /* check for correct error codes */
5784         r.in.connect_handle = handle;
5785         r.in.domain_name = &n2;
5786         r.out.sid = &sid;
5787         n2.string = NULL;
5788
5789         status = dcerpc_samr_LookupDomain(p, tctx, &r);
5790         torture_assert_ntstatus_equal(tctx, NT_STATUS_INVALID_PARAMETER, status, "LookupDomain expected NT_STATUS_INVALID_PARAMETER");
5791
5792         init_lsa_String(&n2, "xxNODOMAINxx");
5793
5794         status = dcerpc_samr_LookupDomain(p, tctx, &r);
5795         torture_assert_ntstatus_equal(tctx, NT_STATUS_NO_SUCH_DOMAIN, status, "LookupDomain expected NT_STATUS_NO_SUCH_DOMAIN");
5796
5797         r.in.connect_handle = handle;
5798
5799         init_lsa_String(&n1, domain);
5800         r.in.domain_name = &n1;
5801
5802         status = dcerpc_samr_LookupDomain(p, tctx, &r);
5803         torture_assert_ntstatus_ok(tctx, status, "LookupDomain");
5804
5805         if (!test_GetDomPwInfo(p, tctx, &n1)) {
5806                 ret = false;
5807         }
5808
5809         if (!test_OpenDomain(p, tctx, handle, *r.out.sid, which_ops,
5810                              machine_credentials)) {
5811                 ret = false;
5812         }
5813
5814         return ret;
5815 }
5816
5817
5818 static bool test_EnumDomains(struct dcerpc_pipe *p, struct torture_context *tctx,
5819                              struct policy_handle *handle, enum torture_samr_choice which_ops,
5820                              struct cli_credentials *machine_credentials)
5821 {
5822         NTSTATUS status;
5823         struct samr_EnumDomains r;
5824         uint32_t resume_handle = 0;
5825         uint32_t num_entries = 0;
5826         struct samr_SamArray *sam = NULL;
5827         int i;
5828         bool ret = true;
5829
5830         r.in.connect_handle = handle;
5831         r.in.resume_handle = &resume_handle;
5832         r.in.buf_size = (uint32_t)-1;
5833         r.out.resume_handle = &resume_handle;
5834         r.out.num_entries = &num_entries;
5835         r.out.sam = &sam;
5836
5837         status = dcerpc_samr_EnumDomains(p, tctx, &r);
5838         torture_assert_ntstatus_ok(tctx, status, "EnumDomains");
5839
5840         if (!*r.out.sam) {
5841                 return false;
5842         }
5843
5844         for (i=0;i<sam->count;i++) {
5845                 if (!test_LookupDomain(p, tctx, handle,
5846                                        sam->entries[i].name.string, which_ops,
5847                                        machine_credentials)) {
5848                         ret = false;
5849                 }
5850         }
5851
5852         status = dcerpc_samr_EnumDomains(p, tctx, &r);
5853         torture_assert_ntstatus_ok(tctx, status, "EnumDomains");
5854
5855         return ret;
5856 }
5857
5858
5859 static bool test_Connect(struct dcerpc_pipe *p, struct torture_context *tctx,
5860                          struct policy_handle *handle)
5861 {
5862         NTSTATUS status;
5863         struct samr_Connect r;
5864         struct samr_Connect2 r2;
5865         struct samr_Connect3 r3;
5866         struct samr_Connect4 r4;
5867         struct samr_Connect5 r5;
5868         union samr_ConnectInfo info;
5869         struct policy_handle h;
5870         uint32_t level_out = 0;
5871         bool ret = true, got_handle = false;
5872
5873         torture_comment(tctx, "testing samr_Connect\n");
5874
5875         r.in.system_name = 0;
5876         r.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
5877         r.out.connect_handle = &h;
5878
5879         status = dcerpc_samr_Connect(p, tctx, &r);
5880         if (!NT_STATUS_IS_OK(status)) {
5881                 torture_comment(tctx, "Connect failed - %s\n", nt_errstr(status));
5882                 ret = false;
5883         } else {
5884                 got_handle = true;
5885                 *handle = h;
5886         }
5887
5888         torture_comment(tctx, "testing samr_Connect2\n");
5889
5890         r2.in.system_name = NULL;
5891         r2.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
5892         r2.out.connect_handle = &h;
5893
5894         status = dcerpc_samr_Connect2(p, tctx, &r2);
5895         if (!NT_STATUS_IS_OK(status)) {
5896                 torture_comment(tctx, "Connect2 failed - %s\n", nt_errstr(status));
5897                 ret = false;
5898         } else {
5899                 if (got_handle) {
5900                         test_samr_handle_Close(p, tctx, handle);
5901                 }
5902                 got_handle = true;
5903                 *handle = h;
5904         }
5905
5906         torture_comment(tctx, "testing samr_Connect3\n");
5907
5908         r3.in.system_name = NULL;
5909         r3.in.unknown = 0;
5910         r3.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
5911         r3.out.connect_handle = &h;
5912
5913         status = dcerpc_samr_Connect3(p, tctx, &r3);
5914         if (!NT_STATUS_IS_OK(status)) {
5915                 printf("Connect3 failed - %s\n", nt_errstr(status));
5916                 ret = false;
5917         } else {
5918                 if (got_handle) {
5919                         test_samr_handle_Close(p, tctx, handle);
5920                 }
5921                 got_handle = true;
5922                 *handle = h;
5923         }
5924
5925         torture_comment(tctx, "testing samr_Connect4\n");
5926
5927         r4.in.system_name = "";
5928         r4.in.client_version = 0;
5929         r4.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
5930         r4.out.connect_handle = &h;
5931
5932         status = dcerpc_samr_Connect4(p, tctx, &r4);
5933         if (!NT_STATUS_IS_OK(status)) {
5934                 printf("Connect4 failed - %s\n", nt_errstr(status));
5935                 ret = false;
5936         } else {
5937                 if (got_handle) {
5938                         test_samr_handle_Close(p, tctx, handle);
5939                 }
5940                 got_handle = true;
5941                 *handle = h;
5942         }
5943
5944         torture_comment(tctx, "testing samr_Connect5\n");
5945
5946         info.info1.client_version = 0;
5947         info.info1.unknown2 = 0;
5948
5949         r5.in.system_name = "";
5950         r5.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
5951         r5.in.level_in = 1;
5952         r5.out.level_out = &level_out;
5953         r5.in.info_in = &info;
5954         r5.out.info_out = &info;
5955         r5.out.connect_handle = &h;
5956
5957         status = dcerpc_samr_Connect5(p, tctx, &r5);
5958         if (!NT_STATUS_IS_OK(status)) {
5959                 printf("Connect5 failed - %s\n", nt_errstr(status));
5960                 ret = false;
5961         } else {
5962                 if (got_handle) {
5963                         test_samr_handle_Close(p, tctx, handle);
5964                 }
5965                 got_handle = true;
5966                 *handle = h;
5967         }
5968
5969         return ret;
5970 }
5971
5972
5973 bool torture_rpc_samr(struct torture_context *torture)
5974 {
5975         NTSTATUS status;
5976         struct dcerpc_pipe *p;
5977         bool ret = true;
5978         struct policy_handle handle;
5979
5980         status = torture_rpc_connection(torture, &p, &ndr_table_samr);
5981         if (!NT_STATUS_IS_OK(status)) {
5982                 return false;
5983         }
5984
5985         ret &= test_Connect(p, torture, &handle);
5986
5987         ret &= test_QuerySecurity(p, torture, &handle);
5988
5989         ret &= test_EnumDomains(p, torture, &handle, TORTURE_SAMR_OTHER, NULL);
5990
5991         ret &= test_SetDsrmPassword(p, torture, &handle);
5992
5993         ret &= test_Shutdown(p, torture, &handle);
5994
5995         ret &= test_samr_handle_Close(p, torture, &handle);
5996
5997         return ret;
5998 }
5999
6000
6001 bool torture_rpc_samr_users(struct torture_context *torture)
6002 {
6003         NTSTATUS status;
6004         struct dcerpc_pipe *p;
6005         bool ret = true;
6006         struct policy_handle handle;
6007
6008         status = torture_rpc_connection(torture, &p, &ndr_table_samr);
6009         if (!NT_STATUS_IS_OK(status)) {
6010                 return false;
6011         }
6012
6013         ret &= test_Connect(p, torture, &handle);
6014
6015         ret &= test_QuerySecurity(p, torture, &handle);
6016
6017         ret &= test_EnumDomains(p, torture, &handle, TORTURE_SAMR_USER_ATTRIBUTES, NULL);
6018
6019         ret &= test_SetDsrmPassword(p, torture, &handle);
6020
6021         ret &= test_Shutdown(p, torture, &handle);
6022
6023         ret &= test_samr_handle_Close(p, torture, &handle);
6024
6025         return ret;
6026 }
6027
6028
6029 bool torture_rpc_samr_passwords(struct torture_context *torture)
6030 {
6031         NTSTATUS status;
6032         struct dcerpc_pipe *p;
6033         bool ret = true;
6034         struct policy_handle handle;
6035
6036         status = torture_rpc_connection(torture, &p, &ndr_table_samr);
6037         if (!NT_STATUS_IS_OK(status)) {
6038                 return false;
6039         }
6040
6041         ret &= test_Connect(p, torture, &handle);
6042
6043         ret &= test_EnumDomains(p, torture, &handle, TORTURE_SAMR_PASSWORDS, NULL);
6044
6045         ret &= test_samr_handle_Close(p, torture, &handle);
6046
6047         return ret;
6048 }
6049
6050 static bool torture_rpc_samr_pwdlastset(struct torture_context *torture,
6051                                         struct dcerpc_pipe *p2,
6052                                         struct cli_credentials *machine_credentials)
6053 {
6054         NTSTATUS status;
6055         struct dcerpc_pipe *p;
6056         bool ret = true;
6057         struct policy_handle handle;
6058
6059         status = torture_rpc_connection(torture, &p, &ndr_table_samr);
6060         if (!NT_STATUS_IS_OK(status)) {
6061                 return false;
6062         }
6063
6064         ret &= test_Connect(p, torture, &handle);
6065
6066         ret &= test_EnumDomains(p, torture, &handle,
6067                                 TORTURE_SAMR_PASSWORDS_PWDLASTSET,
6068                                 machine_credentials);
6069
6070         ret &= test_samr_handle_Close(p, torture, &handle);
6071
6072         return ret;
6073 }
6074
6075 struct torture_suite *torture_rpc_samr_passwords_pwdlastset(TALLOC_CTX *mem_ctx)
6076 {
6077         struct torture_suite *suite = torture_suite_create(mem_ctx, "SAMR-PASSWORDS-PWDLASTSET");
6078         struct torture_rpc_tcase *tcase;
6079
6080         tcase = torture_suite_add_machine_rpc_iface_tcase(suite, "samr",
6081                                                           &ndr_table_samr,
6082                                                           TEST_ACCOUNT_NAME_PWD);
6083
6084         torture_rpc_tcase_add_test_creds(tcase, "pwdLastSet",
6085                                          torture_rpc_samr_pwdlastset);
6086
6087         return suite;
6088 }