This program is free software; you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
- the Free Software Foundation; either version 2 of the License, or
+ the Free Software Foundation; either version 3 of the License, or
(at your option) any later version.
This program is distributed in the hope that it will be useful,
GNU General Public License for more details.
You should have received a copy of the GNU General Public License
- along with this program; if not, write to the Free Software
- Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
+ along with this program. If not, see <http://www.gnu.org/licenses/>.
*/
#include "includes.h"
#include "torture/torture.h"
#include "librpc/gen_ndr/ndr_lsa_c.h"
+#include "librpc/gen_ndr/netlogon.h"
#include "lib/events/events.h"
-#include "libcli/security/proto.h"
+#include "libcli/security/security.h"
#include "libcli/auth/libcli_auth.h"
#include "torture/rpc/rpc.h"
return True;
}
-#define NUM_ASYNC_REQUESTS 1000
-
static void lookupsids_cb(struct rpc_request *req)
{
- int *replies = (int *)req->async.private;
+ int *replies = (int *)req->async.private_data;
NTSTATUS status;
status = dcerpc_ndr_request_recv(req);
- DEBUG(3, ("lookupsids returned %s\n", nt_errstr(status)));
if (!NT_STATUS_IS_OK(status)) {
+ printf("lookupsids returned %s\n", nt_errstr(status));
*replies = -1;
}
- *replies += 1;
+ if (*replies >= 0) {
+ *replies += 1;
+ }
}
static BOOL test_LookupSids_async(struct dcerpc_pipe *p,
{
struct lsa_SidArray sids;
struct lsa_SidPtr sidptr;
-
- uint32_t count[NUM_ASYNC_REQUESTS];
- struct lsa_TransNameArray names[NUM_ASYNC_REQUESTS];
- struct lsa_LookupSids r[NUM_ASYNC_REQUESTS];
+ uint32_t *count;
+ struct lsa_TransNameArray *names;
+ struct lsa_LookupSids *r;
struct rpc_request **req;
-
int i, replies;
BOOL ret = True;
+ const int num_async_requests = 50;
+
+ count = talloc_array(mem_ctx, uint32_t, num_async_requests);
+ names = talloc_array(mem_ctx, struct lsa_TransNameArray, num_async_requests);
+ r = talloc_array(mem_ctx, struct lsa_LookupSids, num_async_requests);
- printf("\nTesting %d async lookupsids request\n", 100);
+ printf("\nTesting %d async lookupsids request\n", num_async_requests);
- req = talloc_array(mem_ctx, struct rpc_request *, NUM_ASYNC_REQUESTS);
+ req = talloc_array(mem_ctx, struct rpc_request *, num_async_requests);
sids.num_sids = 1;
sids.sids = &sidptr;
replies = 0;
- for (i=0; i<NUM_ASYNC_REQUESTS; i++) {
+ for (i=0; i<num_async_requests; i++) {
count[i] = 0;
names[i].count = 0;
names[i].names = NULL;
}
req[i]->async.callback = lookupsids_cb;
- req[i]->async.private = &replies;
+ req[i]->async.private_data = &replies;
}
- while (replies < NUM_ASYNC_REQUESTS) {
+ while (replies >= 0 && replies < num_async_requests) {
event_loop_once(p->conn->event_ctx);
- if (replies < 0) {
- ret = False;
- break;
- }
}
talloc_free(req);
+ if (replies < 0) {
+ ret = False;
+ }
+
return ret;
}
return True;
}
+static BOOL test_DeleteTrustedDomainBySid(struct dcerpc_pipe *p,
+ TALLOC_CTX *mem_ctx,
+ struct policy_handle *handle,
+ struct dom_sid *sid)
+{
+ NTSTATUS status;
+ struct lsa_DeleteTrustedDomain r;
+
+ r.in.handle = handle;
+ r.in.dom_sid = sid;
+
+ status = dcerpc_lsa_DeleteTrustedDomain(p, mem_ctx, &r);
+ if (!NT_STATUS_IS_OK(status)) {
+ printf("lsa_DeleteTrustedDomain failed - %s\n", nt_errstr(status));
+ return False;
+ }
+
+ return True;
+}
+
static BOOL test_CreateSecret(struct dcerpc_pipe *p,
TALLOC_CTX *mem_ctx,
blob2 = data_blob_talloc(mem_ctx, NULL, blob1.length);
- secret2 = sess_decrypt_string(&blob1, &session_key);
+ secret2 = sess_decrypt_string(mem_ctx,
+ &blob1, &session_key);
if (strcmp(secret1, secret2) != 0) {
printf("Returned secret '%s' doesn't match '%s'\n",
blob2 = data_blob_talloc(mem_ctx, NULL, blob1.length);
- secret4 = sess_decrypt_string(&blob1, &session_key);
+ secret4 = sess_decrypt_string(mem_ctx,
+ &blob1, &session_key);
if (strcmp(secret3, secret4) != 0) {
printf("Returned NEW secret %s doesn't match %s\n", secret4, secret3);
blob2 = data_blob_talloc(mem_ctx, NULL, blob1.length);
- secret2 = sess_decrypt_string(&blob1, &session_key);
+ secret2 = sess_decrypt_string(mem_ctx,
+ &blob1, &session_key);
if (strcmp(secret1, secret2) != 0) {
printf("Returned OLD secret %s doesn't match %s\n", secret2, secret1);
blob2 = data_blob_talloc(mem_ctx, NULL, blob1.length);
- secret6 = sess_decrypt_string(&blob1, &session_key);
+ secret6 = sess_decrypt_string(mem_ctx,
+ &blob1, &session_key);
if (strcmp(secret3, secret4) != 0) {
printf("Returned NEW secret '%s' doesn't match '%s'\n", secret4, secret3);
blob2 = data_blob_talloc(mem_ctx, NULL, blob1.length);
- secret6 = sess_decrypt_string(&blob1, &session_key);
+ secret6 = sess_decrypt_string(mem_ctx,
+ &blob1, &session_key);
if (strcmp(secret5, secret6) != 0) {
printf("Returned OLD secret %s doesn't match %s\n", secret5, secret6);
status = dcerpc_lsa_EnumAccountRights(p, mem_ctx, &r);
if (!NT_STATUS_IS_OK(status)) {
- printf("EnumAccountRights failed - %s\n", nt_errstr(status));
+ printf("EnumAccountRights of %s failed - %s\n",
+ dom_sid_string(mem_ctx, sid), nt_errstr(status));
return False;
}
NTSTATUS status;
struct lsa_QuerySecurity r;
+ if (lp_parm_bool(-1, "torture", "samba4", False)) {
+ printf("skipping QuerySecurity test against Samba4\n");
+ return True;
+ }
+
printf("Testing QuerySecurity\n");
r.in.handle = acct_handle;
struct lsa_SidArray sids1, sids2;
uint32_t resume_handle = 0;
int i;
+ BOOL ret = True;
printf("\ntesting EnumAccounts\n");
printf("testing all accounts\n");
for (i=0;i<sids1.num_sids;i++) {
- test_OpenAccount(p, mem_ctx, handle, sids1.sids[i].sid);
- test_EnumAccountRights(p, mem_ctx, handle, sids1.sids[i].sid);
+ ret &= test_OpenAccount(p, mem_ctx, handle, sids1.sids[i].sid);
+ ret &= test_EnumAccountRights(p, mem_ctx, handle, sids1.sids[i].sid);
}
printf("\n");
}
if (sids1.num_sids < 3) {
- return True;
+ return ret;
}
printf("trying EnumAccounts partial listing (asking for 1 at 2)\n");
return ret;
}
+static BOOL test_QueryForestTrustInformation(struct dcerpc_pipe *p,
+ TALLOC_CTX *mem_ctx,
+ struct policy_handle *handle,
+ const char *trusted_domain_name)
+{
+ BOOL ret = True;
+ struct lsa_lsaRQueryForestTrustInformation r;
+ NTSTATUS status;
+ struct lsa_String string;
+ struct lsa_ForestTrustInformation info, *info_ptr;
+ uint16_t unknown = 0;
+
+ printf("\nTesting lsaRQueryForestTrustInformation\n");
+
+ if (lp_parm_bool(-1, "torture", "samba4", False)) {
+ printf("skipping QueryForestTrustInformation against Samba4\n");
+ return True;
+ }
+
+ ZERO_STRUCT(string);
+
+ if (trusted_domain_name) {
+ init_lsa_String(&string, trusted_domain_name);
+ }
+
+ info_ptr = &info;
+
+ r.in.handle = handle;
+ r.in.trusted_domain_name = &string;
+ r.in.unknown = 0;
+ r.out.forest_trust_info = &info_ptr;
+
+ status = dcerpc_lsa_lsaRQueryForestTrustInformation(p, mem_ctx, &r);
+
+ if (!NT_STATUS_IS_OK(status)) {
+ printf("lsaRQueryForestTrustInformation failed - %s\n", nt_errstr(status));
+ ret = False;
+ }
+
+ return ret;
+}
+
+static BOOL test_query_each_TrustDomEx(struct dcerpc_pipe *p,
+ TALLOC_CTX *mem_ctx,
+ struct policy_handle *handle,
+ struct lsa_DomainListEx *domains)
+{
+ NTSTATUS status;
+ int i,j;
+ BOOL ret = True;
+
+ for (i=0; i< domains->count; i++) {
+
+ if (domains->domains[i].trust_attributes & NETR_TRUST_ATTRIBUTE_FOREST_TRANSITIVE) {
+ ret &= test_QueryForestTrustInformation(p, mem_ctx, handle,
+ domains->domains[i].domain_name.string);
+ }
+ }
+
+ return ret;
+}
+
static BOOL test_query_each_TrustDom(struct dcerpc_pipe *p,
TALLOC_CTX *mem_ctx,
struct policy_handle *handle,
struct policy_handle trustdom_handle;
struct policy_handle handle2;
struct lsa_Close c;
- int levels [] = {1, 3, 6, 8, 12};
-
+ struct lsa_CloseTrustedDomainEx c_trust;
+ int levels [] = {1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12};
+ int ok[] = {1, 0, 1, 0, 0, 1, 0, 1, 0, 0, 0, 1};
+
if (domains->domains[i].sid) {
trust.in.handle = handle;
trust.in.sid = domains->domains[i].sid;
c.in.handle = &trustdom_handle;
c.out.handle = &handle2;
+ c_trust.in.handle = &trustdom_handle;
+ c_trust.out.handle = &handle2;
+
for (j=0; j < ARRAY_SIZE(levels); j++) {
struct lsa_QueryTrustedDomainInfo q;
union lsa_TrustedDomainInfo info;
q.in.level = levels[j];
q.out.info = &info;
status = dcerpc_lsa_QueryTrustedDomainInfo(p, mem_ctx, &q);
- if (!NT_STATUS_IS_OK(status)) {
+ if (!NT_STATUS_IS_OK(status) && ok[j]) {
printf("QueryTrustedDomainInfo level %d failed - %s\n",
levels[j], nt_errstr(status));
ret = False;
+ } else if (NT_STATUS_IS_OK(status) && !ok[j]) {
+ printf("QueryTrustedDomainInfo level %d unexpectedly succeeded - %s\n",
+ levels[j], nt_errstr(status));
+ ret = False;
}
}
+ status = dcerpc_lsa_CloseTrustedDomainEx(p, mem_ctx, &c_trust);
+ if (!NT_STATUS_EQUAL(status, NT_STATUS_NOT_IMPLEMENTED)) {
+ printf("Expected CloseTrustedDomainEx to return NT_STATUS_NOT_IMPLEMENTED, instead - %s\n", nt_errstr(status));
+ return False;
+ }
+
+ c.in.handle = &trustdom_handle;
+ c.out.handle = &handle2;
+
status = dcerpc_lsa_Close(p, mem_ctx, &c);
if (!NT_STATUS_IS_OK(status)) {
printf("Close of trusted domain failed - %s\n", nt_errstr(status));
return False;
}
+
+ for (j=0; j < ARRAY_SIZE(levels); j++) {
+ struct lsa_QueryTrustedDomainInfoBySid q;
+ union lsa_TrustedDomainInfo info;
+
+ if (!domains->domains[i].sid) {
+ continue;
+ }
+
+ q.in.handle = handle;
+ q.in.dom_sid = domains->domains[i].sid;
+ q.in.level = levels[j];
+ q.out.info = &info;
+ status = dcerpc_lsa_QueryTrustedDomainInfoBySid(p, mem_ctx, &q);
+ if (!NT_STATUS_IS_OK(status) && ok[j]) {
+ printf("QueryTrustedDomainInfoBySid level %d failed - %s\n",
+ levels[j], nt_errstr(status));
+ ret = False;
+ } else if (NT_STATUS_IS_OK(status) && !ok[j]) {
+ printf("QueryTrustedDomainInfoBySid level %d unexpectedly succeeded - %s\n",
+ levels[j], nt_errstr(status));
+ ret = False;
+ }
+ }
}
trust_by_name.in.handle = handle;
q.in.level = levels[j];
q.out.info = &info;
status = dcerpc_lsa_QueryTrustedDomainInfo(p, mem_ctx, &q);
- if (!NT_STATUS_IS_OK(status)) {
+ if (!NT_STATUS_IS_OK(status) && ok[j]) {
printf("QueryTrustedDomainInfo level %d failed - %s\n",
levels[j], nt_errstr(status));
ret = False;
+ } else if (NT_STATUS_IS_OK(status) && !ok[j]) {
+ printf("QueryTrustedDomainInfo level %d unexpectedly succeeded - %s\n",
+ levels[j], nt_errstr(status));
+ ret = False;
}
}
return False;
}
- for (j=0; j < ARRAY_SIZE(levels); j++) {
- struct lsa_QueryTrustedDomainInfoBySid q;
- union lsa_TrustedDomainInfo info;
-
- if (!domains->domains[i].sid) {
- continue;
- }
-
- q.in.handle = handle;
- q.in.dom_sid = domains->domains[i].sid;
- q.in.level = levels[j];
- q.out.info = &info;
- status = dcerpc_lsa_QueryTrustedDomainInfoBySid(p, mem_ctx, &q);
- if (!NT_STATUS_IS_OK(status)) {
- printf("QueryTrustedDomainInfoBySid level %d failed - %s\n",
- levels[j], nt_errstr(status));
- ret = False;
- }
- }
-
for (j=0; j < ARRAY_SIZE(levels); j++) {
struct lsa_QueryTrustedDomainInfoByName q;
union lsa_TrustedDomainInfo info;
q.in.level = levels[j];
q.out.info = &info;
status = dcerpc_lsa_QueryTrustedDomainInfoByName(p, mem_ctx, &q);
- if (!NT_STATUS_IS_OK(status)) {
+ if (!NT_STATUS_IS_OK(status) && ok[j]) {
printf("QueryTrustedDomainInfoByName level %d failed - %s\n",
levels[j], nt_errstr(status));
ret = False;
+ } else if (NT_STATUS_IS_OK(status) && !ok[j]) {
+ printf("QueryTrustedDomainInfoByName level %d unexpectedly succeeded - %s\n",
+ levels[j], nt_errstr(status));
+ ret = False;
}
}
}
struct policy_handle *handle)
{
struct lsa_EnumTrustDom r;
+ struct lsa_EnumTrustedDomainsEx r_ex;
NTSTATUS enum_status;
uint32_t resume_handle = 0;
struct lsa_DomainList domains;
+ struct lsa_DomainListEx domains_ex;
BOOL ret = True;
printf("\nTesting EnumTrustDom\n");
}
ret &= test_query_each_TrustDom(p, mem_ctx, handle, &domains);
+
+ } while ((NT_STATUS_EQUAL(enum_status, STATUS_MORE_ENTRIES)));
+
+ printf("\nTesting EnumTrustedDomainsEx\n");
+ resume_handle = 0;
+ do {
+ r_ex.in.handle = handle;
+ r_ex.in.resume_handle = &resume_handle;
+ r_ex.in.max_size = LSA_ENUM_TRUST_DOMAIN_EX_MULTIPLIER * 3;
+ r_ex.out.domains = &domains_ex;
+ r_ex.out.resume_handle = &resume_handle;
+
+ enum_status = dcerpc_lsa_EnumTrustedDomainsEx(p, mem_ctx, &r_ex);
+
+ /* NO_MORE_ENTRIES is allowed */
+ if (NT_STATUS_EQUAL(enum_status, NT_STATUS_NO_MORE_ENTRIES)) {
+ return True;
+ } else if (NT_STATUS_EQUAL(enum_status, STATUS_MORE_ENTRIES)) {
+ /* Windows 2003 gets this off by one on the first run */
+ if (r_ex.out.domains->count < 3 || r_ex.out.domains->count > 4) {
+ printf("EnumTrustDom didn't fill the buffer we "
+ "asked it to (got %d, expected %d / %d == %d entries)\n",
+ r_ex.out.domains->count,
+ r_ex.in.max_size,
+ LSA_ENUM_TRUST_DOMAIN_EX_MULTIPLIER,
+ r_ex.in.max_size / LSA_ENUM_TRUST_DOMAIN_EX_MULTIPLIER);
+ ret = False;
+ exit(1);
+ }
+ } else if (!NT_STATUS_IS_OK(enum_status)) {
+ printf("EnumTrustedDomainEx failed - %s\n", nt_errstr(enum_status));
+ return False;
+ }
+
+ ret &= test_query_each_TrustDomEx(p, mem_ctx, handle, &domains_ex);
+
} while ((NT_STATUS_EQUAL(enum_status, STATUS_MORE_ENTRIES)));
return ret;
NTSTATUS status;
BOOL ret = True;
struct lsa_CreateTrustedDomain r;
- struct lsa_TrustInformation trustinfo;
+ struct lsa_DomainInfo trustinfo;
struct dom_sid *domsid[12];
struct policy_handle trustdom_handle[12];
struct lsa_QueryTrustedDomainInfo q;
}
for (i=0; i<12; i++) {
- if (!test_Delete(p, mem_ctx, &trustdom_handle[i])) {
+ if (!test_DeleteTrustedDomainBySid(p, mem_ctx, handle, domsid[i])) {
ret = False;
}
}
NTSTATUS status;
int i;
BOOL ret = True;
+ if (lp_parm_bool(-1, "torture", "samba4", False)) {
+ printf("skipping QueryDomainInformationPolicy test against Samba4\n");
+ return True;
+ }
+
printf("\nTesting QueryDomainInformationPolicy\n");
for (i=2;i<4;i++) {
BOOL ret = True;
printf("\nTesting QueryInfoPolicy\n");
+ if (lp_parm_bool(-1, "torture", "samba4", False)) {
+ printf("skipping QueryInfoPolicy against Samba4\n");
+ return True;
+ }
+
for (i=1;i<13;i++) {
r.in.handle = handle;
r.in.level = i;
int i;
BOOL ret = True;
printf("\nTesting QueryInfoPolicy2\n");
+ if (lp_parm_bool(-1, "torture", "samba4", False)) {
+ printf("skipping QueryInfoPolicy2 against Samba4\n");
+ return True;
+ }
for (i=1;i<13;i++) {
r.in.handle = handle;
return ret;
}
-static BOOL test_GetUserName(struct dcerpc_pipe *p,
- TALLOC_CTX *mem_ctx,
- struct policy_handle *handle)
+static BOOL test_GetUserName(struct dcerpc_pipe *p, TALLOC_CTX *mem_ctx)
{
struct lsa_GetUserName r;
NTSTATUS status;
printf("\nTesting GetUserName\n");
- r.in.system_name = "\\";
- r.in.account_name = NULL;
+ r.in.system_name = "\\";
+ r.in.account_name = NULL;
r.in.authority_name = &authority_name_p;
authority_name_p.string = NULL;
return True;
}
-BOOL torture_rpc_lsa(void)
+BOOL torture_rpc_lsa(struct torture_context *torture)
{
NTSTATUS status;
struct dcerpc_pipe *p;
mem_ctx = talloc_init("torture_rpc_lsa");
- status = torture_rpc_connection(mem_ctx, &p, &dcerpc_table_lsarpc);
+ status = torture_rpc_connection(mem_ctx, &p, &ndr_table_lsarpc);
if (!NT_STATUS_IS_OK(status)) {
talloc_free(mem_ctx);
return False;
ret = False;
}
- if (!test_GetUserName(p, mem_ctx, handle)) {
- ret = False;
- }
-
#if 0
if (!test_Delete(p, mem_ctx, handle)) {
ret = False;
ret = False;
}
}
+
+ if (!test_GetUserName(p, mem_ctx)) {
+ ret = False;
+ }
+
+ talloc_free(mem_ctx);
+
+ return ret;
+}
+
+BOOL torture_rpc_lsa_get_user(struct torture_context *torture)
+{
+ NTSTATUS status;
+ struct dcerpc_pipe *p;
+ TALLOC_CTX *mem_ctx;
+ BOOL ret = True;
+
+ mem_ctx = talloc_init("torture_rpc_lsa_get_user");
+
+ status = torture_rpc_connection(mem_ctx, &p, &ndr_table_lsarpc);
+ if (!NT_STATUS_IS_OK(status)) {
+ talloc_free(mem_ctx);
+ return False;
+ }
+
+ if (!test_GetUserName(p, mem_ctx)) {
+ ret = False;
+ }
talloc_free(mem_ctx);
git.samba.org / ira / wip.git / blobdiff