Copyright (C) Andrew Tridgell 2003
Copyright (C) Andrew Bartlett <abartlet@samba.org> 2003
- Copyright (C) Guenther Deschner 2008,2009
+ Copyright (C) Guenther Deschner 2008-2010
This program is free software; you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
#include "libcli/security/security.h"
#include "torture/rpc/rpc.h"
#include "param/param.h"
+#include "auth/gensec/gensec.h"
+#include "auth/gensec/gensec_proto.h"
+#include "../libcli/auth/schannel.h"
#include <unistd.h>
enum torture_samr_choice {
TORTURE_SAMR_PASSWORDS,
TORTURE_SAMR_PASSWORDS_PWDLASTSET,
+ TORTURE_SAMR_PASSWORDS_BADPWDCOUNT,
+ TORTURE_SAMR_PASSWORDS_LOCKOUT,
TORTURE_SAMR_USER_ATTRIBUTES,
TORTURE_SAMR_USER_PRIVILEGES,
TORTURE_SAMR_OTHER,
TORTURE_SAMR_MANY_ALIASES
};
+struct torture_samr_context {
+ struct policy_handle handle;
+ struct cli_credentials *machine_credentials;
+ enum torture_samr_choice choice;
+ uint32_t num_objects_large_dc;
+};
+
static bool test_QueryUserInfo(struct dcerpc_pipe *p,
struct torture_context *tctx,
struct policy_handle *handle);
q0.in.level = 12;
do { TESTCALL(QueryUserInfo, q0) } while (0);
- /* Samba 3 cannot store comment fields atm. - gd */
- if (!torture_setting_bool(tctx, "samba3", false)) {
- TEST_USERINFO_STRING(2, comment, 1, comment, "xx2-1 comment", 0);
- TEST_USERINFO_STRING(2, comment, 21, comment, "xx2-21 comment", 0);
- TEST_USERINFO_STRING(21, comment, 21, comment, "xx21-21 comment",
- SAMR_FIELD_COMMENT);
- }
+ TEST_USERINFO_STRING(2, comment, 1, comment, "xx2-1 comment", 0);
+ TEST_USERINFO_STRING(2, comment, 21, comment, "xx2-21 comment", 0);
+ TEST_USERINFO_STRING(21, comment, 21, comment, "xx21-21 comment",
+ SAMR_FIELD_COMMENT);
test_account_name = talloc_asprintf(tctx, "%sxx7-1", base_account_name);
TEST_USERINFO_STRING(7, account_name, 1, account_name, base_account_name, 0);
status = dcerpc_fetch_session_key(p, &session_key);
if (!NT_STATUS_IS_OK(status)) {
- printf("SetUserInfo level %u - no session key - %s\n",
+ torture_warning(tctx, "SetUserInfo level %u - no session key - %s\n",
s.in.level, nt_errstr(status));
return false;
}
status = dcerpc_samr_SetUserInfo(p, tctx, &s);
if (!NT_STATUS_IS_OK(status)) {
- printf("SetUserInfo level %u failed - %s\n",
+ torture_warning(tctx, "SetUserInfo level %u failed - %s\n",
s.in.level, nt_errstr(status));
ret = false;
} else {
status = dcerpc_fetch_session_key(p, &session_key);
if (!NT_STATUS_IS_OK(status)) {
- printf("SetUserInfo level %u - no session key - %s\n",
+ torture_warning(tctx, "SetUserInfo level %u - no session key - %s\n",
s.in.level, nt_errstr(status));
return false;
}
status = dcerpc_samr_SetUserInfo(p, tctx, &s);
if (!NT_STATUS_IS_OK(status)) {
- printf("SetUserInfo level %u failed - %s\n",
+ torture_warning(tctx, "SetUserInfo level %u failed - %s\n",
s.in.level, nt_errstr(status));
ret = false;
} else {
status = dcerpc_fetch_session_key(p, &session_key);
if (!NT_STATUS_IS_OK(status)) {
- printf("SetUserInfo level %u - no session key - %s\n",
+ torture_warning(tctx, "SetUserInfo level %u - no session key - %s\n",
s.in.level, nt_errstr(status));
return false;
}
status = dcerpc_samr_SetUserInfo(p, tctx, &s);
if (!NT_STATUS_EQUAL(status, NT_STATUS_WRONG_PASSWORD)) {
- printf("SetUserInfo level %u should have failed with WRONG_PASSWORD- %s\n",
+ torture_warning(tctx, "SetUserInfo level %u should have failed with WRONG_PASSWORD- %s\n",
s.in.level, nt_errstr(status));
ret = false;
}
status = dcerpc_fetch_session_key(p, &session_key);
if (!NT_STATUS_IS_OK(status)) {
- printf("SetUserInfo level %u - no session key - %s\n",
+ torture_warning(tctx, "SetUserInfo level %u - no session key - %s\n",
s.in.level, nt_errstr(status));
return false;
}
status = dcerpc_samr_SetUserInfo(p, tctx, &s);
if (!NT_STATUS_IS_OK(status)) {
- printf("SetUserInfo level %u failed - %s\n",
+ torture_warning(tctx, "SetUserInfo level %u failed - %s\n",
s.in.level, nt_errstr(status));
ret = false;
} else {
status = dcerpc_samr_SetUserInfo(p, tctx, &s);
if (!NT_STATUS_EQUAL(status, NT_STATUS_WRONG_PASSWORD)) {
- printf("SetUserInfo level %u should have failed with WRONG_PASSWORD: %s\n",
+ torture_warning(tctx, "SetUserInfo level %u should have failed with WRONG_PASSWORD: %s\n",
s.in.level, nt_errstr(status));
ret = false;
} else {
status = dcerpc_fetch_session_key(p, &session_key);
if (!NT_STATUS_IS_OK(status)) {
- printf("SetUserInfo level %u - no session key - %s\n",
+ torture_warning(tctx, "SetUserInfo level %u - no session key - %s\n",
s.in.level, nt_errstr(status));
return false;
}
status = dcerpc_samr_SetUserInfo(p, tctx, &s);
if (!NT_STATUS_IS_OK(status)) {
- printf("SetUserInfo level %u failed - %s\n",
+ torture_warning(tctx, "SetUserInfo level %u failed - %s\n",
s.in.level, nt_errstr(status));
ret = false;
} else {
status = dcerpc_samr_SetUserInfo(p, tctx, &s);
if (!NT_STATUS_EQUAL(status, NT_STATUS_WRONG_PASSWORD)) {
- printf("SetUserInfo level %u should have failed with WRONG_PASSWORD- %s\n",
+ torture_warning(tctx, "SetUserInfo level %u should have failed with WRONG_PASSWORD- %s\n",
s.in.level, nt_errstr(status));
ret = false;
}
status = dcerpc_fetch_session_key(p, &session_key);
if (!NT_STATUS_IS_OK(status)) {
- printf("SetUserInfo level %u - no session key - %s\n",
+ torture_warning(tctx, "SetUserInfo level %u - no session key - %s\n",
s.in.level, nt_errstr(status));
return false;
}
status = dcerpc_samr_SetUserInfo(p, tctx, &s);
if (!NT_STATUS_IS_OK(status)) {
- printf("SetUserInfo level %u failed - %s\n",
+ torture_warning(tctx, "SetUserInfo level %u failed - %s\n",
s.in.level, nt_errstr(status));
ret = false;
} else {
status = dcerpc_fetch_session_key(p, &session_key);
if (!NT_STATUS_IS_OK(status)) {
- printf("SetUserInfo level %u - no session key - %s\n",
+ torture_warning(tctx, "SetUserInfo level %u - no session key - %s\n",
s.in.level, nt_errstr(status));
return false;
}
status = dcerpc_samr_SetUserInfo(p, tctx, &s);
if (!NT_STATUS_IS_OK(status)) {
- printf("SetUserInfo level %u failed - %s\n",
+ torture_warning(tctx, "SetUserInfo level %u failed - %s\n",
s.in.level, nt_errstr(status));
ret = false;
} else {
status = dcerpc_samr_SetUserInfo(p, tctx, &s);
if (!NT_STATUS_EQUAL(status, NT_STATUS_INVALID_PARAMETER)) {
- printf("SetUserInfo level %u should have failed with NT_STATUS_INVALID_PARAMETER - %s\n",
+ torture_warning(tctx, "SetUserInfo level %u should have failed with NT_STATUS_INVALID_PARAMETER - %s\n",
s.in.level, nt_errstr(status));
ret = false;
}
status = dcerpc_samr_SetUserInfo(p, tctx, &s);
if (!NT_STATUS_EQUAL(status, NT_STATUS_INVALID_PARAMETER)) {
- printf("SetUserInfo level %u should have failed with NT_STATUS_INVALID_PARAMETER - %s\n",
+ torture_warning(tctx, "SetUserInfo level %u should have failed with NT_STATUS_INVALID_PARAMETER - %s\n",
s.in.level, nt_errstr(status));
ret = false;
}
status = dcerpc_fetch_session_key(p, &session_key);
if (!NT_STATUS_IS_OK(status)) {
- printf("SetUserInfo level %u - no session key - %s\n",
+ torture_warning(tctx, "SetUserInfo level %u - no session key - %s\n",
s.in.level, nt_errstr(status));
return false;
}
}
if (!NT_STATUS_IS_OK(status)) {
- printf("SetUserInfo%s level %u failed - %s\n",
+ torture_warning(tctx, "SetUserInfo%s level %u failed - %s\n",
use_setinfo2 ? "2":"", level, nt_errstr(status));
ret = false;
} else {
case ALIASINFONAME: init_lsa_String(&r.in.info->name,TEST_ALIASNAME); break;
case ALIASINFODESCRIPTION: init_lsa_String(&r.in.info->description,
"Test Description, should test I18N as well"); break;
- case ALIASINFOALL: printf("ALIASINFOALL ignored\n"); break;
+ case ALIASINFOALL: torture_comment(tctx, "ALIASINFOALL ignored\n"); break;
}
status = dcerpc_samr_SetAliasInfo(p, tctx, &r);
if (!NT_STATUS_IS_OK(status)) {
- printf("SetAliasInfo level %u failed - %s\n",
+ torture_warning(tctx, "SetAliasInfo level %u failed - %s\n",
levels[i], nt_errstr(status));
ret = false;
}
status = dcerpc_samr_QueryAliasInfo(p, tctx, &q);
if (!NT_STATUS_IS_OK(status)) {
- printf("QueryAliasInfo level %u failed - %s\n",
+ torture_warning(tctx, "QueryAliasInfo level %u failed - %s\n",
levels[i], nt_errstr(status));
ret = false;
}
n.in.num_names = 2;
status = dcerpc_samr_LookupNames(p, tctx, &n);
if (!NT_STATUS_EQUAL(status, STATUS_SOME_UNMAPPED)) {
- printf("LookupNames[2] failed - %s\n", nt_errstr(status));
+ torture_warning(tctx, "LookupNames[2] failed - %s\n", nt_errstr(status));
if (NT_STATUS_IS_OK(status)) {
return NT_STATUS_UNSUCCESSFUL;
}
n.in.num_names = 0;
status = dcerpc_samr_LookupNames(p, tctx, &n);
if (!NT_STATUS_IS_OK(status)) {
- printf("LookupNames[0] failed - %s\n", nt_errstr(status));
+ torture_warning(tctx, "LookupNames[0] failed - %s\n", nt_errstr(status));
return status;
}
n.in.num_names = 1;
status = dcerpc_samr_LookupNames(p, tctx, &n);
if (!NT_STATUS_EQUAL(status, NT_STATUS_NONE_MAPPED)) {
- printf("LookupNames[1 bad name] failed - %s\n", nt_errstr(status));
+ torture_warning(tctx, "LookupNames[1 bad name] failed - %s\n", nt_errstr(status));
if (NT_STATUS_IS_OK(status)) {
return NT_STATUS_UNSUCCESSFUL;
}
n.in.num_names = 2;
status = dcerpc_samr_LookupNames(p, tctx, &n);
if (!NT_STATUS_EQUAL(status, NT_STATUS_NONE_MAPPED)) {
- printf("LookupNames[2 bad names] failed - %s\n", nt_errstr(status));
+ torture_warning(tctx, "LookupNames[2 bad names] failed - %s\n", nt_errstr(status));
if (NT_STATUS_IS_OK(status)) {
return NT_STATUS_UNSUCCESSFUL;
}
r.out.user_handle = user_handle;
status = dcerpc_samr_OpenUser(p, tctx, &r);
if (!NT_STATUS_IS_OK(status)) {
- printf("OpenUser_byname(%s -> %d) failed - %s\n", name, rid, nt_errstr(status));
+ torture_warning(tctx, "OpenUser_byname(%s -> %d) failed - %s\n", name, rid, nt_errstr(status));
}
return status;
return false;
}
- printf("Testing ChangePasswordUser for user 'testuser'\n");
+ torture_comment(tctx, "Testing ChangePasswordUser for user 'testuser'\n");
- printf("old password: %s\n", oldpass);
- printf("new password: %s\n", newpass);
+ torture_comment(tctx, "old password: %s\n", oldpass);
+ torture_comment(tctx, "new password: %s\n", newpass);
E_md4hash(oldpass, old_nt_hash);
E_md4hash(newpass, new_nt_hash);
status = dcerpc_samr_ChangePasswordUser(p, tctx, &r);
if (!NT_STATUS_IS_OK(status)) {
- printf("ChangePasswordUser failed - %s\n", nt_errstr(status));
+ torture_warning(tctx, "ChangePasswordUser failed - %s\n", nt_errstr(status));
ret = false;
}
status = dcerpc_samr_ChangePasswordUser(p, tctx, &r);
if (!NT_STATUS_EQUAL(status, NT_STATUS_WRONG_PASSWORD)) {
- printf("ChangePasswordUser failed: expected NT_STATUS_WRONG_PASSWORD because we broke the LM cross-hash, got %s\n", nt_errstr(status));
+ torture_warning(tctx, "ChangePasswordUser failed: expected NT_STATUS_WRONG_PASSWORD because we broke the LM cross-hash, got %s\n", nt_errstr(status));
ret = false;
}
status = dcerpc_samr_ChangePasswordUser(p, tctx, &r);
if (!NT_STATUS_EQUAL(status, NT_STATUS_WRONG_PASSWORD)) {
- printf("ChangePasswordUser failed: expected NT_STATUS_WRONG_PASSWORD because we broke the NT cross-hash, got %s\n", nt_errstr(status));
+ torture_warning(tctx, "ChangePasswordUser failed: expected NT_STATUS_WRONG_PASSWORD because we broke the NT cross-hash, got %s\n", nt_errstr(status));
ret = false;
}
changed = true;
*password = newpass;
} else if (!NT_STATUS_EQUAL(NT_STATUS_PASSWORD_RESTRICTION, status)) {
- printf("ChangePasswordUser failed: expected NT_STATUS_OK, or at least NT_STATUS_PASSWORD_RESTRICTION, got %s\n", nt_errstr(status));
+ torture_warning(tctx, "ChangePasswordUser failed: expected NT_STATUS_OK, or at least NT_STATUS_PASSWORD_RESTRICTION, got %s\n", nt_errstr(status));
ret = false;
}
changed = true;
*password = newpass;
} else if (!NT_STATUS_EQUAL(NT_STATUS_PASSWORD_RESTRICTION, status)) {
- printf("ChangePasswordUser failed: expected NT_STATUS_NT_CROSS_ENCRYPTION_REQUIRED, got %s\n", nt_errstr(status));
+ torture_warning(tctx, "ChangePasswordUser failed: expected NT_STATUS_NT_CROSS_ENCRYPTION_REQUIRED, got %s\n", nt_errstr(status));
ret = false;
}
status = dcerpc_samr_ChangePasswordUser(p, tctx, &r);
if (NT_STATUS_EQUAL(status, NT_STATUS_PASSWORD_RESTRICTION)) {
- printf("ChangePasswordUser returned: %s perhaps min password age? (not fatal)\n", nt_errstr(status));
+ torture_comment(tctx, "ChangePasswordUser returned: %s perhaps min password age? (not fatal)\n", nt_errstr(status));
} else if (!NT_STATUS_IS_OK(status)) {
- printf("ChangePasswordUser failed - %s\n", nt_errstr(status));
+ torture_warning(tctx, "ChangePasswordUser failed - %s\n", nt_errstr(status));
ret = false;
} else {
changed = true;
if (changed) {
status = dcerpc_samr_ChangePasswordUser(p, tctx, &r);
if (NT_STATUS_EQUAL(status, NT_STATUS_PASSWORD_RESTRICTION)) {
- printf("ChangePasswordUser returned: %s perhaps min password age? (not fatal)\n", nt_errstr(status));
+ torture_comment(tctx, "ChangePasswordUser returned: %s perhaps min password age? (not fatal)\n", nt_errstr(status));
} else if (!NT_STATUS_EQUAL(status, NT_STATUS_WRONG_PASSWORD)) {
- printf("ChangePasswordUser failed: expected NT_STATUS_WRONG_PASSWORD because we already changed the password, got %s\n", nt_errstr(status));
+ torture_warning(tctx, "ChangePasswordUser failed: expected NT_STATUS_WRONG_PASSWORD because we already changed the password, got %s\n", nt_errstr(status));
ret = false;
}
}
if (!NT_STATUS_EQUAL(status, NT_STATUS_PASSWORD_RESTRICTION)
&& !NT_STATUS_EQUAL(status, NT_STATUS_WRONG_PASSWORD)) {
- printf("OemChangePasswordUser2 failed, should have returned WRONG_PASSWORD (or at least 'PASSWORD_RESTRICTON') for invalid password verifier - %s\n",
+ torture_warning(tctx, "OemChangePasswordUser2 failed, should have returned WRONG_PASSWORD (or at least 'PASSWORD_RESTRICTON') for invalid password verifier - %s\n",
nt_errstr(status));
ret = false;
}
if (!NT_STATUS_EQUAL(status, NT_STATUS_PASSWORD_RESTRICTION)
&& !NT_STATUS_EQUAL(status, NT_STATUS_WRONG_PASSWORD)) {
- printf("OemChangePasswordUser2 failed, should have returned WRONG_PASSWORD (or at least 'PASSWORD_RESTRICTON') for invalidly encrpted password - %s\n",
+ torture_warning(tctx, "OemChangePasswordUser2 failed, should have returned WRONG_PASSWORD (or at least 'PASSWORD_RESTRICTON') for invalidly encrpted password - %s\n",
nt_errstr(status));
ret = false;
}
if (!NT_STATUS_EQUAL(status, NT_STATUS_PASSWORD_RESTRICTION)
&& !NT_STATUS_EQUAL(status, NT_STATUS_INVALID_PARAMETER)) {
- printf("OemChangePasswordUser2 failed, should have returned INVALID_PARAMETER (or at least 'PASSWORD_RESTRICTON') for no supplied validation hash - %s\n",
+ torture_warning(tctx, "OemChangePasswordUser2 failed, should have returned INVALID_PARAMETER (or at least 'PASSWORD_RESTRICTON') for no supplied validation hash - %s\n",
nt_errstr(status));
ret = false;
}
status = dcerpc_samr_OemChangePasswordUser2(p, tctx, &r);
if (!NT_STATUS_EQUAL(status, NT_STATUS_INVALID_PARAMETER)) {
- printf("OemChangePasswordUser2 failed, should have returned INVALID_PARAMETER for no supplied validation hash and invalid user - %s\n",
+ torture_warning(tctx, "OemChangePasswordUser2 failed, should have returned INVALID_PARAMETER for no supplied validation hash and invalid user - %s\n",
nt_errstr(status));
ret = false;
}
status = dcerpc_samr_OemChangePasswordUser2(p, tctx, &r);
if (!NT_STATUS_EQUAL(status, NT_STATUS_WRONG_PASSWORD)) {
- printf("OemChangePasswordUser2 failed, should have returned WRONG_PASSWORD for invalid user - %s\n",
+ torture_warning(tctx, "OemChangePasswordUser2 failed, should have returned WRONG_PASSWORD for invalid user - %s\n",
nt_errstr(status));
ret = false;
}
status = dcerpc_samr_OemChangePasswordUser2(p, tctx, &r);
if (!NT_STATUS_EQUAL(status, NT_STATUS_INVALID_PARAMETER)) {
- printf("OemChangePasswordUser2 failed, should have returned INVALID_PARAMETER for no supplied password and invalid user - %s\n",
+ torture_warning(tctx, "OemChangePasswordUser2 failed, should have returned INVALID_PARAMETER for no supplied password and invalid user - %s\n",
nt_errstr(status));
ret = false;
}
status = dcerpc_samr_OemChangePasswordUser2(p, tctx, &r);
if (NT_STATUS_EQUAL(status, NT_STATUS_PASSWORD_RESTRICTION)) {
- printf("OemChangePasswordUser2 returned: %s perhaps min password age? (not fatal)\n", nt_errstr(status));
+ torture_comment(tctx, "OemChangePasswordUser2 returned: %s perhaps min password age? (not fatal)\n", nt_errstr(status));
} else if (!NT_STATUS_IS_OK(status)) {
- printf("OemChangePasswordUser2 failed - %s\n", nt_errstr(status));
+ torture_warning(tctx, "OemChangePasswordUser2 failed - %s\n", nt_errstr(status));
ret = false;
} else {
*password = newpass;
status = dcerpc_samr_ChangePasswordUser2(p, tctx, &r);
if (allow_password_restriction && NT_STATUS_EQUAL(status, NT_STATUS_PASSWORD_RESTRICTION)) {
- printf("ChangePasswordUser2 returned: %s perhaps min password age? (not fatal)\n", nt_errstr(status));
+ torture_comment(tctx, "ChangePasswordUser2 returned: %s perhaps min password age? (not fatal)\n", nt_errstr(status));
} else if (!NT_STATUS_IS_OK(status)) {
- printf("ChangePasswordUser2 failed - %s\n", nt_errstr(status));
+ torture_warning(tctx, "ChangePasswordUser2 failed - %s\n", nt_errstr(status));
ret = false;
} else {
*password = newpass;
uint8_t old_lm_hash[16], new_lm_hash[16];
NTTIME t;
struct samr_DomInfo1 *dominfo = NULL;
- struct samr_ChangeReject *reject = NULL;
+ struct userPwdChangeFailureInformation *reject = NULL;
torture_comment(tctx, "Testing ChangePasswordUser3\n");
status = dcerpc_samr_ChangePasswordUser3(p, tctx, &r);
if (!NT_STATUS_EQUAL(status, NT_STATUS_PASSWORD_RESTRICTION) &&
(!NT_STATUS_EQUAL(status, NT_STATUS_WRONG_PASSWORD))) {
- printf("ChangePasswordUser3 failed, should have returned WRONG_PASSWORD (or at least 'PASSWORD_RESTRICTON') for invalid password verifier - %s\n",
+ torture_warning(tctx, "ChangePasswordUser3 failed, should have returned WRONG_PASSWORD (or at least 'PASSWORD_RESTRICTON') for invalid password verifier - %s\n",
nt_errstr(status));
ret = false;
}
status = dcerpc_samr_ChangePasswordUser3(p, tctx, &r);
if (!NT_STATUS_EQUAL(status, NT_STATUS_PASSWORD_RESTRICTION) &&
(!NT_STATUS_EQUAL(status, NT_STATUS_WRONG_PASSWORD))) {
- printf("ChangePasswordUser3 failed, should have returned WRONG_PASSWORD (or at least 'PASSWORD_RESTRICTON') for invalidly encrpted password - %s\n",
+ torture_warning(tctx, "ChangePasswordUser3 failed, should have returned WRONG_PASSWORD (or at least 'PASSWORD_RESTRICTON') for invalidly encrpted password - %s\n",
nt_errstr(status));
ret = false;
}
r.in.account = &account_bad;
status = dcerpc_samr_ChangePasswordUser3(p, tctx, &r);
if (!NT_STATUS_EQUAL(status, NT_STATUS_WRONG_PASSWORD)) {
- printf("ChangePasswordUser3 failed, should have returned WRONG_PASSWORD for invalid username - %s\n",
+ torture_warning(tctx, "ChangePasswordUser3 failed, should have returned WRONG_PASSWORD for invalid username - %s\n",
nt_errstr(status));
ret = false;
}
&& (!null_nttime(last_password_change) || !dominfo->min_password_age)) {
if (dominfo->password_properties & DOMAIN_REFUSE_PASSWORD_CHANGE ) {
- if (reject && (reject->reason != SAMR_REJECT_OTHER)) {
- printf("expected SAMR_REJECT_OTHER (%d), got %d\n",
- SAMR_REJECT_OTHER, reject->reason);
+ if (reject && (reject->extendedFailureReason != SAM_PWD_CHANGE_NO_ERROR)) {
+ torture_warning(tctx, "expected SAM_PWD_CHANGE_NO_ERROR (%d), got %d\n",
+ SAM_PWD_CHANGE_NO_ERROR, reject->extendedFailureReason);
return false;
}
}
if ((dominfo->min_password_age > 0) && !null_nttime(last_password_change) &&
(last_password_change + dominfo->min_password_age > t)) {
- if (reject->reason != SAMR_REJECT_OTHER) {
- printf("expected SAMR_REJECT_OTHER (%d), got %d\n",
- SAMR_REJECT_OTHER, reject->reason);
+ if (reject->extendedFailureReason != SAM_PWD_CHANGE_NO_ERROR) {
+ torture_warning(tctx, "expected SAM_PWD_CHANGE_NO_ERROR (%d), got %d\n",
+ SAM_PWD_CHANGE_NO_ERROR, reject->extendedFailureReason);
return false;
}
} else if ((dominfo->min_password_length > 0) &&
(strlen(newpass) < dominfo->min_password_length)) {
- if (reject->reason != SAMR_REJECT_TOO_SHORT) {
- printf("expected SAMR_REJECT_TOO_SHORT (%d), got %d\n",
- SAMR_REJECT_TOO_SHORT, reject->reason);
+ if (reject->extendedFailureReason != SAM_PWD_CHANGE_PASSWORD_TOO_SHORT) {
+ torture_warning(tctx, "expected SAM_PWD_CHANGE_PASSWORD_TOO_SHORT (%d), got %d\n",
+ SAM_PWD_CHANGE_PASSWORD_TOO_SHORT, reject->extendedFailureReason);
return false;
}
} else if ((dominfo->password_history_length > 0) &&
strequal(oldpass, newpass)) {
- if (reject->reason != SAMR_REJECT_IN_HISTORY) {
- printf("expected SAMR_REJECT_IN_HISTORY (%d), got %d\n",
- SAMR_REJECT_IN_HISTORY, reject->reason);
+ if (reject->extendedFailureReason != SAM_PWD_CHANGE_PWD_IN_HISTORY) {
+ torture_warning(tctx, "expected SAM_PWD_CHANGE_PWD_IN_HISTORY (%d), got %d\n",
+ SAM_PWD_CHANGE_PWD_IN_HISTORY, reject->extendedFailureReason);
return false;
}
} else if (dominfo->password_properties & DOMAIN_PASSWORD_COMPLEX) {
- if (reject->reason != SAMR_REJECT_COMPLEXITY) {
- printf("expected SAMR_REJECT_COMPLEXITY (%d), got %d\n",
- SAMR_REJECT_COMPLEXITY, reject->reason);
+ if (reject->extendedFailureReason != SAM_PWD_CHANGE_NOT_COMPLEX) {
+ torture_warning(tctx, "expected SAM_PWD_CHANGE_NOT_COMPLEX (%d), got %d\n",
+ SAM_PWD_CHANGE_NOT_COMPLEX, reject->extendedFailureReason);
return false;
}
}
- if (reject->reason == SAMR_REJECT_TOO_SHORT) {
+ if (reject->extendedFailureReason == SAM_PWD_CHANGE_PASSWORD_TOO_SHORT) {
/* retry with adjusted size */
return test_ChangePasswordUser3(p, tctx, account_string,
dominfo->min_password_length,
}
} else if (NT_STATUS_EQUAL(status, NT_STATUS_PASSWORD_RESTRICTION)) {
- if (reject && reject->reason != SAMR_REJECT_OTHER) {
- printf("expected SAMR_REJECT_OTHER (%d), got %d\n",
- SAMR_REJECT_OTHER, reject->reason);
+ if (reject && reject->extendedFailureReason != SAM_PWD_CHANGE_NO_ERROR) {
+ torture_warning(tctx, "expected SAM_PWD_CHANGE_NO_ERROR (%d), got %d\n",
+ SAM_PWD_CHANGE_NO_ERROR, reject->extendedFailureReason);
return false;
}
/* Perhaps the server has a 'min password age' set? */
uint8_t old_nt_hash[16], new_nt_hash[16];
NTTIME t;
struct samr_DomInfo1 *dominfo = NULL;
- struct samr_ChangeReject *reject = NULL;
+ struct userPwdChangeFailureInformation *reject = NULL;
new_random_pass = samr_very_rand_pass(tctx, 128);
status = dcerpc_fetch_session_key(p, &session_key);
if (!NT_STATUS_IS_OK(status)) {
- printf("SetUserInfo level %u - no session key - %s\n",
+ torture_warning(tctx, "SetUserInfo level %u - no session key - %s\n",
s.in.level, nt_errstr(status));
return false;
}
status = dcerpc_samr_SetUserInfo(p, tctx, &s);
if (!NT_STATUS_IS_OK(status)) {
- printf("SetUserInfo level %u failed - %s\n",
+ torture_warning(tctx, "SetUserInfo level %u failed - %s\n",
s.in.level, nt_errstr(status));
ret = false;
}
status = dcerpc_samr_ChangePasswordUser3(p, tctx, &r);
if (NT_STATUS_EQUAL(status, NT_STATUS_PASSWORD_RESTRICTION)) {
- if (reject && reject->reason != SAMR_REJECT_OTHER) {
- printf("expected SAMR_REJECT_OTHER (%d), got %d\n",
- SAMR_REJECT_OTHER, reject->reason);
+ if (reject && reject->extendedFailureReason != SAM_PWD_CHANGE_NO_ERROR) {
+ torture_warning(tctx, "expected SAM_PWD_CHANGE_NO_ERROR (%d), got %d\n",
+ SAM_PWD_CHANGE_NO_ERROR, reject->extendedFailureReason);
return false;
}
/* Perhaps the server has a 'min password age' set? */
} else if (!NT_STATUS_IS_OK(status)) {
- printf("ChangePasswordUser3 failed - %s\n", nt_errstr(status));
+ torture_warning(tctx, "ChangePasswordUser3 failed - %s\n", nt_errstr(status));
ret = false;
}
status = dcerpc_samr_ChangePasswordUser3(p, tctx, &r);
if (NT_STATUS_EQUAL(status, NT_STATUS_PASSWORD_RESTRICTION)) {
- if (reject && reject->reason != SAMR_REJECT_OTHER) {
- printf("expected SAMR_REJECT_OTHER (%d), got %d\n",
- SAMR_REJECT_OTHER, reject->reason);
+ if (reject && reject->extendedFailureReason != SAM_PWD_CHANGE_NO_ERROR) {
+ torture_warning(tctx, "expected SAM_PWD_CHANGE_NO_ERROR (%d), got %d\n",
+ SAM_PWD_CHANGE_NO_ERROR, reject->extendedFailureReason);
return false;
}
/* Perhaps the server has a 'min password age' set? */
return true;
}
+static bool test_GetAliasMembership(struct dcerpc_pipe *p,
+ struct torture_context *tctx,
+ struct policy_handle *domain_handle)
+{
+ struct samr_GetAliasMembership r;
+ struct lsa_SidArray sids;
+ struct samr_Ids rids;
+ NTSTATUS status;
+
+ torture_comment(tctx, "Testing GetAliasMembership\n");
+
+ if (torture_setting_bool(tctx, "samba4", false)) {
+ torture_skip(tctx, "skipping GetAliasMembership against s4");
+ }
+
+ r.in.domain_handle = domain_handle;
+ r.in.sids = &sids;
+ r.out.rids = &rids;
+
+ sids.num_sids = 0;
+ sids.sids = talloc_zero_array(tctx, struct lsa_SidPtr, sids.num_sids);
+
+ status = dcerpc_samr_GetAliasMembership(p, tctx, &r);
+ torture_assert_ntstatus_ok(tctx, status,
+ "samr_GetAliasMembership failed");
+
+ torture_assert_int_equal(tctx, sids.num_sids, rids.count,
+ "protocol misbehaviour");
+
+ sids.num_sids = 1;
+ sids.sids = talloc_zero_array(tctx, struct lsa_SidPtr, sids.num_sids);
+ sids.sids[0].sid = dom_sid_parse_talloc(tctx, "S-1-5-32-1-2-3-1");
+
+ status = dcerpc_samr_GetAliasMembership(p, tctx, &r);
+ torture_assert_ntstatus_ok(tctx, status,
+ "samr_GetAliasMembership failed");
+
+#if 0
+ /* only true for w2k8 it seems
+ * win7, xp, w2k3 will return a 0 length array pointer */
+
+ if (rids.ids && (rids.count == 0)) {
+ torture_fail(tctx, "samr_GetAliasMembership returned 0 count and a rids array");
+ }
+#endif
+ if (!rids.ids && rids.count) {
+ torture_fail(tctx, "samr_GetAliasMembership returned non-0 count but no rids");
+ }
+
+ return true;
+}
+
static bool test_TestPrivateFunctionsUser(struct dcerpc_pipe *p, struct torture_context *tctx,
struct policy_handle *user_handle)
{
if (!NT_STATUS_IS_OK(status) &&
!NT_STATUS_EQUAL(status, NT_STATUS_INVALID_INFO_CLASS)) {
- printf("QueryUserInfo%s level %u failed - %s\n",
+ torture_warning(tctx, "QueryUserInfo%s level %u failed - %s\n",
use_info2 ? "2":"", levels[i], nt_errstr(status));
return false;
}
return true;
}
-static bool test_SamLogon_Creds(struct dcerpc_pipe *p, struct torture_context *tctx,
- struct cli_credentials *machine_credentials,
- struct cli_credentials *test_credentials,
- struct netlogon_creds_CredentialState *creds,
- NTSTATUS expected_result)
+static bool test_SamLogon(struct torture_context *tctx,
+ struct dcerpc_pipe *p,
+ struct cli_credentials *test_credentials,
+ NTSTATUS expected_result,
+ bool interactive)
{
NTSTATUS status;
- struct netr_LogonSamLogon r;
- struct netr_Authenticator auth, auth2;
+ struct netr_LogonSamLogonEx r;
union netr_LogonLevel logon;
union netr_Validation validation;
uint8_t authoritative;
+ struct netr_IdentityInfo identity;
struct netr_NetworkInfo ninfo;
+ struct netr_PasswordInfo pinfo;
DATA_BLOB names_blob, chal, lm_resp, nt_resp;
int flags = CLI_CRED_NTLM_AUTH;
+ uint32_t samlogon_flags = 0;
+ struct netlogon_creds_CredentialState *creds;
+ struct netr_Authenticator a;
+
+ torture_assert_ntstatus_ok(tctx, dcerpc_schannel_creds(p->conn->security_state.generic_state, tctx, &creds), "");
if (lp_client_lanman_auth(tctx->lp_ctx)) {
flags |= CLI_CRED_LANMAN_AUTH;
}
cli_credentials_get_ntlm_username_domain(test_credentials, tctx,
- &ninfo.identity_info.account_name.string,
- &ninfo.identity_info.domain_name.string);
+ &identity.account_name.string,
+ &identity.domain_name.string);
- generate_random_buffer(ninfo.challenge,
- sizeof(ninfo.challenge));
- chal = data_blob_const(ninfo.challenge,
- sizeof(ninfo.challenge));
+ identity.parameter_control =
+ MSV1_0_ALLOW_SERVER_TRUST_ACCOUNT |
+ MSV1_0_ALLOW_WORKSTATION_TRUST_ACCOUNT;
+ identity.logon_id_low = 0;
+ identity.logon_id_high = 0;
+ identity.workstation.string = cli_credentials_get_workstation(test_credentials);
- names_blob = NTLMv2_generate_names_blob(tctx, cli_credentials_get_workstation(machine_credentials),
- cli_credentials_get_domain(machine_credentials));
+ if (interactive) {
+ netlogon_creds_client_authenticator(creds, &a);
- status = cli_credentials_get_ntlm_response(test_credentials, tctx,
- &flags,
- chal,
- names_blob,
- &lm_resp, &nt_resp,
- NULL, NULL);
- torture_assert_ntstatus_ok(tctx, status, "cli_credentials_get_ntlm_response failed");
+ if (!E_deshash(cli_credentials_get_password(test_credentials), pinfo.lmpassword.hash)) {
+ ZERO_STRUCT(pinfo.lmpassword.hash);
+ }
+ E_md4hash(cli_credentials_get_password(test_credentials), pinfo.ntpassword.hash);
- ninfo.lm.data = lm_resp.data;
- ninfo.lm.length = lm_resp.length;
+ if (creds->negotiate_flags & NETLOGON_NEG_ARCFOUR) {
+ netlogon_creds_arcfour_crypt(creds, pinfo.lmpassword.hash, 16);
+ netlogon_creds_arcfour_crypt(creds, pinfo.ntpassword.hash, 16);
+ } else {
+ netlogon_creds_des_encrypt(creds, &pinfo.lmpassword);
+ netlogon_creds_des_encrypt(creds, &pinfo.ntpassword);
+ }
- ninfo.nt.data = nt_resp.data;
- ninfo.nt.length = nt_resp.length;
+ pinfo.identity_info = identity;
+ logon.password = &pinfo;
- ninfo.identity_info.parameter_control =
- MSV1_0_ALLOW_SERVER_TRUST_ACCOUNT |
- MSV1_0_ALLOW_WORKSTATION_TRUST_ACCOUNT;
- ninfo.identity_info.logon_id_low = 0;
- ninfo.identity_info.logon_id_high = 0;
- ninfo.identity_info.workstation.string = cli_credentials_get_workstation(machine_credentials);
+ r.in.logon_level = NetlogonInteractiveInformation;
+ } else {
+ generate_random_buffer(ninfo.challenge,
+ sizeof(ninfo.challenge));
+ chal = data_blob_const(ninfo.challenge,
+ sizeof(ninfo.challenge));
+
+ names_blob = NTLMv2_generate_names_blob(tctx, cli_credentials_get_workstation(test_credentials),
+ cli_credentials_get_domain(test_credentials));
+
+ status = cli_credentials_get_ntlm_response(test_credentials, tctx,
+ &flags,
+ chal,
+ names_blob,
+ &lm_resp, &nt_resp,
+ NULL, NULL);
+ torture_assert_ntstatus_ok(tctx, status, "cli_credentials_get_ntlm_response failed");
+
+ ninfo.lm.data = lm_resp.data;
+ ninfo.lm.length = lm_resp.length;
+
+ ninfo.nt.data = nt_resp.data;
+ ninfo.nt.length = nt_resp.length;
- logon.network = &ninfo;
+ ninfo.identity_info = identity;
+ logon.network = &ninfo;
+
+ r.in.logon_level = NetlogonNetworkInformation;
+ }
r.in.server_name = talloc_asprintf(tctx, "\\\\%s", dcerpc_server_name(p));
- r.in.computer_name = cli_credentials_get_workstation(machine_credentials);
- r.in.credential = &auth;
- r.in.return_authenticator = &auth2;
- r.in.logon_level = 2;
+ r.in.computer_name = cli_credentials_get_workstation(test_credentials);
r.in.logon = &logon;
+ r.in.flags = &samlogon_flags;
+ r.out.flags = &samlogon_flags;
r.out.validation = &validation;
r.out.authoritative = &authoritative;
- d_printf("Testing LogonSamLogon with name %s\n", ninfo.identity_info.account_name.string);
-
- ZERO_STRUCT(auth2);
- netlogon_creds_client_authenticator(creds, &auth);
+ torture_comment(tctx, "Testing LogonSamLogon with name %s\n", identity.account_name.string);
- r.in.validation_level = 2;
+ r.in.validation_level = 6;
- status = dcerpc_netr_LogonSamLogon(p, tctx, &r);
+ status = dcerpc_netr_LogonSamLogonEx(p, tctx, &r);
+ if (NT_STATUS_EQUAL(status, NT_STATUS_INVALID_INFO_CLASS)) {
+ r.in.validation_level = 3;
+ status = dcerpc_netr_LogonSamLogonEx(p, tctx, &r);
+ }
if (!NT_STATUS_IS_OK(status)) {
- torture_assert_ntstatus_equal(tctx, status, expected_result, "LogonSamLogon failed");
+ torture_assert_ntstatus_equal(tctx, status, expected_result, "LogonSamLogonEx failed");
return true;
} else {
- torture_assert_ntstatus_ok(tctx, status, "LogonSamLogon failed");
+ torture_assert_ntstatus_ok(tctx, status, "LogonSamLogonEx failed");
}
- torture_assert(tctx, netlogon_creds_client_check(creds, &r.out.return_authenticator->cred),
- "Credential chaining failed");
-
return true;
}
-static bool test_SamLogon(struct torture_context *tctx,
- struct dcerpc_pipe *p,
- struct cli_credentials *machine_credentials,
- struct cli_credentials *test_credentials,
- NTSTATUS expected_result)
-{
- struct netlogon_creds_CredentialState *creds;
-
- if (!test_SetupCredentials(p, tctx, machine_credentials, &creds)) {
- return false;
- }
-
- return test_SamLogon_Creds(p, tctx, machine_credentials, test_credentials,
- creds, expected_result);
-}
-
static bool test_SamLogon_with_creds(struct torture_context *tctx,
struct dcerpc_pipe *p,
struct cli_credentials *machine_creds,
const char *acct_name,
char *password,
- NTSTATUS expected_samlogon_result)
+ NTSTATUS expected_samlogon_result,
+ bool interactive)
{
bool ret = true;
struct cli_credentials *test_credentials;
test_credentials = cli_credentials_init(tctx);
cli_credentials_set_workstation(test_credentials,
- TEST_ACCOUNT_NAME_PWD, CRED_SPECIFIED);
+ cli_credentials_get_workstation(machine_creds), CRED_SPECIFIED);
cli_credentials_set_domain(test_credentials,
- lp_workgroup(tctx->lp_ctx), CRED_SPECIFIED);
+ cli_credentials_get_domain(machine_creds), CRED_SPECIFIED);
cli_credentials_set_username(test_credentials,
acct_name, CRED_SPECIFIED);
cli_credentials_set_password(test_credentials,
password, CRED_SPECIFIED);
- cli_credentials_set_secure_channel_type(test_credentials, SEC_CHAN_BDC);
- printf("testing samlogon as %s@%s password: %s\n",
- acct_name, TEST_ACCOUNT_NAME_PWD, password);
+ torture_comment(tctx, "testing samlogon (%s) as %s password: %s\n",
+ interactive ? "interactive" : "network", acct_name, password);
- if (!test_SamLogon(tctx, p, machine_creds, test_credentials,
- expected_samlogon_result)) {
+ if (!test_SamLogon(tctx, p, test_credentials,
+ expected_samlogon_result, interactive)) {
torture_warning(tctx, "new password did not work\n");
ret = false;
}
machine_creds,
acct_name,
*password,
- expected_samlogon_result)) {
+ expected_samlogon_result,
+ false)) {
ret = false;
}
return ret;
}
+static bool setup_schannel_netlogon_pipe(struct torture_context *tctx,
+ struct cli_credentials *credentials,
+ struct dcerpc_pipe **p)
+{
+ struct dcerpc_binding *b;
+
+ torture_assert_ntstatus_ok(tctx, torture_rpc_binding(tctx, &b),
+ "failed to get rpc binding");
+
+ /* We have to use schannel, otherwise the SamLogonEx fails
+ * with INTERNAL_ERROR */
+
+ b->flags &= ~DCERPC_AUTH_OPTIONS;
+ b->flags |= DCERPC_SCHANNEL | DCERPC_SIGN | DCERPC_SCHANNEL_128;
+
+ torture_assert_ntstatus_ok(tctx,
+ dcerpc_pipe_connect_b(tctx, p, b, &ndr_table_netlogon,
+ credentials, tctx->ev, tctx->lp_ctx),
+ "failed to bind to netlogon");
+
+ return true;
+}
+
static bool test_SetPassword_pwdlastset(struct dcerpc_pipe *p,
struct torture_context *tctx,
uint32_t acct_flags,
{
int s = 0, q = 0, f = 0, l = 0, z = 0;
bool ret = true;
- int delay = 500000;
+ int delay = 50000;
bool set_levels[] = { false, true };
bool query_levels[] = { false, true };
- uint32_t levels[] = { 18, 21, 23, 24, 25, 26 };
+ uint32_t levels[] = { 18, 21, 26, 23, 24, 25 }; /* Second half only used when TEST_ALL_LEVELS defined */
uint32_t nonzeros[] = { 1, 24 };
uint32_t fields_present[] = {
0,
SAMR_FIELD_NT_PASSWORD_PRESENT | SAMR_FIELD_LM_PASSWORD_PRESENT | SAMR_FIELD_EXPIRED_FLAG,
SAMR_FIELD_NT_PASSWORD_PRESENT | SAMR_FIELD_LM_PASSWORD_PRESENT | SAMR_FIELD_LAST_PWD_CHANGE | SAMR_FIELD_EXPIRED_FLAG
};
- NTSTATUS status;
struct dcerpc_pipe *np = NULL;
if (torture_setting_bool(tctx, "samba3", false)) {
- delay = 1000000;
- printf("Samba3 has second granularity, setting delay to: %d\n",
+ delay = 999999;
+ torture_comment(tctx, "Samba3 has second granularity, setting delay to: %d\n",
delay);
}
- status = torture_rpc_connection(tctx, &np, &ndr_table_netlogon);
- if (!NT_STATUS_IS_OK(status)) {
- return false;
- }
+ torture_assert(tctx, setup_schannel_netlogon_pipe(tctx, machine_credentials, &np), "");
/* set to 1 to enable testing for all possible opcode
(SetUserInfo, SetUserInfo2, QueryUserInfo, QueryUserInfo2)
combinations */
#if 0
+#define TEST_ALL_LEVELS 1
#define TEST_SET_LEVELS 1
#define TEST_QUERY_LEVELS 1
#endif
+#ifdef TEST_ALL_LEVELS
for (l=0; l<ARRAY_SIZE(levels); l++) {
+#else
+ for (l=0; l<(ARRAY_SIZE(levels))/2; l++) {
+#endif
for (z=0; z<ARRAY_SIZE(nonzeros); z++) {
for (f=0; f<ARRAY_SIZE(fields_present); f++) {
#ifdef TEST_SET_LEVELS
f = ARRAY_SIZE(fields_present);
break;
}
-
-#ifdef TEST_QUERY_LEVELS
- }
-#endif
-#ifdef TEST_SET_LEVELS
+
+#ifdef TEST_QUERY_LEVELS
+ }
+#endif
+#ifdef TEST_SET_LEVELS
+ }
+#endif
+ } /* fields present */
+ } /* nonzeros */
+ } /* levels */
+
+#undef TEST_SET_LEVELS
+#undef TEST_QUERY_LEVELS
+
+ talloc_free(np);
+
+ return ret;
+}
+
+static bool test_QueryUserInfo_badpwdcount(struct dcerpc_pipe *p,
+ struct torture_context *tctx,
+ struct policy_handle *handle,
+ uint32_t *badpwdcount)
+{
+ union samr_UserInfo *info;
+ struct samr_QueryUserInfo r;
+
+ r.in.user_handle = handle;
+ r.in.level = 3;
+ r.out.info = &info;
+
+ torture_comment(tctx, "Testing QueryUserInfo level %d", r.in.level);
+
+ torture_assert_ntstatus_ok(tctx, dcerpc_samr_QueryUserInfo(p, tctx, &r),
+ "failed to query userinfo");
+
+ *badpwdcount = info->info3.bad_password_count;
+
+ torture_comment(tctx, " (bad password count: %d)\n", *badpwdcount);
+
+ return true;
+}
+
+static bool test_SetUserInfo_acct_flags(struct dcerpc_pipe *p,
+ struct torture_context *tctx,
+ struct policy_handle *user_handle,
+ uint32_t acct_flags)
+{
+ struct samr_SetUserInfo r;
+ union samr_UserInfo user_info;
+
+ torture_comment(tctx, "Testing SetUserInfo level 16\n");
+
+ user_info.info16.acct_flags = acct_flags;
+
+ r.in.user_handle = user_handle;
+ r.in.level = 16;
+ r.in.info = &user_info;
+
+ torture_assert_ntstatus_ok(tctx, dcerpc_samr_SetUserInfo(p, tctx, &r),
+ "failed to set account flags");
+
+ return true;
+}
+
+static bool test_reset_badpwdcount(struct dcerpc_pipe *p,
+ struct torture_context *tctx,
+ struct policy_handle *user_handle,
+ uint32_t acct_flags,
+ char **password)
+{
+ torture_assert(tctx, test_SetUserPass(p, tctx, user_handle, password),
+ "failed to set password");
+
+ torture_comment(tctx, "Testing SetUserInfo level 16 (enable account)\n");
+
+ torture_assert(tctx,
+ test_SetUserInfo_acct_flags(p, tctx, user_handle,
+ acct_flags & ~ACB_DISABLED),
+ "failed to enable user");
+
+ torture_assert(tctx, test_SetUserPass(p, tctx, user_handle, password),
+ "failed to set password");
+
+ return true;
+}
+
+static bool test_SetDomainInfo(struct dcerpc_pipe *p,
+ struct torture_context *tctx,
+ struct policy_handle *domain_handle,
+ enum samr_DomainInfoClass level,
+ union samr_DomainInfo *info)
+{
+ struct samr_SetDomainInfo r;
+
+ r.in.domain_handle = domain_handle;
+ r.in.level = level;
+ r.in.info = info;
+
+ torture_assert_ntstatus_ok(tctx,
+ dcerpc_samr_SetDomainInfo(p, tctx, &r),
+ "failed to set domain info");
+
+ return true;
+}
+
+static bool test_SetDomainInfo_ntstatus(struct dcerpc_pipe *p,
+ struct torture_context *tctx,
+ struct policy_handle *domain_handle,
+ enum samr_DomainInfoClass level,
+ union samr_DomainInfo *info,
+ NTSTATUS expected)
+{
+ struct samr_SetDomainInfo r;
+
+ r.in.domain_handle = domain_handle;
+ r.in.level = level;
+ r.in.info = info;
+
+ torture_assert_ntstatus_equal(tctx,
+ dcerpc_samr_SetDomainInfo(p, tctx, &r),
+ expected,
+ "");
+
+ return true;
+}
+
+static bool test_QueryDomainInfo2_level(struct dcerpc_pipe *p,
+ struct torture_context *tctx,
+ struct policy_handle *domain_handle,
+ enum samr_DomainInfoClass level,
+ union samr_DomainInfo **q_info)
+{
+ struct samr_QueryDomainInfo2 r;
+
+ r.in.domain_handle = domain_handle;
+ r.in.level = level;
+ r.out.info = q_info;
+
+ torture_assert_ntstatus_ok(tctx,
+ dcerpc_samr_QueryDomainInfo2(p, tctx, &r),
+ "failed to query domain info");
+
+ return true;
+}
+
+static bool test_Password_badpwdcount(struct dcerpc_pipe *p,
+ struct dcerpc_pipe *np,
+ struct torture_context *tctx,
+ uint32_t acct_flags,
+ const char *acct_name,
+ struct policy_handle *domain_handle,
+ struct policy_handle *user_handle,
+ char **password,
+ struct cli_credentials *machine_credentials,
+ const char *comment,
+ bool disable,
+ bool interactive,
+ NTSTATUS expected_success_status,
+ struct samr_DomInfo1 *info1,
+ struct samr_DomInfo12 *info12)
+{
+ union samr_DomainInfo info;
+ char **passwords;
+ int i;
+ uint32_t badpwdcount, tmp;
+ uint32_t password_history_length = 12;
+ uint32_t lockout_threshold = 15;
+
+ torture_comment(tctx, "\nTesting bad pwd count with: %s\n", comment);
+
+ torture_assert(tctx, password_history_length < lockout_threshold,
+ "password history length needs to be smaller than account lockout threshold for this test");
+
+
+ /* set policies */
+
+ info.info1 = *info1;
+ info.info1.password_history_length = password_history_length;
+
+ torture_assert(tctx,
+ test_SetDomainInfo(p, tctx, domain_handle,
+ DomainPasswordInformation, &info),
+ "failed to set password history length");
+
+ info.info12 = *info12;
+ info.info12.lockout_threshold = lockout_threshold;
+
+ torture_assert(tctx,
+ test_SetDomainInfo(p, tctx, domain_handle,
+ DomainLockoutInformation, &info),
+ "failed to set lockout threshold");
+
+ /* reset bad pwd count */
+
+ torture_assert(tctx,
+ test_reset_badpwdcount(p, tctx, user_handle, acct_flags, password), "");
+
+
+ /* enable or disable account */
+ if (disable) {
+ torture_assert(tctx,
+ test_SetUserInfo_acct_flags(p, tctx, user_handle,
+ acct_flags | ACB_DISABLED),
+ "failed to disable user");
+ } else {
+ torture_assert(tctx,
+ test_SetUserInfo_acct_flags(p, tctx, user_handle,
+ acct_flags & ~ACB_DISABLED),
+ "failed to enable user");
+ }
+
+
+ /* setup password history */
+
+ passwords = talloc_array(tctx, char *, password_history_length);
+
+ for (i=0; i < password_history_length; i++) {
+
+ torture_assert(tctx, test_SetUserPass(p, tctx, user_handle, password),
+ "failed to set password");
+ passwords[i] = talloc_strdup(tctx, *password);
+
+ if (!test_SamLogon_with_creds(tctx, np, machine_credentials,
+ acct_name, passwords[i],
+ expected_success_status, interactive)) {
+ torture_fail(tctx, "failed to auth with latest password");
+ }
+
+ torture_assert(tctx,
+ test_QueryUserInfo_badpwdcount(p, tctx, user_handle, &badpwdcount), "");
+
+ torture_assert_int_equal(tctx, badpwdcount, 0, "expected badpwdcount to be 0");
+ }
+
+
+ /* test with wrong password */
+
+ if (!test_SamLogon_with_creds(tctx, np, machine_credentials,
+ acct_name, "random_crap",
+ NT_STATUS_WRONG_PASSWORD, interactive)) {
+ torture_fail(tctx, "succeeded to authenticate with wrong password");
+ }
+
+ torture_assert(tctx,
+ test_QueryUserInfo_badpwdcount(p, tctx, user_handle, &badpwdcount), "");
+
+ torture_assert_int_equal(tctx, badpwdcount, 1, "expected badpwdcount to be 1");
+
+
+ /* test with latest good password */
+
+ if (!test_SamLogon_with_creds(tctx, np, machine_credentials, acct_name,
+ passwords[password_history_length-1],
+ expected_success_status, interactive)) {
+ torture_fail(tctx, "succeeded to authenticate with wrong password");
+ }
+
+ torture_assert(tctx,
+ test_QueryUserInfo_badpwdcount(p, tctx, user_handle, &badpwdcount), "");
+
+ if (disable) {
+ torture_assert_int_equal(tctx, badpwdcount, 1, "expected badpwdcount to be 1");
+ } else {
+ /* only enabled accounts get the bad pwd count reset upon
+ * successful logon */
+ torture_assert_int_equal(tctx, badpwdcount, 0, "expected badpwdcount to be 0");
+ }
+
+ tmp = badpwdcount;
+
+
+ /* test password history */
+
+ for (i=0; i < password_history_length; i++) {
+
+ torture_comment(tctx, "Testing bad password count behavior with "
+ "password #%d of #%d\n", i, password_history_length);
+
+ /* - network samlogon will succeed auth and not
+ * increase badpwdcount for 2 last entries
+ * - interactive samlogon only for the last one */
+
+ if (i == password_history_length - 1 ||
+ (i == password_history_length - 2 && !interactive)) {
+
+ if (!test_SamLogon_with_creds(tctx, np, machine_credentials,
+ acct_name, passwords[i],
+ expected_success_status, interactive)) {
+ torture_fail(tctx, talloc_asprintf(tctx, "succeeded to authenticate with old password (#%d of #%d in history)", i, password_history_length));
+ }
+
+ torture_assert(tctx,
+ test_QueryUserInfo_badpwdcount(p, tctx, user_handle, &badpwdcount), "");
+
+ if (disable) {
+ /* torture_comment(tctx, "expecting bad pwd count to *NOT INCREASE* for pwd history entry %d\n", i); */
+ torture_assert_int_equal(tctx, badpwdcount, tmp, "unexpected badpwdcount");
+ } else {
+ /* torture_comment(tctx, "expecting bad pwd count to be 0 for pwd history entry %d\n", i); */
+ torture_assert_int_equal(tctx, badpwdcount, 0, "expected badpwdcount to be 0");
+ }
+
+ tmp = badpwdcount;
+
+ continue;
+ }
+
+ if (!test_SamLogon_with_creds(tctx, np, machine_credentials,
+ acct_name, passwords[i],
+ NT_STATUS_WRONG_PASSWORD, interactive)) {
+ torture_fail(tctx, talloc_asprintf(tctx, "succeeded to authenticate with old password (#%d of #%d in history)", i, password_history_length));
+ }
+
+ torture_assert(tctx,
+ test_QueryUserInfo_badpwdcount(p, tctx, user_handle, &badpwdcount), "");
+
+ /* - network samlogon will fail auth but not increase
+ * badpwdcount for 3rd last entry
+ * - interactive samlogon for 3rd and 2nd last entry */
+
+ if (i == password_history_length - 3 ||
+ (i == password_history_length - 2 && interactive)) {
+ /* torture_comment(tctx, "expecting bad pwd count to *NOT INCREASE * by one for pwd history entry %d\n", i); */
+ torture_assert_int_equal(tctx, badpwdcount, tmp, "unexpected badpwdcount");
+ } else {
+ /* torture_comment(tctx, "expecting bad pwd count to increase by one for pwd history entry %d\n", i); */
+ torture_assert_int_equal(tctx, badpwdcount, tmp + 1, "unexpected badpwdcount");
+ }
+
+ tmp = badpwdcount;
+ }
+
+ return true;
+}
+
+static bool test_Password_badpwdcount_wrap(struct dcerpc_pipe *p,
+ struct torture_context *tctx,
+ uint32_t acct_flags,
+ const char *acct_name,
+ struct policy_handle *domain_handle,
+ struct policy_handle *user_handle,
+ char **password,
+ struct cli_credentials *machine_credentials)
+{
+ union samr_DomainInfo *q_info, s_info;
+ struct samr_DomInfo1 info1, _info1;
+ struct samr_DomInfo12 info12, _info12;
+ bool ret = true;
+ struct dcerpc_pipe *np;
+ int i;
+
+ struct {
+ const char *comment;
+ bool disabled;
+ bool interactive;
+ NTSTATUS expected_success_status;
+ } creds[] = {
+ {
+ .comment = "network logon (disabled account)",
+ .disabled = true,
+ .interactive = false,
+ .expected_success_status= NT_STATUS_ACCOUNT_DISABLED
+ },
+ {
+ .comment = "network logon (enabled account)",
+ .disabled = false,
+ .interactive = false,
+ .expected_success_status= NT_STATUS_OK
+ },
+ {
+ .comment = "interactive logon (disabled account)",
+ .disabled = true,
+ .interactive = true,
+ .expected_success_status= NT_STATUS_ACCOUNT_DISABLED
+ },
+ {
+ .comment = "interactive logon (enabled account)",
+ .disabled = false,
+ .interactive = true,
+ .expected_success_status= NT_STATUS_OK
+ },
+ };
+
+ torture_assert(tctx, setup_schannel_netlogon_pipe(tctx, machine_credentials, &np), "");
+
+ /* backup old policies */
+
+ torture_assert(tctx,
+ test_QueryDomainInfo2_level(p, tctx, domain_handle,
+ DomainPasswordInformation, &q_info),
+ "failed to query domain info level 1");
+
+ info1 = q_info->info1;
+ _info1 = info1;
+
+ torture_assert(tctx,
+ test_QueryDomainInfo2_level(p, tctx, domain_handle,
+ DomainLockoutInformation, &q_info),
+ "failed to query domain info level 12");
+
+ info12 = q_info->info12;
+ _info12 = info12;
+
+ /* run tests */
+
+ for (i=0; i < ARRAY_SIZE(creds); i++) {
+
+ /* skip trust tests for now */
+ if (acct_flags & ACB_WSTRUST ||
+ acct_flags & ACB_SVRTRUST ||
+ acct_flags & ACB_DOMTRUST) {
+ continue;
+ }
+
+ ret &= test_Password_badpwdcount(p, np, tctx, acct_flags, acct_name,
+ domain_handle, user_handle, password,
+ machine_credentials,
+ creds[i].comment,
+ creds[i].disabled,
+ creds[i].interactive,
+ creds[i].expected_success_status,
+ &_info1, &_info12);
+ if (!ret) {
+ torture_warning(tctx, "TEST #%d (%s) failed\n", i, creds[i].comment);
+ } else {
+ torture_comment(tctx, "TEST #%d (%s) succeeded\n", i, creds[i].comment);
+ }
+ }
+
+ /* restore policies */
+
+ s_info.info1 = info1;
+
+ torture_assert(tctx,
+ test_SetDomainInfo(p, tctx, domain_handle,
+ DomainPasswordInformation, &s_info),
+ "failed to set password information");
+
+ s_info.info12 = info12;
+
+ torture_assert(tctx,
+ test_SetDomainInfo(p, tctx, domain_handle,
+ DomainLockoutInformation, &s_info),
+ "failed to set lockout information");
+
+ return ret;
+}
+
+static bool test_QueryUserInfo_acct_flags(struct dcerpc_pipe *p,
+ struct torture_context *tctx,
+ struct policy_handle *handle,
+ uint32_t *acct_flags)
+{
+ union samr_UserInfo *info;
+ struct samr_QueryUserInfo r;
+
+ r.in.user_handle = handle;
+ r.in.level = 16;
+ r.out.info = &info;
+
+ torture_comment(tctx, "Testing QueryUserInfo level %d", r.in.level);
+
+ torture_assert_ntstatus_ok(tctx, dcerpc_samr_QueryUserInfo(p, tctx, &r),
+ "failed to query userinfo");
+
+ *acct_flags = info->info16.acct_flags;
+
+ torture_comment(tctx, " (acct_flags: 0x%08x)\n", *acct_flags);
+
+ return true;
+}
+
+static bool test_Password_lockout(struct dcerpc_pipe *p,
+ struct dcerpc_pipe *np,
+ struct torture_context *tctx,
+ uint32_t acct_flags,
+ const char *acct_name,
+ struct policy_handle *domain_handle,
+ struct policy_handle *user_handle,
+ char **password,
+ struct cli_credentials *machine_credentials,
+ const char *comment,
+ bool disable,
+ bool interactive,
+ NTSTATUS expected_success_status,
+ struct samr_DomInfo1 *info1,
+ struct samr_DomInfo12 *info12)
+{
+ union samr_DomainInfo info;
+ uint32_t badpwdcount;
+ uint32_t password_history_length = 1;
+ uint64_t lockout_threshold = 1;
+ uint32_t lockout_seconds = 5;
+ uint64_t delta_time_factor = 10 * 1000 * 1000;
+
+ torture_comment(tctx, "\nTesting account lockout: %s\n", comment);
+
+ /* set policies */
+
+ info.info1 = *info1;
+
+ torture_comment(tctx, "setting password history lenght.\n");
+ info.info1.password_history_length = password_history_length;
+
+ torture_assert(tctx,
+ test_SetDomainInfo(p, tctx, domain_handle,
+ DomainPasswordInformation, &info),
+ "failed to set password history length");
+
+ info.info12 = *info12;
+ info.info12.lockout_threshold = lockout_threshold;
+
+ /* set lockout duration < lockout window: should fail */
+ info.info12.lockout_duration = ~(lockout_seconds * delta_time_factor);
+ info.info12.lockout_window = ~((lockout_seconds + 1) * delta_time_factor);
+
+ torture_assert(tctx,
+ test_SetDomainInfo_ntstatus(p, tctx, domain_handle,
+ DomainLockoutInformation, &info,
+ NT_STATUS_INVALID_PARAMETER),
+ "setting lockout duration < lockout window gave unexpected result");
+
+ info.info12.lockout_duration = 0;
+ info.info12.lockout_window = 0;
+
+ torture_assert(tctx,
+ test_SetDomainInfo(p, tctx, domain_handle,
+ DomainLockoutInformation, &info),
+ "failed to set lockout window and duration to 0");
+
+
+ /* set lockout duration of 5 seconds */
+ info.info12.lockout_duration = ~(lockout_seconds * delta_time_factor);
+ info.info12.lockout_window = ~(lockout_seconds * delta_time_factor);
+
+ torture_assert(tctx,
+ test_SetDomainInfo(p, tctx, domain_handle,
+ DomainLockoutInformation, &info),
+ "failed to set lockout window and duration to 5 seconds");
+
+ /* reset bad pwd count */
+
+ torture_assert(tctx,
+ test_reset_badpwdcount(p, tctx, user_handle, acct_flags, password), "");
+
+
+ /* enable or disable account */
+
+ if (disable) {
+ torture_assert(tctx,
+ test_SetUserInfo_acct_flags(p, tctx, user_handle,
+ acct_flags | ACB_DISABLED),
+ "failed to disable user");
+ } else {
+ torture_assert(tctx,
+ test_SetUserInfo_acct_flags(p, tctx, user_handle,
+ acct_flags & ~ACB_DISABLED),
+ "failed to enable user");
+ }
+
+
+ /* test logon with right password */
+
+ if (!test_SamLogon_with_creds(tctx, np, machine_credentials,
+ acct_name, *password,
+ expected_success_status, interactive)) {
+ torture_fail(tctx, "failed to auth with latest password");
+ }
+
+ torture_assert(tctx,
+ test_QueryUserInfo_badpwdcount(p, tctx, user_handle, &badpwdcount), "");
+ torture_assert_int_equal(tctx, badpwdcount, 0, "expected badpwdcount to be 0");
+
+
+ /* test with wrong password ==> lockout */
+
+ if (!test_SamLogon_with_creds(tctx, np, machine_credentials,
+ acct_name, "random_crap",
+ NT_STATUS_WRONG_PASSWORD, interactive)) {
+ torture_fail(tctx, "succeeded to authenticate with wrong password");
+ }
+
+ torture_assert(tctx,
+ test_QueryUserInfo_badpwdcount(p, tctx, user_handle, &badpwdcount), "");
+ torture_assert_int_equal(tctx, badpwdcount, 1, "expected badpwdcount to be 1");
+
+ torture_assert(tctx,
+ test_QueryUserInfo_acct_flags(p, tctx, user_handle, &acct_flags), "");
+ torture_assert_int_equal(tctx, acct_flags & ACB_AUTOLOCK, 0,
+ "expected account to be locked");
+
+
+ /* test with good password */
+
+ if (!test_SamLogon_with_creds(tctx, np, machine_credentials, acct_name,
+ *password,
+ NT_STATUS_ACCOUNT_LOCKED_OUT, interactive))
+ {
+ torture_fail(tctx, "authenticate did not return NT_STATUS_ACCOUNT_LOCKED_OUT");
+ }
+
+ /* bad pwd count should not get updated */
+ torture_assert(tctx,
+ test_QueryUserInfo_badpwdcount(p, tctx, user_handle, &badpwdcount), "");
+ torture_assert_int_equal(tctx, badpwdcount, 1, "expected badpwdcount to be 1");
+
+ /* curiously, windows does _not_ set the autlock flag */
+ torture_assert(tctx,
+ test_QueryUserInfo_acct_flags(p, tctx, user_handle, &acct_flags), "");
+ torture_assert_int_equal(tctx, acct_flags & ACB_AUTOLOCK, 0,
+ "expected account to be locked");
+
+
+ /* with bad password */
+
+ if (!test_SamLogon_with_creds(tctx, np, machine_credentials,
+ acct_name, "random_crap2",
+ NT_STATUS_ACCOUNT_LOCKED_OUT, interactive))
+ {
+ torture_fail(tctx, "authenticate did not return NT_STATUS_ACCOUNT_LOCKED_OUT");
+ }
+
+ /* bad pwd count should not get updated */
+ torture_assert(tctx,
+ test_QueryUserInfo_badpwdcount(p, tctx, user_handle, &badpwdcount), "");
+ torture_assert_int_equal(tctx, badpwdcount, 1, "expected badpwdcount to be 1");
+
+ /* curiously, windows does _not_ set the autlock flag */
+ torture_assert(tctx,
+ test_QueryUserInfo_acct_flags(p, tctx, user_handle, &acct_flags), "");
+ torture_assert_int_equal(tctx, acct_flags & ACB_AUTOLOCK, 0,
+ "expected account to be locked");
+
+
+ /* let lockout duration expire ==> unlock */
+
+ torture_comment(tctx, "let lockout duration expire...\n");
+ sleep(lockout_seconds + 1);
+
+ if (!test_SamLogon_with_creds(tctx, np, machine_credentials, acct_name,
+ *password,
+ expected_success_status, interactive))
+ {
+ torture_fail(tctx, "failed to authenticate after lockout expired");
+ }
+
+ torture_assert(tctx,
+ test_QueryUserInfo_acct_flags(p, tctx, user_handle, &acct_flags), "");
+ torture_assert_int_equal(tctx, acct_flags & ACB_AUTOLOCK, 0,
+ "expected account not to be locked");
+
+ return true;
+}
+
+static bool test_Password_lockout_wrap(struct dcerpc_pipe *p,
+ struct torture_context *tctx,
+ uint32_t acct_flags,
+ const char *acct_name,
+ struct policy_handle *domain_handle,
+ struct policy_handle *user_handle,
+ char **password,
+ struct cli_credentials *machine_credentials)
+{
+ union samr_DomainInfo *q_info, s_info;
+ struct samr_DomInfo1 info1, _info1;
+ struct samr_DomInfo12 info12, _info12;
+ bool ret = true;
+ struct dcerpc_pipe *np;
+ int i;
+
+ struct {
+ const char *comment;
+ bool disabled;
+ bool interactive;
+ NTSTATUS expected_success_status;
+ } creds[] = {
+ {
+ .comment = "network logon (disabled account)",
+ .disabled = true,
+ .interactive = false,
+ .expected_success_status= NT_STATUS_ACCOUNT_DISABLED
+ },
+ {
+ .comment = "network logon (enabled account)",
+ .disabled = false,
+ .interactive = false,
+ .expected_success_status= NT_STATUS_OK
+ },
+ {
+ .comment = "interactive logon (disabled account)",
+ .disabled = true,
+ .interactive = true,
+ .expected_success_status= NT_STATUS_ACCOUNT_DISABLED
+ },
+ {
+ .comment = "interactive logon (enabled account)",
+ .disabled = false,
+ .interactive = true,
+ .expected_success_status= NT_STATUS_OK
+ },
+ };
+
+ torture_assert(tctx, setup_schannel_netlogon_pipe(tctx, machine_credentials, &np), "");
+
+ /* backup old policies */
+
+ torture_assert(tctx,
+ test_QueryDomainInfo2_level(p, tctx, domain_handle,
+ DomainPasswordInformation, &q_info),
+ "failed to query domain info level 1");
+
+ info1 = q_info->info1;
+ _info1 = info1;
+
+ torture_assert(tctx,
+ test_QueryDomainInfo2_level(p, tctx, domain_handle,
+ DomainLockoutInformation, &q_info),
+ "failed to query domain info level 12");
+
+ info12 = q_info->info12;
+ _info12 = info12;
+
+ /* run tests */
+
+ for (i=0; i < ARRAY_SIZE(creds); i++) {
+
+ /* skip trust tests for now */
+ if (acct_flags & ACB_WSTRUST ||
+ acct_flags & ACB_SVRTRUST ||
+ acct_flags & ACB_DOMTRUST) {
+ continue;
+ }
+
+ ret &= test_Password_lockout(p, np, tctx, acct_flags, acct_name,
+ domain_handle, user_handle, password,
+ machine_credentials,
+ creds[i].comment,
+ creds[i].disabled,
+ creds[i].interactive,
+ creds[i].expected_success_status,
+ &_info1, &_info12);
+ if (!ret) {
+ torture_warning(tctx, "TEST #%d (%s) failed\n", i, creds[i].comment);
+ } else {
+ torture_comment(tctx, "TEST #%d (%s) succeeded\n", i, creds[i].comment);
+ }
}
-#endif
- } /* fields present */
- } /* nonzeros */
- } /* levels */
-#undef TEST_SET_LEVELS
-#undef TEST_QUERY_LEVELS
+ /* restore policies */
+
+ s_info.info1 = info1;
+
+ torture_assert(tctx,
+ test_SetDomainInfo(p, tctx, domain_handle,
+ DomainPasswordInformation, &s_info),
+ "failed to set password information");
+
+ s_info.info12 = info12;
+
+ torture_assert(tctx,
+ test_SetDomainInfo(p, tctx, domain_handle,
+ DomainLockoutInformation, &s_info),
+ "failed to set lockout information");
return ret;
}
struct lsa_EnumAccountRights r;
struct lsa_RightSet rights;
- printf("Testing LSA EnumAccountRights\n");
+ torture_comment(tctx, "Testing LSA EnumAccountRights\n");
r.in.handle = lsa_handle;
r.in.sid = user_sid;
struct lsa_StringLarge names[2];
struct lsa_AddAccountRights r;
- printf("Testing LSA AddAccountRights\n");
+ torture_comment(tctx, "Testing LSA AddAccountRights\n");
init_lsa_StringLarge(&names[0], "SeMachineAccountPrivilege");
init_lsa_StringLarge(&names[1], NULL);
int i;
bool found_sid = false;
- printf("Testing LSA EnumAccounts\n");
+ torture_comment(tctx, "Testing LSA EnumAccounts\n");
r.in.handle = lsa_handle;
r.in.num_entries = 0x1000;
struct lsa_EnumAccountRights r;
struct lsa_RightSet user_rights;
- printf("Testing LSA EnumAccountRights\n");
+ torture_comment(tctx, "Testing LSA EnumAccountRights\n");
r.in.handle = lsa_handle;
r.in.sid = user_sid;
{
struct lsa_OpenAccount r;
- printf("Testing LSA OpenAccount\n");
+ torture_comment(tctx, "Testing LSA OpenAccount\n");
r.in.handle = lsa_handle;
r.in.sid = user_sid;
struct lsa_GetSystemAccessAccount r;
uint32_t access_mask;
- printf("Testing LSA GetSystemAccessAccount\n");
+ torture_comment(tctx, "Testing LSA GetSystemAccessAccount\n");
r.in.handle = &lsa_acct_handle;
r.out.access_mask = &access_mask;
{
struct lsa_Close r;
- printf("Testing LSA Close\n");
+ torture_comment(tctx, "Testing LSA Close\n");
r.in.handle = &lsa_acct_handle;
r.out.handle = &lsa_acct_handle;
{
struct samr_DeleteUser r;
- printf("Testing SAMR DeleteUser\n");
+ torture_comment(tctx, "Testing SAMR DeleteUser\n");
r.in.user_handle = user_handle;
r.out.user_handle = user_handle;
int i;
bool found_sid = false;
- printf("Testing LSA EnumAccounts\n");
+ torture_comment(tctx, "Testing LSA EnumAccounts\n");
r.in.handle = lsa_handle;
r.in.num_entries = 0x1000;
struct lsa_EnumAccountRights r;
struct lsa_RightSet user_rights;
- printf("Testing LSA EnumAccountRights\n");
+ torture_comment(tctx, "Testing LSA EnumAccountRights\n");
r.in.handle = lsa_handle;
r.in.sid = user_sid;
{
struct lsa_OpenAccount r;
- printf("Testing LSA OpenAccount\n");
+ torture_comment(tctx, "Testing LSA OpenAccount\n");
r.in.handle = lsa_handle;
r.in.sid = user_sid;
struct lsa_GetSystemAccessAccount r;
uint32_t access_mask;
- printf("Testing LSA GetSystemAccessAccount\n");
+ torture_comment(tctx, "Testing LSA GetSystemAccessAccount\n");
r.in.handle = &lsa_acct_handle;
r.out.access_mask = &access_mask;
{
struct lsa_DeleteObject r;
- printf("Testing LSA DeleteObject\n");
+ torture_comment(tctx, "Testing LSA DeleteObject\n");
r.in.handle = &lsa_acct_handle;
r.out.handle = &lsa_acct_handle;
int i;
bool found_sid = false;
- printf("Testing LSA EnumAccounts\n");
+ torture_comment(tctx, "Testing LSA EnumAccounts\n");
r.in.handle = lsa_handle;
r.in.num_entries = 0x1000;
struct lsa_EnumAccountRights r;
struct lsa_RightSet user_rights;
- printf("Testing LSA EnumAccountRights\n");
+ torture_comment(tctx, "Testing LSA EnumAccountRights\n");
r.in.handle = lsa_handle;
r.in.sid = user_sid;
ZERO_STRUCT(simple_pass);
memset(simple_pass, *v, sizeof(simple_pass) - 1);
- printf("Testing machine account password policy rules\n");
+ torture_comment(tctx, "Testing machine account password policy rules\n");
/* Workstation trust accounts don't seem to need to honour password quality policy */
if (!test_SetUserPassEx(p, tctx, user_handle, true, &password)) {
}
if (torture_setting_bool(tctx, "samba4", false)) {
- printf("skipping Set Password level 18 and 21 against Samba4\n");
+ torture_comment(tctx, "skipping Set Password level 18 and 21 against Samba4\n");
} else {
if (!test_SetUserPass_18(p, tctx, user_handle, &password)) {
status = dcerpc_samr_QueryUserInfo(p, tctx, &q);
if (!NT_STATUS_IS_OK(status)) {
- printf("QueryUserInfo level %u failed - %s\n",
+ torture_warning(tctx, "QueryUserInfo level %u failed - %s\n",
q.in.level, nt_errstr(status));
ret = false;
} else {
uint32_t expected_flags = (base_acct_flags | ACB_PWNOTREQ | ACB_DISABLED);
if ((info->info5.acct_flags) != expected_flags) {
- printf("QuerUserInfo level 5 failed, it returned 0x%08x when we expected flags of 0x%08x\n",
+ torture_warning(tctx, "QuerUserInfo level 5 failed, it returned 0x%08x when we expected flags of 0x%08x\n",
info->info5.acct_flags,
expected_flags);
/* FIXME: GD */
}
}
if (info->info5.rid != rid) {
- printf("QuerUserInfo level 5 failed, it returned %u when we expected rid of %u\n",
+ torture_warning(tctx, "QuerUserInfo level 5 failed, it returned %u when we expected rid of %u\n",
info->info5.rid, rid);
}
break;
+ case TORTURE_SAMR_PASSWORDS_BADPWDCOUNT:
+
+ /* test bad pwd count change behaviour */
+ if (!test_Password_badpwdcount_wrap(p, tctx, base_acct_flags,
+ base_acct_name,
+ domain_handle,
+ user_handle, &password,
+ machine_credentials)) {
+ ret = false;
+ }
+
+ if (ret == true) {
+ torture_comment(tctx, "badPwdCount test succeeded\n");
+ } else {
+ torture_warning(tctx, "badPwdCount test failed\n");
+ }
+
+ break;
+
+ case TORTURE_SAMR_PASSWORDS_LOCKOUT:
+
+ if (!test_Password_lockout_wrap(p, tctx, base_acct_flags,
+ base_acct_name,
+ domain_handle,
+ user_handle, &password,
+ machine_credentials))
+ {
+ ret = false;
+ }
+
+ if (ret == true) {
+ torture_comment(tctx, "lockout test succeeded\n");
+ } else {
+ torture_warning(tctx, "lockout test failed\n");
+ }
+
+ break;
+
+
case TORTURE_SAMR_USER_PRIVILEGES: {
struct dcerpc_pipe *lp;
ret = false;
}
- if (torture_setting_bool(tctx, "samba4", false)) {
- printf("skipping MultipleMembers Alias tests against Samba4\n");
+ if (torture_setting_bool(tctx, "samba3", false) ||
+ torture_setting_bool(tctx, "samba4", false)) {
+ torture_comment(tctx, "skipping MultipleMembers Alias tests against Samba\n");
return ret;
}
return true;
failed:
- printf("DeleteUser_byname(%s) failed - %s\n", name, nt_errstr(status));
+ torture_warning(tctx, "DeleteUser_byname(%s) failed - %s\n", name, nt_errstr(status));
return false;
}
return true;
failed:
- printf("DeleteGroup_byname(%s) failed - %s\n", name, nt_errstr(status));
+ torture_warning(tctx, "DeleteGroup_byname(%s) failed - %s\n", name, nt_errstr(status));
return false;
}
struct policy_handle alias_handle;
uint32_t rid;
- printf("testing DeleteAlias_byname\n");
+ torture_comment(tctx, "testing DeleteAlias_byname\n");
status = test_LookupName(p, tctx, domain_handle, name, &rid);
if (!NT_STATUS_IS_OK(status)) {
return true;
failed:
- printf("DeleteAlias_byname(%s) failed - %s\n", name, nt_errstr(status));
+ torture_warning(tctx, "DeleteAlias_byname(%s) failed - %s\n", name, nt_errstr(status));
return false;
}
struct samr_DeleteDomAlias d;
NTSTATUS status;
bool ret = true;
- printf("Testing DeleteAlias\n");
+
+ torture_comment(tctx, "Testing DeleteAlias\n");
d.in.alias_handle = alias_handle;
d.out.alias_handle = alias_handle;
status = dcerpc_samr_DeleteDomAlias(p, tctx, &d);
if (!NT_STATUS_IS_OK(status)) {
- printf("DeleteAlias failed - %s\n", nt_errstr(status));
+ torture_warning(tctx, "DeleteAlias failed - %s\n", nt_errstr(status));
ret = false;
}
r.out.alias_handle = alias_handle;
r.out.rid = &rid;
- printf("Testing CreateAlias (%s)\n", r.in.alias_name->string);
+ torture_comment(tctx, "Testing CreateAlias (%s)\n", r.in.alias_name->string);
status = dcerpc_samr_CreateDomAlias(p, tctx, &r);
if (dom_sid_equal(domain_sid, dom_sid_parse_talloc(tctx, SID_BUILTIN))) {
if (NT_STATUS_EQUAL(status, NT_STATUS_ACCESS_DENIED)) {
- printf("Server correctly refused create of '%s'\n", r.in.alias_name->string);
+ torture_comment(tctx, "Server correctly refused create of '%s'\n", r.in.alias_name->string);
return true;
} else {
- printf("Server should have refused create of '%s', got %s instead\n", r.in.alias_name->string,
+ torture_warning(tctx, "Server should have refused create of '%s', got %s instead\n", r.in.alias_name->string,
nt_errstr(status));
return false;
}
}
if (!NT_STATUS_IS_OK(status)) {
- printf("CreateAlias failed - %s\n", nt_errstr(status));
+ torture_warning(tctx, "CreateAlias failed - %s\n", nt_errstr(status));
return false;
}
r.in.level = 1;
r.out.info = &info;
- printf("testing samr_QueryDomainInfo level 1\n");
+ torture_comment(tctx, "testing samr_QueryDomainInfo level 1\n");
status = dcerpc_samr_QueryDomainInfo(p, tctx, &r);
if (!NT_STATUS_IS_OK(status)) {
return false;
min_pwd_age_old = s.in.info->info1.min_password_age;
s.in.info->info1.min_password_age = 0;
- printf("testing samr_SetDomainInfo level 1\n");
+ torture_comment(tctx, "testing samr_SetDomainInfo level 1\n");
status = dcerpc_samr_SetDomainInfo(p, tctx, &s);
if (!NT_STATUS_IS_OK(status)) {
return false;
}
- printf("calling test_ChangePasswordUser3 with too short password\n");
+ torture_comment(tctx, "calling test_ChangePasswordUser3 with too short password\n");
if (!test_ChangePasswordUser3(p, tctx, acct_name, len - 1, password, NULL, 0, true)) {
ret = false;
s.in.info->info1.password_properties = pwd_prop_old;
s.in.info->info1.min_password_age = min_pwd_age_old;
- printf("testing samr_SetDomainInfo level 1\n");
+ torture_comment(tctx, "testing samr_SetDomainInfo level 1\n");
status = dcerpc_samr_SetDomainInfo(p, tctx, &s);
if (!NT_STATUS_IS_OK(status)) {
return false;
status = dcerpc_samr_LookupNames(p, tctx, &n);
if (!NT_STATUS_IS_OK(status)) {
- printf("LookupNames failed - %s\n", nt_errstr(status));
+ torture_warning(tctx, "LookupNames failed - %s\n", nt_errstr(status));
return false;
}
status = dcerpc_samr_OpenUser(p, tctx, &r);
if (!NT_STATUS_IS_OK(status)) {
- printf("OpenUser(%u) failed - %s\n", n.out.rids->ids[0], nt_errstr(status));
+ torture_warning(tctx, "OpenUser(%u) failed - %s\n", n.out.rids->ids[0], nt_errstr(status));
return false;
}
status = dcerpc_samr_QueryUserInfo(p, tctx, &q);
if (!NT_STATUS_IS_OK(status)) {
- printf("QueryUserInfo failed - %s\n", nt_errstr(status));
+ torture_warning(tctx, "QueryUserInfo failed - %s\n", nt_errstr(status));
return false;
}
- printf("calling test_ChangePasswordUser3 with too early password change\n");
+ torture_comment(tctx, "calling test_ChangePasswordUser3 with too early password change\n");
if (!test_ChangePasswordUser3(p, tctx, acct_name, 0, password, NULL,
info->info5.last_password_change, true)) {
r.out.user_handle = &user_handle;
r.out.rid = &rid;
- printf("Testing CreateUser(%s)\n", r.in.account_name->string);
+ torture_comment(tctx, "Testing CreateUser(%s)\n", r.in.account_name->string);
status = dcerpc_samr_CreateUser(p, user_ctx, &r);
if (dom_sid_equal(domain_sid, dom_sid_parse_talloc(tctx, SID_BUILTIN))) {
if (NT_STATUS_EQUAL(status, NT_STATUS_ACCESS_DENIED) || NT_STATUS_EQUAL(status, NT_STATUS_INVALID_PARAMETER)) {
- printf("Server correctly refused create of '%s'\n", r.in.account_name->string);
+ torture_comment(tctx, "Server correctly refused create of '%s'\n", r.in.account_name->string);
return true;
} else {
- printf("Server should have refused create of '%s', got %s instead\n", r.in.account_name->string,
+ torture_warning(tctx, "Server should have refused create of '%s', got %s instead\n", r.in.account_name->string,
nt_errstr(status));
return false;
}
if (!NT_STATUS_IS_OK(status)) {
talloc_free(user_ctx);
- printf("CreateUser failed - %s\n", nt_errstr(status));
+ torture_warning(tctx, "CreateUser failed - %s\n", nt_errstr(status));
return false;
}
status = dcerpc_samr_QueryUserInfo(p, user_ctx, &q);
if (!NT_STATUS_IS_OK(status)) {
- printf("QueryUserInfo level %u failed - %s\n",
+ torture_warning(tctx, "QueryUserInfo level %u failed - %s\n",
q.in.level, nt_errstr(status));
ret = false;
} else {
if ((info->info16.acct_flags & acct_flags) != acct_flags) {
- printf("QuerUserInfo level 16 failed, it returned 0x%08x when we expected flags of 0x%08x\n",
+ torture_warning(tctx, "QuerUserInfo level 16 failed, it returned 0x%08x when we expected flags of 0x%08x\n",
info->info16.acct_flags,
acct_flags);
ret = false;
if (user_handle_out) {
*user_handle_out = user_handle;
} else {
- printf("Testing DeleteUser (createuser test)\n");
+ torture_comment(tctx, "Testing DeleteUser (createuser test)\n");
d.in.user_handle = &user_handle;
d.out.user_handle = &user_handle;
status = dcerpc_samr_DeleteUser(p, user_ctx, &d);
if (!NT_STATUS_IS_OK(status)) {
- printf("DeleteUser failed - %s\n", nt_errstr(status));
+ torture_warning(tctx, "DeleteUser failed - %s\n", nt_errstr(status));
ret = false;
}
}
{ ACB_SVRTRUST, TEST_MACHINENAME, NT_STATUS_OK },
{ ACB_SVRTRUST | ACB_DISABLED, TEST_MACHINENAME, NT_STATUS_INVALID_PARAMETER },
{ ACB_SVRTRUST | ACB_PWNOEXP, TEST_MACHINENAME, NT_STATUS_INVALID_PARAMETER },
- { ACB_DOMTRUST, TEST_DOMAINNAME, NT_STATUS_OK },
+ { ACB_DOMTRUST, TEST_DOMAINNAME, NT_STATUS_ACCESS_DENIED },
{ ACB_DOMTRUST | ACB_DISABLED, TEST_DOMAINNAME, NT_STATUS_INVALID_PARAMETER },
{ ACB_DOMTRUST | ACB_PWNOEXP, TEST_DOMAINNAME, NT_STATUS_INVALID_PARAMETER },
{ 0, TEST_ACCOUNT_NAME, NT_STATUS_INVALID_PARAMETER },
r.out.access_granted = &access_granted;
r.out.rid = &rid;
- printf("Testing CreateUser2(%s, 0x%x)\n", r.in.account_name->string, acct_flags);
+ torture_comment(tctx, "Testing CreateUser2(%s, 0x%x)\n", r.in.account_name->string, acct_flags);
status = dcerpc_samr_CreateUser2(p, user_ctx, &r);
if (dom_sid_equal(domain_sid, dom_sid_parse_talloc(tctx, SID_BUILTIN))) {
if (NT_STATUS_EQUAL(status, NT_STATUS_ACCESS_DENIED) || NT_STATUS_EQUAL(status, NT_STATUS_INVALID_PARAMETER)) {
- printf("Server correctly refused create of '%s'\n", r.in.account_name->string);
+ torture_comment(tctx, "Server correctly refused create of '%s'\n", r.in.account_name->string);
continue;
} else {
- printf("Server should have refused create of '%s', got %s instead\n", r.in.account_name->string,
+ torture_warning(tctx, "Server should have refused create of '%s', got %s instead\n", r.in.account_name->string,
nt_errstr(status));
ret = false;
continue;
}
if (!NT_STATUS_EQUAL(status, account_types[i].nt_status)) {
- printf("CreateUser2 failed gave incorrect error return - %s (should be %s)\n",
+ torture_warning(tctx, "CreateUser2 failed gave incorrect error return - %s (should be %s)\n",
nt_errstr(status), nt_errstr(account_types[i].nt_status));
ret = false;
}
status = dcerpc_samr_QueryUserInfo(p, user_ctx, &q);
if (!NT_STATUS_IS_OK(status)) {
- printf("QueryUserInfo level %u failed - %s\n",
+ torture_warning(tctx, "QueryUserInfo level %u failed - %s\n",
q.in.level, nt_errstr(status));
ret = false;
} else {
expected_flags |= ACB_PW_EXPIRED;
}
if ((info->info5.acct_flags) != expected_flags) {
- printf("QuerUserInfo level 5 failed, it returned 0x%08x when we expected flags of 0x%08x\n",
+ torture_warning(tctx, "QuerUserInfo level 5 failed, it returned 0x%08x when we expected flags of 0x%08x\n",
info->info5.acct_flags,
expected_flags);
ret = false;
switch (acct_flags) {
case ACB_SVRTRUST:
if (info->info5.primary_gid != DOMAIN_RID_DCS) {
- printf("QuerUserInfo level 5: DC should have had Primary Group %d, got %d\n",
+ torture_warning(tctx, "QuerUserInfo level 5: DC should have had Primary Group %d, got %d\n",
DOMAIN_RID_DCS, info->info5.primary_gid);
ret = false;
}
break;
case ACB_WSTRUST:
if (info->info5.primary_gid != DOMAIN_RID_DOMAIN_MEMBERS) {
- printf("QuerUserInfo level 5: Domain Member should have had Primary Group %d, got %d\n",
+ torture_warning(tctx, "QuerUserInfo level 5: Domain Member should have had Primary Group %d, got %d\n",
DOMAIN_RID_DOMAIN_MEMBERS, info->info5.primary_gid);
ret = false;
}
break;
case ACB_NORMAL:
if (info->info5.primary_gid != DOMAIN_RID_USERS) {
- printf("QuerUserInfo level 5: Users should have had Primary Group %d, got %d\n",
+ torture_warning(tctx, "QuerUserInfo level 5: Users should have had Primary Group %d, got %d\n",
DOMAIN_RID_USERS, info->info5.primary_gid);
ret = false;
}
}
if (!policy_handle_empty(&user_handle)) {
- printf("Testing DeleteUser (createuser2 test)\n");
+ torture_comment(tctx, "Testing DeleteUser (createuser2 test)\n");
d.in.user_handle = &user_handle;
d.out.user_handle = &user_handle;
status = dcerpc_samr_DeleteUser(p, user_ctx, &d);
if (!NT_STATUS_IS_OK(status)) {
- printf("DeleteUser failed - %s\n", nt_errstr(status));
+ torture_warning(tctx, "DeleteUser failed - %s\n", nt_errstr(status));
ret = false;
}
}
bool ret = true;
for (i=0;i<ARRAY_SIZE(levels);i++) {
- printf("Testing QueryAliasInfo level %u\n", levels[i]);
+ torture_comment(tctx, "Testing QueryAliasInfo level %u\n", levels[i]);
r.in.alias_handle = handle;
r.in.level = levels[i];
status = dcerpc_samr_QueryAliasInfo(p, tctx, &r);
if (!NT_STATUS_IS_OK(status)) {
- printf("QueryAliasInfo level %u failed - %s\n",
+ torture_warning(tctx, "QueryAliasInfo level %u failed - %s\n",
levels[i], nt_errstr(status));
ret = false;
}
bool ret = true;
for (i=0;i<ARRAY_SIZE(levels);i++) {
- printf("Testing QueryGroupInfo level %u\n", levels[i]);
+ torture_comment(tctx, "Testing QueryGroupInfo level %u\n", levels[i]);
r.in.group_handle = handle;
r.in.level = levels[i];
status = dcerpc_samr_QueryGroupInfo(p, tctx, &r);
if (!NT_STATUS_IS_OK(status)) {
- printf("QueryGroupInfo level %u failed - %s\n",
+ torture_warning(tctx, "QueryGroupInfo level %u failed - %s\n",
levels[i], nt_errstr(status));
ret = false;
}
struct samr_RidTypeArray *rids = NULL;
bool ret = true;
- printf("Testing QueryGroupMember\n");
+ torture_comment(tctx, "Testing QueryGroupMember\n");
r.in.group_handle = handle;
r.out.rids = &rids;
status = dcerpc_samr_QueryGroupMember(p, tctx, &r);
if (!NT_STATUS_IS_OK(status)) {
- printf("QueryGroupInfo failed - %s\n", nt_errstr(status));
+ torture_warning(tctx, "QueryGroupInfo failed - %s\n", nt_errstr(status));
ret = false;
}
bool ret = true;
for (i=0;i<ARRAY_SIZE(levels);i++) {
- printf("Testing QueryGroupInfo level %u\n", levels[i]);
+ torture_comment(tctx, "Testing QueryGroupInfo level %u\n", levels[i]);
r.in.group_handle = handle;
r.in.level = levels[i];
status = dcerpc_samr_QueryGroupInfo(p, tctx, &r);
if (!NT_STATUS_IS_OK(status)) {
- printf("QueryGroupInfo level %u failed - %s\n",
+ torture_warning(tctx, "QueryGroupInfo level %u failed - %s\n",
levels[i], nt_errstr(status));
ret = false;
}
- printf("Testing SetGroupInfo level %u\n", levels[i]);
+ torture_comment(tctx, "Testing SetGroupInfo level %u\n", levels[i]);
s.in.group_handle = handle;
s.in.level = levels[i];
status = dcerpc_samr_SetGroupInfo(p, tctx, &s);
if (set_ok[i]) {
if (!NT_STATUS_IS_OK(status)) {
- printf("SetGroupInfo level %u failed - %s\n",
+ torture_warning(tctx, "SetGroupInfo level %u failed - %s\n",
r.in.level, nt_errstr(status));
ret = false;
continue;
}
} else {
if (!NT_STATUS_EQUAL(NT_STATUS_INVALID_INFO_CLASS, status)) {
- printf("SetGroupInfo level %u gave %s - should have been NT_STATUS_INVALID_INFO_CLASS\n",
+ torture_warning(tctx, "SetGroupInfo level %u gave %s - should have been NT_STATUS_INVALID_INFO_CLASS\n",
r.in.level, nt_errstr(status));
ret = false;
continue;
bool ret = true;
for (i=0;i<ARRAY_SIZE(levels);i++) {
- printf("Testing QueryUserInfo level %u\n", levels[i]);
+ torture_comment(tctx, "Testing QueryUserInfo level %u\n", levels[i]);
r.in.user_handle = handle;
r.in.level = levels[i];
status = dcerpc_samr_QueryUserInfo(p, tctx, &r);
if (!NT_STATUS_IS_OK(status)) {
- printf("QueryUserInfo level %u failed - %s\n",
+ torture_warning(tctx, "QueryUserInfo level %u failed - %s\n",
levels[i], nt_errstr(status));
ret = false;
}
bool ret = true;
for (i=0;i<ARRAY_SIZE(levels);i++) {
- printf("Testing QueryUserInfo2 level %u\n", levels[i]);
+ torture_comment(tctx, "Testing QueryUserInfo2 level %u\n", levels[i]);
r.in.user_handle = handle;
r.in.level = levels[i];
status = dcerpc_samr_QueryUserInfo2(p, tctx, &r);
if (!NT_STATUS_IS_OK(status)) {
- printf("QueryUserInfo2 level %u failed - %s\n",
+ torture_warning(tctx, "QueryUserInfo2 level %u failed - %s\n",
levels[i], nt_errstr(status));
ret = false;
}
struct policy_handle user_handle;
bool ret = true;
- printf("Testing OpenUser(%u)\n", rid);
+ torture_comment(tctx, "Testing OpenUser(%u)\n", rid);
r.in.domain_handle = handle;
r.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
status = dcerpc_samr_OpenUser(p, tctx, &r);
if (!NT_STATUS_IS_OK(status)) {
- printf("OpenUser(%u) failed - %s\n", rid, nt_errstr(status));
+ torture_warning(tctx, "OpenUser(%u) failed - %s\n", rid, nt_errstr(status));
return false;
}
struct policy_handle group_handle;
bool ret = true;
- printf("Testing OpenGroup(%u)\n", rid);
+ torture_comment(tctx, "Testing OpenGroup(%u)\n", rid);
r.in.domain_handle = handle;
r.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
status = dcerpc_samr_OpenGroup(p, tctx, &r);
if (!NT_STATUS_IS_OK(status)) {
- printf("OpenGroup(%u) failed - %s\n", rid, nt_errstr(status));
+ torture_warning(tctx, "OpenGroup(%u) failed - %s\n", rid, nt_errstr(status));
return false;
}
status = dcerpc_samr_OpenAlias(p, tctx, &r);
if (!NT_STATUS_IS_OK(status)) {
- printf("OpenAlias(%u) failed - %s\n", rid, nt_errstr(status));
+ torture_warning(tctx, "OpenAlias(%u) failed - %s\n", rid, nt_errstr(status));
return false;
}
status = dcerpc_samr_OpenUser(p, tctx, &r);
if (!NT_STATUS_IS_OK(status)) {
- printf("OpenUser(%u) failed - %s\n", rid, nt_errstr(status));
+ torture_warning(tctx, "OpenUser(%u) failed - %s\n", rid, nt_errstr(status));
return false;
}
status = dcerpc_samr_QueryUserInfo(p, tctx, &q);
if (!NT_STATUS_IS_OK(status)) {
- printf("QueryUserInfo level 16 failed - %s\n",
+ torture_warning(tctx, "QueryUserInfo level 16 failed - %s\n",
nt_errstr(status));
ret = false;
} else {
if ((acct_flag_mask & info->info16.acct_flags) == 0) {
- printf("Server failed to filter for 0x%x, allowed 0x%x (%d) on EnumDomainUsers\n",
+ torture_warning(tctx, "Server failed to filter for 0x%x, allowed 0x%x (%d) on EnumDomainUsers\n",
acct_flag_mask, info->info16.acct_flags, rid);
ret = false;
}
ACB_SVRTRUST | ACB_DOMTRUST | ACB_WSTRUST,
ACB_PWNOEXP, 0};
- printf("Testing EnumDomainUsers\n");
+ torture_comment(tctx, "Testing EnumDomainUsers\n");
for (mask_idx=0;mask_idx<ARRAY_SIZE(masks);mask_idx++) {
r.in.domain_handle = handle;
status = dcerpc_samr_EnumDomainUsers(p, tctx, &r);
if (!NT_STATUS_EQUAL(status, STATUS_MORE_ENTRIES) &&
!NT_STATUS_IS_OK(status)) {
- printf("EnumDomainUsers failed - %s\n", nt_errstr(status));
+ torture_warning(tctx, "EnumDomainUsers failed - %s\n", nt_errstr(status));
return false;
}
}
}
- printf("Testing LookupNames\n");
+ torture_comment(tctx, "Testing LookupNames\n");
n.in.domain_handle = handle;
n.in.num_names = sam->count;
n.in.names = talloc_array(tctx, struct lsa_String, sam->count);
}
status = dcerpc_samr_LookupNames(p, tctx, &n);
if (!NT_STATUS_IS_OK(status)) {
- printf("LookupNames failed - %s\n", nt_errstr(status));
+ torture_warning(tctx, "LookupNames failed - %s\n", nt_errstr(status));
ret = false;
}
- printf("Testing LookupRids\n");
+ torture_comment(tctx, "Testing LookupRids\n");
lr.in.domain_handle = handle;
lr.in.num_rids = sam->count;
lr.in.rids = talloc_array(tctx, uint32_t, sam->count);
for (i=0;i<ASYNC_COUNT;i++) {
status = dcerpc_ndr_request_recv(req[i]);
if (!NT_STATUS_IS_OK(status)) {
- printf("EnumDomainUsers[%d] failed - %s\n",
+ torture_warning(tctx, "EnumDomainUsers[%d] failed - %s\n",
i, nt_errstr(status));
return false;
}
int i;
bool ret = true;
- printf("Testing EnumDomainGroups\n");
+ torture_comment(tctx, "Testing EnumDomainGroups\n");
r.in.domain_handle = handle;
r.in.resume_handle = &resume_handle;
status = dcerpc_samr_EnumDomainGroups(p, tctx, &r);
if (!NT_STATUS_IS_OK(status)) {
- printf("EnumDomainGroups failed - %s\n", nt_errstr(status));
+ torture_warning(tctx, "EnumDomainGroups failed - %s\n", nt_errstr(status));
return false;
}
int i;
bool ret = true;
- printf("Testing EnumDomainAliases\n");
+ torture_comment(tctx, "Testing EnumDomainAliases\n");
r.in.domain_handle = handle;
r.in.resume_handle = &resume_handle;
status = dcerpc_samr_EnumDomainAliases(p, tctx, &r);
if (!NT_STATUS_IS_OK(status)) {
- printf("EnumDomainAliases failed - %s\n", nt_errstr(status));
+ torture_warning(tctx, "EnumDomainAliases failed - %s\n", nt_errstr(status));
return false;
}
int i;
for (i=0;i<ARRAY_SIZE(levels);i++) {
- printf("Testing GetDisplayEnumerationIndex level %u\n", levels[i]);
+ torture_comment(tctx, "Testing GetDisplayEnumerationIndex level %u\n", levels[i]);
init_lsa_String(&name, TEST_ACCOUNT_NAME);
if (ok_lvl[i] &&
!NT_STATUS_IS_OK(status) &&
!NT_STATUS_EQUAL(NT_STATUS_NO_MORE_ENTRIES, status)) {
- printf("GetDisplayEnumerationIndex level %u failed - %s\n",
+ torture_warning(tctx, "GetDisplayEnumerationIndex level %u failed - %s\n",
levels[i], nt_errstr(status));
ret = false;
}
status = dcerpc_samr_GetDisplayEnumerationIndex(p, tctx, &r);
if (ok_lvl[i] && !NT_STATUS_EQUAL(NT_STATUS_NO_MORE_ENTRIES, status)) {
- printf("GetDisplayEnumerationIndex level %u failed - %s\n",
+ torture_warning(tctx, "GetDisplayEnumerationIndex level %u failed - %s\n",
levels[i], nt_errstr(status));
ret = false;
}
int i;
for (i=0;i<ARRAY_SIZE(levels);i++) {
- printf("Testing GetDisplayEnumerationIndex2 level %u\n", levels[i]);
+ torture_comment(tctx, "Testing GetDisplayEnumerationIndex2 level %u\n", levels[i]);
init_lsa_String(&name, TEST_ACCOUNT_NAME);
if (ok_lvl[i] &&
!NT_STATUS_IS_OK(status) &&
!NT_STATUS_EQUAL(NT_STATUS_NO_MORE_ENTRIES, status)) {
- printf("GetDisplayEnumerationIndex2 level %u failed - %s\n",
+ torture_warning(tctx, "GetDisplayEnumerationIndex2 level %u failed - %s\n",
levels[i], nt_errstr(status));
ret = false;
}
status = dcerpc_samr_GetDisplayEnumerationIndex2(p, tctx, &r);
if (ok_lvl[i] && !NT_STATUS_EQUAL(NT_STATUS_NO_MORE_ENTRIES, status)) {
- printf("GetDisplayEnumerationIndex2 level %u failed - %s\n",
+ torture_warning(tctx, "GetDisplayEnumerationIndex2 level %u failed - %s\n",
levels[i], nt_errstr(status));
ret = false;
}
if (s1.string == NULL && s2.string != NULL && s2.string[0] == '\0') { \
/* odd, but valid */ \
} else if ((s1.string && !s2.string) || (s2.string && !s1.string) || strcmp(s1.string, s2.string)) { \
- printf("%s mismatch for %s: %s != %s (%s)\n", \
+ torture_warning(tctx, "%s mismatch for %s: %s != %s (%s)\n", \
#s1, user.string, s1.string, s2.string, __location__); \
ret = false; \
}
#define INT_EQUAL_QUERY(s1, s2, user) \
if (s1 != s2) { \
- printf("%s mismatch for %s: 0x%llx != 0x%llx (%s)\n", \
+ torture_warning(tctx, "%s mismatch for %s: 0x%llx != 0x%llx (%s)\n", \
#s1, user.string, (unsigned long long)s1, (unsigned long long)s2, __location__); \
ret = false; \
}
case 2:
status = dcerpc_samr_OpenUser(p, tctx, &r);
if (!NT_STATUS_IS_OK(status)) {
- printf("OpenUser(%u) failed - %s\n", r.in.rid, nt_errstr(status));
+ torture_warning(tctx, "OpenUser(%u) failed - %s\n", r.in.rid, nt_errstr(status));
return false;
}
}
q.out.info = &info;
status = dcerpc_samr_QueryUserInfo(p, tctx, &q);
if (!NT_STATUS_IS_OK(status)) {
- printf("QueryUserInfo(%u) failed - %s\n", r.in.rid, nt_errstr(status));
+ torture_warning(tctx, "QueryUserInfo(%u) failed - %s\n", r.in.rid, nt_errstr(status));
return false;
}
info->info21.acct_flags, info->info21.account_name);
if (!(querydisplayinfo->out.info->info2.entries[i].acct_flags & ACB_NORMAL)) {
- printf("Missing ACB_NORMAL in querydisplayinfo->out.info.info2.entries[i].acct_flags on %s\n",
+ torture_warning(tctx, "Missing ACB_NORMAL in querydisplayinfo->out.info.info2.entries[i].acct_flags on %s\n",
info->info21.account_name.string);
}
if (!(info->info21.acct_flags & (ACB_WSTRUST | ACB_SVRTRUST))) {
- printf("Found non-trust account %s in trust account listing: 0x%x 0x%x\n",
+ torture_warning(tctx, "Found non-trust account %s in trust account listing: 0x%x 0x%x\n",
info->info21.account_name.string,
querydisplayinfo->out.info->info2.entries[i].acct_flags,
info->info21.acct_flags);
for (i=0;i<ARRAY_SIZE(levels);i++) {
- printf("Testing QueryDisplayInfo level %u\n", levels[i]);
+ torture_comment(tctx, "Testing QueryDisplayInfo level %u\n", levels[i]);
r.in.start_idx = 0;
status = STATUS_MORE_ENTRIES;
status = dcerpc_samr_QueryDisplayInfo(p, tctx, &r);
if (!NT_STATUS_EQUAL(status, STATUS_MORE_ENTRIES) && !NT_STATUS_IS_OK(status)) {
- printf("QueryDisplayInfo level %u failed - %s\n",
+ torture_warning(tctx, "QueryDisplayInfo level %u failed - %s\n",
levels[i], nt_errstr(status));
ret = false;
}
/* Check number of users returned is correct */
status = dcerpc_samr_QueryDomainInfo(p, tctx, &dom_info);
if (!NT_STATUS_IS_OK(status)) {
- printf("QueryDomainInfo level %u failed - %s\n",
+ torture_warning(tctx, "QueryDomainInfo level %u failed - %s\n",
r.in.level, nt_errstr(status));
ret = false;
break;
case 1:
case 4:
if (info->general.num_users < r.in.start_idx) {
- printf("QueryDomainInfo indicates that QueryDisplayInfo returned more users (%d/%d) than the domain %s is said to contain!\n",
+ torture_warning(tctx, "QueryDomainInfo indicates that QueryDisplayInfo returned more users (%d/%d) than the domain %s is said to contain!\n",
r.in.start_idx, info->general.num_groups,
info->general.domain_name.string);
ret = false;
if (!seen_testuser) {
struct policy_handle user_handle;
if (NT_STATUS_IS_OK(test_OpenUser_byname(p, tctx, handle, TEST_ACCOUNT_NAME, &user_handle))) {
- printf("Didn't find test user " TEST_ACCOUNT_NAME " in enumeration of %s\n",
+ torture_warning(tctx, "Didn't find test user " TEST_ACCOUNT_NAME " in enumeration of %s\n",
info->general.domain_name.string);
ret = false;
test_samr_handle_Close(p, tctx, &user_handle);
case 3:
case 5:
if (info->general.num_groups != r.in.start_idx) {
- printf("QueryDomainInfo indicates that QueryDisplayInfo didn't return all (%d/%d) the groups in %s\n",
+ torture_warning(tctx, "QueryDomainInfo indicates that QueryDisplayInfo didn't return all (%d/%d) the groups in %s\n",
r.in.start_idx, info->general.num_groups,
info->general.domain_name.string);
ret = false;
union samr_DispInfo info;
for (i=0;i<ARRAY_SIZE(levels);i++) {
- printf("Testing QueryDisplayInfo2 level %u\n", levels[i]);
+ torture_comment(tctx, "Testing QueryDisplayInfo2 level %u\n", levels[i]);
r.in.domain_handle = handle;
r.in.level = levels[i];
status = dcerpc_samr_QueryDisplayInfo2(p, tctx, &r);
if (!NT_STATUS_IS_OK(status)) {
- printf("QueryDisplayInfo2 level %u failed - %s\n",
+ torture_warning(tctx, "QueryDisplayInfo2 level %u failed - %s\n",
levels[i], nt_errstr(status));
ret = false;
}
status = dcerpc_samr_QueryDisplayInfo3(p, tctx, &r);
if (!NT_STATUS_IS_OK(status)) {
- printf("QueryDisplayInfo3 level %u failed - %s\n",
+ torture_warning(tctx, "QueryDisplayInfo3 level %u failed - %s\n",
levels[i], nt_errstr(status));
ret = false;
}
uint32_t returned_size;
union samr_DispInfo info;
- printf("Testing QueryDisplayInfo continuation\n");
+ torture_comment(tctx, "Testing QueryDisplayInfo continuation\n");
r.in.domain_handle = handle;
r.in.level = 1;
status = dcerpc_samr_QueryDisplayInfo(p, tctx, &r);
if (NT_STATUS_IS_OK(status) && *r.out.returned_size != 0) {
if (r.out.info->info1.entries[0].idx != r.in.start_idx + 1) {
- printf("expected idx %d but got %d\n",
+ torture_warning(tctx, "expected idx %d but got %d\n",
r.in.start_idx + 1,
r.out.info->info1.entries[0].idx);
break;
}
if (!NT_STATUS_EQUAL(status, STATUS_MORE_ENTRIES) &&
!NT_STATUS_IS_OK(status)) {
- printf("QueryDisplayInfo level %u failed - %s\n",
+ torture_warning(tctx, "QueryDisplayInfo level %u failed - %s\n",
r.in.level, nt_errstr(status));
ret = false;
break;
s.in.info->oem.oem_information.string = domain_comment;
status = dcerpc_samr_SetDomainInfo(p, tctx, &s);
if (!NT_STATUS_IS_OK(status)) {
- printf("SetDomainInfo level %u (set comment) failed - %s\n",
+ torture_warning(tctx, "SetDomainInfo level %u (set comment) failed - %s\n",
s.in.level, nt_errstr(status));
return false;
}
status = dcerpc_samr_QueryDomainInfo(p, tctx, &r);
if (!NT_STATUS_IS_OK(status)) {
- printf("QueryDomainInfo level %u failed - %s\n",
+ torture_warning(tctx, "QueryDomainInfo level %u failed - %s\n",
r.in.level, nt_errstr(status));
ret = false;
continue;
switch (levels[i]) {
case 2:
if (strcmp(info->general.oem_information.string, domain_comment) != 0) {
- printf("QueryDomainInfo level %u returned different oem_information (comment) (%s, expected %s)\n",
+ torture_warning(tctx, "QueryDomainInfo level %u returned different oem_information (comment) (%s, expected %s)\n",
levels[i], info->general.oem_information.string, domain_comment);
- ret = false;
+ if (!torture_setting_bool(tctx, "samba3", false)) {
+ ret = false;
+ }
}
if (!info->general.primary.string) {
- printf("QueryDomainInfo level %u returned no PDC name\n",
+ torture_warning(tctx, "QueryDomainInfo level %u returned no PDC name\n",
levels[i]);
ret = false;
} else if (info->general.role == SAMR_ROLE_DOMAIN_PDC) {
if (dcerpc_server_name(p) && strcasecmp_m(dcerpc_server_name(p), info->general.primary.string) != 0) {
- printf("QueryDomainInfo level %u returned different PDC name (%s) compared to server name (%s), despite claiming to be the PDC\n",
+ torture_warning(tctx, "QueryDomainInfo level %u returned different PDC name (%s) compared to server name (%s), despite claiming to be the PDC\n",
levels[i], info->general.primary.string, dcerpc_server_name(p));
}
}
break;
case 4:
if (strcmp(info->oem.oem_information.string, domain_comment) != 0) {
- printf("QueryDomainInfo level %u returned different oem_information (comment) (%s, expected %s)\n",
+ torture_warning(tctx, "QueryDomainInfo level %u returned different oem_information (comment) (%s, expected %s)\n",
levels[i], info->oem.oem_information.string, domain_comment);
- ret = false;
+ if (!torture_setting_bool(tctx, "samba3", false)) {
+ ret = false;
+ }
}
break;
case 6:
if (!info->info6.primary.string) {
- printf("QueryDomainInfo level %u returned no PDC name\n",
+ torture_warning(tctx, "QueryDomainInfo level %u returned no PDC name\n",
levels[i]);
ret = false;
}
break;
case 11:
if (strcmp(info->general2.general.oem_information.string, domain_comment) != 0) {
- printf("QueryDomainInfo level %u returned different comment (%s, expected %s)\n",
+ torture_warning(tctx, "QueryDomainInfo level %u returned different comment (%s, expected %s)\n",
levels[i], info->general2.general.oem_information.string, domain_comment);
- ret = false;
+ if (!torture_setting_bool(tctx, "samba3", false)) {
+ ret = false;
+ }
}
break;
}
status = dcerpc_samr_SetDomainInfo(p, tctx, &s);
if (set_ok[i]) {
if (!NT_STATUS_IS_OK(status)) {
- printf("SetDomainInfo level %u failed - %s\n",
+ torture_warning(tctx, "SetDomainInfo level %u failed - %s\n",
r.in.level, nt_errstr(status));
ret = false;
continue;
}
} else {
if (!NT_STATUS_EQUAL(NT_STATUS_INVALID_INFO_CLASS, status)) {
- printf("SetDomainInfo level %u gave %s - should have been NT_STATUS_INVALID_INFO_CLASS\n",
+ torture_warning(tctx, "SetDomainInfo level %u gave %s - should have been NT_STATUS_INVALID_INFO_CLASS\n",
r.in.level, nt_errstr(status));
ret = false;
continue;
status = dcerpc_samr_QueryDomainInfo(p, tctx, &r);
if (!NT_STATUS_IS_OK(status)) {
- printf("QueryDomainInfo level %u failed - %s\n",
+ torture_warning(tctx, "QueryDomainInfo level %u failed - %s\n",
r.in.level, nt_errstr(status));
ret = false;
continue;
bool ret = true;
for (i=0;i<ARRAY_SIZE(levels);i++) {
- printf("Testing QueryDomainInfo2 level %u\n", levels[i]);
+ torture_comment(tctx, "Testing QueryDomainInfo2 level %u\n", levels[i]);
r.in.domain_handle = handle;
r.in.level = levels[i];
status = dcerpc_samr_QueryDomainInfo2(p, tctx, &r);
if (!NT_STATUS_IS_OK(status)) {
- printf("QueryDomainInfo2 level %u failed - %s\n",
+ torture_warning(tctx, "QueryDomainInfo2 level %u failed - %s\n",
r.in.level, nt_errstr(status));
ret = false;
continue;
}
if (!found) {
- printf("QueryDisplayInfo gave name [%s] that EnumDomainGroups did not\n",
+ torture_warning(tctx, "QueryDisplayInfo gave name [%s] that EnumDomainGroups did not\n",
name);
ret = false;
}
}
if (!NT_STATUS_IS_OK(status)) {
- printf("QueryDisplayInfo level 5 failed - %s\n",
+ torture_warning(tctx, "QueryDisplayInfo level 5 failed - %s\n",
nt_errstr(status));
ret = false;
}
for (i=0; i<num_names; i++) {
if (names[i] != NULL) {
- printf("EnumDomainGroups gave name [%s] that QueryDisplayInfo did not\n",
+ torture_warning(tctx, "EnumDomainGroups gave name [%s] that QueryDisplayInfo did not\n",
names[i]);
ret = false;
}
status = dcerpc_samr_RidToSid(p, tctx, &r);
if (!NT_STATUS_IS_OK(status)) {
- printf("RidToSid for %d failed - %s\n", rids[i], nt_errstr(status));
+ torture_warning(tctx, "RidToSid for %d failed - %s\n", rids[i], nt_errstr(status));
ret = false;
} else {
calc_sid = dom_sid_add_rid(calc_sid, calc_sid, rids[i]);
if (!dom_sid_equal(calc_sid, out_sid)) {
- printf("RidToSid for %d failed - got %s, expected %s\n", rids[i],
+ torture_warning(tctx, "RidToSid for %d failed - got %s, expected %s\n", rids[i],
dom_sid_string(tctx, out_sid),
dom_sid_string(tctx, calc_sid));
ret = false;
struct samr_RidTypeArray *rids = NULL;
struct samr_SetMemberAttributesOfGroup s;
uint32_t rid;
+ bool found_member = false;
+ int i;
status = test_LookupName(p, tctx, domain_handle, TEST_ACCOUNT_NAME, &rid);
torture_assert_ntstatus_ok(tctx, status, "test_AddGroupMember looking up name " TEST_ACCOUNT_NAME);
r.in.rid = rid;
r.in.flags = 0; /* ??? */
- torture_comment(tctx, "Testing AddGroupMember and DeleteGroupMember\n");
+ torture_comment(tctx, "Testing AddGroupMember, QueryGroupMember and DeleteGroupMember\n");
d.in.group_handle = group_handle;
d.in.rid = rid;
if (torture_setting_bool(tctx, "samba4", false) ||
torture_setting_bool(tctx, "samba3", false)) {
- torture_comment(tctx, "skipping SetMemberAttributesOfGroup test against Samba4\n");
+ torture_comment(tctx, "skipping SetMemberAttributesOfGroup test against Samba\n");
} else {
/* this one is quite strange. I am using random inputs in the
hope of triggering an error that might give us a clue */
status = dcerpc_samr_QueryGroupMember(p, tctx, &q);
torture_assert_ntstatus_ok(tctx, status, "QueryGroupMember");
+ torture_assert(tctx, rids, "QueryGroupMember did not fill in rids structure");
+
+ for (i=0; i < rids->count; i++) {
+ if (rids->rids[i] == rid) {
+ found_member = true;
+ }
+ }
+
+ torture_assert(tctx, found_member, "QueryGroupMember did not list newly added member");
status = dcerpc_samr_DeleteGroupMember(p, tctx, &d);
torture_assert_ntstatus_ok(tctx, status, "DeleteGroupMember");
+ rids = NULL;
+ found_member = false;
+
+ status = dcerpc_samr_QueryGroupMember(p, tctx, &q);
+ torture_assert_ntstatus_ok(tctx, status, "QueryGroupMember");
+ torture_assert(tctx, rids, "QueryGroupMember did not fill in rids structure");
+
+ for (i=0; i < rids->count; i++) {
+ if (rids->rids[i] == rid) {
+ found_member = true;
+ }
+ }
+
+ torture_assert(tctx, !found_member, "QueryGroupMember does still list removed member");
+
status = dcerpc_samr_AddGroupMember(p, tctx, &r);
torture_assert_ntstatus_ok(tctx, status, "AddGroupMember");
r.out.group_handle = group_handle;
r.out.rid = &rid;
- printf("Testing CreateDomainGroup(%s)\n", r.in.name->string);
+ torture_comment(tctx, "Testing CreateDomainGroup(%s)\n", r.in.name->string);
status = dcerpc_samr_CreateDomainGroup(p, tctx, &r);
torture_comment(tctx, "Server correctly refused create of '%s'\n", r.in.name->string);
return true;
} else {
- printf("Server should have refused create of '%s', got %s instead\n", r.in.name->string,
+ torture_warning(tctx, "Server should have refused create of '%s', got %s instead\n", r.in.name->string,
nt_errstr(status));
return false;
}
if (NT_STATUS_EQUAL(status, NT_STATUS_GROUP_EXISTS)) {
if (!test_DeleteGroup_byname(p, tctx, domain_handle, r.in.name->string)) {
- printf("CreateDomainGroup failed: Could not delete domain group %s - %s\n", r.in.name->string,
+ torture_warning(tctx, "CreateDomainGroup failed: Could not delete domain group %s - %s\n", r.in.name->string,
nt_errstr(status));
return false;
}
if (NT_STATUS_EQUAL(status, NT_STATUS_USER_EXISTS)) {
if (!test_DeleteUser_byname(p, tctx, domain_handle, r.in.name->string)) {
- printf("CreateDomainGroup failed: Could not delete user %s - %s\n", r.in.name->string,
+ torture_warning(tctx, "CreateDomainGroup failed: Could not delete user %s - %s\n", r.in.name->string,
nt_errstr(status));
return false;
}
}
if (!test_AddGroupMember(p, tctx, domain_handle, group_handle)) {
- printf("CreateDomainGroup failed - %s\n", nt_errstr(status));
+ torture_warning(tctx, "CreateDomainGroup failed - %s\n", nt_errstr(status));
ret = false;
}
struct samr_SamArray *sam;
r.in.domain_handle = domain_handle;
- r.in.acct_flags = ACB_NORMAL;
+ r.in.acct_flags = 0;
r.in.max_size = (uint32_t)-1;
r.in.resume_handle = &resume_handle;
r.out.num_entries = &num_entries;
r.out.resume_handle = &resume_handle;
- printf("Testing EnumDomainUsers\n");
+ torture_comment(tctx, "Testing EnumDomainUsers\n");
do {
status = dcerpc_samr_EnumDomainUsers(p, tctx, &r);
r.out.num_entries = &num_entries;
r.out.resume_handle = &resume_handle;
- printf("Testing EnumDomainGroups\n");
+ torture_comment(tctx, "Testing EnumDomainGroups\n");
do {
status = dcerpc_samr_EnumDomainGroups(p, tctx, &r);
r.out.num_entries = &num_entries;
r.out.resume_handle = &resume_handle;
- printf("Testing EnumDomainAliases\n");
+ torture_comment(tctx, "Testing EnumDomainAliases\n");
do {
status = dcerpc_samr_EnumDomainAliases(p, tctx, &r);
return true;
}
+static bool test_QueryDisplayInfo_level(struct dcerpc_pipe *p,
+ struct torture_context *tctx,
+ struct policy_handle *handle,
+ uint16_t level,
+ uint32_t *total_num_entries_p)
+{
+ NTSTATUS status;
+ struct samr_QueryDisplayInfo r;
+ uint32_t total_num_entries = 0;
+
+ r.in.domain_handle = handle;
+ r.in.level = level;
+ r.in.start_idx = 0;
+ r.in.max_entries = (uint32_t)-1;
+ r.in.buf_size = (uint32_t)-1;
+
+ torture_comment(tctx, "Testing QueryDisplayInfo\n");
+
+ do {
+ uint32_t total_size;
+ uint32_t returned_size;
+ union samr_DispInfo info;
+
+ r.out.total_size = &total_size;
+ r.out.returned_size = &returned_size;
+ r.out.info = &info;
+
+ status = dcerpc_samr_QueryDisplayInfo(p, tctx, &r);
+ if (NT_STATUS_IS_ERR(status)) {
+ torture_assert_ntstatus_ok(tctx, status,
+ "failed to query displayinfo");
+ }
+
+ if (*r.out.returned_size == 0) {
+ break;
+ }
+
+ switch (r.in.level) {
+ case 1:
+ total_num_entries += info.info1.count;
+ r.in.start_idx += info.info1.entries[info.info1.count - 1].idx + 1;
+ break;
+ case 2:
+ total_num_entries += info.info2.count;
+ r.in.start_idx += info.info2.entries[info.info2.count - 1].idx + 1;
+ break;
+ case 3:
+ total_num_entries += info.info3.count;
+ r.in.start_idx += info.info3.entries[info.info3.count - 1].idx + 1;
+ break;
+ case 4:
+ total_num_entries += info.info4.count;
+ r.in.start_idx += info.info4.entries[info.info4.count - 1].idx + 1;
+ break;
+ case 5:
+ total_num_entries += info.info5.count;
+ r.in.start_idx += info.info5.entries[info.info5.count - 1].idx + 1;
+ break;
+ default:
+ return false;
+ }
+
+ } while (NT_STATUS_EQUAL(status, STATUS_MORE_ENTRIES));
+
+ if (total_num_entries_p) {
+ *total_num_entries_p = total_num_entries;
+ }
+
+ return true;
+}
+
static bool test_ManyObjects(struct dcerpc_pipe *p,
struct torture_context *tctx,
struct policy_handle *domain_handle,
struct dom_sid *domain_sid,
- enum torture_samr_choice which_ops)
+ struct torture_samr_context *ctx)
{
- uint32_t num_total = 1500;
+ uint32_t num_total = ctx->num_objects_large_dc;
uint32_t num_enum = 0;
uint32_t num_disp = 0;
uint32_t num_created = 0;
NTSTATUS status;
uint32_t i;
+ struct policy_handle *handles = talloc_zero_array(tctx, struct policy_handle, num_total);
+
/* query */
{
torture_assert_ntstatus_ok(tctx, status,
"failed to query domain info");
- switch (which_ops) {
+ switch (ctx->choice) {
case TORTURE_SAMR_MANY_ACCOUNTS:
num_anounced = info->general.num_users;
break;
for (i=0; i < num_total; i++) {
- struct policy_handle handle;
const char *name = NULL;
- ZERO_STRUCT(handle);
-
- switch (which_ops) {
+ switch (ctx->choice) {
case TORTURE_SAMR_MANY_ACCOUNTS:
name = talloc_asprintf(tctx, "%s%04d", TEST_ACCOUNT_NAME, i);
- ret &= test_CreateUser(p, tctx, domain_handle, name, &handle, domain_sid, 0, NULL, false);
+ ret &= test_CreateUser(p, tctx, domain_handle, name, &handles[i], domain_sid, 0, NULL, false);
break;
case TORTURE_SAMR_MANY_GROUPS:
name = talloc_asprintf(tctx, "%s%04d", TEST_GROUPNAME, i);
- ret &= test_CreateDomainGroup(p, tctx, domain_handle, name, &handle, domain_sid, false);
+ ret &= test_CreateDomainGroup(p, tctx, domain_handle, name, &handles[i], domain_sid, false);
break;
case TORTURE_SAMR_MANY_ALIASES:
name = talloc_asprintf(tctx, "%s%04d", TEST_ALIASNAME, i);
- ret &= test_CreateAlias(p, tctx, domain_handle, name, &handle, domain_sid, false);
+ ret &= test_CreateAlias(p, tctx, domain_handle, name, &handles[i], domain_sid, false);
break;
default:
return false;
}
- if (!policy_handle_empty(&handle)) {
- ret &= test_samr_handle_Close(p, tctx, &handle);
+ if (!policy_handle_empty(&handles[i])) {
num_created++;
}
}
/* enum */
- switch (which_ops) {
+ switch (ctx->choice) {
case TORTURE_SAMR_MANY_ACCOUNTS:
ret &= test_EnumDomainUsers(p, tctx, domain_handle, &num_enum);
break;
return false;
}
- torture_assert_int_equal(tctx, num_enum, num_anounced + num_created,
- "unexpected number of results returned in enum call");
-#if 0
- /* TODO: dispinfo */
+ /* dispinfo */
- switch (which_ops) {
+ switch (ctx->choice) {
case TORTURE_SAMR_MANY_ACCOUNTS:
+ ret &= test_QueryDisplayInfo_level(p, tctx, domain_handle, 1, &num_disp);
break;
case TORTURE_SAMR_MANY_GROUPS:
+ ret &= test_QueryDisplayInfo_level(p, tctx, domain_handle, 3, &num_disp);
break;
case TORTURE_SAMR_MANY_ALIASES:
+ /* no aliases in dispinfo */
break;
default:
return false;
}
- torture_assert_int_equal(tctx, num_disp, num_anounced + num_created,
- "unexpected number of results returned in dispinfo call");
-#endif
+ /* close or delete */
+
+ for (i=0; i < num_total; i++) {
+
+ if (policy_handle_empty(&handles[i])) {
+ continue;
+ }
+
+ if (torture_setting_bool(tctx, "samba3", false)) {
+ ret &= test_samr_handle_Close(p, tctx, &handles[i]);
+ } else {
+ switch (ctx->choice) {
+ case TORTURE_SAMR_MANY_ACCOUNTS:
+ ret &= test_DeleteUser(p, tctx, &handles[i]);
+ break;
+ case TORTURE_SAMR_MANY_GROUPS:
+ ret &= test_DeleteDomainGroup(p, tctx, &handles[i]);
+ break;
+ case TORTURE_SAMR_MANY_ALIASES:
+ ret &= test_DeleteAlias(p, tctx, &handles[i]);
+ break;
+ default:
+ return false;
+ }
+ }
+ }
+
+ talloc_free(handles);
+
+ if (ctx->choice == TORTURE_SAMR_MANY_ACCOUNTS && num_enum != num_anounced + num_created) {
+ torture_comment(tctx,
+ "unexpected number of results (%u) returned in enum call, expected %u\n",
+ num_enum, num_anounced + num_created);
+
+ torture_comment(tctx,
+ "unexpected number of results (%u) returned in dispinfo, call, expected %u\n",
+ num_disp, num_anounced + num_created);
+ }
return ret;
}
struct policy_handle *handle);
static bool test_OpenDomain(struct dcerpc_pipe *p, struct torture_context *tctx,
- struct policy_handle *handle, struct dom_sid *sid,
- enum torture_samr_choice which_ops,
- struct cli_credentials *machine_credentials)
+ struct torture_samr_context *ctx, struct dom_sid *sid)
{
NTSTATUS status;
struct samr_OpenDomain r;
torture_comment(tctx, "Testing OpenDomain of %s\n", dom_sid_string(tctx, sid));
- r.in.connect_handle = handle;
+ r.in.connect_handle = &ctx->handle;
r.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
r.in.sid = sid;
r.out.domain_handle = &domain_handle;
/* run the domain tests with the main handle closed - this tests
the servers reference counting */
- ret &= test_samr_handle_Close(p, tctx, handle);
+ torture_assert(tctx, test_samr_handle_Close(p, tctx, &ctx->handle), "Failed to close SAMR handle");
- switch (which_ops) {
- case TORTURE_SAMR_USER_ATTRIBUTES:
- case TORTURE_SAMR_USER_PRIVILEGES:
+ switch (ctx->choice) {
case TORTURE_SAMR_PASSWORDS:
+ case TORTURE_SAMR_USER_PRIVILEGES:
+ if (!torture_setting_bool(tctx, "samba3", false)) {
+ ret &= test_CreateUser2(p, tctx, &domain_handle, sid, ctx->choice, NULL);
+ }
+ ret &= test_CreateUser(p, tctx, &domain_handle, TEST_ACCOUNT_NAME, &user_handle, sid, ctx->choice, NULL, true);
+ if (!ret) {
+ torture_warning(tctx, "Testing PASSWORDS or PRIVILEGES on domain %s failed!\n", dom_sid_string(tctx, sid));
+ }
+ break;
+ case TORTURE_SAMR_USER_ATTRIBUTES:
if (!torture_setting_bool(tctx, "samba3", false)) {
- ret &= test_CreateUser2(p, tctx, &domain_handle, sid, which_ops, NULL);
+ ret &= test_CreateUser2(p, tctx, &domain_handle, sid, ctx->choice, NULL);
}
- ret &= test_CreateUser(p, tctx, &domain_handle, TEST_ACCOUNT_NAME, &user_handle, sid, which_ops, NULL, true);
+ ret &= test_CreateUser(p, tctx, &domain_handle, TEST_ACCOUNT_NAME, &user_handle, sid, ctx->choice, NULL, true);
/* This test needs 'complex' users to validate */
ret &= test_QueryDisplayInfo(p, tctx, &domain_handle);
if (!ret) {
- printf("Testing PASSWORDS or ATTRIBUTES on domain %s failed!\n", dom_sid_string(tctx, sid));
+ torture_warning(tctx, "Testing ATTRIBUTES on domain %s failed!\n", dom_sid_string(tctx, sid));
}
break;
case TORTURE_SAMR_PASSWORDS_PWDLASTSET:
+ case TORTURE_SAMR_PASSWORDS_BADPWDCOUNT:
+ case TORTURE_SAMR_PASSWORDS_LOCKOUT:
if (!torture_setting_bool(tctx, "samba3", false)) {
- ret &= test_CreateUser2(p, tctx, &domain_handle, sid, which_ops, machine_credentials);
+ ret &= test_CreateUser2(p, tctx, &domain_handle, sid, ctx->choice, ctx->machine_credentials);
}
- ret &= test_CreateUser(p, tctx, &domain_handle, TEST_ACCOUNT_NAME, &user_handle, sid, which_ops, machine_credentials, true);
+ ret &= test_CreateUser(p, tctx, &domain_handle, TEST_ACCOUNT_NAME, &user_handle, sid, ctx->choice, ctx->machine_credentials, true);
if (!ret) {
- printf("Testing PASSWORDS PWDLASTSET on domain %s failed!\n", dom_sid_string(tctx, sid));
+ torture_warning(tctx, "Testing PASSWORDS PWDLASTSET or BADPWDCOUNT on domain %s failed!\n", dom_sid_string(tctx, sid));
}
break;
case TORTURE_SAMR_MANY_ACCOUNTS:
case TORTURE_SAMR_MANY_GROUPS:
case TORTURE_SAMR_MANY_ALIASES:
- ret &= test_ManyObjects(p, tctx, &domain_handle, sid, which_ops);
+ ret &= test_ManyObjects(p, tctx, &domain_handle, sid, ctx);
+ if (!ret) {
+ torture_warning(tctx, "Testing MANY-{ACCOUNTS,GROUPS,ALIASES} on domain %s failed!\n", dom_sid_string(tctx, sid));
+ }
break;
case TORTURE_SAMR_OTHER:
- ret &= test_CreateUser(p, tctx, &domain_handle, TEST_ACCOUNT_NAME, &user_handle, sid, which_ops, NULL, true);
+ ret &= test_CreateUser(p, tctx, &domain_handle, TEST_ACCOUNT_NAME, &user_handle, sid, ctx->choice, NULL, true);
if (!ret) {
- printf("Failed to CreateUser in SAMR-OTHER on domain %s!\n", dom_sid_string(tctx, sid));
+ torture_warning(tctx, "Failed to CreateUser in SAMR-OTHER on domain %s!\n", dom_sid_string(tctx, sid));
}
if (!torture_setting_bool(tctx, "samba3", false)) {
ret &= test_QuerySecurity(p, tctx, &domain_handle);
ret &= test_RemoveMemberFromForeignDomain(p, tctx, &domain_handle);
ret &= test_CreateAlias(p, tctx, &domain_handle, TEST_ALIASNAME, &alias_handle, sid, true);
ret &= test_CreateDomainGroup(p, tctx, &domain_handle, TEST_GROUPNAME, &group_handle, sid, true);
+ ret &= test_GetAliasMembership(p, tctx, &domain_handle);
ret &= test_QueryDomainInfo(p, tctx, &domain_handle);
ret &= test_QueryDomainInfo2(p, tctx, &domain_handle);
ret &= test_EnumDomainUsers_all(p, tctx, &domain_handle);
ret = false;
}
- ret &= test_samr_handle_Close(p, tctx, &domain_handle);
+ torture_assert(tctx, test_samr_handle_Close(p, tctx, &domain_handle), "Failed to close SAMR domain handle");
+ torture_assert(tctx, test_Connect(p, tctx, &ctx->handle), "Faile to re-connect SAMR handle");
/* reconnect the main handle */
- ret &= test_Connect(p, tctx, handle);
if (!ret) {
- printf("Testing domain %s failed!\n", dom_sid_string(tctx, sid));
+ torture_warning(tctx, "Testing domain %s failed!\n", dom_sid_string(tctx, sid));
}
return ret;
}
static bool test_LookupDomain(struct dcerpc_pipe *p, struct torture_context *tctx,
- struct policy_handle *handle, const char *domain,
- enum torture_samr_choice which_ops,
- struct cli_credentials *machine_credentials)
+ struct torture_samr_context *ctx, const char *domain)
{
NTSTATUS status;
struct samr_LookupDomain r;
torture_comment(tctx, "Testing LookupDomain(%s)\n", domain);
/* check for correct error codes */
- r.in.connect_handle = handle;
+ r.in.connect_handle = &ctx->handle;
r.in.domain_name = &n2;
r.out.sid = &sid;
n2.string = NULL;
status = dcerpc_samr_LookupDomain(p, tctx, &r);
torture_assert_ntstatus_equal(tctx, NT_STATUS_NO_SUCH_DOMAIN, status, "LookupDomain expected NT_STATUS_NO_SUCH_DOMAIN");
- r.in.connect_handle = handle;
+ r.in.connect_handle = &ctx->handle;
init_lsa_String(&n1, domain);
r.in.domain_name = &n1;
ret = false;
}
- if (!test_OpenDomain(p, tctx, handle, *r.out.sid, which_ops,
- machine_credentials)) {
+ if (!test_OpenDomain(p, tctx, ctx, *r.out.sid)) {
ret = false;
}
static bool test_EnumDomains(struct dcerpc_pipe *p, struct torture_context *tctx,
- struct policy_handle *handle, enum torture_samr_choice which_ops,
- struct cli_credentials *machine_credentials)
+ struct torture_samr_context *ctx)
{
NTSTATUS status;
struct samr_EnumDomains r;
int i;
bool ret = true;
- r.in.connect_handle = handle;
+ r.in.connect_handle = &ctx->handle;
r.in.resume_handle = &resume_handle;
r.in.buf_size = (uint32_t)-1;
r.out.resume_handle = &resume_handle;
}
for (i=0;i<sam->count;i++) {
- if (!test_LookupDomain(p, tctx, handle,
- sam->entries[i].name.string, which_ops,
- machine_credentials)) {
+ if (!test_LookupDomain(p, tctx, ctx,
+ sam->entries[i].name.string)) {
ret = false;
}
}
status = dcerpc_samr_Connect3(p, tctx, &r3);
if (!NT_STATUS_IS_OK(status)) {
- printf("Connect3 failed - %s\n", nt_errstr(status));
+ torture_warning(tctx, "Connect3 failed - %s\n", nt_errstr(status));
ret = false;
} else {
if (got_handle) {
status = dcerpc_samr_Connect4(p, tctx, &r4);
if (!NT_STATUS_IS_OK(status)) {
- printf("Connect4 failed - %s\n", nt_errstr(status));
+ torture_warning(tctx, "Connect4 failed - %s\n", nt_errstr(status));
ret = false;
} else {
if (got_handle) {
status = dcerpc_samr_Connect5(p, tctx, &r5);
if (!NT_STATUS_IS_OK(status)) {
- printf("Connect5 failed - %s\n", nt_errstr(status));
+ torture_warning(tctx, "Connect5 failed - %s\n", nt_errstr(status));
ret = false;
} else {
if (got_handle) {
}
+static bool test_samr_ValidatePassword(struct dcerpc_pipe *p, struct torture_context *tctx)
+{
+ struct samr_ValidatePassword r;
+ union samr_ValidatePasswordReq req;
+ union samr_ValidatePasswordRep *repp = NULL;
+ NTSTATUS status;
+ const char *passwords[] = { "penguin", "p@ssw0rd", "p@ssw0rd123$", NULL };
+ int i;
+
+ torture_comment(tctx, "testing samr_ValidatePassword\n");
+
+ ZERO_STRUCT(r);
+ r.in.level = NetValidatePasswordReset;
+ r.in.req = &req;
+ r.out.rep = &repp;
+
+ ZERO_STRUCT(req);
+ req.req3.account.string = "non-existant-account-aklsdji";
+
+ for (i=0; passwords[i]; i++) {
+ req.req3.password.string = passwords[i];
+ status = dcerpc_samr_ValidatePassword(p, tctx, &r);
+ if (NT_STATUS_EQUAL(status, NT_STATUS_NET_WRITE_FAULT) &&
+ p->last_fault_code == DCERPC_FAULT_OP_RNG_ERROR) {
+ torture_skip(tctx, "ValidatePassword not supported by server\n");
+ }
+ torture_assert_ntstatus_ok(tctx, status, "samr_ValidatePassword");
+ torture_comment(tctx, "Server %s password '%s' with code %i\n",
+ repp->ctr3.status==SAMR_VALIDATION_STATUS_SUCCESS?"allowed":"refused",
+ req.req3.password.string, repp->ctr3.status);
+ }
+
+ return true;
+}
+
bool torture_rpc_samr(struct torture_context *torture)
{
NTSTATUS status;
struct dcerpc_pipe *p;
bool ret = true;
- struct policy_handle handle;
+ struct torture_samr_context *ctx;
status = torture_rpc_connection(torture, &p, &ndr_table_samr);
if (!NT_STATUS_IS_OK(status)) {
return false;
}
- ret &= test_Connect(p, torture, &handle);
+ ctx = talloc_zero(torture, struct torture_samr_context);
+
+ ctx->choice = TORTURE_SAMR_OTHER;
+
+ ret &= test_Connect(p, torture, &ctx->handle);
if (!torture_setting_bool(torture, "samba3", false)) {
- ret &= test_QuerySecurity(p, torture, &handle);
+ ret &= test_QuerySecurity(p, torture, &ctx->handle);
}
- ret &= test_EnumDomains(p, torture, &handle, TORTURE_SAMR_OTHER, NULL);
+ ret &= test_EnumDomains(p, torture, ctx);
- ret &= test_SetDsrmPassword(p, torture, &handle);
+ ret &= test_SetDsrmPassword(p, torture, &ctx->handle);
- ret &= test_Shutdown(p, torture, &handle);
+ ret &= test_Shutdown(p, torture, &ctx->handle);
- ret &= test_samr_handle_Close(p, torture, &handle);
+ ret &= test_samr_handle_Close(p, torture, &ctx->handle);
return ret;
}
NTSTATUS status;
struct dcerpc_pipe *p;
bool ret = true;
- struct policy_handle handle;
+ struct torture_samr_context *ctx;
status = torture_rpc_connection(torture, &p, &ndr_table_samr);
if (!NT_STATUS_IS_OK(status)) {
return false;
}
- ret &= test_Connect(p, torture, &handle);
+ ctx = talloc_zero(torture, struct torture_samr_context);
+
+ ctx->choice = TORTURE_SAMR_USER_ATTRIBUTES;
+
+ ret &= test_Connect(p, torture, &ctx->handle);
if (!torture_setting_bool(torture, "samba3", false)) {
- ret &= test_QuerySecurity(p, torture, &handle);
+ ret &= test_QuerySecurity(p, torture, &ctx->handle);
}
- ret &= test_EnumDomains(p, torture, &handle, TORTURE_SAMR_USER_ATTRIBUTES, NULL);
+ ret &= test_EnumDomains(p, torture, ctx);
- ret &= test_SetDsrmPassword(p, torture, &handle);
+ ret &= test_SetDsrmPassword(p, torture, &ctx->handle);
- ret &= test_Shutdown(p, torture, &handle);
+ ret &= test_Shutdown(p, torture, &ctx->handle);
- ret &= test_samr_handle_Close(p, torture, &handle);
+ ret &= test_samr_handle_Close(p, torture, &ctx->handle);
return ret;
}
NTSTATUS status;
struct dcerpc_pipe *p;
bool ret = true;
- struct policy_handle handle;
+ struct torture_samr_context *ctx;
status = torture_rpc_connection(torture, &p, &ndr_table_samr);
if (!NT_STATUS_IS_OK(status)) {
return false;
}
- ret &= test_Connect(p, torture, &handle);
+ ctx = talloc_zero(torture, struct torture_samr_context);
+
+ ctx->choice = TORTURE_SAMR_PASSWORDS;
- ret &= test_EnumDomains(p, torture, &handle, TORTURE_SAMR_PASSWORDS, NULL);
+ ret &= test_Connect(p, torture, &ctx->handle);
- ret &= test_samr_handle_Close(p, torture, &handle);
+ ret &= test_EnumDomains(p, torture, ctx);
+
+ ret &= test_samr_handle_Close(p, torture, &ctx->handle);
+
+ ret &= test_samr_ValidatePassword(p, torture);
return ret;
}
NTSTATUS status;
struct dcerpc_pipe *p;
bool ret = true;
- struct policy_handle handle;
+ struct torture_samr_context *ctx;
status = torture_rpc_connection(torture, &p, &ndr_table_samr);
if (!NT_STATUS_IS_OK(status)) {
return false;
}
- ret &= test_Connect(p, torture, &handle);
+ ctx = talloc_zero(torture, struct torture_samr_context);
+
+ ctx->choice = TORTURE_SAMR_PASSWORDS_PWDLASTSET;
+ ctx->machine_credentials = machine_credentials;
- ret &= test_EnumDomains(p, torture, &handle,
- TORTURE_SAMR_PASSWORDS_PWDLASTSET,
- machine_credentials);
+ ret &= test_Connect(p, torture, &ctx->handle);
- ret &= test_samr_handle_Close(p, torture, &handle);
+ ret &= test_EnumDomains(p, torture, ctx);
+
+ ret &= test_samr_handle_Close(p, torture, &ctx->handle);
return ret;
}
struct torture_suite *suite = torture_suite_create(mem_ctx, "SAMR-PASSWORDS-PWDLASTSET");
struct torture_rpc_tcase *tcase;
- tcase = torture_suite_add_machine_rpc_iface_tcase(suite, "samr",
+ tcase = torture_suite_add_machine_bdc_rpc_iface_tcase(suite, "samr",
&ndr_table_samr,
TEST_ACCOUNT_NAME_PWD);
NTSTATUS status;
struct dcerpc_pipe *p;
bool ret = true;
- struct policy_handle handle;
+ struct torture_samr_context *ctx;
status = torture_rpc_connection(torture, &p, &ndr_table_samr);
if (!NT_STATUS_IS_OK(status)) {
return false;
}
- ret &= test_Connect(p, torture, &handle);
+ ctx = talloc_zero(torture, struct torture_samr_context);
+
+ ctx->choice = TORTURE_SAMR_USER_PRIVILEGES;
+ ctx->machine_credentials = machine_credentials;
+
+ ret &= test_Connect(p, torture, &ctx->handle);
- ret &= test_EnumDomains(p, torture, &handle,
- TORTURE_SAMR_USER_PRIVILEGES,
- machine_credentials);
+ ret &= test_EnumDomains(p, torture, ctx);
- ret &= test_samr_handle_Close(p, torture, &handle);
+ ret &= test_samr_handle_Close(p, torture, &ctx->handle);
return ret;
}
struct torture_suite *suite = torture_suite_create(mem_ctx, "SAMR-USERS-PRIVILEGES");
struct torture_rpc_tcase *tcase;
- tcase = torture_suite_add_machine_rpc_iface_tcase(suite, "samr",
+ tcase = torture_suite_add_machine_bdc_rpc_iface_tcase(suite, "samr",
&ndr_table_samr,
TEST_ACCOUNT_NAME_PWD);
static bool torture_rpc_samr_many_accounts(struct torture_context *torture,
struct dcerpc_pipe *p2,
- struct cli_credentials *machine_credentials)
+ void *data)
{
NTSTATUS status;
struct dcerpc_pipe *p;
bool ret = true;
- struct policy_handle handle;
+ struct torture_samr_context *ctx =
+ talloc_get_type_abort(data, struct torture_samr_context);
status = torture_rpc_connection(torture, &p, &ndr_table_samr);
if (!NT_STATUS_IS_OK(status)) {
return false;
}
- ret &= test_Connect(p, torture, &handle);
+ ctx->choice = TORTURE_SAMR_MANY_ACCOUNTS;
+ ctx->num_objects_large_dc = torture_setting_int(torture, "large_dc",
+ ctx->num_objects_large_dc);
- ret &= test_EnumDomains(p, torture, &handle,
- TORTURE_SAMR_MANY_ACCOUNTS,
- machine_credentials);
+ ret &= test_Connect(p, torture, &ctx->handle);
- ret &= test_samr_handle_Close(p, torture, &handle);
+ ret &= test_EnumDomains(p, torture, ctx);
+
+ ret &= test_samr_handle_Close(p, torture, &ctx->handle);
return ret;
}
static bool torture_rpc_samr_many_groups(struct torture_context *torture,
struct dcerpc_pipe *p2,
- struct cli_credentials *machine_credentials)
+ void *data)
{
NTSTATUS status;
struct dcerpc_pipe *p;
bool ret = true;
- struct policy_handle handle;
+ struct torture_samr_context *ctx =
+ talloc_get_type_abort(data, struct torture_samr_context);
status = torture_rpc_connection(torture, &p, &ndr_table_samr);
if (!NT_STATUS_IS_OK(status)) {
return false;
}
- ret &= test_Connect(p, torture, &handle);
+ ctx->choice = TORTURE_SAMR_MANY_GROUPS;
+ ctx->num_objects_large_dc = torture_setting_int(torture, "large_dc",
+ ctx->num_objects_large_dc);
+
+ ret &= test_Connect(p, torture, &ctx->handle);
- ret &= test_EnumDomains(p, torture, &handle,
- TORTURE_SAMR_MANY_GROUPS,
- machine_credentials);
+ ret &= test_EnumDomains(p, torture, ctx);
- ret &= test_samr_handle_Close(p, torture, &handle);
+ ret &= test_samr_handle_Close(p, torture, &ctx->handle);
return ret;
}
static bool torture_rpc_samr_many_aliases(struct torture_context *torture,
struct dcerpc_pipe *p2,
- struct cli_credentials *machine_credentials)
+ void *data)
{
NTSTATUS status;
struct dcerpc_pipe *p;
bool ret = true;
- struct policy_handle handle;
+ struct torture_samr_context *ctx =
+ talloc_get_type_abort(data, struct torture_samr_context);
status = torture_rpc_connection(torture, &p, &ndr_table_samr);
if (!NT_STATUS_IS_OK(status)) {
return false;
}
- ret &= test_Connect(p, torture, &handle);
+ ctx->choice = TORTURE_SAMR_MANY_ALIASES;
+ ctx->num_objects_large_dc = torture_setting_int(torture, "large_dc",
+ ctx->num_objects_large_dc);
+
+ ret &= test_Connect(p, torture, &ctx->handle);
- ret &= test_EnumDomains(p, torture, &handle,
- TORTURE_SAMR_MANY_ALIASES,
- machine_credentials);
+ ret &= test_EnumDomains(p, torture, ctx);
- ret &= test_samr_handle_Close(p, torture, &handle);
+ ret &= test_samr_handle_Close(p, torture, &ctx->handle);
return ret;
}
{
struct torture_suite *suite = torture_suite_create(mem_ctx, "SAMR-LARGE-DC");
struct torture_rpc_tcase *tcase;
+ struct torture_samr_context *ctx;
+
+ tcase = torture_suite_add_rpc_iface_tcase(suite, "samr", &ndr_table_samr);
+
+ ctx = talloc_zero(suite, struct torture_samr_context);
+ ctx->num_objects_large_dc = 150;
+
+ torture_rpc_tcase_add_test_ex(tcase, "many_aliases",
+ torture_rpc_samr_many_aliases, ctx);
+ torture_rpc_tcase_add_test_ex(tcase, "many_groups",
+ torture_rpc_samr_many_groups, ctx);
+ torture_rpc_tcase_add_test_ex(tcase, "many_accounts",
+ torture_rpc_samr_many_accounts, ctx);
+
+ return suite;
+}
+
+static bool torture_rpc_samr_badpwdcount(struct torture_context *torture,
+ struct dcerpc_pipe *p2,
+ struct cli_credentials *machine_credentials)
+{
+ NTSTATUS status;
+ struct dcerpc_pipe *p;
+ bool ret = true;
+ struct torture_samr_context *ctx;
+
+ status = torture_rpc_connection(torture, &p, &ndr_table_samr);
+ if (!NT_STATUS_IS_OK(status)) {
+ return false;
+ }
+
+ ctx = talloc_zero(torture, struct torture_samr_context);
+
+ ctx->choice = TORTURE_SAMR_PASSWORDS_BADPWDCOUNT;
+ ctx->machine_credentials = machine_credentials;
+
+ ret &= test_Connect(p, torture, &ctx->handle);
+
+ ret &= test_EnumDomains(p, torture, ctx);
+
+ ret &= test_samr_handle_Close(p, torture, &ctx->handle);
+
+ return ret;
+}
+
+struct torture_suite *torture_rpc_samr_passwords_badpwdcount(TALLOC_CTX *mem_ctx)
+{
+ struct torture_suite *suite = torture_suite_create(mem_ctx, "SAMR-PASSWORDS-BADPWDCOUNT");
+ struct torture_rpc_tcase *tcase;
+
+ tcase = torture_suite_add_machine_bdc_rpc_iface_tcase(suite, "samr",
+ &ndr_table_samr,
+ TEST_ACCOUNT_NAME_PWD);
+
+ torture_rpc_tcase_add_test_creds(tcase, "badPwdCount",
+ torture_rpc_samr_badpwdcount);
+
+ return suite;
+}
+
+static bool torture_rpc_samr_lockout(struct torture_context *torture,
+ struct dcerpc_pipe *p2,
+ struct cli_credentials *machine_credentials)
+{
+ NTSTATUS status;
+ struct dcerpc_pipe *p;
+ bool ret = true;
+ struct torture_samr_context *ctx;
+
+ status = torture_rpc_connection(torture, &p, &ndr_table_samr);
+ if (!NT_STATUS_IS_OK(status)) {
+ return false;
+ }
+
+ ctx = talloc_zero(torture, struct torture_samr_context);
+
+ ctx->choice = TORTURE_SAMR_PASSWORDS_LOCKOUT;
+ ctx->machine_credentials = machine_credentials;
+
+ ret &= test_Connect(p, torture, &ctx->handle);
+
+ ret &= test_EnumDomains(p, torture, ctx);
+
+ ret &= test_samr_handle_Close(p, torture, &ctx->handle);
+
+ return ret;
+}
+
+struct torture_suite *torture_rpc_samr_passwords_lockout(TALLOC_CTX *mem_ctx)
+{
+ struct torture_suite *suite = torture_suite_create(mem_ctx, "SAMR-PASSWORDS-LOCKOUT");
+ struct torture_rpc_tcase *tcase;
- tcase = torture_suite_add_machine_rpc_iface_tcase(suite, "samr",
+ tcase = torture_suite_add_machine_bdc_rpc_iface_tcase(suite, "samr",
&ndr_table_samr,
- TEST_ACCOUNT_NAME);
+ TEST_ACCOUNT_NAME_PWD);
- torture_rpc_tcase_add_test_creds(tcase, "many_aliases",
- torture_rpc_samr_many_aliases);
- torture_rpc_tcase_add_test_creds(tcase, "many_groups",
- torture_rpc_samr_many_groups);
- torture_rpc_tcase_add_test_creds(tcase, "many_accounts",
- torture_rpc_samr_many_accounts);
+ torture_rpc_tcase_add_test_creds(tcase, "lockout",
+ torture_rpc_samr_lockout);
return suite;
}
+
+
git.samba.org / ira / wip.git / blobdiff