source4/torture/rpc/lsa.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3    test suite for lsa rpc operations
   4
   5    Copyright (C) Andrew Tridgell 2003
   6    Copyright (C) Andrew Bartlett <abartlet@samba.org> 2004-2005
   7
   8    This program is free software; you can redistribute it and/or modify
   9    it under the terms of the GNU General Public License as published by
  10    the Free Software Foundation; either version 3 of the License, or
  11    (at your option) any later version.
  12
  13    This program is distributed in the hope that it will be useful,
  14    but WITHOUT ANY WARRANTY; without even the implied warranty of
  15    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  16    GNU General Public License for more details.
  17
  18    You should have received a copy of the GNU General Public License
  19    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  20 */
  21
  22 #include "includes.h"
  23 #include "torture/torture.h"
  24 #include "librpc/gen_ndr/ndr_lsa_c.h"
  25 #include "librpc/gen_ndr/netlogon.h"
  26 #include "librpc/gen_ndr/ndr_drsblobs.h"
  27 #include "librpc/gen_ndr/ndr_netlogon_c.h"
  28 #include "lib/events/events.h"
  29 #include "libcli/security/security.h"
  30 #include "libcli/auth/libcli_auth.h"
  31 #include "torture/rpc/torture_rpc.h"
  32 #include "param/param.h"
  33 #include "../lib/crypto/crypto.h"
  34 #define TEST_MACHINENAME "lsatestmach"
  35 #define TRUSTPW "12345678"
  36
  37 static void init_lsa_String(struct lsa_String *name, const char *s)
  38 {
  39         name->string = s;
  40 }
  41
  42 static bool test_OpenPolicy(struct dcerpc_binding_handle *b,
  43                             struct torture_context *tctx)
  44 {
  45         struct lsa_ObjectAttribute attr;
  46         struct policy_handle handle;
  47         struct lsa_QosInfo qos;
  48         struct lsa_OpenPolicy r;
  49         uint16_t system_name = '\\';
  50
  51         torture_comment(tctx, "\nTesting OpenPolicy\n");
  52
  53         qos.len = 0;
  54         qos.impersonation_level = 2;
  55         qos.context_mode = 1;
  56         qos.effective_only = 0;
  57
  58         attr.len = 0;
  59         attr.root_dir = NULL;
  60         attr.object_name = NULL;
  61         attr.attributes = 0;
  62         attr.sec_desc = NULL;
  63         attr.sec_qos = &qos;
  64
  65         r.in.system_name = &system_name;
  66         r.in.attr = &attr;
  67         r.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
  68         r.out.handle = &handle;
  69
  70         torture_assert_ntstatus_ok(tctx, dcerpc_lsa_OpenPolicy_r(b, tctx, &r),
  71                                    "OpenPolicy failed");
  72
  73         torture_assert_ntstatus_ok(tctx,
  74                                    r.out.result,
  75                                    "OpenPolicy failed");
  76
  77         return true;
  78 }
  79
  80 static bool test_OpenPolicy_fail(struct dcerpc_binding_handle *b,
  81                                  struct torture_context *tctx)
  82 {
  83         struct lsa_ObjectAttribute attr;
  84         struct policy_handle handle;
  85         struct lsa_QosInfo qos;
  86         struct lsa_OpenPolicy r;
  87         uint16_t system_name = '\\';
  88         NTSTATUS status;
  89
  90         torture_comment(tctx, "\nTesting OpenPolicy_fail\n");
  91
  92         qos.len = 0;
  93         qos.impersonation_level = 2;
  94         qos.context_mode = 1;
  95         qos.effective_only = 0;
  96
  97         attr.len = 0;
  98         attr.root_dir = NULL;
  99         attr.object_name = NULL;
 100         attr.attributes = 0;
 101         attr.sec_desc = NULL;
 102         attr.sec_qos = &qos;
 103
 104         r.in.system_name = &system_name;
 105         r.in.attr = &attr;
 106         r.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
 107         r.out.handle = &handle;
 108
 109         status = dcerpc_lsa_OpenPolicy_r(b, tctx, &r);
 110         if (!NT_STATUS_IS_OK(status)) {
 111                 if (NT_STATUS_EQUAL(status, NT_STATUS_ACCESS_DENIED)) {
 112                         torture_comment(tctx,
 113                                         "OpenPolicy correctly returned with "
 114                                         "status: %s\n",
 115                                         nt_errstr(status));
 116                         return true;
 117                 }
 118
 119                 torture_assert_ntstatus_equal(tctx,
 120                                               status,
 121                                               NT_STATUS_ACCESS_DENIED,
 122                                               "OpenPolicy return value should "
 123                                               "be ACCESS_DENIED");
 124                 return true;
 125         }
 126
 127         if (!NT_STATUS_IS_OK(r.out.result)) {
 128                 if (NT_STATUS_EQUAL(r.out.result, NT_STATUS_ACCESS_DENIED) ||
 129                     NT_STATUS_EQUAL(r.out.result, NT_STATUS_RPC_PROTSEQ_NOT_SUPPORTED)) {
 130                         torture_comment(tctx,
 131                                         "OpenPolicy correctly returned with "
 132                                         "result: %s\n",
 133                                         nt_errstr(r.out.result));
 134                         return true;
 135                 }
 136         }
 137
 138         torture_assert_ntstatus_equal(tctx,
 139                                       r.out.result,
 140                                       NT_STATUS_OK,
 141                                       "OpenPolicy return value should be "
 142                                       "ACCESS_DENIED");
 143
 144         return false;
 145 }
 146
 147
 148 bool test_lsa_OpenPolicy2_ex(struct dcerpc_binding_handle *b,
 149                              struct torture_context *tctx,
 150                              struct policy_handle **handle,
 151                              NTSTATUS expected_status)
 152 {
 153         struct lsa_ObjectAttribute attr;
 154         struct lsa_QosInfo qos;
 155         struct lsa_OpenPolicy2 r;
 156         NTSTATUS status;
 157
 158         torture_comment(tctx, "\nTesting OpenPolicy2\n");
 159
 160         *handle = talloc(tctx, struct policy_handle);
 161         if (!*handle) {
 162                 return false;
 163         }
 164
 165         qos.len = 0;
 166         qos.impersonation_level = 2;
 167         qos.context_mode = 1;
 168         qos.effective_only = 0;
 169
 170         attr.len = 0;
 171         attr.root_dir = NULL;
 172         attr.object_name = NULL;
 173         attr.attributes = 0;
 174         attr.sec_desc = NULL;
 175         attr.sec_qos = &qos;
 176
 177         r.in.system_name = "\\";
 178         r.in.attr = &attr;
 179         r.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
 180         r.out.handle = *handle;
 181
 182         status = dcerpc_lsa_OpenPolicy2_r(b, tctx, &r);
 183         torture_assert_ntstatus_equal(tctx, status, expected_status,
 184                                    "OpenPolicy2 failed");
 185         if (!NT_STATUS_IS_OK(expected_status)) {
 186                 return true;
 187         }
 188
 189         torture_assert_ntstatus_ok(tctx,
 190                                    r.out.result,
 191                                    "OpenPolicy2 failed");
 192
 193         return true;
 194 }
 195
 196
 197 bool test_lsa_OpenPolicy2(struct dcerpc_binding_handle *b,
 198                           struct torture_context *tctx,
 199                           struct policy_handle **handle)
 200 {
 201         return test_lsa_OpenPolicy2_ex(b, tctx, handle, NT_STATUS_OK);
 202 }
 203
 204 static bool test_OpenPolicy2_fail(struct dcerpc_binding_handle *b,
 205                                   struct torture_context *tctx)
 206 {
 207         struct lsa_ObjectAttribute attr;
 208         struct policy_handle handle;
 209         struct lsa_QosInfo qos;
 210         struct lsa_OpenPolicy2 r;
 211         NTSTATUS status;
 212
 213         torture_comment(tctx, "\nTesting OpenPolicy2_fail\n");
 214
 215         qos.len = 0;
 216         qos.impersonation_level = 2;
 217         qos.context_mode = 1;
 218         qos.effective_only = 0;
 219
 220         attr.len = 0;
 221         attr.root_dir = NULL;
 222         attr.object_name = NULL;
 223         attr.attributes = 0;
 224         attr.sec_desc = NULL;
 225         attr.sec_qos = &qos;
 226
 227         r.in.system_name = "\\";
 228         r.in.attr = &attr;
 229         r.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
 230         r.out.handle = &handle;
 231
 232         status = dcerpc_lsa_OpenPolicy2_r(b, tctx, &r);
 233         if (!NT_STATUS_IS_OK(status)) {
 234                 if (NT_STATUS_EQUAL(status, NT_STATUS_ACCESS_DENIED)) {
 235                         torture_comment(tctx,
 236                                         "OpenPolicy2 correctly returned with "
 237                                         "status: %s\n",
 238                                         nt_errstr(status));
 239                         return true;
 240                 }
 241
 242                 torture_assert_ntstatus_equal(tctx,
 243                                               status,
 244                                               NT_STATUS_ACCESS_DENIED,
 245                                               "OpenPolicy2 return value should "
 246                                               "be ACCESS_DENIED");
 247                 return true;
 248         }
 249
 250         if (!NT_STATUS_IS_OK(r.out.result)) {
 251                 if (NT_STATUS_EQUAL(r.out.result, NT_STATUS_ACCESS_DENIED) ||
 252                     NT_STATUS_EQUAL(r.out.result, NT_STATUS_RPC_PROTSEQ_NOT_SUPPORTED)) {
 253                         torture_comment(tctx,
 254                                         "OpenPolicy2 correctly returned with "
 255                                         "result: %s\n",
 256                                         nt_errstr(r.out.result));
 257                         return true;
 258                 }
 259         }
 260
 261         torture_assert_ntstatus_equal(tctx,
 262                                       r.out.result,
 263                                       NT_STATUS_OK,
 264                                       "OpenPolicy2 return value should be "
 265                                       "ACCESS_DENIED");
 266
 267         return false;
 268 }
 269
 270 static bool test_LookupNames(struct dcerpc_binding_handle *b,
 271                              struct torture_context *tctx,
 272                              struct policy_handle *handle,
 273                              struct lsa_TransNameArray *tnames)
 274 {
 275         struct lsa_LookupNames r;
 276         struct lsa_TransSidArray sids;
 277         struct lsa_RefDomainList *domains = NULL;
 278         struct lsa_String *names;
 279         uint32_t count = 0;
 280         int i;
 281         uint32_t *input_idx;
 282
 283         torture_comment(tctx, "\nTesting LookupNames with %d names\n", tnames->count);
 284
 285         sids.count = 0;
 286         sids.sids = NULL;
 287
 288
 289         r.in.num_names = 0;
 290
 291         input_idx = talloc_array(tctx, uint32_t, tnames->count);
 292         names = talloc_array(tctx, struct lsa_String, tnames->count);
 293
 294         for (i=0;i<tnames->count;i++) {
 295                 if (tnames->names[i].sid_type != SID_NAME_UNKNOWN) {
 296                         init_lsa_String(&names[r.in.num_names], tnames->names[i].name.string);
 297                         input_idx[r.in.num_names] = i;
 298                         r.in.num_names++;
 299                 }
 300         }
 301
 302         r.in.handle = handle;
 303         r.in.names = names;
 304         r.in.sids = &sids;
 305         r.in.level = 1;
 306         r.in.count = &count;
 307         r.out.count = &count;
 308         r.out.sids = &sids;
 309         r.out.domains = &domains;
 310
 311         torture_assert_ntstatus_ok(tctx, dcerpc_lsa_LookupNames_r(b, tctx, &r),
 312                                    "LookupNames failed");
 313         if (NT_STATUS_EQUAL(r.out.result, STATUS_SOME_UNMAPPED) ||
 314             NT_STATUS_EQUAL(r.out.result, NT_STATUS_NONE_MAPPED)) {
 315                 for (i=0;i< r.in.num_names;i++) {
 316                         if (i < count && sids.sids[i].sid_type == SID_NAME_UNKNOWN) {
 317                                 torture_comment(tctx, "LookupName of %s was unmapped\n",
 318                                        tnames->names[i].name.string);
 319                         } else if (i >=count) {
 320                                 torture_comment(tctx, "LookupName of %s failed to return a result\n",
 321                                        tnames->names[i].name.string);
 322                         }
 323                 }
 324                 torture_comment(tctx, "LookupNames failed - %s\n",
 325                                 nt_errstr(r.out.result));
 326                 return false;
 327         } else if (!NT_STATUS_IS_OK(r.out.result)) {
 328                 torture_comment(tctx, "LookupNames failed - %s\n",
 329                                 nt_errstr(r.out.result));
 330                 return false;
 331         }
 332
 333         for (i=0;i< r.in.num_names;i++) {
 334                 if (i < count) {
 335                         if (sids.sids[i].sid_type != tnames->names[input_idx[i]].sid_type) {
 336                                 torture_comment(tctx, "LookupName of %s got unexpected name type: %s\n",
 337                                                 tnames->names[input_idx[i]].name.string,
 338                                                 sid_type_lookup(sids.sids[i].sid_type));
 339                                 return false;
 340                         }
 341                         if ((sids.sids[i].sid_type == SID_NAME_DOMAIN) &&
 342                             (sids.sids[i].rid != (uint32_t)-1)) {
 343                                 torture_comment(tctx, "LookupName of %s got unexpected rid: %d\n",
 344                                         tnames->names[input_idx[i]].name.string, sids.sids[i].rid);
 345                                 return false;
 346                         }
 347                 } else if (i >=count) {
 348                         torture_comment(tctx, "LookupName of %s failed to return a result\n",
 349                                tnames->names[input_idx[i]].name.string);
 350                         return false;
 351                 }
 352         }
 353         torture_comment(tctx, "\n");
 354
 355         return true;
 356 }
 357
 358 static bool test_LookupNames_bogus(struct dcerpc_binding_handle *b,
 359                                    struct torture_context *tctx,
 360                                    struct policy_handle *handle)
 361 {
 362         struct lsa_LookupNames r;
 363         struct lsa_TransSidArray sids;
 364         struct lsa_RefDomainList *domains = NULL;
 365         struct lsa_String names[1];
 366         uint32_t count = 0;
 367
 368         torture_comment(tctx, "\nTesting LookupNames with bogus name\n");
 369
 370         sids.count = 0;
 371         sids.sids = NULL;
 372
 373         init_lsa_String(&names[0], "NT AUTHORITY\\BOGUS");
 374
 375         r.in.handle = handle;
 376         r.in.num_names = 1;
 377         r.in.names = names;
 378         r.in.sids = &sids;
 379         r.in.level = 1;
 380         r.in.count = &count;
 381         r.out.count = &count;
 382         r.out.sids = &sids;
 383         r.out.domains = &domains;
 384
 385         torture_assert_ntstatus_ok(tctx, dcerpc_lsa_LookupNames_r(b, tctx, &r),
 386                                    "LookupNames bogus failed");
 387         if (!NT_STATUS_EQUAL(r.out.result, NT_STATUS_NONE_MAPPED)) {
 388                 torture_comment(tctx, "LookupNames failed - %s\n",
 389                                 nt_errstr(r.out.result));
 390                 return false;
 391         }
 392
 393         torture_comment(tctx, "\n");
 394
 395         return true;
 396 }
 397
 398 static bool test_LookupNames_NULL(struct dcerpc_binding_handle *b,
 399                                   struct torture_context *tctx,
 400                                   struct policy_handle *handle)
 401 {
 402         struct lsa_LookupNames r;
 403         struct lsa_TransSidArray sids;
 404         struct lsa_RefDomainList *domains = NULL;
 405         struct lsa_String names[1];
 406         uint32_t count = 0;
 407
 408         torture_comment(tctx, "\nTesting LookupNames with NULL name\n");
 409
 410         sids.count = 0;
 411         sids.sids = NULL;
 412
 413         names[0].string = NULL;
 414
 415         r.in.handle = handle;
 416         r.in.num_names = 1;
 417         r.in.names = names;
 418         r.in.sids = &sids;
 419         r.in.level = 1;
 420         r.in.count = &count;
 421         r.out.count = &count;
 422         r.out.sids = &sids;
 423         r.out.domains = &domains;
 424
 425         /* nt4 returns NT_STATUS_NONE_MAPPED with sid_type
 426          * SID_NAME_UNKNOWN, rid 0, and sid_index -1;
 427          *
 428          * w2k3/w2k8 return NT_STATUS_OK with sid_type
 429          * SID_NAME_DOMAIN, rid -1 and sid_index 0 and BUILTIN domain
 430          */
 431
 432         torture_assert_ntstatus_ok(tctx, dcerpc_lsa_LookupNames_r(b, tctx, &r),
 433                 "LookupNames with NULL name failed");
 434         torture_assert_ntstatus_ok(tctx, r.out.result,
 435                 "LookupNames with NULL name failed");
 436
 437         torture_comment(tctx, "\n");
 438
 439         return true;
 440 }
 441
 442 static bool test_LookupNames_wellknown(struct dcerpc_binding_handle *b,
 443                                        struct torture_context *tctx,
 444                                        struct policy_handle *handle)
 445 {
 446         struct lsa_TranslatedName name;
 447         struct lsa_TransNameArray tnames;
 448         bool ret = true;
 449
 450         torture_comment(tctx, "Testing LookupNames with well known names\n");
 451
 452         tnames.names = &name;
 453         tnames.count = 1;
 454         name.name.string = "NT AUTHORITY\\SYSTEM";
 455         name.sid_type = SID_NAME_WKN_GRP;
 456         ret &= test_LookupNames(b, tctx, handle, &tnames);
 457
 458         name.name.string = "NT AUTHORITY\\ANONYMOUS LOGON";
 459         name.sid_type = SID_NAME_WKN_GRP;
 460         ret &= test_LookupNames(b, tctx, handle, &tnames);
 461
 462         name.name.string = "NT AUTHORITY\\Authenticated Users";
 463         name.sid_type = SID_NAME_WKN_GRP;
 464         ret &= test_LookupNames(b, tctx, handle, &tnames);
 465
 466 #if 0
 467         name.name.string = "NT AUTHORITY";
 468         ret &= test_LookupNames(b, tctx, handle, &tnames);
 469
 470         name.name.string = "NT AUTHORITY\\";
 471         ret &= test_LookupNames(b, tctx, handle, &tnames);
 472 #endif
 473
 474         name.name.string = "BUILTIN\\";
 475         name.sid_type = SID_NAME_DOMAIN;
 476         ret &= test_LookupNames(b, tctx, handle, &tnames);
 477
 478         name.name.string = "BUILTIN\\Administrators";
 479         name.sid_type = SID_NAME_ALIAS;
 480         ret &= test_LookupNames(b, tctx, handle, &tnames);
 481
 482         name.name.string = "SYSTEM";
 483         name.sid_type = SID_NAME_WKN_GRP;
 484         ret &= test_LookupNames(b, tctx, handle, &tnames);
 485
 486         name.name.string = "Everyone";
 487         name.sid_type = SID_NAME_WKN_GRP;
 488         ret &= test_LookupNames(b, tctx, handle, &tnames);
 489         return ret;
 490 }
 491
 492 static bool test_LookupNames2(struct dcerpc_binding_handle *b,
 493                               struct torture_context *tctx,
 494                               struct policy_handle *handle,
 495                               struct lsa_TransNameArray2 *tnames,
 496                               bool check_result)
 497 {
 498         struct lsa_LookupNames2 r;
 499         struct lsa_TransSidArray2 sids;
 500         struct lsa_RefDomainList *domains = NULL;
 501         struct lsa_String *names;
 502         uint32_t *input_idx;
 503         uint32_t count = 0;
 504         int i;
 505
 506         torture_comment(tctx, "\nTesting LookupNames2 with %d names\n", tnames->count);
 507
 508         sids.count = 0;
 509         sids.sids = NULL;
 510
 511         r.in.num_names = 0;
 512
 513         input_idx = talloc_array(tctx, uint32_t, tnames->count);
 514         names = talloc_array(tctx, struct lsa_String, tnames->count);
 515
 516         for (i=0;i<tnames->count;i++) {
 517                 if (tnames->names[i].sid_type != SID_NAME_UNKNOWN) {
 518                         init_lsa_String(&names[r.in.num_names], tnames->names[i].name.string);
 519                         input_idx[r.in.num_names] = i;
 520                         r.in.num_names++;
 521                 }
 522         }
 523
 524         r.in.handle = handle;
 525         r.in.names = names;
 526         r.in.sids = &sids;
 527         r.in.level = 1;
 528         r.in.count = &count;
 529         r.in.lookup_options = 0;
 530         r.in.client_revision = 0;
 531         r.out.count = &count;
 532         r.out.sids = &sids;
 533         r.out.domains = &domains;
 534
 535         torture_assert_ntstatus_ok(tctx, dcerpc_lsa_LookupNames2_r(b, tctx, &r),
 536                 "LookupNames2 failed");
 537         if (!NT_STATUS_IS_OK(r.out.result)) {
 538                 torture_comment(tctx, "LookupNames2 failed - %s\n",
 539                                 nt_errstr(r.out.result));
 540                 return false;
 541         }
 542
 543         if (check_result) {
 544                 torture_assert_int_equal(tctx, count, sids.count,
 545                         "unexpected number of results returned");
 546                 if (sids.count > 0) {
 547                         torture_assert(tctx, sids.sids, "invalid sid buffer");
 548                 }
 549         }
 550
 551         torture_comment(tctx, "\n");
 552
 553         return true;
 554 }
 555
 556
 557 static bool test_LookupNames3(struct dcerpc_binding_handle *b,
 558                               struct torture_context *tctx,
 559                               struct policy_handle *handle,
 560                               struct lsa_TransNameArray2 *tnames,
 561                               bool check_result)
 562 {
 563         struct lsa_LookupNames3 r;
 564         struct lsa_TransSidArray3 sids;
 565         struct lsa_RefDomainList *domains = NULL;
 566         struct lsa_String *names;
 567         uint32_t count = 0;
 568         int i;
 569         uint32_t *input_idx;
 570
 571         torture_comment(tctx, "\nTesting LookupNames3 with %d names\n", tnames->count);
 572
 573         sids.count = 0;
 574         sids.sids = NULL;
 575
 576         r.in.num_names = 0;
 577
 578         input_idx = talloc_array(tctx, uint32_t, tnames->count);
 579         names = talloc_array(tctx, struct lsa_String, tnames->count);
 580         for (i=0;i<tnames->count;i++) {
 581                 if (tnames->names[i].sid_type != SID_NAME_UNKNOWN) {
 582                         init_lsa_String(&names[r.in.num_names], tnames->names[i].name.string);
 583                         input_idx[r.in.num_names] = i;
 584                         r.in.num_names++;
 585                 }
 586         }
 587
 588         r.in.handle = handle;
 589         r.in.names = names;
 590         r.in.sids = &sids;
 591         r.in.level = 1;
 592         r.in.count = &count;
 593         r.in.lookup_options = 0;
 594         r.in.client_revision = 0;
 595         r.out.count = &count;
 596         r.out.sids = &sids;
 597         r.out.domains = &domains;
 598
 599         torture_assert_ntstatus_ok(tctx, dcerpc_lsa_LookupNames3_r(b, tctx, &r),
 600                 "LookupNames3 failed");
 601         if (!NT_STATUS_IS_OK(r.out.result)) {
 602                 torture_comment(tctx, "LookupNames3 failed - %s\n",
 603                                 nt_errstr(r.out.result));
 604                 return false;
 605         }
 606
 607         if (check_result) {
 608                 torture_assert_int_equal(tctx, count, sids.count,
 609                         "unexpected number of results returned");
 610                 if (sids.count > 0) {
 611                         torture_assert(tctx, sids.sids, "invalid sid buffer");
 612                 }
 613         }
 614
 615         torture_comment(tctx, "\n");
 616
 617         return true;
 618 }
 619
 620 static bool test_LookupNames4(struct dcerpc_binding_handle *b,
 621                               struct torture_context *tctx,
 622                               struct lsa_TransNameArray2 *tnames,
 623                               bool check_result)
 624 {
 625         struct lsa_LookupNames4 r;
 626         struct lsa_TransSidArray3 sids;
 627         struct lsa_RefDomainList *domains = NULL;
 628         struct lsa_String *names;
 629         uint32_t count = 0;
 630         int i;
 631         uint32_t *input_idx;
 632
 633         torture_comment(tctx, "\nTesting LookupNames4 with %d names\n", tnames->count);
 634
 635         sids.count = 0;
 636         sids.sids = NULL;
 637
 638         r.in.num_names = 0;
 639
 640         input_idx = talloc_array(tctx, uint32_t, tnames->count);
 641         names = talloc_array(tctx, struct lsa_String, tnames->count);
 642         for (i=0;i<tnames->count;i++) {
 643                 if (tnames->names[i].sid_type != SID_NAME_UNKNOWN) {
 644                         init_lsa_String(&names[r.in.num_names], tnames->names[i].name.string);
 645                         input_idx[r.in.num_names] = i;
 646                         r.in.num_names++;
 647                 }
 648         }
 649
 650         r.in.num_names = tnames->count;
 651         r.in.names = names;
 652         r.in.sids = &sids;
 653         r.in.level = 1;
 654         r.in.count = &count;
 655         r.in.lookup_options = 0;
 656         r.in.client_revision = 0;
 657         r.out.count = &count;
 658         r.out.sids = &sids;
 659         r.out.domains = &domains;
 660
 661         torture_assert_ntstatus_ok(tctx, dcerpc_lsa_LookupNames4_r(b, tctx, &r),
 662                 "LookupNames4 failed");
 663
 664         if (!NT_STATUS_IS_OK(r.out.result)) {
 665                 if (NT_STATUS_EQUAL(r.out.result, NT_STATUS_NONE_MAPPED)) {
 666                         torture_comment(tctx,
 667                                         "LookupNames4 failed: %s - not considered as an error",
 668                                         nt_errstr(r.out.result));
 669
 670                         return true;
 671                 }
 672
 673                 torture_assert_ntstatus_ok(tctx,
 674                                            r.out.result,
 675                                            "LookupNames4 failed");
 676
 677                 return false;
 678         }
 679
 680         if (check_result) {
 681                 torture_assert_int_equal(tctx, count, sids.count,
 682                         "unexpected number of results returned");
 683                 if (sids.count > 0) {
 684                         torture_assert(tctx, sids.sids, "invalid sid buffer");
 685                 }
 686         }
 687
 688         torture_comment(tctx, "\n");
 689
 690         return true;
 691 }
 692
 693 static bool test_LookupNames4_fail(struct dcerpc_binding_handle *b,
 694                                    struct torture_context *tctx)
 695 {
 696         struct lsa_LookupNames4 r;
 697         struct lsa_TransSidArray3 sids;
 698         struct lsa_RefDomainList *domains = NULL;
 699         struct lsa_String *names = NULL;
 700         uint32_t count = 0;
 701         NTSTATUS status;
 702
 703         torture_comment(tctx, "\nTesting LookupNames4_fail");
 704
 705         sids.count = 0;
 706         sids.sids = NULL;
 707
 708         r.in.num_names = 0;
 709
 710         r.in.num_names = count;
 711         r.in.names = names;
 712         r.in.sids = &sids;
 713         r.in.level = 1;
 714         r.in.count = &count;
 715         r.in.lookup_options = 0;
 716         r.in.client_revision = 0;
 717         r.out.count = &count;
 718         r.out.sids = &sids;
 719         r.out.domains = &domains;
 720
 721         status = dcerpc_lsa_LookupNames4_r(b, tctx, &r);
 722         if (!NT_STATUS_IS_OK(status)) {
 723                 if (NT_STATUS_EQUAL(status, NT_STATUS_ACCESS_DENIED)) {
 724                         torture_comment(tctx,
 725                                         "LookupNames4 correctly returned with "
 726                                         "status: %s\n",
 727                                         nt_errstr(status));
 728                         return true;
 729                 }
 730
 731                 torture_assert_ntstatus_equal(tctx,
 732                                               status,
 733                                               NT_STATUS_ACCESS_DENIED,
 734                                               "LookupNames4 return value should "
 735                                               "be ACCESS_DENIED");
 736                 return true;
 737         }
 738
 739         if (!NT_STATUS_IS_OK(r.out.result)) {
 740                 if (NT_STATUS_EQUAL(r.out.result, NT_STATUS_ACCESS_DENIED) ||
 741                     NT_STATUS_EQUAL(r.out.result, NT_STATUS_RPC_PROTSEQ_NOT_SUPPORTED)) {
 742                         torture_comment(tctx,
 743                                         "LookupSids3 correctly returned with "
 744                                         "result: %s\n",
 745                                         nt_errstr(r.out.result));
 746                         return true;
 747                 }
 748         }
 749
 750         torture_assert_ntstatus_equal(tctx,
 751                                       r.out.result,
 752                                       NT_STATUS_OK,
 753                                       "LookupNames4 return value should be "
 754                                       "ACCESS_DENIED");
 755
 756         return false;
 757 }
 758
 759
 760 static bool test_LookupSids(struct dcerpc_binding_handle *b,
 761                             struct torture_context *tctx,
 762                             struct policy_handle *handle,
 763                             struct lsa_SidArray *sids)
 764 {
 765         struct lsa_LookupSids r;
 766         struct lsa_TransNameArray names;
 767         struct lsa_RefDomainList *domains = NULL;
 768         uint32_t count = sids->num_sids;
 769
 770         torture_comment(tctx, "\nTesting LookupSids\n");
 771
 772         names.count = 0;
 773         names.names = NULL;
 774
 775         r.in.handle = handle;
 776         r.in.sids = sids;
 777         r.in.names = &names;
 778         r.in.level = 1;
 779         r.in.count = &count;
 780         r.out.count = &count;
 781         r.out.names = &names;
 782         r.out.domains = &domains;
 783
 784         torture_assert_ntstatus_ok(tctx, dcerpc_lsa_LookupSids_r(b, tctx, &r),
 785                 "LookupSids failed");
 786         if (!NT_STATUS_IS_OK(r.out.result) &&
 787             !NT_STATUS_EQUAL(r.out.result, STATUS_SOME_UNMAPPED)) {
 788                 torture_comment(tctx, "LookupSids failed - %s\n",
 789                                 nt_errstr(r.out.result));
 790                 return false;
 791         }
 792
 793         torture_comment(tctx, "\n");
 794
 795         if (!test_LookupNames(b, tctx, handle, &names)) {
 796                 return false;
 797         }
 798
 799         return true;
 800 }
 801
 802
 803 static bool test_LookupSids2(struct dcerpc_binding_handle *b,
 804                             struct torture_context *tctx,
 805                             struct policy_handle *handle,
 806                             struct lsa_SidArray *sids)
 807 {
 808         struct lsa_LookupSids2 r;
 809         struct lsa_TransNameArray2 names;
 810         struct lsa_RefDomainList *domains = NULL;
 811         uint32_t count = sids->num_sids;
 812
 813         torture_comment(tctx, "\nTesting LookupSids2\n");
 814
 815         names.count = 0;
 816         names.names = NULL;
 817
 818         r.in.handle = handle;
 819         r.in.sids = sids;
 820         r.in.names = &names;
 821         r.in.level = 1;
 822         r.in.count = &count;
 823         r.in.lookup_options = 0;
 824         r.in.client_revision = 0;
 825         r.out.count = &count;
 826         r.out.names = &names;
 827         r.out.domains = &domains;
 828
 829         torture_assert_ntstatus_ok(tctx, dcerpc_lsa_LookupSids2_r(b, tctx, &r),
 830                 "LookupSids2 failed");
 831         if (!NT_STATUS_IS_OK(r.out.result) &&
 832             !NT_STATUS_EQUAL(r.out.result, STATUS_SOME_UNMAPPED)) {
 833                 torture_comment(tctx, "LookupSids2 failed - %s\n",
 834                                 nt_errstr(r.out.result));
 835                 return false;
 836         }
 837
 838         torture_comment(tctx, "\n");
 839
 840         if (!test_LookupNames2(b, tctx, handle, &names, false)) {
 841                 return false;
 842         }
 843
 844         if (!test_LookupNames3(b, tctx, handle, &names, false)) {
 845                 return false;
 846         }
 847
 848         return true;
 849 }
 850
 851 static bool test_LookupSids3(struct dcerpc_binding_handle *b,
 852                             struct torture_context *tctx,
 853                             struct lsa_SidArray *sids)
 854 {
 855         struct lsa_LookupSids3 r;
 856         struct lsa_TransNameArray2 names;
 857         struct lsa_RefDomainList *domains = NULL;
 858         uint32_t count = sids->num_sids;
 859
 860         torture_comment(tctx, "\nTesting LookupSids3\n");
 861
 862         names.count = 0;
 863         names.names = NULL;
 864
 865         r.in.sids = sids;
 866         r.in.names = &names;
 867         r.in.level = 1;
 868         r.in.count = &count;
 869         r.in.lookup_options = 0;
 870         r.in.client_revision = 0;
 871         r.out.domains = &domains;
 872         r.out.count = &count;
 873         r.out.names = &names;
 874
 875         torture_assert_ntstatus_ok(tctx, dcerpc_lsa_LookupSids3_r(b, tctx, &r),
 876                 "LookupSids3 failed");
 877
 878         if (!NT_STATUS_IS_OK(r.out.result)) {
 879                 if (NT_STATUS_EQUAL(r.out.result, NT_STATUS_NONE_MAPPED)) {
 880                         torture_comment(tctx,
 881                                         "LookupSids3 failed: %s - not considered as an error",
 882                                         nt_errstr(r.out.result));
 883
 884                         return true;
 885                 }
 886
 887                 torture_assert_ntstatus_ok(tctx,
 888                                            r.out.result,
 889                                            "LookupSids3 failed");
 890
 891                 return false;
 892         }
 893
 894         torture_comment(tctx, "\n");
 895
 896         if (!test_LookupNames4(b, tctx, &names, true)) {
 897                 return false;
 898         }
 899
 900         return true;
 901 }
 902
 903 static bool test_LookupSids3_fail(struct dcerpc_binding_handle *b,
 904                                   struct torture_context *tctx,
 905                                   struct lsa_SidArray *sids)
 906 {
 907         struct lsa_LookupSids3 r;
 908         struct lsa_TransNameArray2 names;
 909         struct lsa_RefDomainList *domains = NULL;
 910         uint32_t count = sids->num_sids;
 911         NTSTATUS status;
 912
 913         torture_comment(tctx, "\nTesting LookupSids3\n");
 914
 915         names.count = 0;
 916         names.names = NULL;
 917
 918         r.in.sids = sids;
 919         r.in.names = &names;
 920         r.in.level = 1;
 921         r.in.count = &count;
 922         r.in.lookup_options = 0;
 923         r.in.client_revision = 0;
 924         r.out.domains = &domains;
 925         r.out.count = &count;
 926         r.out.names = &names;
 927
 928         status = dcerpc_lsa_LookupSids3_r(b, tctx, &r);
 929         if (!NT_STATUS_IS_OK(status)) {
 930                 if (NT_STATUS_EQUAL(status, NT_STATUS_ACCESS_DENIED)) {
 931                         torture_comment(tctx,
 932                                         "LookupSids3 correctly returned with "
 933                                         "status: %s\n",
 934                                         nt_errstr(status));
 935                         return true;
 936                 }
 937
 938                 torture_assert_ntstatus_equal(tctx,
 939                                               status,
 940                                               NT_STATUS_ACCESS_DENIED,
 941                                               "LookupSids3 return value should "
 942                                               "be ACCESS_DENIED");
 943                 return true;
 944         }
 945
 946         if (!NT_STATUS_IS_OK(r.out.result)) {
 947                 if (NT_STATUS_EQUAL(r.out.result, NT_STATUS_ACCESS_DENIED) ||
 948                     NT_STATUS_EQUAL(r.out.result, NT_STATUS_RPC_PROTSEQ_NOT_SUPPORTED)) {
 949                         torture_comment(tctx,
 950                                         "LookupNames4 correctly returned with "
 951                                         "result: %s\n",
 952                                         nt_errstr(r.out.result));
 953                         return true;
 954                 }
 955         }
 956
 957         torture_assert_ntstatus_equal(tctx,
 958                                       r.out.result,
 959                                       NT_STATUS_OK,
 960                                       "LookupSids3 return value should be "
 961                                       "ACCESS_DENIED");
 962
 963         return false;
 964 }
 965
 966 bool test_many_LookupSids(struct dcerpc_pipe *p,
 967                           struct torture_context *tctx,
 968                           struct policy_handle *handle)
 969 {
 970         uint32_t count;
 971         struct lsa_SidArray sids;
 972         int i;
 973         struct dcerpc_binding_handle *b = p->binding_handle;
 974
 975         torture_comment(tctx, "\nTesting LookupSids with lots of SIDs\n");
 976
 977         sids.num_sids = 100;
 978
 979         sids.sids = talloc_array(tctx, struct lsa_SidPtr, sids.num_sids);
 980
 981         for (i=0; i<sids.num_sids; i++) {
 982                 const char *sidstr = "S-1-5-32-545";
 983                 sids.sids[i].sid = dom_sid_parse_talloc(tctx, sidstr);
 984         }
 985
 986         count = sids.num_sids;
 987
 988         if (handle) {
 989                 struct lsa_LookupSids r;
 990                 struct lsa_TransNameArray names;
 991                 struct lsa_RefDomainList *domains = NULL;
 992                 names.count = 0;
 993                 names.names = NULL;
 994
 995                 r.in.handle = handle;
 996                 r.in.sids = &sids;
 997                 r.in.names = &names;
 998                 r.in.level = 1;
 999                 r.in.count = &names.count;
1000                 r.out.count = &count;
1001                 r.out.names = &names;
1002                 r.out.domains = &domains;
1003
1004                 torture_assert_ntstatus_ok(tctx, dcerpc_lsa_LookupSids_r(b, tctx, &r),
1005                         "LookupSids failed");
1006                 if (!NT_STATUS_IS_OK(r.out.result)) {
1007                         torture_comment(tctx, "LookupSids failed - %s\n",
1008                                         nt_errstr(r.out.result));
1009                         return false;
1010                 }
1011
1012                 torture_comment(tctx, "\n");
1013
1014                 if (!test_LookupNames(b, tctx, handle, &names)) {
1015                         return false;
1016                 }
1017         }
1018
1019         if (p->binding->transport == NCACN_NP) {
1020                 if (!test_LookupSids3_fail(b, tctx, &sids)) {
1021                         return false;
1022                 }
1023                 if (!test_LookupNames4_fail(b, tctx)) {
1024                         return false;
1025                 }
1026         } else if (p->binding->transport == NCACN_IP_TCP) {
1027                 struct lsa_TransNameArray2 names;
1028
1029                 names.count = 0;
1030                 names.names = NULL;
1031
1032                 if (p->conn->security_state.auth_info->auth_type == DCERPC_AUTH_TYPE_SCHANNEL &&
1033                    p->conn->security_state.auth_info->auth_level >= DCERPC_AUTH_LEVEL_INTEGRITY) {
1034                         if (!test_LookupSids3(b, tctx, &sids)) {
1035                                 return false;
1036                         }
1037                         if (!test_LookupNames4(b, tctx, &names, true)) {
1038                                 return false;
1039                         }
1040                 } else {
1041                         /*
1042                          * If we don't have a secure channel these tests must
1043                          * fail with ACCESS_DENIED.
1044                          */
1045                         if (!test_LookupSids3_fail(b, tctx, &sids)) {
1046                                 return false;
1047                         }
1048                         if (!test_LookupNames4_fail(b, tctx)) {
1049                                 return false;
1050                         }
1051                 }
1052         }
1053
1054         torture_comment(tctx, "\n");
1055
1056
1057
1058         return true;
1059 }
1060
1061 static void lookupsids_cb(struct tevent_req *subreq)
1062 {
1063         int *replies = (int *)tevent_req_callback_data_void(subreq);
1064         NTSTATUS status;
1065
1066         status = dcerpc_lsa_LookupSids_r_recv(subreq, subreq);
1067         TALLOC_FREE(subreq);
1068         if (!NT_STATUS_IS_OK(status)) {
1069                 printf("lookupsids returned %s\n", nt_errstr(status));
1070                 *replies = -1;
1071         }
1072
1073         if (*replies >= 0) {
1074                 *replies += 1;
1075         }
1076 }
1077
1078 static bool test_LookupSids_async(struct dcerpc_binding_handle *b,
1079                                   struct torture_context *tctx,
1080                                   struct policy_handle *handle)
1081 {
1082         struct lsa_SidArray sids;
1083         struct lsa_SidPtr sidptr;
1084         uint32_t *count;
1085         struct lsa_TransNameArray *names;
1086         struct lsa_LookupSids *r;
1087         struct lsa_RefDomainList *domains = NULL;
1088         struct tevent_req **req;
1089         int i, replies;
1090         bool ret = true;
1091         const int num_async_requests = 50;
1092
1093         count = talloc_array(tctx, uint32_t, num_async_requests);
1094         names = talloc_array(tctx, struct lsa_TransNameArray, num_async_requests);
1095         r = talloc_array(tctx, struct lsa_LookupSids, num_async_requests);
1096
1097         torture_comment(tctx, "\nTesting %d async lookupsids request\n", num_async_requests);
1098
1099         req = talloc_array(tctx, struct tevent_req *, num_async_requests);
1100
1101         sids.num_sids = 1;
1102         sids.sids = &sidptr;
1103         sidptr.sid = dom_sid_parse_talloc(tctx, "S-1-5-32-545");
1104
1105         replies = 0;
1106
1107         for (i=0; i<num_async_requests; i++) {
1108                 count[i] = 0;
1109                 names[i].count = 0;
1110                 names[i].names = NULL;
1111
1112                 r[i].in.handle = handle;
1113                 r[i].in.sids = &sids;
1114                 r[i].in.names = &names[i];
1115                 r[i].in.level = 1;
1116                 r[i].in.count = &names[i].count;
1117                 r[i].out.count = &count[i];
1118                 r[i].out.names = &names[i];
1119                 r[i].out.domains = &domains;
1120
1121                 req[i] = dcerpc_lsa_LookupSids_r_send(tctx, tctx->ev, b, &r[i]);
1122                 if (req[i] == NULL) {
1123                         ret = false;
1124                         break;
1125                 }
1126
1127                 tevent_req_set_callback(req[i], lookupsids_cb, &replies);
1128         }
1129
1130         while (replies >= 0 && replies < num_async_requests) {
1131                 tevent_loop_once(tctx->ev);
1132         }
1133
1134         talloc_free(req);
1135
1136         if (replies < 0) {
1137                 ret = false;
1138         }
1139
1140         return ret;
1141 }
1142
1143 static bool test_LookupPrivValue(struct dcerpc_binding_handle *b,
1144                                  struct torture_context *tctx,
1145                                  struct policy_handle *handle,
1146                                  struct lsa_String *name)
1147 {
1148         struct lsa_LookupPrivValue r;
1149         struct lsa_LUID luid;
1150
1151         r.in.handle = handle;
1152         r.in.name = name;
1153         r.out.luid = &luid;
1154
1155         torture_assert_ntstatus_ok(tctx, dcerpc_lsa_LookupPrivValue_r(b, tctx, &r),
1156                 "LookupPrivValue failed");
1157         if (!NT_STATUS_IS_OK(r.out.result)) {
1158                 torture_comment(tctx, "\nLookupPrivValue failed - %s\n",
1159                                 nt_errstr(r.out.result));
1160                 return false;
1161         }
1162
1163         return true;
1164 }
1165
1166 static bool test_LookupPrivName(struct dcerpc_binding_handle *b,
1167                                 struct torture_context *tctx,
1168                                 struct policy_handle *handle,
1169                                 struct lsa_LUID *luid)
1170 {
1171         struct lsa_LookupPrivName r;
1172         struct lsa_StringLarge *name = NULL;
1173
1174         r.in.handle = handle;
1175         r.in.luid = luid;
1176         r.out.name = &name;
1177
1178         torture_assert_ntstatus_ok(tctx, dcerpc_lsa_LookupPrivName_r(b, tctx, &r),
1179                 "LookupPrivName failed");
1180         if (!NT_STATUS_IS_OK(r.out.result)) {
1181                 torture_comment(tctx, "\nLookupPrivName failed - %s\n",
1182                                 nt_errstr(r.out.result));
1183                 return false;
1184         }
1185
1186         return true;
1187 }
1188
1189 static bool test_RemovePrivilegesFromAccount(struct dcerpc_binding_handle *b,
1190                                              struct torture_context *tctx,
1191                                              struct policy_handle *handle,
1192                                              struct policy_handle *acct_handle,
1193                                              struct lsa_LUID *luid)
1194 {
1195         struct lsa_RemovePrivilegesFromAccount r;
1196         struct lsa_PrivilegeSet privs;
1197         bool ret = true;
1198
1199         torture_comment(tctx, "\nTesting RemovePrivilegesFromAccount\n");
1200
1201         r.in.handle = acct_handle;
1202         r.in.remove_all = 0;
1203         r.in.privs = &privs;
1204
1205         privs.count = 1;
1206         privs.unknown = 0;
1207         privs.set = talloc_array(tctx, struct lsa_LUIDAttribute, 1);
1208         privs.set[0].luid = *luid;
1209         privs.set[0].attribute = 0;
1210
1211         torture_assert_ntstatus_ok(tctx, dcerpc_lsa_RemovePrivilegesFromAccount_r(b, tctx, &r),
1212                 "RemovePrivilegesFromAccount failed");
1213         if (!NT_STATUS_IS_OK(r.out.result)) {
1214
1215                 struct lsa_LookupPrivName r_name;
1216                 struct lsa_StringLarge *name = NULL;
1217
1218                 r_name.in.handle = handle;
1219                 r_name.in.luid = luid;
1220                 r_name.out.name = &name;
1221
1222                 torture_assert_ntstatus_ok(tctx, dcerpc_lsa_LookupPrivName_r(b, tctx, &r_name),
1223                         "LookupPrivName failed");
1224                 if (!NT_STATUS_IS_OK(r_name.out.result)) {
1225                         torture_comment(tctx, "\nLookupPrivName failed - %s\n",
1226                                         nt_errstr(r_name.out.result));
1227                         return false;
1228                 }
1229                 /* Windows 2008 does not allow this to be removed */
1230                 if (strcmp("SeAuditPrivilege", name->string) == 0) {
1231                         return ret;
1232                 }
1233
1234                 torture_comment(tctx, "RemovePrivilegesFromAccount failed to remove %s - %s\n",
1235                        name->string,
1236                        nt_errstr(r.out.result));
1237                 return false;
1238         }
1239
1240         return ret;
1241 }
1242
1243 static bool test_AddPrivilegesToAccount(struct dcerpc_binding_handle *b,
1244                                         struct torture_context *tctx,
1245                                         struct policy_handle *acct_handle,
1246                                         struct lsa_LUID *luid)
1247 {
1248         struct lsa_AddPrivilegesToAccount r;
1249         struct lsa_PrivilegeSet privs;
1250         bool ret = true;
1251
1252         torture_comment(tctx, "\nTesting AddPrivilegesToAccount\n");
1253
1254         r.in.handle = acct_handle;
1255         r.in.privs = &privs;
1256
1257         privs.count = 1;
1258         privs.unknown = 0;
1259         privs.set = talloc_array(tctx, struct lsa_LUIDAttribute, 1);
1260         privs.set[0].luid = *luid;
1261         privs.set[0].attribute = 0;
1262
1263         torture_assert_ntstatus_ok(tctx, dcerpc_lsa_AddPrivilegesToAccount_r(b, tctx, &r),
1264                 "AddPrivilegesToAccount failed");
1265         if (!NT_STATUS_IS_OK(r.out.result)) {
1266                 torture_comment(tctx, "AddPrivilegesToAccount failed - %s\n",
1267                                 nt_errstr(r.out.result));
1268                 return false;
1269         }
1270
1271         return ret;
1272 }
1273
1274 static bool test_EnumPrivsAccount(struct dcerpc_binding_handle *b,
1275                                   struct torture_context *tctx,
1276                                   struct policy_handle *handle,
1277                                   struct policy_handle *acct_handle)
1278 {
1279         struct lsa_EnumPrivsAccount r;
1280         struct lsa_PrivilegeSet *privs = NULL;
1281         bool ret = true;
1282
1283         torture_comment(tctx, "\nTesting EnumPrivsAccount\n");
1284
1285         r.in.handle = acct_handle;
1286         r.out.privs = &privs;
1287
1288         torture_assert_ntstatus_ok(tctx, dcerpc_lsa_EnumPrivsAccount_r(b, tctx, &r),
1289                 "EnumPrivsAccount failed");
1290         if (!NT_STATUS_IS_OK(r.out.result)) {
1291                 torture_comment(tctx, "EnumPrivsAccount failed - %s\n",
1292                                 nt_errstr(r.out.result));
1293                 return false;
1294         }
1295
1296         if (privs && privs->count > 0) {
1297                 int i;
1298                 for (i=0;i<privs->count;i++) {
1299                         test_LookupPrivName(b, tctx, handle,
1300                                             &privs->set[i].luid);
1301                 }
1302
1303                 ret &= test_RemovePrivilegesFromAccount(b, tctx, handle, acct_handle,
1304                                                         &privs->set[0].luid);
1305                 ret &= test_AddPrivilegesToAccount(b, tctx, acct_handle,
1306                                                    &privs->set[0].luid);
1307         }
1308
1309         return ret;
1310 }
1311
1312 static bool test_GetSystemAccessAccount(struct dcerpc_binding_handle *b,
1313                                         struct torture_context *tctx,
1314                                         struct policy_handle *handle,
1315                                         struct policy_handle *acct_handle)
1316 {
1317         uint32_t access_mask;
1318         struct lsa_GetSystemAccessAccount r;
1319
1320         torture_comment(tctx, "\nTesting GetSystemAccessAccount\n");
1321
1322         r.in.handle = acct_handle;
1323         r.out.access_mask = &access_mask;
1324
1325         torture_assert_ntstatus_ok(tctx, dcerpc_lsa_GetSystemAccessAccount_r(b, tctx, &r),
1326                 "GetSystemAccessAccount failed");
1327         if (!NT_STATUS_IS_OK(r.out.result)) {
1328                 torture_comment(tctx, "GetSystemAccessAccount failed - %s\n",
1329                                 nt_errstr(r.out.result));
1330                 return false;
1331         }
1332
1333         if (r.out.access_mask != NULL) {
1334                 torture_comment(tctx, "Rights:");
1335                 if (*(r.out.access_mask) & LSA_POLICY_MODE_INTERACTIVE)
1336                         torture_comment(tctx, " LSA_POLICY_MODE_INTERACTIVE");
1337                 if (*(r.out.access_mask) & LSA_POLICY_MODE_NETWORK)
1338                         torture_comment(tctx, " LSA_POLICY_MODE_NETWORK");
1339                 if (*(r.out.access_mask) & LSA_POLICY_MODE_BATCH)
1340                         torture_comment(tctx, " LSA_POLICY_MODE_BATCH");
1341                 if (*(r.out.access_mask) & LSA_POLICY_MODE_SERVICE)
1342                         torture_comment(tctx, " LSA_POLICY_MODE_SERVICE");
1343                 if (*(r.out.access_mask) & LSA_POLICY_MODE_PROXY)
1344                         torture_comment(tctx, " LSA_POLICY_MODE_PROXY");
1345                 if (*(r.out.access_mask) & LSA_POLICY_MODE_DENY_INTERACTIVE)
1346                         torture_comment(tctx, " LSA_POLICY_MODE_DENY_INTERACTIVE");
1347                 if (*(r.out.access_mask) & LSA_POLICY_MODE_DENY_NETWORK)
1348                         torture_comment(tctx, " LSA_POLICY_MODE_DENY_NETWORK");
1349                 if (*(r.out.access_mask) & LSA_POLICY_MODE_DENY_BATCH)
1350                         torture_comment(tctx, " LSA_POLICY_MODE_DENY_BATCH");
1351                 if (*(r.out.access_mask) & LSA_POLICY_MODE_DENY_SERVICE)
1352                         torture_comment(tctx, " LSA_POLICY_MODE_DENY_SERVICE");
1353                 if (*(r.out.access_mask) & LSA_POLICY_MODE_REMOTE_INTERACTIVE)
1354                         torture_comment(tctx, " LSA_POLICY_MODE_REMOTE_INTERACTIVE");
1355                 if (*(r.out.access_mask) & LSA_POLICY_MODE_DENY_REMOTE_INTERACTIVE)
1356                         torture_comment(tctx, " LSA_POLICY_MODE_DENY_REMOTE_INTERACTIVE");
1357                 if (*(r.out.access_mask) & LSA_POLICY_MODE_ALL)
1358                         torture_comment(tctx, " LSA_POLICY_MODE_ALL");
1359                 if (*(r.out.access_mask) & LSA_POLICY_MODE_ALL_NT4)
1360                         torture_comment(tctx, " LSA_POLICY_MODE_ALL_NT4");
1361                 torture_comment(tctx, "\n");
1362         }
1363
1364         return true;
1365 }
1366
1367 static bool test_Delete(struct dcerpc_binding_handle *b,
1368                         struct torture_context *tctx,
1369                         struct policy_handle *handle)
1370 {
1371         struct lsa_Delete r;
1372
1373         torture_comment(tctx, "\nTesting Delete\n");
1374
1375         r.in.handle = handle;
1376         torture_assert_ntstatus_ok(tctx, dcerpc_lsa_Delete_r(b, tctx, &r),
1377                 "Delete failed");
1378         if (!NT_STATUS_EQUAL(r.out.result, NT_STATUS_NOT_SUPPORTED)) {
1379                 torture_comment(tctx, "Delete should have failed NT_STATUS_NOT_SUPPORTED - %s\n", nt_errstr(r.out.result));
1380                 return false;
1381         }
1382
1383         return true;
1384 }
1385
1386 static bool test_DeleteObject(struct dcerpc_binding_handle *b,
1387                               struct torture_context *tctx,
1388                               struct policy_handle *handle)
1389 {
1390         struct lsa_DeleteObject r;
1391
1392         torture_comment(tctx, "\nTesting DeleteObject\n");
1393
1394         r.in.handle = handle;
1395         r.out.handle = handle;
1396         torture_assert_ntstatus_ok(tctx, dcerpc_lsa_DeleteObject_r(b, tctx, &r),
1397                 "DeleteObject failed");
1398         if (!NT_STATUS_IS_OK(r.out.result)) {
1399                 torture_comment(tctx, "DeleteObject failed - %s\n",
1400                                 nt_errstr(r.out.result));
1401                 return false;
1402         }
1403
1404         return true;
1405 }
1406
1407
1408 static bool test_CreateAccount(struct dcerpc_binding_handle *b,
1409                                struct torture_context *tctx,
1410                                struct policy_handle *handle)
1411 {
1412         struct lsa_CreateAccount r;
1413         struct dom_sid2 *newsid;
1414         struct policy_handle acct_handle;
1415
1416         newsid = dom_sid_parse_talloc(tctx, "S-1-5-12349876-4321-2854");
1417
1418         torture_comment(tctx, "\nTesting CreateAccount\n");
1419
1420         r.in.handle = handle;
1421         r.in.sid = newsid;
1422         r.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
1423         r.out.acct_handle = &acct_handle;
1424
1425         torture_assert_ntstatus_ok(tctx, dcerpc_lsa_CreateAccount_r(b, tctx, &r),
1426                 "CreateAccount failed");
1427         if (NT_STATUS_EQUAL(r.out.result, NT_STATUS_OBJECT_NAME_COLLISION)) {
1428                 struct lsa_OpenAccount r_o;
1429                 r_o.in.handle = handle;
1430                 r_o.in.sid = newsid;
1431                 r_o.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
1432                 r_o.out.acct_handle = &acct_handle;
1433
1434                 torture_assert_ntstatus_ok(tctx, dcerpc_lsa_OpenAccount_r(b, tctx, &r_o),
1435                         "OpenAccount failed");
1436                 if (!NT_STATUS_IS_OK(r_o.out.result)) {
1437                         torture_comment(tctx, "OpenAccount failed - %s\n",
1438                                         nt_errstr(r_o.out.result));
1439                         return false;
1440                 }
1441         } else if (!NT_STATUS_IS_OK(r.out.result)) {
1442                 torture_comment(tctx, "CreateAccount failed - %s\n",
1443                                 nt_errstr(r.out.result));
1444                 return false;
1445         }
1446
1447         if (!test_Delete(b, tctx, &acct_handle)) {
1448                 return false;
1449         }
1450
1451         if (!test_DeleteObject(b, tctx, &acct_handle)) {
1452                 return false;
1453         }
1454
1455         return true;
1456 }
1457
1458 static bool test_DeleteTrustedDomain(struct dcerpc_binding_handle *b,
1459                                      struct torture_context *tctx,
1460                                      struct policy_handle *handle,
1461                                      struct lsa_StringLarge name)
1462 {
1463         struct lsa_OpenTrustedDomainByName r;
1464         struct policy_handle trustdom_handle;
1465
1466         r.in.handle = handle;
1467         r.in.name.string = name.string;
1468         r.in.access_mask = SEC_STD_DELETE;
1469         r.out.trustdom_handle = &trustdom_handle;
1470
1471         torture_assert_ntstatus_ok(tctx, dcerpc_lsa_OpenTrustedDomainByName_r(b, tctx, &r),
1472                 "OpenTrustedDomainByName failed");
1473         if (!NT_STATUS_IS_OK(r.out.result)) {
1474                 torture_comment(tctx, "OpenTrustedDomainByName failed - %s\n", nt_errstr(r.out.result));
1475                 return false;
1476         }
1477
1478         if (!test_Delete(b, tctx, &trustdom_handle)) {
1479                 return false;
1480         }
1481
1482         if (!test_DeleteObject(b, tctx, &trustdom_handle)) {
1483                 return false;
1484         }
1485
1486         return true;
1487 }
1488
1489 static bool test_DeleteTrustedDomainBySid(struct dcerpc_binding_handle *b,
1490                                           struct torture_context *tctx,
1491                                           struct policy_handle *handle,
1492                                           struct dom_sid *sid)
1493 {
1494         struct lsa_DeleteTrustedDomain r;
1495
1496         r.in.handle = handle;
1497         r.in.dom_sid = sid;
1498
1499         torture_assert_ntstatus_ok(tctx, dcerpc_lsa_DeleteTrustedDomain_r(b, tctx, &r),
1500                 "DeleteTrustedDomain failed");
1501         if (!NT_STATUS_IS_OK(r.out.result)) {
1502                 torture_comment(tctx, "DeleteTrustedDomain failed - %s\n", nt_errstr(r.out.result));
1503                 return false;
1504         }
1505
1506         return true;
1507 }
1508
1509
1510 static bool test_CreateSecret(struct dcerpc_pipe *p,
1511                               struct torture_context *tctx,
1512                               struct policy_handle *handle)
1513 {
1514         NTSTATUS status;
1515         struct lsa_CreateSecret r;
1516         struct lsa_OpenSecret r2;
1517         struct lsa_SetSecret r3;
1518         struct lsa_QuerySecret r4;
1519         struct lsa_SetSecret r5;
1520         struct lsa_QuerySecret r6;
1521         struct lsa_SetSecret r7;
1522         struct lsa_QuerySecret r8;
1523         struct policy_handle sec_handle, sec_handle2, sec_handle3;
1524         struct lsa_DeleteObject d_o;
1525         struct lsa_DATA_BUF buf1;
1526         struct lsa_DATA_BUF_PTR bufp1;
1527         struct lsa_DATA_BUF_PTR bufp2;
1528         DATA_BLOB enc_key;
1529         bool ret = true;
1530         DATA_BLOB session_key;
1531         NTTIME old_mtime, new_mtime;
1532         DATA_BLOB blob1;
1533         const char *secret1 = "abcdef12345699qwerty";
1534         char *secret2;
1535         const char *secret3 = "ABCDEF12345699QWERTY";
1536         char *secret4;
1537         const char *secret5 = "NEW-SAMBA4-SECRET";
1538         char *secret6;
1539         char *secname[2];
1540         int i;
1541         const int LOCAL = 0;
1542         const int GLOBAL = 1;
1543         struct dcerpc_binding_handle *b = p->binding_handle;
1544
1545         secname[LOCAL] = talloc_asprintf(tctx, "torturesecret-%u", (unsigned int)random());
1546         secname[GLOBAL] = talloc_asprintf(tctx, "G$torturesecret-%u", (unsigned int)random());
1547
1548         for (i=0; i< 2; i++) {
1549                 torture_comment(tctx, "\nTesting CreateSecret of %s\n", secname[i]);
1550
1551                 init_lsa_String(&r.in.name, secname[i]);
1552
1553                 r.in.handle = handle;
1554                 r.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
1555                 r.out.sec_handle = &sec_handle;
1556
1557                 torture_assert_ntstatus_ok(tctx, dcerpc_lsa_CreateSecret_r(b, tctx, &r),
1558                         "CreateSecret failed");
1559                 if (!NT_STATUS_IS_OK(r.out.result)) {
1560                         torture_comment(tctx, "CreateSecret failed - %s\n", nt_errstr(r.out.result));
1561                         return false;
1562                 }
1563
1564                 r.in.handle = handle;
1565                 r.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
1566                 r.out.sec_handle = &sec_handle3;
1567
1568                 torture_assert_ntstatus_ok(tctx, dcerpc_lsa_CreateSecret_r(b, tctx, &r),
1569                         "CreateSecret failed");
1570                 if (!NT_STATUS_EQUAL(r.out.result, NT_STATUS_OBJECT_NAME_COLLISION)) {
1571                         torture_comment(tctx, "CreateSecret should have failed OBJECT_NAME_COLLISION - %s\n", nt_errstr(r.out.result));
1572                         return false;
1573                 }
1574
1575                 r2.in.handle = handle;
1576                 r2.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
1577                 r2.in.name = r.in.name;
1578                 r2.out.sec_handle = &sec_handle2;
1579
1580                 torture_comment(tctx, "Testing OpenSecret\n");
1581
1582                 torture_assert_ntstatus_ok(tctx, dcerpc_lsa_OpenSecret_r(b, tctx, &r2),
1583                         "OpenSecret failed");
1584                 if (!NT_STATUS_IS_OK(r2.out.result)) {
1585                         torture_comment(tctx, "OpenSecret failed - %s\n", nt_errstr(r2.out.result));
1586                         return false;
1587                 }
1588
1589                 status = dcerpc_fetch_session_key(p, &session_key);
1590                 if (!NT_STATUS_IS_OK(status)) {
1591                         torture_comment(tctx, "dcerpc_fetch_session_key failed - %s\n", nt_errstr(status));
1592                         return false;
1593                 }
1594
1595                 enc_key = sess_encrypt_string(secret1, &session_key);
1596
1597                 r3.in.sec_handle = &sec_handle;
1598                 r3.in.new_val = &buf1;
1599                 r3.in.old_val = NULL;
1600                 r3.in.new_val->data = enc_key.data;
1601                 r3.in.new_val->length = enc_key.length;
1602                 r3.in.new_val->size = enc_key.length;
1603
1604                 torture_comment(tctx, "Testing SetSecret\n");
1605
1606                 torture_assert_ntstatus_ok(tctx, dcerpc_lsa_SetSecret_r(b, tctx, &r3),
1607                         "SetSecret failed");
1608                 if (!NT_STATUS_IS_OK(r3.out.result)) {
1609                         torture_comment(tctx, "SetSecret failed - %s\n", nt_errstr(r3.out.result));
1610                         return false;
1611                 }
1612
1613                 r3.in.sec_handle = &sec_handle;
1614                 r3.in.new_val = &buf1;
1615                 r3.in.old_val = NULL;
1616                 r3.in.new_val->data = enc_key.data;
1617                 r3.in.new_val->length = enc_key.length;
1618                 r3.in.new_val->size = enc_key.length;
1619
1620                 /* break the encrypted data */
1621                 enc_key.data[0]++;
1622
1623                 torture_comment(tctx, "Testing SetSecret with broken key\n");
1624
1625                 torture_assert_ntstatus_ok(tctx, dcerpc_lsa_SetSecret_r(b, tctx, &r3),
1626                         "SetSecret failed");
1627                 if (!NT_STATUS_EQUAL(r3.out.result, NT_STATUS_UNKNOWN_REVISION)) {
1628                         torture_comment(tctx, "SetSecret should have failed UNKNOWN_REVISION - %s\n", nt_errstr(r3.out.result));
1629                         ret = false;
1630                 }
1631
1632                 data_blob_free(&enc_key);
1633
1634                 ZERO_STRUCT(new_mtime);
1635                 ZERO_STRUCT(old_mtime);
1636
1637                 /* fetch the secret back again */
1638                 r4.in.sec_handle = &sec_handle;
1639                 r4.in.new_val = &bufp1;
1640                 r4.in.new_mtime = &new_mtime;
1641                 r4.in.old_val = NULL;
1642                 r4.in.old_mtime = NULL;
1643
1644                 bufp1.buf = NULL;
1645
1646                 torture_comment(tctx, "Testing QuerySecret\n");
1647                 torture_assert_ntstatus_ok(tctx, dcerpc_lsa_QuerySecret_r(b, tctx, &r4),
1648                         "QuerySecret failed");
1649                 if (!NT_STATUS_IS_OK(r4.out.result)) {
1650                         torture_comment(tctx, "QuerySecret failed - %s\n", nt_errstr(r4.out.result));
1651                         ret = false;
1652                 } else {
1653                         if (r4.out.new_val == NULL || r4.out.new_val->buf == NULL) {
1654                                 torture_comment(tctx, "No secret buffer returned\n");
1655                                 ret = false;
1656                         } else {
1657                                 blob1.data = r4.out.new_val->buf->data;
1658                                 blob1.length = r4.out.new_val->buf->size;
1659
1660                                 secret2 = sess_decrypt_string(tctx,
1661                                                               &blob1, &session_key);
1662
1663                                 if (strcmp(secret1, secret2) != 0) {
1664                                         torture_comment(tctx, "Returned secret (r4) '%s' doesn't match '%s'\n",
1665                                                secret2, secret1);
1666                                         ret = false;
1667                                 }
1668                         }
1669                 }
1670
1671                 enc_key = sess_encrypt_string(secret3, &session_key);
1672
1673                 r5.in.sec_handle = &sec_handle;
1674                 r5.in.new_val = &buf1;
1675                 r5.in.old_val = NULL;
1676                 r5.in.new_val->data = enc_key.data;
1677                 r5.in.new_val->length = enc_key.length;
1678                 r5.in.new_val->size = enc_key.length;
1679
1680
1681                 smb_msleep(200);
1682                 torture_comment(tctx, "Testing SetSecret (existing value should move to old)\n");
1683
1684                 torture_assert_ntstatus_ok(tctx, dcerpc_lsa_SetSecret_r(b, tctx, &r5),
1685                         "SetSecret failed");
1686                 if (!NT_STATUS_IS_OK(r5.out.result)) {
1687                         torture_comment(tctx, "SetSecret failed - %s\n", nt_errstr(r5.out.result));
1688                         ret = false;
1689                 }
1690
1691                 data_blob_free(&enc_key);
1692
1693                 ZERO_STRUCT(new_mtime);
1694                 ZERO_STRUCT(old_mtime);
1695
1696                 /* fetch the secret back again */
1697                 r6.in.sec_handle = &sec_handle;
1698                 r6.in.new_val = &bufp1;
1699                 r6.in.new_mtime = &new_mtime;
1700                 r6.in.old_val = &bufp2;
1701                 r6.in.old_mtime = &old_mtime;
1702
1703                 bufp1.buf = NULL;
1704                 bufp2.buf = NULL;
1705
1706                 torture_assert_ntstatus_ok(tctx, dcerpc_lsa_QuerySecret_r(b, tctx, &r6),
1707                         "QuerySecret failed");
1708                 if (!NT_STATUS_IS_OK(r6.out.result)) {
1709                         torture_comment(tctx, "QuerySecret failed - %s\n", nt_errstr(r6.out.result));
1710                         ret = false;
1711                         secret4 = NULL;
1712                 } else {
1713
1714                         if (r6.out.new_val->buf == NULL || r6.out.old_val->buf == NULL
1715                                 || r6.out.new_mtime == NULL || r6.out.old_mtime == NULL) {
1716                                 torture_comment(tctx, "Both secret buffers and both times not returned\n");
1717                                 ret = false;
1718                                 secret4 = NULL;
1719                         } else {
1720                                 blob1.data = r6.out.new_val->buf->data;
1721                                 blob1.length = r6.out.new_val->buf->size;
1722
1723                                 secret4 = sess_decrypt_string(tctx,
1724                                                               &blob1, &session_key);
1725
1726                                 if (strcmp(secret3, secret4) != 0) {
1727                                         torture_comment(tctx, "Returned NEW secret %s doesn't match %s\n", secret4, secret3);
1728                                         ret = false;
1729                                 }
1730
1731                                 blob1.data = r6.out.old_val->buf->data;
1732                                 blob1.length = r6.out.old_val->buf->length;
1733
1734                                 secret2 = sess_decrypt_string(tctx,
1735                                                               &blob1, &session_key);
1736
1737                                 if (strcmp(secret1, secret2) != 0) {
1738                                         torture_comment(tctx, "Returned OLD secret %s doesn't match %s\n", secret2, secret1);
1739                                         ret = false;
1740                                 }
1741
1742                                 if (*r6.out.new_mtime == *r6.out.old_mtime) {
1743                                         torture_comment(tctx, "Returned secret (r6-%d) %s must not have same mtime for both secrets: %s != %s\n",
1744                                                i,
1745                                                secname[i],
1746                                                nt_time_string(tctx, *r6.out.old_mtime),
1747                                                nt_time_string(tctx, *r6.out.new_mtime));
1748                                         ret = false;
1749                                 }
1750                         }
1751                 }
1752
1753                 enc_key = sess_encrypt_string(secret5, &session_key);
1754
1755                 r7.in.sec_handle = &sec_handle;
1756                 r7.in.old_val = &buf1;
1757                 r7.in.old_val->data = enc_key.data;
1758                 r7.in.old_val->length = enc_key.length;
1759                 r7.in.old_val->size = enc_key.length;
1760                 r7.in.new_val = NULL;
1761
1762                 torture_comment(tctx, "Testing SetSecret of old Secret only\n");
1763
1764                 torture_assert_ntstatus_ok(tctx, dcerpc_lsa_SetSecret_r(b, tctx, &r7),
1765                         "SetSecret failed");
1766                 if (!NT_STATUS_IS_OK(r7.out.result)) {
1767                         torture_comment(tctx, "SetSecret failed - %s\n", nt_errstr(r7.out.result));
1768                         ret = false;
1769                 }
1770
1771                 data_blob_free(&enc_key);
1772
1773                 /* fetch the secret back again */
1774                 r8.in.sec_handle = &sec_handle;
1775                 r8.in.new_val = &bufp1;
1776                 r8.in.new_mtime = &new_mtime;
1777                 r8.in.old_val = &bufp2;
1778                 r8.in.old_mtime = &old_mtime;
1779
1780                 bufp1.buf = NULL;
1781                 bufp2.buf = NULL;
1782
1783                 torture_assert_ntstatus_ok(tctx, dcerpc_lsa_QuerySecret_r(b, tctx, &r8),
1784                         "QuerySecret failed");
1785                 if (!NT_STATUS_IS_OK(r8.out.result)) {
1786                         torture_comment(tctx, "QuerySecret failed - %s\n", nt_errstr(r8.out.result));
1787                         ret = false;
1788                 } else {
1789                         if (!r8.out.new_val || !r8.out.old_val) {
1790                                 torture_comment(tctx, "in/out pointers not returned, despite being set on in for QuerySecret\n");
1791                                 ret = false;
1792                         } else if (r8.out.new_val->buf != NULL) {
1793                                 torture_comment(tctx, "NEW secret buffer must not be returned after OLD set\n");
1794                                 ret = false;
1795                         } else if (r8.out.old_val->buf == NULL) {
1796                                 torture_comment(tctx, "OLD secret buffer was not returned after OLD set\n");
1797                                 ret = false;
1798                         } else if (r8.out.new_mtime == NULL || r8.out.old_mtime == NULL) {
1799                                 torture_comment(tctx, "Both times not returned after OLD set\n");
1800                                 ret = false;
1801                         } else {
1802                                 blob1.data = r8.out.old_val->buf->data;
1803                                 blob1.length = r8.out.old_val->buf->size;
1804
1805                                 secret6 = sess_decrypt_string(tctx,
1806                                                               &blob1, &session_key);
1807
1808                                 if (strcmp(secret5, secret6) != 0) {
1809                                         torture_comment(tctx, "Returned OLD secret %s doesn't match %s\n", secret5, secret6);
1810                                         ret = false;
1811                                 }
1812
1813                                 if (*r8.out.new_mtime != *r8.out.old_mtime) {
1814                                         torture_comment(tctx, "Returned secret (r8) %s did not had same mtime for both secrets: %s != %s\n",
1815                                                secname[i],
1816                                                nt_time_string(tctx, *r8.out.old_mtime),
1817                                                nt_time_string(tctx, *r8.out.new_mtime));
1818                                         ret = false;
1819                                 }
1820                         }
1821                 }
1822
1823                 if (!test_Delete(b, tctx, &sec_handle)) {
1824                         ret = false;
1825                 }
1826
1827                 if (!test_DeleteObject(b, tctx, &sec_handle)) {
1828                         return false;
1829                 }
1830
1831                 d_o.in.handle = &sec_handle2;
1832                 d_o.out.handle = &sec_handle2;
1833                 torture_assert_ntstatus_ok(tctx, dcerpc_lsa_DeleteObject_r(b, tctx, &d_o),
1834                         "DeleteObject failed");
1835                 if (!NT_STATUS_EQUAL(d_o.out.result, NT_STATUS_INVALID_HANDLE)) {
1836                         torture_comment(tctx, "Second delete expected INVALID_HANDLE - %s\n", nt_errstr(d_o.out.result));
1837                         ret = false;
1838                 } else {
1839
1840                         torture_comment(tctx, "Testing OpenSecret of just-deleted secret\n");
1841
1842                         torture_assert_ntstatus_ok(tctx, dcerpc_lsa_OpenSecret_r(b, tctx, &r2),
1843                                 "OpenSecret failed");
1844                         if (!NT_STATUS_EQUAL(r2.out.result, NT_STATUS_OBJECT_NAME_NOT_FOUND)) {
1845                                 torture_comment(tctx, "OpenSecret expected OBJECT_NAME_NOT_FOUND - %s\n", nt_errstr(r2.out.result));
1846                                 ret = false;
1847                         }
1848                 }
1849
1850         }
1851
1852         return ret;
1853 }
1854
1855
1856 static bool test_EnumAccountRights(struct dcerpc_binding_handle *b,
1857                                    struct torture_context *tctx,
1858                                    struct policy_handle *acct_handle,
1859                                    struct dom_sid *sid)
1860 {
1861         struct lsa_EnumAccountRights r;
1862         struct lsa_RightSet rights;
1863
1864         torture_comment(tctx, "\nTesting EnumAccountRights\n");
1865
1866         r.in.handle = acct_handle;
1867         r.in.sid = sid;
1868         r.out.rights = &rights;
1869
1870         torture_assert_ntstatus_ok(tctx, dcerpc_lsa_EnumAccountRights_r(b, tctx, &r),
1871                 "EnumAccountRights failed");
1872         if (!NT_STATUS_IS_OK(r.out.result)) {
1873                 torture_comment(tctx, "EnumAccountRights of %s failed - %s\n",
1874                        dom_sid_string(tctx, sid), nt_errstr(r.out.result));
1875                 return false;
1876         }
1877
1878         return true;
1879 }
1880
1881
1882 static bool test_QuerySecurity(struct dcerpc_binding_handle *b,
1883                              struct torture_context *tctx,
1884                              struct policy_handle *handle,
1885                              struct policy_handle *acct_handle)
1886 {
1887         struct lsa_QuerySecurity r;
1888         struct sec_desc_buf *sdbuf = NULL;
1889
1890         if (torture_setting_bool(tctx, "samba4", false)) {
1891                 torture_comment(tctx, "\nskipping QuerySecurity test against Samba4\n");
1892                 return true;
1893         }
1894
1895         torture_comment(tctx, "\nTesting QuerySecurity\n");
1896
1897         r.in.handle = acct_handle;
1898         r.in.sec_info = SECINFO_OWNER |
1899                         SECINFO_GROUP |
1900                         SECINFO_DACL;
1901         r.out.sdbuf = &sdbuf;
1902
1903         torture_assert_ntstatus_ok(tctx, dcerpc_lsa_QuerySecurity_r(b, tctx, &r),
1904                 "QuerySecurity failed");
1905         if (!NT_STATUS_IS_OK(r.out.result)) {
1906                 torture_comment(tctx, "QuerySecurity failed - %s\n", nt_errstr(r.out.result));
1907                 return false;
1908         }
1909
1910         return true;
1911 }
1912
1913 static bool test_OpenAccount(struct dcerpc_binding_handle *b,
1914                              struct torture_context *tctx,
1915                              struct policy_handle *handle,
1916                              struct dom_sid *sid)
1917 {
1918         struct lsa_OpenAccount r;
1919         struct policy_handle acct_handle;
1920
1921         torture_comment(tctx, "\nTesting OpenAccount\n");
1922
1923         r.in.handle = handle;
1924         r.in.sid = sid;
1925         r.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
1926         r.out.acct_handle = &acct_handle;
1927
1928         torture_assert_ntstatus_ok(tctx, dcerpc_lsa_OpenAccount_r(b, tctx, &r),
1929                 "OpenAccount failed");
1930         if (!NT_STATUS_IS_OK(r.out.result)) {
1931                 torture_comment(tctx, "OpenAccount failed - %s\n", nt_errstr(r.out.result));
1932                 return false;
1933         }
1934
1935         if (!test_EnumPrivsAccount(b, tctx, handle, &acct_handle)) {
1936                 return false;
1937         }
1938
1939         if (!test_GetSystemAccessAccount(b, tctx, handle, &acct_handle)) {
1940                 return false;
1941         }
1942
1943         if (!test_QuerySecurity(b, tctx, handle, &acct_handle)) {
1944                 return false;
1945         }
1946
1947         return true;
1948 }
1949
1950 static bool test_EnumAccounts(struct dcerpc_binding_handle *b,
1951                               struct torture_context *tctx,
1952                               struct policy_handle *handle)
1953 {
1954         struct lsa_EnumAccounts r;
1955         struct lsa_SidArray sids1, sids2;
1956         uint32_t resume_handle = 0;
1957         int i;
1958         bool ret = true;
1959
1960         torture_comment(tctx, "\nTesting EnumAccounts\n");
1961
1962         r.in.handle = handle;
1963         r.in.resume_handle = &resume_handle;
1964         r.in.num_entries = 100;
1965         r.out.resume_handle = &resume_handle;
1966         r.out.sids = &sids1;
1967
1968         resume_handle = 0;
1969         while (true) {
1970                 torture_assert_ntstatus_ok(tctx, dcerpc_lsa_EnumAccounts_r(b, tctx, &r),
1971                         "EnumAccounts failed");
1972                 if (NT_STATUS_EQUAL(r.out.result, NT_STATUS_NO_MORE_ENTRIES)) {
1973                         break;
1974                 }
1975                 if (!NT_STATUS_IS_OK(r.out.result)) {
1976                         torture_comment(tctx, "EnumAccounts failed - %s\n", nt_errstr(r.out.result));
1977                         return false;
1978                 }
1979
1980                 if (!test_LookupSids(b, tctx, handle, &sids1)) {
1981                         return false;
1982                 }
1983
1984                 if (!test_LookupSids2(b, tctx, handle, &sids1)) {
1985                         return false;
1986                 }
1987
1988                 /* Can't test lookupSids3 here, as clearly we must not
1989                  * be on schannel, or we would not be able to do the
1990                  * rest */
1991
1992                 torture_comment(tctx, "Testing all accounts\n");
1993                 for (i=0;i<sids1.num_sids;i++) {
1994                         ret &= test_OpenAccount(b, tctx, handle, sids1.sids[i].sid);
1995                         ret &= test_EnumAccountRights(b, tctx, handle, sids1.sids[i].sid);
1996                 }
1997                 torture_comment(tctx, "\n");
1998         }
1999
2000         if (sids1.num_sids < 3) {
2001                 return ret;
2002         }
2003
2004         torture_comment(tctx, "Trying EnumAccounts partial listing (asking for 1 at 2)\n");
2005         resume_handle = 2;
2006         r.in.num_entries = 1;
2007         r.out.sids = &sids2;
2008
2009         torture_assert_ntstatus_ok(tctx, dcerpc_lsa_EnumAccounts_r(b, tctx, &r),
2010                 "EnumAccounts failed");
2011         if (!NT_STATUS_IS_OK(r.out.result)) {
2012                 torture_comment(tctx, "EnumAccounts failed - %s\n", nt_errstr(r.out.result));
2013                 return false;
2014         }
2015
2016         if (sids2.num_sids != 1) {
2017                 torture_comment(tctx, "Returned wrong number of entries (%d)\n", sids2.num_sids);
2018                 return false;
2019         }
2020
2021         return true;
2022 }
2023
2024 static bool test_LookupPrivDisplayName(struct dcerpc_binding_handle *b,
2025                                        struct torture_context *tctx,
2026                                        struct policy_handle *handle,
2027                                        struct lsa_String *priv_name)
2028 {
2029         struct lsa_LookupPrivDisplayName r;
2030         /* produce a reasonable range of language output without screwing up
2031            terminals */
2032         uint16_t language_id = (random() % 4) + 0x409;
2033         uint16_t returned_language_id = 0;
2034         struct lsa_StringLarge *disp_name = NULL;
2035
2036         torture_comment(tctx, "\nTesting LookupPrivDisplayName(%s)\n", priv_name->string);
2037
2038         r.in.handle = handle;
2039         r.in.name = priv_name;
2040         r.in.language_id = language_id;
2041         r.in.language_id_sys = 0;
2042         r.out.returned_language_id = &returned_language_id;
2043         r.out.disp_name = &disp_name;
2044
2045         torture_assert_ntstatus_ok(tctx, dcerpc_lsa_LookupPrivDisplayName_r(b, tctx, &r),
2046                 "LookupPrivDisplayName failed");
2047         if (!NT_STATUS_IS_OK(r.out.result)) {
2048                 torture_comment(tctx, "LookupPrivDisplayName failed - %s\n", nt_errstr(r.out.result));
2049                 return false;
2050         }
2051         torture_comment(tctx, "%s -> \"%s\"  (language 0x%x/0x%x)\n",
2052                priv_name->string, disp_name->string,
2053                r.in.language_id, *r.out.returned_language_id);
2054
2055         return true;
2056 }
2057
2058 static bool test_EnumAccountsWithUserRight(struct dcerpc_binding_handle *b,
2059                                            struct torture_context *tctx,
2060                                            struct policy_handle *handle,
2061                                            struct lsa_String *priv_name)
2062 {
2063         struct lsa_EnumAccountsWithUserRight r;
2064         struct lsa_SidArray sids;
2065
2066         ZERO_STRUCT(sids);
2067
2068         torture_comment(tctx, "\nTesting EnumAccountsWithUserRight(%s)\n", priv_name->string);
2069
2070         r.in.handle = handle;
2071         r.in.name = priv_name;
2072         r.out.sids = &sids;
2073
2074         torture_assert_ntstatus_ok(tctx, dcerpc_lsa_EnumAccountsWithUserRight_r(b, tctx, &r),
2075                 "EnumAccountsWithUserRight failed");
2076
2077         /* NT_STATUS_NO_MORE_ENTRIES means noone has this privilege */
2078         if (NT_STATUS_EQUAL(r.out.result, NT_STATUS_NO_MORE_ENTRIES)) {
2079                 return true;
2080         }
2081
2082         if (!NT_STATUS_IS_OK(r.out.result)) {
2083                 torture_comment(tctx, "EnumAccountsWithUserRight failed - %s\n", nt_errstr(r.out.result));
2084                 return false;
2085         }
2086
2087         return true;
2088 }
2089
2090
2091 static bool test_EnumPrivs(struct dcerpc_binding_handle *b,
2092                            struct torture_context *tctx,
2093                            struct policy_handle *handle)
2094 {
2095         struct lsa_EnumPrivs r;
2096         struct lsa_PrivArray privs1;
2097         uint32_t resume_handle = 0;
2098         int i;
2099         bool ret = true;
2100
2101         torture_comment(tctx, "\nTesting EnumPrivs\n");
2102
2103         r.in.handle = handle;
2104         r.in.resume_handle = &resume_handle;
2105         r.in.max_count = 100;
2106         r.out.resume_handle = &resume_handle;
2107         r.out.privs = &privs1;
2108
2109         resume_handle = 0;
2110         torture_assert_ntstatus_ok(tctx, dcerpc_lsa_EnumPrivs_r(b, tctx, &r),
2111                 "EnumPrivs failed");
2112         if (!NT_STATUS_IS_OK(r.out.result)) {
2113                 torture_comment(tctx, "EnumPrivs failed - %s\n", nt_errstr(r.out.result));
2114                 return false;
2115         }
2116
2117         for (i = 0; i< privs1.count; i++) {
2118                 test_LookupPrivDisplayName(b, tctx, handle, (struct lsa_String *)&privs1.privs[i].name);
2119                 test_LookupPrivValue(b, tctx, handle, (struct lsa_String *)&privs1.privs[i].name);
2120                 if (!test_EnumAccountsWithUserRight(b, tctx, handle, (struct lsa_String *)&privs1.privs[i].name)) {
2121                         ret = false;
2122                 }
2123         }
2124
2125         return ret;
2126 }
2127
2128 static bool test_QueryForestTrustInformation(struct dcerpc_binding_handle *b,
2129                                              struct torture_context *tctx,
2130                                              struct policy_handle *handle,
2131                                              const char *trusted_domain_name)
2132 {
2133         bool ret = true;
2134         struct lsa_lsaRQueryForestTrustInformation r;
2135         struct lsa_String string;
2136         struct lsa_ForestTrustInformation info, *info_ptr;
2137
2138         torture_comment(tctx, "\nTesting lsaRQueryForestTrustInformation\n");
2139
2140         if (torture_setting_bool(tctx, "samba4", false)) {
2141                 torture_comment(tctx, "skipping QueryForestTrustInformation against Samba4\n");
2142                 return true;
2143         }
2144
2145         ZERO_STRUCT(string);
2146
2147         if (trusted_domain_name) {
2148                 init_lsa_String(&string, trusted_domain_name);
2149         }
2150
2151         info_ptr = &info;
2152
2153         r.in.handle = handle;
2154         r.in.trusted_domain_name = &string;
2155         r.in.unknown = 0;
2156         r.out.forest_trust_info = &info_ptr;
2157
2158         torture_assert_ntstatus_ok(tctx, dcerpc_lsa_lsaRQueryForestTrustInformation_r(b, tctx, &r),
2159                 "lsaRQueryForestTrustInformation failed");
2160
2161         if (!NT_STATUS_IS_OK(r.out.result)) {
2162                 torture_comment(tctx, "lsaRQueryForestTrustInformation of %s failed - %s\n", trusted_domain_name, nt_errstr(r.out.result));
2163                 ret = false;
2164         }
2165
2166         return ret;
2167 }
2168
2169 static bool test_query_each_TrustDomEx(struct dcerpc_binding_handle *b,
2170                                        struct torture_context *tctx,
2171                                        struct policy_handle *handle,
2172                                        struct lsa_DomainListEx *domains)
2173 {
2174         int i;
2175         bool ret = true;
2176
2177         for (i=0; i< domains->count; i++) {
2178
2179                 if (domains->domains[i].trust_attributes & NETR_TRUST_ATTRIBUTE_FOREST_TRANSITIVE) {
2180                         ret &= test_QueryForestTrustInformation(b, tctx, handle,
2181                                                                 domains->domains[i].domain_name.string);
2182                 }
2183         }
2184
2185         return ret;
2186 }
2187
2188 static bool test_query_each_TrustDom(struct dcerpc_binding_handle *b,
2189                                      struct torture_context *tctx,
2190                                      struct policy_handle *handle,
2191                                      struct lsa_DomainList *domains)
2192 {
2193         int i,j;
2194         bool ret = true;
2195
2196         torture_comment(tctx, "\nTesting OpenTrustedDomain, OpenTrustedDomainByName and QueryInfoTrustedDomain\n");
2197         for (i=0; i< domains->count; i++) {
2198                 struct lsa_OpenTrustedDomain trust;
2199                 struct lsa_OpenTrustedDomainByName trust_by_name;
2200                 struct policy_handle trustdom_handle;
2201                 struct policy_handle handle2;
2202                 struct lsa_Close c;
2203                 struct lsa_CloseTrustedDomainEx c_trust;
2204                 int levels [] = {1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13};
2205                 int ok[]      = {1, 0, 1, 0, 0, 1, 0, 1, 0,  0,  0,  1, 1};
2206
2207                 if (domains->domains[i].sid) {
2208                         trust.in.handle = handle;
2209                         trust.in.sid = domains->domains[i].sid;
2210                         trust.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
2211                         trust.out.trustdom_handle = &trustdom_handle;
2212
2213                         torture_assert_ntstatus_ok(tctx, dcerpc_lsa_OpenTrustedDomain_r(b, tctx, &trust),
2214                                 "OpenTrustedDomain failed");
2215
2216                         if (!NT_STATUS_IS_OK(trust.out.result)) {
2217                                 torture_comment(tctx, "OpenTrustedDomain failed - %s\n", nt_errstr(trust.out.result));
2218                                 return false;
2219                         }
2220
2221                         c.in.handle = &trustdom_handle;
2222                         c.out.handle = &handle2;
2223
2224                         c_trust.in.handle = &trustdom_handle;
2225                         c_trust.out.handle = &handle2;
2226
2227                         for (j=0; j < ARRAY_SIZE(levels); j++) {
2228                                 struct lsa_QueryTrustedDomainInfo q;
2229                                 union lsa_TrustedDomainInfo *info = NULL;
2230                                 q.in.trustdom_handle = &trustdom_handle;
2231                                 q.in.level = levels[j];
2232                                 q.out.info = &info;
2233                                 torture_assert_ntstatus_ok(tctx, dcerpc_lsa_QueryTrustedDomainInfo_r(b, tctx, &q),
2234                                         "QueryTrustedDomainInfo failed");
2235                                 if (!NT_STATUS_IS_OK(q.out.result) && ok[j]) {
2236                                         torture_comment(tctx, "QueryTrustedDomainInfo level %d failed - %s\n",
2237                                                levels[j], nt_errstr(q.out.result));
2238                                         ret = false;
2239                                 } else if (NT_STATUS_IS_OK(q.out.result) && !ok[j]) {
2240                                         torture_comment(tctx, "QueryTrustedDomainInfo level %d unexpectedly succeeded - %s\n",
2241                                                levels[j], nt_errstr(q.out.result));
2242                                         ret = false;
2243                                 }
2244                         }
2245
2246                         torture_assert_ntstatus_ok(tctx, dcerpc_lsa_CloseTrustedDomainEx_r(b, tctx, &c_trust),
2247                                 "CloseTrustedDomainEx failed");
2248                         if (!NT_STATUS_EQUAL(c_trust.out.result, NT_STATUS_NOT_IMPLEMENTED)) {
2249                                 torture_comment(tctx, "Expected CloseTrustedDomainEx to return NT_STATUS_NOT_IMPLEMENTED, instead - %s\n", nt_errstr(c_trust.out.result));
2250                                 return false;
2251                         }
2252
2253                         c.in.handle = &trustdom_handle;
2254                         c.out.handle = &handle2;
2255
2256                         torture_assert_ntstatus_ok(tctx, dcerpc_lsa_Close_r(b, tctx, &c),
2257                                 "Close failed");
2258                         if (!NT_STATUS_IS_OK(c.out.result)) {
2259                                 torture_comment(tctx, "Close of trusted domain failed - %s\n", nt_errstr(c.out.result));
2260                                 return false;
2261                         }
2262
2263                         for (j=0; j < ARRAY_SIZE(levels); j++) {
2264                                 struct lsa_QueryTrustedDomainInfoBySid q;
2265                                 union lsa_TrustedDomainInfo *info = NULL;
2266
2267                                 if (!domains->domains[i].sid) {
2268                                         continue;
2269                                 }
2270
2271                                 q.in.handle  = handle;
2272                                 q.in.dom_sid = domains->domains[i].sid;
2273                                 q.in.level   = levels[j];
2274                                 q.out.info   = &info;
2275
2276                                 torture_assert_ntstatus_ok(tctx, dcerpc_lsa_QueryTrustedDomainInfoBySid_r(b, tctx, &q),
2277                                         "lsa_QueryTrustedDomainInfoBySid failed");
2278                                 if (!NT_STATUS_IS_OK(q.out.result) && ok[j]) {
2279                                         torture_comment(tctx, "QueryTrustedDomainInfoBySid level %d failed - %s\n",
2280                                                levels[j], nt_errstr(q.out.result));
2281                                         ret = false;
2282                                 } else if (NT_STATUS_IS_OK(q.out.result) && !ok[j]) {
2283                                         torture_comment(tctx, "QueryTrustedDomainInfoBySid level %d unexpectedly succeeded - %s\n",
2284                                                levels[j], nt_errstr(q.out.result));
2285                                         ret = false;
2286                                 }
2287                         }
2288                 }
2289
2290                 trust_by_name.in.handle = handle;
2291                 trust_by_name.in.name.string = domains->domains[i].name.string;
2292                 trust_by_name.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
2293                 trust_by_name.out.trustdom_handle = &trustdom_handle;
2294
2295                 torture_assert_ntstatus_ok(tctx, dcerpc_lsa_OpenTrustedDomainByName_r(b, tctx, &trust_by_name),
2296                         "OpenTrustedDomainByName failed");
2297
2298                 if (!NT_STATUS_IS_OK(trust_by_name.out.result)) {
2299                         torture_comment(tctx, "OpenTrustedDomainByName failed - %s\n", nt_errstr(trust_by_name.out.result));
2300                         return false;
2301                 }
2302
2303                 for (j=0; j < ARRAY_SIZE(levels); j++) {
2304                         struct lsa_QueryTrustedDomainInfo q;
2305                         union lsa_TrustedDomainInfo *info = NULL;
2306                         q.in.trustdom_handle = &trustdom_handle;
2307                         q.in.level = levels[j];
2308                         q.out.info = &info;
2309                         torture_assert_ntstatus_ok(tctx, dcerpc_lsa_QueryTrustedDomainInfo_r(b, tctx, &q),
2310                                 "QueryTrustedDomainInfo failed");
2311                         if (!NT_STATUS_IS_OK(q.out.result) && ok[j]) {
2312                                 torture_comment(tctx, "QueryTrustedDomainInfo level %d failed - %s\n",
2313                                        levels[j], nt_errstr(q.out.result));
2314                                 ret = false;
2315                         } else if (NT_STATUS_IS_OK(q.out.result) && !ok[j]) {
2316                                 torture_comment(tctx, "QueryTrustedDomainInfo level %d unexpectedly succeeded - %s\n",
2317                                        levels[j], nt_errstr(q.out.result));
2318                                 ret = false;
2319                         }
2320                 }
2321
2322                 c.in.handle = &trustdom_handle;
2323                 c.out.handle = &handle2;
2324
2325                 torture_assert_ntstatus_ok(tctx, dcerpc_lsa_Close_r(b, tctx, &c),
2326                         "Close failed");
2327                 if (!NT_STATUS_IS_OK(c.out.result)) {
2328                         torture_comment(tctx, "Close of trusted domain failed - %s\n", nt_errstr(c.out.result));
2329                         return false;
2330                 }
2331
2332                 for (j=0; j < ARRAY_SIZE(levels); j++) {
2333                         struct lsa_QueryTrustedDomainInfoByName q;
2334                         union lsa_TrustedDomainInfo *info = NULL;
2335                         struct lsa_String name;
2336
2337                         name.string = domains->domains[i].name.string;
2338
2339                         q.in.handle         = handle;
2340                         q.in.trusted_domain = &name;
2341                         q.in.level          = levels[j];
2342                         q.out.info          = &info;
2343                         torture_assert_ntstatus_ok(tctx, dcerpc_lsa_QueryTrustedDomainInfoByName_r(b, tctx, &q),
2344                                 "QueryTrustedDomainInfoByName failed");
2345                         if (!NT_STATUS_IS_OK(q.out.result) && ok[j]) {
2346                                 torture_comment(tctx, "QueryTrustedDomainInfoByName level %d failed - %s\n",
2347                                        levels[j], nt_errstr(q.out.result));
2348                                 ret = false;
2349                         } else if (NT_STATUS_IS_OK(q.out.result) && !ok[j]) {
2350                                 torture_comment(tctx, "QueryTrustedDomainInfoByName level %d unexpectedly succeeded - %s\n",
2351                                        levels[j], nt_errstr(q.out.result));
2352                                 ret = false;
2353                         }
2354                 }
2355         }
2356         return ret;
2357 }
2358
2359 static bool test_EnumTrustDom(struct dcerpc_binding_handle *b,
2360                               struct torture_context *tctx,
2361                               struct policy_handle *handle)
2362 {
2363         struct lsa_EnumTrustDom r;
2364         uint32_t in_resume_handle = 0;
2365         uint32_t out_resume_handle;
2366         struct lsa_DomainList domains;
2367         bool ret = true;
2368
2369         torture_comment(tctx, "\nTesting EnumTrustDom\n");
2370
2371         r.in.handle = handle;
2372         r.in.resume_handle = &in_resume_handle;
2373         r.in.max_size = 0;
2374         r.out.domains = &domains;
2375         r.out.resume_handle = &out_resume_handle;
2376
2377         torture_assert_ntstatus_ok(tctx, dcerpc_lsa_EnumTrustDom_r(b, tctx, &r),
2378                 "lsa_EnumTrustDom failed");
2379
2380         /* according to MS-LSAD 3.1.4.7.8 output resume handle MUST
2381          * always be larger than the previous input resume handle, in
2382          * particular when hitting the last query it is vital to set the
2383          * resume handle correctly to avoid infinite client loops, as
2384          * seen e.g.  with Windows XP SP3 when resume handle is 0 and
2385          * status is NT_STATUS_OK - gd */
2386
2387         if (NT_STATUS_IS_OK(r.out.result) ||
2388             NT_STATUS_EQUAL(r.out.result, NT_STATUS_NO_MORE_ENTRIES) ||
2389             NT_STATUS_EQUAL(r.out.result, STATUS_MORE_ENTRIES))
2390         {
2391                 if (out_resume_handle <= in_resume_handle) {
2392                         torture_comment(tctx, "EnumTrustDom failed - should have returned output resume_handle (0x%08x) larger than input resume handle (0x%08x)\n",
2393                                 out_resume_handle, in_resume_handle);
2394                         return false;
2395                 }
2396         }
2397
2398         if (NT_STATUS_IS_OK(r.out.result)) {
2399                 if (domains.count == 0) {
2400                         torture_comment(tctx, "EnumTrustDom failed - should have returned 'NT_STATUS_NO_MORE_ENTRIES' for 0 trusted domains\n");
2401                         return false;
2402                 }
2403         } else if (!(NT_STATUS_EQUAL(r.out.result, STATUS_MORE_ENTRIES) || NT_STATUS_EQUAL(r.out.result, NT_STATUS_NO_MORE_ENTRIES))) {
2404                 torture_comment(tctx, "EnumTrustDom of zero size failed - %s\n", nt_errstr(r.out.result));
2405                 return false;
2406         }
2407
2408         /* Start from the bottom again */
2409         in_resume_handle = 0;
2410
2411         do {
2412                 r.in.handle = handle;
2413                 r.in.resume_handle = &in_resume_handle;
2414                 r.in.max_size = LSA_ENUM_TRUST_DOMAIN_MULTIPLIER * 3;
2415                 r.out.domains = &domains;
2416                 r.out.resume_handle = &out_resume_handle;
2417
2418                 torture_assert_ntstatus_ok(tctx, dcerpc_lsa_EnumTrustDom_r(b, tctx, &r),
2419                         "EnumTrustDom failed");
2420
2421                 /* according to MS-LSAD 3.1.4.7.8 output resume handle MUST
2422                  * always be larger than the previous input resume handle, in
2423                  * particular when hitting the last query it is vital to set the
2424                  * resume handle correctly to avoid infinite client loops, as
2425                  * seen e.g.  with Windows XP SP3 when resume handle is 0 and
2426                  * status is NT_STATUS_OK - gd */
2427
2428                 if (NT_STATUS_IS_OK(r.out.result) ||
2429                     NT_STATUS_EQUAL(r.out.result, NT_STATUS_NO_MORE_ENTRIES) ||
2430                     NT_STATUS_EQUAL(r.out.result, STATUS_MORE_ENTRIES))
2431                 {
2432                         if (out_resume_handle <= in_resume_handle) {
2433                                 torture_comment(tctx, "EnumTrustDom failed - should have returned output resume_handle (0x%08x) larger than input resume handle (0x%08x)\n",
2434                                         out_resume_handle, in_resume_handle);
2435                                 return false;
2436                         }
2437                 }
2438
2439                 /* NO_MORE_ENTRIES is allowed */
2440                 if (NT_STATUS_EQUAL(r.out.result, NT_STATUS_NO_MORE_ENTRIES)) {
2441                         if (domains.count == 0) {
2442                                 return true;
2443                         }
2444                         torture_comment(tctx, "EnumTrustDom failed - should have returned 0 trusted domains with 'NT_STATUS_NO_MORE_ENTRIES'\n");
2445                         return false;
2446                 } else if (NT_STATUS_EQUAL(r.out.result, STATUS_MORE_ENTRIES)) {
2447                         /* Windows 2003 gets this off by one on the first run */
2448                         if (r.out.domains->count < 3 || r.out.domains->count > 4) {
2449                                 torture_comment(tctx, "EnumTrustDom didn't fill the buffer we "
2450                                        "asked it to (got %d, expected %d / %d == %d entries)\n",
2451                                        r.out.domains->count, LSA_ENUM_TRUST_DOMAIN_MULTIPLIER * 3,
2452                                        LSA_ENUM_TRUST_DOMAIN_MULTIPLIER, r.in.max_size);
2453                                 ret = false;
2454                         }
2455                 } else if (!NT_STATUS_IS_OK(r.out.result)) {
2456                         torture_comment(tctx, "EnumTrustDom failed - %s\n", nt_errstr(r.out.result));
2457                         return false;
2458                 }
2459
2460                 if (domains.count == 0) {
2461                         torture_comment(tctx, "EnumTrustDom failed - should have returned 'NT_STATUS_NO_MORE_ENTRIES' for 0 trusted domains\n");
2462                         return false;
2463                 }
2464
2465                 ret &= test_query_each_TrustDom(b, tctx, handle, &domains);
2466
2467                 in_resume_handle = out_resume_handle;
2468
2469         } while ((NT_STATUS_EQUAL(r.out.result, STATUS_MORE_ENTRIES)));
2470
2471         return ret;
2472 }
2473
2474 static bool test_EnumTrustDomEx(struct dcerpc_binding_handle *b,
2475                                 struct torture_context *tctx,
2476                                 struct policy_handle *handle)
2477 {
2478         struct lsa_EnumTrustedDomainsEx r_ex;
2479         uint32_t resume_handle = 0;
2480         struct lsa_DomainListEx domains_ex;
2481         bool ret = true;
2482
2483         torture_comment(tctx, "\nTesting EnumTrustedDomainsEx\n");
2484
2485         r_ex.in.handle = handle;
2486         r_ex.in.resume_handle = &resume_handle;
2487         r_ex.in.max_size = LSA_ENUM_TRUST_DOMAIN_EX_MULTIPLIER * 3;
2488         r_ex.out.domains = &domains_ex;
2489         r_ex.out.resume_handle = &resume_handle;
2490
2491         torture_assert_ntstatus_ok(tctx, dcerpc_lsa_EnumTrustedDomainsEx_r(b, tctx, &r_ex),
2492                 "EnumTrustedDomainsEx failed");
2493
2494         if (!(NT_STATUS_EQUAL(r_ex.out.result, STATUS_MORE_ENTRIES) || NT_STATUS_EQUAL(r_ex.out.result, NT_STATUS_NO_MORE_ENTRIES))) {
2495                 torture_comment(tctx, "EnumTrustedDomainEx of zero size failed - %s\n", nt_errstr(r_ex.out.result));
2496                 return false;
2497         }
2498
2499         resume_handle = 0;
2500         do {
2501                 r_ex.in.handle = handle;
2502                 r_ex.in.resume_handle = &resume_handle;
2503                 r_ex.in.max_size = LSA_ENUM_TRUST_DOMAIN_EX_MULTIPLIER * 3;
2504                 r_ex.out.domains = &domains_ex;
2505                 r_ex.out.resume_handle = &resume_handle;
2506
2507                 torture_assert_ntstatus_ok(tctx, dcerpc_lsa_EnumTrustedDomainsEx_r(b, tctx, &r_ex),
2508                         "EnumTrustedDomainsEx failed");
2509
2510                 /* NO_MORE_ENTRIES is allowed */
2511                 if (NT_STATUS_EQUAL(r_ex.out.result, NT_STATUS_NO_MORE_ENTRIES)) {
2512                         if (domains_ex.count == 0) {
2513                                 return true;
2514                         }
2515                         torture_comment(tctx, "EnumTrustDomainsEx failed - should have returned 0 trusted domains with 'NT_STATUS_NO_MORE_ENTRIES'\n");
2516                         return false;
2517                 } else if (NT_STATUS_EQUAL(r_ex.out.result, STATUS_MORE_ENTRIES)) {
2518                         /* Windows 2003 gets this off by one on the first run */
2519                         if (r_ex.out.domains->count < 3 || r_ex.out.domains->count > 4) {
2520                                 torture_comment(tctx, "EnumTrustDom didn't fill the buffer we "
2521                                        "asked it to (got %d, expected %d / %d == %d entries)\n",
2522                                        r_ex.out.domains->count,
2523                                        r_ex.in.max_size,
2524                                        LSA_ENUM_TRUST_DOMAIN_EX_MULTIPLIER,
2525                                        r_ex.in.max_size / LSA_ENUM_TRUST_DOMAIN_EX_MULTIPLIER);
2526                         }
2527                 } else if (!NT_STATUS_IS_OK(r_ex.out.result)) {
2528                         torture_comment(tctx, "EnumTrustedDomainEx failed - %s\n", nt_errstr(r_ex.out.result));
2529                         return false;
2530                 }
2531
2532                 if (domains_ex.count == 0) {
2533                         torture_comment(tctx, "EnumTrustDomainEx failed - should have returned 'NT_STATUS_NO_MORE_ENTRIES' for 0 trusted domains\n");
2534                         return false;
2535                 }
2536
2537                 ret &= test_query_each_TrustDomEx(b, tctx, handle, &domains_ex);
2538
2539         } while ((NT_STATUS_EQUAL(r_ex.out.result, STATUS_MORE_ENTRIES)));
2540
2541         return ret;
2542 }
2543
2544
2545 static bool test_CreateTrustedDomain(struct dcerpc_binding_handle *b,
2546                                      struct torture_context *tctx,
2547                                      struct policy_handle *handle,
2548                                      uint32_t num_trusts)
2549 {
2550         bool ret = true;
2551         struct lsa_CreateTrustedDomain r;
2552         struct lsa_DomainInfo trustinfo;
2553         struct dom_sid **domsid;
2554         struct policy_handle *trustdom_handle;
2555         struct lsa_QueryTrustedDomainInfo q;
2556         union lsa_TrustedDomainInfo *info = NULL;
2557         int i;
2558
2559         torture_comment(tctx, "\nTesting CreateTrustedDomain for %d domains\n", num_trusts);
2560
2561         if (!test_EnumTrustDom(b, tctx, handle)) {
2562                 ret = false;
2563         }
2564
2565         if (!test_EnumTrustDomEx(b, tctx, handle)) {
2566                 ret = false;
2567         }
2568
2569         domsid = talloc_array(tctx, struct dom_sid *, num_trusts);
2570         trustdom_handle = talloc_array(tctx, struct policy_handle, num_trusts);
2571
2572         for (i=0; i< num_trusts; i++) {
2573                 char *trust_name = talloc_asprintf(tctx, "torturedom%02d", i);
2574                 char *trust_sid = talloc_asprintf(tctx, "S-1-5-21-97398-379795-100%02d", i);
2575
2576                 domsid[i] = dom_sid_parse_talloc(tctx, trust_sid);
2577
2578                 trustinfo.sid = domsid[i];
2579                 init_lsa_String((struct lsa_String *)&trustinfo.name, trust_name);
2580
2581                 r.in.policy_handle = handle;
2582                 r.in.info = &trustinfo;
2583                 r.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
2584                 r.out.trustdom_handle = &trustdom_handle[i];
2585
2586                 torture_assert_ntstatus_ok(tctx, dcerpc_lsa_CreateTrustedDomain_r(b, tctx, &r),
2587                         "CreateTrustedDomain failed");
2588                 if (NT_STATUS_EQUAL(r.out.result, NT_STATUS_OBJECT_NAME_COLLISION)) {
2589                         test_DeleteTrustedDomain(b, tctx, handle, trustinfo.name);
2590                         torture_assert_ntstatus_ok(tctx, dcerpc_lsa_CreateTrustedDomain_r(b, tctx, &r),
2591                                 "CreateTrustedDomain failed");
2592                 }
2593                 if (!NT_STATUS_IS_OK(r.out.result)) {
2594                         torture_comment(tctx, "CreateTrustedDomain failed - %s\n", nt_errstr(r.out.result));
2595                         ret = false;
2596                 } else {
2597
2598                         q.in.trustdom_handle = &trustdom_handle[i];
2599                         q.in.level = LSA_TRUSTED_DOMAIN_INFO_INFO_EX;
2600                         q.out.info = &info;
2601                         torture_assert_ntstatus_ok(tctx, dcerpc_lsa_QueryTrustedDomainInfo_r(b, tctx, &q),
2602                                 "QueryTrustedDomainInfo failed");
2603                         if (!NT_STATUS_IS_OK(q.out.result)) {
2604                                 torture_comment(tctx, "QueryTrustedDomainInfo level %d failed - %s\n", q.in.level, nt_errstr(q.out.result));
2605                                 ret = false;
2606                         } else if (!q.out.info) {
2607                                 ret = false;
2608                         } else {
2609                                 if (strcmp(info->info_ex.netbios_name.string, trustinfo.name.string) != 0) {
2610                                         torture_comment(tctx, "QueryTrustedDomainInfo returned inconsistent short name: %s != %s\n",
2611                                                info->info_ex.netbios_name.string, trustinfo.name.string);
2612                                         ret = false;
2613                                 }
2614                                 if (info->info_ex.trust_type != LSA_TRUST_TYPE_DOWNLEVEL) {
2615                                         torture_comment(tctx, "QueryTrustedDomainInfo of %s returned incorrect trust type %d != %d\n",
2616                                                trust_name, info->info_ex.trust_type, LSA_TRUST_TYPE_DOWNLEVEL);
2617                                         ret = false;
2618                                 }
2619                                 if (info->info_ex.trust_attributes != 0) {
2620                                         torture_comment(tctx, "QueryTrustedDomainInfo of %s returned incorrect trust attributes %d != %d\n",
2621                                                trust_name, info->info_ex.trust_attributes, 0);
2622                                         ret = false;
2623                                 }
2624                                 if (info->info_ex.trust_direction != LSA_TRUST_DIRECTION_OUTBOUND) {
2625                                         torture_comment(tctx, "QueryTrustedDomainInfo of %s returned incorrect trust direction %d != %d\n",
2626                                                trust_name, info->info_ex.trust_direction, LSA_TRUST_DIRECTION_OUTBOUND);
2627                                         ret = false;
2628                                 }
2629                         }
2630                 }
2631         }
2632
2633         /* now that we have some domains to look over, we can test the enum calls */
2634         if (!test_EnumTrustDom(b, tctx, handle)) {
2635                 ret = false;
2636         }
2637
2638         if (!test_EnumTrustDomEx(b, tctx, handle)) {
2639                 ret = false;
2640         }
2641
2642         for (i=0; i<num_trusts; i++) {
2643                 if (!test_DeleteTrustedDomainBySid(b, tctx, handle, domsid[i])) {
2644                         ret = false;
2645                 }
2646         }
2647
2648         return ret;
2649 }
2650
2651 static bool gen_authinfo_internal(TALLOC_CTX *mem_ctx, const char *password,
2652                                   DATA_BLOB session_key,
2653                                   struct lsa_TrustDomainInfoAuthInfoInternal **_authinfo_internal)
2654 {
2655         struct lsa_TrustDomainInfoAuthInfoInternal *authinfo_internal;
2656         struct trustDomainPasswords auth_struct;
2657         struct AuthenticationInformation *auth_info_array;
2658         size_t converted_size;
2659         DATA_BLOB auth_blob;
2660         enum ndr_err_code ndr_err;
2661
2662         authinfo_internal = talloc_zero(mem_ctx, struct lsa_TrustDomainInfoAuthInfoInternal);
2663         if (authinfo_internal == NULL) {
2664                 return false;
2665         }
2666
2667         auth_info_array = talloc_array(mem_ctx,
2668                                        struct AuthenticationInformation, 1);
2669         if (auth_info_array == NULL) {
2670                 return false;
2671         }
2672
2673         generate_random_buffer(auth_struct.confounder, sizeof(auth_struct.confounder));
2674
2675         auth_info_array[0].AuthType = TRUST_AUTH_TYPE_CLEAR;
2676
2677         if (!convert_string_talloc(mem_ctx, CH_UNIX, CH_UTF16, password,
2678                                   strlen(password),
2679                                   &auth_info_array[0].AuthInfo.clear.password,
2680                                   &converted_size)) {
2681                 return false;
2682         }
2683
2684         auth_info_array[0].AuthInfo.clear.size = converted_size;
2685
2686         auth_struct.outgoing.count = 1;
2687         auth_struct.outgoing.current.count = 1;
2688         auth_struct.outgoing.current.array = auth_info_array;
2689         auth_struct.outgoing.previous.count = 0;
2690         auth_struct.outgoing.previous.array = NULL;
2691
2692         auth_struct.incoming.count = 1;
2693         auth_struct.incoming.current.count = 1;
2694         auth_struct.incoming.current.array = auth_info_array;
2695         auth_struct.incoming.previous.count = 0;
2696         auth_struct.incoming.previous.array = NULL;
2697
2698
2699         ndr_err = ndr_push_struct_blob(&auth_blob, mem_ctx, &auth_struct,
2700                                        (ndr_push_flags_fn_t)ndr_push_trustDomainPasswords);
2701         if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
2702                 return false;
2703         }
2704
2705         arcfour_crypt_blob(auth_blob.data, auth_blob.length, &session_key);
2706
2707         authinfo_internal->auth_blob.size = auth_blob.length;
2708         authinfo_internal->auth_blob.data = auth_blob.data;
2709
2710         *_authinfo_internal = authinfo_internal;
2711
2712         return true;
2713 }
2714
2715 static bool gen_authinfo(TALLOC_CTX *mem_ctx, const char *password,
2716                          struct lsa_TrustDomainInfoAuthInfo **_authinfo)
2717 {
2718         struct lsa_TrustDomainInfoAuthInfo *authinfo;
2719         struct lsa_TrustDomainInfoBuffer *info_buffer;
2720         size_t converted_size;
2721
2722         authinfo = talloc_zero(mem_ctx, struct lsa_TrustDomainInfoAuthInfo);
2723         if (authinfo == NULL) {
2724                 return false;
2725         }
2726
2727         info_buffer = talloc_zero(mem_ctx, struct lsa_TrustDomainInfoBuffer);
2728         if (info_buffer == NULL) {
2729                 return false;
2730         }
2731
2732         info_buffer->AuthType = TRUST_AUTH_TYPE_CLEAR;
2733
2734         if (!convert_string_talloc(mem_ctx, CH_UNIX, CH_UTF16, password,
2735                                   strlen(password),
2736                                   &info_buffer->data.data,
2737                                   &converted_size)) {
2738                 return false;
2739         }
2740
2741         info_buffer->data.size = converted_size;
2742
2743         authinfo->incoming_count = 1;
2744         authinfo->incoming_current_auth_info = info_buffer;
2745         authinfo->incoming_previous_auth_info = NULL;
2746         authinfo->outgoing_count = 1;
2747         authinfo->outgoing_current_auth_info = info_buffer;
2748         authinfo->outgoing_previous_auth_info = NULL;
2749
2750         *_authinfo = authinfo;
2751
2752         return true;
2753 }
2754
2755 static bool check_pw_with_ServerAuthenticate3(struct dcerpc_pipe *p,
2756                                              struct torture_context *tctx,
2757                                              uint32_t negotiate_flags,
2758                                              struct cli_credentials *machine_credentials,
2759                                              struct netlogon_creds_CredentialState **creds_out)
2760 {
2761         struct netr_ServerReqChallenge r;
2762         struct netr_ServerAuthenticate3 a;
2763         struct netr_Credential credentials1, credentials2, credentials3;
2764         struct netlogon_creds_CredentialState *creds;
2765         struct samr_Password mach_password;
2766         uint32_t rid;
2767         const char *machine_name;
2768         const char *plain_pass;
2769         struct dcerpc_binding_handle *b = p->binding_handle;
2770
2771         machine_name = cli_credentials_get_workstation(machine_credentials);
2772         plain_pass = cli_credentials_get_password(machine_credentials);
2773
2774         r.in.server_name = NULL;
2775         r.in.computer_name = machine_name;
2776         r.in.credentials = &credentials1;
2777         r.out.return_credentials = &credentials2;
2778
2779         generate_random_buffer(credentials1.data, sizeof(credentials1.data));
2780
2781         torture_assert_ntstatus_ok(tctx, dcerpc_netr_ServerReqChallenge_r(b, tctx, &r),
2782                 "ServerReqChallenge failed");
2783         torture_assert_ntstatus_ok(tctx, r.out.result, "ServerReqChallenge failed");
2784
2785         E_md4hash(plain_pass, mach_password.hash);
2786
2787         a.in.server_name = NULL;
2788         a.in.account_name = talloc_asprintf(tctx, "%s$", machine_name);
2789         a.in.secure_channel_type = cli_credentials_get_secure_channel_type(machine_credentials);
2790         a.in.computer_name = machine_name;
2791         a.in.negotiate_flags = &negotiate_flags;
2792         a.in.credentials = &credentials3;
2793         a.out.return_credentials = &credentials3;
2794         a.out.negotiate_flags = &negotiate_flags;
2795         a.out.rid = &rid;
2796
2797         creds = netlogon_creds_client_init(tctx, a.in.account_name,
2798                                            a.in.computer_name,
2799                                            &credentials1, &credentials2,
2800                                            &mach_password, &credentials3,
2801                                            negotiate_flags);
2802
2803         torture_assert(tctx, creds != NULL, "memory allocation");
2804
2805         torture_assert_ntstatus_ok(tctx, dcerpc_netr_ServerAuthenticate3_r(b, tctx, &a),
2806                 "ServerAuthenticate3 failed");
2807         if (!NT_STATUS_IS_OK(a.out.result)) {
2808                 if (!NT_STATUS_EQUAL(a.out.result, NT_STATUS_ACCESS_DENIED)) {
2809                         torture_assert_ntstatus_ok(tctx, a.out.result,
2810                                                    "ServerAuthenticate3 failed");
2811                 }
2812                 return false;
2813         }
2814         torture_assert(tctx, netlogon_creds_client_check(creds, &credentials3), "Credential chaining failed");
2815
2816         /* Prove that requesting a challenge again won't break it */
2817         torture_assert_ntstatus_ok(tctx, dcerpc_netr_ServerReqChallenge_r(b, tctx, &r),
2818                 "ServerReqChallenge failed");
2819         torture_assert_ntstatus_ok(tctx, r.out.result, "ServerReqChallenge failed");
2820
2821         *creds_out = creds;
2822         return true;
2823 }
2824
2825 static bool check_dom_trust_pw(struct dcerpc_pipe *p,
2826                                struct torture_context *tctx,
2827                                const char *trusted_dom_name,
2828                                const char *password)
2829 {
2830         struct cli_credentials *credentials;
2831         char *dummy;
2832         struct netlogon_creds_CredentialState *creds;
2833         struct dcerpc_pipe *pipe;
2834         NTSTATUS status;
2835         bool ok;
2836
2837         credentials = cli_credentials_init(tctx);
2838         if (credentials == NULL) {
2839                 return false;
2840         }
2841
2842         dummy = talloc_asprintf(tctx, "%s$", trusted_dom_name);
2843         if (dummy == NULL) {
2844                 return false;
2845         }
2846
2847         cli_credentials_set_username(credentials, dummy, CRED_SPECIFIED);
2848         cli_credentials_set_password(credentials, password, CRED_SPECIFIED);
2849         cli_credentials_set_workstation(credentials,
2850                                         trusted_dom_name, CRED_SPECIFIED);
2851         cli_credentials_set_secure_channel_type(credentials, SEC_CHAN_DOMAIN);
2852
2853         status = dcerpc_pipe_connect_b(tctx, &pipe, p->binding,
2854                                        &ndr_table_netlogon,
2855                                        cli_credentials_init_anon(tctx),
2856                                        tctx->ev, tctx->lp_ctx);
2857         if (!NT_STATUS_IS_OK(status)) {
2858                 torture_comment(tctx, "dcerpc_pipe_connect_b failed.\n");
2859                 return false;
2860         }
2861
2862         ok = check_pw_with_ServerAuthenticate3(pipe, tctx,
2863                                                NETLOGON_NEG_AUTH2_ADS_FLAGS,
2864                                                credentials, &creds);
2865         talloc_free(pipe);
2866
2867         return ok;
2868 }
2869
2870 static bool test_CreateTrustedDomainEx_common(struct dcerpc_pipe *p,
2871                                               struct torture_context *tctx,
2872                                               struct policy_handle *handle,
2873                                               uint32_t num_trusts,
2874                                               bool ex2_call)
2875 {
2876         NTSTATUS status;
2877         bool ret = true;
2878         struct lsa_CreateTrustedDomainEx r;
2879         struct lsa_CreateTrustedDomainEx2 r2;
2880         struct lsa_TrustDomainInfoInfoEx trustinfo;
2881         struct lsa_TrustDomainInfoAuthInfoInternal *authinfo_internal;
2882         struct lsa_TrustDomainInfoAuthInfo *authinfo;
2883         struct dom_sid **domsid;
2884         struct policy_handle *trustdom_handle;
2885         struct lsa_QueryTrustedDomainInfo q;
2886         union lsa_TrustedDomainInfo *info = NULL;
2887         DATA_BLOB session_key;
2888         int i;
2889         struct dcerpc_binding_handle *b = p->binding_handle;
2890
2891         if (ex2_call) {
2892                 torture_comment(tctx, "\nTesting CreateTrustedDomainEx2 for %d domains\n", num_trusts);
2893         } else {
2894                 torture_comment(tctx, "\nTesting CreateTrustedDomainEx for %d domains\n", num_trusts);
2895         }
2896
2897         domsid = talloc_array(tctx, struct dom_sid *, num_trusts);
2898         trustdom_handle = talloc_array(tctx, struct policy_handle, num_trusts);
2899
2900         status = dcerpc_fetch_session_key(p, &session_key);
2901         if (!NT_STATUS_IS_OK(status)) {
2902                 torture_comment(tctx, "dcerpc_fetch_session_key failed - %s\n", nt_errstr(status));
2903                 return false;
2904         }
2905
2906         for (i=0; i< num_trusts; i++) {
2907                 char *trust_name = talloc_asprintf(tctx, "torturedom%02d", i);
2908                 char *trust_name_dns = talloc_asprintf(tctx, "torturedom%02d.samba.example.com", i);
2909                 char *trust_sid = talloc_asprintf(tctx, "S-1-5-21-97398-379795-100%02d", i);
2910
2911                 domsid[i] = dom_sid_parse_talloc(tctx, trust_sid);
2912
2913                 trustinfo.sid = domsid[i];
2914                 trustinfo.netbios_name.string = trust_name;
2915                 trustinfo.domain_name.string = trust_name_dns;
2916
2917                 /* Create inbound, some outbound, and some
2918                  * bi-directional trusts in a repeating pattern based
2919                  * on i */
2920
2921                 /* 1 == inbound, 2 == outbound, 3 == both */
2922                 trustinfo.trust_direction = (i % 3) + 1;
2923
2924                 /* Try different trust types too */
2925
2926                 /* 1 == downlevel (NT4), 2 == uplevel (ADS), 3 == MIT (kerberos but not AD) */
2927                 trustinfo.trust_type = (((i / 3) + 1) % 3) + 1;
2928
2929                 trustinfo.trust_attributes = LSA_TRUST_ATTRIBUTE_USES_RC4_ENCRYPTION;
2930
2931                 if (!gen_authinfo_internal(tctx, TRUSTPW, session_key, &authinfo_internal)) {
2932                         torture_comment(tctx, "gen_authinfo_internal failed");
2933                         ret = false;
2934                 }
2935
2936                 if (!gen_authinfo(tctx, TRUSTPW, &authinfo)) {
2937                         torture_comment(tctx, "gen_authinfonfo failed");
2938                         ret = false;
2939                 }
2940
2941                 if (ex2_call) {
2942
2943                         r2.in.policy_handle = handle;
2944                         r2.in.info = &trustinfo;
2945                         r2.in.auth_info_internal = authinfo_internal;
2946                         r2.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
2947                         r2.out.trustdom_handle = &trustdom_handle[i];
2948
2949                         torture_assert_ntstatus_ok(tctx,
2950                                 dcerpc_lsa_CreateTrustedDomainEx2_r(b, tctx, &r2),
2951                                 "CreateTrustedDomainEx2 failed");
2952
2953                         status = r2.out.result;
2954                 } else {
2955
2956                         r.in.policy_handle = handle;
2957                         r.in.info = &trustinfo;
2958                         r.in.auth_info = authinfo;
2959                         r.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
2960                         r.out.trustdom_handle = &trustdom_handle[i];
2961
2962                         torture_assert_ntstatus_ok(tctx,
2963                                 dcerpc_lsa_CreateTrustedDomainEx_r(b, tctx, &r),
2964                                 "CreateTrustedDomainEx failed");
2965
2966                         status = r.out.result;
2967                 }
2968
2969                 if (NT_STATUS_EQUAL(status, NT_STATUS_OBJECT_NAME_COLLISION)) {
2970                         test_DeleteTrustedDomain(b, tctx, handle, trustinfo.netbios_name);
2971                         if (ex2_call) {
2972                                 torture_assert_ntstatus_ok(tctx,
2973                                         dcerpc_lsa_CreateTrustedDomainEx2_r(b, tctx, &r2),
2974                                         "CreateTrustedDomainEx2 failed");
2975                                 status = r2.out.result;
2976                         } else {
2977                                 torture_assert_ntstatus_ok(tctx,
2978                                         dcerpc_lsa_CreateTrustedDomainEx_r(b, tctx, &r),
2979                                         "CreateTrustedDomainEx2 failed");
2980                                 status = r.out.result;
2981                         }
2982                 }
2983                 if (!NT_STATUS_IS_OK(status)) {
2984                         torture_comment(tctx, "CreateTrustedDomainEx failed2 - %s\n", nt_errstr(status));
2985                         ret = false;
2986                 } else {
2987                         /* For outbound and MIT trusts there is no trust account */
2988                         if (trustinfo.trust_direction != 2 &&
2989                             trustinfo.trust_type != 3) {
2990
2991                                 if (torture_setting_bool(tctx, "samba3", false) ||
2992                                     torture_setting_bool(tctx, "samba4", false)) {
2993                                         torture_comment(tctx, "skipping trusted domain auth tests against samba");
2994                                 } else {
2995                                         if (check_dom_trust_pw(p, tctx, trust_name,
2996                                                                 "x" TRUSTPW "x")) {
2997                                                 torture_comment(tctx, "Password check passed unexpectedly\n");
2998                                                 ret = false;
2999                                         }
3000                                         if (!check_dom_trust_pw(p, tctx, trust_name,
3001                                                                 TRUSTPW)) {
3002                                                 torture_comment(tctx, "Password check failed\n");
3003                                                 ret = false;
3004                                         }
3005                                 }
3006                         }
3007
3008                         q.in.trustdom_handle = &trustdom_handle[i];
3009                         q.in.level = LSA_TRUSTED_DOMAIN_INFO_INFO_EX;
3010                         q.out.info = &info;
3011                         torture_assert_ntstatus_ok(tctx, dcerpc_lsa_QueryTrustedDomainInfo_r(b, tctx, &q),
3012                                 "QueryTrustedDomainInfo failed");
3013                         if (!NT_STATUS_IS_OK(q.out.result)) {
3014                                 torture_comment(tctx, "QueryTrustedDomainInfo level 1 failed - %s\n", nt_errstr(q.out.result));
3015                                 ret = false;
3016                         } else if (!q.out.info) {
3017                                 torture_comment(tctx, "QueryTrustedDomainInfo level 1 failed to return an info pointer\n");
3018                                 ret = false;
3019                         } else {
3020                                 if (strcmp(info->info_ex.netbios_name.string, trustinfo.netbios_name.string) != 0) {
3021                                         torture_comment(tctx, "QueryTrustedDomainInfo returned inconsistent short name: %s != %s\n",
3022                                                info->info_ex.netbios_name.string, trustinfo.netbios_name.string);
3023                                         ret = false;
3024                                 }
3025                                 if (info->info_ex.trust_type != trustinfo.trust_type) {
3026                                         torture_comment(tctx, "QueryTrustedDomainInfo of %s returned incorrect trust type %d != %d\n",
3027                                                trust_name, info->info_ex.trust_type, trustinfo.trust_type);
3028                                         ret = false;
3029                                 }
3030                                 if (info->info_ex.trust_attributes != LSA_TRUST_ATTRIBUTE_USES_RC4_ENCRYPTION) {
3031                                         torture_comment(tctx, "QueryTrustedDomainInfo of %s returned incorrect trust attributes %d != %d\n",
3032                                                trust_name, info->info_ex.trust_attributes, LSA_TRUST_ATTRIBUTE_USES_RC4_ENCRYPTION);
3033                                         ret = false;
3034                                 }
3035                                 if (info->info_ex.trust_direction != trustinfo.trust_direction) {
3036                                         torture_comment(tctx, "QueryTrustedDomainInfo of %s returned incorrect trust direction %d != %d\n",
3037                                                trust_name, info->info_ex.trust_direction, trustinfo.trust_direction);
3038                                         ret = false;
3039                                 }
3040                         }
3041                 }
3042         }
3043
3044         /* now that we have some domains to look over, we can test the enum calls */
3045         if (!test_EnumTrustDom(b, tctx, handle)) {
3046                 torture_comment(tctx, "test_EnumTrustDom failed\n");
3047                 ret = false;
3048         }
3049
3050         if (!test_EnumTrustDomEx(b, tctx, handle)) {
3051                 torture_comment(tctx, "test_EnumTrustDomEx failed\n");
3052                 ret = false;
3053         }
3054
3055         for (i=0; i<num_trusts; i++) {
3056                 if (!test_DeleteTrustedDomainBySid(b, tctx, handle, domsid[i])) {
3057                         torture_comment(tctx, "test_DeleteTrustedDomainBySid failed\n");
3058                         ret = false;
3059                 }
3060         }
3061
3062         return ret;
3063 }
3064
3065 static bool test_CreateTrustedDomainEx2(struct dcerpc_pipe *p,
3066                                         struct torture_context *tctx,
3067                                         struct policy_handle *handle,
3068                                         uint32_t num_trusts)
3069 {
3070         return test_CreateTrustedDomainEx_common(p, tctx, handle, num_trusts, true);
3071 }
3072
3073 static bool test_CreateTrustedDomainEx(struct dcerpc_pipe *p,
3074                                        struct torture_context *tctx,
3075                                        struct policy_handle *handle,
3076                                        uint32_t num_trusts)
3077 {
3078         return test_CreateTrustedDomainEx_common(p, tctx, handle, num_trusts, false);
3079 }
3080
3081 static bool test_QueryDomainInfoPolicy(struct dcerpc_binding_handle *b,
3082                                  struct torture_context *tctx,
3083                                  struct policy_handle *handle)
3084 {
3085         struct lsa_QueryDomainInformationPolicy r;
3086         union lsa_DomainInformationPolicy *info = NULL;
3087         int i;
3088         bool ret = true;
3089
3090         if (torture_setting_bool(tctx, "samba3", false)) {
3091                 torture_skip(tctx, "skipping QueryDomainInformationPolicy test\n");
3092         }
3093
3094         torture_comment(tctx, "\nTesting QueryDomainInformationPolicy\n");
3095
3096         for (i=2;i<4;i++) {
3097                 r.in.handle = handle;
3098                 r.in.level = i;
3099                 r.out.info = &info;
3100
3101                 torture_comment(tctx, "\nTrying QueryDomainInformationPolicy level %d\n", i);
3102
3103                 torture_assert_ntstatus_ok(tctx, dcerpc_lsa_QueryDomainInformationPolicy_r(b, tctx, &r),
3104                         "QueryDomainInformationPolicy failed");
3105
3106                 /* If the server does not support EFS, then this is the correct return */
3107                 if (i == LSA_DOMAIN_INFO_POLICY_EFS && NT_STATUS_EQUAL(r.out.result, NT_STATUS_OBJECT_NAME_NOT_FOUND)) {
3108                         continue;
3109                 } else if (!NT_STATUS_IS_OK(r.out.result)) {
3110                         torture_comment(tctx, "QueryDomainInformationPolicy failed - %s\n", nt_errstr(r.out.result));
3111                         ret = false;
3112                         continue;
3113                 }
3114         }
3115
3116         return ret;
3117 }
3118
3119
3120 static bool test_QueryInfoPolicyCalls(  bool version2,
3121                                         struct dcerpc_binding_handle *b,
3122                                         struct torture_context *tctx,
3123                                         struct policy_handle *handle)
3124 {
3125         struct lsa_QueryInfoPolicy r;
3126         union lsa_PolicyInformation *info = NULL;
3127         int i;
3128         bool ret = true;
3129         const char *call = talloc_asprintf(tctx, "QueryInfoPolicy%s", version2 ? "2":"");
3130
3131         torture_comment(tctx, "\nTesting %s\n", call);
3132
3133         if (version2 && torture_setting_bool(tctx, "samba3", false)) {
3134                 torture_skip(tctx, "skipping QueryInfoPolicy2 tests\n");
3135         }
3136
3137         for (i=1;i<=14;i++) {
3138                 r.in.handle = handle;
3139                 r.in.level = i;
3140                 r.out.info = &info;
3141
3142                 torture_comment(tctx, "\nTrying %s level %d\n", call, i);
3143
3144                 if (version2)
3145                         /* We can perform the cast, because both types are
3146                            structurally equal */
3147                         torture_assert_ntstatus_ok(tctx, dcerpc_lsa_QueryInfoPolicy2_r(b, tctx,
3148                                  (struct lsa_QueryInfoPolicy2*) &r),
3149                                  "QueryInfoPolicy2 failed");
3150                 else
3151                         torture_assert_ntstatus_ok(tctx, dcerpc_lsa_QueryInfoPolicy_r(b, tctx, &r),
3152                                 "QueryInfoPolicy2 failed");
3153
3154                 switch (i) {
3155                 case LSA_POLICY_INFO_MOD:
3156                 case LSA_POLICY_INFO_AUDIT_FULL_SET:
3157                 case LSA_POLICY_INFO_AUDIT_FULL_QUERY:
3158                         if (!NT_STATUS_EQUAL(r.out.result, NT_STATUS_INVALID_PARAMETER)) {
3159                                 torture_comment(tctx, "Server should have failed level %u: %s\n", i, nt_errstr(r.out.result));
3160                                 ret = false;
3161                         }
3162                         break;
3163                 case LSA_POLICY_INFO_DOMAIN:
3164                 case LSA_POLICY_INFO_ACCOUNT_DOMAIN:
3165                 case LSA_POLICY_INFO_REPLICA:
3166                 case LSA_POLICY_INFO_QUOTA:
3167                 case LSA_POLICY_INFO_ROLE:
3168                 case LSA_POLICY_INFO_AUDIT_LOG:
3169                 case LSA_POLICY_INFO_AUDIT_EVENTS:
3170                 case LSA_POLICY_INFO_PD:
3171                         if (!NT_STATUS_IS_OK(r.out.result)) {
3172                                 torture_comment(tctx, "%s failed - %s\n", call, nt_errstr(r.out.result));
3173                                 ret = false;
3174                         }
3175                         break;
3176                 case LSA_POLICY_INFO_L_ACCOUNT_DOMAIN:
3177                 case LSA_POLICY_INFO_DNS_INT:
3178                 case LSA_POLICY_INFO_DNS:
3179                         if (torture_setting_bool(tctx, "samba3", false)) {
3180                                 /* Other levels not implemented yet */
3181                                 if (!NT_STATUS_EQUAL(r.out.result, NT_STATUS_INVALID_INFO_CLASS)) {
3182                                         torture_comment(tctx, "%s failed - %s\n", call, nt_errstr(r.out.result));
3183                                         ret = false;
3184                                 }
3185                         } else if (!NT_STATUS_IS_OK(r.out.result)) {
3186                                 torture_comment(tctx, "%s failed - %s\n", call, nt_errstr(r.out.result));
3187                                 ret = false;
3188                         }
3189                         break;
3190                 default:
3191                         if (torture_setting_bool(tctx, "samba4", false)) {
3192                                 /* Other levels not implemented yet */
3193                                 if (!NT_STATUS_EQUAL(r.out.result, NT_STATUS_INVALID_INFO_CLASS)) {
3194                                         torture_comment(tctx, "%s failed - %s\n", call, nt_errstr(r.out.result));
3195                                         ret = false;
3196                                 }
3197                         } else if (!NT_STATUS_IS_OK(r.out.result)) {
3198                                 torture_comment(tctx, "%s failed - %s\n", call, nt_errstr(r.out.result));
3199                                 ret = false;
3200                         }
3201                         break;
3202                 }
3203
3204                 if (NT_STATUS_IS_OK(r.out.result) && (i == LSA_POLICY_INFO_DNS
3205                         || i == LSA_POLICY_INFO_DNS_INT)) {
3206                         /* Let's look up some of these names */
3207
3208                         struct lsa_TransNameArray tnames;
3209                         tnames.count = 14;
3210                         tnames.names = talloc_zero_array(tctx, struct lsa_TranslatedName, tnames.count);
3211                         tnames.names[0].name.string = info->dns.name.string;
3212                         tnames.names[0].sid_type = SID_NAME_DOMAIN;
3213                         tnames.names[1].name.string = info->dns.dns_domain.string;
3214                         tnames.names[1].sid_type = SID_NAME_DOMAIN;
3215                         tnames.names[2].name.string = talloc_asprintf(tctx, "%s\\", info->dns.name.string);
3216                         tnames.names[2].sid_type = SID_NAME_DOMAIN;
3217                         tnames.names[3].name.string = talloc_asprintf(tctx, "%s\\", info->dns.dns_domain.string);
3218                         tnames.names[3].sid_type = SID_NAME_DOMAIN;
3219                         tnames.names[4].name.string = talloc_asprintf(tctx, "%s\\guest", info->dns.name.string);
3220                         tnames.names[4].sid_type = SID_NAME_USER;
3221                         tnames.names[5].name.string = talloc_asprintf(tctx, "%s\\krbtgt", info->dns.name.string);
3222                         tnames.names[5].sid_type = SID_NAME_USER;
3223                         tnames.names[6].name.string = talloc_asprintf(tctx, "%s\\guest", info->dns.dns_domain.string);
3224                         tnames.names[6].sid_type = SID_NAME_USER;
3225                         tnames.names[7].name.string = talloc_asprintf(tctx, "%s\\krbtgt", info->dns.dns_domain.string);
3226                         tnames.names[7].sid_type = SID_NAME_USER;
3227                         tnames.names[8].name.string = talloc_asprintf(tctx, "krbtgt@%s", info->dns.name.string);
3228                         tnames.names[8].sid_type = SID_NAME_USER;
3229                         tnames.names[9].name.string = talloc_asprintf(tctx, "krbtgt@%s", info->dns.dns_domain.string);
3230                         tnames.names[9].sid_type = SID_NAME_USER;
3231                         tnames.names[10].name.string = talloc_asprintf(tctx, "%s\\"TEST_MACHINENAME "$", info->dns.name.string);
3232                         tnames.names[10].sid_type = SID_NAME_USER;
3233                         tnames.names[11].name.string = talloc_asprintf(tctx, "%s\\"TEST_MACHINENAME "$", info->dns.dns_domain.string);
3234                         tnames.names[11].sid_type = SID_NAME_USER;
3235                         tnames.names[12].name.string = talloc_asprintf(tctx, TEST_MACHINENAME "$@%s", info->dns.name.string);
3236                         tnames.names[12].sid_type = SID_NAME_USER;
3237                         tnames.names[13].name.string = talloc_asprintf(tctx, TEST_MACHINENAME "$@%s", info->dns.dns_domain.string);
3238                         tnames.names[13].sid_type = SID_NAME_USER;
3239                         ret &= test_LookupNames(b, tctx, handle, &tnames);
3240
3241                 }
3242         }
3243
3244         return ret;
3245 }
3246
3247 static bool test_QueryInfoPolicy(struct dcerpc_binding_handle *b,
3248                                  struct torture_context *tctx,
3249                                  struct policy_handle *handle)
3250 {
3251         return test_QueryInfoPolicyCalls(false, b, tctx, handle);
3252 }
3253
3254 static bool test_QueryInfoPolicy2(struct dcerpc_binding_handle *b,
3255                                   struct torture_context *tctx,
3256                                   struct policy_handle *handle)
3257 {
3258         return test_QueryInfoPolicyCalls(true, b, tctx, handle);
3259 }
3260
3261 static bool test_GetUserName(struct dcerpc_binding_handle *b,
3262                              struct torture_context *tctx)
3263 {
3264         struct lsa_GetUserName r;
3265         bool ret = true;
3266         struct lsa_String *authority_name_p = NULL;
3267         struct lsa_String *account_name_p = NULL;
3268
3269         torture_comment(tctx, "\nTesting GetUserName\n");
3270
3271         r.in.system_name        = "\\";
3272         r.in.account_name       = &account_name_p;
3273         r.in.authority_name     = NULL;
3274         r.out.account_name      = &account_name_p;
3275
3276         torture_assert_ntstatus_ok(tctx, dcerpc_lsa_GetUserName_r(b, tctx, &r),
3277                 "GetUserName failed");
3278
3279         if (!NT_STATUS_IS_OK(r.out.result)) {
3280                 torture_comment(tctx, "GetUserName failed - %s\n", nt_errstr(r.out.result));
3281                 ret = false;
3282         }
3283
3284         account_name_p = NULL;
3285         r.in.account_name       = &account_name_p;
3286         r.in.authority_name     = &authority_name_p;
3287         r.out.account_name      = &account_name_p;
3288
3289         torture_assert_ntstatus_ok(tctx, dcerpc_lsa_GetUserName_r(b, tctx, &r),
3290                 "GetUserName failed");
3291
3292         if (!NT_STATUS_IS_OK(r.out.result)) {
3293                 torture_comment(tctx, "GetUserName failed - %s\n", nt_errstr(r.out.result));
3294                 ret = false;
3295         }
3296
3297         return ret;
3298 }
3299
3300 static bool test_GetUserName_fail(struct dcerpc_binding_handle *b,
3301                                   struct torture_context *tctx)
3302 {
3303         struct lsa_GetUserName r;
3304         struct lsa_String *account_name_p = NULL;
3305         NTSTATUS status;
3306
3307         torture_comment(tctx, "\nTesting GetUserName_fail\n");
3308
3309         r.in.system_name        = "\\";
3310         r.in.account_name       = &account_name_p;
3311         r.in.authority_name     = NULL;
3312         r.out.account_name      = &account_name_p;
3313
3314         status = dcerpc_lsa_GetUserName_r(b, tctx, &r);
3315         if (!NT_STATUS_IS_OK(status)) {
3316                 if (NT_STATUS_EQUAL(status, NT_STATUS_ACCESS_DENIED)) {
3317                         torture_comment(tctx,
3318                                         "GetUserName correctly returned with "
3319                                         "status: %s\n",
3320                                         nt_errstr(status));
3321                         return true;
3322                 }
3323
3324                 torture_assert_ntstatus_equal(tctx,
3325                                               status,
3326                                               NT_STATUS_ACCESS_DENIED,
3327                                               "GetUserName return value should "
3328                                               "be ACCESS_DENIED");
3329                 return true;
3330         }
3331
3332         if (!NT_STATUS_IS_OK(r.out.result)) {
3333                 if (NT_STATUS_EQUAL(r.out.result, NT_STATUS_ACCESS_DENIED) ||
3334                     NT_STATUS_EQUAL(r.out.result, NT_STATUS_RPC_PROTSEQ_NOT_SUPPORTED)) {
3335                         torture_comment(tctx,
3336                                         "GetUserName correctly returned with "
3337                                         "result: %s\n",
3338                                         nt_errstr(r.out.result));
3339                         return true;
3340                 }
3341         }
3342
3343         torture_assert_ntstatus_equal(tctx,
3344                                       r.out.result,
3345                                       NT_STATUS_OK,
3346                                       "GetUserName return value should be "
3347                                       "ACCESS_DENIED");
3348
3349         return false;
3350 }
3351
3352 bool test_lsa_Close(struct dcerpc_binding_handle *b,
3353                     struct torture_context *tctx,
3354                     struct policy_handle *handle)
3355 {
3356         struct lsa_Close r;
3357         struct policy_handle handle2;
3358
3359         torture_comment(tctx, "\nTesting Close\n");
3360
3361         r.in.handle = handle;
3362         r.out.handle = &handle2;
3363
3364         torture_assert_ntstatus_ok(tctx, dcerpc_lsa_Close_r(b, tctx, &r),
3365                 "Close failed");
3366         if (!NT_STATUS_IS_OK(r.out.result)) {
3367                 torture_comment(tctx, "Close failed - %s\n",
3368                 nt_errstr(r.out.result));
3369                 return false;
3370         }
3371
3372         torture_assert_ntstatus_equal(tctx, dcerpc_lsa_Close_r(b, tctx, &r),
3373                 NT_STATUS_RPC_SS_CONTEXT_MISMATCH, "Close should failed");
3374
3375         torture_comment(tctx, "\n");
3376
3377         return true;
3378 }
3379
3380 bool torture_rpc_lsa(struct torture_context *tctx)
3381 {
3382         NTSTATUS status;
3383         struct dcerpc_pipe *p;
3384         bool ret = true;
3385         struct policy_handle *handle = NULL;
3386         struct test_join *join = NULL;
3387         struct cli_credentials *machine_creds;
3388         struct dcerpc_binding_handle *b;
3389
3390         status = torture_rpc_connection(tctx, &p, &ndr_table_lsarpc);
3391         if (!NT_STATUS_IS_OK(status)) {
3392                 return false;
3393         }
3394         b = p->binding_handle;
3395
3396         /* Test lsaLookupSids3 and lsaLookupNames4 over tcpip */
3397         if (p->binding->transport == NCACN_IP_TCP) {
3398                 if (!test_OpenPolicy_fail(b, tctx)) {
3399                         ret = false;
3400                 }
3401
3402                 if (!test_OpenPolicy2_fail(b, tctx)) {
3403                         ret = false;
3404                 }
3405
3406                 if (!test_many_LookupSids(p, tctx, handle)) {
3407                         ret = false;
3408                 }
3409
3410                 return ret;
3411         }
3412
3413         if (!test_OpenPolicy(b, tctx)) {
3414                 ret = false;
3415         }
3416
3417         if (!test_lsa_OpenPolicy2(b, tctx, &handle)) {
3418                 ret = false;
3419         }
3420
3421         if (handle) {
3422                 join = torture_join_domain(tctx, TEST_MACHINENAME, ACB_WSTRUST, &machine_creds);
3423                 if (!join) {
3424                         ret = false;
3425                 }
3426
3427                 if (!test_LookupSids_async(b, tctx, handle)) {
3428                         ret = false;
3429                 }
3430
3431                 if (!test_QueryDomainInfoPolicy(b, tctx, handle)) {
3432                         ret = false;
3433                 }
3434
3435                 if (!test_CreateSecret(p, tctx, handle)) {
3436                         ret = false;
3437                 }
3438
3439                 if (!test_QueryInfoPolicy(b, tctx, handle)) {
3440                         ret = false;
3441                 }
3442
3443                 if (!test_QueryInfoPolicy2(b, tctx, handle)) {
3444                         ret = false;
3445                 }
3446
3447                 if (!test_Delete(b, tctx, handle)) {
3448                         ret = false;
3449                 }
3450
3451                 if (!test_many_LookupSids(p, tctx, handle)) {
3452                         ret = false;
3453                 }
3454
3455                 if (!test_lsa_Close(b, tctx, handle)) {
3456                         ret = false;
3457                 }
3458
3459                 torture_leave_domain(tctx, join);
3460
3461         } else {
3462                 if (!test_many_LookupSids(p, tctx, handle)) {
3463                         ret = false;
3464                 }
3465         }
3466
3467         if (!test_GetUserName(b, tctx)) {
3468                 ret = false;
3469         }
3470
3471         return ret;
3472 }
3473
3474 bool torture_rpc_lsa_get_user(struct torture_context *tctx)
3475 {
3476         NTSTATUS status;
3477         struct dcerpc_pipe *p;
3478         bool ret = true;
3479         struct dcerpc_binding_handle *b;
3480
3481         status = torture_rpc_connection(tctx, &p, &ndr_table_lsarpc);
3482         if (!NT_STATUS_IS_OK(status)) {
3483                 return false;
3484         }
3485         b = p->binding_handle;
3486
3487         if (p->binding->transport == NCACN_IP_TCP) {
3488                 if (!test_GetUserName_fail(b, tctx)) {
3489                         ret = false;
3490                 }
3491                 return ret;
3492         }
3493
3494         if (!test_GetUserName(b, tctx)) {
3495                 ret = false;
3496         }
3497
3498         return ret;
3499 }
3500
3501 static bool testcase_LookupNames(struct torture_context *tctx,
3502                                  struct dcerpc_pipe *p)
3503 {
3504         bool ret = true;
3505         struct policy_handle *handle;
3506         struct lsa_TransNameArray tnames;
3507         struct lsa_TransNameArray2 tnames2;
3508         struct dcerpc_binding_handle *b = p->binding_handle;
3509
3510         if (p->binding->transport != NCACN_NP &&
3511             p->binding->transport != NCALRPC) {
3512                 torture_comment(tctx, "testcase_LookupNames is only available "
3513                                 "over NCACN_NP or NCALRPC");
3514                 return true;
3515         }
3516
3517         if (!test_OpenPolicy(b, tctx)) {
3518                 ret = false;
3519         }
3520
3521         if (!test_lsa_OpenPolicy2(b, tctx, &handle)) {
3522                 ret = false;
3523         }
3524
3525         if (!handle) {
3526                 ret = false;
3527         }
3528
3529         tnames.count = 1;
3530         tnames.names = talloc_array(tctx, struct lsa_TranslatedName, tnames.count);
3531         ZERO_STRUCT(tnames.names[0]);
3532         tnames.names[0].name.string = "BUILTIN";
3533         tnames.names[0].sid_type = SID_NAME_DOMAIN;
3534
3535         if (!test_LookupNames(b, tctx, handle, &tnames)) {
3536                 ret = false;
3537         }
3538
3539         tnames2.count = 1;
3540         tnames2.names = talloc_array(tctx, struct lsa_TranslatedName2, tnames2.count);
3541         ZERO_STRUCT(tnames2.names[0]);
3542         tnames2.names[0].name.string = "BUILTIN";
3543         tnames2.names[0].sid_type = SID_NAME_DOMAIN;
3544
3545         if (!test_LookupNames2(b, tctx, handle, &tnames2, true)) {
3546                 ret = false;
3547         }
3548
3549         if (!test_LookupNames3(b, tctx, handle, &tnames2, true)) {
3550                 ret = false;
3551         }
3552
3553         if (!test_LookupNames_wellknown(b, tctx, handle)) {
3554                 ret = false;
3555         }
3556
3557         if (!test_LookupNames_NULL(b, tctx, handle)) {
3558                 ret = false;
3559         }
3560
3561         if (!test_LookupNames_bogus(b, tctx, handle)) {
3562                 ret = false;
3563         }
3564
3565         if (!test_lsa_Close(b, tctx, handle)) {
3566                 ret = false;
3567         }
3568
3569         return ret;
3570 }
3571
3572 struct torture_suite *torture_rpc_lsa_lookup_names(TALLOC_CTX *mem_ctx)
3573 {
3574         struct torture_suite *suite;
3575         struct torture_rpc_tcase *tcase;
3576
3577         suite = torture_suite_create(mem_ctx, "lsa.lookupnames");
3578
3579         tcase = torture_suite_add_rpc_iface_tcase(suite, "lsa",
3580                                                   &ndr_table_lsarpc);
3581         torture_rpc_tcase_add_test(tcase, "LookupNames",
3582                                    testcase_LookupNames);
3583
3584         return suite;
3585 }
3586
3587 struct lsa_trustdom_state {
3588         uint32_t num_trusts;
3589 };
3590
3591 static bool testcase_TrustedDomains(struct torture_context *tctx,
3592                                     struct dcerpc_pipe *p,
3593                                     void *data)
3594 {
3595         bool ret = true;
3596         struct policy_handle *handle;
3597         struct lsa_trustdom_state *state =
3598                 talloc_get_type_abort(data, struct lsa_trustdom_state);
3599         struct dcerpc_binding_handle *b = p->binding_handle;
3600
3601         if (p->binding->transport != NCACN_NP &&
3602             p->binding->transport != NCALRPC) {
3603                 torture_comment(tctx, "testcase_TrustedDomains is only available "
3604                                 "over NCACN_NP or NCALRPC");
3605                 return true;
3606         }
3607
3608         torture_comment(tctx, "Testing %d domains\n", state->num_trusts);
3609
3610         if (!test_OpenPolicy(b, tctx)) {
3611                 ret = false;
3612         }
3613
3614         if (!test_lsa_OpenPolicy2(b, tctx, &handle)) {
3615                 ret = false;
3616         }
3617
3618         if (!handle) {
3619                 ret = false;
3620         }
3621
3622         if (!test_CreateTrustedDomain(b, tctx, handle, state->num_trusts)) {
3623                 ret = false;
3624         }
3625
3626         if (!test_CreateTrustedDomainEx(p, tctx, handle, state->num_trusts)) {
3627                 ret = false;
3628         }
3629
3630         if (!test_CreateTrustedDomainEx2(p, tctx, handle, state->num_trusts)) {
3631                 ret = false;
3632         }
3633
3634         if (!test_lsa_Close(b, tctx, handle)) {
3635                 ret = false;
3636         }
3637
3638         return ret;
3639 }
3640
3641 struct torture_suite *torture_rpc_lsa_trusted_domains(TALLOC_CTX *mem_ctx)
3642 {
3643         struct torture_suite *suite;
3644         struct torture_rpc_tcase *tcase;
3645         struct lsa_trustdom_state *state;
3646
3647         state = talloc(mem_ctx, struct lsa_trustdom_state);
3648
3649         state->num_trusts = 12;
3650
3651         suite = torture_suite_create(mem_ctx, "lsa.trusted.domains");
3652
3653         tcase = torture_suite_add_rpc_iface_tcase(suite, "lsa",
3654                                                   &ndr_table_lsarpc);
3655         torture_rpc_tcase_add_test_ex(tcase, "TrustedDomains",
3656                                       testcase_TrustedDomains,
3657                                       state);
3658
3659         return suite;
3660 }
3661
3662 static bool testcase_Privileges(struct torture_context *tctx,
3663                                 struct dcerpc_pipe *p)
3664 {
3665         bool ret = true;
3666         struct policy_handle *handle;
3667         struct dcerpc_binding_handle *b = p->binding_handle;
3668
3669         if (p->binding->transport != NCACN_NP &&
3670             p->binding->transport != NCALRPC) {
3671                 torture_comment(tctx, "testcase_Privileges is only available "
3672                                 "over NCACN_NP or NCALRPC");
3673                 return true;
3674         }
3675
3676         if (!test_OpenPolicy(b, tctx)) {
3677                 ret = false;
3678         }
3679
3680         if (!test_lsa_OpenPolicy2(b, tctx, &handle)) {
3681                 ret = false;
3682         }
3683
3684         if (!handle) {
3685                 ret = false;
3686         }
3687
3688         if (!test_CreateAccount(b, tctx, handle)) {
3689                 ret = false;
3690         }
3691
3692         if (!test_EnumAccounts(b, tctx, handle)) {
3693                 ret = false;
3694         }
3695
3696         if (!test_EnumPrivs(b, tctx, handle)) {
3697                 ret = false;
3698         }
3699
3700         if (!test_lsa_Close(b, tctx, handle)) {
3701                 ret = false;
3702         }
3703
3704         return ret;
3705 }
3706
3707
3708 struct torture_suite *torture_rpc_lsa_privileges(TALLOC_CTX *mem_ctx)
3709 {
3710         struct torture_suite *suite;
3711         struct torture_rpc_tcase *tcase;
3712
3713         suite = torture_suite_create(mem_ctx, "lsa.privileges");
3714
3715         tcase = torture_suite_add_rpc_iface_tcase(suite, "lsa",
3716                                                   &ndr_table_lsarpc);
3717         torture_rpc_tcase_add_test(tcase, "Privileges",
3718                                    testcase_Privileges);
3719
3720         return suite;
3721 }