source4/torture/rpc/samba3rpc.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3
   4    dcerpc torture tests, designed to walk Samba3 code paths
   5
   6    Copyright (C) Volker Lendecke 2006
   7
   8    This program is free software; you can redistribute it and/or modify
   9    it under the terms of the GNU General Public License as published by
  10    the Free Software Foundation; either version 3 of the License, or
  11    (at your option) any later version.
  12
  13    This program is distributed in the hope that it will be useful,
  14    but WITHOUT ANY WARRANTY; without even the implied warranty of
  15    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  16    GNU General Public License for more details.
  17
  18    You should have received a copy of the GNU General Public License
  19    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  20 */
  21
  22 #include "includes.h"
  23 #include "libcli/raw/libcliraw.h"
  24 #include "libcli/raw/raw_proto.h"
  25 #include "libcli/rap/rap.h"
  26 #include "torture/torture.h"
  27 #include "torture/util.h"
  28 #include "torture/rap/proto.h"
  29 #include "librpc/gen_ndr/ndr_lsa.h"
  30 #include "librpc/gen_ndr/ndr_lsa_c.h"
  31 #include "librpc/gen_ndr/ndr_samr.h"
  32 #include "librpc/gen_ndr/ndr_samr_c.h"
  33 #include "librpc/gen_ndr/ndr_netlogon.h"
  34 #include "librpc/gen_ndr/ndr_netlogon_c.h"
  35 #include "librpc/gen_ndr/ndr_srvsvc.h"
  36 #include "librpc/gen_ndr/ndr_srvsvc_c.h"
  37 #include "librpc/gen_ndr/ndr_spoolss.h"
  38 #include "librpc/gen_ndr/ndr_spoolss_c.h"
  39 #include "librpc/gen_ndr/ndr_winreg.h"
  40 #include "librpc/gen_ndr/ndr_winreg_c.h"
  41 #include "librpc/gen_ndr/ndr_wkssvc.h"
  42 #include "librpc/gen_ndr/ndr_wkssvc_c.h"
  43 #include "lib/cmdline/popt_common.h"
  44 #include "librpc/rpc/dcerpc.h"
  45 #include "torture/rpc/rpc.h"
  46 #include "libcli/libcli.h"
  47 #include "libcli/composite/composite.h"
  48 #include "libcli/smb_composite/smb_composite.h"
  49 #include "libcli/auth/libcli_auth.h"
  50 #include "../lib/crypto/crypto.h"
  51 #include "auth/ntlmssp/ntlmssp.h"
  52 #include "libcli/security/proto.h"
  53 #include "param/param.h"
  54 #include "lib/registry/registry.h"
  55 #include "libcli/resolve/resolve.h"
  56
  57 /*
  58  * This tests a RPC call using an invalid vuid
  59  */
  60
  61 bool torture_bind_authcontext(struct torture_context *torture)
  62 {
  63         TALLOC_CTX *mem_ctx;
  64         NTSTATUS status;
  65         bool ret = false;
  66         struct lsa_ObjectAttribute objectattr;
  67         struct lsa_OpenPolicy2 openpolicy;
  68         struct policy_handle handle;
  69         struct lsa_Close close_handle;
  70         struct smbcli_session *tmp;
  71         struct smbcli_session *session2;
  72         struct smbcli_state *cli;
  73         struct dcerpc_pipe *lsa_pipe;
  74         struct cli_credentials *anon_creds;
  75         struct smb_composite_sesssetup setup;
  76         struct smbcli_options options;
  77
  78         mem_ctx = talloc_init("torture_bind_authcontext");
  79
  80         if (mem_ctx == NULL) {
  81                 d_printf("talloc_init failed\n");
  82                 return false;
  83         }
  84
  85         lp_smbcli_options(torture->lp_ctx, &options);
  86
  87         status = smbcli_full_connection(mem_ctx, &cli,
  88                                         torture_setting_string(torture, "host", NULL),
  89                                         lp_smb_ports(torture->lp_ctx),
  90                                         "IPC$", NULL, cmdline_credentials,
  91                                         lp_resolve_context(torture->lp_ctx),
  92                                         torture->ev, &options);
  93         if (!NT_STATUS_IS_OK(status)) {
  94                 d_printf("smbcli_full_connection failed: %s\n",
  95                          nt_errstr(status));
  96                 goto done;
  97         }
  98
  99         lsa_pipe = dcerpc_pipe_init(mem_ctx, cli->transport->socket->event.ctx,
 100                                     lp_iconv_convenience(torture->lp_ctx));
 101         if (lsa_pipe == NULL) {
 102                 d_printf("dcerpc_pipe_init failed\n");
 103                 goto done;
 104         }
 105
 106         status = dcerpc_pipe_open_smb(lsa_pipe, cli->tree, "\\lsarpc");
 107         if (!NT_STATUS_IS_OK(status)) {
 108                 d_printf("dcerpc_pipe_open_smb failed: %s\n",
 109                          nt_errstr(status));
 110                 goto done;
 111         }
 112
 113         status = dcerpc_bind_auth_none(lsa_pipe, &ndr_table_lsarpc);
 114         if (!NT_STATUS_IS_OK(status)) {
 115                 d_printf("dcerpc_bind_auth_none failed: %s\n",
 116                          nt_errstr(status));
 117                 goto done;
 118         }
 119
 120         openpolicy.in.system_name =talloc_asprintf(
 121                 mem_ctx, "\\\\%s", dcerpc_server_name(lsa_pipe));
 122         ZERO_STRUCT(objectattr);
 123         openpolicy.in.attr = &objectattr;
 124         openpolicy.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
 125         openpolicy.out.handle = &handle;
 126
 127         status = dcerpc_lsa_OpenPolicy2(lsa_pipe, mem_ctx, &openpolicy);
 128
 129         if (!NT_STATUS_IS_OK(status)) {
 130                 d_printf("dcerpc_lsa_OpenPolicy2 failed: %s\n",
 131                          nt_errstr(status));
 132                 goto done;
 133         }
 134
 135         close_handle.in.handle = &handle;
 136         close_handle.out.handle = &handle;
 137
 138         status = dcerpc_lsa_Close(lsa_pipe, mem_ctx, &close_handle);
 139         if (!NT_STATUS_IS_OK(status)) {
 140                 d_printf("dcerpc_lsa_Close failed: %s\n",
 141                          nt_errstr(status));
 142                 goto done;
 143         }
 144
 145         session2 = smbcli_session_init(cli->transport, mem_ctx, false);
 146         if (session2 == NULL) {
 147                 d_printf("smbcli_session_init failed\n");
 148                 goto done;
 149         }
 150
 151         if (!(anon_creds = cli_credentials_init_anon(mem_ctx))) {
 152                 d_printf("create_anon_creds failed\n");
 153                 goto done;
 154         }
 155
 156         setup.in.sesskey = cli->transport->negotiate.sesskey;
 157         setup.in.capabilities = cli->transport->negotiate.capabilities;
 158         setup.in.workgroup = "";
 159         setup.in.credentials = anon_creds;
 160
 161         status = smb_composite_sesssetup(session2, &setup);
 162         if (!NT_STATUS_IS_OK(status)) {
 163                 d_printf("anon session setup failed: %s\n",
 164                          nt_errstr(status));
 165                 goto done;
 166         }
 167         session2->vuid = setup.out.vuid;
 168
 169         tmp = cli->tree->session;
 170         cli->tree->session = session2;
 171
 172         status = dcerpc_lsa_OpenPolicy2(lsa_pipe, mem_ctx, &openpolicy);
 173
 174         cli->tree->session = tmp;
 175         talloc_free(lsa_pipe);
 176         lsa_pipe = NULL;
 177
 178         if (!NT_STATUS_EQUAL(status, NT_STATUS_INVALID_HANDLE)) {
 179                 d_printf("dcerpc_lsa_OpenPolicy2 with wrong vuid gave %s, "
 180                          "expected NT_STATUS_INVALID_HANDLE\n",
 181                          nt_errstr(status));
 182                 goto done;
 183         }
 184
 185         ret = true;
 186  done:
 187         talloc_free(mem_ctx);
 188         return ret;
 189 }
 190
 191 /*
 192  * Bind to lsa using a specific auth method
 193  */
 194
 195 static bool bindtest(struct smbcli_state *cli,
 196                      struct cli_credentials *credentials,
 197                      struct loadparm_context *lp_ctx,
 198                      uint8_t auth_type, uint8_t auth_level)
 199 {
 200         TALLOC_CTX *mem_ctx;
 201         bool ret = false;
 202         NTSTATUS status;
 203
 204         struct dcerpc_pipe *lsa_pipe;
 205         struct lsa_ObjectAttribute objectattr;
 206         struct lsa_OpenPolicy2 openpolicy;
 207         struct lsa_QueryInfoPolicy query;
 208         struct policy_handle handle;
 209         struct lsa_Close close_handle;
 210
 211         if ((mem_ctx = talloc_init("bindtest")) == NULL) {
 212                 d_printf("talloc_init failed\n");
 213                 return false;
 214         }
 215
 216         lsa_pipe = dcerpc_pipe_init(mem_ctx,
 217                                     cli->transport->socket->event.ctx,
 218                                     lp_iconv_convenience(lp_ctx));
 219         if (lsa_pipe == NULL) {
 220                 d_printf("dcerpc_pipe_init failed\n");
 221                 goto done;
 222         }
 223
 224         status = dcerpc_pipe_open_smb(lsa_pipe, cli->tree, "\\lsarpc");
 225         if (!NT_STATUS_IS_OK(status)) {
 226                 d_printf("dcerpc_pipe_open_smb failed: %s\n",
 227                          nt_errstr(status));
 228                 goto done;
 229         }
 230
 231         status = dcerpc_bind_auth(lsa_pipe, &ndr_table_lsarpc,
 232                                   credentials, lp_ctx, auth_type, auth_level,
 233                                   NULL);
 234         if (!NT_STATUS_IS_OK(status)) {
 235                 d_printf("dcerpc_bind_auth failed: %s\n", nt_errstr(status));
 236                 goto done;
 237         }
 238
 239         openpolicy.in.system_name =talloc_asprintf(
 240                 mem_ctx, "\\\\%s", dcerpc_server_name(lsa_pipe));
 241         ZERO_STRUCT(objectattr);
 242         openpolicy.in.attr = &objectattr;
 243         openpolicy.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
 244         openpolicy.out.handle = &handle;
 245
 246         status = dcerpc_lsa_OpenPolicy2(lsa_pipe, mem_ctx, &openpolicy);
 247
 248         if (!NT_STATUS_IS_OK(status)) {
 249                 d_printf("dcerpc_lsa_OpenPolicy2 failed: %s\n",
 250                          nt_errstr(status));
 251                 goto done;
 252         }
 253
 254         query.in.handle = &handle;
 255         query.in.level = LSA_POLICY_INFO_DOMAIN;
 256
 257         status = dcerpc_lsa_QueryInfoPolicy(lsa_pipe, mem_ctx, &query);
 258         if (!NT_STATUS_IS_OK(status)) {
 259                 d_printf("dcerpc_lsa_QueryInfoPolicy failed: %s\n",
 260                          nt_errstr(status));
 261                 goto done;
 262         }
 263
 264         close_handle.in.handle = &handle;
 265         close_handle.out.handle = &handle;
 266
 267         status = dcerpc_lsa_Close(lsa_pipe, mem_ctx, &close_handle);
 268         if (!NT_STATUS_IS_OK(status)) {
 269                 d_printf("dcerpc_lsa_Close failed: %s\n",
 270                          nt_errstr(status));
 271                 goto done;
 272         }
 273
 274         ret = true;
 275  done:
 276         talloc_free(mem_ctx);
 277         return ret;
 278 }
 279
 280 /*
 281  * test authenticated RPC binds with the variants Samba3 does support
 282  */
 283
 284 bool torture_bind_samba3(struct torture_context *torture)
 285 {
 286         TALLOC_CTX *mem_ctx;
 287         NTSTATUS status;
 288         bool ret = false;
 289         struct smbcli_state *cli;
 290         struct smbcli_options options;
 291
 292         mem_ctx = talloc_init("torture_bind_authcontext");
 293
 294         if (mem_ctx == NULL) {
 295                 d_printf("talloc_init failed\n");
 296                 return false;
 297         }
 298
 299         lp_smbcli_options(torture->lp_ctx, &options);
 300
 301         status = smbcli_full_connection(mem_ctx, &cli,
 302                                         torture_setting_string(torture, "host", NULL),
 303                                         lp_smb_ports(torture->lp_ctx),
 304                                         "IPC$", NULL, cmdline_credentials,
 305                                         lp_resolve_context(torture->lp_ctx),
 306                                         torture->ev, &options);
 307         if (!NT_STATUS_IS_OK(status)) {
 308                 d_printf("smbcli_full_connection failed: %s\n",
 309                          nt_errstr(status));
 310                 goto done;
 311         }
 312
 313         ret = true;
 314
 315         ret &= bindtest(cli, cmdline_credentials, torture->lp_ctx, DCERPC_AUTH_TYPE_NTLMSSP,
 316                         DCERPC_AUTH_LEVEL_INTEGRITY);
 317         ret &= bindtest(cli, cmdline_credentials, torture->lp_ctx, DCERPC_AUTH_TYPE_NTLMSSP,
 318                         DCERPC_AUTH_LEVEL_PRIVACY);
 319         ret &= bindtest(cli, cmdline_credentials, torture->lp_ctx, DCERPC_AUTH_TYPE_SPNEGO,
 320                         DCERPC_AUTH_LEVEL_INTEGRITY);
 321         ret &= bindtest(cli, cmdline_credentials, torture->lp_ctx, DCERPC_AUTH_TYPE_SPNEGO,
 322                         DCERPC_AUTH_LEVEL_PRIVACY);
 323
 324  done:
 325         talloc_free(mem_ctx);
 326         return ret;
 327 }
 328
 329 /*
 330  * Lookup or create a user and return all necessary info
 331  */
 332
 333 static NTSTATUS get_usr_handle(struct smbcli_state *cli,
 334                                TALLOC_CTX *mem_ctx,
 335                                struct loadparm_context *lp_ctx,
 336                                struct cli_credentials *admin_creds,
 337                                uint8_t auth_type,
 338                                uint8_t auth_level,
 339                                const char *username,
 340                                char **domain,
 341                                struct dcerpc_pipe **result_pipe,
 342                                struct policy_handle **result_handle,
 343                                struct dom_sid **sid)
 344 {
 345         struct dcerpc_pipe *samr_pipe;
 346         NTSTATUS status;
 347         struct policy_handle conn_handle;
 348         struct policy_handle domain_handle;
 349         struct policy_handle *user_handle;
 350         struct samr_Connect2 conn;
 351         struct samr_EnumDomains enumdom;
 352         uint32_t resume_handle = 0;
 353         struct samr_LookupDomain l;
 354         int dom_idx;
 355         struct lsa_String domain_name;
 356         struct lsa_String user_name;
 357         struct samr_OpenDomain o;
 358         struct samr_CreateUser2 c;
 359         uint32_t user_rid,access_granted;
 360
 361         samr_pipe = dcerpc_pipe_init(mem_ctx,
 362                                      cli->transport->socket->event.ctx,
 363                                      lp_iconv_convenience(lp_ctx));
 364         if (samr_pipe == NULL) {
 365                 d_printf("dcerpc_pipe_init failed\n");
 366                 status = NT_STATUS_NO_MEMORY;
 367                 goto fail;
 368         }
 369
 370         status = dcerpc_pipe_open_smb(samr_pipe, cli->tree, "\\samr");
 371         if (!NT_STATUS_IS_OK(status)) {
 372                 d_printf("dcerpc_pipe_open_smb failed: %s\n",
 373                          nt_errstr(status));
 374                 goto fail;
 375         }
 376
 377         if (admin_creds != NULL) {
 378                 status = dcerpc_bind_auth(samr_pipe, &ndr_table_samr,
 379                                           admin_creds, lp_ctx, auth_type, auth_level,
 380                                           NULL);
 381                 if (!NT_STATUS_IS_OK(status)) {
 382                         d_printf("dcerpc_bind_auth failed: %s\n",
 383                                  nt_errstr(status));
 384                         goto fail;
 385                 }
 386         } else {
 387                 /* We must have an authenticated SMB connection */
 388                 status = dcerpc_bind_auth_none(samr_pipe, &ndr_table_samr);
 389                 if (!NT_STATUS_IS_OK(status)) {
 390                         d_printf("dcerpc_bind_auth_none failed: %s\n",
 391                                  nt_errstr(status));
 392                         goto fail;
 393                 }
 394         }
 395
 396         conn.in.system_name = talloc_asprintf(
 397                 mem_ctx, "\\\\%s", dcerpc_server_name(samr_pipe));
 398         conn.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
 399         conn.out.connect_handle = &conn_handle;
 400
 401         status = dcerpc_samr_Connect2(samr_pipe, mem_ctx, &conn);
 402         if (!NT_STATUS_IS_OK(status)) {
 403                 d_printf("samr_Connect2 failed: %s\n", nt_errstr(status));
 404                 goto fail;
 405         }
 406
 407         enumdom.in.connect_handle = &conn_handle;
 408         enumdom.in.resume_handle = &resume_handle;
 409         enumdom.in.buf_size = (uint32_t)-1;
 410         enumdom.out.resume_handle = &resume_handle;
 411
 412         status = dcerpc_samr_EnumDomains(samr_pipe, mem_ctx, &enumdom);
 413         if (!NT_STATUS_IS_OK(status)) {
 414                 d_printf("samr_EnumDomains failed: %s\n", nt_errstr(status));
 415                 goto fail;
 416         }
 417
 418         if (enumdom.out.num_entries != 2) {
 419                 d_printf("samr_EnumDomains returned %d entries, expected 2\n",
 420                          enumdom.out.num_entries);
 421                 status = NT_STATUS_UNSUCCESSFUL;
 422                 goto fail;
 423         }
 424
 425         dom_idx = strequal(enumdom.out.sam->entries[0].name.string,
 426                            "builtin") ? 1:0;
 427
 428         l.in.connect_handle = &conn_handle;
 429         domain_name.string = enumdom.out.sam->entries[dom_idx].name.string;
 430         *domain = talloc_strdup(mem_ctx, domain_name.string);
 431         l.in.domain_name = &domain_name;
 432
 433         status = dcerpc_samr_LookupDomain(samr_pipe, mem_ctx, &l);
 434         if (!NT_STATUS_IS_OK(status)) {
 435                 d_printf("samr_LookupDomain failed: %s\n", nt_errstr(status));
 436                 goto fail;
 437         }
 438
 439         o.in.connect_handle = &conn_handle;
 440         o.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
 441         o.in.sid = l.out.sid;
 442         o.out.domain_handle = &domain_handle;
 443
 444         status = dcerpc_samr_OpenDomain(samr_pipe, mem_ctx, &o);
 445         if (!NT_STATUS_IS_OK(status)) {
 446                 d_printf("samr_OpenDomain failed: %s\n", nt_errstr(status));
 447                 goto fail;
 448         }
 449
 450         c.in.domain_handle = &domain_handle;
 451         user_name.string = username;
 452         c.in.account_name = &user_name;
 453         c.in.acct_flags = ACB_NORMAL;
 454         c.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
 455         user_handle = talloc(mem_ctx, struct policy_handle);
 456         c.out.user_handle = user_handle;
 457         c.out.access_granted = &access_granted;
 458         c.out.rid = &user_rid;
 459
 460         status = dcerpc_samr_CreateUser2(samr_pipe, mem_ctx, &c);
 461
 462         if (NT_STATUS_EQUAL(status, NT_STATUS_USER_EXISTS)) {
 463                 struct samr_LookupNames ln;
 464                 struct samr_OpenUser ou;
 465
 466                 ln.in.domain_handle = &domain_handle;
 467                 ln.in.num_names = 1;
 468                 ln.in.names = &user_name;
 469
 470                 status = dcerpc_samr_LookupNames(samr_pipe, mem_ctx, &ln);
 471                 if (!NT_STATUS_IS_OK(status)) {
 472                         d_printf("samr_LookupNames failed: %s\n",
 473                                  nt_errstr(status));
 474                         goto fail;
 475                 }
 476
 477                 ou.in.domain_handle = &domain_handle;
 478                 ou.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
 479                 user_rid = ou.in.rid = ln.out.rids.ids[0];
 480                 ou.out.user_handle = user_handle;
 481
 482                 status = dcerpc_samr_OpenUser(samr_pipe, mem_ctx, &ou);
 483                 if (!NT_STATUS_IS_OK(status)) {
 484                         d_printf("samr_OpenUser failed: %s\n",
 485                                  nt_errstr(status));
 486                         goto fail;
 487                 }
 488         }
 489
 490         if (!NT_STATUS_IS_OK(status)) {
 491                 d_printf("samr_CreateUser failed: %s\n", nt_errstr(status));
 492                 goto fail;
 493         }
 494
 495         *result_pipe = samr_pipe;
 496         *result_handle = user_handle;
 497         if (sid != NULL) {
 498                 *sid = dom_sid_add_rid(mem_ctx, l.out.sid, user_rid);
 499         }
 500         return NT_STATUS_OK;
 501
 502  fail:
 503         return status;
 504 }
 505
 506 /*
 507  * Create a test user
 508  */
 509
 510 static bool create_user(TALLOC_CTX *mem_ctx, struct smbcli_state *cli,
 511                         struct loadparm_context *lp_ctx,
 512                         struct cli_credentials *admin_creds,
 513                         const char *username, const char *password,
 514                         char **domain_name,
 515                         struct dom_sid **user_sid)
 516 {
 517         TALLOC_CTX *tmp_ctx;
 518         NTSTATUS status;
 519         struct dcerpc_pipe *samr_pipe;
 520         struct policy_handle *wks_handle;
 521         bool ret = false;
 522
 523         if (!(tmp_ctx = talloc_new(mem_ctx))) {
 524                 d_printf("talloc_init failed\n");
 525                 return false;
 526         }
 527
 528         status = get_usr_handle(cli, tmp_ctx, lp_ctx, admin_creds,
 529                                 DCERPC_AUTH_TYPE_NTLMSSP,
 530                                 DCERPC_AUTH_LEVEL_INTEGRITY,
 531                                 username, domain_name, &samr_pipe, &wks_handle,
 532                                 user_sid);
 533         if (!NT_STATUS_IS_OK(status)) {
 534                 d_printf("get_usr_handle failed: %s\n", nt_errstr(status));
 535                 goto done;
 536         }
 537
 538         {
 539                 struct samr_SetUserInfo2 sui2;
 540                 struct samr_SetUserInfo sui;
 541                 struct samr_QueryUserInfo qui;
 542                 union samr_UserInfo u_info;
 543                 DATA_BLOB session_key;
 544
 545
 546                 ZERO_STRUCT(u_info);
 547                 encode_pw_buffer(u_info.info23.password.data, password,
 548                                  STR_UNICODE);
 549
 550                 status = dcerpc_fetch_session_key(samr_pipe, &session_key);
 551                 if (!NT_STATUS_IS_OK(status)) {
 552                         d_printf("dcerpc_fetch_session_key failed\n");
 553                         goto done;
 554                 }
 555                 arcfour_crypt_blob(u_info.info23.password.data, 516,
 556                                    &session_key);
 557                 u_info.info23.info.password_expired = 0;
 558                 u_info.info23.info.fields_present = SAMR_FIELD_PASSWORD |
 559                                                     SAMR_FIELD_PASSWORD2 |
 560                                                     SAMR_FIELD_EXPIRED_FLAG;
 561                 sui2.in.user_handle = wks_handle;
 562                 sui2.in.info = &u_info;
 563                 sui2.in.level = 23;
 564
 565                 status = dcerpc_samr_SetUserInfo2(samr_pipe, tmp_ctx, &sui2);
 566                 if (!NT_STATUS_IS_OK(status)) {
 567                         d_printf("samr_SetUserInfo(23) failed: %s\n",
 568                                  nt_errstr(status));
 569                         goto done;
 570                 }
 571
 572                 u_info.info16.acct_flags = ACB_NORMAL;
 573                 sui.in.user_handle = wks_handle;
 574                 sui.in.info = &u_info;
 575                 sui.in.level = 16;
 576
 577                 status = dcerpc_samr_SetUserInfo(samr_pipe, tmp_ctx, &sui);
 578                 if (!NT_STATUS_IS_OK(status)) {
 579                         d_printf("samr_SetUserInfo(16) failed\n");
 580                         goto done;
 581                 }
 582
 583                 qui.in.user_handle = wks_handle;
 584                 qui.in.level = 21;
 585
 586                 status = dcerpc_samr_QueryUserInfo(samr_pipe, tmp_ctx, &qui);
 587                 if (!NT_STATUS_IS_OK(status)) {
 588                         d_printf("samr_QueryUserInfo(21) failed\n");
 589                         goto done;
 590                 }
 591
 592                 qui.out.info->info21.allow_password_change = 0;
 593                 qui.out.info->info21.force_password_change = 0;
 594                 qui.out.info->info21.account_name.string = NULL;
 595                 qui.out.info->info21.rid = 0;
 596                 qui.out.info->info21.acct_expiry = 0;
 597                 qui.out.info->info21.fields_present = 0x81827fa; /* copy usrmgr.exe */
 598
 599                 u_info.info21 = qui.out.info->info21;
 600                 sui.in.user_handle = wks_handle;
 601                 sui.in.info = &u_info;
 602                 sui.in.level = 21;
 603
 604                 status = dcerpc_samr_SetUserInfo(samr_pipe, tmp_ctx, &sui);
 605                 if (!NT_STATUS_IS_OK(status)) {
 606                         d_printf("samr_SetUserInfo(21) failed\n");
 607                         goto done;
 608                 }
 609         }
 610
 611         *domain_name= talloc_steal(mem_ctx, *domain_name);
 612         *user_sid = talloc_steal(mem_ctx, *user_sid);
 613         ret = true;
 614  done:
 615         talloc_free(tmp_ctx);
 616         return ret;
 617 }
 618
 619 /*
 620  * Delete a test user
 621  */
 622
 623 static bool delete_user(struct smbcli_state *cli,
 624                         struct loadparm_context *lp_ctx,
 625                         struct cli_credentials *admin_creds,
 626                         const char *username)
 627 {
 628         TALLOC_CTX *mem_ctx;
 629         NTSTATUS status;
 630         char *dom_name;
 631         struct dcerpc_pipe *samr_pipe;
 632         struct policy_handle *user_handle;
 633         bool ret = false;
 634
 635         if ((mem_ctx = talloc_init("leave")) == NULL) {
 636                 d_printf("talloc_init failed\n");
 637                 return false;
 638         }
 639
 640         status = get_usr_handle(cli, mem_ctx, lp_ctx, admin_creds,
 641                                 DCERPC_AUTH_TYPE_NTLMSSP,
 642                                 DCERPC_AUTH_LEVEL_INTEGRITY,
 643                                 username, &dom_name, &samr_pipe,
 644                                 &user_handle, NULL);
 645
 646         if (!NT_STATUS_IS_OK(status)) {
 647                 d_printf("get_wks_handle failed: %s\n", nt_errstr(status));
 648                 goto done;
 649         }
 650
 651         {
 652                 struct samr_DeleteUser d;
 653
 654                 d.in.user_handle = user_handle;
 655                 d.out.user_handle = user_handle;
 656
 657                 status = dcerpc_samr_DeleteUser(samr_pipe, mem_ctx, &d);
 658                 if (!NT_STATUS_IS_OK(status)) {
 659                         d_printf("samr_DeleteUser failed %s\n", nt_errstr(status));
 660                         goto done;
 661                 }
 662         }
 663
 664         ret = true;
 665
 666  done:
 667         talloc_free(mem_ctx);
 668         return ret;
 669 }
 670
 671 /*
 672  * Do a Samba3-style join
 673  */
 674
 675 static bool join3(struct smbcli_state *cli,
 676                   struct loadparm_context *lp_ctx,
 677                   bool use_level25,
 678                   struct cli_credentials *admin_creds,
 679                   struct cli_credentials *wks_creds)
 680 {
 681         TALLOC_CTX *mem_ctx;
 682         NTSTATUS status;
 683         char *dom_name;
 684         struct dcerpc_pipe *samr_pipe;
 685         struct policy_handle *wks_handle;
 686         bool ret = false;
 687         NTTIME last_password_change;
 688
 689         if ((mem_ctx = talloc_init("join3")) == NULL) {
 690                 d_printf("talloc_init failed\n");
 691                 return false;
 692         }
 693
 694         status = get_usr_handle(
 695                 cli, mem_ctx, lp_ctx, admin_creds,
 696                 DCERPC_AUTH_TYPE_NTLMSSP,
 697                 DCERPC_AUTH_LEVEL_PRIVACY,
 698                 talloc_asprintf(mem_ctx, "%s$",
 699                                 cli_credentials_get_workstation(wks_creds)),
 700                 &dom_name, &samr_pipe, &wks_handle, NULL);
 701
 702         if (!NT_STATUS_IS_OK(status)) {
 703                 d_printf("get_wks_handle failed: %s\n", nt_errstr(status));
 704                 goto done;
 705         }
 706
 707         {
 708                 struct samr_QueryUserInfo q;
 709
 710                 q.in.user_handle = wks_handle;
 711                 q.in.level = 21;
 712
 713                 status = dcerpc_samr_QueryUserInfo(samr_pipe, mem_ctx, &q);
 714                 if (!NT_STATUS_IS_OK(status)) {
 715                         d_printf("(%s) QueryUserInfo failed: %s\n",
 716                                   __location__, nt_errstr(status));
 717                         goto done;
 718                 }
 719
 720                 last_password_change = q.out.info->info21.last_password_change;
 721         }
 722
 723         cli_credentials_set_domain(wks_creds, dom_name, CRED_SPECIFIED);
 724
 725         if (use_level25) {
 726                 struct samr_SetUserInfo2 sui2;
 727                 union samr_UserInfo u_info;
 728                 struct samr_UserInfo21 *i21 = &u_info.info25.info;
 729                 DATA_BLOB session_key;
 730                 DATA_BLOB confounded_session_key = data_blob_talloc(
 731                         mem_ctx, NULL, 16);
 732                 struct MD5Context ctx;
 733                 uint8_t confounder[16];
 734
 735                 ZERO_STRUCT(u_info);
 736
 737                 i21->full_name.string = talloc_asprintf(
 738                         mem_ctx, "%s$",
 739                         cli_credentials_get_workstation(wks_creds));
 740                 i21->acct_flags = ACB_WSTRUST;
 741                 i21->fields_present = SAMR_FIELD_FULL_NAME |
 742                         SAMR_FIELD_ACCT_FLAGS | SAMR_FIELD_PASSWORD;
 743
 744                 encode_pw_buffer(u_info.info25.password.data,
 745                                  cli_credentials_get_password(wks_creds),
 746                                  STR_UNICODE);
 747                 status = dcerpc_fetch_session_key(samr_pipe, &session_key);
 748                 if (!NT_STATUS_IS_OK(status)) {
 749                         d_printf("dcerpc_fetch_session_key failed: %s\n",
 750                                  nt_errstr(status));
 751                         goto done;
 752                 }
 753                 generate_random_buffer((uint8_t *)confounder, 16);
 754
 755                 MD5Init(&ctx);
 756                 MD5Update(&ctx, confounder, 16);
 757                 MD5Update(&ctx, session_key.data, session_key.length);
 758                 MD5Final(confounded_session_key.data, &ctx);
 759
 760                 arcfour_crypt_blob(u_info.info25.password.data, 516,
 761                                    &confounded_session_key);
 762                 memcpy(&u_info.info25.password.data[516], confounder, 16);
 763
 764                 sui2.in.user_handle = wks_handle;
 765                 sui2.in.level = 25;
 766                 sui2.in.info = &u_info;
 767
 768                 status = dcerpc_samr_SetUserInfo2(samr_pipe, mem_ctx, &sui2);
 769                 if (!NT_STATUS_IS_OK(status)) {
 770                         d_printf("samr_SetUserInfo2(25) failed: %s\n",
 771                                  nt_errstr(status));
 772                         goto done;
 773                 }
 774         } else {
 775                 struct samr_SetUserInfo2 sui2;
 776                 struct samr_SetUserInfo sui;
 777                 union samr_UserInfo u_info;
 778                 DATA_BLOB session_key;
 779
 780                 encode_pw_buffer(u_info.info24.password.data,
 781                                  cli_credentials_get_password(wks_creds),
 782                                  STR_UNICODE);
 783                 u_info.info24.pw_len =
 784                         strlen_m(cli_credentials_get_password(wks_creds))*2;
 785
 786                 status = dcerpc_fetch_session_key(samr_pipe, &session_key);
 787                 if (!NT_STATUS_IS_OK(status)) {
 788                         d_printf("dcerpc_fetch_session_key failed\n");
 789                         goto done;
 790                 }
 791                 arcfour_crypt_blob(u_info.info24.password.data, 516,
 792                                    &session_key);
 793                 sui2.in.user_handle = wks_handle;
 794                 sui2.in.info = &u_info;
 795                 sui2.in.level = 24;
 796
 797                 status = dcerpc_samr_SetUserInfo2(samr_pipe, mem_ctx, &sui2);
 798                 if (!NT_STATUS_IS_OK(status)) {
 799                         d_printf("samr_SetUserInfo(24) failed: %s\n",
 800                                  nt_errstr(status));
 801                         goto done;
 802                 }
 803
 804                 u_info.info16.acct_flags = ACB_WSTRUST;
 805                 sui.in.user_handle = wks_handle;
 806                 sui.in.info = &u_info;
 807                 sui.in.level = 16;
 808
 809                 status = dcerpc_samr_SetUserInfo(samr_pipe, mem_ctx, &sui);
 810                 if (!NT_STATUS_IS_OK(status)) {
 811                         d_printf("samr_SetUserInfo(16) failed\n");
 812                         goto done;
 813                 }
 814         }
 815
 816         {
 817                 struct samr_QueryUserInfo q;
 818
 819                 q.in.user_handle = wks_handle;
 820                 q.in.level = 21;
 821
 822                 status = dcerpc_samr_QueryUserInfo(samr_pipe, mem_ctx, &q);
 823                 if (!NT_STATUS_IS_OK(status)) {
 824                         d_printf("(%s) QueryUserInfo failed: %s\n",
 825                                   __location__, nt_errstr(status));
 826                         goto done;
 827                 }
 828
 829                 if (use_level25) {
 830                         if (last_password_change
 831                             == q.out.info->info21.last_password_change) {
 832                                 d_printf("(%s) last_password_change unchanged "
 833                                          "during join, level25 must change "
 834                                          "it\n", __location__);
 835                                 goto done;
 836                         }
 837                 }
 838                 else {
 839                         if (last_password_change
 840                             != q.out.info->info21.last_password_change) {
 841                                 d_printf("(%s) last_password_change changed "
 842                                          "during join, level24 doesn't "
 843                                          "change it\n", __location__);
 844                                 goto done;
 845                         }
 846                 }
 847         }
 848
 849         ret = true;
 850
 851  done:
 852         talloc_free(mem_ctx);
 853         return ret;
 854 }
 855
 856 /*
 857  * Do a ReqChallenge/Auth2 and get the wks creds
 858  */
 859
 860 static bool auth2(struct smbcli_state *cli,
 861                   struct loadparm_context *lp_ctx,
 862                   struct cli_credentials *wks_cred)
 863 {
 864         TALLOC_CTX *mem_ctx;
 865         struct dcerpc_pipe *net_pipe;
 866         bool result = false;
 867         NTSTATUS status;
 868         struct netr_ServerReqChallenge r;
 869         struct netr_Credential netr_cli_creds;
 870         struct netr_Credential netr_srv_creds;
 871         uint32_t negotiate_flags;
 872         struct netr_ServerAuthenticate2 a;
 873         struct creds_CredentialState *creds_state;
 874         struct netr_Credential netr_cred;
 875         struct samr_Password mach_pw;
 876
 877         mem_ctx = talloc_new(NULL);
 878         if (mem_ctx == NULL) {
 879                 d_printf("talloc_new failed\n");
 880                 return false;
 881         }
 882
 883         net_pipe = dcerpc_pipe_init(mem_ctx,
 884                                     cli->transport->socket->event.ctx,
 885                                     lp_iconv_convenience(lp_ctx));
 886         if (net_pipe == NULL) {
 887                 d_printf("dcerpc_pipe_init failed\n");
 888                 goto done;
 889         }
 890
 891         status = dcerpc_pipe_open_smb(net_pipe, cli->tree, "\\netlogon");
 892         if (!NT_STATUS_IS_OK(status)) {
 893                 d_printf("dcerpc_pipe_open_smb failed: %s\n",
 894                          nt_errstr(status));
 895                 goto done;
 896         }
 897
 898         status = dcerpc_bind_auth_none(net_pipe, &ndr_table_netlogon);
 899         if (!NT_STATUS_IS_OK(status)) {
 900                 d_printf("dcerpc_bind_auth_none failed: %s\n",
 901                          nt_errstr(status));
 902                 goto done;
 903         }
 904
 905         r.in.computer_name = cli_credentials_get_workstation(wks_cred);
 906         r.in.server_name = talloc_asprintf(
 907                 mem_ctx, "\\\\%s", dcerpc_server_name(net_pipe));
 908         if (r.in.server_name == NULL) {
 909                 d_printf("talloc_asprintf failed\n");
 910                 goto done;
 911         }
 912         generate_random_buffer(netr_cli_creds.data,
 913                                sizeof(netr_cli_creds.data));
 914         r.in.credentials = &netr_cli_creds;
 915         r.out.credentials = &netr_srv_creds;
 916
 917         status = dcerpc_netr_ServerReqChallenge(net_pipe, mem_ctx, &r);
 918         if (!NT_STATUS_IS_OK(status)) {
 919                 d_printf("netr_ServerReqChallenge failed: %s\n",
 920                          nt_errstr(status));
 921                 goto done;
 922         }
 923
 924         negotiate_flags = NETLOGON_NEG_AUTH2_FLAGS;
 925         E_md4hash(cli_credentials_get_password(wks_cred), mach_pw.hash);
 926
 927         creds_state = talloc(mem_ctx, struct creds_CredentialState);
 928         creds_client_init(creds_state, r.in.credentials,
 929                           r.out.credentials, &mach_pw,
 930                           &netr_cred, negotiate_flags);
 931
 932         a.in.server_name = talloc_asprintf(
 933                 mem_ctx, "\\\\%s", dcerpc_server_name(net_pipe));
 934         a.in.account_name = talloc_asprintf(
 935                 mem_ctx, "%s$", cli_credentials_get_workstation(wks_cred));
 936         a.in.computer_name = cli_credentials_get_workstation(wks_cred);
 937         a.in.secure_channel_type = SEC_CHAN_WKSTA;
 938         a.in.negotiate_flags = &negotiate_flags;
 939         a.out.negotiate_flags = &negotiate_flags;
 940         a.in.credentials = &netr_cred;
 941         a.out.credentials = &netr_cred;
 942
 943         status = dcerpc_netr_ServerAuthenticate2(net_pipe, mem_ctx, &a);
 944         if (!NT_STATUS_IS_OK(status)) {
 945                 d_printf("netr_ServerServerAuthenticate2 failed: %s\n",
 946                          nt_errstr(status));
 947                 goto done;
 948         }
 949
 950         if (!creds_client_check(creds_state, a.out.credentials)) {
 951                 d_printf("creds_client_check failed\n");
 952                 goto done;
 953         }
 954
 955         cli_credentials_set_netlogon_creds(wks_cred, creds_state);
 956
 957         result = true;
 958
 959  done:
 960         talloc_free(mem_ctx);
 961         return result;
 962 }
 963
 964 /*
 965  * Do a couple of schannel protected Netlogon ops: Interactive and Network
 966  * login, and change the wks password
 967  */
 968
 969 static bool schan(struct smbcli_state *cli,
 970                   struct loadparm_context *lp_ctx,
 971                   struct cli_credentials *wks_creds,
 972                   struct cli_credentials *user_creds)
 973 {
 974         TALLOC_CTX *mem_ctx;
 975         NTSTATUS status;
 976         bool ret = false;
 977         struct dcerpc_pipe *net_pipe;
 978         int i;
 979
 980         mem_ctx = talloc_new(NULL);
 981         if (mem_ctx == NULL) {
 982                 d_printf("talloc_new failed\n");
 983                 return false;
 984         }
 985
 986         net_pipe = dcerpc_pipe_init(mem_ctx,
 987                                     cli->transport->socket->event.ctx,
 988                                     lp_iconv_convenience(lp_ctx));
 989         if (net_pipe == NULL) {
 990                 d_printf("dcerpc_pipe_init failed\n");
 991                 goto done;
 992         }
 993
 994         status = dcerpc_pipe_open_smb(net_pipe, cli->tree, "\\netlogon");
 995         if (!NT_STATUS_IS_OK(status)) {
 996                 d_printf("dcerpc_pipe_open_smb failed: %s\n",
 997                          nt_errstr(status));
 998                 goto done;
 999         }
1000
1001 #if 0
1002         net_pipe->conn->flags |= DCERPC_DEBUG_PRINT_IN |
1003                 DCERPC_DEBUG_PRINT_OUT;
1004 #endif
1005 #if 1
1006         net_pipe->conn->flags |= (DCERPC_SIGN | DCERPC_SEAL);
1007         status = dcerpc_bind_auth(net_pipe, &ndr_table_netlogon,
1008                                   wks_creds, lp_ctx, DCERPC_AUTH_TYPE_SCHANNEL,
1009                                   DCERPC_AUTH_LEVEL_PRIVACY,
1010                                   NULL);
1011 #else
1012         status = dcerpc_bind_auth_none(net_pipe, &ndr_table_netlogon);
1013 #endif
1014         if (!NT_STATUS_IS_OK(status)) {
1015                 d_printf("schannel bind failed: %s\n", nt_errstr(status));
1016                 goto done;
1017         }
1018
1019
1020         for (i=2; i<4; i++) {
1021                 int flags;
1022                 DATA_BLOB chal, nt_resp, lm_resp, names_blob, session_key;
1023                 struct creds_CredentialState *creds_state;
1024                 struct netr_Authenticator netr_auth, netr_auth2;
1025                 struct netr_NetworkInfo ninfo;
1026                 struct netr_PasswordInfo pinfo;
1027                 struct netr_LogonSamLogon r;
1028
1029                 flags = CLI_CRED_LANMAN_AUTH | CLI_CRED_NTLM_AUTH |
1030                         CLI_CRED_NTLMv2_AUTH;
1031
1032                 chal = data_blob_talloc(mem_ctx, NULL, 8);
1033                 if (chal.data == NULL) {
1034                         d_printf("data_blob_talloc failed\n");
1035                         goto done;
1036                 }
1037
1038                 generate_random_buffer(chal.data, chal.length);
1039                 names_blob = NTLMv2_generate_names_blob(
1040                         mem_ctx, lp_iconv_convenience(lp_ctx),
1041                         cli_credentials_get_workstation(user_creds),
1042                         cli_credentials_get_domain(user_creds));
1043                 status = cli_credentials_get_ntlm_response(
1044                         user_creds, mem_ctx, &flags, chal, names_blob,
1045                         &lm_resp, &nt_resp, NULL, NULL);
1046                 if (!NT_STATUS_IS_OK(status)) {
1047                         d_printf("cli_credentials_get_ntlm_response failed:"
1048                                  " %s\n", nt_errstr(status));
1049                         goto done;
1050                 }
1051
1052                 creds_state = cli_credentials_get_netlogon_creds(wks_creds);
1053                 creds_client_authenticator(creds_state, &netr_auth);
1054
1055                 ninfo.identity_info.account_name.string =
1056                         cli_credentials_get_username(user_creds);
1057                 ninfo.identity_info.domain_name.string =
1058                         cli_credentials_get_domain(user_creds);
1059                 ninfo.identity_info.parameter_control = 0;
1060                 ninfo.identity_info.logon_id_low = 0;
1061                 ninfo.identity_info.logon_id_high = 0;
1062                 ninfo.identity_info.workstation.string =
1063                         cli_credentials_get_workstation(user_creds);
1064                 memcpy(ninfo.challenge, chal.data, sizeof(ninfo.challenge));
1065                 ninfo.nt.length = nt_resp.length;
1066                 ninfo.nt.data = nt_resp.data;
1067                 ninfo.lm.length = lm_resp.length;
1068                 ninfo.lm.data = lm_resp.data;
1069
1070                 r.in.server_name = talloc_asprintf(
1071                         mem_ctx, "\\\\%s", dcerpc_server_name(net_pipe));
1072                 ZERO_STRUCT(netr_auth2);
1073                 r.in.computer_name =
1074                         cli_credentials_get_workstation(wks_creds);
1075                 r.in.credential = &netr_auth;
1076                 r.in.return_authenticator = &netr_auth2;
1077                 r.in.logon_level = 2;
1078                 r.in.validation_level = i;
1079                 r.in.logon.network = &ninfo;
1080                 r.out.return_authenticator = NULL;
1081
1082                 status = dcerpc_netr_LogonSamLogon(net_pipe, mem_ctx, &r);
1083                 if (!NT_STATUS_IS_OK(status)) {
1084                         d_printf("netr_LogonSamLogon failed: %s\n",
1085                                  nt_errstr(status));
1086                         goto done;
1087                 }
1088
1089                 if ((r.out.return_authenticator == NULL) ||
1090                     (!creds_client_check(creds_state,
1091                                          &r.out.return_authenticator->cred))) {
1092                         d_printf("Credentials check failed!\n");
1093                         goto done;
1094                 }
1095
1096                 creds_client_authenticator(creds_state, &netr_auth);
1097
1098                 pinfo.identity_info = ninfo.identity_info;
1099                 ZERO_STRUCT(pinfo.lmpassword.hash);
1100                 E_md4hash(cli_credentials_get_password(user_creds),
1101                           pinfo.ntpassword.hash);
1102                 session_key = data_blob_talloc(mem_ctx,
1103                                                creds_state->session_key, 16);
1104                 arcfour_crypt_blob(pinfo.ntpassword.hash,
1105                                    sizeof(pinfo.ntpassword.hash),
1106                                    &session_key);
1107
1108                 r.in.logon_level = 1;
1109                 r.in.logon.password = &pinfo;
1110                 r.out.return_authenticator = NULL;
1111
1112                 status = dcerpc_netr_LogonSamLogon(net_pipe, mem_ctx, &r);
1113                 if (!NT_STATUS_IS_OK(status)) {
1114                         d_printf("netr_LogonSamLogon failed: %s\n",
1115                                  nt_errstr(status));
1116                         goto done;
1117                 }
1118
1119                 if ((r.out.return_authenticator == NULL) ||
1120                     (!creds_client_check(creds_state,
1121                                          &r.out.return_authenticator->cred))) {
1122                         d_printf("Credentials check failed!\n");
1123                         goto done;
1124                 }
1125         }
1126
1127         {
1128                 struct netr_ServerPasswordSet s;
1129                 char *password = generate_random_str(wks_creds, 8);
1130                 struct creds_CredentialState *creds_state;
1131
1132                 s.in.server_name = talloc_asprintf(
1133                         mem_ctx, "\\\\%s", dcerpc_server_name(net_pipe));
1134                 s.in.computer_name = cli_credentials_get_workstation(wks_creds);
1135                 s.in.account_name = talloc_asprintf(
1136                         mem_ctx, "%s$", s.in.computer_name);
1137                 s.in.secure_channel_type = SEC_CHAN_WKSTA;
1138                 E_md4hash(password, s.in.new_password.hash);
1139
1140                 creds_state = cli_credentials_get_netlogon_creds(wks_creds);
1141                 creds_des_encrypt(creds_state, &s.in.new_password);
1142                 creds_client_authenticator(creds_state, &s.in.credential);
1143
1144                 status = dcerpc_netr_ServerPasswordSet(net_pipe, mem_ctx, &s);
1145                 if (!NT_STATUS_IS_OK(status)) {
1146                         printf("ServerPasswordSet - %s\n", nt_errstr(status));
1147                         goto done;
1148                 }
1149
1150                 if (!creds_client_check(creds_state,
1151                                         &s.out.return_authenticator.cred)) {
1152                         printf("Credential chaining failed\n");
1153                 }
1154
1155                 cli_credentials_set_password(wks_creds, password,
1156                                              CRED_SPECIFIED);
1157         }
1158
1159         ret = true;
1160  done:
1161         talloc_free(mem_ctx);
1162         return ret;
1163 }
1164
1165 /*
1166  * Delete the wks account again
1167  */
1168
1169 static bool leave(struct smbcli_state *cli,
1170                   struct loadparm_context *lp_ctx,
1171                   struct cli_credentials *admin_creds,
1172                   struct cli_credentials *wks_creds)
1173 {
1174         char *wks_name = talloc_asprintf(
1175                 NULL, "%s$", cli_credentials_get_workstation(wks_creds));
1176         bool ret;
1177
1178         ret = delete_user(cli, lp_ctx, admin_creds, wks_name);
1179         talloc_free(wks_name);
1180         return ret;
1181 }
1182
1183 /*
1184  * Test the Samba3 DC code a bit. Join, do some schan netlogon ops, leave
1185  */
1186
1187 bool torture_netlogon_samba3(struct torture_context *torture)
1188 {
1189         TALLOC_CTX *mem_ctx;
1190         NTSTATUS status;
1191         bool ret = false;
1192         struct smbcli_state *cli;
1193         struct cli_credentials *anon_creds;
1194         struct cli_credentials *wks_creds;
1195         const char *wks_name;
1196         int i;
1197         struct smbcli_options options;
1198
1199         wks_name = torture_setting_string(torture, "wksname", NULL);
1200         if (wks_name == NULL) {
1201                 wks_name = get_myname();
1202         }
1203
1204         mem_ctx = talloc_init("torture_netlogon_samba3");
1205
1206         if (mem_ctx == NULL) {
1207                 d_printf("talloc_init failed\n");
1208                 return false;
1209         }
1210
1211         if (!(anon_creds = cli_credentials_init_anon(mem_ctx))) {
1212                 d_printf("create_anon_creds failed\n");
1213                 goto done;
1214         }
1215
1216         lp_smbcli_options(torture->lp_ctx, &options);
1217
1218         status = smbcli_full_connection(mem_ctx, &cli,
1219                                         torture_setting_string(torture, "host", NULL),
1220                                         lp_smb_ports(torture->lp_ctx),
1221                                         "IPC$", NULL, anon_creds,
1222                                         lp_resolve_context(torture->lp_ctx),
1223                                         torture->ev, &options);
1224         if (!NT_STATUS_IS_OK(status)) {
1225                 d_printf("smbcli_full_connection failed: %s\n",
1226                          nt_errstr(status));
1227                 goto done;
1228         }
1229
1230         wks_creds = cli_credentials_init(mem_ctx);
1231         if (wks_creds == NULL) {
1232                 d_printf("cli_credentials_init failed\n");
1233                 goto done;
1234         }
1235
1236         cli_credentials_set_conf(wks_creds, torture->lp_ctx);
1237         cli_credentials_set_secure_channel_type(wks_creds, SEC_CHAN_WKSTA);
1238         cli_credentials_set_username(wks_creds, wks_name, CRED_SPECIFIED);
1239         cli_credentials_set_workstation(wks_creds, wks_name, CRED_SPECIFIED);
1240         cli_credentials_set_password(wks_creds,
1241                                      generate_random_str(wks_creds, 8),
1242                                      CRED_SPECIFIED);
1243
1244         if (!join3(cli, torture->lp_ctx, false, cmdline_credentials, wks_creds)) {
1245                 d_printf("join failed\n");
1246                 goto done;
1247         }
1248
1249         cli_credentials_set_domain(
1250                 cmdline_credentials, cli_credentials_get_domain(wks_creds),
1251                 CRED_SPECIFIED);
1252
1253         for (i=0; i<2; i++) {
1254
1255                 /* Do this more than once, the routine "schan" changes
1256                  * the workstation password using the netlogon
1257                  * password change routine */
1258
1259                 int j;
1260
1261                 if (!auth2(cli, torture->lp_ctx, wks_creds)) {
1262                         d_printf("auth2 failed\n");
1263                         goto done;
1264                 }
1265
1266                 for (j=0; j<2; j++) {
1267                         if (!schan(cli, torture->lp_ctx, wks_creds, cmdline_credentials)) {
1268                                 d_printf("schan failed\n");
1269                                 goto done;
1270                         }
1271                 }
1272         }
1273
1274         if (!leave(cli, torture->lp_ctx, cmdline_credentials, wks_creds)) {
1275                 d_printf("leave failed\n");
1276                 goto done;
1277         }
1278
1279         ret = true;
1280
1281  done:
1282         talloc_free(mem_ctx);
1283         return ret;
1284 }
1285
1286 /*
1287  * Do a simple join, testjoin and leave using specified smb and samr
1288  * credentials
1289  */
1290
1291 static bool test_join3(struct torture_context *tctx,
1292                        bool use_level25,
1293                        struct cli_credentials *smb_creds,
1294                        struct cli_credentials *samr_creds,
1295                        const char *wks_name)
1296 {
1297         NTSTATUS status;
1298         bool ret = false;
1299         struct smbcli_state *cli;
1300         struct cli_credentials *wks_creds;
1301         struct smbcli_options options;
1302
1303         lp_smbcli_options(tctx->lp_ctx, &options);
1304
1305         status = smbcli_full_connection(tctx, &cli,
1306                                         torture_setting_string(tctx, "host", NULL),
1307                                         lp_smb_ports(tctx->lp_ctx),
1308                                         "IPC$", NULL, smb_creds,
1309                                         lp_resolve_context(tctx->lp_ctx),
1310                                         tctx->ev, &options);
1311         if (!NT_STATUS_IS_OK(status)) {
1312                 d_printf("smbcli_full_connection failed: %s\n",
1313                          nt_errstr(status));
1314                 goto done;
1315         }
1316
1317         wks_creds = cli_credentials_init(cli);
1318         if (wks_creds == NULL) {
1319                 d_printf("cli_credentials_init failed\n");
1320                 goto done;
1321         }
1322
1323         cli_credentials_set_conf(wks_creds, tctx->lp_ctx);
1324         cli_credentials_set_secure_channel_type(wks_creds, SEC_CHAN_WKSTA);
1325         cli_credentials_set_username(wks_creds, wks_name, CRED_SPECIFIED);
1326         cli_credentials_set_workstation(wks_creds, wks_name, CRED_SPECIFIED);
1327         cli_credentials_set_password(wks_creds,
1328                                      generate_random_str(wks_creds, 8),
1329                                      CRED_SPECIFIED);
1330
1331         if (!join3(cli, tctx->lp_ctx, use_level25, samr_creds, wks_creds)) {
1332                 d_printf("join failed\n");
1333                 goto done;
1334         }
1335
1336         cli_credentials_set_domain(
1337                 cmdline_credentials, cli_credentials_get_domain(wks_creds),
1338                 CRED_SPECIFIED);
1339
1340         if (!auth2(cli, tctx->lp_ctx, wks_creds)) {
1341                 d_printf("auth2 failed\n");
1342                 goto done;
1343         }
1344
1345         if (!leave(cli, tctx->lp_ctx, samr_creds, wks_creds)) {
1346                 d_printf("leave failed\n");
1347                 goto done;
1348         }
1349
1350         talloc_free(cli);
1351
1352         ret = true;
1353
1354  done:
1355         return ret;
1356 }
1357
1358 /*
1359  * Test the different session key variants. Do it by joining, this uses the
1360  * session key in the setpassword routine. Test the join by doing the auth2.
1361  */
1362
1363 bool torture_samba3_sessionkey(struct torture_context *torture)
1364 {
1365         bool ret = false;
1366         struct cli_credentials *anon_creds;
1367         const char *wks_name;
1368
1369         wks_name = torture_setting_string(torture, "wksname", get_myname());
1370
1371         if (!(anon_creds = cli_credentials_init_anon(torture))) {
1372                 d_printf("create_anon_creds failed\n");
1373                 goto done;
1374         }
1375
1376         cli_credentials_set_workstation(anon_creds, wks_name, CRED_SPECIFIED);
1377
1378         ret = true;
1379
1380         if (!torture_setting_bool(torture, "samba3", false)) {
1381
1382                 /* Samba3 in the build farm right now does this happily. Need
1383                  * to fix :-) */
1384
1385                 if (test_join3(torture, false, anon_creds, NULL, wks_name)) {
1386                         d_printf("join using anonymous bind on an anonymous smb "
1387                                  "connection succeeded -- HUH??\n");
1388                         ret = false;
1389                 }
1390         }
1391
1392         if (!test_join3(torture, false, anon_creds, cmdline_credentials,
1393                         wks_name)) {
1394                 d_printf("join using ntlmssp bind on an anonymous smb "
1395                          "connection failed\n");
1396                 ret = false;
1397         }
1398
1399         if (!test_join3(torture, false, cmdline_credentials, NULL, wks_name)) {
1400                 d_printf("join using anonymous bind on an authenticated smb "
1401                          "connection failed\n");
1402                 ret = false;
1403         }
1404
1405         if (!test_join3(torture, false, cmdline_credentials,
1406                         cmdline_credentials,
1407                         wks_name)) {
1408                 d_printf("join using ntlmssp bind on an authenticated smb "
1409                          "connection failed\n");
1410                 ret = false;
1411         }
1412
1413         /*
1414          * The following two are tests for setuserinfolevel 25
1415          */
1416
1417         if (!test_join3(torture, true, anon_creds, cmdline_credentials,
1418                         wks_name)) {
1419                 d_printf("join using ntlmssp bind on an anonymous smb "
1420                          "connection failed\n");
1421                 ret = false;
1422         }
1423
1424         if (!test_join3(torture, true, cmdline_credentials, NULL, wks_name)) {
1425                 d_printf("join using anonymous bind on an authenticated smb "
1426                          "connection failed\n");
1427                 ret = false;
1428         }
1429
1430  done:
1431
1432         return ret;
1433 }
1434
1435 /*
1436  * open pipe and bind, given an IPC$ context
1437  */
1438
1439 static NTSTATUS pipe_bind_smb(TALLOC_CTX *mem_ctx,
1440                               struct loadparm_context *lp_ctx,
1441                               struct smbcli_tree *tree,
1442                               const char *pipe_name,
1443                               const struct ndr_interface_table *iface,
1444                               struct dcerpc_pipe **p)
1445 {
1446         struct dcerpc_pipe *result;
1447         NTSTATUS status;
1448
1449         if (!(result = dcerpc_pipe_init(
1450                       mem_ctx, tree->session->transport->socket->event.ctx,
1451                       lp_iconv_convenience(lp_ctx)))) {
1452                 return NT_STATUS_NO_MEMORY;
1453         }
1454
1455         status = dcerpc_pipe_open_smb(result, tree, pipe_name);
1456         if (!NT_STATUS_IS_OK(status)) {
1457                 d_printf("dcerpc_pipe_open_smb failed: %s\n",
1458                          nt_errstr(status));
1459                 talloc_free(result);
1460                 return status;
1461         }
1462
1463         status = dcerpc_bind_auth_none(result, iface);
1464         if (!NT_STATUS_IS_OK(status)) {
1465                 d_printf("schannel bind failed: %s\n", nt_errstr(status));
1466                 talloc_free(result);
1467                 return status;
1468         }
1469
1470         *p = result;
1471         return NT_STATUS_OK;
1472 }
1473
1474 /*
1475  * Sane wrapper around lsa_LookupNames
1476  */
1477
1478 static struct dom_sid *name2sid(TALLOC_CTX *mem_ctx,
1479                                 struct dcerpc_pipe *p,
1480                                 const char *name,
1481                                 const char *domain)
1482 {
1483         struct lsa_ObjectAttribute attr;
1484         struct lsa_QosInfo qos;
1485         struct lsa_OpenPolicy2 r;
1486         struct lsa_Close c;
1487         NTSTATUS status;
1488         struct policy_handle handle;
1489         struct lsa_LookupNames l;
1490         struct lsa_TransSidArray sids;
1491         struct lsa_String lsa_name;
1492         uint32_t count = 0;
1493         struct dom_sid *result;
1494         TALLOC_CTX *tmp_ctx;
1495
1496         if (!(tmp_ctx = talloc_new(mem_ctx))) {
1497                 return NULL;
1498         }
1499
1500         qos.len = 0;
1501         qos.impersonation_level = 2;
1502         qos.context_mode = 1;
1503         qos.effective_only = 0;
1504
1505         attr.len = 0;
1506         attr.root_dir = NULL;
1507         attr.object_name = NULL;
1508         attr.attributes = 0;
1509         attr.sec_desc = NULL;
1510         attr.sec_qos = &qos;
1511
1512         r.in.system_name = "\\";
1513         r.in.attr = &attr;
1514         r.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
1515         r.out.handle = &handle;
1516
1517         status = dcerpc_lsa_OpenPolicy2(p, tmp_ctx, &r);
1518         if (!NT_STATUS_IS_OK(status)) {
1519                 printf("OpenPolicy2 failed - %s\n", nt_errstr(status));
1520                 talloc_free(tmp_ctx);
1521                 return NULL;
1522         }
1523
1524         sids.count = 0;
1525         sids.sids = NULL;
1526
1527         lsa_name.string = talloc_asprintf(tmp_ctx, "%s\\%s", domain, name);
1528
1529         l.in.handle = &handle;
1530         l.in.num_names = 1;
1531         l.in.names = &lsa_name;
1532         l.in.sids = &sids;
1533         l.in.level = 1;
1534         l.in.count = &count;
1535         l.out.count = &count;
1536         l.out.sids = &sids;
1537
1538         status = dcerpc_lsa_LookupNames(p, tmp_ctx, &l);
1539         if (!NT_STATUS_IS_OK(status)) {
1540                 printf("LookupNames of %s failed - %s\n", lsa_name.string,
1541                        nt_errstr(status));
1542                 talloc_free(tmp_ctx);
1543                 return NULL;
1544         }
1545
1546         result = dom_sid_add_rid(mem_ctx, l.out.domains->domains[0].sid,
1547                                  l.out.sids->sids[0].rid);
1548
1549         c.in.handle = &handle;
1550         c.out.handle = &handle;
1551
1552         status = dcerpc_lsa_Close(p, tmp_ctx, &c);
1553         if (!NT_STATUS_IS_OK(status)) {
1554                 printf("dcerpc_lsa_Close failed - %s\n", nt_errstr(status));
1555                 talloc_free(tmp_ctx);
1556                 return NULL;
1557         }
1558
1559         talloc_free(tmp_ctx);
1560         return result;
1561 }
1562
1563 /*
1564  * Find out the user SID on this connection
1565  */
1566
1567 static struct dom_sid *whoami(TALLOC_CTX *mem_ctx,
1568                               struct loadparm_context *lp_ctx,
1569                               struct smbcli_tree *tree)
1570 {
1571         struct dcerpc_pipe *lsa;
1572         struct lsa_GetUserName r;
1573         NTSTATUS status;
1574         struct lsa_StringPointer authority_name_p;
1575         struct dom_sid *result;
1576
1577         status = pipe_bind_smb(mem_ctx, lp_ctx, tree, "\\pipe\\lsarpc",
1578                                &ndr_table_lsarpc, &lsa);
1579         if (!NT_STATUS_IS_OK(status)) {
1580                 d_printf("(%s) Could not bind to LSA: %s\n",
1581                          __location__, nt_errstr(status));
1582                 return NULL;
1583         }
1584
1585         r.in.system_name = "\\";
1586         r.in.account_name = NULL;
1587         authority_name_p.string = NULL;
1588         r.in.authority_name = &authority_name_p;
1589
1590         status = dcerpc_lsa_GetUserName(lsa, mem_ctx, &r);
1591
1592         if (!NT_STATUS_IS_OK(status)) {
1593                 printf("(%s) GetUserName failed - %s\n",
1594                        __location__, nt_errstr(status));
1595                 talloc_free(lsa);
1596                 return NULL;
1597         }
1598
1599         result = name2sid(mem_ctx, lsa, r.out.account_name->string,
1600                           r.out.authority_name->string->string);
1601
1602         talloc_free(lsa);
1603         return result;
1604 }
1605
1606 static int destroy_tree(struct smbcli_tree *tree)
1607 {
1608         smb_tree_disconnect(tree);
1609         return 0;
1610 }
1611
1612 /*
1613  * Do a tcon, given a session
1614  */
1615
1616 NTSTATUS secondary_tcon(TALLOC_CTX *mem_ctx,
1617                         struct smbcli_session *session,
1618                         const char *sharename,
1619                         struct smbcli_tree **res)
1620 {
1621         struct smbcli_tree *result;
1622         TALLOC_CTX *tmp_ctx;
1623         union smb_tcon tcon;
1624         NTSTATUS status;
1625
1626         if (!(tmp_ctx = talloc_new(mem_ctx))) {
1627                 return NT_STATUS_NO_MEMORY;
1628         }
1629
1630         if (!(result = smbcli_tree_init(session, mem_ctx, false))) {
1631                 talloc_free(tmp_ctx);
1632                 return NT_STATUS_NO_MEMORY;
1633         }
1634
1635         tcon.generic.level = RAW_TCON_TCONX;
1636         tcon.tconx.in.flags = 0;
1637         tcon.tconx.in.password = data_blob(NULL, 0);
1638         tcon.tconx.in.path = sharename;
1639         tcon.tconx.in.device = "?????";
1640
1641         status = smb_raw_tcon(result, tmp_ctx, &tcon);
1642         if (!NT_STATUS_IS_OK(status)) {
1643                 d_printf("(%s) smb_raw_tcon failed: %s\n", __location__,
1644                          nt_errstr(status));
1645                 talloc_free(tmp_ctx);
1646                 return status;
1647         }
1648
1649         result->tid = tcon.tconx.out.tid;
1650         result = talloc_steal(mem_ctx, result);
1651         talloc_set_destructor(result, destroy_tree);
1652         talloc_free(tmp_ctx);
1653         *res = result;
1654         return NT_STATUS_OK;
1655 }
1656
1657 /*
1658  * Test the getusername behaviour
1659  */
1660
1661 bool torture_samba3_rpc_getusername(struct torture_context *torture)
1662 {
1663         NTSTATUS status;
1664         struct smbcli_state *cli;
1665         TALLOC_CTX *mem_ctx;
1666         bool ret = true;
1667         struct dom_sid *user_sid;
1668         struct dom_sid *created_sid;
1669         struct cli_credentials *anon_creds;
1670         struct cli_credentials *user_creds;
1671         char *domain_name;
1672         struct smbcli_options options;
1673
1674         if (!(mem_ctx = talloc_new(torture))) {
1675                 return false;
1676         }
1677
1678         lp_smbcli_options(torture->lp_ctx, &options);
1679
1680         status = smbcli_full_connection(
1681                 mem_ctx, &cli, torture_setting_string(torture, "host", NULL),
1682                 lp_smb_ports(torture->lp_ctx),
1683                 "IPC$", NULL, cmdline_credentials,
1684                 lp_resolve_context(torture->lp_ctx),
1685                 torture->ev, &options);
1686         if (!NT_STATUS_IS_OK(status)) {
1687                 d_printf("(%s) smbcli_full_connection failed: %s\n",
1688                          __location__, nt_errstr(status));
1689                 ret = false;
1690                 goto done;
1691         }
1692
1693         if (!(user_sid = whoami(mem_ctx, torture->lp_ctx, cli->tree))) {
1694                 d_printf("(%s) whoami on auth'ed connection failed\n",
1695                          __location__);
1696                 ret = false;
1697         }
1698
1699         talloc_free(cli);
1700
1701         if (!(anon_creds = cli_credentials_init_anon(mem_ctx))) {
1702                 d_printf("(%s) create_anon_creds failed\n", __location__);
1703                 ret = false;
1704                 goto done;
1705         }
1706
1707         status = smbcli_full_connection(
1708                 mem_ctx, &cli, torture_setting_string(torture, "host", NULL),
1709                 lp_smb_ports(torture->lp_ctx),
1710                 "IPC$", NULL, anon_creds,
1711                 lp_resolve_context(torture->lp_ctx),
1712                 torture->ev, &options);
1713         if (!NT_STATUS_IS_OK(status)) {
1714                 d_printf("(%s) anon smbcli_full_connection failed: %s\n",
1715                          __location__, nt_errstr(status));
1716                 ret = false;
1717                 goto done;
1718         }
1719
1720         if (!(user_sid = whoami(mem_ctx, torture->lp_ctx, cli->tree))) {
1721                 d_printf("(%s) whoami on anon connection failed\n",
1722                          __location__);
1723                 ret = false;
1724                 goto done;
1725         }
1726
1727         if (!dom_sid_equal(user_sid,
1728                            dom_sid_parse_talloc(mem_ctx, "s-1-5-7"))) {
1729                 d_printf("(%s) Anon lsa_GetUserName returned %s, expected "
1730                          "S-1-5-7", __location__,
1731                          dom_sid_string(mem_ctx, user_sid));
1732                 ret = false;
1733         }
1734
1735         if (!(user_creds = cli_credentials_init(mem_ctx))) {
1736                 d_printf("(%s) cli_credentials_init failed\n", __location__);
1737                 ret = false;
1738                 goto done;
1739         }
1740
1741         cli_credentials_set_conf(user_creds, torture->lp_ctx);
1742         cli_credentials_set_username(user_creds, "torture_username",
1743                                      CRED_SPECIFIED);
1744         cli_credentials_set_password(user_creds,
1745                                      generate_random_str(user_creds, 8),
1746                                      CRED_SPECIFIED);
1747
1748         if (!create_user(mem_ctx, cli, torture->lp_ctx, cmdline_credentials,
1749                          cli_credentials_get_username(user_creds),
1750                          cli_credentials_get_password(user_creds),
1751                          &domain_name, &created_sid)) {
1752                 d_printf("(%s) create_user failed\n", __location__);
1753                 ret = false;
1754                 goto done;
1755         }
1756
1757         cli_credentials_set_domain(user_creds, domain_name,
1758                                    CRED_SPECIFIED);
1759
1760         {
1761                 struct smbcli_session *session2;
1762                 struct smb_composite_sesssetup setup;
1763                 struct smbcli_tree *tree;
1764
1765                 session2 = smbcli_session_init(cli->transport, mem_ctx, false);
1766                 if (session2 == NULL) {
1767                         d_printf("(%s) smbcli_session_init failed\n",
1768                                  __location__);
1769                         goto done;
1770                 }
1771
1772                 setup.in.sesskey = cli->transport->negotiate.sesskey;
1773                 setup.in.capabilities = cli->transport->negotiate.capabilities;
1774                 setup.in.workgroup = "";
1775                 setup.in.credentials = user_creds;
1776
1777                 status = smb_composite_sesssetup(session2, &setup);
1778                 if (!NT_STATUS_IS_OK(status)) {
1779                         d_printf("(%s) session setup with new user failed: "
1780                                  "%s\n", __location__, nt_errstr(status));
1781                         ret = false;
1782                         goto done;
1783                 }
1784                 session2->vuid = setup.out.vuid;
1785
1786                 if (!NT_STATUS_IS_OK(secondary_tcon(mem_ctx, session2,
1787                                                     "IPC$", &tree))) {
1788                         d_printf("(%s) secondary_tcon failed\n",
1789                                  __location__);
1790                         ret = false;
1791                         goto done;
1792                 }
1793
1794                 if (!(user_sid = whoami(mem_ctx, torture->lp_ctx, tree))) {
1795                         d_printf("(%s) whoami on user connection failed\n",
1796                                  __location__);
1797                         ret = false;
1798                         goto delete;
1799                 }
1800
1801                 talloc_free(tree);
1802         }
1803
1804         d_printf("Created %s, found %s\n",
1805                  dom_sid_string(mem_ctx, created_sid),
1806                  dom_sid_string(mem_ctx, user_sid));
1807
1808         if (!dom_sid_equal(created_sid, user_sid)) {
1809                 ret = false;
1810         }
1811
1812  delete:
1813         if (!delete_user(cli, torture->lp_ctx,
1814                          cmdline_credentials,
1815                          cli_credentials_get_username(user_creds))) {
1816                 d_printf("(%s) delete_user failed\n", __location__);
1817                 ret = false;
1818         }
1819
1820  done:
1821         talloc_free(mem_ctx);
1822         return ret;
1823 }
1824
1825 static bool test_NetShareGetInfo(struct dcerpc_pipe *p, TALLOC_CTX *mem_ctx,
1826                                  const char *sharename)
1827 {
1828         NTSTATUS status;
1829         struct srvsvc_NetShareGetInfo r;
1830         uint32_t levels[] = { 0, 1, 2, 501, 502, 1004, 1005, 1006, 1007, 1501 };
1831         int i;
1832         bool ret = true;
1833
1834         r.in.server_unc = talloc_asprintf(mem_ctx, "\\\\%s",
1835                                           dcerpc_server_name(p));
1836         r.in.share_name = sharename;
1837
1838         for (i=0;i<ARRAY_SIZE(levels);i++) {
1839                 r.in.level = levels[i];
1840
1841                 ZERO_STRUCT(r.out);
1842
1843                 printf("testing NetShareGetInfo level %u on share '%s'\n",
1844                        r.in.level, r.in.share_name);
1845
1846                 status = dcerpc_srvsvc_NetShareGetInfo(p, mem_ctx, &r);
1847                 if (!NT_STATUS_IS_OK(status)) {
1848                         printf("NetShareGetInfo level %u on share '%s' failed"
1849                                " - %s\n", r.in.level, r.in.share_name,
1850                                nt_errstr(status));
1851                         ret = false;
1852                         continue;
1853                 }
1854                 if (!W_ERROR_IS_OK(r.out.result)) {
1855                         printf("NetShareGetInfo level %u on share '%s' failed "
1856                                "- %s\n", r.in.level, r.in.share_name,
1857                                win_errstr(r.out.result));
1858                         ret = false;
1859                         continue;
1860                 }
1861         }
1862
1863         return ret;
1864 }
1865
1866 static bool test_NetShareEnum(struct dcerpc_pipe *p, TALLOC_CTX *mem_ctx,
1867                               const char **one_sharename)
1868 {
1869         NTSTATUS status;
1870         struct srvsvc_NetShareEnum r;
1871         struct srvsvc_NetShareCtr0 c0;
1872         uint32_t levels[] = { 0, 1, 2, 501, 502, 1004, 1005, 1006, 1007 };
1873         int i;
1874         bool ret = true;
1875
1876         r.in.server_unc = talloc_asprintf(mem_ctx,"\\\\%s",dcerpc_server_name(p));
1877         r.in.ctr.ctr0 = &c0;
1878         r.in.ctr.ctr0->count = 0;
1879         r.in.ctr.ctr0->array = NULL;
1880         r.in.max_buffer = (uint32_t)-1;
1881         r.in.resume_handle = NULL;
1882
1883         for (i=0;i<ARRAY_SIZE(levels);i++) {
1884                 r.in.level = levels[i];
1885
1886                 ZERO_STRUCT(r.out);
1887
1888                 printf("testing NetShareEnum level %u\n", r.in.level);
1889                 status = dcerpc_srvsvc_NetShareEnum(p, mem_ctx, &r);
1890                 if (!NT_STATUS_IS_OK(status)) {
1891                         printf("NetShareEnum level %u failed - %s\n",
1892                                r.in.level, nt_errstr(status));
1893                         ret = false;
1894                         continue;
1895                 }
1896                 if (!W_ERROR_IS_OK(r.out.result)) {
1897                         printf("NetShareEnum level %u failed - %s\n",
1898                                r.in.level, win_errstr(r.out.result));
1899                         continue;
1900                 }
1901                 if (r.in.level == 0) {
1902                         struct srvsvc_NetShareCtr0 *ctr = r.out.ctr.ctr0;
1903                         if (ctr->count > 0) {
1904                                 *one_sharename = ctr->array[0].name;
1905                         }
1906                 }
1907         }
1908
1909         return ret;
1910 }
1911
1912 bool torture_samba3_rpc_srvsvc(struct torture_context *torture)
1913 {
1914         struct dcerpc_pipe *p;
1915         TALLOC_CTX *mem_ctx;
1916         bool ret = true;
1917         const char *sharename = NULL;
1918         struct smbcli_state *cli;
1919         NTSTATUS status;
1920
1921         if (!(mem_ctx = talloc_new(torture))) {
1922                 return false;
1923         }
1924
1925         if (!(torture_open_connection_share(
1926                       mem_ctx, &cli, torture, torture_setting_string(torture, "host", NULL),
1927                       "IPC$", torture->ev))) {
1928                 talloc_free(mem_ctx);
1929                 return false;
1930         }
1931
1932         status = pipe_bind_smb(mem_ctx, torture->lp_ctx, cli->tree,
1933                                "\\pipe\\srvsvc", &ndr_table_srvsvc, &p);
1934         if (!NT_STATUS_IS_OK(status)) {
1935                 d_printf("(%s) could not bind to srvsvc pipe: %s\n",
1936                          __location__, nt_errstr(status));
1937                 ret = false;
1938                 goto done;
1939         }
1940
1941         ret &= test_NetShareEnum(p, mem_ctx, &sharename);
1942         if (sharename == NULL) {
1943                 printf("did not get sharename\n");
1944         } else {
1945                 ret &= test_NetShareGetInfo(p, mem_ctx, sharename);
1946         }
1947
1948  done:
1949         talloc_free(mem_ctx);
1950         return ret;
1951 }
1952
1953 /*
1954  * Do a ReqChallenge/Auth2 with a random wks name, make sure it returns
1955  * NT_STATUS_NO_SAM_ACCOUNT
1956  */
1957
1958 bool torture_samba3_rpc_randomauth2(struct torture_context *torture)
1959 {
1960         TALLOC_CTX *mem_ctx;
1961         struct dcerpc_pipe *net_pipe;
1962         char *wksname;
1963         bool result = false;
1964         NTSTATUS status;
1965         struct netr_ServerReqChallenge r;
1966         struct netr_Credential netr_cli_creds;
1967         struct netr_Credential netr_srv_creds;
1968         uint32_t negotiate_flags;
1969         struct netr_ServerAuthenticate2 a;
1970         struct creds_CredentialState *creds_state;
1971         struct netr_Credential netr_cred;
1972         struct samr_Password mach_pw;
1973         struct smbcli_state *cli;
1974
1975         if (!(mem_ctx = talloc_new(torture))) {
1976                 d_printf("talloc_new failed\n");
1977                 return false;
1978         }
1979
1980         if (!(wksname = generate_random_str_list(
1981                       mem_ctx, 14, "ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789"))) {
1982                 d_printf("generate_random_str_list failed\n");
1983                 goto done;
1984         }
1985
1986         if (!(torture_open_connection_share(
1987                       mem_ctx, &cli,
1988                       torture, torture_setting_string(torture, "host", NULL),
1989                       "IPC$", torture->ev))) {
1990                 d_printf("IPC$ connection failed\n");
1991                 goto done;
1992         }
1993
1994         if (!(net_pipe = dcerpc_pipe_init(
1995                       mem_ctx, cli->transport->socket->event.ctx,
1996                       lp_iconv_convenience(torture->lp_ctx)))) {
1997                 d_printf("dcerpc_pipe_init failed\n");
1998                 goto done;
1999         }
2000
2001         status = dcerpc_pipe_open_smb(net_pipe, cli->tree, "\\netlogon");
2002         if (!NT_STATUS_IS_OK(status)) {
2003                 d_printf("dcerpc_pipe_open_smb failed: %s\n",
2004                          nt_errstr(status));
2005                 goto done;
2006         }
2007
2008         status = dcerpc_bind_auth_none(net_pipe, &ndr_table_netlogon);
2009         if (!NT_STATUS_IS_OK(status)) {
2010                 d_printf("dcerpc_bind_auth_none failed: %s\n",
2011                          nt_errstr(status));
2012                 goto done;
2013         }
2014
2015         r.in.computer_name = wksname;
2016         r.in.server_name = talloc_asprintf(
2017                 mem_ctx, "\\\\%s", dcerpc_server_name(net_pipe));
2018         if (r.in.server_name == NULL) {
2019                 d_printf("talloc_asprintf failed\n");
2020                 goto done;
2021         }
2022         generate_random_buffer(netr_cli_creds.data,
2023                                sizeof(netr_cli_creds.data));
2024         r.in.credentials = &netr_cli_creds;
2025         r.out.credentials = &netr_srv_creds;
2026
2027         status = dcerpc_netr_ServerReqChallenge(net_pipe, mem_ctx, &r);
2028         if (!NT_STATUS_IS_OK(status)) {
2029                 d_printf("netr_ServerReqChallenge failed: %s\n",
2030                          nt_errstr(status));
2031                 goto done;
2032         }
2033
2034         negotiate_flags = NETLOGON_NEG_AUTH2_FLAGS;
2035         E_md4hash("foobar", mach_pw.hash);
2036
2037         creds_state = talloc(mem_ctx, struct creds_CredentialState);
2038         creds_client_init(creds_state, r.in.credentials,
2039                           r.out.credentials, &mach_pw,
2040                           &netr_cred, negotiate_flags);
2041
2042         a.in.server_name = talloc_asprintf(
2043                 mem_ctx, "\\\\%s", dcerpc_server_name(net_pipe));
2044         a.in.account_name = talloc_asprintf(
2045                 mem_ctx, "%s$", wksname);
2046         a.in.computer_name = wksname;
2047         a.in.secure_channel_type = SEC_CHAN_WKSTA;
2048         a.in.negotiate_flags = &negotiate_flags;
2049         a.out.negotiate_flags = &negotiate_flags;
2050         a.in.credentials = &netr_cred;
2051         a.out.credentials = &netr_cred;
2052
2053         status = dcerpc_netr_ServerAuthenticate2(net_pipe, mem_ctx, &a);
2054
2055         if (!NT_STATUS_EQUAL(status, NT_STATUS_NO_TRUST_SAM_ACCOUNT)) {
2056                 d_printf("dcerpc_netr_ServerAuthenticate2 returned %s, "
2057                          "expected NT_STATUS_NO_TRUST_SAM_ACCOUNT\n",
2058                          nt_errstr(status));
2059                 goto done;
2060         }
2061
2062         result = true;
2063  done:
2064         talloc_free(mem_ctx);
2065         return result;
2066 }
2067
2068 static struct security_descriptor *get_sharesec(TALLOC_CTX *mem_ctx,
2069                                                 struct loadparm_context *lp_ctx,
2070                                                 struct smbcli_session *sess,
2071                                                 const char *sharename)
2072 {
2073         struct smbcli_tree *tree;
2074         TALLOC_CTX *tmp_ctx;
2075         struct dcerpc_pipe *p;
2076         NTSTATUS status;
2077         struct srvsvc_NetShareGetInfo r;
2078         struct security_descriptor *result;
2079
2080         if (!(tmp_ctx = talloc_new(mem_ctx))) {
2081                 d_printf("talloc_new failed\n");
2082                 return NULL;
2083         }
2084
2085         if (!NT_STATUS_IS_OK(secondary_tcon(tmp_ctx, sess, "IPC$", &tree))) {
2086                 d_printf("secondary_tcon failed\n");
2087                 talloc_free(tmp_ctx);
2088                 return NULL;
2089         }
2090
2091         status = pipe_bind_smb(mem_ctx, lp_ctx, tree, "\\pipe\\srvsvc",
2092                                &ndr_table_srvsvc, &p);
2093         if (!NT_STATUS_IS_OK(status)) {
2094                 d_printf("(%s) could not bind to srvsvc pipe: %s\n",
2095                          __location__, nt_errstr(status));
2096                 talloc_free(tmp_ctx);
2097                 return NULL;
2098         }
2099
2100 #if 0
2101         p->conn->flags |= DCERPC_DEBUG_PRINT_IN | DCERPC_DEBUG_PRINT_OUT;
2102 #endif
2103
2104         r.in.server_unc = talloc_asprintf(tmp_ctx, "\\\\%s",
2105                                           dcerpc_server_name(p));
2106         r.in.share_name = sharename;
2107         r.in.level = 502;
2108
2109         status = dcerpc_srvsvc_NetShareGetInfo(p, tmp_ctx, &r);
2110         if (!NT_STATUS_IS_OK(status)) {
2111                 d_printf("srvsvc_NetShareGetInfo failed: %s\n",
2112                          nt_errstr(status));
2113                 talloc_free(tmp_ctx);
2114                 return NULL;
2115         }
2116
2117         result = talloc_steal(mem_ctx, r.out.info.info502->sd);
2118         talloc_free(tmp_ctx);
2119         return result;
2120 }
2121
2122 static NTSTATUS set_sharesec(TALLOC_CTX *mem_ctx,
2123                              struct loadparm_context *lp_ctx,
2124                              struct smbcli_session *sess,
2125                              const char *sharename,
2126                              struct security_descriptor *sd)
2127 {
2128         struct smbcli_tree *tree;
2129         TALLOC_CTX *tmp_ctx;
2130         struct dcerpc_pipe *p;
2131         NTSTATUS status;
2132         struct sec_desc_buf i;
2133         struct srvsvc_NetShareSetInfo r;
2134         uint32_t error = 0;
2135
2136         if (!(tmp_ctx = talloc_new(mem_ctx))) {
2137                 d_printf("talloc_new failed\n");
2138                 return NT_STATUS_NO_MEMORY;
2139         }
2140
2141         if (!NT_STATUS_IS_OK(secondary_tcon(tmp_ctx, sess, "IPC$", &tree))) {
2142                 d_printf("secondary_tcon failed\n");
2143                 talloc_free(tmp_ctx);
2144                 return NT_STATUS_UNSUCCESSFUL;
2145         }
2146
2147         status = pipe_bind_smb(mem_ctx, lp_ctx, tree, "\\pipe\\srvsvc",
2148                                &ndr_table_srvsvc, &p);
2149         if (!NT_STATUS_IS_OK(status)) {
2150                 d_printf("(%s) could not bind to srvsvc pipe: %s\n",
2151                          __location__, nt_errstr(status));
2152                 talloc_free(tmp_ctx);
2153                 return NT_STATUS_UNSUCCESSFUL;
2154         }
2155
2156 #if 0
2157         p->conn->flags |= DCERPC_DEBUG_PRINT_IN | DCERPC_DEBUG_PRINT_OUT;
2158 #endif
2159
2160         r.in.server_unc = talloc_asprintf(tmp_ctx, "\\\\%s",
2161                                           dcerpc_server_name(p));
2162         r.in.share_name = sharename;
2163         r.in.level = 1501;
2164         i.sd = sd;
2165         r.in.info.info1501 = &i;
2166         r.in.parm_error = &error;
2167
2168         status = dcerpc_srvsvc_NetShareSetInfo(p, tmp_ctx, &r);
2169         if (!NT_STATUS_IS_OK(status)) {
2170                 d_printf("srvsvc_NetShareGetInfo failed: %s\n",
2171                          nt_errstr(status));
2172         }
2173
2174         talloc_free(tmp_ctx);
2175         return status;
2176 }
2177
2178 bool try_tcon(TALLOC_CTX *mem_ctx,
2179               struct loadparm_context *lp_ctx,
2180               struct security_descriptor *orig_sd,
2181               struct smbcli_session *session,
2182               const char *sharename, const struct dom_sid *user_sid,
2183               unsigned int access_mask, NTSTATUS expected_tcon,
2184               NTSTATUS expected_mkdir)
2185 {
2186         TALLOC_CTX *tmp_ctx;
2187         struct smbcli_tree *rmdir_tree, *tree;
2188         struct dom_sid *domain_sid;
2189         uint32_t rid;
2190         struct security_descriptor *sd;
2191         NTSTATUS status;
2192         bool ret = true;
2193
2194         if (!(tmp_ctx = talloc_new(mem_ctx))) {
2195                 d_printf("talloc_new failed\n");
2196                 return false;
2197         }
2198
2199         status = secondary_tcon(tmp_ctx, session, sharename, &rmdir_tree);
2200         if (!NT_STATUS_IS_OK(status)) {
2201                 d_printf("first tcon to delete dir failed\n");
2202                 talloc_free(tmp_ctx);
2203                 return false;
2204         }
2205
2206         smbcli_rmdir(rmdir_tree, "sharesec_testdir");
2207
2208         if (!NT_STATUS_IS_OK(dom_sid_split_rid(tmp_ctx, user_sid,
2209                                                &domain_sid, &rid))) {
2210                 d_printf("dom_sid_split_rid failed\n");
2211                 talloc_free(tmp_ctx);
2212                 return false;
2213         }
2214
2215         sd = security_descriptor_dacl_create(
2216                 tmp_ctx, 0, "S-1-5-32-544",
2217                 dom_sid_string(mem_ctx, dom_sid_add_rid(mem_ctx, domain_sid,
2218                                                         DOMAIN_RID_USERS)),
2219                 dom_sid_string(mem_ctx, user_sid),
2220                 SEC_ACE_TYPE_ACCESS_ALLOWED, access_mask, 0, NULL);
2221         if (sd == NULL) {
2222                 d_printf("security_descriptor_dacl_create failed\n");
2223                 talloc_free(tmp_ctx);
2224                 return false;
2225         }
2226
2227         status = set_sharesec(mem_ctx, lp_ctx, session, sharename, sd);
2228         if (!NT_STATUS_IS_OK(status)) {
2229                 d_printf("custom set_sharesec failed: %s\n",
2230                          nt_errstr(status));
2231                 talloc_free(tmp_ctx);
2232                 return false;
2233         }
2234
2235         status = secondary_tcon(tmp_ctx, session, sharename, &tree);
2236         if (!NT_STATUS_EQUAL(status, expected_tcon)) {
2237                 d_printf("Expected %s, got %s\n", nt_errstr(expected_tcon),
2238                          nt_errstr(status));
2239                 ret = false;
2240                 goto done;
2241         }
2242
2243         if (!NT_STATUS_IS_OK(status)) {
2244                 /* An expected non-access, no point in trying to write */
2245                 goto done;
2246         }
2247
2248         status = smbcli_mkdir(tree, "sharesec_testdir");
2249         if (!NT_STATUS_EQUAL(status, expected_mkdir)) {
2250                 d_printf("(%s) Expected %s, got %s\n", __location__,
2251                          nt_errstr(expected_mkdir), nt_errstr(status));
2252                 ret = false;
2253         }
2254
2255  done:
2256         smbcli_rmdir(rmdir_tree, "sharesec_testdir");
2257
2258         status = set_sharesec(mem_ctx, lp_ctx, session, sharename, orig_sd);
2259         if (!NT_STATUS_IS_OK(status)) {
2260                 d_printf("custom set_sharesec failed: %s\n",
2261                          nt_errstr(status));
2262                 talloc_free(tmp_ctx);
2263                 return false;
2264         }
2265
2266         talloc_free(tmp_ctx);
2267         return ret;
2268 }
2269
2270 bool torture_samba3_rpc_sharesec(struct torture_context *torture)
2271 {
2272         TALLOC_CTX *mem_ctx;
2273         bool ret = true;
2274         struct smbcli_state *cli;
2275         struct security_descriptor *sd;
2276         struct dom_sid *user_sid;
2277
2278         if (!(mem_ctx = talloc_new(torture))) {
2279                 return false;
2280         }
2281
2282         if (!(torture_open_connection_share(
2283                       mem_ctx, &cli, torture, torture_setting_string(torture, "host", NULL),
2284                       "IPC$", torture->ev))) {
2285                 d_printf("IPC$ connection failed\n");
2286                 talloc_free(mem_ctx);
2287                 return false;
2288         }
2289
2290         if (!(user_sid = whoami(mem_ctx, torture->lp_ctx, cli->tree))) {
2291                 d_printf("whoami failed\n");
2292                 talloc_free(mem_ctx);
2293                 return false;
2294         }
2295
2296         sd = get_sharesec(mem_ctx, torture->lp_ctx, cli->session,
2297                           torture_setting_string(torture, "share", NULL));
2298
2299         ret &= try_tcon(mem_ctx, torture->lp_ctx, sd, cli->session,
2300                         torture_setting_string(torture, "share", NULL),
2301                         user_sid, 0, NT_STATUS_ACCESS_DENIED, NT_STATUS_OK);
2302
2303         ret &= try_tcon(mem_ctx, torture->lp_ctx, sd, cli->session,
2304                         torture_setting_string(torture, "share", NULL),
2305                         user_sid, SEC_FILE_READ_DATA, NT_STATUS_OK,
2306                         NT_STATUS_MEDIA_WRITE_PROTECTED);
2307
2308         ret &= try_tcon(mem_ctx, torture->lp_ctx, sd, cli->session,
2309                         torture_setting_string(torture, "share", NULL),
2310                         user_sid, SEC_FILE_ALL, NT_STATUS_OK, NT_STATUS_OK);
2311
2312         talloc_free(mem_ctx);
2313         return ret;
2314 }
2315
2316 bool torture_samba3_rpc_lsa(struct torture_context *torture)
2317 {
2318         TALLOC_CTX *mem_ctx;
2319         bool ret = true;
2320         struct smbcli_state *cli;
2321         struct dcerpc_pipe *p;
2322         struct policy_handle lsa_handle;
2323         NTSTATUS status;
2324         struct dom_sid *domain_sid;
2325
2326         if (!(mem_ctx = talloc_new(torture))) {
2327                 return false;
2328         }
2329
2330         if (!(torture_open_connection_share(
2331                       mem_ctx, &cli, torture, torture_setting_string(torture, "host", NULL),
2332                       "IPC$", torture->ev))) {
2333                 d_printf("IPC$ connection failed\n");
2334                 talloc_free(mem_ctx);
2335                 return false;
2336         }
2337
2338         status = pipe_bind_smb(mem_ctx, torture->lp_ctx, cli->tree, "\\lsarpc",
2339                                &ndr_table_lsarpc, &p);
2340         if (!NT_STATUS_IS_OK(status)) {
2341                 d_printf("(%s) pipe_bind_smb failed: %s\n", __location__,
2342                          nt_errstr(status));
2343                 talloc_free(mem_ctx);
2344                 return false;
2345         }
2346
2347         {
2348                 struct lsa_ObjectAttribute attr;
2349                 struct lsa_OpenPolicy2 o;
2350                 o.in.system_name = talloc_asprintf(
2351                         mem_ctx, "\\\\%s", dcerpc_server_name(p));
2352                 ZERO_STRUCT(attr);
2353                 o.in.attr = &attr;
2354                 o.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
2355                 o.out.handle = &lsa_handle;
2356                 status = dcerpc_lsa_OpenPolicy2(p, mem_ctx, &o);
2357                 if (!NT_STATUS_IS_OK(status)) {
2358                         d_printf("(%s) dcerpc_lsa_OpenPolicy2 failed: %s\n",
2359                                  __location__, nt_errstr(status));
2360                         talloc_free(mem_ctx);
2361                         return false;
2362                 }
2363         }
2364
2365 #if 0
2366         p->conn->flags |= DCERPC_DEBUG_PRINT_IN | DCERPC_DEBUG_PRINT_OUT;
2367 #endif
2368
2369         {
2370                 int i;
2371                 int levels[] = { 2,3,5,6 };
2372
2373                 for (i=0; i<ARRAY_SIZE(levels); i++) {
2374                         struct lsa_QueryInfoPolicy r;
2375                         r.in.handle = &lsa_handle;
2376                         r.in.level = levels[i];
2377                         status = dcerpc_lsa_QueryInfoPolicy(p, mem_ctx, &r);
2378                         if (!NT_STATUS_IS_OK(status)) {
2379                                 d_printf("(%s) dcerpc_lsa_QueryInfoPolicy %d "
2380                                          "failed: %s\n", __location__,
2381                                          levels[i], nt_errstr(status));
2382                                 talloc_free(mem_ctx);
2383                                 return false;
2384                         }
2385                         if (levels[i] == 5) {
2386                                 domain_sid = r.out.info->account_domain.sid;
2387                         }
2388                 }
2389         }
2390
2391         return ret;
2392 }
2393
2394 static NTSTATUS get_servername(TALLOC_CTX *mem_ctx, struct smbcli_tree *tree,
2395                                struct smb_iconv_convenience *iconv_convenience,
2396                                char **name)
2397 {
2398         struct rap_WserverGetInfo r;
2399         NTSTATUS status;
2400         char servername[17];
2401
2402         r.in.level = 0;
2403         r.in.bufsize = 0xffff;
2404
2405         status = smbcli_rap_netservergetinfo(tree, iconv_convenience, mem_ctx, &r);
2406         if (!NT_STATUS_IS_OK(status)) {
2407                 return status;
2408         }
2409
2410         memcpy(servername, r.out.info.info0.name, 16);
2411         servername[16] = '\0';
2412
2413         if (pull_ascii_talloc(mem_ctx, iconv_convenience,
2414                               name, servername) < 0) {
2415                 return NT_STATUS_NO_MEMORY;
2416         }
2417
2418         return NT_STATUS_OK;
2419 }
2420
2421
2422 static NTSTATUS find_printers(TALLOC_CTX *ctx, struct loadparm_context *lp_ctx,
2423                               struct smbcli_tree *tree,
2424                               const char ***printers, int *num_printers)
2425 {
2426         TALLOC_CTX *mem_ctx;
2427         NTSTATUS status;
2428         struct dcerpc_pipe *p;
2429         struct srvsvc_NetShareEnum r;
2430         struct srvsvc_NetShareCtr1 c1_in;
2431         struct srvsvc_NetShareCtr1 *c1;
2432         int i;
2433
2434         mem_ctx = talloc_new(ctx);
2435         if (mem_ctx == NULL) {
2436                 return NT_STATUS_NO_MEMORY;
2437         }
2438
2439         status = pipe_bind_smb(mem_ctx, lp_ctx,
2440                                tree, "\\srvsvc", &ndr_table_srvsvc,
2441                                &p);
2442         if (!NT_STATUS_IS_OK(status)) {
2443                 d_printf("could not bind to srvsvc pipe\n");
2444                 talloc_free(mem_ctx);
2445                 return status;
2446         }
2447
2448         r.in.server_unc = talloc_asprintf(
2449                 mem_ctx, "\\\\%s", dcerpc_server_name(p));
2450         r.in.level = 1;
2451         ZERO_STRUCT(c1_in);
2452         r.in.ctr.ctr1 = &c1_in;
2453         r.in.max_buffer = (uint32_t)-1;
2454         r.in.resume_handle = NULL;
2455
2456         status = dcerpc_srvsvc_NetShareEnum(p, mem_ctx, &r);
2457         if (!NT_STATUS_IS_OK(status)) {
2458                 d_printf("NetShareEnum level %u failed - %s\n",
2459                          r.in.level, nt_errstr(status));
2460                 talloc_free(mem_ctx);
2461                 return status;
2462         }
2463
2464         *printers = NULL;
2465         *num_printers = 0;
2466         c1 = r.out.ctr.ctr1;
2467         for (i=0; i<c1->count; i++) {
2468                 if (c1->array[i].type != STYPE_PRINTQ) {
2469                         continue;
2470                 }
2471                 if (!add_string_to_array(ctx, c1->array[i].name,
2472                                          printers, num_printers)) {
2473                         talloc_free(ctx);
2474                         return NT_STATUS_NO_MEMORY;
2475                 }
2476         }
2477
2478         talloc_free(mem_ctx);
2479         return NT_STATUS_OK;
2480 }
2481
2482 static bool enumprinters(TALLOC_CTX *mem_ctx, struct dcerpc_pipe *pipe,
2483                          const char *servername, int level, int *num_printers)
2484 {
2485         struct spoolss_EnumPrinters r;
2486         NTSTATUS status;
2487         DATA_BLOB blob;
2488
2489         r.in.flags = PRINTER_ENUM_LOCAL;
2490         r.in.server = talloc_asprintf(mem_ctx, "\\\\%s", servername);
2491         r.in.level = level;
2492         r.in.buffer = NULL;
2493         r.in.offered = 0;
2494
2495         status = dcerpc_spoolss_EnumPrinters(pipe, mem_ctx, &r);
2496         if (!NT_STATUS_IS_OK(status)) {
2497                 d_printf("(%s) dcerpc_spoolss_EnumPrinters failed: %s\n",
2498                          __location__, nt_errstr(status));
2499                 return false;
2500         }
2501
2502         if (!W_ERROR_EQUAL(r.out.result, WERR_INSUFFICIENT_BUFFER)) {
2503                 d_printf("(%s) EnumPrinters unexpected return code %s, should "
2504                          "be WERR_INSUFFICIENT_BUFFER\n", __location__,
2505                          win_errstr(r.out.result));
2506                 return false;
2507         }
2508
2509         blob = data_blob_talloc_zero(mem_ctx, r.out.needed);
2510         if (blob.data == NULL) {
2511                 d_printf("(%s) data_blob_talloc failed\n", __location__);
2512                 return false;
2513         }
2514
2515         r.in.buffer = &blob;
2516         r.in.offered = r.out.needed;
2517
2518         status = dcerpc_spoolss_EnumPrinters(pipe, mem_ctx, &r);
2519         if (!NT_STATUS_IS_OK(status) || !W_ERROR_IS_OK(r.out.result)) {
2520                 d_printf("(%s) dcerpc_spoolss_EnumPrinters failed: %s, "
2521                          "%s\n", __location__, nt_errstr(status),
2522                          win_errstr(r.out.result));
2523                 return false;
2524         }
2525
2526         *num_printers = r.out.count;
2527
2528         return true;
2529 }
2530
2531 static NTSTATUS getprinterinfo(TALLOC_CTX *ctx, struct dcerpc_pipe *pipe,
2532                                struct policy_handle *handle, int level,
2533                                union spoolss_PrinterInfo **res)
2534 {
2535         TALLOC_CTX *mem_ctx;
2536         struct spoolss_GetPrinter r;
2537         DATA_BLOB blob;
2538         NTSTATUS status;
2539
2540         mem_ctx = talloc_new(ctx);
2541         if (mem_ctx == NULL) {
2542                 return NT_STATUS_NO_MEMORY;
2543         }
2544
2545         r.in.handle = handle;
2546         r.in.level = level;
2547         r.in.buffer = NULL;
2548         r.in.offered = 0;
2549
2550         status = dcerpc_spoolss_GetPrinter(pipe, mem_ctx, &r);
2551         if (!NT_STATUS_IS_OK(status)) {
2552                 d_printf("(%s) dcerpc_spoolss_GetPrinter failed: %s\n",
2553                          __location__, nt_errstr(status));
2554                 talloc_free(mem_ctx);
2555                 return status;
2556         }
2557
2558         if (!W_ERROR_EQUAL(r.out.result, WERR_INSUFFICIENT_BUFFER)) {
2559                 printf("GetPrinter unexpected return code %s, should "
2560                        "be WERR_INSUFFICIENT_BUFFER\n",
2561                        win_errstr(r.out.result));
2562                 talloc_free(mem_ctx);
2563                 return NT_STATUS_UNSUCCESSFUL;
2564         }
2565
2566         r.in.handle = handle;
2567         r.in.level = level;
2568         blob = data_blob_talloc(mem_ctx, NULL, r.out.needed);
2569         if (blob.data == NULL) {
2570                 talloc_free(mem_ctx);
2571                 return NT_STATUS_NO_MEMORY;
2572         }
2573         memset(blob.data, 0, blob.length);
2574         r.in.buffer = &blob;
2575         r.in.offered = r.out.needed;
2576
2577         status = dcerpc_spoolss_GetPrinter(pipe, mem_ctx, &r);
2578         if (!NT_STATUS_IS_OK(status) || !W_ERROR_IS_OK(r.out.result)) {
2579                 d_printf("(%s) dcerpc_spoolss_GetPrinter failed: %s, "
2580                          "%s\n", __location__, nt_errstr(status),
2581                          win_errstr(r.out.result));
2582                 talloc_free(mem_ctx);
2583                 return NT_STATUS_IS_OK(status) ?
2584                         NT_STATUS_UNSUCCESSFUL : status;
2585         }
2586
2587         if (res != NULL) {
2588                 *res = talloc_steal(ctx, r.out.info);
2589         }
2590
2591         talloc_free(mem_ctx);
2592         return NT_STATUS_OK;
2593 }
2594
2595 bool torture_samba3_rpc_spoolss(struct torture_context *torture)
2596 {
2597         TALLOC_CTX *mem_ctx;
2598         bool ret = true;
2599         struct smbcli_state *cli;
2600         struct dcerpc_pipe *p;
2601         NTSTATUS status;
2602         struct policy_handle server_handle, printer_handle;
2603         const char **printers;
2604         int num_printers;
2605         struct spoolss_UserLevel1 userlevel1;
2606         char *servername;
2607
2608         if (!(mem_ctx = talloc_new(torture))) {
2609                 return false;
2610         }
2611
2612         if (!(torture_open_connection_share(
2613                       mem_ctx, &cli, torture, torture_setting_string(torture, "host", NULL),
2614                       "IPC$", torture->ev))) {
2615                 d_printf("IPC$ connection failed\n");
2616                 talloc_free(mem_ctx);
2617                 return false;
2618         }
2619
2620         status = get_servername(mem_ctx, cli->tree, lp_iconv_convenience(torture->lp_ctx), &servername);
2621         if (!NT_STATUS_IS_OK(status)) {
2622                 d_fprintf(stderr, "(%s) get_servername returned %s\n",
2623                           __location__, nt_errstr(status));
2624                 talloc_free(mem_ctx);
2625                 return false;
2626         }
2627
2628         if (!NT_STATUS_IS_OK(find_printers(mem_ctx, torture->lp_ctx, cli->tree,
2629                                            &printers, &num_printers))) {
2630                 talloc_free(mem_ctx);
2631                 return false;
2632         }
2633
2634         if (num_printers == 0) {
2635                 d_printf("Did not find printers\n");
2636                 talloc_free(mem_ctx);
2637                 return true;
2638         }
2639
2640         status = pipe_bind_smb(mem_ctx, torture->lp_ctx, cli->tree, "\\spoolss",
2641                                &ndr_table_spoolss, &p);
2642         if (!NT_STATUS_IS_OK(status)) {
2643                 d_printf("(%s) pipe_bind_smb failed: %s\n", __location__,
2644                          nt_errstr(status));
2645                 talloc_free(mem_ctx);
2646                 return false;
2647         }
2648
2649         ZERO_STRUCT(userlevel1);
2650         userlevel1.client = talloc_asprintf(
2651                 mem_ctx, "\\\\%s", lp_netbios_name(torture->lp_ctx));
2652         userlevel1.user = cli_credentials_get_username(cmdline_credentials);
2653         userlevel1.build = 2600;
2654         userlevel1.major = 3;
2655         userlevel1.minor = 0;
2656         userlevel1.processor = 0;
2657
2658         {
2659                 struct spoolss_OpenPrinterEx r;
2660
2661                 ZERO_STRUCT(r);
2662                 r.in.printername = talloc_asprintf(mem_ctx, "\\\\%s",
2663                                                    servername);
2664                 r.in.datatype = NULL;
2665                 r.in.access_mask = 0;
2666                 r.in.level = 1;
2667                 r.in.userlevel.level1 = &userlevel1;
2668                 r.out.handle = &server_handle;
2669
2670                 status = dcerpc_spoolss_OpenPrinterEx(p, mem_ctx, &r);
2671                 if (!NT_STATUS_IS_OK(status) || !W_ERROR_IS_OK(r.out.result)) {
2672                         d_printf("(%s) dcerpc_spoolss_OpenPrinterEx failed: "
2673                                  "%s, %s\n", __location__, nt_errstr(status),
2674                                  win_errstr(r.out.result));
2675                         talloc_free(mem_ctx);
2676                         return false;
2677                 }
2678         }
2679
2680         {
2681                 struct spoolss_ClosePrinter r;
2682
2683                 r.in.handle = &server_handle;
2684                 r.out.handle = &server_handle;
2685
2686                 status = dcerpc_spoolss_ClosePrinter(p, mem_ctx, &r);
2687                 if (!NT_STATUS_IS_OK(status) || !W_ERROR_IS_OK(r.out.result)) {
2688                         d_printf("(%s) dcerpc_spoolss_ClosePrinter failed: "
2689                                  "%s, %s\n", __location__, nt_errstr(status),
2690                                  win_errstr(r.out.result));
2691                         talloc_free(mem_ctx);
2692                         return false;
2693                 }
2694         }
2695
2696         {
2697                 struct spoolss_OpenPrinterEx r;
2698
2699                 ZERO_STRUCT(r);
2700                 r.in.printername = talloc_asprintf(
2701                         mem_ctx, "\\\\%s\\%s", servername, printers[0]);
2702                 r.in.datatype = NULL;
2703                 r.in.access_mask = 0;
2704                 r.in.level = 1;
2705                 r.in.userlevel.level1 = &userlevel1;
2706                 r.out.handle = &printer_handle;
2707
2708                 status = dcerpc_spoolss_OpenPrinterEx(p, mem_ctx, &r);
2709                 if (!NT_STATUS_IS_OK(status) || !W_ERROR_IS_OK(r.out.result)) {
2710                         d_printf("(%s) dcerpc_spoolss_OpenPrinterEx failed: "
2711                                  "%s, %s\n", __location__, nt_errstr(status),
2712                                  win_errstr(r.out.result));
2713                         talloc_free(mem_ctx);
2714                         return false;
2715                 }
2716         }
2717
2718         {
2719                 int i;
2720
2721                 for (i=0; i<8; i++) {
2722                         status = getprinterinfo(mem_ctx, p, &printer_handle,
2723                                                 i, NULL);
2724                         if (!NT_STATUS_IS_OK(status)) {
2725                                 d_printf("(%s) getprinterinfo %d failed: %s\n",
2726                                          __location__, i, nt_errstr(status));
2727                                 ret = false;
2728                         }
2729                 }
2730         }
2731
2732         {
2733                 struct spoolss_ClosePrinter r;
2734
2735                 r.in.handle = &printer_handle;
2736                 r.out.handle = &printer_handle;
2737
2738                 status = dcerpc_spoolss_ClosePrinter(p, mem_ctx, &r);
2739                 if (!NT_STATUS_IS_OK(status)) {
2740                         d_printf("(%s) dcerpc_spoolss_ClosePrinter failed: "
2741                                  "%s\n", __location__, nt_errstr(status));
2742                         talloc_free(mem_ctx);
2743                         return false;
2744                 }
2745         }
2746
2747         {
2748                 int num_enumerated;
2749                 if (!enumprinters(mem_ctx, p, servername, 1,
2750                                   &num_enumerated)) {
2751                         d_printf("(%s) enumprinters failed\n", __location__);
2752                         talloc_free(mem_ctx);
2753                         return false;
2754                 }
2755                 if (num_printers != num_enumerated) {
2756                         d_printf("(%s) netshareenum gave %d printers, "
2757                                  "enumprinters lvl 1 gave %d\n", __location__,
2758                                  num_printers, num_enumerated);
2759                         talloc_free(mem_ctx);
2760                         return false;
2761                 }
2762         }
2763
2764         {
2765                 int num_enumerated;
2766                 if (!enumprinters(mem_ctx, p, servername, 2,
2767                                   &num_enumerated)) {
2768                         d_printf("(%s) enumprinters failed\n", __location__);
2769                         talloc_free(mem_ctx);
2770                         return false;
2771                 }
2772                 if (num_printers != num_enumerated) {
2773                         d_printf("(%s) netshareenum gave %d printers, "
2774                                  "enumprinters lvl 2 gave %d\n", __location__,
2775                                  num_printers, num_enumerated);
2776                         talloc_free(mem_ctx);
2777                         return false;
2778                 }
2779         }
2780
2781         talloc_free(mem_ctx);
2782
2783         return ret;
2784 }
2785
2786 bool torture_samba3_rpc_wkssvc(struct torture_context *torture)
2787 {
2788         TALLOC_CTX *mem_ctx;
2789         struct smbcli_state *cli;
2790         struct dcerpc_pipe *p;
2791         NTSTATUS status;
2792         char *servername;
2793
2794         if (!(mem_ctx = talloc_new(torture))) {
2795                 return false;
2796         }
2797
2798         if (!(torture_open_connection_share(
2799                       mem_ctx, &cli, torture, torture_setting_string(torture, "host", NULL),
2800                       "IPC$", torture->ev))) {
2801                 d_printf("IPC$ connection failed\n");
2802                 talloc_free(mem_ctx);
2803                 return false;
2804         }
2805
2806         status = get_servername(mem_ctx, cli->tree, lp_iconv_convenience(torture->lp_ctx), &servername);
2807         if (!NT_STATUS_IS_OK(status)) {
2808                 d_fprintf(stderr, "(%s) get_servername returned %s\n",
2809                           __location__, nt_errstr(status));
2810                 talloc_free(mem_ctx);
2811                 return false;
2812         }
2813
2814         status = pipe_bind_smb(mem_ctx, torture->lp_ctx, cli->tree, "\\wkssvc",
2815                                &ndr_table_wkssvc, &p);
2816         if (!NT_STATUS_IS_OK(status)) {
2817                 d_printf("(%s) pipe_bind_smb failed: %s\n", __location__,
2818                          nt_errstr(status));
2819                 talloc_free(mem_ctx);
2820                 return false;
2821         }
2822
2823         {
2824                 struct wkssvc_NetWkstaInfo100 wks100;
2825                 union wkssvc_NetWkstaInfo info;
2826                 struct wkssvc_NetWkstaGetInfo r;
2827
2828                 r.in.server_name = "\\foo";
2829                 r.in.level = 100;
2830                 info.info100 = &wks100;
2831                 r.out.info = &info;
2832
2833                 status = dcerpc_wkssvc_NetWkstaGetInfo(p, mem_ctx, &r);
2834                 if (!NT_STATUS_IS_OK(status) || !W_ERROR_IS_OK(r.out.result)) {
2835                         d_printf("(%s) dcerpc_wkssvc_NetWksGetInfo failed: "
2836                                  "%s, %s\n", __location__, nt_errstr(status),
2837                                  win_errstr(r.out.result));
2838                         talloc_free(mem_ctx);
2839                         return false;
2840                 }
2841
2842                 if (strcmp(servername,
2843                            r.out.info->info100->server_name) != 0) {
2844                         d_printf("(%s) servername inconsistency: RAP=%s, "
2845                                  "dcerpc_wkssvc_NetWksGetInfo=%s",
2846                                  __location__, servername,
2847                                  r.out.info->info100->server_name);
2848                         talloc_free(mem_ctx);
2849                         return false;
2850                 }
2851         }
2852
2853         talloc_free(mem_ctx);
2854         return true;
2855 }
2856
2857 static NTSTATUS winreg_close(struct dcerpc_pipe *p,
2858                              struct policy_handle *handle)
2859 {
2860         struct winreg_CloseKey c;
2861         NTSTATUS status;
2862         TALLOC_CTX *mem_ctx;
2863
2864         c.in.handle = c.out.handle = handle;
2865
2866         if (!(mem_ctx = talloc_new(p))) {
2867                 return NT_STATUS_NO_MEMORY;
2868         }
2869
2870         status = dcerpc_winreg_CloseKey(p, mem_ctx, &c);
2871         talloc_free(mem_ctx);
2872
2873         if (!NT_STATUS_IS_OK(status)) {
2874                 return status;
2875         }
2876
2877         if (!W_ERROR_IS_OK(c.out.result)) {
2878                 return werror_to_ntstatus(c.out.result);
2879         }
2880
2881         return NT_STATUS_OK;
2882 }
2883
2884 static NTSTATUS enumvalues(struct dcerpc_pipe *p, struct policy_handle *handle,
2885                            TALLOC_CTX *mem_ctx)
2886 {
2887         uint32_t enum_index = 0;
2888
2889         while (1) {
2890                 struct winreg_EnumValue r;
2891                 struct winreg_StringBuf name;
2892                 enum winreg_Type type = 0;
2893                 uint8_t buf8[1024];
2894                 NTSTATUS status;
2895                 uint32_t size, length;
2896
2897                 r.in.handle = handle;
2898                 r.in.enum_index = enum_index;
2899                 name.name = "";
2900                 name.size = 1024;
2901                 r.in.name = r.out.name = &name;
2902                 size = 1024;
2903                 length = 5;
2904                 r.in.type = &type;
2905                 r.in.value = buf8;
2906                 r.in.size = &size;
2907                 r.in.length = &length;
2908
2909                 status = dcerpc_winreg_EnumValue(p, mem_ctx, &r);
2910                 if (!NT_STATUS_IS_OK(status) || !W_ERROR_IS_OK(r.out.result)) {
2911                         return NT_STATUS_OK;
2912                 }
2913                 enum_index += 1;
2914         }
2915 }
2916
2917 static NTSTATUS enumkeys(struct dcerpc_pipe *p, struct policy_handle *handle,
2918                          TALLOC_CTX *mem_ctx, int depth)
2919 {
2920         struct winreg_EnumKey r;
2921         struct winreg_StringBuf class, name;
2922         NTSTATUS status;
2923         NTTIME t = 0;
2924
2925         if (depth <= 0) {
2926                 return NT_STATUS_OK;
2927         }
2928
2929         class.name   = "";
2930         class.size   = 1024;
2931
2932         r.in.handle = handle;
2933         r.in.enum_index = 0;
2934         r.in.name = &name;
2935         r.in.keyclass = &class;
2936         r.out.name = &name;
2937         r.in.last_changed_time = &t;
2938
2939         do {
2940                 TALLOC_CTX *tmp_ctx;
2941                 struct winreg_OpenKey o;
2942                 struct policy_handle key_handle;
2943                 int i;
2944
2945                 if (!(tmp_ctx = talloc_new(mem_ctx))) {
2946                         return NT_STATUS_NO_MEMORY;
2947                 }
2948
2949                 name.name = NULL;
2950                 name.size = 1024;
2951
2952                 status = dcerpc_winreg_EnumKey(p, tmp_ctx, &r);
2953                 if (!NT_STATUS_IS_OK(status) || !W_ERROR_IS_OK(r.out.result)) {
2954                         /* We're done enumerating */
2955                         talloc_free(tmp_ctx);
2956                         return NT_STATUS_OK;
2957                 }
2958
2959                 for (i=0; i<10-depth; i++)
2960                         printf(" ");
2961                 printf("%s\n", r.out.name->name);
2962
2963
2964                 o.in.parent_handle = handle;
2965                 o.in.keyname.name = r.out.name->name;
2966                 o.in.unknown = 0;
2967                 o.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
2968                 o.out.handle = &key_handle;
2969
2970                 status = dcerpc_winreg_OpenKey(p, tmp_ctx, &o);
2971                 if (NT_STATUS_IS_OK(status) && W_ERROR_IS_OK(o.out.result)) {
2972                         enumkeys(p, &key_handle, tmp_ctx, depth-1);
2973                         enumvalues(p, &key_handle, tmp_ctx);
2974                         status = winreg_close(p, &key_handle);
2975                         if (!NT_STATUS_IS_OK(status)) {
2976                                 return status;
2977                         }
2978                 }
2979
2980                 talloc_free(tmp_ctx);
2981
2982                 r.in.enum_index += 1;
2983         } while(true);
2984
2985         return NT_STATUS_OK;
2986 }
2987
2988 typedef NTSTATUS (*winreg_open_fn)(struct dcerpc_pipe *, TALLOC_CTX *, void *);
2989
2990 static bool test_Open3(struct dcerpc_pipe *p, TALLOC_CTX *mem_ctx,
2991                        const char *name, winreg_open_fn open_fn)
2992 {
2993         struct policy_handle handle;
2994         struct winreg_OpenHKLM r;
2995         NTSTATUS status;
2996
2997         r.in.system_name = 0;
2998         r.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
2999         r.out.handle = &handle;
3000
3001         status = open_fn(p, mem_ctx, &r);
3002         if (!NT_STATUS_IS_OK(status) || !W_ERROR_IS_OK(r.out.result)) {
3003                 d_printf("(%s) %s failed: %s, %s\n", __location__, name,
3004                          nt_errstr(status), win_errstr(r.out.result));
3005                 return false;
3006         }
3007
3008         enumkeys(p, &handle, mem_ctx, 4);
3009
3010         status = winreg_close(p, &handle);
3011         if (!NT_STATUS_IS_OK(status)) {
3012                 d_printf("(%s) dcerpc_CloseKey failed: %s\n",
3013                          __location__, nt_errstr(status));
3014                 return false;
3015         }
3016
3017         return true;
3018 }
3019
3020 bool torture_samba3_rpc_winreg(struct torture_context *torture)
3021 {
3022         NTSTATUS status;
3023         struct dcerpc_pipe *p;
3024         TALLOC_CTX *mem_ctx;
3025         bool ret = true;
3026         struct {
3027                 const char *name;
3028                 winreg_open_fn fn;
3029         } open_fns[] = {
3030                 {"OpenHKLM", (winreg_open_fn)dcerpc_winreg_OpenHKLM },
3031                 {"OpenHKU",  (winreg_open_fn)dcerpc_winreg_OpenHKU },
3032                 {"OpenHKPD", (winreg_open_fn)dcerpc_winreg_OpenHKPD },
3033                 {"OpenHKPT", (winreg_open_fn)dcerpc_winreg_OpenHKPT },
3034                 {"OpenHKCR", (winreg_open_fn)dcerpc_winreg_OpenHKCR }};
3035 #if 0
3036         int i;
3037 #endif
3038
3039         mem_ctx = talloc_init("torture_rpc_winreg");
3040
3041         status = torture_rpc_connection(torture, &p, &ndr_table_winreg);
3042
3043         if (!NT_STATUS_IS_OK(status)) {
3044                 talloc_free(mem_ctx);
3045                 return false;
3046         }
3047
3048 #if 1
3049         ret = test_Open3(p, mem_ctx, open_fns[0].name, open_fns[0].fn);
3050 #else
3051         for (i = 0; i < ARRAY_SIZE(open_fns); i++) {
3052                 if (!test_Open3(p, mem_ctx, open_fns[i].name, open_fns[i].fn))
3053                         ret = false;
3054         }
3055 #endif
3056
3057         talloc_free(mem_ctx);
3058
3059         return ret;
3060 }
3061
3062 static NTSTATUS get_shareinfo(TALLOC_CTX *mem_ctx,
3063                               struct loadparm_context *lp_ctx,
3064                               struct smbcli_state *cli,
3065                               const char *share,
3066                               struct srvsvc_NetShareInfo502 **info)
3067 {
3068         struct smbcli_tree *ipc;
3069         struct dcerpc_pipe *p;
3070         struct srvsvc_NetShareGetInfo r;
3071         NTSTATUS status;
3072
3073         if (!(p = dcerpc_pipe_init(cli,
3074                                    cli->transport->socket->event.ctx,
3075                                    lp_iconv_convenience(lp_ctx)))) {
3076                 status = NT_STATUS_NO_MEMORY;
3077                 goto fail;
3078         }
3079
3080         status = secondary_tcon(p, cli->session, "IPC$", &ipc);
3081         if (!NT_STATUS_IS_OK(status)) {
3082                 goto fail;
3083         }
3084
3085         status = dcerpc_pipe_open_smb(p, ipc, "\\pipe\\srvsvc");
3086         if (!NT_STATUS_IS_OK(status)) {
3087                 d_printf("dcerpc_pipe_open_smb failed: %s\n",
3088                          nt_errstr(status));
3089                 goto fail;
3090         }
3091
3092         status = dcerpc_bind_auth_none(p, &ndr_table_srvsvc);
3093         if (!NT_STATUS_IS_OK(status)) {
3094                 d_printf("dcerpc_bind_auth_none failed: %s\n",
3095                          nt_errstr(status));
3096                 goto fail;
3097         }
3098
3099         r.in.server_unc = talloc_asprintf(mem_ctx, "\\\\%s",
3100                                           dcerpc_server_name(p));
3101         r.in.share_name = share;
3102         r.in.level = 502;
3103
3104         status = dcerpc_srvsvc_NetShareGetInfo(p, p, &r);
3105         if (!NT_STATUS_IS_OK(status) || !W_ERROR_IS_OK(r.out.result)) {
3106                 d_printf("(%s) OpenHKLM failed: %s, %s\n", __location__,
3107                          nt_errstr(status), win_errstr(r.out.result));
3108                 goto fail;
3109         }
3110
3111         *info = talloc_move(mem_ctx, &r.out.info.info502);
3112         return NT_STATUS_OK;
3113
3114  fail:
3115         talloc_free(p);
3116         return status;
3117 }
3118
3119 /*
3120  * Get us a handle on HKLM\
3121  */
3122
3123 static NTSTATUS get_hklm_handle(TALLOC_CTX *mem_ctx,
3124                                 struct smbcli_state *cli,
3125                                 struct smb_iconv_convenience *iconv_convenience,
3126                                 struct dcerpc_pipe **pipe_p,
3127                                 struct policy_handle **handle)
3128 {
3129         struct smbcli_tree *ipc;
3130         struct dcerpc_pipe *p;
3131         struct winreg_OpenHKLM r;
3132         NTSTATUS status;
3133         struct policy_handle *result;
3134
3135         result = talloc(mem_ctx, struct policy_handle);
3136
3137         if (result == NULL) {
3138                 return NT_STATUS_NO_MEMORY;
3139         }
3140
3141         if (!(p = dcerpc_pipe_init(result,
3142                                    cli->transport->socket->event.ctx,
3143                                    iconv_convenience))) {
3144                 status = NT_STATUS_NO_MEMORY;
3145                 goto fail;
3146         }
3147
3148         status = secondary_tcon(p, cli->session, "IPC$", &ipc);
3149         if (!NT_STATUS_IS_OK(status)) {
3150                 goto fail;
3151         }
3152
3153         status = dcerpc_pipe_open_smb(p, ipc, "\\winreg");
3154         if (!NT_STATUS_IS_OK(status)) {
3155                 d_printf("dcerpc_pipe_open_smb failed: %s\n",
3156                          nt_errstr(status));
3157                 goto fail;
3158         }
3159
3160         status = dcerpc_bind_auth_none(p, &ndr_table_winreg);
3161         if (!NT_STATUS_IS_OK(status)) {
3162                 d_printf("dcerpc_bind_auth_none failed: %s\n",
3163                          nt_errstr(status));
3164                 goto fail;
3165         }
3166
3167         r.in.system_name = 0;
3168         r.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
3169         r.out.handle = result;
3170
3171         status = dcerpc_winreg_OpenHKLM(p, p, &r);
3172         if (!NT_STATUS_IS_OK(status) || !W_ERROR_IS_OK(r.out.result)) {
3173                 d_printf("(%s) OpenHKLM failed: %s, %s\n", __location__,
3174                          nt_errstr(status), win_errstr(r.out.result));
3175                 goto fail;
3176         }
3177
3178         *pipe_p = p;
3179         *handle = result;
3180         return NT_STATUS_OK;
3181
3182  fail:
3183         talloc_free(result);
3184         return status;
3185 }
3186
3187 static NTSTATUS torture_samba3_createshare(struct smbcli_state *cli,
3188                                            struct smb_iconv_convenience *iconv_convenience,
3189                                            const char *sharename)
3190 {
3191         struct dcerpc_pipe *p;
3192         struct policy_handle *hklm = NULL;
3193         struct policy_handle new_handle;
3194         struct winreg_CreateKey c;
3195         struct winreg_CloseKey cl;
3196         enum winreg_CreateAction action_taken;
3197         NTSTATUS status;
3198         TALLOC_CTX *mem_ctx;
3199
3200         mem_ctx = talloc_new(cli);
3201         NT_STATUS_HAVE_NO_MEMORY(mem_ctx);
3202
3203         status = get_hklm_handle(mem_ctx, cli, iconv_convenience, &p, &hklm);
3204         if (!NT_STATUS_IS_OK(status)) {
3205                 d_printf("get_hklm_handle failed: %s\n", nt_errstr(status));
3206                 goto fail;
3207         }
3208
3209         c.in.handle = hklm;
3210         c.in.name.name = talloc_asprintf(
3211                 mem_ctx, "software\\samba\\smbconf\\%s", sharename);
3212         if (c.in.name.name == NULL) {
3213                 d_printf("talloc_asprintf failed\n");
3214                 status = NT_STATUS_NO_MEMORY;
3215                 goto fail;
3216         }
3217         c.in.keyclass.name = "";
3218         c.in.options = 0;
3219         c.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
3220         c.in.secdesc = NULL;
3221         c.in.action_taken = &action_taken;
3222         c.out.new_handle = &new_handle;
3223         c.out.action_taken = &action_taken;
3224
3225         status = dcerpc_winreg_CreateKey(p, p, &c);
3226         if (!NT_STATUS_IS_OK(status) || !W_ERROR_IS_OK(c.out.result)) {
3227                 d_printf("(%s) OpenKey failed: %s, %s\n", __location__,
3228                          nt_errstr(status), win_errstr(c.out.result));
3229                 goto fail;
3230         }
3231
3232         cl.in.handle = &new_handle;
3233         cl.out.handle = &new_handle;
3234         status = dcerpc_winreg_CloseKey(p, p, &cl);
3235         if (!NT_STATUS_IS_OK(status) || !W_ERROR_IS_OK(cl.out.result)) {
3236                 d_printf("(%s) OpenKey failed: %s, %s\n", __location__,
3237                          nt_errstr(status), win_errstr(cl.out.result));
3238                 goto fail;
3239         }
3240
3241
3242  fail:
3243         talloc_free(mem_ctx);
3244         return status;
3245 }
3246
3247 static NTSTATUS torture_samba3_deleteshare(struct torture_context *torture,
3248                                            struct smbcli_state *cli,
3249                                            const char *sharename)
3250 {
3251         struct dcerpc_pipe *p;
3252         struct policy_handle *hklm = NULL;
3253         struct winreg_DeleteKey d;
3254         NTSTATUS status;
3255         TALLOC_CTX *mem_ctx;
3256
3257         mem_ctx = talloc_new(cli);
3258         NT_STATUS_HAVE_NO_MEMORY(mem_ctx);
3259
3260         status = get_hklm_handle(cli, cli, lp_iconv_convenience(torture->lp_ctx),
3261                                  &p, &hklm);
3262         if (!NT_STATUS_IS_OK(status)) {
3263                 d_printf("get_hklm_handle failed: %s\n", nt_errstr(status));
3264                 goto fail;
3265         }
3266
3267         d.in.handle = hklm;
3268         d.in.key.name = talloc_asprintf(
3269                 mem_ctx, "software\\samba\\smbconf\\%s", sharename);
3270         if (d.in.key.name == NULL) {
3271                 d_printf("talloc_asprintf failed\n");
3272                 status = NT_STATUS_NO_MEMORY;
3273                 goto fail;
3274         }
3275         status = dcerpc_winreg_DeleteKey(p, p, &d);
3276         if (!NT_STATUS_IS_OK(status) || !W_ERROR_IS_OK(d.out.result)) {
3277                 d_printf("(%s) OpenKey failed: %s, %s\n", __location__,
3278                          nt_errstr(status), win_errstr(d.out.result));
3279                 goto fail;
3280         }
3281
3282  fail:
3283         talloc_free(mem_ctx);
3284         return status;
3285 }
3286
3287 static NTSTATUS torture_samba3_setconfig(struct smbcli_state *cli,
3288                                          struct loadparm_context *lp_ctx,
3289                                          const char *sharename,
3290                                          const char *parameter,
3291                                          const char *value)
3292 {
3293         struct dcerpc_pipe *p = NULL;
3294         struct policy_handle *hklm = NULL, key_handle;
3295         struct winreg_OpenKey o;
3296         struct winreg_SetValue s;
3297         uint32_t type;
3298         DATA_BLOB val;
3299         NTSTATUS status;
3300
3301         status = get_hklm_handle(cli, cli, lp_iconv_convenience(lp_ctx), &p, &hklm);
3302         if (!NT_STATUS_IS_OK(status)) {
3303                 d_printf("get_hklm_handle failed: %s\n", nt_errstr(status));
3304                 return status;;
3305         }
3306
3307         o.in.parent_handle = hklm;
3308         o.in.keyname.name = talloc_asprintf(
3309                 hklm, "software\\samba\\smbconf\\%s", sharename);
3310         if (o.in.keyname.name == NULL) {
3311                 d_printf("talloc_asprintf failed\n");
3312                 status = NT_STATUS_NO_MEMORY;
3313                 goto done;
3314         }
3315         o.in.unknown = 0;
3316         o.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
3317         o.out.handle = &key_handle;
3318
3319         status = dcerpc_winreg_OpenKey(p, p, &o);
3320         if (!NT_STATUS_IS_OK(status) || !W_ERROR_IS_OK(o.out.result)) {
3321                 d_printf("(%s) OpenKey failed: %s, %s\n", __location__,
3322                          nt_errstr(status), win_errstr(o.out.result));
3323                 goto done;
3324         }
3325
3326         if (!reg_string_to_val(hklm, lp_iconv_convenience(lp_ctx), "REG_SZ",
3327                                value, &type, &val)) {
3328                 d_printf("(%s) reg_string_to_val failed\n", __location__);
3329                 goto done;
3330         }
3331
3332         s.in.handle = &key_handle;
3333         s.in.name.name = parameter;
3334         s.in.type = type;
3335         s.in.data = val.data;
3336         s.in.size = val.length;
3337
3338         status = dcerpc_winreg_SetValue(p, p, &s);
3339         if (!NT_STATUS_IS_OK(status) || !W_ERROR_IS_OK(s.out.result)) {
3340                 d_printf("(%s) SetValue failed: %s, %s\n", __location__,
3341                          nt_errstr(status), win_errstr(s.out.result));
3342                 goto done;
3343         }
3344
3345  done:
3346         talloc_free(hklm);
3347         return status;
3348 }
3349
3350 bool torture_samba3_regconfig(struct torture_context *torture)
3351 {
3352         struct smbcli_state *cli;
3353         struct srvsvc_NetShareInfo502 *i = NULL;
3354         NTSTATUS status;
3355         bool ret = false;
3356         const char *comment = "Dummer Kommentar";
3357
3358         if (!(torture_open_connection(&cli, torture, 0))) {
3359                 return false;
3360         }
3361
3362         status = torture_samba3_createshare(cli, lp_iconv_convenience(torture->lp_ctx), "blubber");
3363         if (!NT_STATUS_IS_OK(status)) {
3364                 torture_warning(torture, "torture_samba3_createshare failed: "
3365                                 "%s\n", nt_errstr(status));
3366                 goto done;
3367         }
3368
3369         status = torture_samba3_setconfig(cli, torture->lp_ctx, "blubber", "comment", comment);
3370         if (!NT_STATUS_IS_OK(status)) {
3371                 torture_warning(torture, "torture_samba3_setconfig failed: "
3372                                 "%s\n", nt_errstr(status));
3373                 goto done;
3374         }
3375
3376         status = get_shareinfo(torture, torture->lp_ctx, cli, "blubber", &i);
3377         if (!NT_STATUS_IS_OK(status)) {
3378                 torture_warning(torture, "get_shareinfo failed: "
3379                                 "%s\n", nt_errstr(status));
3380                 goto done;
3381         }
3382
3383         if (strcmp(comment, i->comment) != 0) {
3384                 torture_warning(torture, "Expected comment [%s], got [%s]\n",
3385                                 comment, i->comment);
3386                 goto done;
3387         }
3388
3389         status = torture_samba3_deleteshare(torture, cli, "blubber");
3390         if (!NT_STATUS_IS_OK(status)) {
3391                 torture_warning(torture, "torture_samba3_deleteshare failed: "
3392                                 "%s\n", nt_errstr(status));
3393                 goto done;
3394         }
3395
3396         ret = true;
3397  done:
3398         talloc_free(cli);
3399         return ret;
3400 }