source4/torture/rpc/samr.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3    test suite for samr rpc operations
   4
   5    Copyright (C) Andrew Tridgell 2003
   6    Copyright (C) Andrew Bartlett <abartlet@samba.org> 2003
   7    Copyright (C) Guenther Deschner 2008,2009
   8
   9    This program is free software; you can redistribute it and/or modify
  10    it under the terms of the GNU General Public License as published by
  11    the Free Software Foundation; either version 3 of the License, or
  12    (at your option) any later version.
  13
  14    This program is distributed in the hope that it will be useful,
  15    but WITHOUT ANY WARRANTY; without even the implied warranty of
  16    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  17    GNU General Public License for more details.
  18
  19    You should have received a copy of the GNU General Public License
  20    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  21 */
  22
  23 #include "includes.h"
  24 #include "torture/torture.h"
  25 #include "system/time.h"
  26 #include "librpc/gen_ndr/lsa.h"
  27 #include "librpc/gen_ndr/ndr_netlogon.h"
  28 #include "librpc/gen_ndr/ndr_netlogon_c.h"
  29 #include "librpc/gen_ndr/ndr_samr_c.h"
  30 #include "librpc/gen_ndr/ndr_lsa_c.h"
  31 #include "../lib/crypto/crypto.h"
  32 #include "libcli/auth/libcli_auth.h"
  33 #include "libcli/security/security.h"
  34 #include "torture/rpc/rpc.h"
  35 #include "param/param.h"
  36
  37 #include <unistd.h>
  38
  39 #define TEST_ACCOUNT_NAME "samrtorturetest"
  40 #define TEST_ACCOUNT_NAME_PWD "samrpwdlastset"
  41 #define TEST_ALIASNAME "samrtorturetestalias"
  42 #define TEST_GROUPNAME "samrtorturetestgroup"
  43 #define TEST_MACHINENAME "samrtestmach$"
  44 #define TEST_DOMAINNAME "samrtestdom$"
  45
  46 enum torture_samr_choice {
  47         TORTURE_SAMR_PASSWORDS,
  48         TORTURE_SAMR_PASSWORDS_PWDLASTSET,
  49         TORTURE_SAMR_USER_ATTRIBUTES,
  50         TORTURE_SAMR_USER_PRIVILEGES,
  51         TORTURE_SAMR_OTHER,
  52         TORTURE_SAMR_MANY_ACCOUNTS,
  53         TORTURE_SAMR_MANY_GROUPS,
  54         TORTURE_SAMR_MANY_ALIASES
  55 };
  56
  57 struct torture_samr_context {
  58         struct policy_handle handle;
  59         struct cli_credentials *machine_credentials;
  60         enum torture_samr_choice choice;
  61         uint32_t num_objects_large_dc;
  62 };
  63
  64 static bool test_QueryUserInfo(struct dcerpc_pipe *p,
  65                                struct torture_context *tctx,
  66                                struct policy_handle *handle);
  67
  68 static bool test_QueryUserInfo2(struct dcerpc_pipe *p,
  69                                 struct torture_context *tctx,
  70                                 struct policy_handle *handle);
  71
  72 static bool test_QueryAliasInfo(struct dcerpc_pipe *p,
  73                                 struct torture_context *tctx,
  74                                 struct policy_handle *handle);
  75
  76 static bool test_ChangePassword(struct dcerpc_pipe *p,
  77                                 struct torture_context *tctx,
  78                                 const char *acct_name,
  79                                 struct policy_handle *domain_handle, char **password);
  80
  81 static void init_lsa_String(struct lsa_String *string, const char *s)
  82 {
  83         string->string = s;
  84 }
  85
  86 static void init_lsa_StringLarge(struct lsa_StringLarge *string, const char *s)
  87 {
  88         string->string = s;
  89 }
  90
  91 static void init_lsa_BinaryString(struct lsa_BinaryString *string, const char *s, uint32_t length)
  92 {
  93         string->length = length;
  94         string->size = length;
  95         string->array = (uint16_t *)discard_const(s);
  96 }
  97
  98 bool test_samr_handle_Close(struct dcerpc_pipe *p, struct torture_context *tctx,
  99                                    struct policy_handle *handle)
 100 {
 101         NTSTATUS status;
 102         struct samr_Close r;
 103
 104         r.in.handle = handle;
 105         r.out.handle = handle;
 106
 107         status = dcerpc_samr_Close(p, tctx, &r);
 108         torture_assert_ntstatus_ok(tctx, status, "Close");
 109
 110         return true;
 111 }
 112
 113 static bool test_Shutdown(struct dcerpc_pipe *p, struct torture_context *tctx,
 114                        struct policy_handle *handle)
 115 {
 116         NTSTATUS status;
 117         struct samr_Shutdown r;
 118
 119         if (!torture_setting_bool(tctx, "dangerous", false)) {
 120                 torture_skip(tctx, "samr_Shutdown disabled - enable dangerous tests to use\n");
 121                 return true;
 122         }
 123
 124         r.in.connect_handle = handle;
 125
 126         torture_comment(tctx, "testing samr_Shutdown\n");
 127
 128         status = dcerpc_samr_Shutdown(p, tctx, &r);
 129         torture_assert_ntstatus_ok(tctx, status, "samr_Shutdown");
 130
 131         return true;
 132 }
 133
 134 static bool test_SetDsrmPassword(struct dcerpc_pipe *p, struct torture_context *tctx,
 135                                  struct policy_handle *handle)
 136 {
 137         NTSTATUS status;
 138         struct samr_SetDsrmPassword r;
 139         struct lsa_String string;
 140         struct samr_Password hash;
 141
 142         if (!torture_setting_bool(tctx, "dangerous", false)) {
 143                 torture_skip(tctx, "samr_SetDsrmPassword disabled - enable dangerous tests to use");
 144         }
 145
 146         E_md4hash("TeSTDSRM123", hash.hash);
 147
 148         init_lsa_String(&string, "Administrator");
 149
 150         r.in.name = &string;
 151         r.in.unknown = 0;
 152         r.in.hash = &hash;
 153
 154         torture_comment(tctx, "testing samr_SetDsrmPassword\n");
 155
 156         status = dcerpc_samr_SetDsrmPassword(p, tctx, &r);
 157         torture_assert_ntstatus_equal(tctx, status, NT_STATUS_NOT_SUPPORTED, "samr_SetDsrmPassword");
 158
 159         return true;
 160 }
 161
 162
 163 static bool test_QuerySecurity(struct dcerpc_pipe *p,
 164                                struct torture_context *tctx,
 165                                struct policy_handle *handle)
 166 {
 167         NTSTATUS status;
 168         struct samr_QuerySecurity r;
 169         struct samr_SetSecurity s;
 170         struct sec_desc_buf *sdbuf = NULL;
 171
 172         r.in.handle = handle;
 173         r.in.sec_info = 7;
 174         r.out.sdbuf = &sdbuf;
 175
 176         status = dcerpc_samr_QuerySecurity(p, tctx, &r);
 177         torture_assert_ntstatus_ok(tctx, status, "QuerySecurity");
 178
 179         torture_assert(tctx, sdbuf != NULL, "sdbuf is NULL");
 180
 181         s.in.handle = handle;
 182         s.in.sec_info = 7;
 183         s.in.sdbuf = sdbuf;
 184
 185         if (torture_setting_bool(tctx, "samba4", false)) {
 186                 torture_skip(tctx, "skipping SetSecurity test against Samba4\n");
 187         }
 188
 189         status = dcerpc_samr_SetSecurity(p, tctx, &s);
 190         torture_assert_ntstatus_ok(tctx, status, "SetSecurity");
 191
 192         status = dcerpc_samr_QuerySecurity(p, tctx, &r);
 193         torture_assert_ntstatus_ok(tctx, status, "QuerySecurity");
 194
 195         return true;
 196 }
 197
 198
 199 static bool test_SetUserInfo(struct dcerpc_pipe *p, struct torture_context *tctx,
 200                              struct policy_handle *handle, uint32_t base_acct_flags,
 201                              const char *base_account_name)
 202 {
 203         NTSTATUS status;
 204         struct samr_SetUserInfo s;
 205         struct samr_SetUserInfo2 s2;
 206         struct samr_QueryUserInfo q;
 207         struct samr_QueryUserInfo q0;
 208         union samr_UserInfo u;
 209         union samr_UserInfo *info;
 210         bool ret = true;
 211         const char *test_account_name;
 212
 213         uint32_t user_extra_flags = 0;
 214
 215         if (!torture_setting_bool(tctx, "samba3", false)) {
 216                 if (base_acct_flags == ACB_NORMAL) {
 217                         /* When created, accounts are expired by default */
 218                         user_extra_flags = ACB_PW_EXPIRED;
 219                 }
 220         }
 221
 222         s.in.user_handle = handle;
 223         s.in.info = &u;
 224
 225         s2.in.user_handle = handle;
 226         s2.in.info = &u;
 227
 228         q.in.user_handle = handle;
 229         q.out.info = &info;
 230         q0 = q;
 231
 232 #define TESTCALL(call, r) \
 233                 status = dcerpc_samr_ ##call(p, tctx, &r); \
 234                 if (!NT_STATUS_IS_OK(status)) { \
 235                         torture_comment(tctx, #call " level %u failed - %s (%s)\n", \
 236                                r.in.level, nt_errstr(status), __location__); \
 237                         ret = false; \
 238                         break; \
 239                 }
 240
 241 #define STRING_EQUAL(s1, s2, field) \
 242                 if ((s1 && !s2) || (s2 && !s1) || strcmp(s1, s2)) { \
 243                         torture_comment(tctx, "Failed to set %s to '%s' (%s)\n", \
 244                                #field, s2, __location__); \
 245                         ret = false; \
 246                         break; \
 247                 }
 248
 249 #define MEM_EQUAL(s1, s2, length, field) \
 250                 if ((s1 && !s2) || (s2 && !s1) || memcmp(s1, s2, length)) { \
 251                         torture_comment(tctx, "Failed to set %s to '%s' (%s)\n", \
 252                                #field, (const char *)s2, __location__); \
 253                         ret = false; \
 254                         break; \
 255                 }
 256
 257 #define INT_EQUAL(i1, i2, field) \
 258                 if (i1 != i2) { \
 259                         torture_comment(tctx, "Failed to set %s to 0x%llx - got 0x%llx (%s)\n", \
 260                                #field, (unsigned long long)i2, (unsigned long long)i1, __location__); \
 261                         ret = false; \
 262                         break; \
 263                 }
 264
 265 #define TEST_USERINFO_STRING(lvl1, field1, lvl2, field2, value, fpval) do { \
 266                 torture_comment(tctx, "field test %d/%s vs %d/%s\n", lvl1, #field1, lvl2, #field2); \
 267                 q.in.level = lvl1; \
 268                 TESTCALL(QueryUserInfo, q) \
 269                 s.in.level = lvl1; \
 270                 s2.in.level = lvl1; \
 271                 u = *info; \
 272                 if (lvl1 == 21) { \
 273                         ZERO_STRUCT(u.info21); \
 274                         u.info21.fields_present = fpval; \
 275                 } \
 276                 init_lsa_String(&u.info ## lvl1.field1, value); \
 277                 TESTCALL(SetUserInfo, s) \
 278                 TESTCALL(SetUserInfo2, s2) \
 279                 init_lsa_String(&u.info ## lvl1.field1, ""); \
 280                 TESTCALL(QueryUserInfo, q); \
 281                 u = *info; \
 282                 STRING_EQUAL(u.info ## lvl1.field1.string, value, field1); \
 283                 q.in.level = lvl2; \
 284                 TESTCALL(QueryUserInfo, q) \
 285                 u = *info; \
 286                 STRING_EQUAL(u.info ## lvl2.field2.string, value, field2); \
 287         } while (0)
 288
 289 #define TEST_USERINFO_BINARYSTRING(lvl1, field1, lvl2, field2, value, fpval) do { \
 290                 torture_comment(tctx, "field test %d/%s vs %d/%s\n", lvl1, #field1, lvl2, #field2); \
 291                 q.in.level = lvl1; \
 292                 TESTCALL(QueryUserInfo, q) \
 293                 s.in.level = lvl1; \
 294                 s2.in.level = lvl1; \
 295                 u = *info; \
 296                 if (lvl1 == 21) { \
 297                         ZERO_STRUCT(u.info21); \
 298                         u.info21.fields_present = fpval; \
 299                 } \
 300                 init_lsa_BinaryString(&u.info ## lvl1.field1, value, strlen(value)); \
 301                 TESTCALL(SetUserInfo, s) \
 302                 TESTCALL(SetUserInfo2, s2) \
 303                 init_lsa_BinaryString(&u.info ## lvl1.field1, "", 1); \
 304                 TESTCALL(QueryUserInfo, q); \
 305                 u = *info; \
 306                 MEM_EQUAL(u.info ## lvl1.field1.array, value, strlen(value), field1); \
 307                 q.in.level = lvl2; \
 308                 TESTCALL(QueryUserInfo, q) \
 309                 u = *info; \
 310                 MEM_EQUAL(u.info ## lvl2.field2.array, value, strlen(value), field2); \
 311         } while (0)
 312
 313 #define TEST_USERINFO_INT_EXP(lvl1, field1, lvl2, field2, value, exp_value, fpval) do { \
 314                 torture_comment(tctx, "field test %d/%s vs %d/%s\n", lvl1, #field1, lvl2, #field2); \
 315                 q.in.level = lvl1; \
 316                 TESTCALL(QueryUserInfo, q) \
 317                 s.in.level = lvl1; \
 318                 s2.in.level = lvl1; \
 319                 u = *info; \
 320                 if (lvl1 == 21) { \
 321                         uint8_t *bits = u.info21.logon_hours.bits; \
 322                         ZERO_STRUCT(u.info21); \
 323                         if (fpval == SAMR_FIELD_LOGON_HOURS) { \
 324                                 u.info21.logon_hours.units_per_week = 168; \
 325                                 u.info21.logon_hours.bits = bits; \
 326                         } \
 327                         u.info21.fields_present = fpval; \
 328                 } \
 329                 u.info ## lvl1.field1 = value; \
 330                 TESTCALL(SetUserInfo, s) \
 331                 TESTCALL(SetUserInfo2, s2) \
 332                 u.info ## lvl1.field1 = 0; \
 333                 TESTCALL(QueryUserInfo, q); \
 334                 u = *info; \
 335                 INT_EQUAL(u.info ## lvl1.field1, exp_value, field1); \
 336                 q.in.level = lvl2; \
 337                 TESTCALL(QueryUserInfo, q) \
 338                 u = *info; \
 339                 INT_EQUAL(u.info ## lvl2.field2, exp_value, field1); \
 340         } while (0)
 341
 342 #define TEST_USERINFO_INT(lvl1, field1, lvl2, field2, value, fpval) do { \
 343         TEST_USERINFO_INT_EXP(lvl1, field1, lvl2, field2, value, value, fpval); \
 344         } while (0)
 345
 346         q0.in.level = 12;
 347         do { TESTCALL(QueryUserInfo, q0) } while (0);
 348
 349         TEST_USERINFO_STRING(2, comment,  1, comment, "xx2-1 comment", 0);
 350         TEST_USERINFO_STRING(2, comment, 21, comment, "xx2-21 comment", 0);
 351         TEST_USERINFO_STRING(21, comment, 21, comment, "xx21-21 comment",
 352                            SAMR_FIELD_COMMENT);
 353
 354         test_account_name = talloc_asprintf(tctx, "%sxx7-1", base_account_name);
 355         TEST_USERINFO_STRING(7, account_name,  1, account_name, base_account_name, 0);
 356         test_account_name = talloc_asprintf(tctx, "%sxx7-3", base_account_name);
 357         TEST_USERINFO_STRING(7, account_name,  3, account_name, base_account_name, 0);
 358         test_account_name = talloc_asprintf(tctx, "%sxx7-5", base_account_name);
 359         TEST_USERINFO_STRING(7, account_name,  5, account_name, base_account_name, 0);
 360         test_account_name = talloc_asprintf(tctx, "%sxx7-6", base_account_name);
 361         TEST_USERINFO_STRING(7, account_name,  6, account_name, base_account_name, 0);
 362         test_account_name = talloc_asprintf(tctx, "%sxx7-7", base_account_name);
 363         TEST_USERINFO_STRING(7, account_name,  7, account_name, base_account_name, 0);
 364         test_account_name = talloc_asprintf(tctx, "%sxx7-21", base_account_name);
 365         TEST_USERINFO_STRING(7, account_name, 21, account_name, base_account_name, 0);
 366         test_account_name = base_account_name;
 367         TEST_USERINFO_STRING(21, account_name, 21, account_name, base_account_name,
 368                            SAMR_FIELD_ACCOUNT_NAME);
 369
 370         TEST_USERINFO_STRING(6, full_name,  1, full_name, "xx6-1 full_name", 0);
 371         TEST_USERINFO_STRING(6, full_name,  3, full_name, "xx6-3 full_name", 0);
 372         TEST_USERINFO_STRING(6, full_name,  5, full_name, "xx6-5 full_name", 0);
 373         TEST_USERINFO_STRING(6, full_name,  6, full_name, "xx6-6 full_name", 0);
 374         TEST_USERINFO_STRING(6, full_name,  8, full_name, "xx6-8 full_name", 0);
 375         TEST_USERINFO_STRING(6, full_name, 21, full_name, "xx6-21 full_name", 0);
 376         TEST_USERINFO_STRING(8, full_name, 21, full_name, "xx8-21 full_name", 0);
 377         TEST_USERINFO_STRING(21, full_name, 21, full_name, "xx21-21 full_name",
 378                            SAMR_FIELD_FULL_NAME);
 379
 380         TEST_USERINFO_STRING(6, full_name,  1, full_name, "", 0);
 381         TEST_USERINFO_STRING(6, full_name,  3, full_name, "", 0);
 382         TEST_USERINFO_STRING(6, full_name,  5, full_name, "", 0);
 383         TEST_USERINFO_STRING(6, full_name,  6, full_name, "", 0);
 384         TEST_USERINFO_STRING(6, full_name,  8, full_name, "", 0);
 385         TEST_USERINFO_STRING(6, full_name, 21, full_name, "", 0);
 386         TEST_USERINFO_STRING(8, full_name, 21, full_name, "", 0);
 387         TEST_USERINFO_STRING(21, full_name, 21, full_name, "",
 388                            SAMR_FIELD_FULL_NAME);
 389
 390         TEST_USERINFO_STRING(11, logon_script, 3, logon_script, "xx11-3 logon_script", 0);
 391         TEST_USERINFO_STRING(11, logon_script, 5, logon_script, "xx11-5 logon_script", 0);
 392         TEST_USERINFO_STRING(11, logon_script, 21, logon_script, "xx11-21 logon_script", 0);
 393         TEST_USERINFO_STRING(21, logon_script, 21, logon_script, "xx21-21 logon_script",
 394                            SAMR_FIELD_LOGON_SCRIPT);
 395
 396         TEST_USERINFO_STRING(12, profile_path,  3, profile_path, "xx12-3 profile_path", 0);
 397         TEST_USERINFO_STRING(12, profile_path,  5, profile_path, "xx12-5 profile_path", 0);
 398         TEST_USERINFO_STRING(12, profile_path, 21, profile_path, "xx12-21 profile_path", 0);
 399         TEST_USERINFO_STRING(21, profile_path, 21, profile_path, "xx21-21 profile_path",
 400                            SAMR_FIELD_PROFILE_PATH);
 401
 402         TEST_USERINFO_STRING(10, home_directory, 3, home_directory, "xx10-3 home_directory", 0);
 403         TEST_USERINFO_STRING(10, home_directory, 5, home_directory, "xx10-5 home_directory", 0);
 404         TEST_USERINFO_STRING(10, home_directory, 21, home_directory, "xx10-21 home_directory", 0);
 405         TEST_USERINFO_STRING(21, home_directory, 21, home_directory, "xx21-21 home_directory",
 406                              SAMR_FIELD_HOME_DIRECTORY);
 407         TEST_USERINFO_STRING(21, home_directory, 10, home_directory, "xx21-10 home_directory",
 408                              SAMR_FIELD_HOME_DIRECTORY);
 409
 410         TEST_USERINFO_STRING(10, home_drive, 3, home_drive, "xx10-3 home_drive", 0);
 411         TEST_USERINFO_STRING(10, home_drive, 5, home_drive, "xx10-5 home_drive", 0);
 412         TEST_USERINFO_STRING(10, home_drive, 21, home_drive, "xx10-21 home_drive", 0);
 413         TEST_USERINFO_STRING(21, home_drive, 21, home_drive, "xx21-21 home_drive",
 414                              SAMR_FIELD_HOME_DRIVE);
 415         TEST_USERINFO_STRING(21, home_drive, 10, home_drive, "xx21-10 home_drive",
 416                              SAMR_FIELD_HOME_DRIVE);
 417
 418         TEST_USERINFO_STRING(13, description,  1, description, "xx13-1 description", 0);
 419         TEST_USERINFO_STRING(13, description,  5, description, "xx13-5 description", 0);
 420         TEST_USERINFO_STRING(13, description, 21, description, "xx13-21 description", 0);
 421         TEST_USERINFO_STRING(21, description, 21, description, "xx21-21 description",
 422                            SAMR_FIELD_DESCRIPTION);
 423
 424         TEST_USERINFO_STRING(14, workstations,  3, workstations, "14workstation3", 0);
 425         TEST_USERINFO_STRING(14, workstations,  5, workstations, "14workstation4", 0);
 426         TEST_USERINFO_STRING(14, workstations, 21, workstations, "14workstation21", 0);
 427         TEST_USERINFO_STRING(21, workstations, 21, workstations, "21workstation21",
 428                            SAMR_FIELD_WORKSTATIONS);
 429         TEST_USERINFO_STRING(21, workstations, 3, workstations, "21workstation3",
 430                            SAMR_FIELD_WORKSTATIONS);
 431         TEST_USERINFO_STRING(21, workstations, 5, workstations, "21workstation5",
 432                            SAMR_FIELD_WORKSTATIONS);
 433         TEST_USERINFO_STRING(21, workstations, 14, workstations, "21workstation14",
 434                            SAMR_FIELD_WORKSTATIONS);
 435
 436         TEST_USERINFO_BINARYSTRING(20, parameters, 21, parameters, "xx20-21 parameters", 0);
 437         TEST_USERINFO_BINARYSTRING(21, parameters, 21, parameters, "xx21-21 parameters",
 438                            SAMR_FIELD_PARAMETERS);
 439         TEST_USERINFO_BINARYSTRING(21, parameters, 20, parameters, "xx21-20 parameters",
 440                            SAMR_FIELD_PARAMETERS);
 441         /* also empty user parameters are allowed */
 442         TEST_USERINFO_BINARYSTRING(20, parameters, 21, parameters, "", 0);
 443         TEST_USERINFO_BINARYSTRING(21, parameters, 21, parameters, "",
 444                            SAMR_FIELD_PARAMETERS);
 445         TEST_USERINFO_BINARYSTRING(21, parameters, 20, parameters, "",
 446                            SAMR_FIELD_PARAMETERS);
 447
 448         /* Samba 3 cannot store country_code and copy_page atm. - gd */
 449         if (!torture_setting_bool(tctx, "samba3", false)) {
 450                 TEST_USERINFO_INT(2, country_code, 2, country_code, __LINE__, 0);
 451                 TEST_USERINFO_INT(2, country_code, 21, country_code, __LINE__, 0);
 452                 TEST_USERINFO_INT(21, country_code, 21, country_code, __LINE__,
 453                                   SAMR_FIELD_COUNTRY_CODE);
 454                 TEST_USERINFO_INT(21, country_code, 2, country_code, __LINE__,
 455                                   SAMR_FIELD_COUNTRY_CODE);
 456
 457                 TEST_USERINFO_INT(2, code_page, 21, code_page, __LINE__, 0);
 458                 TEST_USERINFO_INT(21, code_page, 21, code_page, __LINE__,
 459                                   SAMR_FIELD_CODE_PAGE);
 460                 TEST_USERINFO_INT(21, code_page, 2, code_page, __LINE__,
 461                                   SAMR_FIELD_CODE_PAGE);
 462         }
 463
 464         if (!torture_setting_bool(tctx, "samba3", false)) {
 465                 TEST_USERINFO_INT(17, acct_expiry, 21, acct_expiry, __LINE__, 0);
 466                 TEST_USERINFO_INT(17, acct_expiry, 5, acct_expiry, __LINE__, 0);
 467                 TEST_USERINFO_INT(21, acct_expiry, 21, acct_expiry, __LINE__,
 468                                   SAMR_FIELD_ACCT_EXPIRY);
 469                 TEST_USERINFO_INT(21, acct_expiry, 5, acct_expiry, __LINE__,
 470                                   SAMR_FIELD_ACCT_EXPIRY);
 471                 TEST_USERINFO_INT(21, acct_expiry, 17, acct_expiry, __LINE__,
 472                                   SAMR_FIELD_ACCT_EXPIRY);
 473         } else {
 474                 /* Samba 3 can only store seconds / time_t in passdb - gd */
 475                 NTTIME nt;
 476                 unix_to_nt_time(&nt, time(NULL) + __LINE__);
 477                 TEST_USERINFO_INT(17, acct_expiry, 21, acct_expiry, nt, 0);
 478                 unix_to_nt_time(&nt, time(NULL) + __LINE__);
 479                 TEST_USERINFO_INT(17, acct_expiry, 5, acct_expiry, nt, 0);
 480                 unix_to_nt_time(&nt, time(NULL) + __LINE__);
 481                 TEST_USERINFO_INT(21, acct_expiry, 21, acct_expiry, nt, SAMR_FIELD_ACCT_EXPIRY);
 482                 unix_to_nt_time(&nt, time(NULL) + __LINE__);
 483                 TEST_USERINFO_INT(21, acct_expiry, 5, acct_expiry, nt, SAMR_FIELD_ACCT_EXPIRY);
 484                 unix_to_nt_time(&nt, time(NULL) + __LINE__);
 485                 TEST_USERINFO_INT(21, acct_expiry, 17, acct_expiry, nt, SAMR_FIELD_ACCT_EXPIRY);
 486         }
 487
 488         TEST_USERINFO_INT(4, logon_hours.bits[3],  3, logon_hours.bits[3], 1, 0);
 489         TEST_USERINFO_INT(4, logon_hours.bits[3],  5, logon_hours.bits[3], 2, 0);
 490         TEST_USERINFO_INT(4, logon_hours.bits[3], 21, logon_hours.bits[3], 3, 0);
 491         TEST_USERINFO_INT(21, logon_hours.bits[3], 21, logon_hours.bits[3], 4,
 492                           SAMR_FIELD_LOGON_HOURS);
 493
 494         TEST_USERINFO_INT_EXP(16, acct_flags, 5, acct_flags,
 495                               (base_acct_flags  | ACB_DISABLED | ACB_HOMDIRREQ),
 496                               (base_acct_flags  | ACB_DISABLED | ACB_HOMDIRREQ | user_extra_flags),
 497                               0);
 498         TEST_USERINFO_INT_EXP(16, acct_flags, 5, acct_flags,
 499                               (base_acct_flags  | ACB_DISABLED),
 500                               (base_acct_flags  | ACB_DISABLED | user_extra_flags),
 501                               0);
 502
 503         /* Setting PWNOEXP clears the magic ACB_PW_EXPIRED flag */
 504         TEST_USERINFO_INT_EXP(16, acct_flags, 5, acct_flags,
 505                               (base_acct_flags  | ACB_DISABLED | ACB_PWNOEXP),
 506                               (base_acct_flags  | ACB_DISABLED | ACB_PWNOEXP),
 507                               0);
 508         TEST_USERINFO_INT_EXP(16, acct_flags, 21, acct_flags,
 509                               (base_acct_flags | ACB_DISABLED | ACB_HOMDIRREQ),
 510                               (base_acct_flags | ACB_DISABLED | ACB_HOMDIRREQ | user_extra_flags),
 511                               0);
 512
 513
 514         /* The 'autolock' flag doesn't stick - check this */
 515         TEST_USERINFO_INT_EXP(16, acct_flags, 21, acct_flags,
 516                               (base_acct_flags | ACB_DISABLED | ACB_AUTOLOCK),
 517                               (base_acct_flags | ACB_DISABLED | user_extra_flags),
 518                               0);
 519 #if 0
 520         /* Removing the 'disabled' flag doesn't stick - check this */
 521         TEST_USERINFO_INT_EXP(16, acct_flags, 21, acct_flags,
 522                               (base_acct_flags),
 523                               (base_acct_flags | ACB_DISABLED | user_extra_flags),
 524                               0);
 525 #endif
 526
 527         /* Samba3 cannot store these atm */
 528         if (!torture_setting_bool(tctx, "samba3", false)) {
 529         /* The 'store plaintext' flag does stick */
 530         TEST_USERINFO_INT_EXP(16, acct_flags, 21, acct_flags,
 531                               (base_acct_flags | ACB_DISABLED | ACB_ENC_TXT_PWD_ALLOWED),
 532                               (base_acct_flags | ACB_DISABLED | ACB_ENC_TXT_PWD_ALLOWED | user_extra_flags),
 533                               0);
 534         /* The 'use DES' flag does stick */
 535         TEST_USERINFO_INT_EXP(16, acct_flags, 21, acct_flags,
 536                               (base_acct_flags | ACB_DISABLED | ACB_USE_DES_KEY_ONLY),
 537                               (base_acct_flags | ACB_DISABLED | ACB_USE_DES_KEY_ONLY | user_extra_flags),
 538                               0);
 539         /* The 'don't require kerberos pre-authentication flag does stick */
 540         TEST_USERINFO_INT_EXP(16, acct_flags, 21, acct_flags,
 541                               (base_acct_flags | ACB_DISABLED | ACB_DONT_REQUIRE_PREAUTH),
 542                               (base_acct_flags | ACB_DISABLED | ACB_DONT_REQUIRE_PREAUTH | user_extra_flags),
 543                               0);
 544         /* The 'no kerberos PAC required' flag sticks */
 545         TEST_USERINFO_INT_EXP(16, acct_flags, 21, acct_flags,
 546                               (base_acct_flags | ACB_DISABLED | ACB_NO_AUTH_DATA_REQD),
 547                               (base_acct_flags | ACB_DISABLED | ACB_NO_AUTH_DATA_REQD | user_extra_flags),
 548                               0);
 549         }
 550         TEST_USERINFO_INT_EXP(21, acct_flags, 21, acct_flags,
 551                               (base_acct_flags | ACB_DISABLED),
 552                               (base_acct_flags | ACB_DISABLED | user_extra_flags),
 553                               SAMR_FIELD_ACCT_FLAGS);
 554
 555 #if 0
 556         /* these fail with win2003 - it appears you can't set the primary gid?
 557            the set succeeds, but the gid isn't changed. Very weird! */
 558         TEST_USERINFO_INT(9, primary_gid,  1, primary_gid, 513);
 559         TEST_USERINFO_INT(9, primary_gid,  3, primary_gid, 513);
 560         TEST_USERINFO_INT(9, primary_gid,  5, primary_gid, 513);
 561         TEST_USERINFO_INT(9, primary_gid, 21, primary_gid, 513);
 562 #endif
 563
 564         return ret;
 565 }
 566
 567 /*
 568   generate a random password for password change tests
 569 */
 570 static char *samr_rand_pass_silent(TALLOC_CTX *mem_ctx, int min_len)
 571 {
 572         size_t len = MAX(8, min_len) + (random() % 6);
 573         char *s = generate_random_str(mem_ctx, len);
 574         return s;
 575 }
 576
 577 static char *samr_rand_pass(TALLOC_CTX *mem_ctx, int min_len)
 578 {
 579         char *s = samr_rand_pass_silent(mem_ctx, min_len);
 580         printf("Generated password '%s'\n", s);
 581         return s;
 582
 583 }
 584
 585 /*
 586   generate a random password for password change tests
 587 */
 588 static DATA_BLOB samr_very_rand_pass(TALLOC_CTX *mem_ctx, int len)
 589 {
 590         int i;
 591         DATA_BLOB password = data_blob_talloc(mem_ctx, NULL, len * 2 /* number of unicode chars */);
 592         generate_random_buffer(password.data, password.length);
 593
 594         for (i=0; i < len; i++) {
 595                 if (((uint16_t *)password.data)[i] == 0) {
 596                         ((uint16_t *)password.data)[i] = 1;
 597                 }
 598         }
 599
 600         return password;
 601 }
 602
 603 /*
 604   generate a random password for password change tests (fixed length)
 605 */
 606 static char *samr_rand_pass_fixed_len(TALLOC_CTX *mem_ctx, int len)
 607 {
 608         char *s = generate_random_str(mem_ctx, len);
 609         printf("Generated password '%s'\n", s);
 610         return s;
 611 }
 612
 613 static bool test_SetUserPass(struct dcerpc_pipe *p, struct torture_context *tctx,
 614                              struct policy_handle *handle, char **password)
 615 {
 616         NTSTATUS status;
 617         struct samr_SetUserInfo s;
 618         union samr_UserInfo u;
 619         bool ret = true;
 620         DATA_BLOB session_key;
 621         char *newpass;
 622         struct samr_GetUserPwInfo pwp;
 623         struct samr_PwInfo info;
 624         int policy_min_pw_len = 0;
 625         pwp.in.user_handle = handle;
 626         pwp.out.info = &info;
 627
 628         status = dcerpc_samr_GetUserPwInfo(p, tctx, &pwp);
 629         if (NT_STATUS_IS_OK(status)) {
 630                 policy_min_pw_len = pwp.out.info->min_password_length;
 631         }
 632         newpass = samr_rand_pass(tctx, policy_min_pw_len);
 633
 634         s.in.user_handle = handle;
 635         s.in.info = &u;
 636         s.in.level = 24;
 637
 638         encode_pw_buffer(u.info24.password.data, newpass, STR_UNICODE);
 639         u.info24.password_expired = 0;
 640
 641         status = dcerpc_fetch_session_key(p, &session_key);
 642         if (!NT_STATUS_IS_OK(status)) {
 643                 torture_warning(tctx, "SetUserInfo level %u - no session key - %s\n",
 644                        s.in.level, nt_errstr(status));
 645                 return false;
 646         }
 647
 648         arcfour_crypt_blob(u.info24.password.data, 516, &session_key);
 649
 650         torture_comment(tctx, "Testing SetUserInfo level 24 (set password)\n");
 651
 652         status = dcerpc_samr_SetUserInfo(p, tctx, &s);
 653         if (!NT_STATUS_IS_OK(status)) {
 654                 torture_warning(tctx, "SetUserInfo level %u failed - %s\n",
 655                        s.in.level, nt_errstr(status));
 656                 ret = false;
 657         } else {
 658                 *password = newpass;
 659         }
 660
 661         return ret;
 662 }
 663
 664
 665 static bool test_SetUserPass_23(struct dcerpc_pipe *p, struct torture_context *tctx,
 666                                 struct policy_handle *handle, uint32_t fields_present,
 667                                 char **password)
 668 {
 669         NTSTATUS status;
 670         struct samr_SetUserInfo s;
 671         union samr_UserInfo u;
 672         bool ret = true;
 673         DATA_BLOB session_key;
 674         char *newpass;
 675         struct samr_GetUserPwInfo pwp;
 676         struct samr_PwInfo info;
 677         int policy_min_pw_len = 0;
 678         pwp.in.user_handle = handle;
 679         pwp.out.info = &info;
 680
 681         status = dcerpc_samr_GetUserPwInfo(p, tctx, &pwp);
 682         if (NT_STATUS_IS_OK(status)) {
 683                 policy_min_pw_len = pwp.out.info->min_password_length;
 684         }
 685         newpass = samr_rand_pass(tctx, policy_min_pw_len);
 686
 687         s.in.user_handle = handle;
 688         s.in.info = &u;
 689         s.in.level = 23;
 690
 691         ZERO_STRUCT(u);
 692
 693         u.info23.info.fields_present = fields_present;
 694
 695         encode_pw_buffer(u.info23.password.data, newpass, STR_UNICODE);
 696
 697         status = dcerpc_fetch_session_key(p, &session_key);
 698         if (!NT_STATUS_IS_OK(status)) {
 699                 torture_warning(tctx, "SetUserInfo level %u - no session key - %s\n",
 700                        s.in.level, nt_errstr(status));
 701                 return false;
 702         }
 703
 704         arcfour_crypt_blob(u.info23.password.data, 516, &session_key);
 705
 706         torture_comment(tctx, "Testing SetUserInfo level 23 (set password)\n");
 707
 708         status = dcerpc_samr_SetUserInfo(p, tctx, &s);
 709         if (!NT_STATUS_IS_OK(status)) {
 710                 torture_warning(tctx, "SetUserInfo level %u failed - %s\n",
 711                        s.in.level, nt_errstr(status));
 712                 ret = false;
 713         } else {
 714                 *password = newpass;
 715         }
 716
 717         encode_pw_buffer(u.info23.password.data, newpass, STR_UNICODE);
 718
 719         status = dcerpc_fetch_session_key(p, &session_key);
 720         if (!NT_STATUS_IS_OK(status)) {
 721                 torture_warning(tctx, "SetUserInfo level %u - no session key - %s\n",
 722                        s.in.level, nt_errstr(status));
 723                 return false;
 724         }
 725
 726         /* This should break the key nicely */
 727         session_key.length--;
 728         arcfour_crypt_blob(u.info23.password.data, 516, &session_key);
 729
 730         torture_comment(tctx, "Testing SetUserInfo level 23 (set password) with wrong password\n");
 731
 732         status = dcerpc_samr_SetUserInfo(p, tctx, &s);
 733         if (!NT_STATUS_EQUAL(status, NT_STATUS_WRONG_PASSWORD)) {
 734                 torture_warning(tctx, "SetUserInfo level %u should have failed with WRONG_PASSWORD- %s\n",
 735                        s.in.level, nt_errstr(status));
 736                 ret = false;
 737         }
 738
 739         return ret;
 740 }
 741
 742
 743 static bool test_SetUserPassEx(struct dcerpc_pipe *p, struct torture_context *tctx,
 744                                struct policy_handle *handle, bool makeshort,
 745                                char **password)
 746 {
 747         NTSTATUS status;
 748         struct samr_SetUserInfo s;
 749         union samr_UserInfo u;
 750         bool ret = true;
 751         DATA_BLOB session_key;
 752         DATA_BLOB confounded_session_key = data_blob_talloc(tctx, NULL, 16);
 753         uint8_t confounder[16];
 754         char *newpass;
 755         struct MD5Context ctx;
 756         struct samr_GetUserPwInfo pwp;
 757         struct samr_PwInfo info;
 758         int policy_min_pw_len = 0;
 759         pwp.in.user_handle = handle;
 760         pwp.out.info = &info;
 761
 762         status = dcerpc_samr_GetUserPwInfo(p, tctx, &pwp);
 763         if (NT_STATUS_IS_OK(status)) {
 764                 policy_min_pw_len = pwp.out.info->min_password_length;
 765         }
 766         if (makeshort && policy_min_pw_len) {
 767                 newpass = samr_rand_pass_fixed_len(tctx, policy_min_pw_len - 1);
 768         } else {
 769                 newpass = samr_rand_pass(tctx, policy_min_pw_len);
 770         }
 771
 772         s.in.user_handle = handle;
 773         s.in.info = &u;
 774         s.in.level = 26;
 775
 776         encode_pw_buffer(u.info26.password.data, newpass, STR_UNICODE);
 777         u.info26.password_expired = 0;
 778
 779         status = dcerpc_fetch_session_key(p, &session_key);
 780         if (!NT_STATUS_IS_OK(status)) {
 781                 torture_warning(tctx, "SetUserInfo level %u - no session key - %s\n",
 782                        s.in.level, nt_errstr(status));
 783                 return false;
 784         }
 785
 786         generate_random_buffer((uint8_t *)confounder, 16);
 787
 788         MD5Init(&ctx);
 789         MD5Update(&ctx, confounder, 16);
 790         MD5Update(&ctx, session_key.data, session_key.length);
 791         MD5Final(confounded_session_key.data, &ctx);
 792
 793         arcfour_crypt_blob(u.info26.password.data, 516, &confounded_session_key);
 794         memcpy(&u.info26.password.data[516], confounder, 16);
 795
 796         torture_comment(tctx, "Testing SetUserInfo level 26 (set password ex)\n");
 797
 798         status = dcerpc_samr_SetUserInfo(p, tctx, &s);
 799         if (!NT_STATUS_IS_OK(status)) {
 800                 torture_warning(tctx, "SetUserInfo level %u failed - %s\n",
 801                        s.in.level, nt_errstr(status));
 802                 ret = false;
 803         } else {
 804                 *password = newpass;
 805         }
 806
 807         /* This should break the key nicely */
 808         confounded_session_key.data[0]++;
 809
 810         arcfour_crypt_blob(u.info26.password.data, 516, &confounded_session_key);
 811         memcpy(&u.info26.password.data[516], confounder, 16);
 812
 813         torture_comment(tctx, "Testing SetUserInfo level 26 (set password ex) with wrong session key\n");
 814
 815         status = dcerpc_samr_SetUserInfo(p, tctx, &s);
 816         if (!NT_STATUS_EQUAL(status, NT_STATUS_WRONG_PASSWORD)) {
 817                 torture_warning(tctx, "SetUserInfo level %u should have failed with WRONG_PASSWORD: %s\n",
 818                        s.in.level, nt_errstr(status));
 819                 ret = false;
 820         } else {
 821                 *password = newpass;
 822         }
 823
 824         return ret;
 825 }
 826
 827 static bool test_SetUserPass_25(struct dcerpc_pipe *p, struct torture_context *tctx,
 828                                 struct policy_handle *handle, uint32_t fields_present,
 829                                 char **password)
 830 {
 831         NTSTATUS status;
 832         struct samr_SetUserInfo s;
 833         union samr_UserInfo u;
 834         bool ret = true;
 835         DATA_BLOB session_key;
 836         DATA_BLOB confounded_session_key = data_blob_talloc(tctx, NULL, 16);
 837         struct MD5Context ctx;
 838         uint8_t confounder[16];
 839         char *newpass;
 840         struct samr_GetUserPwInfo pwp;
 841         struct samr_PwInfo info;
 842         int policy_min_pw_len = 0;
 843         pwp.in.user_handle = handle;
 844         pwp.out.info = &info;
 845
 846         status = dcerpc_samr_GetUserPwInfo(p, tctx, &pwp);
 847         if (NT_STATUS_IS_OK(status)) {
 848                 policy_min_pw_len = pwp.out.info->min_password_length;
 849         }
 850         newpass = samr_rand_pass(tctx, policy_min_pw_len);
 851
 852         s.in.user_handle = handle;
 853         s.in.info = &u;
 854         s.in.level = 25;
 855
 856         ZERO_STRUCT(u);
 857
 858         u.info25.info.fields_present = fields_present;
 859
 860         encode_pw_buffer(u.info25.password.data, newpass, STR_UNICODE);
 861
 862         status = dcerpc_fetch_session_key(p, &session_key);
 863         if (!NT_STATUS_IS_OK(status)) {
 864                 torture_warning(tctx, "SetUserInfo level %u - no session key - %s\n",
 865                        s.in.level, nt_errstr(status));
 866                 return false;
 867         }
 868
 869         generate_random_buffer((uint8_t *)confounder, 16);
 870
 871         MD5Init(&ctx);
 872         MD5Update(&ctx, confounder, 16);
 873         MD5Update(&ctx, session_key.data, session_key.length);
 874         MD5Final(confounded_session_key.data, &ctx);
 875
 876         arcfour_crypt_blob(u.info25.password.data, 516, &confounded_session_key);
 877         memcpy(&u.info25.password.data[516], confounder, 16);
 878
 879         torture_comment(tctx, "Testing SetUserInfo level 25 (set password ex)\n");
 880
 881         status = dcerpc_samr_SetUserInfo(p, tctx, &s);
 882         if (!NT_STATUS_IS_OK(status)) {
 883                 torture_warning(tctx, "SetUserInfo level %u failed - %s\n",
 884                        s.in.level, nt_errstr(status));
 885                 ret = false;
 886         } else {
 887                 *password = newpass;
 888         }
 889
 890         /* This should break the key nicely */
 891         confounded_session_key.data[0]++;
 892
 893         arcfour_crypt_blob(u.info25.password.data, 516, &confounded_session_key);
 894         memcpy(&u.info25.password.data[516], confounder, 16);
 895
 896         torture_comment(tctx, "Testing SetUserInfo level 25 (set password ex) with wrong session key\n");
 897
 898         status = dcerpc_samr_SetUserInfo(p, tctx, &s);
 899         if (!NT_STATUS_EQUAL(status, NT_STATUS_WRONG_PASSWORD)) {
 900                 torture_warning(tctx, "SetUserInfo level %u should have failed with WRONG_PASSWORD- %s\n",
 901                        s.in.level, nt_errstr(status));
 902                 ret = false;
 903         }
 904
 905         return ret;
 906 }
 907
 908 static bool test_SetUserPass_18(struct dcerpc_pipe *p, struct torture_context *tctx,
 909                                 struct policy_handle *handle, char **password)
 910 {
 911         NTSTATUS status;
 912         struct samr_SetUserInfo s;
 913         union samr_UserInfo u;
 914         bool ret = true;
 915         DATA_BLOB session_key;
 916         char *newpass;
 917         struct samr_GetUserPwInfo pwp;
 918         struct samr_PwInfo info;
 919         int policy_min_pw_len = 0;
 920         uint8_t lm_hash[16], nt_hash[16];
 921
 922         pwp.in.user_handle = handle;
 923         pwp.out.info = &info;
 924
 925         status = dcerpc_samr_GetUserPwInfo(p, tctx, &pwp);
 926         if (NT_STATUS_IS_OK(status)) {
 927                 policy_min_pw_len = pwp.out.info->min_password_length;
 928         }
 929         newpass = samr_rand_pass(tctx, policy_min_pw_len);
 930
 931         s.in.user_handle = handle;
 932         s.in.info = &u;
 933         s.in.level = 18;
 934
 935         ZERO_STRUCT(u);
 936
 937         u.info18.nt_pwd_active = true;
 938         u.info18.lm_pwd_active = true;
 939
 940         E_md4hash(newpass, nt_hash);
 941         E_deshash(newpass, lm_hash);
 942
 943         status = dcerpc_fetch_session_key(p, &session_key);
 944         if (!NT_STATUS_IS_OK(status)) {
 945                 torture_warning(tctx, "SetUserInfo level %u - no session key - %s\n",
 946                        s.in.level, nt_errstr(status));
 947                 return false;
 948         }
 949
 950         {
 951                 DATA_BLOB in,out;
 952                 in = data_blob_const(nt_hash, 16);
 953                 out = data_blob_talloc_zero(tctx, 16);
 954                 sess_crypt_blob(&out, &in, &session_key, true);
 955                 memcpy(u.info18.nt_pwd.hash, out.data, out.length);
 956         }
 957         {
 958                 DATA_BLOB in,out;
 959                 in = data_blob_const(lm_hash, 16);
 960                 out = data_blob_talloc_zero(tctx, 16);
 961                 sess_crypt_blob(&out, &in, &session_key, true);
 962                 memcpy(u.info18.lm_pwd.hash, out.data, out.length);
 963         }
 964
 965         torture_comment(tctx, "Testing SetUserInfo level 18 (set password hash)\n");
 966
 967         status = dcerpc_samr_SetUserInfo(p, tctx, &s);
 968         if (!NT_STATUS_IS_OK(status)) {
 969                 torture_warning(tctx, "SetUserInfo level %u failed - %s\n",
 970                        s.in.level, nt_errstr(status));
 971                 ret = false;
 972         } else {
 973                 *password = newpass;
 974         }
 975
 976         return ret;
 977 }
 978
 979 static bool test_SetUserPass_21(struct dcerpc_pipe *p, struct torture_context *tctx,
 980                                 struct policy_handle *handle, uint32_t fields_present,
 981                                 char **password)
 982 {
 983         NTSTATUS status;
 984         struct samr_SetUserInfo s;
 985         union samr_UserInfo u;
 986         bool ret = true;
 987         DATA_BLOB session_key;
 988         char *newpass;
 989         struct samr_GetUserPwInfo pwp;
 990         struct samr_PwInfo info;
 991         int policy_min_pw_len = 0;
 992         uint8_t lm_hash[16], nt_hash[16];
 993
 994         pwp.in.user_handle = handle;
 995         pwp.out.info = &info;
 996
 997         status = dcerpc_samr_GetUserPwInfo(p, tctx, &pwp);
 998         if (NT_STATUS_IS_OK(status)) {
 999                 policy_min_pw_len = pwp.out.info->min_password_length;
1000         }
1001         newpass = samr_rand_pass(tctx, policy_min_pw_len);
1002
1003         s.in.user_handle = handle;
1004         s.in.info = &u;
1005         s.in.level = 21;
1006
1007         E_md4hash(newpass, nt_hash);
1008         E_deshash(newpass, lm_hash);
1009
1010         ZERO_STRUCT(u);
1011
1012         u.info21.fields_present = fields_present;
1013
1014         if (fields_present & SAMR_FIELD_LM_PASSWORD_PRESENT) {
1015                 u.info21.lm_owf_password.length = 16;
1016                 u.info21.lm_owf_password.size = 16;
1017                 u.info21.lm_owf_password.array = (uint16_t *)lm_hash;
1018                 u.info21.lm_password_set = true;
1019         }
1020
1021         if (fields_present & SAMR_FIELD_NT_PASSWORD_PRESENT) {
1022                 u.info21.nt_owf_password.length = 16;
1023                 u.info21.nt_owf_password.size = 16;
1024                 u.info21.nt_owf_password.array = (uint16_t *)nt_hash;
1025                 u.info21.nt_password_set = true;
1026         }
1027
1028         status = dcerpc_fetch_session_key(p, &session_key);
1029         if (!NT_STATUS_IS_OK(status)) {
1030                 torture_warning(tctx, "SetUserInfo level %u - no session key - %s\n",
1031                        s.in.level, nt_errstr(status));
1032                 return false;
1033         }
1034
1035         if (fields_present & SAMR_FIELD_LM_PASSWORD_PRESENT) {
1036                 DATA_BLOB in,out;
1037                 in = data_blob_const(u.info21.lm_owf_password.array,
1038                                      u.info21.lm_owf_password.length);
1039                 out = data_blob_talloc_zero(tctx, 16);
1040                 sess_crypt_blob(&out, &in, &session_key, true);
1041                 u.info21.lm_owf_password.array = (uint16_t *)out.data;
1042         }
1043
1044         if (fields_present & SAMR_FIELD_NT_PASSWORD_PRESENT) {
1045                 DATA_BLOB in,out;
1046                 in = data_blob_const(u.info21.nt_owf_password.array,
1047                                      u.info21.nt_owf_password.length);
1048                 out = data_blob_talloc_zero(tctx, 16);
1049                 sess_crypt_blob(&out, &in, &session_key, true);
1050                 u.info21.nt_owf_password.array = (uint16_t *)out.data;
1051         }
1052
1053         torture_comment(tctx, "Testing SetUserInfo level 21 (set password hash)\n");
1054
1055         status = dcerpc_samr_SetUserInfo(p, tctx, &s);
1056         if (!NT_STATUS_IS_OK(status)) {
1057                 torture_warning(tctx, "SetUserInfo level %u failed - %s\n",
1058                        s.in.level, nt_errstr(status));
1059                 ret = false;
1060         } else {
1061                 *password = newpass;
1062         }
1063
1064         /* try invalid length */
1065         if (fields_present & SAMR_FIELD_NT_PASSWORD_PRESENT) {
1066
1067                 u.info21.nt_owf_password.length++;
1068
1069                 status = dcerpc_samr_SetUserInfo(p, tctx, &s);
1070
1071                 if (!NT_STATUS_EQUAL(status, NT_STATUS_INVALID_PARAMETER)) {
1072                         torture_warning(tctx, "SetUserInfo level %u should have failed with NT_STATUS_INVALID_PARAMETER - %s\n",
1073                                s.in.level, nt_errstr(status));
1074                         ret = false;
1075                 }
1076         }
1077
1078         if (fields_present & SAMR_FIELD_LM_PASSWORD_PRESENT) {
1079
1080                 u.info21.lm_owf_password.length++;
1081
1082                 status = dcerpc_samr_SetUserInfo(p, tctx, &s);
1083
1084                 if (!NT_STATUS_EQUAL(status, NT_STATUS_INVALID_PARAMETER)) {
1085                         torture_warning(tctx, "SetUserInfo level %u should have failed with NT_STATUS_INVALID_PARAMETER - %s\n",
1086                                s.in.level, nt_errstr(status));
1087                         ret = false;
1088                 }
1089         }
1090
1091         return ret;
1092 }
1093
1094 static bool test_SetUserPass_level_ex(struct dcerpc_pipe *p,
1095                                       struct torture_context *tctx,
1096                                       struct policy_handle *handle,
1097                                       uint16_t level,
1098                                       uint32_t fields_present,
1099                                       char **password, uint8_t password_expired,
1100                                       bool use_setinfo2,
1101                                       bool *matched_expected_error)
1102 {
1103         NTSTATUS status;
1104         NTSTATUS expected_error = NT_STATUS_OK;
1105         struct samr_SetUserInfo s;
1106         struct samr_SetUserInfo2 s2;
1107         union samr_UserInfo u;
1108         bool ret = true;
1109         DATA_BLOB session_key;
1110         DATA_BLOB confounded_session_key = data_blob_talloc(tctx, NULL, 16);
1111         struct MD5Context ctx;
1112         uint8_t confounder[16];
1113         char *newpass;
1114         struct samr_GetUserPwInfo pwp;
1115         struct samr_PwInfo info;
1116         int policy_min_pw_len = 0;
1117         const char *comment = NULL;
1118         uint8_t lm_hash[16], nt_hash[16];
1119
1120         pwp.in.user_handle = handle;
1121         pwp.out.info = &info;
1122
1123         status = dcerpc_samr_GetUserPwInfo(p, tctx, &pwp);
1124         if (NT_STATUS_IS_OK(status)) {
1125                 policy_min_pw_len = pwp.out.info->min_password_length;
1126         }
1127         newpass = samr_rand_pass_silent(tctx, policy_min_pw_len);
1128
1129         if (use_setinfo2) {
1130                 s2.in.user_handle = handle;
1131                 s2.in.info = &u;
1132                 s2.in.level = level;
1133         } else {
1134                 s.in.user_handle = handle;
1135                 s.in.info = &u;
1136                 s.in.level = level;
1137         }
1138
1139         if (fields_present & SAMR_FIELD_COMMENT) {
1140                 comment = talloc_asprintf(tctx, "comment: %ld\n", time(NULL));
1141         }
1142
1143         ZERO_STRUCT(u);
1144
1145         switch (level) {
1146         case 18:
1147                 E_md4hash(newpass, nt_hash);
1148                 E_deshash(newpass, lm_hash);
1149
1150                 u.info18.nt_pwd_active = true;
1151                 u.info18.lm_pwd_active = true;
1152                 u.info18.password_expired = password_expired;
1153
1154                 memcpy(u.info18.lm_pwd.hash, lm_hash, 16);
1155                 memcpy(u.info18.nt_pwd.hash, nt_hash, 16);
1156
1157                 break;
1158         case 21:
1159                 E_md4hash(newpass, nt_hash);
1160                 E_deshash(newpass, lm_hash);
1161
1162                 u.info21.fields_present = fields_present;
1163                 u.info21.password_expired = password_expired;
1164                 u.info21.comment.string = comment;
1165
1166                 if (fields_present & SAMR_FIELD_LM_PASSWORD_PRESENT) {
1167                         u.info21.lm_owf_password.length = 16;
1168                         u.info21.lm_owf_password.size = 16;
1169                         u.info21.lm_owf_password.array = (uint16_t *)lm_hash;
1170                         u.info21.lm_password_set = true;
1171                 }
1172
1173                 if (fields_present & SAMR_FIELD_NT_PASSWORD_PRESENT) {
1174                         u.info21.nt_owf_password.length = 16;
1175                         u.info21.nt_owf_password.size = 16;
1176                         u.info21.nt_owf_password.array = (uint16_t *)nt_hash;
1177                         u.info21.nt_password_set = true;
1178                 }
1179
1180                 break;
1181         case 23:
1182                 u.info23.info.fields_present = fields_present;
1183                 u.info23.info.password_expired = password_expired;
1184                 u.info23.info.comment.string = comment;
1185
1186                 encode_pw_buffer(u.info23.password.data, newpass, STR_UNICODE);
1187
1188                 break;
1189         case 24:
1190                 u.info24.password_expired = password_expired;
1191
1192                 encode_pw_buffer(u.info24.password.data, newpass, STR_UNICODE);
1193
1194                 break;
1195         case 25:
1196                 u.info25.info.fields_present = fields_present;
1197                 u.info25.info.password_expired = password_expired;
1198                 u.info25.info.comment.string = comment;
1199
1200                 encode_pw_buffer(u.info25.password.data, newpass, STR_UNICODE);
1201
1202                 break;
1203         case 26:
1204                 u.info26.password_expired = password_expired;
1205
1206                 encode_pw_buffer(u.info26.password.data, newpass, STR_UNICODE);
1207
1208                 break;
1209         }
1210
1211         status = dcerpc_fetch_session_key(p, &session_key);
1212         if (!NT_STATUS_IS_OK(status)) {
1213                 torture_warning(tctx, "SetUserInfo level %u - no session key - %s\n",
1214                        s.in.level, nt_errstr(status));
1215                 return false;
1216         }
1217
1218         generate_random_buffer((uint8_t *)confounder, 16);
1219
1220         MD5Init(&ctx);
1221         MD5Update(&ctx, confounder, 16);
1222         MD5Update(&ctx, session_key.data, session_key.length);
1223         MD5Final(confounded_session_key.data, &ctx);
1224
1225         switch (level) {
1226         case 18:
1227                 {
1228                         DATA_BLOB in,out;
1229                         in = data_blob_const(u.info18.nt_pwd.hash, 16);
1230                         out = data_blob_talloc_zero(tctx, 16);
1231                         sess_crypt_blob(&out, &in, &session_key, true);
1232                         memcpy(u.info18.nt_pwd.hash, out.data, out.length);
1233                 }
1234                 {
1235                         DATA_BLOB in,out;
1236                         in = data_blob_const(u.info18.lm_pwd.hash, 16);
1237                         out = data_blob_talloc_zero(tctx, 16);
1238                         sess_crypt_blob(&out, &in, &session_key, true);
1239                         memcpy(u.info18.lm_pwd.hash, out.data, out.length);
1240                 }
1241
1242                 break;
1243         case 21:
1244                 if (fields_present & SAMR_FIELD_LM_PASSWORD_PRESENT) {
1245                         DATA_BLOB in,out;
1246                         in = data_blob_const(u.info21.lm_owf_password.array,
1247                                              u.info21.lm_owf_password.length);
1248                         out = data_blob_talloc_zero(tctx, 16);
1249                         sess_crypt_blob(&out, &in, &session_key, true);
1250                         u.info21.lm_owf_password.array = (uint16_t *)out.data;
1251                 }
1252                 if (fields_present & SAMR_FIELD_NT_PASSWORD_PRESENT) {
1253                         DATA_BLOB in,out;
1254                         in = data_blob_const(u.info21.nt_owf_password.array,
1255                                              u.info21.nt_owf_password.length);
1256                         out = data_blob_talloc_zero(tctx, 16);
1257                         sess_crypt_blob(&out, &in, &session_key, true);
1258                         u.info21.nt_owf_password.array = (uint16_t *)out.data;
1259                 }
1260                 break;
1261         case 23:
1262                 arcfour_crypt_blob(u.info23.password.data, 516, &session_key);
1263                 break;
1264         case 24:
1265                 arcfour_crypt_blob(u.info24.password.data, 516, &session_key);
1266                 break;
1267         case 25:
1268                 arcfour_crypt_blob(u.info25.password.data, 516, &confounded_session_key);
1269                 memcpy(&u.info25.password.data[516], confounder, 16);
1270                 break;
1271         case 26:
1272                 arcfour_crypt_blob(u.info26.password.data, 516, &confounded_session_key);
1273                 memcpy(&u.info26.password.data[516], confounder, 16);
1274                 break;
1275         }
1276
1277         if (use_setinfo2) {
1278                 status = dcerpc_samr_SetUserInfo2(p, tctx, &s2);
1279         } else {
1280                 status = dcerpc_samr_SetUserInfo(p, tctx, &s);
1281         }
1282
1283         if (!NT_STATUS_IS_OK(status)) {
1284                 if (fields_present == 0) {
1285                         expected_error = NT_STATUS_INVALID_PARAMETER;
1286                 }
1287                 if (fields_present & SAMR_FIELD_LAST_PWD_CHANGE) {
1288                         expected_error = NT_STATUS_ACCESS_DENIED;
1289                 }
1290         }
1291
1292         if (!NT_STATUS_IS_OK(expected_error)) {
1293                 if (use_setinfo2) {
1294                         torture_assert_ntstatus_equal(tctx,
1295                                 s2.out.result,
1296                                 expected_error, "SetUserInfo2 failed");
1297                 } else {
1298                         torture_assert_ntstatus_equal(tctx,
1299                                 s.out.result,
1300                                 expected_error, "SetUserInfo failed");
1301                 }
1302                 *matched_expected_error = true;
1303                 return true;
1304         }
1305
1306         if (!NT_STATUS_IS_OK(status)) {
1307                 torture_warning(tctx, "SetUserInfo%s level %u failed - %s\n",
1308                        use_setinfo2 ? "2":"", level, nt_errstr(status));
1309                 ret = false;
1310         } else {
1311                 *password = newpass;
1312         }
1313
1314         return ret;
1315 }
1316
1317 static bool test_SetAliasInfo(struct dcerpc_pipe *p, struct torture_context *tctx,
1318                                struct policy_handle *handle)
1319 {
1320         NTSTATUS status;
1321         struct samr_SetAliasInfo r;
1322         struct samr_QueryAliasInfo q;
1323         union samr_AliasInfo *info;
1324         uint16_t levels[] = {2, 3};
1325         int i;
1326         bool ret = true;
1327
1328         /* Ignoring switch level 1, as that includes the number of members for the alias
1329          * and setting this to a wrong value might have negative consequences
1330          */
1331
1332         for (i=0;i<ARRAY_SIZE(levels);i++) {
1333                 torture_comment(tctx, "Testing SetAliasInfo level %u\n", levels[i]);
1334
1335                 r.in.alias_handle = handle;
1336                 r.in.level = levels[i];
1337                 r.in.info  = talloc(tctx, union samr_AliasInfo);
1338                 switch (r.in.level) {
1339                     case ALIASINFONAME: init_lsa_String(&r.in.info->name,TEST_ALIASNAME); break;
1340                     case ALIASINFODESCRIPTION: init_lsa_String(&r.in.info->description,
1341                                 "Test Description, should test I18N as well"); break;
1342                     case ALIASINFOALL: torture_comment(tctx, "ALIASINFOALL ignored\n"); break;
1343                 }
1344
1345                 status = dcerpc_samr_SetAliasInfo(p, tctx, &r);
1346                 if (!NT_STATUS_IS_OK(status)) {
1347                         torture_warning(tctx, "SetAliasInfo level %u failed - %s\n",
1348                                levels[i], nt_errstr(status));
1349                         ret = false;
1350                 }
1351
1352                 q.in.alias_handle = handle;
1353                 q.in.level = levels[i];
1354                 q.out.info = &info;
1355
1356                 status = dcerpc_samr_QueryAliasInfo(p, tctx, &q);
1357                 if (!NT_STATUS_IS_OK(status)) {
1358                         torture_warning(tctx, "QueryAliasInfo level %u failed - %s\n",
1359                                levels[i], nt_errstr(status));
1360                         ret = false;
1361                 }
1362         }
1363
1364         return ret;
1365 }
1366
1367 static bool test_GetGroupsForUser(struct dcerpc_pipe *p, struct torture_context *tctx,
1368                                   struct policy_handle *user_handle)
1369 {
1370         struct samr_GetGroupsForUser r;
1371         struct samr_RidWithAttributeArray *rids = NULL;
1372         NTSTATUS status;
1373
1374         torture_comment(tctx, "testing GetGroupsForUser\n");
1375
1376         r.in.user_handle = user_handle;
1377         r.out.rids = &rids;
1378
1379         status = dcerpc_samr_GetGroupsForUser(p, tctx, &r);
1380         torture_assert_ntstatus_ok(tctx, status, "GetGroupsForUser");
1381
1382         return true;
1383
1384 }
1385
1386 static bool test_GetDomPwInfo(struct dcerpc_pipe *p, struct torture_context *tctx,
1387                               struct lsa_String *domain_name)
1388 {
1389         NTSTATUS status;
1390         struct samr_GetDomPwInfo r;
1391         struct samr_PwInfo info;
1392
1393         r.in.domain_name = domain_name;
1394         r.out.info = &info;
1395
1396         torture_comment(tctx, "Testing GetDomPwInfo with name %s\n", r.in.domain_name->string);
1397
1398         status = dcerpc_samr_GetDomPwInfo(p, tctx, &r);
1399         torture_assert_ntstatus_ok(tctx, status, "GetDomPwInfo");
1400
1401         r.in.domain_name->string = talloc_asprintf(tctx, "\\\\%s", dcerpc_server_name(p));
1402         torture_comment(tctx, "Testing GetDomPwInfo with name %s\n", r.in.domain_name->string);
1403
1404         status = dcerpc_samr_GetDomPwInfo(p, tctx, &r);
1405         torture_assert_ntstatus_ok(tctx, status, "GetDomPwInfo");
1406
1407         r.in.domain_name->string = "\\\\__NONAME__";
1408         torture_comment(tctx, "Testing GetDomPwInfo with name %s\n", r.in.domain_name->string);
1409
1410         status = dcerpc_samr_GetDomPwInfo(p, tctx, &r);
1411         torture_assert_ntstatus_ok(tctx, status, "GetDomPwInfo");
1412
1413         r.in.domain_name->string = "\\\\Builtin";
1414         torture_comment(tctx, "Testing GetDomPwInfo with name %s\n", r.in.domain_name->string);
1415
1416         status = dcerpc_samr_GetDomPwInfo(p, tctx, &r);
1417         torture_assert_ntstatus_ok(tctx, status, "GetDomPwInfo");
1418
1419         return true;
1420 }
1421
1422 static bool test_GetUserPwInfo(struct dcerpc_pipe *p, struct torture_context *tctx,
1423                                struct policy_handle *handle)
1424 {
1425         NTSTATUS status;
1426         struct samr_GetUserPwInfo r;
1427         struct samr_PwInfo info;
1428
1429         torture_comment(tctx, "Testing GetUserPwInfo\n");
1430
1431         r.in.user_handle = handle;
1432         r.out.info = &info;
1433
1434         status = dcerpc_samr_GetUserPwInfo(p, tctx, &r);
1435         torture_assert_ntstatus_ok(tctx, status, "GetUserPwInfo");
1436
1437         return true;
1438 }
1439
1440 static NTSTATUS test_LookupName(struct dcerpc_pipe *p, struct torture_context *tctx,
1441                                 struct policy_handle *domain_handle, const char *name,
1442                                 uint32_t *rid)
1443 {
1444         NTSTATUS status;
1445         struct samr_LookupNames n;
1446         struct lsa_String sname[2];
1447         struct samr_Ids rids, types;
1448
1449         init_lsa_String(&sname[0], name);
1450
1451         n.in.domain_handle = domain_handle;
1452         n.in.num_names = 1;
1453         n.in.names = sname;
1454         n.out.rids = &rids;
1455         n.out.types = &types;
1456         status = dcerpc_samr_LookupNames(p, tctx, &n);
1457         if (NT_STATUS_IS_OK(status)) {
1458                 *rid = n.out.rids->ids[0];
1459         } else {
1460                 return status;
1461         }
1462
1463         init_lsa_String(&sname[1], "xxNONAMExx");
1464         n.in.num_names = 2;
1465         status = dcerpc_samr_LookupNames(p, tctx, &n);
1466         if (!NT_STATUS_EQUAL(status, STATUS_SOME_UNMAPPED)) {
1467                 torture_warning(tctx, "LookupNames[2] failed - %s\n", nt_errstr(status));
1468                 if (NT_STATUS_IS_OK(status)) {
1469                         return NT_STATUS_UNSUCCESSFUL;
1470                 }
1471                 return status;
1472         }
1473
1474         n.in.num_names = 0;
1475         status = dcerpc_samr_LookupNames(p, tctx, &n);
1476         if (!NT_STATUS_IS_OK(status)) {
1477                 torture_warning(tctx, "LookupNames[0] failed - %s\n", nt_errstr(status));
1478                 return status;
1479         }
1480
1481         init_lsa_String(&sname[0], "xxNONAMExx");
1482         n.in.num_names = 1;
1483         status = dcerpc_samr_LookupNames(p, tctx, &n);
1484         if (!NT_STATUS_EQUAL(status, NT_STATUS_NONE_MAPPED)) {
1485                 torture_warning(tctx, "LookupNames[1 bad name] failed - %s\n", nt_errstr(status));
1486                 if (NT_STATUS_IS_OK(status)) {
1487                         return NT_STATUS_UNSUCCESSFUL;
1488                 }
1489                 return status;
1490         }
1491
1492         init_lsa_String(&sname[0], "xxNONAMExx");
1493         init_lsa_String(&sname[1], "xxNONAME2xx");
1494         n.in.num_names = 2;
1495         status = dcerpc_samr_LookupNames(p, tctx, &n);
1496         if (!NT_STATUS_EQUAL(status, NT_STATUS_NONE_MAPPED)) {
1497                 torture_warning(tctx, "LookupNames[2 bad names] failed - %s\n", nt_errstr(status));
1498                 if (NT_STATUS_IS_OK(status)) {
1499                         return NT_STATUS_UNSUCCESSFUL;
1500                 }
1501                 return status;
1502         }
1503
1504         return NT_STATUS_OK;
1505 }
1506
1507 static NTSTATUS test_OpenUser_byname(struct dcerpc_pipe *p,
1508                                      struct torture_context *tctx,
1509                                      struct policy_handle *domain_handle,
1510                                      const char *name, struct policy_handle *user_handle)
1511 {
1512         NTSTATUS status;
1513         struct samr_OpenUser r;
1514         uint32_t rid;
1515
1516         status = test_LookupName(p, tctx, domain_handle, name, &rid);
1517         if (!NT_STATUS_IS_OK(status)) {
1518                 return status;
1519         }
1520
1521         r.in.domain_handle = domain_handle;
1522         r.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
1523         r.in.rid = rid;
1524         r.out.user_handle = user_handle;
1525         status = dcerpc_samr_OpenUser(p, tctx, &r);
1526         if (!NT_STATUS_IS_OK(status)) {
1527                 torture_warning(tctx, "OpenUser_byname(%s -> %d) failed - %s\n", name, rid, nt_errstr(status));
1528         }
1529
1530         return status;
1531 }
1532
1533 #if 0
1534 static bool test_ChangePasswordNT3(struct dcerpc_pipe *p,
1535                                    struct torture_context *tctx,
1536                                    struct policy_handle *handle)
1537 {
1538         NTSTATUS status;
1539         struct samr_ChangePasswordUser r;
1540         bool ret = true;
1541         struct samr_Password hash1, hash2, hash3, hash4, hash5, hash6;
1542         struct policy_handle user_handle;
1543         char *oldpass = "test";
1544         char *newpass = "test2";
1545         uint8_t old_nt_hash[16], new_nt_hash[16];
1546         uint8_t old_lm_hash[16], new_lm_hash[16];
1547
1548         status = test_OpenUser_byname(p, tctx, handle, "testuser", &user_handle);
1549         if (!NT_STATUS_IS_OK(status)) {
1550                 return false;
1551         }
1552
1553         torture_comment(tctx, "Testing ChangePasswordUser for user 'testuser'\n");
1554
1555         torture_comment(tctx, "old password: %s\n", oldpass);
1556         torture_comment(tctx, "new password: %s\n", newpass);
1557
1558         E_md4hash(oldpass, old_nt_hash);
1559         E_md4hash(newpass, new_nt_hash);
1560         E_deshash(oldpass, old_lm_hash);
1561         E_deshash(newpass, new_lm_hash);
1562
1563         E_old_pw_hash(new_lm_hash, old_lm_hash, hash1.hash);
1564         E_old_pw_hash(old_lm_hash, new_lm_hash, hash2.hash);
1565         E_old_pw_hash(new_nt_hash, old_nt_hash, hash3.hash);
1566         E_old_pw_hash(old_nt_hash, new_nt_hash, hash4.hash);
1567         E_old_pw_hash(old_lm_hash, new_nt_hash, hash5.hash);
1568         E_old_pw_hash(old_nt_hash, new_lm_hash, hash6.hash);
1569
1570         r.in.handle = &user_handle;
1571         r.in.lm_present = 1;
1572         r.in.old_lm_crypted = &hash1;
1573         r.in.new_lm_crypted = &hash2;
1574         r.in.nt_present = 1;
1575         r.in.old_nt_crypted = &hash3;
1576         r.in.new_nt_crypted = &hash4;
1577         r.in.cross1_present = 1;
1578         r.in.nt_cross = &hash5;
1579         r.in.cross2_present = 1;
1580         r.in.lm_cross = &hash6;
1581
1582         status = dcerpc_samr_ChangePasswordUser(p, tctx, &r);
1583         if (!NT_STATUS_IS_OK(status)) {
1584                 torture_warning(tctx, "ChangePasswordUser failed - %s\n", nt_errstr(status));
1585                 ret = false;
1586         }
1587
1588         if (!test_samr_handle_Close(p, tctx, &user_handle)) {
1589                 ret = false;
1590         }
1591
1592         return ret;
1593 }
1594 #endif
1595
1596 static bool test_ChangePasswordUser(struct dcerpc_pipe *p, struct torture_context *tctx,
1597                                     const char *acct_name,
1598                                     struct policy_handle *handle, char **password)
1599 {
1600         NTSTATUS status;
1601         struct samr_ChangePasswordUser r;
1602         bool ret = true;
1603         struct samr_Password hash1, hash2, hash3, hash4, hash5, hash6;
1604         struct policy_handle user_handle;
1605         char *oldpass;
1606         uint8_t old_nt_hash[16], new_nt_hash[16];
1607         uint8_t old_lm_hash[16], new_lm_hash[16];
1608         bool changed = true;
1609
1610         char *newpass;
1611         struct samr_GetUserPwInfo pwp;
1612         struct samr_PwInfo info;
1613         int policy_min_pw_len = 0;
1614
1615         status = test_OpenUser_byname(p, tctx, handle, acct_name, &user_handle);
1616         if (!NT_STATUS_IS_OK(status)) {
1617                 return false;
1618         }
1619         pwp.in.user_handle = &user_handle;
1620         pwp.out.info = &info;
1621
1622         status = dcerpc_samr_GetUserPwInfo(p, tctx, &pwp);
1623         if (NT_STATUS_IS_OK(status)) {
1624                 policy_min_pw_len = pwp.out.info->min_password_length;
1625         }
1626         newpass = samr_rand_pass(tctx, policy_min_pw_len);
1627
1628         torture_comment(tctx, "Testing ChangePasswordUser\n");
1629
1630         torture_assert(tctx, *password != NULL,
1631                                    "Failing ChangePasswordUser as old password was NULL.  Previous test failed?");
1632
1633         oldpass = *password;
1634
1635         E_md4hash(oldpass, old_nt_hash);
1636         E_md4hash(newpass, new_nt_hash);
1637         E_deshash(oldpass, old_lm_hash);
1638         E_deshash(newpass, new_lm_hash);
1639
1640         E_old_pw_hash(new_lm_hash, old_lm_hash, hash1.hash);
1641         E_old_pw_hash(old_lm_hash, new_lm_hash, hash2.hash);
1642         E_old_pw_hash(new_nt_hash, old_nt_hash, hash3.hash);
1643         E_old_pw_hash(old_nt_hash, new_nt_hash, hash4.hash);
1644         E_old_pw_hash(old_lm_hash, new_nt_hash, hash5.hash);
1645         E_old_pw_hash(old_nt_hash, new_lm_hash, hash6.hash);
1646
1647         r.in.user_handle = &user_handle;
1648         r.in.lm_present = 1;
1649         /* Break the LM hash */
1650         hash1.hash[0]++;
1651         r.in.old_lm_crypted = &hash1;
1652         r.in.new_lm_crypted = &hash2;
1653         r.in.nt_present = 1;
1654         r.in.old_nt_crypted = &hash3;
1655         r.in.new_nt_crypted = &hash4;
1656         r.in.cross1_present = 1;
1657         r.in.nt_cross = &hash5;
1658         r.in.cross2_present = 1;
1659         r.in.lm_cross = &hash6;
1660
1661         status = dcerpc_samr_ChangePasswordUser(p, tctx, &r);
1662         torture_assert_ntstatus_equal(tctx, status, NT_STATUS_WRONG_PASSWORD,
1663                 "ChangePasswordUser failed: expected NT_STATUS_WRONG_PASSWORD because we broke the LM hash");
1664
1665         /* Unbreak the LM hash */
1666         hash1.hash[0]--;
1667
1668         r.in.user_handle = &user_handle;
1669         r.in.lm_present = 1;
1670         r.in.old_lm_crypted = &hash1;
1671         r.in.new_lm_crypted = &hash2;
1672         /* Break the NT hash */
1673         hash3.hash[0]--;
1674         r.in.nt_present = 1;
1675         r.in.old_nt_crypted = &hash3;
1676         r.in.new_nt_crypted = &hash4;
1677         r.in.cross1_present = 1;
1678         r.in.nt_cross = &hash5;
1679         r.in.cross2_present = 1;
1680         r.in.lm_cross = &hash6;
1681
1682         status = dcerpc_samr_ChangePasswordUser(p, tctx, &r);
1683         torture_assert_ntstatus_equal(tctx, status, NT_STATUS_WRONG_PASSWORD,
1684                 "expected NT_STATUS_WRONG_PASSWORD because we broke the NT hash");
1685
1686         /* Unbreak the NT hash */
1687         hash3.hash[0]--;
1688
1689         r.in.user_handle = &user_handle;
1690         r.in.lm_present = 1;
1691         r.in.old_lm_crypted = &hash1;
1692         r.in.new_lm_crypted = &hash2;
1693         r.in.nt_present = 1;
1694         r.in.old_nt_crypted = &hash3;
1695         r.in.new_nt_crypted = &hash4;
1696         r.in.cross1_present = 1;
1697         r.in.nt_cross = &hash5;
1698         r.in.cross2_present = 1;
1699         /* Break the LM cross */
1700         hash6.hash[0]++;
1701         r.in.lm_cross = &hash6;
1702
1703         status = dcerpc_samr_ChangePasswordUser(p, tctx, &r);
1704         if (!NT_STATUS_EQUAL(status, NT_STATUS_WRONG_PASSWORD)) {
1705                 torture_warning(tctx, "ChangePasswordUser failed: expected NT_STATUS_WRONG_PASSWORD because we broke the LM cross-hash, got %s\n", nt_errstr(status));
1706                 ret = false;
1707         }
1708
1709         /* Unbreak the LM cross */
1710         hash6.hash[0]--;
1711
1712         r.in.user_handle = &user_handle;
1713         r.in.lm_present = 1;
1714         r.in.old_lm_crypted = &hash1;
1715         r.in.new_lm_crypted = &hash2;
1716         r.in.nt_present = 1;
1717         r.in.old_nt_crypted = &hash3;
1718         r.in.new_nt_crypted = &hash4;
1719         r.in.cross1_present = 1;
1720         /* Break the NT cross */
1721         hash5.hash[0]++;
1722         r.in.nt_cross = &hash5;
1723         r.in.cross2_present = 1;
1724         r.in.lm_cross = &hash6;
1725
1726         status = dcerpc_samr_ChangePasswordUser(p, tctx, &r);
1727         if (!NT_STATUS_EQUAL(status, NT_STATUS_WRONG_PASSWORD)) {
1728                 torture_warning(tctx, "ChangePasswordUser failed: expected NT_STATUS_WRONG_PASSWORD because we broke the NT cross-hash, got %s\n", nt_errstr(status));
1729                 ret = false;
1730         }
1731
1732         /* Unbreak the NT cross */
1733         hash5.hash[0]--;
1734
1735
1736         /* Reset the hashes to not broken values */
1737         E_old_pw_hash(new_lm_hash, old_lm_hash, hash1.hash);
1738         E_old_pw_hash(old_lm_hash, new_lm_hash, hash2.hash);
1739         E_old_pw_hash(new_nt_hash, old_nt_hash, hash3.hash);
1740         E_old_pw_hash(old_nt_hash, new_nt_hash, hash4.hash);
1741         E_old_pw_hash(old_lm_hash, new_nt_hash, hash5.hash);
1742         E_old_pw_hash(old_nt_hash, new_lm_hash, hash6.hash);
1743
1744         r.in.user_handle = &user_handle;
1745         r.in.lm_present = 1;
1746         r.in.old_lm_crypted = &hash1;
1747         r.in.new_lm_crypted = &hash2;
1748         r.in.nt_present = 1;
1749         r.in.old_nt_crypted = &hash3;
1750         r.in.new_nt_crypted = &hash4;
1751         r.in.cross1_present = 1;
1752         r.in.nt_cross = &hash5;
1753         r.in.cross2_present = 0;
1754         r.in.lm_cross = NULL;
1755
1756         status = dcerpc_samr_ChangePasswordUser(p, tctx, &r);
1757         if (NT_STATUS_IS_OK(status)) {
1758                 changed = true;
1759                 *password = newpass;
1760         } else if (!NT_STATUS_EQUAL(NT_STATUS_PASSWORD_RESTRICTION, status)) {
1761                 torture_warning(tctx, "ChangePasswordUser failed: expected NT_STATUS_OK, or at least NT_STATUS_PASSWORD_RESTRICTION, got %s\n", nt_errstr(status));
1762                 ret = false;
1763         }
1764
1765         oldpass = newpass;
1766         newpass = samr_rand_pass(tctx, policy_min_pw_len);
1767
1768         E_md4hash(oldpass, old_nt_hash);
1769         E_md4hash(newpass, new_nt_hash);
1770         E_deshash(oldpass, old_lm_hash);
1771         E_deshash(newpass, new_lm_hash);
1772
1773
1774         /* Reset the hashes to not broken values */
1775         E_old_pw_hash(new_lm_hash, old_lm_hash, hash1.hash);
1776         E_old_pw_hash(old_lm_hash, new_lm_hash, hash2.hash);
1777         E_old_pw_hash(new_nt_hash, old_nt_hash, hash3.hash);
1778         E_old_pw_hash(old_nt_hash, new_nt_hash, hash4.hash);
1779         E_old_pw_hash(old_lm_hash, new_nt_hash, hash5.hash);
1780         E_old_pw_hash(old_nt_hash, new_lm_hash, hash6.hash);
1781
1782         r.in.user_handle = &user_handle;
1783         r.in.lm_present = 1;
1784         r.in.old_lm_crypted = &hash1;
1785         r.in.new_lm_crypted = &hash2;
1786         r.in.nt_present = 1;
1787         r.in.old_nt_crypted = &hash3;
1788         r.in.new_nt_crypted = &hash4;
1789         r.in.cross1_present = 0;
1790         r.in.nt_cross = NULL;
1791         r.in.cross2_present = 1;
1792         r.in.lm_cross = &hash6;
1793
1794         status = dcerpc_samr_ChangePasswordUser(p, tctx, &r);
1795         if (NT_STATUS_IS_OK(status)) {
1796                 changed = true;
1797                 *password = newpass;
1798         } else if (!NT_STATUS_EQUAL(NT_STATUS_PASSWORD_RESTRICTION, status)) {
1799                 torture_warning(tctx, "ChangePasswordUser failed: expected NT_STATUS_NT_CROSS_ENCRYPTION_REQUIRED, got %s\n", nt_errstr(status));
1800                 ret = false;
1801         }
1802
1803         oldpass = newpass;
1804         newpass = samr_rand_pass(tctx, policy_min_pw_len);
1805
1806         E_md4hash(oldpass, old_nt_hash);
1807         E_md4hash(newpass, new_nt_hash);
1808         E_deshash(oldpass, old_lm_hash);
1809         E_deshash(newpass, new_lm_hash);
1810
1811
1812         /* Reset the hashes to not broken values */
1813         E_old_pw_hash(new_lm_hash, old_lm_hash, hash1.hash);
1814         E_old_pw_hash(old_lm_hash, new_lm_hash, hash2.hash);
1815         E_old_pw_hash(new_nt_hash, old_nt_hash, hash3.hash);
1816         E_old_pw_hash(old_nt_hash, new_nt_hash, hash4.hash);
1817         E_old_pw_hash(old_lm_hash, new_nt_hash, hash5.hash);
1818         E_old_pw_hash(old_nt_hash, new_lm_hash, hash6.hash);
1819
1820         r.in.user_handle = &user_handle;
1821         r.in.lm_present = 1;
1822         r.in.old_lm_crypted = &hash1;
1823         r.in.new_lm_crypted = &hash2;
1824         r.in.nt_present = 1;
1825         r.in.old_nt_crypted = &hash3;
1826         r.in.new_nt_crypted = &hash4;
1827         r.in.cross1_present = 1;
1828         r.in.nt_cross = &hash5;
1829         r.in.cross2_present = 1;
1830         r.in.lm_cross = &hash6;
1831
1832         status = dcerpc_samr_ChangePasswordUser(p, tctx, &r);
1833         if (NT_STATUS_EQUAL(status, NT_STATUS_PASSWORD_RESTRICTION)) {
1834                 torture_comment(tctx, "ChangePasswordUser returned: %s perhaps min password age? (not fatal)\n", nt_errstr(status));
1835         } else  if (!NT_STATUS_IS_OK(status)) {
1836                 torture_warning(tctx, "ChangePasswordUser failed - %s\n", nt_errstr(status));
1837                 ret = false;
1838         } else {
1839                 changed = true;
1840                 *password = newpass;
1841         }
1842
1843         r.in.user_handle = &user_handle;
1844         r.in.lm_present = 1;
1845         r.in.old_lm_crypted = &hash1;
1846         r.in.new_lm_crypted = &hash2;
1847         r.in.nt_present = 1;
1848         r.in.old_nt_crypted = &hash3;
1849         r.in.new_nt_crypted = &hash4;
1850         r.in.cross1_present = 1;
1851         r.in.nt_cross = &hash5;
1852         r.in.cross2_present = 1;
1853         r.in.lm_cross = &hash6;
1854
1855         if (changed) {
1856                 status = dcerpc_samr_ChangePasswordUser(p, tctx, &r);
1857                 if (NT_STATUS_EQUAL(status, NT_STATUS_PASSWORD_RESTRICTION)) {
1858                         torture_comment(tctx, "ChangePasswordUser returned: %s perhaps min password age? (not fatal)\n", nt_errstr(status));
1859                 } else if (!NT_STATUS_EQUAL(status, NT_STATUS_WRONG_PASSWORD)) {
1860                         torture_warning(tctx, "ChangePasswordUser failed: expected NT_STATUS_WRONG_PASSWORD because we already changed the password, got %s\n", nt_errstr(status));
1861                         ret = false;
1862                 }
1863         }
1864
1865
1866         if (!test_samr_handle_Close(p, tctx, &user_handle)) {
1867                 ret = false;
1868         }
1869
1870         return ret;
1871 }
1872
1873
1874 static bool test_OemChangePasswordUser2(struct dcerpc_pipe *p, struct torture_context *tctx,
1875                                         const char *acct_name,
1876                                         struct policy_handle *handle, char **password)
1877 {
1878         NTSTATUS status;
1879         struct samr_OemChangePasswordUser2 r;
1880         bool ret = true;
1881         struct samr_Password lm_verifier;
1882         struct samr_CryptPassword lm_pass;
1883         struct lsa_AsciiString server, account, account_bad;
1884         char *oldpass;
1885         char *newpass;
1886         uint8_t old_lm_hash[16], new_lm_hash[16];
1887
1888         struct samr_GetDomPwInfo dom_pw_info;
1889         struct samr_PwInfo info;
1890         int policy_min_pw_len = 0;
1891
1892         struct lsa_String domain_name;
1893
1894         domain_name.string = "";
1895         dom_pw_info.in.domain_name = &domain_name;
1896         dom_pw_info.out.info = &info;
1897
1898         torture_comment(tctx, "Testing OemChangePasswordUser2\n");
1899
1900         torture_assert(tctx, *password != NULL,
1901                                    "Failing OemChangePasswordUser2 as old password was NULL.  Previous test failed?");
1902
1903         oldpass = *password;
1904
1905         status = dcerpc_samr_GetDomPwInfo(p, tctx, &dom_pw_info);
1906         if (NT_STATUS_IS_OK(status)) {
1907                 policy_min_pw_len = dom_pw_info.out.info->min_password_length;
1908         }
1909
1910         newpass = samr_rand_pass(tctx, policy_min_pw_len);
1911
1912         server.string = talloc_asprintf(tctx, "\\\\%s", dcerpc_server_name(p));
1913         account.string = acct_name;
1914
1915         E_deshash(oldpass, old_lm_hash);
1916         E_deshash(newpass, new_lm_hash);
1917
1918         encode_pw_buffer(lm_pass.data, newpass, STR_ASCII);
1919         arcfour_crypt(lm_pass.data, old_lm_hash, 516);
1920         E_old_pw_hash(new_lm_hash, old_lm_hash, lm_verifier.hash);
1921
1922         r.in.server = &server;
1923         r.in.account = &account;
1924         r.in.password = &lm_pass;
1925         r.in.hash = &lm_verifier;
1926
1927         /* Break the verification */
1928         lm_verifier.hash[0]++;
1929
1930         status = dcerpc_samr_OemChangePasswordUser2(p, tctx, &r);
1931
1932         if (!NT_STATUS_EQUAL(status, NT_STATUS_PASSWORD_RESTRICTION)
1933             && !NT_STATUS_EQUAL(status, NT_STATUS_WRONG_PASSWORD)) {
1934                 torture_warning(tctx, "OemChangePasswordUser2 failed, should have returned WRONG_PASSWORD (or at least 'PASSWORD_RESTRICTON') for invalid password verifier - %s\n",
1935                         nt_errstr(status));
1936                 ret = false;
1937         }
1938
1939         encode_pw_buffer(lm_pass.data, newpass, STR_ASCII);
1940         /* Break the old password */
1941         old_lm_hash[0]++;
1942         arcfour_crypt(lm_pass.data, old_lm_hash, 516);
1943         /* unbreak it for the next operation */
1944         old_lm_hash[0]--;
1945         E_old_pw_hash(new_lm_hash, old_lm_hash, lm_verifier.hash);
1946
1947         r.in.server = &server;
1948         r.in.account = &account;
1949         r.in.password = &lm_pass;
1950         r.in.hash = &lm_verifier;
1951
1952         status = dcerpc_samr_OemChangePasswordUser2(p, tctx, &r);
1953
1954         if (!NT_STATUS_EQUAL(status, NT_STATUS_PASSWORD_RESTRICTION)
1955             && !NT_STATUS_EQUAL(status, NT_STATUS_WRONG_PASSWORD)) {
1956                 torture_warning(tctx, "OemChangePasswordUser2 failed, should have returned WRONG_PASSWORD (or at least 'PASSWORD_RESTRICTON') for invalidly encrpted password - %s\n",
1957                         nt_errstr(status));
1958                 ret = false;
1959         }
1960
1961         encode_pw_buffer(lm_pass.data, newpass, STR_ASCII);
1962         arcfour_crypt(lm_pass.data, old_lm_hash, 516);
1963
1964         r.in.server = &server;
1965         r.in.account = &account;
1966         r.in.password = &lm_pass;
1967         r.in.hash = NULL;
1968
1969         status = dcerpc_samr_OemChangePasswordUser2(p, tctx, &r);
1970
1971         if (!NT_STATUS_EQUAL(status, NT_STATUS_PASSWORD_RESTRICTION)
1972             && !NT_STATUS_EQUAL(status, NT_STATUS_INVALID_PARAMETER)) {
1973                 torture_warning(tctx, "OemChangePasswordUser2 failed, should have returned INVALID_PARAMETER (or at least 'PASSWORD_RESTRICTON') for no supplied validation hash - %s\n",
1974                         nt_errstr(status));
1975                 ret = false;
1976         }
1977
1978         /* This shouldn't be a valid name */
1979         account_bad.string = TEST_ACCOUNT_NAME "XX";
1980         r.in.account = &account_bad;
1981
1982         status = dcerpc_samr_OemChangePasswordUser2(p, tctx, &r);
1983
1984         if (!NT_STATUS_EQUAL(status, NT_STATUS_INVALID_PARAMETER)) {
1985                 torture_warning(tctx, "OemChangePasswordUser2 failed, should have returned INVALID_PARAMETER for no supplied validation hash and invalid user - %s\n",
1986                         nt_errstr(status));
1987                 ret = false;
1988         }
1989
1990         /* This shouldn't be a valid name */
1991         account_bad.string = TEST_ACCOUNT_NAME "XX";
1992         r.in.account = &account_bad;
1993         r.in.password = &lm_pass;
1994         r.in.hash = &lm_verifier;
1995
1996         status = dcerpc_samr_OemChangePasswordUser2(p, tctx, &r);
1997
1998         if (!NT_STATUS_EQUAL(status, NT_STATUS_WRONG_PASSWORD)) {
1999                 torture_warning(tctx, "OemChangePasswordUser2 failed, should have returned WRONG_PASSWORD for invalid user - %s\n",
2000                         nt_errstr(status));
2001                 ret = false;
2002         }
2003
2004         /* This shouldn't be a valid name */
2005         account_bad.string = TEST_ACCOUNT_NAME "XX";
2006         r.in.account = &account_bad;
2007         r.in.password = NULL;
2008         r.in.hash = &lm_verifier;
2009
2010         status = dcerpc_samr_OemChangePasswordUser2(p, tctx, &r);
2011
2012         if (!NT_STATUS_EQUAL(status, NT_STATUS_INVALID_PARAMETER)) {
2013                 torture_warning(tctx, "OemChangePasswordUser2 failed, should have returned INVALID_PARAMETER for no supplied password and invalid user - %s\n",
2014                         nt_errstr(status));
2015                 ret = false;
2016         }
2017
2018         E_deshash(oldpass, old_lm_hash);
2019         E_deshash(newpass, new_lm_hash);
2020
2021         encode_pw_buffer(lm_pass.data, newpass, STR_ASCII);
2022         arcfour_crypt(lm_pass.data, old_lm_hash, 516);
2023         E_old_pw_hash(new_lm_hash, old_lm_hash, lm_verifier.hash);
2024
2025         r.in.server = &server;
2026         r.in.account = &account;
2027         r.in.password = &lm_pass;
2028         r.in.hash = &lm_verifier;
2029
2030         status = dcerpc_samr_OemChangePasswordUser2(p, tctx, &r);
2031         if (NT_STATUS_EQUAL(status, NT_STATUS_PASSWORD_RESTRICTION)) {
2032                 torture_comment(tctx, "OemChangePasswordUser2 returned: %s perhaps min password age? (not fatal)\n", nt_errstr(status));
2033         } else if (!NT_STATUS_IS_OK(status)) {
2034                 torture_warning(tctx, "OemChangePasswordUser2 failed - %s\n", nt_errstr(status));
2035                 ret = false;
2036         } else {
2037                 *password = newpass;
2038         }
2039
2040         return ret;
2041 }
2042
2043
2044 static bool test_ChangePasswordUser2(struct dcerpc_pipe *p, struct torture_context *tctx,
2045                                      const char *acct_name,
2046                                      char **password,
2047                                      char *newpass, bool allow_password_restriction)
2048 {
2049         NTSTATUS status;
2050         struct samr_ChangePasswordUser2 r;
2051         bool ret = true;
2052         struct lsa_String server, account;
2053         struct samr_CryptPassword nt_pass, lm_pass;
2054         struct samr_Password nt_verifier, lm_verifier;
2055         char *oldpass;
2056         uint8_t old_nt_hash[16], new_nt_hash[16];
2057         uint8_t old_lm_hash[16], new_lm_hash[16];
2058
2059         struct samr_GetDomPwInfo dom_pw_info;
2060         struct samr_PwInfo info;
2061
2062         struct lsa_String domain_name;
2063
2064         domain_name.string = "";
2065         dom_pw_info.in.domain_name = &domain_name;
2066         dom_pw_info.out.info = &info;
2067
2068         torture_comment(tctx, "Testing ChangePasswordUser2 on %s\n", acct_name);
2069
2070         torture_assert(tctx, *password != NULL,
2071                                    "Failing ChangePasswordUser2 as old password was NULL.  Previous test failed?");
2072         oldpass = *password;
2073
2074         if (!newpass) {
2075                 int policy_min_pw_len = 0;
2076                 status = dcerpc_samr_GetDomPwInfo(p, tctx, &dom_pw_info);
2077                 if (NT_STATUS_IS_OK(status)) {
2078                         policy_min_pw_len = dom_pw_info.out.info->min_password_length;
2079                 }
2080
2081                 newpass = samr_rand_pass(tctx, policy_min_pw_len);
2082         }
2083
2084         server.string = talloc_asprintf(tctx, "\\\\%s", dcerpc_server_name(p));
2085         init_lsa_String(&account, acct_name);
2086
2087         E_md4hash(oldpass, old_nt_hash);
2088         E_md4hash(newpass, new_nt_hash);
2089
2090         E_deshash(oldpass, old_lm_hash);
2091         E_deshash(newpass, new_lm_hash);
2092
2093         encode_pw_buffer(lm_pass.data, newpass, STR_ASCII|STR_TERMINATE);
2094         arcfour_crypt(lm_pass.data, old_lm_hash, 516);
2095         E_old_pw_hash(new_nt_hash, old_lm_hash, lm_verifier.hash);
2096
2097         encode_pw_buffer(nt_pass.data, newpass, STR_UNICODE);
2098         arcfour_crypt(nt_pass.data, old_nt_hash, 516);
2099         E_old_pw_hash(new_nt_hash, old_nt_hash, nt_verifier.hash);
2100
2101         r.in.server = &server;
2102         r.in.account = &account;
2103         r.in.nt_password = &nt_pass;
2104         r.in.nt_verifier = &nt_verifier;
2105         r.in.lm_change = 1;
2106         r.in.lm_password = &lm_pass;
2107         r.in.lm_verifier = &lm_verifier;
2108
2109         status = dcerpc_samr_ChangePasswordUser2(p, tctx, &r);
2110         if (allow_password_restriction && NT_STATUS_EQUAL(status, NT_STATUS_PASSWORD_RESTRICTION)) {
2111                 torture_comment(tctx, "ChangePasswordUser2 returned: %s perhaps min password age? (not fatal)\n", nt_errstr(status));
2112         } else if (!NT_STATUS_IS_OK(status)) {
2113                 torture_warning(tctx, "ChangePasswordUser2 failed - %s\n", nt_errstr(status));
2114                 ret = false;
2115         } else {
2116                 *password = newpass;
2117         }
2118
2119         return ret;
2120 }
2121
2122
2123 bool test_ChangePasswordUser3(struct dcerpc_pipe *p, struct torture_context *tctx,
2124                               const char *account_string,
2125                               int policy_min_pw_len,
2126                               char **password,
2127                               const char *newpass,
2128                               NTTIME last_password_change,
2129                               bool handle_reject_reason)
2130 {
2131         NTSTATUS status;
2132         struct samr_ChangePasswordUser3 r;
2133         bool ret = true;
2134         struct lsa_String server, account, account_bad;
2135         struct samr_CryptPassword nt_pass, lm_pass;
2136         struct samr_Password nt_verifier, lm_verifier;
2137         char *oldpass;
2138         uint8_t old_nt_hash[16], new_nt_hash[16];
2139         uint8_t old_lm_hash[16], new_lm_hash[16];
2140         NTTIME t;
2141         struct samr_DomInfo1 *dominfo = NULL;
2142         struct userPwdChangeFailureInformation *reject = NULL;
2143
2144         torture_comment(tctx, "Testing ChangePasswordUser3\n");
2145
2146         if (newpass == NULL) {
2147                 do {
2148                         if (policy_min_pw_len == 0) {
2149                                 newpass = samr_rand_pass(tctx, policy_min_pw_len);
2150                         } else {
2151                                 newpass = samr_rand_pass_fixed_len(tctx, policy_min_pw_len);
2152                         }
2153                 } while (check_password_quality(newpass) == false);
2154         } else {
2155                 torture_comment(tctx, "Using password '%s'\n", newpass);
2156         }
2157
2158         torture_assert(tctx, *password != NULL,
2159                                    "Failing ChangePasswordUser3 as old password was NULL.  Previous test failed?");
2160
2161         oldpass = *password;
2162         server.string = talloc_asprintf(tctx, "\\\\%s", dcerpc_server_name(p));
2163         init_lsa_String(&account, account_string);
2164
2165         E_md4hash(oldpass, old_nt_hash);
2166         E_md4hash(newpass, new_nt_hash);
2167
2168         E_deshash(oldpass, old_lm_hash);
2169         E_deshash(newpass, new_lm_hash);
2170
2171         encode_pw_buffer(lm_pass.data, newpass, STR_UNICODE);
2172         arcfour_crypt(lm_pass.data, old_nt_hash, 516);
2173         E_old_pw_hash(new_nt_hash, old_lm_hash, lm_verifier.hash);
2174
2175         encode_pw_buffer(nt_pass.data, newpass, STR_UNICODE);
2176         arcfour_crypt(nt_pass.data, old_nt_hash, 516);
2177         E_old_pw_hash(new_nt_hash, old_nt_hash, nt_verifier.hash);
2178
2179         /* Break the verification */
2180         nt_verifier.hash[0]++;
2181
2182         r.in.server = &server;
2183         r.in.account = &account;
2184         r.in.nt_password = &nt_pass;
2185         r.in.nt_verifier = &nt_verifier;
2186         r.in.lm_change = 1;
2187         r.in.lm_password = &lm_pass;
2188         r.in.lm_verifier = &lm_verifier;
2189         r.in.password3 = NULL;
2190         r.out.dominfo = &dominfo;
2191         r.out.reject = &reject;
2192
2193         status = dcerpc_samr_ChangePasswordUser3(p, tctx, &r);
2194         if (!NT_STATUS_EQUAL(status, NT_STATUS_PASSWORD_RESTRICTION) &&
2195             (!NT_STATUS_EQUAL(status, NT_STATUS_WRONG_PASSWORD))) {
2196                 torture_warning(tctx, "ChangePasswordUser3 failed, should have returned WRONG_PASSWORD (or at least 'PASSWORD_RESTRICTON') for invalid password verifier - %s\n",
2197                         nt_errstr(status));
2198                 ret = false;
2199         }
2200
2201         encode_pw_buffer(lm_pass.data, newpass, STR_UNICODE);
2202         arcfour_crypt(lm_pass.data, old_nt_hash, 516);
2203         E_old_pw_hash(new_nt_hash, old_lm_hash, lm_verifier.hash);
2204
2205         encode_pw_buffer(nt_pass.data, newpass, STR_UNICODE);
2206         /* Break the NT hash */
2207         old_nt_hash[0]++;
2208         arcfour_crypt(nt_pass.data, old_nt_hash, 516);
2209         /* Unbreak it again */
2210         old_nt_hash[0]--;
2211         E_old_pw_hash(new_nt_hash, old_nt_hash, nt_verifier.hash);
2212
2213         r.in.server = &server;
2214         r.in.account = &account;
2215         r.in.nt_password = &nt_pass;
2216         r.in.nt_verifier = &nt_verifier;
2217         r.in.lm_change = 1;
2218         r.in.lm_password = &lm_pass;
2219         r.in.lm_verifier = &lm_verifier;
2220         r.in.password3 = NULL;
2221         r.out.dominfo = &dominfo;
2222         r.out.reject = &reject;
2223
2224         status = dcerpc_samr_ChangePasswordUser3(p, tctx, &r);
2225         if (!NT_STATUS_EQUAL(status, NT_STATUS_PASSWORD_RESTRICTION) &&
2226             (!NT_STATUS_EQUAL(status, NT_STATUS_WRONG_PASSWORD))) {
2227                 torture_warning(tctx, "ChangePasswordUser3 failed, should have returned WRONG_PASSWORD (or at least 'PASSWORD_RESTRICTON') for invalidly encrpted password - %s\n",
2228                         nt_errstr(status));
2229                 ret = false;
2230         }
2231
2232         /* This shouldn't be a valid name */
2233         init_lsa_String(&account_bad, talloc_asprintf(tctx, "%sXX", account_string));
2234
2235         r.in.account = &account_bad;
2236         status = dcerpc_samr_ChangePasswordUser3(p, tctx, &r);
2237         if (!NT_STATUS_EQUAL(status, NT_STATUS_WRONG_PASSWORD)) {
2238                 torture_warning(tctx, "ChangePasswordUser3 failed, should have returned WRONG_PASSWORD for invalid username - %s\n",
2239                         nt_errstr(status));
2240                 ret = false;
2241         }
2242
2243         E_md4hash(oldpass, old_nt_hash);
2244         E_md4hash(newpass, new_nt_hash);
2245
2246         E_deshash(oldpass, old_lm_hash);
2247         E_deshash(newpass, new_lm_hash);
2248
2249         encode_pw_buffer(lm_pass.data, newpass, STR_UNICODE);
2250         arcfour_crypt(lm_pass.data, old_nt_hash, 516);
2251         E_old_pw_hash(new_nt_hash, old_lm_hash, lm_verifier.hash);
2252
2253         encode_pw_buffer(nt_pass.data, newpass, STR_UNICODE);
2254         arcfour_crypt(nt_pass.data, old_nt_hash, 516);
2255         E_old_pw_hash(new_nt_hash, old_nt_hash, nt_verifier.hash);
2256
2257         r.in.server = &server;
2258         r.in.account = &account;
2259         r.in.nt_password = &nt_pass;
2260         r.in.nt_verifier = &nt_verifier;
2261         r.in.lm_change = 1;
2262         r.in.lm_password = &lm_pass;
2263         r.in.lm_verifier = &lm_verifier;
2264         r.in.password3 = NULL;
2265         r.out.dominfo = &dominfo;
2266         r.out.reject = &reject;
2267
2268         unix_to_nt_time(&t, time(NULL));
2269
2270         status = dcerpc_samr_ChangePasswordUser3(p, tctx, &r);
2271
2272         if (NT_STATUS_EQUAL(status, NT_STATUS_PASSWORD_RESTRICTION)
2273             && dominfo
2274             && reject
2275             && handle_reject_reason
2276             && (!null_nttime(last_password_change) || !dominfo->min_password_age)) {
2277                 if (dominfo->password_properties & DOMAIN_REFUSE_PASSWORD_CHANGE ) {
2278
2279                         if (reject && (reject->extendedFailureReason != SAM_PWD_CHANGE_NO_ERROR)) {
2280                                 torture_warning(tctx, "expected SAM_PWD_CHANGE_NO_ERROR (%d), got %d\n",
2281                                         SAM_PWD_CHANGE_NO_ERROR, reject->extendedFailureReason);
2282                                 return false;
2283                         }
2284                 }
2285
2286                 /* We tested the order of precendence which is as follows:
2287
2288                 * pwd min_age
2289                 * pwd length
2290                 * pwd complexity
2291                 * pwd history
2292
2293                 Guenther */
2294
2295                 if ((dominfo->min_password_age > 0) && !null_nttime(last_password_change) &&
2296                            (last_password_change + dominfo->min_password_age > t)) {
2297
2298                         if (reject->extendedFailureReason != SAM_PWD_CHANGE_NO_ERROR) {
2299                                 torture_warning(tctx, "expected SAM_PWD_CHANGE_NO_ERROR (%d), got %d\n",
2300                                         SAM_PWD_CHANGE_NO_ERROR, reject->extendedFailureReason);
2301                                 return false;
2302                         }
2303
2304                 } else if ((dominfo->min_password_length > 0) &&
2305                            (strlen(newpass) < dominfo->min_password_length)) {
2306
2307                         if (reject->extendedFailureReason != SAM_PWD_CHANGE_PASSWORD_TOO_SHORT) {
2308                                 torture_warning(tctx, "expected SAM_PWD_CHANGE_PASSWORD_TOO_SHORT (%d), got %d\n",
2309                                         SAM_PWD_CHANGE_PASSWORD_TOO_SHORT, reject->extendedFailureReason);
2310                                 return false;
2311                         }
2312
2313                 } else if ((dominfo->password_history_length > 0) &&
2314                             strequal(oldpass, newpass)) {
2315
2316                         if (reject->extendedFailureReason != SAM_PWD_CHANGE_PWD_IN_HISTORY) {
2317                                 torture_warning(tctx, "expected SAM_PWD_CHANGE_PWD_IN_HISTORY (%d), got %d\n",
2318                                         SAM_PWD_CHANGE_PWD_IN_HISTORY, reject->extendedFailureReason);
2319                                 return false;
2320                         }
2321                 } else if (dominfo->password_properties & DOMAIN_PASSWORD_COMPLEX) {
2322
2323                         if (reject->extendedFailureReason != SAM_PWD_CHANGE_NOT_COMPLEX) {
2324                                 torture_warning(tctx, "expected SAM_PWD_CHANGE_NOT_COMPLEX (%d), got %d\n",
2325                                         SAM_PWD_CHANGE_NOT_COMPLEX, reject->extendedFailureReason);
2326                                 return false;
2327                         }
2328
2329                 }
2330
2331                 if (reject->extendedFailureReason == SAM_PWD_CHANGE_PASSWORD_TOO_SHORT) {
2332                         /* retry with adjusted size */
2333                         return test_ChangePasswordUser3(p, tctx, account_string,
2334                                                         dominfo->min_password_length,
2335                                                         password, NULL, 0, false);
2336
2337                 }
2338
2339         } else if (NT_STATUS_EQUAL(status, NT_STATUS_PASSWORD_RESTRICTION)) {
2340                 if (reject && reject->extendedFailureReason != SAM_PWD_CHANGE_NO_ERROR) {
2341                         torture_warning(tctx, "expected SAM_PWD_CHANGE_NO_ERROR (%d), got %d\n",
2342                                SAM_PWD_CHANGE_NO_ERROR, reject->extendedFailureReason);
2343                         return false;
2344                 }
2345                 /* Perhaps the server has a 'min password age' set? */
2346
2347         } else {
2348                 torture_assert_ntstatus_ok(tctx, status, "ChangePasswordUser3");
2349                 *password = talloc_strdup(tctx, newpass);
2350         }
2351
2352         return ret;
2353 }
2354
2355 bool test_ChangePasswordRandomBytes(struct dcerpc_pipe *p, struct torture_context *tctx,
2356                                     const char *account_string,
2357                                     struct policy_handle *handle,
2358                                     char **password)
2359 {
2360         NTSTATUS status;
2361         struct samr_ChangePasswordUser3 r;
2362         struct samr_SetUserInfo s;
2363         union samr_UserInfo u;
2364         DATA_BLOB session_key;
2365         DATA_BLOB confounded_session_key = data_blob_talloc(tctx, NULL, 16);
2366         uint8_t confounder[16];
2367         struct MD5Context ctx;
2368
2369         bool ret = true;
2370         struct lsa_String server, account;
2371         struct samr_CryptPassword nt_pass;
2372         struct samr_Password nt_verifier;
2373         DATA_BLOB new_random_pass;
2374         char *newpass;
2375         char *oldpass;
2376         uint8_t old_nt_hash[16], new_nt_hash[16];
2377         NTTIME t;
2378         struct samr_DomInfo1 *dominfo = NULL;
2379         struct userPwdChangeFailureInformation *reject = NULL;
2380
2381         new_random_pass = samr_very_rand_pass(tctx, 128);
2382
2383         torture_assert(tctx, *password != NULL,
2384                                    "Failing ChangePasswordUser3 as old password was NULL.  Previous test failed?");
2385
2386         oldpass = *password;
2387         server.string = talloc_asprintf(tctx, "\\\\%s", dcerpc_server_name(p));
2388         init_lsa_String(&account, account_string);
2389
2390         s.in.user_handle = handle;
2391         s.in.info = &u;
2392         s.in.level = 25;
2393
2394         ZERO_STRUCT(u);
2395
2396         u.info25.info.fields_present = SAMR_FIELD_NT_PASSWORD_PRESENT;
2397
2398         set_pw_in_buffer(u.info25.password.data, &new_random_pass);
2399
2400         status = dcerpc_fetch_session_key(p, &session_key);
2401         if (!NT_STATUS_IS_OK(status)) {
2402                 torture_warning(tctx, "SetUserInfo level %u - no session key - %s\n",
2403                        s.in.level, nt_errstr(status));
2404                 return false;
2405         }
2406
2407         generate_random_buffer((uint8_t *)confounder, 16);
2408
2409         MD5Init(&ctx);
2410         MD5Update(&ctx, confounder, 16);
2411         MD5Update(&ctx, session_key.data, session_key.length);
2412         MD5Final(confounded_session_key.data, &ctx);
2413
2414         arcfour_crypt_blob(u.info25.password.data, 516, &confounded_session_key);
2415         memcpy(&u.info25.password.data[516], confounder, 16);
2416
2417         torture_comment(tctx, "Testing SetUserInfo level 25 (set password ex) with a password made up of only random bytes\n");
2418
2419         status = dcerpc_samr_SetUserInfo(p, tctx, &s);
2420         if (!NT_STATUS_IS_OK(status)) {
2421                 torture_warning(tctx, "SetUserInfo level %u failed - %s\n",
2422                        s.in.level, nt_errstr(status));
2423                 ret = false;
2424         }
2425
2426         torture_comment(tctx, "Testing ChangePasswordUser3 with a password made up of only random bytes\n");
2427
2428         mdfour(old_nt_hash, new_random_pass.data, new_random_pass.length);
2429
2430         new_random_pass = samr_very_rand_pass(tctx, 128);
2431
2432         mdfour(new_nt_hash, new_random_pass.data, new_random_pass.length);
2433
2434         set_pw_in_buffer(nt_pass.data, &new_random_pass);
2435         arcfour_crypt(nt_pass.data, old_nt_hash, 516);
2436         E_old_pw_hash(new_nt_hash, old_nt_hash, nt_verifier.hash);
2437
2438         r.in.server = &server;
2439         r.in.account = &account;
2440         r.in.nt_password = &nt_pass;
2441         r.in.nt_verifier = &nt_verifier;
2442         r.in.lm_change = 0;
2443         r.in.lm_password = NULL;
2444         r.in.lm_verifier = NULL;
2445         r.in.password3 = NULL;
2446         r.out.dominfo = &dominfo;
2447         r.out.reject = &reject;
2448
2449         unix_to_nt_time(&t, time(NULL));
2450
2451         status = dcerpc_samr_ChangePasswordUser3(p, tctx, &r);
2452
2453         if (NT_STATUS_EQUAL(status, NT_STATUS_PASSWORD_RESTRICTION)) {
2454                 if (reject && reject->extendedFailureReason != SAM_PWD_CHANGE_NO_ERROR) {
2455                         torture_warning(tctx, "expected SAM_PWD_CHANGE_NO_ERROR (%d), got %d\n",
2456                                SAM_PWD_CHANGE_NO_ERROR, reject->extendedFailureReason);
2457                         return false;
2458                 }
2459                 /* Perhaps the server has a 'min password age' set? */
2460
2461         } else if (!NT_STATUS_IS_OK(status)) {
2462                 torture_warning(tctx, "ChangePasswordUser3 failed - %s\n", nt_errstr(status));
2463                 ret = false;
2464         }
2465
2466         newpass = samr_rand_pass(tctx, 128);
2467
2468         mdfour(old_nt_hash, new_random_pass.data, new_random_pass.length);
2469
2470         E_md4hash(newpass, new_nt_hash);
2471
2472         encode_pw_buffer(nt_pass.data, newpass, STR_UNICODE);
2473         arcfour_crypt(nt_pass.data, old_nt_hash, 516);
2474         E_old_pw_hash(new_nt_hash, old_nt_hash, nt_verifier.hash);
2475
2476         r.in.server = &server;
2477         r.in.account = &account;
2478         r.in.nt_password = &nt_pass;
2479         r.in.nt_verifier = &nt_verifier;
2480         r.in.lm_change = 0;
2481         r.in.lm_password = NULL;
2482         r.in.lm_verifier = NULL;
2483         r.in.password3 = NULL;
2484         r.out.dominfo = &dominfo;
2485         r.out.reject = &reject;
2486
2487         unix_to_nt_time(&t, time(NULL));
2488
2489         status = dcerpc_samr_ChangePasswordUser3(p, tctx, &r);
2490
2491         if (NT_STATUS_EQUAL(status, NT_STATUS_PASSWORD_RESTRICTION)) {
2492                 if (reject && reject->extendedFailureReason != SAM_PWD_CHANGE_NO_ERROR) {
2493                         torture_warning(tctx, "expected SAM_PWD_CHANGE_NO_ERROR (%d), got %d\n",
2494                                SAM_PWD_CHANGE_NO_ERROR, reject->extendedFailureReason);
2495                         return false;
2496                 }
2497                 /* Perhaps the server has a 'min password age' set? */
2498
2499         } else {
2500                 torture_assert_ntstatus_ok(tctx, status, "ChangePasswordUser3 (on second random password)");
2501                 *password = talloc_strdup(tctx, newpass);
2502         }
2503
2504         return ret;
2505 }
2506
2507
2508 static bool test_GetMembersInAlias(struct dcerpc_pipe *p, struct torture_context *tctx,
2509                                   struct policy_handle *alias_handle)
2510 {
2511         struct samr_GetMembersInAlias r;
2512         struct lsa_SidArray sids;
2513         NTSTATUS status;
2514
2515         torture_comment(tctx, "Testing GetMembersInAlias\n");
2516
2517         r.in.alias_handle = alias_handle;
2518         r.out.sids = &sids;
2519
2520         status = dcerpc_samr_GetMembersInAlias(p, tctx, &r);
2521         torture_assert_ntstatus_ok(tctx, status, "GetMembersInAlias");
2522
2523         return true;
2524 }
2525
2526 static bool test_AddMemberToAlias(struct dcerpc_pipe *p, struct torture_context *tctx,
2527                                   struct policy_handle *alias_handle,
2528                                   const struct dom_sid *domain_sid)
2529 {
2530         struct samr_AddAliasMember r;
2531         struct samr_DeleteAliasMember d;
2532         NTSTATUS status;
2533         struct dom_sid *sid;
2534
2535         sid = dom_sid_add_rid(tctx, domain_sid, 512);
2536
2537         torture_comment(tctx, "testing AddAliasMember\n");
2538         r.in.alias_handle = alias_handle;
2539         r.in.sid = sid;
2540
2541         status = dcerpc_samr_AddAliasMember(p, tctx, &r);
2542         torture_assert_ntstatus_ok(tctx, status, "AddAliasMember");
2543
2544         d.in.alias_handle = alias_handle;
2545         d.in.sid = sid;
2546
2547         status = dcerpc_samr_DeleteAliasMember(p, tctx, &d);
2548         torture_assert_ntstatus_ok(tctx, status, "DelAliasMember");
2549
2550         return true;
2551 }
2552
2553 static bool test_AddMultipleMembersToAlias(struct dcerpc_pipe *p, struct torture_context *tctx,
2554                                            struct policy_handle *alias_handle)
2555 {
2556         struct samr_AddMultipleMembersToAlias a;
2557         struct samr_RemoveMultipleMembersFromAlias r;
2558         NTSTATUS status;
2559         struct lsa_SidArray sids;
2560
2561         torture_comment(tctx, "testing AddMultipleMembersToAlias\n");
2562         a.in.alias_handle = alias_handle;
2563         a.in.sids = &sids;
2564
2565         sids.num_sids = 3;
2566         sids.sids = talloc_array(tctx, struct lsa_SidPtr, 3);
2567
2568         sids.sids[0].sid = dom_sid_parse_talloc(tctx, "S-1-5-32-1-2-3-1");
2569         sids.sids[1].sid = dom_sid_parse_talloc(tctx, "S-1-5-32-1-2-3-2");
2570         sids.sids[2].sid = dom_sid_parse_talloc(tctx, "S-1-5-32-1-2-3-3");
2571
2572         status = dcerpc_samr_AddMultipleMembersToAlias(p, tctx, &a);
2573         torture_assert_ntstatus_ok(tctx, status, "AddMultipleMembersToAlias");
2574
2575
2576         torture_comment(tctx, "testing RemoveMultipleMembersFromAlias\n");
2577         r.in.alias_handle = alias_handle;
2578         r.in.sids = &sids;
2579
2580         status = dcerpc_samr_RemoveMultipleMembersFromAlias(p, tctx, &r);
2581         torture_assert_ntstatus_ok(tctx, status, "RemoveMultipleMembersFromAlias");
2582
2583         /* strange! removing twice doesn't give any error */
2584         status = dcerpc_samr_RemoveMultipleMembersFromAlias(p, tctx, &r);
2585         torture_assert_ntstatus_ok(tctx, status, "RemoveMultipleMembersFromAlias");
2586
2587         /* but removing an alias that isn't there does */
2588         sids.sids[2].sid = dom_sid_parse_talloc(tctx, "S-1-5-32-1-2-3-4");
2589
2590         status = dcerpc_samr_RemoveMultipleMembersFromAlias(p, tctx, &r);
2591         torture_assert_ntstatus_equal(tctx, status, NT_STATUS_OBJECT_NAME_NOT_FOUND, "RemoveMultipleMembersFromAlias");
2592
2593         return true;
2594 }
2595
2596 static bool test_TestPrivateFunctionsUser(struct dcerpc_pipe *p, struct torture_context *tctx,
2597                                             struct policy_handle *user_handle)
2598 {
2599         struct samr_TestPrivateFunctionsUser r;
2600         NTSTATUS status;
2601
2602         torture_comment(tctx, "Testing TestPrivateFunctionsUser\n");
2603
2604         r.in.user_handle = user_handle;
2605
2606         status = dcerpc_samr_TestPrivateFunctionsUser(p, tctx, &r);
2607         torture_assert_ntstatus_equal(tctx, status, NT_STATUS_NOT_IMPLEMENTED, "TestPrivateFunctionsUser");
2608
2609         return true;
2610 }
2611
2612 static bool test_QueryUserInfo_pwdlastset(struct dcerpc_pipe *p,
2613                                           struct torture_context *tctx,
2614                                           struct policy_handle *handle,
2615                                           bool use_info2,
2616                                           NTTIME *pwdlastset)
2617 {
2618         NTSTATUS status;
2619         uint16_t levels[] = { /* 3, */ 5, 21 };
2620         int i;
2621         NTTIME pwdlastset3 = 0;
2622         NTTIME pwdlastset5 = 0;
2623         NTTIME pwdlastset21 = 0;
2624
2625         torture_comment(tctx, "Testing QueryUserInfo%s level 5 and 21 call ",
2626                         use_info2 ? "2":"");
2627
2628         for (i=0; i<ARRAY_SIZE(levels); i++) {
2629
2630                 struct samr_QueryUserInfo r;
2631                 struct samr_QueryUserInfo2 r2;
2632                 union samr_UserInfo *info;
2633
2634                 if (use_info2) {
2635                         r2.in.user_handle = handle;
2636                         r2.in.level = levels[i];
2637                         r2.out.info = &info;
2638                         status = dcerpc_samr_QueryUserInfo2(p, tctx, &r2);
2639
2640                 } else {
2641                         r.in.user_handle = handle;
2642                         r.in.level = levels[i];
2643                         r.out.info = &info;
2644                         status = dcerpc_samr_QueryUserInfo(p, tctx, &r);
2645                 }
2646
2647                 if (!NT_STATUS_IS_OK(status) &&
2648                     !NT_STATUS_EQUAL(status, NT_STATUS_INVALID_INFO_CLASS)) {
2649                         torture_warning(tctx, "QueryUserInfo%s level %u failed - %s\n",
2650                                use_info2 ? "2":"", levels[i], nt_errstr(status));
2651                         return false;
2652                 }
2653
2654                 switch (levels[i]) {
2655                 case 3:
2656                         pwdlastset3 = info->info3.last_password_change;
2657                         break;
2658                 case 5:
2659                         pwdlastset5 = info->info5.last_password_change;
2660                         break;
2661                 case 21:
2662                         pwdlastset21 = info->info21.last_password_change;
2663                         break;
2664                 default:
2665                         return false;
2666                 }
2667         }
2668         /* torture_assert_int_equal(tctx, pwdlastset3, pwdlastset5,
2669                                     "pwdlastset mixup"); */
2670         torture_assert_int_equal(tctx, pwdlastset5, pwdlastset21,
2671                                  "pwdlastset mixup");
2672
2673         *pwdlastset = pwdlastset21;
2674
2675         torture_comment(tctx, "(pwdlastset: %lld)\n", *pwdlastset);
2676
2677         return true;
2678 }
2679
2680 static bool test_SamLogon(struct torture_context *tctx,
2681                           struct dcerpc_pipe *p,
2682                           struct cli_credentials *test_credentials,
2683                           NTSTATUS expected_result)
2684 {
2685         NTSTATUS status;
2686         struct netr_LogonSamLogonEx r;
2687         union netr_LogonLevel logon;
2688         union netr_Validation validation;
2689         uint8_t authoritative;
2690         struct netr_NetworkInfo ninfo;
2691         DATA_BLOB names_blob, chal, lm_resp, nt_resp;
2692         int flags = CLI_CRED_NTLM_AUTH;
2693         uint32_t samlogon_flags = 0;
2694
2695         if (lp_client_lanman_auth(tctx->lp_ctx)) {
2696                 flags |= CLI_CRED_LANMAN_AUTH;
2697         }
2698
2699         if (lp_client_ntlmv2_auth(tctx->lp_ctx)) {
2700                 flags |= CLI_CRED_NTLMv2_AUTH;
2701         }
2702
2703         cli_credentials_get_ntlm_username_domain(test_credentials, tctx,
2704                                                  &ninfo.identity_info.account_name.string,
2705                                                  &ninfo.identity_info.domain_name.string);
2706
2707         generate_random_buffer(ninfo.challenge,
2708                                sizeof(ninfo.challenge));
2709         chal = data_blob_const(ninfo.challenge,
2710                                sizeof(ninfo.challenge));
2711
2712         names_blob = NTLMv2_generate_names_blob(tctx, cli_credentials_get_workstation(test_credentials),
2713                                                 cli_credentials_get_domain(test_credentials));
2714
2715         status = cli_credentials_get_ntlm_response(test_credentials, tctx,
2716                                                    &flags,
2717                                                    chal,
2718                                                    names_blob,
2719                                                    &lm_resp, &nt_resp,
2720                                                    NULL, NULL);
2721         torture_assert_ntstatus_ok(tctx, status, "cli_credentials_get_ntlm_response failed");
2722
2723         ninfo.lm.data = lm_resp.data;
2724         ninfo.lm.length = lm_resp.length;
2725
2726         ninfo.nt.data = nt_resp.data;
2727         ninfo.nt.length = nt_resp.length;
2728
2729         ninfo.identity_info.parameter_control =
2730                 MSV1_0_ALLOW_SERVER_TRUST_ACCOUNT |
2731                 MSV1_0_ALLOW_WORKSTATION_TRUST_ACCOUNT;
2732         ninfo.identity_info.logon_id_low = 0;
2733         ninfo.identity_info.logon_id_high = 0;
2734         ninfo.identity_info.workstation.string = cli_credentials_get_workstation(test_credentials);
2735
2736         logon.network = &ninfo;
2737
2738         r.in.server_name = talloc_asprintf(tctx, "\\\\%s", dcerpc_server_name(p));
2739         r.in.computer_name = cli_credentials_get_workstation(test_credentials);
2740         r.in.logon_level = NetlogonNetworkInformation;
2741         r.in.logon = &logon;
2742         r.in.flags = &samlogon_flags;
2743         r.out.flags = &samlogon_flags;
2744         r.out.validation = &validation;
2745         r.out.authoritative = &authoritative;
2746
2747         torture_comment(tctx, "Testing LogonSamLogon with name %s\n", ninfo.identity_info.account_name.string);
2748
2749         r.in.validation_level = 6;
2750
2751         status = dcerpc_netr_LogonSamLogonEx(p, tctx, &r);
2752         if (NT_STATUS_EQUAL(status, NT_STATUS_INVALID_INFO_CLASS)) {
2753                 r.in.validation_level = 3;
2754                 status = dcerpc_netr_LogonSamLogonEx(p, tctx, &r);
2755         }
2756         if (!NT_STATUS_IS_OK(status)) {
2757                 torture_assert_ntstatus_equal(tctx, status, expected_result, "LogonSamLogonEx failed");
2758                 return true;
2759         } else {
2760                 torture_assert_ntstatus_ok(tctx, status, "LogonSamLogonEx failed");
2761         }
2762
2763         return true;
2764 }
2765
2766 static bool test_SamLogon_with_creds(struct torture_context *tctx,
2767                                      struct dcerpc_pipe *p,
2768                                      struct cli_credentials *machine_creds,
2769                                      const char *acct_name,
2770                                      char *password,
2771                                      NTSTATUS expected_samlogon_result)
2772 {
2773         bool ret = true;
2774         struct cli_credentials *test_credentials;
2775
2776         test_credentials = cli_credentials_init(tctx);
2777
2778         cli_credentials_set_workstation(test_credentials,
2779                                         cli_credentials_get_workstation(machine_creds), CRED_SPECIFIED);
2780         cli_credentials_set_domain(test_credentials,
2781                                    cli_credentials_get_domain(machine_creds), CRED_SPECIFIED);
2782         cli_credentials_set_username(test_credentials,
2783                                      acct_name, CRED_SPECIFIED);
2784         cli_credentials_set_password(test_credentials,
2785                                      password, CRED_SPECIFIED);
2786
2787         torture_comment(tctx, "testing samlogon as %s password: %s\n",
2788                 acct_name, password);
2789
2790         if (!test_SamLogon(tctx, p, test_credentials,
2791                            expected_samlogon_result)) {
2792                 torture_warning(tctx, "new password did not work\n");
2793                 ret = false;
2794         }
2795
2796         return ret;
2797 }
2798
2799 static bool test_SetPassword_level(struct dcerpc_pipe *p,
2800                                    struct dcerpc_pipe *np,
2801                                    struct torture_context *tctx,
2802                                    struct policy_handle *handle,
2803                                    uint16_t level,
2804                                    uint32_t fields_present,
2805                                    uint8_t password_expired,
2806                                    bool *matched_expected_error,
2807                                    bool use_setinfo2,
2808                                    const char *acct_name,
2809                                    char **password,
2810                                    struct cli_credentials *machine_creds,
2811                                    bool use_queryinfo2,
2812                                    NTTIME *pwdlastset,
2813                                    NTSTATUS expected_samlogon_result)
2814 {
2815         const char *fields = NULL;
2816         bool ret = true;
2817
2818         switch (level) {
2819         case 21:
2820         case 23:
2821         case 25:
2822                 fields = talloc_asprintf(tctx, "(fields_present: 0x%08x)",
2823                                          fields_present);
2824                 break;
2825         default:
2826                 break;
2827         }
2828
2829         torture_comment(tctx, "Testing SetUserInfo%s level %d call "
2830                 "(password_expired: %d) %s\n",
2831                 use_setinfo2 ? "2":"", level, password_expired,
2832                 fields ? fields : "");
2833
2834         if (!test_SetUserPass_level_ex(p, tctx, handle, level,
2835                                        fields_present,
2836                                        password,
2837                                        password_expired,
2838                                        use_setinfo2,
2839                                        matched_expected_error)) {
2840                 ret = false;
2841         }
2842
2843         if (!test_QueryUserInfo_pwdlastset(p, tctx, handle,
2844                                            use_queryinfo2,
2845                                            pwdlastset)) {
2846                 ret = false;
2847         }
2848
2849         if (*matched_expected_error == true) {
2850                 return ret;
2851         }
2852
2853         if (!test_SamLogon_with_creds(tctx, np,
2854                                       machine_creds,
2855                                       acct_name,
2856                                       *password,
2857                                       expected_samlogon_result)) {
2858                 ret = false;
2859         }
2860
2861         return ret;
2862 }
2863
2864 static bool test_SetPassword_pwdlastset(struct dcerpc_pipe *p,
2865                                         struct torture_context *tctx,
2866                                         uint32_t acct_flags,
2867                                         const char *acct_name,
2868                                         struct policy_handle *handle,
2869                                         char **password,
2870                                         struct cli_credentials *machine_credentials)
2871 {
2872         int s = 0, q = 0, f = 0, l = 0, z = 0;
2873         struct dcerpc_binding *b;
2874         bool ret = true;
2875         int delay = 50000;
2876         bool set_levels[] = { false, true };
2877         bool query_levels[] = { false, true };
2878         uint32_t levels[] = { 18, 21, 26, 23, 24, 25 }; /* Second half only used when TEST_ALL_LEVELS defined */
2879         uint32_t nonzeros[] = { 1, 24 };
2880         uint32_t fields_present[] = {
2881                 0,
2882                 SAMR_FIELD_EXPIRED_FLAG,
2883                 SAMR_FIELD_LAST_PWD_CHANGE,
2884                 SAMR_FIELD_EXPIRED_FLAG | SAMR_FIELD_LAST_PWD_CHANGE,
2885                 SAMR_FIELD_COMMENT,
2886                 SAMR_FIELD_NT_PASSWORD_PRESENT,
2887                 SAMR_FIELD_NT_PASSWORD_PRESENT | SAMR_FIELD_LAST_PWD_CHANGE,
2888                 SAMR_FIELD_NT_PASSWORD_PRESENT | SAMR_FIELD_LM_PASSWORD_PRESENT,
2889                 SAMR_FIELD_NT_PASSWORD_PRESENT | SAMR_FIELD_LM_PASSWORD_PRESENT | SAMR_FIELD_LAST_PWD_CHANGE,
2890                 SAMR_FIELD_NT_PASSWORD_PRESENT | SAMR_FIELD_EXPIRED_FLAG,
2891                 SAMR_FIELD_NT_PASSWORD_PRESENT | SAMR_FIELD_LM_PASSWORD_PRESENT | SAMR_FIELD_EXPIRED_FLAG,
2892                 SAMR_FIELD_NT_PASSWORD_PRESENT | SAMR_FIELD_LM_PASSWORD_PRESENT | SAMR_FIELD_LAST_PWD_CHANGE | SAMR_FIELD_EXPIRED_FLAG
2893         };
2894         NTSTATUS status;
2895         struct dcerpc_pipe *np = NULL;
2896
2897         if (torture_setting_bool(tctx, "samba3", false)) {
2898                 delay = 999999;
2899                 torture_comment(tctx, "Samba3 has second granularity, setting delay to: %d\n",
2900                         delay);
2901         }
2902
2903         status = torture_rpc_binding(tctx, &b);
2904         if (!NT_STATUS_IS_OK(status)) {
2905                 ret = false;
2906                 return ret;
2907         }
2908
2909         /* We have to use schannel, otherwise the SamLogonEx fails
2910          * with INTERNAL_ERROR */
2911
2912         b->flags &= ~DCERPC_AUTH_OPTIONS;
2913         b->flags |= DCERPC_SCHANNEL | DCERPC_SIGN | DCERPC_SCHANNEL_128;
2914
2915         status = dcerpc_pipe_connect_b(tctx, &np, b,
2916                                        &ndr_table_netlogon,
2917                                        machine_credentials, tctx->ev, tctx->lp_ctx);
2918
2919         if (!NT_STATUS_IS_OK(status)) {
2920                 torture_warning(tctx, "RPC pipe connect as domain member failed: %s\n", nt_errstr(status));
2921                 ret = false;
2922                 return ret;
2923         }
2924
2925         /* set to 1 to enable testing for all possible opcode
2926            (SetUserInfo, SetUserInfo2, QueryUserInfo, QueryUserInfo2)
2927            combinations */
2928 #if 0
2929 #define TEST_ALL_LEVELS 1
2930 #define TEST_SET_LEVELS 1
2931 #define TEST_QUERY_LEVELS 1
2932 #endif
2933 #ifdef TEST_ALL_LEVELS
2934         for (l=0; l<ARRAY_SIZE(levels); l++) {
2935 #else
2936         for (l=0; l<(ARRAY_SIZE(levels))/2; l++) {
2937 #endif
2938         for (z=0; z<ARRAY_SIZE(nonzeros); z++) {
2939         for (f=0; f<ARRAY_SIZE(fields_present); f++) {
2940 #ifdef TEST_SET_LEVELS
2941         for (s=0; s<ARRAY_SIZE(set_levels); s++) {
2942 #endif
2943 #ifdef TEST_QUERY_LEVELS
2944         for (q=0; q<ARRAY_SIZE(query_levels); q++) {
2945 #endif
2946                 NTTIME pwdlastset_old = 0;
2947                 NTTIME pwdlastset_new = 0;
2948                 bool matched_expected_error = false;
2949                 NTSTATUS expected_samlogon_result = NT_STATUS_ACCOUNT_DISABLED;
2950
2951                 torture_comment(tctx, "------------------------------\n"
2952                                 "Testing pwdLastSet attribute for flags: 0x%08x "
2953                                 "(s: %d (l: %d), q: %d)\n",
2954                                 acct_flags, s, levels[l], q);
2955
2956                 switch (levels[l]) {
2957                 case 21:
2958                 case 23:
2959                 case 25:
2960                         if (!((fields_present[f] & SAMR_FIELD_NT_PASSWORD_PRESENT) ||
2961                               (fields_present[f] & SAMR_FIELD_LM_PASSWORD_PRESENT))) {
2962                                 expected_samlogon_result = NT_STATUS_WRONG_PASSWORD;
2963                         }
2964                         break;
2965                 }
2966
2967
2968                 /* set #1 */
2969
2970                 /* set a password and force password change (pwdlastset 0) by
2971                  * setting the password expired flag to a non-0 value */
2972
2973                 if (!test_SetPassword_level(p, np, tctx, handle,
2974                                             levels[l],
2975                                             fields_present[f],
2976                                             nonzeros[z],
2977                                             &matched_expected_error,
2978                                             set_levels[s],
2979                                             acct_name,
2980                                             password,
2981                                             machine_credentials,
2982                                             query_levels[q],
2983                                             &pwdlastset_old,
2984                                             expected_samlogon_result)) {
2985                         ret = false;
2986                 }
2987
2988                 if (matched_expected_error == true) {
2989                         /* skipping on expected failure */
2990                         continue;
2991                 }
2992
2993                 /* pwdlastset must be 0 afterwards, except for a level 21, 23 and 25
2994                  * set without the SAMR_FIELD_EXPIRED_FLAG */
2995
2996                 switch (levels[l]) {
2997                 case 21:
2998                 case 23:
2999                 case 25:
3000                         if ((pwdlastset_new != 0) &&
3001                             !(fields_present[f] & SAMR_FIELD_EXPIRED_FLAG)) {
3002                                 torture_comment(tctx, "not considering a non-0 "
3003                                         "pwdLastSet as a an error as the "
3004                                         "SAMR_FIELD_EXPIRED_FLAG has not "
3005                                         "been set\n");
3006                                 break;
3007                         }
3008                 default:
3009                         if (pwdlastset_new != 0) {
3010                                 torture_warning(tctx, "pwdLastSet test failed: "
3011                                         "expected pwdLastSet 0 but got %lld\n",
3012                                         pwdlastset_old);
3013                                 ret = false;
3014                         }
3015                         break;
3016                 }
3017
3018                 switch (levels[l]) {
3019                 case 21:
3020                 case 23:
3021                 case 25:
3022                         if (((fields_present[f] & SAMR_FIELD_NT_PASSWORD_PRESENT) ||
3023                              (fields_present[f] & SAMR_FIELD_LM_PASSWORD_PRESENT)) &&
3024                              (pwdlastset_old > 0) && (pwdlastset_new > 0) &&
3025                              (pwdlastset_old >= pwdlastset_new)) {
3026                                 torture_warning(tctx, "pwdlastset not increasing\n");
3027                                 ret = false;
3028                         }
3029                         break;
3030                 default:
3031                         if ((pwdlastset_old > 0) && (pwdlastset_new > 0) &&
3032                             (pwdlastset_old >= pwdlastset_new)) {
3033                                 torture_warning(tctx, "pwdlastset not increasing\n");
3034                                 ret = false;
3035                         }
3036                         break;
3037                 }
3038
3039                 usleep(delay);
3040
3041                 /* set #2 */
3042
3043                 /* set a password, pwdlastset needs to get updated (increased
3044                  * value), password_expired value used here is 0 */
3045
3046                 if (!test_SetPassword_level(p, np, tctx, handle,
3047                                             levels[l],
3048                                             fields_present[f],
3049                                             0,
3050                                             &matched_expected_error,
3051                                             set_levels[s],
3052                                             acct_name,
3053                                             password,
3054                                             machine_credentials,
3055                                             query_levels[q],
3056                                             &pwdlastset_new,
3057                                             expected_samlogon_result)) {
3058                         ret = false;
3059                 }
3060
3061                 /* when a password has been changed, pwdlastset must not be 0 afterwards
3062                  * and must be larger then the old value */
3063
3064                 switch (levels[l]) {
3065                 case 21:
3066                 case 23:
3067                 case 25:
3068
3069                         /* SAMR_FIELD_EXPIRED_FLAG has not been set and no
3070                          * password has been changed, old and new pwdlastset
3071                          * need to be the same value */
3072
3073                         if (!(fields_present[f] & SAMR_FIELD_EXPIRED_FLAG) &&
3074                             !((fields_present[f] & SAMR_FIELD_NT_PASSWORD_PRESENT) ||
3075                               (fields_present[f] & SAMR_FIELD_LM_PASSWORD_PRESENT)))
3076                         {
3077                                 torture_assert_int_equal(tctx, pwdlastset_old,
3078                                         pwdlastset_new, "pwdlastset must be equal");
3079                                 break;
3080                         }
3081                 default:
3082                         if (pwdlastset_old >= pwdlastset_new) {
3083                                 torture_warning(tctx, "pwdLastSet test failed: "
3084                                         "expected last pwdlastset (%lld) < new pwdlastset (%lld)\n",
3085                                         pwdlastset_old, pwdlastset_new);
3086                                 ret = false;
3087                         }
3088                         if (pwdlastset_new == 0) {
3089                                 torture_warning(tctx, "pwdLastSet test failed: "
3090                                         "expected non-0 pwdlastset, got: %lld\n",
3091                                         pwdlastset_new);
3092                                 ret = false;
3093                         }
3094                 }
3095
3096                 switch (levels[l]) {
3097                 case 21:
3098                 case 23:
3099                 case 25:
3100                         if (((fields_present[f] & SAMR_FIELD_NT_PASSWORD_PRESENT) ||
3101                              (fields_present[f] & SAMR_FIELD_LM_PASSWORD_PRESENT)) &&
3102                              (pwdlastset_old > 0) && (pwdlastset_new > 0) &&
3103                              (pwdlastset_old >= pwdlastset_new)) {
3104                                 torture_warning(tctx, "pwdlastset not increasing\n");
3105                                 ret = false;
3106                         }
3107                         break;
3108                 default:
3109                         if ((pwdlastset_old > 0) && (pwdlastset_new > 0) &&
3110                             (pwdlastset_old >= pwdlastset_new)) {
3111                                 torture_warning(tctx, "pwdlastset not increasing\n");
3112                                 ret = false;
3113                         }
3114                         break;
3115                 }
3116
3117                 pwdlastset_old = pwdlastset_new;
3118
3119                 usleep(delay);
3120
3121                 /* set #2b */
3122
3123                 /* set a password, pwdlastset needs to get updated (increased
3124                  * value), password_expired value used here is 0 */
3125
3126                 if (!test_SetPassword_level(p, np, tctx, handle,
3127                                             levels[l],
3128                                             fields_present[f],
3129                                             0,
3130                                             &matched_expected_error,
3131                                             set_levels[s],
3132                                             acct_name,
3133                                             password,
3134                                             machine_credentials,
3135                                             query_levels[q],
3136                                             &pwdlastset_new,
3137                                             expected_samlogon_result)) {
3138                         ret = false;
3139                 }
3140
3141                 /* when a password has been changed, pwdlastset must not be 0 afterwards
3142                  * and must be larger then the old value */
3143
3144                 switch (levels[l]) {
3145                 case 21:
3146                 case 23:
3147                 case 25:
3148
3149                         /* if no password has been changed, old and new pwdlastset
3150                          * need to be the same value */
3151
3152                         if (!((fields_present[f] & SAMR_FIELD_NT_PASSWORD_PRESENT) ||
3153                               (fields_present[f] & SAMR_FIELD_LM_PASSWORD_PRESENT)))
3154                         {
3155                                 torture_assert_int_equal(tctx, pwdlastset_old,
3156                                         pwdlastset_new, "pwdlastset must be equal");
3157                                 break;
3158                         }
3159                 default:
3160                         if (pwdlastset_old >= pwdlastset_new) {
3161                                 torture_warning(tctx, "pwdLastSet test failed: "
3162                                         "expected last pwdlastset (%lld) < new pwdlastset (%lld)\n",
3163                                         pwdlastset_old, pwdlastset_new);
3164                                 ret = false;
3165                         }
3166                         if (pwdlastset_new == 0) {
3167                                 torture_warning(tctx, "pwdLastSet test failed: "
3168                                         "expected non-0 pwdlastset, got: %lld\n",
3169                                         pwdlastset_new);
3170                                 ret = false;
3171                         }
3172                 }
3173
3174                 /* set #3 */
3175
3176                 /* set a password and force password change (pwdlastset 0) by
3177                  * setting the password expired flag to a non-0 value */
3178
3179                 if (!test_SetPassword_level(p, np, tctx, handle,
3180                                             levels[l],
3181                                             fields_present[f],
3182                                             nonzeros[z],
3183                                             &matched_expected_error,
3184                                             set_levels[s],
3185                                             acct_name,
3186                                             password,
3187                                             machine_credentials,
3188                                             query_levels[q],
3189                                             &pwdlastset_new,
3190                                             expected_samlogon_result)) {
3191                         ret = false;
3192                 }
3193
3194                 /* pwdlastset must be 0 afterwards, except for a level 21, 23 and 25
3195                  * set without the SAMR_FIELD_EXPIRED_FLAG */
3196
3197                 switch (levels[l]) {
3198                 case 21:
3199                 case 23:
3200                 case 25:
3201                         if ((pwdlastset_new != 0) &&
3202                             !(fields_present[f] & SAMR_FIELD_EXPIRED_FLAG)) {
3203                                 torture_comment(tctx, "not considering a non-0 "
3204                                         "pwdLastSet as a an error as the "
3205                                         "SAMR_FIELD_EXPIRED_FLAG has not "
3206                                         "been set\n");
3207                                 break;
3208                         }
3209
3210                         /* SAMR_FIELD_EXPIRED_FLAG has not been set and no
3211                          * password has been changed, old and new pwdlastset
3212                          * need to be the same value */
3213
3214                         if (!(fields_present[f] & SAMR_FIELD_EXPIRED_FLAG) &&
3215                             !((fields_present[f] & SAMR_FIELD_NT_PASSWORD_PRESENT) ||
3216                               (fields_present[f] & SAMR_FIELD_LM_PASSWORD_PRESENT)))
3217                         {
3218                                 torture_assert_int_equal(tctx, pwdlastset_old,
3219                                         pwdlastset_new, "pwdlastset must be equal");
3220                                 break;
3221                         }
3222                 default:
3223
3224                         if (pwdlastset_old == pwdlastset_new) {
3225                                 torture_warning(tctx, "pwdLastSet test failed: "
3226                                         "expected last pwdlastset (%lld) != new pwdlastset (%lld)\n",
3227                                         pwdlastset_old, pwdlastset_new);
3228                                 ret = false;
3229                         }
3230
3231                         if (pwdlastset_new != 0) {
3232                                 torture_warning(tctx, "pwdLastSet test failed: "
3233                                         "expected pwdLastSet 0, got %lld\n",
3234                                         pwdlastset_old);
3235                                 ret = false;
3236                         }
3237                         break;
3238                 }
3239
3240                 switch (levels[l]) {
3241                 case 21:
3242                 case 23:
3243                 case 25:
3244                         if (((fields_present[f] & SAMR_FIELD_NT_PASSWORD_PRESENT) ||
3245                              (fields_present[f] & SAMR_FIELD_LM_PASSWORD_PRESENT)) &&
3246                              (pwdlastset_old > 0) && (pwdlastset_new > 0) &&
3247                              (pwdlastset_old >= pwdlastset_new)) {
3248                                 torture_warning(tctx, "pwdlastset not increasing\n");
3249                                 ret = false;
3250                         }
3251                         break;
3252                 default:
3253                         if ((pwdlastset_old > 0) && (pwdlastset_new > 0) &&
3254                             (pwdlastset_old >= pwdlastset_new)) {
3255                                 torture_warning(tctx, "pwdlastset not increasing\n");
3256                                 ret = false;
3257                         }
3258                         break;
3259                 }
3260
3261                 /* if the level we are testing does not have a fields_present
3262                  * field, skip all fields present tests by setting f to to
3263                  * arraysize */
3264                 switch (levels[l]) {
3265                 case 18:
3266                 case 24:
3267                 case 26:
3268                         f = ARRAY_SIZE(fields_present);
3269                         break;
3270                 }
3271
3272 #ifdef TEST_QUERY_LEVELS
3273         }
3274 #endif
3275 #ifdef TEST_SET_LEVELS
3276         }
3277 #endif
3278         } /* fields present */
3279         } /* nonzeros */
3280         } /* levels */
3281
3282 #undef TEST_SET_LEVELS
3283 #undef TEST_QUERY_LEVELS
3284
3285         talloc_free(np);
3286
3287         return ret;
3288 }
3289
3290 static bool test_DeleteUser_with_privs(struct dcerpc_pipe *p,
3291                                        struct dcerpc_pipe *lp,
3292                                        struct torture_context *tctx,
3293                                        struct policy_handle *domain_handle,
3294                                        struct policy_handle *lsa_handle,
3295                                        struct policy_handle *user_handle,
3296                                        const struct dom_sid *domain_sid,
3297                                        uint32_t rid,
3298                                        struct cli_credentials *machine_credentials)
3299 {
3300         NTSTATUS status;
3301         bool ret = true;
3302
3303         struct policy_handle lsa_acct_handle;
3304         struct dom_sid *user_sid;
3305
3306         user_sid = dom_sid_add_rid(tctx, domain_sid, rid);
3307
3308         {
3309                 struct lsa_EnumAccountRights r;
3310                 struct lsa_RightSet rights;
3311
3312                 torture_comment(tctx, "Testing LSA EnumAccountRights\n");
3313
3314                 r.in.handle = lsa_handle;
3315                 r.in.sid = user_sid;
3316                 r.out.rights = &rights;
3317
3318                 status = dcerpc_lsa_EnumAccountRights(lp, tctx, &r);
3319                 torture_assert_ntstatus_equal(tctx, status, NT_STATUS_OBJECT_NAME_NOT_FOUND,
3320                         "Expected enum rights for account to fail");
3321         }
3322
3323         {
3324                 struct lsa_RightSet rights;
3325                 struct lsa_StringLarge names[2];
3326                 struct lsa_AddAccountRights r;
3327
3328                 torture_comment(tctx, "Testing LSA AddAccountRights\n");
3329
3330                 init_lsa_StringLarge(&names[0], "SeMachineAccountPrivilege");
3331                 init_lsa_StringLarge(&names[1], NULL);
3332
3333                 rights.count = 1;
3334                 rights.names = names;
3335
3336                 r.in.handle = lsa_handle;
3337                 r.in.sid = user_sid;
3338                 r.in.rights = &rights;
3339
3340                 status = dcerpc_lsa_AddAccountRights(lp, tctx, &r);
3341                 torture_assert_ntstatus_ok(tctx, status,
3342                         "Failed to add privileges");
3343         }
3344
3345         {
3346                 struct lsa_EnumAccounts r;
3347                 uint32_t resume_handle = 0;
3348                 struct lsa_SidArray lsa_sid_array;
3349                 int i;
3350                 bool found_sid = false;
3351
3352                 torture_comment(tctx, "Testing LSA EnumAccounts\n");
3353
3354                 r.in.handle = lsa_handle;
3355                 r.in.num_entries = 0x1000;
3356                 r.in.resume_handle = &resume_handle;
3357                 r.out.sids = &lsa_sid_array;
3358                 r.out.resume_handle = &resume_handle;
3359
3360                 status = dcerpc_lsa_EnumAccounts(lp, tctx, &r);
3361                 torture_assert_ntstatus_ok(tctx, status,
3362                         "Failed to enum accounts");
3363
3364                 for (i=0; i < lsa_sid_array.num_sids; i++) {
3365                         if (dom_sid_equal(user_sid, lsa_sid_array.sids[i].sid)) {
3366                                 found_sid = true;
3367                         }
3368                 }
3369
3370                 torture_assert(tctx, found_sid,
3371                         "failed to list privileged account");
3372         }
3373
3374         {
3375                 struct lsa_EnumAccountRights r;
3376                 struct lsa_RightSet user_rights;
3377
3378                 torture_comment(tctx, "Testing LSA EnumAccountRights\n");
3379
3380                 r.in.handle = lsa_handle;
3381                 r.in.sid = user_sid;
3382                 r.out.rights = &user_rights;
3383
3384                 status = dcerpc_lsa_EnumAccountRights(lp, tctx, &r);
3385                 torture_assert_ntstatus_ok(tctx, status,
3386                         "Failed to enum rights for account");
3387
3388                 if (user_rights.count < 1) {
3389                         torture_warning(tctx, "failed to find newly added rights");
3390                         return false;
3391                 }
3392         }
3393
3394         {
3395                 struct lsa_OpenAccount r;
3396
3397                 torture_comment(tctx, "Testing LSA OpenAccount\n");
3398
3399                 r.in.handle = lsa_handle;
3400                 r.in.sid = user_sid;
3401                 r.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
3402                 r.out.acct_handle = &lsa_acct_handle;
3403
3404                 status = dcerpc_lsa_OpenAccount(lp, tctx, &r);
3405                 torture_assert_ntstatus_ok(tctx, status,
3406                         "Failed to open lsa account");
3407         }
3408
3409         {
3410                 struct lsa_GetSystemAccessAccount r;
3411                 uint32_t access_mask;
3412
3413                 torture_comment(tctx, "Testing LSA GetSystemAccessAccount\n");
3414
3415                 r.in.handle = &lsa_acct_handle;
3416                 r.out.access_mask = &access_mask;
3417
3418                 status = dcerpc_lsa_GetSystemAccessAccount(lp, tctx, &r);
3419                 torture_assert_ntstatus_ok(tctx, status,
3420                         "Failed to get lsa system access account");
3421         }
3422
3423         {
3424                 struct lsa_Close r;
3425
3426                 torture_comment(tctx, "Testing LSA Close\n");
3427
3428                 r.in.handle = &lsa_acct_handle;
3429                 r.out.handle = &lsa_acct_handle;
3430
3431                 status = dcerpc_lsa_Close(lp, tctx, &r);
3432                 torture_assert_ntstatus_ok(tctx, status,
3433                         "Failed to close lsa");
3434         }
3435
3436         {
3437                 struct samr_DeleteUser r;
3438
3439                 torture_comment(tctx, "Testing SAMR DeleteUser\n");
3440
3441                 r.in.user_handle = user_handle;
3442                 r.out.user_handle = user_handle;
3443
3444                 status = dcerpc_samr_DeleteUser(p, tctx, &r);
3445                 torture_assert_ntstatus_ok(tctx, status, "Delete User failed");
3446         }
3447
3448         {
3449                 struct lsa_EnumAccounts r;
3450                 uint32_t resume_handle = 0;
3451                 struct lsa_SidArray lsa_sid_array;
3452                 int i;
3453                 bool found_sid = false;
3454
3455                 torture_comment(tctx, "Testing LSA EnumAccounts\n");
3456
3457                 r.in.handle = lsa_handle;
3458                 r.in.num_entries = 0x1000;
3459                 r.in.resume_handle = &resume_handle;
3460                 r.out.sids = &lsa_sid_array;
3461                 r.out.resume_handle = &resume_handle;
3462
3463                 status = dcerpc_lsa_EnumAccounts(lp, tctx, &r);
3464                 torture_assert_ntstatus_ok(tctx, status,
3465                         "Failed to enum accounts");
3466
3467                 for (i=0; i < lsa_sid_array.num_sids; i++) {
3468                         if (dom_sid_equal(user_sid, lsa_sid_array.sids[i].sid)) {
3469                                 found_sid = true;
3470                         }
3471                 }
3472
3473                 torture_assert(tctx, found_sid,
3474                         "failed to list privileged account");
3475         }
3476
3477         {
3478                 struct lsa_EnumAccountRights r;
3479                 struct lsa_RightSet user_rights;
3480
3481                 torture_comment(tctx, "Testing LSA EnumAccountRights\n");
3482
3483                 r.in.handle = lsa_handle;
3484                 r.in.sid = user_sid;
3485                 r.out.rights = &user_rights;
3486
3487                 status = dcerpc_lsa_EnumAccountRights(lp, tctx, &r);
3488                 torture_assert_ntstatus_ok(tctx, status,
3489                         "Failed to enum rights for account");
3490
3491                 if (user_rights.count < 1) {
3492                         torture_warning(tctx, "failed to find newly added rights");
3493                         return false;
3494                 }
3495         }
3496
3497         {
3498                 struct lsa_OpenAccount r;
3499
3500                 torture_comment(tctx, "Testing LSA OpenAccount\n");
3501
3502                 r.in.handle = lsa_handle;
3503                 r.in.sid = user_sid;
3504                 r.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
3505                 r.out.acct_handle = &lsa_acct_handle;
3506
3507                 status = dcerpc_lsa_OpenAccount(lp, tctx, &r);
3508                 torture_assert_ntstatus_ok(tctx, status,
3509                         "Failed to open lsa account");
3510         }
3511
3512         {
3513                 struct lsa_GetSystemAccessAccount r;
3514                 uint32_t access_mask;
3515
3516                 torture_comment(tctx, "Testing LSA GetSystemAccessAccount\n");
3517
3518                 r.in.handle = &lsa_acct_handle;
3519                 r.out.access_mask = &access_mask;
3520
3521                 status = dcerpc_lsa_GetSystemAccessAccount(lp, tctx, &r);
3522                 torture_assert_ntstatus_ok(tctx, status,
3523                         "Failed to get lsa system access account");
3524         }
3525
3526         {
3527                 struct lsa_DeleteObject r;
3528
3529                 torture_comment(tctx, "Testing LSA DeleteObject\n");
3530
3531                 r.in.handle = &lsa_acct_handle;
3532                 r.out.handle = &lsa_acct_handle;
3533
3534                 status = dcerpc_lsa_DeleteObject(lp, tctx, &r);
3535                 torture_assert_ntstatus_ok(tctx, status,
3536                         "Failed to delete object");
3537         }
3538
3539         {
3540                 struct lsa_EnumAccounts r;
3541                 uint32_t resume_handle = 0;
3542                 struct lsa_SidArray lsa_sid_array;
3543                 int i;
3544                 bool found_sid = false;
3545
3546                 torture_comment(tctx, "Testing LSA EnumAccounts\n");
3547
3548                 r.in.handle = lsa_handle;
3549                 r.in.num_entries = 0x1000;
3550                 r.in.resume_handle = &resume_handle;
3551                 r.out.sids = &lsa_sid_array;
3552                 r.out.resume_handle = &resume_handle;
3553
3554                 status = dcerpc_lsa_EnumAccounts(lp, tctx, &r);
3555                 torture_assert_ntstatus_ok(tctx, status,
3556                         "Failed to enum accounts");
3557
3558                 for (i=0; i < lsa_sid_array.num_sids; i++) {
3559                         if (dom_sid_equal(user_sid, lsa_sid_array.sids[i].sid)) {
3560                                 found_sid = true;
3561                         }
3562                 }
3563
3564                 torture_assert(tctx, !found_sid,
3565                         "should not have listed privileged account");
3566         }
3567
3568         {
3569                 struct lsa_EnumAccountRights r;
3570                 struct lsa_RightSet user_rights;
3571
3572                 torture_comment(tctx, "Testing LSA EnumAccountRights\n");
3573
3574                 r.in.handle = lsa_handle;
3575                 r.in.sid = user_sid;
3576                 r.out.rights = &user_rights;
3577
3578                 status = dcerpc_lsa_EnumAccountRights(lp, tctx, &r);
3579                 torture_assert_ntstatus_equal(tctx, status, NT_STATUS_OBJECT_NAME_NOT_FOUND,
3580                         "Failed to enum rights for account");
3581         }
3582
3583         return ret;
3584 }
3585
3586 static bool test_user_ops(struct dcerpc_pipe *p,
3587                           struct torture_context *tctx,
3588                           struct policy_handle *user_handle,
3589                           struct policy_handle *domain_handle,
3590                           const struct dom_sid *domain_sid,
3591                           uint32_t base_acct_flags,
3592                           const char *base_acct_name, enum torture_samr_choice which_ops,
3593                           struct cli_credentials *machine_credentials)
3594 {
3595         char *password = NULL;
3596         struct samr_QueryUserInfo q;
3597         union samr_UserInfo *info;
3598         NTSTATUS status;
3599
3600         bool ret = true;
3601         int i;
3602         uint32_t rid;
3603         const uint32_t password_fields[] = {
3604                 SAMR_FIELD_NT_PASSWORD_PRESENT,
3605                 SAMR_FIELD_LM_PASSWORD_PRESENT,
3606                 SAMR_FIELD_NT_PASSWORD_PRESENT | SAMR_FIELD_LM_PASSWORD_PRESENT,
3607                 0
3608         };
3609
3610         status = test_LookupName(p, tctx, domain_handle, base_acct_name, &rid);
3611         if (!NT_STATUS_IS_OK(status)) {
3612                 ret = false;
3613         }
3614
3615         switch (which_ops) {
3616         case TORTURE_SAMR_USER_ATTRIBUTES:
3617                 if (!test_QuerySecurity(p, tctx, user_handle)) {
3618                         ret = false;
3619                 }
3620
3621                 if (!test_QueryUserInfo(p, tctx, user_handle)) {
3622                         ret = false;
3623                 }
3624
3625                 if (!test_QueryUserInfo2(p, tctx, user_handle)) {
3626                         ret = false;
3627                 }
3628
3629                 if (!test_SetUserInfo(p, tctx, user_handle, base_acct_flags,
3630                                       base_acct_name)) {
3631                         ret = false;
3632                 }
3633
3634                 if (!test_GetUserPwInfo(p, tctx, user_handle)) {
3635                         ret = false;
3636                 }
3637
3638                 if (!test_TestPrivateFunctionsUser(p, tctx, user_handle)) {
3639                         ret = false;
3640                 }
3641
3642                 if (!test_SetUserPass(p, tctx, user_handle, &password)) {
3643                         ret = false;
3644                 }
3645                 break;
3646         case TORTURE_SAMR_PASSWORDS:
3647                 if (base_acct_flags & (ACB_WSTRUST|ACB_DOMTRUST|ACB_SVRTRUST)) {
3648                         char simple_pass[9];
3649                         char *v = generate_random_str(tctx, 1);
3650
3651                         ZERO_STRUCT(simple_pass);
3652                         memset(simple_pass, *v, sizeof(simple_pass) - 1);
3653
3654                         torture_comment(tctx, "Testing machine account password policy rules\n");
3655
3656                         /* Workstation trust accounts don't seem to need to honour password quality policy */
3657                         if (!test_SetUserPassEx(p, tctx, user_handle, true, &password)) {
3658                                 ret = false;
3659                         }
3660
3661                         if (!test_ChangePasswordUser2(p, tctx, base_acct_name, &password, simple_pass, false)) {
3662                                 ret = false;
3663                         }
3664
3665                         /* reset again, to allow another 'user' password change */
3666                         if (!test_SetUserPassEx(p, tctx, user_handle, true, &password)) {
3667                                 ret = false;
3668                         }
3669
3670                         /* Try a 'short' password */
3671                         if (!test_ChangePasswordUser2(p, tctx, base_acct_name, &password, samr_rand_pass(tctx, 4), false)) {
3672                                 ret = false;
3673                         }
3674
3675                         /* Try a compleatly random password */
3676                         if (!test_ChangePasswordRandomBytes(p, tctx, base_acct_name, user_handle, &password)) {
3677                                 ret = false;
3678                         }
3679                 }
3680
3681                 for (i = 0; password_fields[i]; i++) {
3682                         if (!test_SetUserPass_23(p, tctx, user_handle, password_fields[i], &password)) {
3683                                 ret = false;
3684                         }
3685
3686                         /* check it was set right */
3687                         if (!test_ChangePasswordUser3(p, tctx, base_acct_name, 0, &password, NULL, 0, false)) {
3688                                 ret = false;
3689                         }
3690                 }
3691
3692                 for (i = 0; password_fields[i]; i++) {
3693                         if (!test_SetUserPass_25(p, tctx, user_handle, password_fields[i], &password)) {
3694                                 ret = false;
3695                         }
3696
3697                         /* check it was set right */
3698                         if (!test_ChangePasswordUser3(p, tctx, base_acct_name, 0, &password, NULL, 0, false)) {
3699                                 ret = false;
3700                         }
3701                 }
3702
3703                 if (!test_SetUserPassEx(p, tctx, user_handle, false, &password)) {
3704                         ret = false;
3705                 }
3706
3707                 if (!test_ChangePassword(p, tctx, base_acct_name, domain_handle, &password)) {
3708                         ret = false;
3709                 }
3710
3711                 if (torture_setting_bool(tctx, "samba4", false)) {
3712                         torture_comment(tctx, "skipping Set Password level 18 and 21 against Samba4\n");
3713                 } else {
3714
3715                         if (!test_SetUserPass_18(p, tctx, user_handle, &password)) {
3716                                 ret = false;
3717                         }
3718
3719                         if (!test_ChangePasswordUser3(p, tctx, base_acct_name, 0, &password, NULL, 0, false)) {
3720                                 ret = false;
3721                         }
3722
3723                         for (i = 0; password_fields[i]; i++) {
3724
3725                                 if (password_fields[i] == SAMR_FIELD_LM_PASSWORD_PRESENT) {
3726                                         /* we need to skip as that would break
3727                                          * the ChangePasswordUser3 verify */
3728                                         continue;
3729                                 }
3730
3731                                 if (!test_SetUserPass_21(p, tctx, user_handle, password_fields[i], &password)) {
3732                                         ret = false;
3733                                 }
3734
3735                                 /* check it was set right */
3736                                 if (!test_ChangePasswordUser3(p, tctx, base_acct_name, 0, &password, NULL, 0, false)) {
3737                                         ret = false;
3738                                 }
3739                         }
3740                 }
3741
3742                 q.in.user_handle = user_handle;
3743                 q.in.level = 5;
3744                 q.out.info = &info;
3745
3746                 status = dcerpc_samr_QueryUserInfo(p, tctx, &q);
3747                 if (!NT_STATUS_IS_OK(status)) {
3748                         torture_warning(tctx, "QueryUserInfo level %u failed - %s\n",
3749                                q.in.level, nt_errstr(status));
3750                         ret = false;
3751                 } else {
3752                         uint32_t expected_flags = (base_acct_flags | ACB_PWNOTREQ | ACB_DISABLED);
3753                         if ((info->info5.acct_flags) != expected_flags) {
3754                                 torture_warning(tctx, "QuerUserInfo level 5 failed, it returned 0x%08x when we expected flags of 0x%08x\n",
3755                                        info->info5.acct_flags,
3756                                        expected_flags);
3757                                 /* FIXME: GD */
3758                                 if (!torture_setting_bool(tctx, "samba3", false)) {
3759                                         ret = false;
3760                                 }
3761                         }
3762                         if (info->info5.rid != rid) {
3763                                 torture_warning(tctx, "QuerUserInfo level 5 failed, it returned %u when we expected rid of %u\n",
3764                                        info->info5.rid, rid);
3765
3766                         }
3767                 }
3768
3769                 break;
3770
3771         case TORTURE_SAMR_PASSWORDS_PWDLASTSET:
3772
3773                 /* test last password change timestamp behaviour */
3774                 if (!test_SetPassword_pwdlastset(p, tctx, base_acct_flags,
3775                                                  base_acct_name,
3776                                                  user_handle, &password,
3777                                                  machine_credentials)) {
3778                         ret = false;
3779                 }
3780
3781                 if (ret == true) {
3782                         torture_comment(tctx, "pwdLastSet test succeeded\n");
3783                 } else {
3784                         torture_warning(tctx, "pwdLastSet test failed\n");
3785                 }
3786
3787                 break;
3788
3789         case TORTURE_SAMR_USER_PRIVILEGES: {
3790
3791                 struct dcerpc_pipe *lp;
3792                 struct policy_handle *lsa_handle;
3793
3794                 status = torture_rpc_connection(tctx, &lp, &ndr_table_lsarpc);
3795                 torture_assert_ntstatus_ok(tctx, status, "Failed to open LSA pipe");
3796
3797                 if (!test_lsa_OpenPolicy2(lp, tctx, &lsa_handle)) {
3798                         ret = false;
3799                 }
3800
3801                 if (!test_DeleteUser_with_privs(p, lp, tctx,
3802                                                 domain_handle, lsa_handle, user_handle,
3803                                                 domain_sid, rid,
3804                                                 machine_credentials)) {
3805                         ret = false;
3806                 }
3807
3808                 if (!test_lsa_Close(lp, tctx, lsa_handle)) {
3809                         ret = false;
3810                 }
3811
3812                 if (!ret) {
3813                         torture_warning(tctx, "privileged user delete test failed\n");
3814                 }
3815
3816                 break;
3817         }
3818         case TORTURE_SAMR_OTHER:
3819                 /* We just need the account to exist */
3820                 break;
3821         }
3822         return ret;
3823 }
3824
3825 static bool test_alias_ops(struct dcerpc_pipe *p, struct torture_context *tctx,
3826                            struct policy_handle *alias_handle,
3827                            const struct dom_sid *domain_sid)
3828 {
3829         bool ret = true;
3830
3831         if (!torture_setting_bool(tctx, "samba3", false)) {
3832                 if (!test_QuerySecurity(p, tctx, alias_handle)) {
3833                         ret = false;
3834                 }
3835         }
3836
3837         if (!test_QueryAliasInfo(p, tctx, alias_handle)) {
3838                 ret = false;
3839         }
3840
3841         if (!test_SetAliasInfo(p, tctx, alias_handle)) {
3842                 ret = false;
3843         }
3844
3845         if (!test_AddMemberToAlias(p, tctx, alias_handle, domain_sid)) {
3846                 ret = false;
3847         }
3848
3849         if (torture_setting_bool(tctx, "samba3", false) ||
3850             torture_setting_bool(tctx, "samba4", false)) {
3851                 torture_comment(tctx, "skipping MultipleMembers Alias tests against Samba\n");
3852                 return ret;
3853         }
3854
3855         if (!test_AddMultipleMembersToAlias(p, tctx, alias_handle)) {
3856                 ret = false;
3857         }
3858
3859         return ret;
3860 }
3861
3862
3863 static bool test_DeleteUser(struct dcerpc_pipe *p, struct torture_context *tctx,
3864                                      struct policy_handle *user_handle)
3865 {
3866         struct samr_DeleteUser d;
3867         NTSTATUS status;
3868         torture_comment(tctx, "Testing DeleteUser\n");
3869
3870         d.in.user_handle = user_handle;
3871         d.out.user_handle = user_handle;
3872
3873         status = dcerpc_samr_DeleteUser(p, tctx, &d);
3874         torture_assert_ntstatus_ok(tctx, status, "DeleteUser");
3875
3876         return true;
3877 }
3878
3879 bool test_DeleteUser_byname(struct dcerpc_pipe *p,
3880                             struct torture_context *tctx,
3881                             struct policy_handle *handle, const char *name)
3882 {
3883         NTSTATUS status;
3884         struct samr_DeleteUser d;
3885         struct policy_handle user_handle;
3886         uint32_t rid;
3887
3888         status = test_LookupName(p, tctx, handle, name, &rid);
3889         if (!NT_STATUS_IS_OK(status)) {
3890                 goto failed;
3891         }
3892
3893         status = test_OpenUser_byname(p, tctx, handle, name, &user_handle);
3894         if (!NT_STATUS_IS_OK(status)) {
3895                 goto failed;
3896         }
3897
3898         d.in.user_handle = &user_handle;
3899         d.out.user_handle = &user_handle;
3900         status = dcerpc_samr_DeleteUser(p, tctx, &d);
3901         if (!NT_STATUS_IS_OK(status)) {
3902                 goto failed;
3903         }
3904
3905         return true;
3906
3907 failed:
3908         torture_warning(tctx, "DeleteUser_byname(%s) failed - %s\n", name, nt_errstr(status));
3909         return false;
3910 }
3911
3912
3913 static bool test_DeleteGroup_byname(struct dcerpc_pipe *p,
3914                                     struct torture_context *tctx,
3915                                     struct policy_handle *handle, const char *name)
3916 {
3917         NTSTATUS status;
3918         struct samr_OpenGroup r;
3919         struct samr_DeleteDomainGroup d;
3920         struct policy_handle group_handle;
3921         uint32_t rid;
3922
3923         status = test_LookupName(p, tctx, handle, name, &rid);
3924         if (!NT_STATUS_IS_OK(status)) {
3925                 goto failed;
3926         }
3927
3928         r.in.domain_handle = handle;
3929         r.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
3930         r.in.rid = rid;
3931         r.out.group_handle = &group_handle;
3932         status = dcerpc_samr_OpenGroup(p, tctx, &r);
3933         if (!NT_STATUS_IS_OK(status)) {
3934                 goto failed;
3935         }
3936
3937         d.in.group_handle = &group_handle;
3938         d.out.group_handle = &group_handle;
3939         status = dcerpc_samr_DeleteDomainGroup(p, tctx, &d);
3940         if (!NT_STATUS_IS_OK(status)) {
3941                 goto failed;
3942         }
3943
3944         return true;
3945
3946 failed:
3947         torture_warning(tctx, "DeleteGroup_byname(%s) failed - %s\n", name, nt_errstr(status));
3948         return false;
3949 }
3950
3951
3952 static bool test_DeleteAlias_byname(struct dcerpc_pipe *p,
3953                                     struct torture_context *tctx,
3954                                     struct policy_handle *domain_handle,
3955                                     const char *name)
3956 {
3957         NTSTATUS status;
3958         struct samr_OpenAlias r;
3959         struct samr_DeleteDomAlias d;
3960         struct policy_handle alias_handle;
3961         uint32_t rid;
3962
3963         torture_comment(tctx, "testing DeleteAlias_byname\n");
3964
3965         status = test_LookupName(p, tctx, domain_handle, name, &rid);
3966         if (!NT_STATUS_IS_OK(status)) {
3967                 goto failed;
3968         }
3969
3970         r.in.domain_handle = domain_handle;
3971         r.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
3972         r.in.rid = rid;
3973         r.out.alias_handle = &alias_handle;
3974         status = dcerpc_samr_OpenAlias(p, tctx, &r);
3975         if (!NT_STATUS_IS_OK(status)) {
3976                 goto failed;
3977         }
3978
3979         d.in.alias_handle = &alias_handle;
3980         d.out.alias_handle = &alias_handle;
3981         status = dcerpc_samr_DeleteDomAlias(p, tctx, &d);
3982         if (!NT_STATUS_IS_OK(status)) {
3983                 goto failed;
3984         }
3985
3986         return true;
3987
3988 failed:
3989         torture_warning(tctx, "DeleteAlias_byname(%s) failed - %s\n", name, nt_errstr(status));
3990         return false;
3991 }
3992
3993 static bool test_DeleteAlias(struct dcerpc_pipe *p,
3994                              struct torture_context *tctx,
3995                              struct policy_handle *alias_handle)
3996 {
3997         struct samr_DeleteDomAlias d;
3998         NTSTATUS status;
3999         bool ret = true;
4000
4001         torture_comment(tctx, "Testing DeleteAlias\n");
4002
4003         d.in.alias_handle = alias_handle;
4004         d.out.alias_handle = alias_handle;
4005
4006         status = dcerpc_samr_DeleteDomAlias(p, tctx, &d);
4007         if (!NT_STATUS_IS_OK(status)) {
4008                 torture_warning(tctx, "DeleteAlias failed - %s\n", nt_errstr(status));
4009                 ret = false;
4010         }
4011
4012         return ret;
4013 }
4014
4015 static bool test_CreateAlias(struct dcerpc_pipe *p, struct torture_context *tctx,
4016                              struct policy_handle *domain_handle,
4017                              const char *alias_name,
4018                              struct policy_handle *alias_handle,
4019                              const struct dom_sid *domain_sid,
4020                              bool test_alias)
4021 {
4022         NTSTATUS status;
4023         struct samr_CreateDomAlias r;
4024         struct lsa_String name;
4025         uint32_t rid;
4026         bool ret = true;
4027
4028         init_lsa_String(&name, alias_name);
4029         r.in.domain_handle = domain_handle;
4030         r.in.alias_name = &name;
4031         r.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
4032         r.out.alias_handle = alias_handle;
4033         r.out.rid = &rid;
4034
4035         torture_comment(tctx, "Testing CreateAlias (%s)\n", r.in.alias_name->string);
4036
4037         status = dcerpc_samr_CreateDomAlias(p, tctx, &r);
4038
4039         if (dom_sid_equal(domain_sid, dom_sid_parse_talloc(tctx, SID_BUILTIN))) {
4040                 if (NT_STATUS_EQUAL(status, NT_STATUS_ACCESS_DENIED)) {
4041                         torture_comment(tctx, "Server correctly refused create of '%s'\n", r.in.alias_name->string);
4042                         return true;
4043                 } else {
4044                         torture_warning(tctx, "Server should have refused create of '%s', got %s instead\n", r.in.alias_name->string,
4045                                nt_errstr(status));
4046                         return false;
4047                 }
4048         }
4049
4050         if (NT_STATUS_EQUAL(status, NT_STATUS_ALIAS_EXISTS)) {
4051                 if (!test_DeleteAlias_byname(p, tctx, domain_handle, r.in.alias_name->string)) {
4052                         return false;
4053                 }
4054                 status = dcerpc_samr_CreateDomAlias(p, tctx, &r);
4055         }
4056
4057         if (!NT_STATUS_IS_OK(status)) {
4058                 torture_warning(tctx, "CreateAlias failed - %s\n", nt_errstr(status));
4059                 return false;
4060         }
4061
4062         if (!test_alias) {
4063                 return ret;
4064         }
4065
4066         if (!test_alias_ops(p, tctx, alias_handle, domain_sid)) {
4067                 ret = false;
4068         }
4069
4070         return ret;
4071 }
4072
4073 static bool test_ChangePassword(struct dcerpc_pipe *p,
4074                                 struct torture_context *tctx,
4075                                 const char *acct_name,
4076                                 struct policy_handle *domain_handle, char **password)
4077 {
4078         bool ret = true;
4079
4080         if (!*password) {
4081                 return false;
4082         }
4083
4084         if (!test_ChangePasswordUser(p, tctx, acct_name, domain_handle, password)) {
4085                 ret = false;
4086         }
4087
4088         if (!test_ChangePasswordUser2(p, tctx, acct_name, password, 0, true)) {
4089                 ret = false;
4090         }
4091
4092         if (!test_OemChangePasswordUser2(p, tctx, acct_name, domain_handle, password)) {
4093                 ret = false;
4094         }
4095
4096         /* test what happens when setting the old password again */
4097         if (!test_ChangePasswordUser3(p, tctx, acct_name, 0, password, *password, 0, true)) {
4098                 ret = false;
4099         }
4100
4101         {
4102                 char simple_pass[9];
4103                 char *v = generate_random_str(tctx, 1);
4104
4105                 ZERO_STRUCT(simple_pass);
4106                 memset(simple_pass, *v, sizeof(simple_pass) - 1);
4107
4108                 /* test what happens when picking a simple password */
4109                 if (!test_ChangePasswordUser3(p, tctx, acct_name, 0, password, simple_pass, 0, true)) {
4110                         ret = false;
4111                 }
4112         }
4113
4114         /* set samr_SetDomainInfo level 1 with min_length 5 */
4115         {
4116                 struct samr_QueryDomainInfo r;
4117                 union samr_DomainInfo *info = NULL;
4118                 struct samr_SetDomainInfo s;
4119                 uint16_t len_old, len;
4120                 uint32_t pwd_prop_old;
4121                 int64_t min_pwd_age_old;
4122                 NTSTATUS status;
4123
4124                 len = 5;
4125
4126                 r.in.domain_handle = domain_handle;
4127                 r.in.level = 1;
4128                 r.out.info = &info;
4129
4130                 torture_comment(tctx, "testing samr_QueryDomainInfo level 1\n");
4131                 status = dcerpc_samr_QueryDomainInfo(p, tctx, &r);
4132                 if (!NT_STATUS_IS_OK(status)) {
4133                         return false;
4134                 }
4135
4136                 s.in.domain_handle = domain_handle;
4137                 s.in.level = 1;
4138                 s.in.info = info;
4139
4140                 /* remember the old min length, so we can reset it */
4141                 len_old = s.in.info->info1.min_password_length;
4142                 s.in.info->info1.min_password_length = len;
4143                 pwd_prop_old = s.in.info->info1.password_properties;
4144                 /* turn off password complexity checks for this test */
4145                 s.in.info->info1.password_properties &= ~DOMAIN_PASSWORD_COMPLEX;
4146
4147                 min_pwd_age_old = s.in.info->info1.min_password_age;
4148                 s.in.info->info1.min_password_age = 0;
4149
4150                 torture_comment(tctx, "testing samr_SetDomainInfo level 1\n");
4151                 status = dcerpc_samr_SetDomainInfo(p, tctx, &s);
4152                 if (!NT_STATUS_IS_OK(status)) {
4153                         return false;
4154                 }
4155
4156                 torture_comment(tctx, "calling test_ChangePasswordUser3 with too short password\n");
4157
4158                 if (!test_ChangePasswordUser3(p, tctx, acct_name, len - 1, password, NULL, 0, true)) {
4159                         ret = false;
4160                 }
4161
4162                 s.in.info->info1.min_password_length = len_old;
4163                 s.in.info->info1.password_properties = pwd_prop_old;
4164                 s.in.info->info1.min_password_age = min_pwd_age_old;
4165
4166                 torture_comment(tctx, "testing samr_SetDomainInfo level 1\n");
4167                 status = dcerpc_samr_SetDomainInfo(p, tctx, &s);
4168                 if (!NT_STATUS_IS_OK(status)) {
4169                         return false;
4170                 }
4171
4172         }
4173
4174         {
4175                 NTSTATUS status;
4176                 struct samr_OpenUser r;
4177                 struct samr_QueryUserInfo q;
4178                 union samr_UserInfo *info;
4179                 struct samr_LookupNames n;
4180                 struct policy_handle user_handle;
4181                 struct samr_Ids rids, types;
4182
4183                 n.in.domain_handle = domain_handle;
4184                 n.in.num_names = 1;
4185                 n.in.names = talloc_array(tctx, struct lsa_String, 1);
4186                 n.in.names[0].string = acct_name;
4187                 n.out.rids = &rids;
4188                 n.out.types = &types;
4189
4190                 status = dcerpc_samr_LookupNames(p, tctx, &n);
4191                 if (!NT_STATUS_IS_OK(status)) {
4192                         torture_warning(tctx, "LookupNames failed - %s\n", nt_errstr(status));
4193                         return false;
4194                 }
4195
4196                 r.in.domain_handle = domain_handle;
4197                 r.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
4198                 r.in.rid = n.out.rids->ids[0];
4199                 r.out.user_handle = &user_handle;
4200
4201                 status = dcerpc_samr_OpenUser(p, tctx, &r);
4202                 if (!NT_STATUS_IS_OK(status)) {
4203                         torture_warning(tctx, "OpenUser(%u) failed - %s\n", n.out.rids->ids[0], nt_errstr(status));
4204                         return false;
4205                 }
4206
4207                 q.in.user_handle = &user_handle;
4208                 q.in.level = 5;
4209                 q.out.info = &info;
4210
4211                 status = dcerpc_samr_QueryUserInfo(p, tctx, &q);
4212                 if (!NT_STATUS_IS_OK(status)) {
4213                         torture_warning(tctx, "QueryUserInfo failed - %s\n", nt_errstr(status));
4214                         return false;
4215                 }
4216
4217                 torture_comment(tctx, "calling test_ChangePasswordUser3 with too early password change\n");
4218
4219                 if (!test_ChangePasswordUser3(p, tctx, acct_name, 0, password, NULL,
4220                                               info->info5.last_password_change, true)) {
4221                         ret = false;
4222                 }
4223         }
4224
4225         /* we change passwords twice - this has the effect of verifying
4226            they were changed correctly for the final call */
4227         if (!test_ChangePasswordUser3(p, tctx, acct_name, 0, password, NULL, 0, true)) {
4228                 ret = false;
4229         }
4230
4231         if (!test_ChangePasswordUser3(p, tctx, acct_name, 0, password, NULL, 0, true)) {
4232                 ret = false;
4233         }
4234
4235         return ret;
4236 }
4237
4238 static bool test_CreateUser(struct dcerpc_pipe *p, struct torture_context *tctx,
4239                             struct policy_handle *domain_handle,
4240                             const char *user_name,
4241                             struct policy_handle *user_handle_out,
4242                             struct dom_sid *domain_sid,
4243                             enum torture_samr_choice which_ops,
4244                             struct cli_credentials *machine_credentials,
4245                             bool test_user)
4246 {
4247
4248         TALLOC_CTX *user_ctx;
4249
4250         NTSTATUS status;
4251         struct samr_CreateUser r;
4252         struct samr_QueryUserInfo q;
4253         union samr_UserInfo *info;
4254         struct samr_DeleteUser d;
4255         uint32_t rid;
4256
4257         /* This call creates a 'normal' account - check that it really does */
4258         const uint32_t acct_flags = ACB_NORMAL;
4259         struct lsa_String name;
4260         bool ret = true;
4261
4262         struct policy_handle user_handle;
4263         user_ctx = talloc_named(tctx, 0, "test_CreateUser2 per-user context");
4264         init_lsa_String(&name, user_name);
4265
4266         r.in.domain_handle = domain_handle;
4267         r.in.account_name = &name;
4268         r.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
4269         r.out.user_handle = &user_handle;
4270         r.out.rid = &rid;
4271
4272         torture_comment(tctx, "Testing CreateUser(%s)\n", r.in.account_name->string);
4273
4274         status = dcerpc_samr_CreateUser(p, user_ctx, &r);
4275
4276         if (dom_sid_equal(domain_sid, dom_sid_parse_talloc(tctx, SID_BUILTIN))) {
4277                 if (NT_STATUS_EQUAL(status, NT_STATUS_ACCESS_DENIED) || NT_STATUS_EQUAL(status, NT_STATUS_INVALID_PARAMETER)) {
4278                         torture_comment(tctx, "Server correctly refused create of '%s'\n", r.in.account_name->string);
4279                         return true;
4280                 } else {
4281                         torture_warning(tctx, "Server should have refused create of '%s', got %s instead\n", r.in.account_name->string,
4282                                nt_errstr(status));
4283                         return false;
4284                 }
4285         }
4286
4287         if (NT_STATUS_EQUAL(status, NT_STATUS_USER_EXISTS)) {
4288                 if (!test_DeleteUser_byname(p, user_ctx, domain_handle, r.in.account_name->string)) {
4289                         talloc_free(user_ctx);
4290                         return false;
4291                 }
4292                 status = dcerpc_samr_CreateUser(p, user_ctx, &r);
4293         }
4294
4295         if (!NT_STATUS_IS_OK(status)) {
4296                 talloc_free(user_ctx);
4297                 torture_warning(tctx, "CreateUser failed - %s\n", nt_errstr(status));
4298                 return false;
4299         }
4300
4301         if (!test_user) {
4302                 if (user_handle_out) {
4303                         *user_handle_out = user_handle;
4304                 }
4305                 return ret;
4306         }
4307
4308         {
4309                 q.in.user_handle = &user_handle;
4310                 q.in.level = 16;
4311                 q.out.info = &info;
4312
4313                 status = dcerpc_samr_QueryUserInfo(p, user_ctx, &q);
4314                 if (!NT_STATUS_IS_OK(status)) {
4315                         torture_warning(tctx, "QueryUserInfo level %u failed - %s\n",
4316                                q.in.level, nt_errstr(status));
4317                         ret = false;
4318                 } else {
4319                         if ((info->info16.acct_flags & acct_flags) != acct_flags) {
4320                                 torture_warning(tctx, "QuerUserInfo level 16 failed, it returned 0x%08x when we expected flags of 0x%08x\n",
4321                                        info->info16.acct_flags,
4322                                        acct_flags);
4323                                 ret = false;
4324                         }
4325                 }
4326
4327                 if (!test_user_ops(p, tctx, &user_handle, domain_handle,
4328                                    domain_sid, acct_flags, name.string, which_ops,
4329                                    machine_credentials)) {
4330                         ret = false;
4331                 }
4332
4333                 if (user_handle_out) {
4334                         *user_handle_out = user_handle;
4335                 } else {
4336                         torture_comment(tctx, "Testing DeleteUser (createuser test)\n");
4337
4338                         d.in.user_handle = &user_handle;
4339                         d.out.user_handle = &user_handle;
4340
4341                         status = dcerpc_samr_DeleteUser(p, user_ctx, &d);
4342                         if (!NT_STATUS_IS_OK(status)) {
4343                                 torture_warning(tctx, "DeleteUser failed - %s\n", nt_errstr(status));
4344                                 ret = false;
4345                         }
4346                 }
4347
4348         }
4349
4350         talloc_free(user_ctx);
4351
4352         return ret;
4353 }
4354
4355
4356 static bool test_CreateUser2(struct dcerpc_pipe *p, struct torture_context *tctx,
4357                              struct policy_handle *domain_handle,
4358                              struct dom_sid *domain_sid,
4359                              enum torture_samr_choice which_ops,
4360                              struct cli_credentials *machine_credentials)
4361 {
4362         NTSTATUS status;
4363         struct samr_CreateUser2 r;
4364         struct samr_QueryUserInfo q;
4365         union samr_UserInfo *info;
4366         struct samr_DeleteUser d;
4367         struct policy_handle user_handle;
4368         uint32_t rid;
4369         struct lsa_String name;
4370         bool ret = true;
4371         int i;
4372
4373         struct {
4374                 uint32_t acct_flags;
4375                 const char *account_name;
4376                 NTSTATUS nt_status;
4377         } account_types[] = {
4378                 { ACB_NORMAL, TEST_ACCOUNT_NAME, NT_STATUS_OK },
4379                 { ACB_NORMAL | ACB_DISABLED, TEST_ACCOUNT_NAME, NT_STATUS_INVALID_PARAMETER },
4380                 { ACB_NORMAL | ACB_PWNOEXP, TEST_ACCOUNT_NAME, NT_STATUS_INVALID_PARAMETER },
4381                 { ACB_WSTRUST, TEST_MACHINENAME, NT_STATUS_OK },
4382                 { ACB_WSTRUST | ACB_DISABLED, TEST_MACHINENAME, NT_STATUS_INVALID_PARAMETER },
4383                 { ACB_WSTRUST | ACB_PWNOEXP, TEST_MACHINENAME, NT_STATUS_INVALID_PARAMETER },
4384                 { ACB_SVRTRUST, TEST_MACHINENAME, NT_STATUS_OK },
4385                 { ACB_SVRTRUST | ACB_DISABLED, TEST_MACHINENAME, NT_STATUS_INVALID_PARAMETER },
4386                 { ACB_SVRTRUST | ACB_PWNOEXP, TEST_MACHINENAME, NT_STATUS_INVALID_PARAMETER },
4387                 { ACB_DOMTRUST, TEST_DOMAINNAME, NT_STATUS_ACCESS_DENIED },
4388                 { ACB_DOMTRUST | ACB_DISABLED, TEST_DOMAINNAME, NT_STATUS_INVALID_PARAMETER },
4389                 { ACB_DOMTRUST | ACB_PWNOEXP, TEST_DOMAINNAME, NT_STATUS_INVALID_PARAMETER },
4390                 { 0, TEST_ACCOUNT_NAME, NT_STATUS_INVALID_PARAMETER },
4391                 { ACB_DISABLED, TEST_ACCOUNT_NAME, NT_STATUS_INVALID_PARAMETER },
4392                 { 0, NULL, NT_STATUS_INVALID_PARAMETER }
4393         };
4394
4395         for (i = 0; account_types[i].account_name; i++) {
4396                 TALLOC_CTX *user_ctx;
4397                 uint32_t acct_flags = account_types[i].acct_flags;
4398                 uint32_t access_granted;
4399                 user_ctx = talloc_named(tctx, 0, "test_CreateUser2 per-user context");
4400                 init_lsa_String(&name, account_types[i].account_name);
4401
4402                 r.in.domain_handle = domain_handle;
4403                 r.in.account_name = &name;
4404                 r.in.acct_flags = acct_flags;
4405                 r.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
4406                 r.out.user_handle = &user_handle;
4407                 r.out.access_granted = &access_granted;
4408                 r.out.rid = &rid;
4409
4410                 torture_comment(tctx, "Testing CreateUser2(%s, 0x%x)\n", r.in.account_name->string, acct_flags);
4411
4412                 status = dcerpc_samr_CreateUser2(p, user_ctx, &r);
4413
4414                 if (dom_sid_equal(domain_sid, dom_sid_parse_talloc(tctx, SID_BUILTIN))) {
4415                         if (NT_STATUS_EQUAL(status, NT_STATUS_ACCESS_DENIED) || NT_STATUS_EQUAL(status, NT_STATUS_INVALID_PARAMETER)) {
4416                                 torture_comment(tctx, "Server correctly refused create of '%s'\n", r.in.account_name->string);
4417                                 continue;
4418                         } else {
4419                                 torture_warning(tctx, "Server should have refused create of '%s', got %s instead\n", r.in.account_name->string,
4420                                        nt_errstr(status));
4421                                 ret = false;
4422                                 continue;
4423                         }
4424                 }
4425
4426                 if (NT_STATUS_EQUAL(status, NT_STATUS_USER_EXISTS)) {
4427                         if (!test_DeleteUser_byname(p, user_ctx, domain_handle, r.in.account_name->string)) {
4428                                 talloc_free(user_ctx);
4429                                 ret = false;
4430                                 continue;
4431                         }
4432                         status = dcerpc_samr_CreateUser2(p, user_ctx, &r);
4433
4434                 }
4435                 if (!NT_STATUS_EQUAL(status, account_types[i].nt_status)) {
4436                         torture_warning(tctx, "CreateUser2 failed gave incorrect error return - %s (should be %s)\n",
4437                                nt_errstr(status), nt_errstr(account_types[i].nt_status));
4438                         ret = false;
4439                 }
4440
4441                 if (NT_STATUS_IS_OK(status)) {
4442                         q.in.user_handle = &user_handle;
4443                         q.in.level = 5;
4444                         q.out.info = &info;
4445
4446                         status = dcerpc_samr_QueryUserInfo(p, user_ctx, &q);
4447                         if (!NT_STATUS_IS_OK(status)) {
4448                                 torture_warning(tctx, "QueryUserInfo level %u failed - %s\n",
4449                                        q.in.level, nt_errstr(status));
4450                                 ret = false;
4451                         } else {
4452                                 uint32_t expected_flags = (acct_flags | ACB_PWNOTREQ | ACB_DISABLED);
4453                                 if (acct_flags == ACB_NORMAL) {
4454                                         expected_flags |= ACB_PW_EXPIRED;
4455                                 }
4456                                 if ((info->info5.acct_flags) != expected_flags) {
4457                                         torture_warning(tctx, "QuerUserInfo level 5 failed, it returned 0x%08x when we expected flags of 0x%08x\n",
4458                                                info->info5.acct_flags,
4459                                                expected_flags);
4460                                         ret = false;
4461                                 }
4462                                 switch (acct_flags) {
4463                                 case ACB_SVRTRUST:
4464                                         if (info->info5.primary_gid != DOMAIN_RID_DCS) {
4465                                                 torture_warning(tctx, "QuerUserInfo level 5: DC should have had Primary Group %d, got %d\n",
4466                                                        DOMAIN_RID_DCS, info->info5.primary_gid);
4467                                                 ret = false;
4468                                         }
4469                                         break;
4470                                 case ACB_WSTRUST:
4471                                         if (info->info5.primary_gid != DOMAIN_RID_DOMAIN_MEMBERS) {
4472                                                 torture_warning(tctx, "QuerUserInfo level 5: Domain Member should have had Primary Group %d, got %d\n",
4473                                                        DOMAIN_RID_DOMAIN_MEMBERS, info->info5.primary_gid);
4474                                                 ret = false;
4475                                         }
4476                                         break;
4477                                 case ACB_NORMAL:
4478                                         if (info->info5.primary_gid != DOMAIN_RID_USERS) {
4479                                                 torture_warning(tctx, "QuerUserInfo level 5: Users should have had Primary Group %d, got %d\n",
4480                                                        DOMAIN_RID_USERS, info->info5.primary_gid);
4481                                                 ret = false;
4482                                         }
4483                                         break;
4484                                 }
4485                         }
4486
4487                         if (!test_user_ops(p, tctx, &user_handle, domain_handle,
4488                                            domain_sid, acct_flags, name.string, which_ops,
4489                                            machine_credentials)) {
4490                                 ret = false;
4491                         }
4492
4493                         if (!policy_handle_empty(&user_handle)) {
4494                                 torture_comment(tctx, "Testing DeleteUser (createuser2 test)\n");
4495
4496                                 d.in.user_handle = &user_handle;
4497                                 d.out.user_handle = &user_handle;
4498
4499                                 status = dcerpc_samr_DeleteUser(p, user_ctx, &d);
4500                                 if (!NT_STATUS_IS_OK(status)) {
4501                                         torture_warning(tctx, "DeleteUser failed - %s\n", nt_errstr(status));
4502                                         ret = false;
4503                                 }
4504                         }
4505                 }
4506                 talloc_free(user_ctx);
4507         }
4508
4509         return ret;
4510 }
4511
4512 static bool test_QueryAliasInfo(struct dcerpc_pipe *p,
4513                                 struct torture_context *tctx,
4514                                 struct policy_handle *handle)
4515 {
4516         NTSTATUS status;
4517         struct samr_QueryAliasInfo r;
4518         union samr_AliasInfo *info;
4519         uint16_t levels[] = {1, 2, 3};
4520         int i;
4521         bool ret = true;
4522
4523         for (i=0;i<ARRAY_SIZE(levels);i++) {
4524                 torture_comment(tctx, "Testing QueryAliasInfo level %u\n", levels[i]);
4525
4526                 r.in.alias_handle = handle;
4527                 r.in.level = levels[i];
4528                 r.out.info = &info;
4529
4530                 status = dcerpc_samr_QueryAliasInfo(p, tctx, &r);
4531                 if (!NT_STATUS_IS_OK(status)) {
4532                         torture_warning(tctx, "QueryAliasInfo level %u failed - %s\n",
4533                                levels[i], nt_errstr(status));
4534                         ret = false;
4535                 }
4536         }
4537
4538         return ret;
4539 }
4540
4541 static bool test_QueryGroupInfo(struct dcerpc_pipe *p,
4542                                 struct torture_context *tctx,
4543                                 struct policy_handle *handle)
4544 {
4545         NTSTATUS status;
4546         struct samr_QueryGroupInfo r;
4547         union samr_GroupInfo *info;
4548         uint16_t levels[] = {1, 2, 3, 4, 5};
4549         int i;
4550         bool ret = true;
4551
4552         for (i=0;i<ARRAY_SIZE(levels);i++) {
4553                 torture_comment(tctx, "Testing QueryGroupInfo level %u\n", levels[i]);
4554
4555                 r.in.group_handle = handle;
4556                 r.in.level = levels[i];
4557                 r.out.info = &info;
4558
4559                 status = dcerpc_samr_QueryGroupInfo(p, tctx, &r);
4560                 if (!NT_STATUS_IS_OK(status)) {
4561                         torture_warning(tctx, "QueryGroupInfo level %u failed - %s\n",
4562                                levels[i], nt_errstr(status));
4563                         ret = false;
4564                 }
4565         }
4566
4567         return ret;
4568 }
4569
4570 static bool test_QueryGroupMember(struct dcerpc_pipe *p,
4571                                   struct torture_context *tctx,
4572                                   struct policy_handle *handle)
4573 {
4574         NTSTATUS status;
4575         struct samr_QueryGroupMember r;
4576         struct samr_RidTypeArray *rids = NULL;
4577         bool ret = true;
4578
4579         torture_comment(tctx, "Testing QueryGroupMember\n");
4580
4581         r.in.group_handle = handle;
4582         r.out.rids = &rids;
4583
4584         status = dcerpc_samr_QueryGroupMember(p, tctx, &r);
4585         if (!NT_STATUS_IS_OK(status)) {
4586                 torture_warning(tctx, "QueryGroupInfo failed - %s\n", nt_errstr(status));
4587                 ret = false;
4588         }
4589
4590         return ret;
4591 }
4592
4593
4594 static bool test_SetGroupInfo(struct dcerpc_pipe *p,
4595                               struct torture_context *tctx,
4596                               struct policy_handle *handle)
4597 {
4598         NTSTATUS status;
4599         struct samr_QueryGroupInfo r;
4600         union samr_GroupInfo *info;
4601         struct samr_SetGroupInfo s;
4602         uint16_t levels[] = {1, 2, 3, 4};
4603         uint16_t set_ok[] = {0, 1, 1, 1};
4604         int i;
4605         bool ret = true;
4606
4607         for (i=0;i<ARRAY_SIZE(levels);i++) {
4608                 torture_comment(tctx, "Testing QueryGroupInfo level %u\n", levels[i]);
4609
4610                 r.in.group_handle = handle;
4611                 r.in.level = levels[i];
4612                 r.out.info = &info;
4613
4614                 status = dcerpc_samr_QueryGroupInfo(p, tctx, &r);
4615                 if (!NT_STATUS_IS_OK(status)) {
4616                         torture_warning(tctx, "QueryGroupInfo level %u failed - %s\n",
4617                                levels[i], nt_errstr(status));
4618                         ret = false;
4619                 }
4620
4621                 torture_comment(tctx, "Testing SetGroupInfo level %u\n", levels[i]);
4622
4623                 s.in.group_handle = handle;
4624                 s.in.level = levels[i];
4625                 s.in.info = *r.out.info;
4626
4627 #if 0
4628                 /* disabled this, as it changes the name only from the point of view of samr,
4629                    but leaves the name from the point of view of w2k3 internals (and ldap). This means
4630                    the name is still reserved, so creating the old name fails, but deleting by the old name
4631                    also fails */
4632                 if (s.in.level == 2) {
4633                         init_lsa_String(&s.in.info->string, "NewName");
4634                 }
4635 #endif
4636
4637                 if (s.in.level == 4) {
4638                         init_lsa_String(&s.in.info->description, "test description");
4639                 }
4640
4641                 status = dcerpc_samr_SetGroupInfo(p, tctx, &s);
4642                 if (set_ok[i]) {
4643                         if (!NT_STATUS_IS_OK(status)) {
4644                                 torture_warning(tctx, "SetGroupInfo level %u failed - %s\n",
4645                                        r.in.level, nt_errstr(status));
4646                                 ret = false;
4647                                 continue;
4648                         }
4649                 } else {
4650                         if (!NT_STATUS_EQUAL(NT_STATUS_INVALID_INFO_CLASS, status)) {
4651                                 torture_warning(tctx, "SetGroupInfo level %u gave %s - should have been NT_STATUS_INVALID_INFO_CLASS\n",
4652                                        r.in.level, nt_errstr(status));
4653                                 ret = false;
4654                                 continue;
4655                         }
4656                 }
4657         }
4658
4659         return ret;
4660 }
4661
4662 static bool test_QueryUserInfo(struct dcerpc_pipe *p,
4663                                struct torture_context *tctx,
4664                                struct policy_handle *handle)
4665 {
4666         NTSTATUS status;
4667         struct samr_QueryUserInfo r;
4668         union samr_UserInfo *info;
4669         uint16_t levels[] = {1, 2, 3, 4, 5, 6, 7, 8, 9, 10,
4670                            11, 12, 13, 14, 16, 17, 20, 21};
4671         int i;
4672         bool ret = true;
4673
4674         for (i=0;i<ARRAY_SIZE(levels);i++) {
4675                 torture_comment(tctx, "Testing QueryUserInfo level %u\n", levels[i]);
4676
4677                 r.in.user_handle = handle;
4678                 r.in.level = levels[i];
4679                 r.out.info = &info;
4680
4681                 status = dcerpc_samr_QueryUserInfo(p, tctx, &r);
4682                 if (!NT_STATUS_IS_OK(status)) {
4683                         torture_warning(tctx, "QueryUserInfo level %u failed - %s\n",
4684                                levels[i], nt_errstr(status));
4685                         ret = false;
4686                 }
4687         }
4688
4689         return ret;
4690 }
4691
4692 static bool test_QueryUserInfo2(struct dcerpc_pipe *p,
4693                                 struct torture_context *tctx,
4694                                 struct policy_handle *handle)
4695 {
4696         NTSTATUS status;
4697         struct samr_QueryUserInfo2 r;
4698         union samr_UserInfo *info;
4699         uint16_t levels[] = {1, 2, 3, 4, 5, 6, 7, 8, 9, 10,
4700                            11, 12, 13, 14, 16, 17, 20, 21};
4701         int i;
4702         bool ret = true;
4703
4704         for (i=0;i<ARRAY_SIZE(levels);i++) {
4705                 torture_comment(tctx, "Testing QueryUserInfo2 level %u\n", levels[i]);
4706
4707                 r.in.user_handle = handle;
4708                 r.in.level = levels[i];
4709                 r.out.info = &info;
4710
4711                 status = dcerpc_samr_QueryUserInfo2(p, tctx, &r);
4712                 if (!NT_STATUS_IS_OK(status)) {
4713                         torture_warning(tctx, "QueryUserInfo2 level %u failed - %s\n",
4714                                levels[i], nt_errstr(status));
4715                         ret = false;
4716                 }
4717         }
4718
4719         return ret;
4720 }
4721
4722 static bool test_OpenUser(struct dcerpc_pipe *p,
4723                           struct torture_context *tctx,
4724                           struct policy_handle *handle, uint32_t rid)
4725 {
4726         NTSTATUS status;
4727         struct samr_OpenUser r;
4728         struct policy_handle user_handle;
4729         bool ret = true;
4730
4731         torture_comment(tctx, "Testing OpenUser(%u)\n", rid);
4732
4733         r.in.domain_handle = handle;
4734         r.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
4735         r.in.rid = rid;
4736         r.out.user_handle = &user_handle;
4737
4738         status = dcerpc_samr_OpenUser(p, tctx, &r);
4739         if (!NT_STATUS_IS_OK(status)) {
4740                 torture_warning(tctx, "OpenUser(%u) failed - %s\n", rid, nt_errstr(status));
4741                 return false;
4742         }
4743
4744         if (!test_QuerySecurity(p, tctx, &user_handle)) {
4745                 ret = false;
4746         }
4747
4748         if (!test_QueryUserInfo(p, tctx, &user_handle)) {
4749                 ret = false;
4750         }
4751
4752         if (!test_QueryUserInfo2(p, tctx, &user_handle)) {
4753                 ret = false;
4754         }
4755
4756         if (!test_GetUserPwInfo(p, tctx, &user_handle)) {
4757                 ret = false;
4758         }
4759
4760         if (!test_GetGroupsForUser(p,tctx, &user_handle)) {
4761                 ret = false;
4762         }
4763
4764         if (!test_samr_handle_Close(p, tctx, &user_handle)) {
4765                 ret = false;
4766         }
4767
4768         return ret;
4769 }
4770
4771 static bool test_OpenGroup(struct dcerpc_pipe *p,
4772                            struct torture_context *tctx,
4773                            struct policy_handle *handle, uint32_t rid)
4774 {
4775         NTSTATUS status;
4776         struct samr_OpenGroup r;
4777         struct policy_handle group_handle;
4778         bool ret = true;
4779
4780         torture_comment(tctx, "Testing OpenGroup(%u)\n", rid);
4781
4782         r.in.domain_handle = handle;
4783         r.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
4784         r.in.rid = rid;
4785         r.out.group_handle = &group_handle;
4786
4787         status = dcerpc_samr_OpenGroup(p, tctx, &r);
4788         if (!NT_STATUS_IS_OK(status)) {
4789                 torture_warning(tctx, "OpenGroup(%u) failed - %s\n", rid, nt_errstr(status));
4790                 return false;
4791         }
4792
4793         if (!torture_setting_bool(tctx, "samba3", false)) {
4794                 if (!test_QuerySecurity(p, tctx, &group_handle)) {
4795                         ret = false;
4796                 }
4797         }
4798
4799         if (!test_QueryGroupInfo(p, tctx, &group_handle)) {
4800                 ret = false;
4801         }
4802
4803         if (!test_QueryGroupMember(p, tctx, &group_handle)) {
4804                 ret = false;
4805         }
4806
4807         if (!test_samr_handle_Close(p, tctx, &group_handle)) {
4808                 ret = false;
4809         }
4810
4811         return ret;
4812 }
4813
4814 static bool test_OpenAlias(struct dcerpc_pipe *p, struct torture_context *tctx,
4815                            struct policy_handle *handle, uint32_t rid)
4816 {
4817         NTSTATUS status;
4818         struct samr_OpenAlias r;
4819         struct policy_handle alias_handle;
4820         bool ret = true;
4821
4822         torture_comment(tctx, "Testing OpenAlias(%u)\n", rid);
4823
4824         r.in.domain_handle = handle;
4825         r.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
4826         r.in.rid = rid;
4827         r.out.alias_handle = &alias_handle;
4828
4829         status = dcerpc_samr_OpenAlias(p, tctx, &r);
4830         if (!NT_STATUS_IS_OK(status)) {
4831                 torture_warning(tctx, "OpenAlias(%u) failed - %s\n", rid, nt_errstr(status));
4832                 return false;
4833         }
4834
4835         if (!torture_setting_bool(tctx, "samba3", false)) {
4836                 if (!test_QuerySecurity(p, tctx, &alias_handle)) {
4837                         ret = false;
4838                 }
4839         }
4840
4841         if (!test_QueryAliasInfo(p, tctx, &alias_handle)) {
4842                 ret = false;
4843         }
4844
4845         if (!test_GetMembersInAlias(p, tctx, &alias_handle)) {
4846                 ret = false;
4847         }
4848
4849         if (!test_samr_handle_Close(p, tctx, &alias_handle)) {
4850                 ret = false;
4851         }
4852
4853         return ret;
4854 }
4855
4856 static bool check_mask(struct dcerpc_pipe *p, struct torture_context *tctx,
4857                        struct policy_handle *handle, uint32_t rid,
4858                        uint32_t acct_flag_mask)
4859 {
4860         NTSTATUS status;
4861         struct samr_OpenUser r;
4862         struct samr_QueryUserInfo q;
4863         union samr_UserInfo *info;
4864         struct policy_handle user_handle;
4865         bool ret = true;
4866
4867         torture_comment(tctx, "Testing OpenUser(%u)\n", rid);
4868
4869         r.in.domain_handle = handle;
4870         r.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
4871         r.in.rid = rid;
4872         r.out.user_handle = &user_handle;
4873
4874         status = dcerpc_samr_OpenUser(p, tctx, &r);
4875         if (!NT_STATUS_IS_OK(status)) {
4876                 torture_warning(tctx, "OpenUser(%u) failed - %s\n", rid, nt_errstr(status));
4877                 return false;
4878         }
4879
4880         q.in.user_handle = &user_handle;
4881         q.in.level = 16;
4882         q.out.info = &info;
4883
4884         status = dcerpc_samr_QueryUserInfo(p, tctx, &q);
4885         if (!NT_STATUS_IS_OK(status)) {
4886                 torture_warning(tctx, "QueryUserInfo level 16 failed - %s\n",
4887                        nt_errstr(status));
4888                 ret = false;
4889         } else {
4890                 if ((acct_flag_mask & info->info16.acct_flags) == 0) {
4891                         torture_warning(tctx, "Server failed to filter for 0x%x, allowed 0x%x (%d) on EnumDomainUsers\n",
4892                                acct_flag_mask, info->info16.acct_flags, rid);
4893                         ret = false;
4894                 }
4895         }
4896
4897         if (!test_samr_handle_Close(p, tctx, &user_handle)) {
4898                 ret = false;
4899         }
4900
4901         return ret;
4902 }
4903
4904 static bool test_EnumDomainUsers_all(struct dcerpc_pipe *p,
4905                                      struct torture_context *tctx,
4906                                      struct policy_handle *handle)
4907 {
4908         NTSTATUS status = STATUS_MORE_ENTRIES;
4909         struct samr_EnumDomainUsers r;
4910         uint32_t mask, resume_handle=0;
4911         int i, mask_idx;
4912         bool ret = true;
4913         struct samr_LookupNames n;
4914         struct samr_LookupRids  lr ;
4915         struct lsa_Strings names;
4916         struct samr_Ids rids, types;
4917         struct samr_SamArray *sam = NULL;
4918         uint32_t num_entries = 0;
4919
4920         uint32_t masks[] = {ACB_NORMAL, ACB_DOMTRUST, ACB_WSTRUST,
4921                             ACB_DISABLED, ACB_NORMAL | ACB_DISABLED,
4922                             ACB_SVRTRUST | ACB_DOMTRUST | ACB_WSTRUST,
4923                             ACB_PWNOEXP, 0};
4924
4925         torture_comment(tctx, "Testing EnumDomainUsers\n");
4926
4927         for (mask_idx=0;mask_idx<ARRAY_SIZE(masks);mask_idx++) {
4928                 r.in.domain_handle = handle;
4929                 r.in.resume_handle = &resume_handle;
4930                 r.in.acct_flags = mask = masks[mask_idx];
4931                 r.in.max_size = (uint32_t)-1;
4932                 r.out.resume_handle = &resume_handle;
4933                 r.out.num_entries = &num_entries;
4934                 r.out.sam = &sam;
4935
4936                 status = dcerpc_samr_EnumDomainUsers(p, tctx, &r);
4937                 if (!NT_STATUS_EQUAL(status, STATUS_MORE_ENTRIES) &&
4938                     !NT_STATUS_IS_OK(status)) {
4939                         torture_warning(tctx, "EnumDomainUsers failed - %s\n", nt_errstr(status));
4940                         return false;
4941                 }
4942
4943                 torture_assert(tctx, sam, "EnumDomainUsers failed: r.out.sam unexpectedly NULL");
4944
4945                 if (sam->count == 0) {
4946                         continue;
4947                 }
4948
4949                 for (i=0;i<sam->count;i++) {
4950                         if (mask) {
4951                                 if (!check_mask(p, tctx, handle, sam->entries[i].idx, mask)) {
4952                                         ret = false;
4953                                 }
4954                         } else if (!test_OpenUser(p, tctx, handle, sam->entries[i].idx)) {
4955                                 ret = false;
4956                         }
4957                 }
4958         }
4959
4960         torture_comment(tctx, "Testing LookupNames\n");
4961         n.in.domain_handle = handle;
4962         n.in.num_names = sam->count;
4963         n.in.names = talloc_array(tctx, struct lsa_String, sam->count);
4964         n.out.rids = &rids;
4965         n.out.types = &types;
4966         for (i=0;i<sam->count;i++) {
4967                 n.in.names[i].string = sam->entries[i].name.string;
4968         }
4969         status = dcerpc_samr_LookupNames(p, tctx, &n);
4970         if (!NT_STATUS_IS_OK(status)) {
4971                 torture_warning(tctx, "LookupNames failed - %s\n", nt_errstr(status));
4972                 ret = false;
4973         }
4974
4975
4976         torture_comment(tctx, "Testing LookupRids\n");
4977         lr.in.domain_handle = handle;
4978         lr.in.num_rids = sam->count;
4979         lr.in.rids = talloc_array(tctx, uint32_t, sam->count);
4980         lr.out.names = &names;
4981         lr.out.types = &types;
4982         for (i=0;i<sam->count;i++) {
4983                 lr.in.rids[i] = sam->entries[i].idx;
4984         }
4985         status = dcerpc_samr_LookupRids(p, tctx, &lr);
4986         torture_assert_ntstatus_ok(tctx, status, "LookupRids");
4987
4988         return ret;
4989 }
4990
4991 /*
4992   try blasting the server with a bunch of sync requests
4993 */
4994 static bool test_EnumDomainUsers_async(struct dcerpc_pipe *p, struct torture_context *tctx,
4995                                        struct policy_handle *handle)
4996 {
4997         NTSTATUS status;
4998         struct samr_EnumDomainUsers r;
4999         uint32_t resume_handle=0;
5000         int i;
5001 #define ASYNC_COUNT 100
5002         struct rpc_request *req[ASYNC_COUNT];
5003
5004         if (!torture_setting_bool(tctx, "dangerous", false)) {
5005                 torture_skip(tctx, "samr async test disabled - enable dangerous tests to use\n");
5006         }
5007
5008         torture_comment(tctx, "Testing EnumDomainUsers_async\n");
5009
5010         r.in.domain_handle = handle;
5011         r.in.resume_handle = &resume_handle;
5012         r.in.acct_flags = 0;
5013         r.in.max_size = (uint32_t)-1;
5014         r.out.resume_handle = &resume_handle;
5015
5016         for (i=0;i<ASYNC_COUNT;i++) {
5017                 req[i] = dcerpc_samr_EnumDomainUsers_send(p, tctx, &r);
5018         }
5019
5020         for (i=0;i<ASYNC_COUNT;i++) {
5021                 status = dcerpc_ndr_request_recv(req[i]);
5022                 if (!NT_STATUS_IS_OK(status)) {
5023                         torture_warning(tctx, "EnumDomainUsers[%d] failed - %s\n",
5024                                i, nt_errstr(status));
5025                         return false;
5026                 }
5027         }
5028
5029         torture_comment(tctx, "%d async requests OK\n", i);
5030
5031         return true;
5032 }
5033
5034 static bool test_EnumDomainGroups_all(struct dcerpc_pipe *p,
5035                                       struct torture_context *tctx,
5036                                       struct policy_handle *handle)
5037 {
5038         NTSTATUS status;
5039         struct samr_EnumDomainGroups r;
5040         uint32_t resume_handle=0;
5041         struct samr_SamArray *sam = NULL;
5042         uint32_t num_entries = 0;
5043         int i;
5044         bool ret = true;
5045
5046         torture_comment(tctx, "Testing EnumDomainGroups\n");
5047
5048         r.in.domain_handle = handle;
5049         r.in.resume_handle = &resume_handle;
5050         r.in.max_size = (uint32_t)-1;
5051         r.out.resume_handle = &resume_handle;
5052         r.out.num_entries = &num_entries;
5053         r.out.sam = &sam;
5054
5055         status = dcerpc_samr_EnumDomainGroups(p, tctx, &r);
5056         if (!NT_STATUS_IS_OK(status)) {
5057                 torture_warning(tctx, "EnumDomainGroups failed - %s\n", nt_errstr(status));
5058                 return false;
5059         }
5060
5061         if (!sam) {
5062                 return false;
5063         }
5064
5065         for (i=0;i<sam->count;i++) {
5066                 if (!test_OpenGroup(p, tctx, handle, sam->entries[i].idx)) {
5067                         ret = false;
5068                 }
5069         }
5070
5071         return ret;
5072 }
5073
5074 static bool test_EnumDomainAliases_all(struct dcerpc_pipe *p,
5075                                        struct torture_context *tctx,
5076                                        struct policy_handle *handle)
5077 {
5078         NTSTATUS status;
5079         struct samr_EnumDomainAliases r;
5080         uint32_t resume_handle=0;
5081         struct samr_SamArray *sam = NULL;
5082         uint32_t num_entries = 0;
5083         int i;
5084         bool ret = true;
5085
5086         torture_comment(tctx, "Testing EnumDomainAliases\n");
5087
5088         r.in.domain_handle = handle;
5089         r.in.resume_handle = &resume_handle;
5090         r.in.max_size = (uint32_t)-1;
5091         r.out.sam = &sam;
5092         r.out.num_entries = &num_entries;
5093         r.out.resume_handle = &resume_handle;
5094
5095         status = dcerpc_samr_EnumDomainAliases(p, tctx, &r);
5096         if (!NT_STATUS_IS_OK(status)) {
5097                 torture_warning(tctx, "EnumDomainAliases failed - %s\n", nt_errstr(status));
5098                 return false;
5099         }
5100
5101         if (!sam) {
5102                 return false;
5103         }
5104
5105         for (i=0;i<sam->count;i++) {
5106                 if (!test_OpenAlias(p, tctx, handle, sam->entries[i].idx)) {
5107                         ret = false;
5108                 }
5109         }
5110
5111         return ret;
5112 }
5113
5114 static bool test_GetDisplayEnumerationIndex(struct dcerpc_pipe *p,
5115                                             struct torture_context *tctx,
5116                                             struct policy_handle *handle)
5117 {
5118         NTSTATUS status;
5119         struct samr_GetDisplayEnumerationIndex r;
5120         bool ret = true;
5121         uint16_t levels[] = {1, 2, 3, 4, 5};
5122         uint16_t ok_lvl[] = {1, 1, 1, 0, 0};
5123         struct lsa_String name;
5124         uint32_t idx = 0;
5125         int i;
5126
5127         for (i=0;i<ARRAY_SIZE(levels);i++) {
5128                 torture_comment(tctx, "Testing GetDisplayEnumerationIndex level %u\n", levels[i]);
5129
5130                 init_lsa_String(&name, TEST_ACCOUNT_NAME);
5131
5132                 r.in.domain_handle = handle;
5133                 r.in.level = levels[i];
5134                 r.in.name = &name;
5135                 r.out.idx = &idx;
5136
5137                 status = dcerpc_samr_GetDisplayEnumerationIndex(p, tctx, &r);
5138
5139                 if (ok_lvl[i] &&
5140                     !NT_STATUS_IS_OK(status) &&
5141                     !NT_STATUS_EQUAL(NT_STATUS_NO_MORE_ENTRIES, status)) {
5142                         torture_warning(tctx, "GetDisplayEnumerationIndex level %u failed - %s\n",
5143                                levels[i], nt_errstr(status));
5144                         ret = false;
5145                 }
5146
5147                 init_lsa_String(&name, "zzzzzzzz");
5148
5149                 status = dcerpc_samr_GetDisplayEnumerationIndex(p, tctx, &r);
5150
5151                 if (ok_lvl[i] && !NT_STATUS_EQUAL(NT_STATUS_NO_MORE_ENTRIES, status)) {
5152                         torture_warning(tctx, "GetDisplayEnumerationIndex level %u failed - %s\n",
5153                                levels[i], nt_errstr(status));
5154                         ret = false;
5155                 }
5156         }
5157
5158         return ret;
5159 }
5160
5161 static bool test_GetDisplayEnumerationIndex2(struct dcerpc_pipe *p,
5162                                              struct torture_context *tctx,
5163                                              struct policy_handle *handle)
5164 {
5165         NTSTATUS status;
5166         struct samr_GetDisplayEnumerationIndex2 r;
5167         bool ret = true;
5168         uint16_t levels[] = {1, 2, 3, 4, 5};
5169         uint16_t ok_lvl[] = {1, 1, 1, 0, 0};
5170         struct lsa_String name;
5171         uint32_t idx = 0;
5172         int i;
5173
5174         for (i=0;i<ARRAY_SIZE(levels);i++) {
5175                 torture_comment(tctx, "Testing GetDisplayEnumerationIndex2 level %u\n", levels[i]);
5176
5177                 init_lsa_String(&name, TEST_ACCOUNT_NAME);
5178
5179                 r.in.domain_handle = handle;
5180                 r.in.level = levels[i];
5181                 r.in.name = &name;
5182                 r.out.idx = &idx;
5183
5184                 status = dcerpc_samr_GetDisplayEnumerationIndex2(p, tctx, &r);
5185                 if (ok_lvl[i] &&
5186                     !NT_STATUS_IS_OK(status) &&
5187                     !NT_STATUS_EQUAL(NT_STATUS_NO_MORE_ENTRIES, status)) {
5188                         torture_warning(tctx, "GetDisplayEnumerationIndex2 level %u failed - %s\n",
5189                                levels[i], nt_errstr(status));
5190                         ret = false;
5191                 }
5192
5193                 init_lsa_String(&name, "zzzzzzzz");
5194
5195                 status = dcerpc_samr_GetDisplayEnumerationIndex2(p, tctx, &r);
5196                 if (ok_lvl[i] && !NT_STATUS_EQUAL(NT_STATUS_NO_MORE_ENTRIES, status)) {
5197                         torture_warning(tctx, "GetDisplayEnumerationIndex2 level %u failed - %s\n",
5198                                levels[i], nt_errstr(status));
5199                         ret = false;
5200                 }
5201         }
5202
5203         return ret;
5204 }
5205
5206 #define STRING_EQUAL_QUERY(s1, s2, user)                                        \
5207         if (s1.string == NULL && s2.string != NULL && s2.string[0] == '\0') { \
5208                 /* odd, but valid */                                            \
5209         } else if ((s1.string && !s2.string) || (s2.string && !s1.string) || strcmp(s1.string, s2.string)) { \
5210                         torture_warning(tctx, "%s mismatch for %s: %s != %s (%s)\n", \
5211                                #s1, user.string,  s1.string, s2.string, __location__);   \
5212                         ret = false; \
5213         }
5214 #define INT_EQUAL_QUERY(s1, s2, user)           \
5215                 if (s1 != s2) { \
5216                         torture_warning(tctx, "%s mismatch for %s: 0x%llx != 0x%llx (%s)\n", \
5217                                #s1, user.string, (unsigned long long)s1, (unsigned long long)s2, __location__); \
5218                         ret = false; \
5219                 }
5220
5221 static bool test_each_DisplayInfo_user(struct dcerpc_pipe *p,
5222                                        struct torture_context *tctx,
5223                                        struct samr_QueryDisplayInfo *querydisplayinfo,
5224                                        bool *seen_testuser)
5225 {
5226         struct samr_OpenUser r;
5227         struct samr_QueryUserInfo q;
5228         union samr_UserInfo *info;
5229         struct policy_handle user_handle;
5230         int i, ret = true;
5231         NTSTATUS status;
5232         r.in.domain_handle = querydisplayinfo->in.domain_handle;
5233         r.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
5234         for (i = 0; ; i++) {
5235                 switch (querydisplayinfo->in.level) {
5236                 case 1:
5237                         if (i >= querydisplayinfo->out.info->info1.count) {
5238                                 return ret;
5239                         }
5240                         r.in.rid = querydisplayinfo->out.info->info1.entries[i].rid;
5241                         break;
5242                 case 2:
5243                         if (i >= querydisplayinfo->out.info->info2.count) {
5244                                 return ret;
5245                         }
5246                         r.in.rid = querydisplayinfo->out.info->info2.entries[i].rid;
5247                         break;
5248                 case 3:
5249                         /* Groups */
5250                 case 4:
5251                 case 5:
5252                         /* Not interested in validating just the account name */
5253                         return true;
5254                 }
5255
5256                 r.out.user_handle = &user_handle;
5257
5258                 switch (querydisplayinfo->in.level) {
5259                 case 1:
5260                 case 2:
5261                         status = dcerpc_samr_OpenUser(p, tctx, &r);
5262                         if (!NT_STATUS_IS_OK(status)) {
5263                                 torture_warning(tctx, "OpenUser(%u) failed - %s\n", r.in.rid, nt_errstr(status));
5264                                 return false;
5265                         }
5266                 }
5267
5268                 q.in.user_handle = &user_handle;
5269                 q.in.level = 21;
5270                 q.out.info = &info;
5271                 status = dcerpc_samr_QueryUserInfo(p, tctx, &q);
5272                 if (!NT_STATUS_IS_OK(status)) {
5273                         torture_warning(tctx, "QueryUserInfo(%u) failed - %s\n", r.in.rid, nt_errstr(status));
5274                         return false;
5275                 }
5276
5277                 switch (querydisplayinfo->in.level) {
5278                 case 1:
5279                         if (seen_testuser && strcmp(info->info21.account_name.string, TEST_ACCOUNT_NAME) == 0) {
5280                                 *seen_testuser = true;
5281                         }
5282                         STRING_EQUAL_QUERY(querydisplayinfo->out.info->info1.entries[i].full_name,
5283                                            info->info21.full_name, info->info21.account_name);
5284                         STRING_EQUAL_QUERY(querydisplayinfo->out.info->info1.entries[i].account_name,
5285                                            info->info21.account_name, info->info21.account_name);
5286                         STRING_EQUAL_QUERY(querydisplayinfo->out.info->info1.entries[i].description,
5287                                            info->info21.description, info->info21.account_name);
5288                         INT_EQUAL_QUERY(querydisplayinfo->out.info->info1.entries[i].rid,
5289                                         info->info21.rid, info->info21.account_name);
5290                         INT_EQUAL_QUERY(querydisplayinfo->out.info->info1.entries[i].acct_flags,
5291                                         info->info21.acct_flags, info->info21.account_name);
5292
5293                         break;
5294                 case 2:
5295                         STRING_EQUAL_QUERY(querydisplayinfo->out.info->info2.entries[i].account_name,
5296                                            info->info21.account_name, info->info21.account_name);
5297                         STRING_EQUAL_QUERY(querydisplayinfo->out.info->info2.entries[i].description,
5298                                            info->info21.description, info->info21.account_name);
5299                         INT_EQUAL_QUERY(querydisplayinfo->out.info->info2.entries[i].rid,
5300                                         info->info21.rid, info->info21.account_name);
5301                         INT_EQUAL_QUERY((querydisplayinfo->out.info->info2.entries[i].acct_flags & ~ACB_NORMAL),
5302                                         info->info21.acct_flags, info->info21.account_name);
5303
5304                         if (!(querydisplayinfo->out.info->info2.entries[i].acct_flags & ACB_NORMAL)) {
5305                                 torture_warning(tctx, "Missing ACB_NORMAL in querydisplayinfo->out.info.info2.entries[i].acct_flags on %s\n",
5306                                        info->info21.account_name.string);
5307                         }
5308
5309                         if (!(info->info21.acct_flags & (ACB_WSTRUST | ACB_SVRTRUST))) {
5310                                 torture_warning(tctx, "Found non-trust account %s in trust account listing: 0x%x 0x%x\n",
5311                                        info->info21.account_name.string,
5312                                        querydisplayinfo->out.info->info2.entries[i].acct_flags,
5313                                        info->info21.acct_flags);
5314                                 return false;
5315                         }
5316
5317                         break;
5318                 }
5319
5320                 if (!test_samr_handle_Close(p, tctx, &user_handle)) {
5321                         return false;
5322                 }
5323         }
5324         return ret;
5325 }
5326
5327 static bool test_QueryDisplayInfo(struct dcerpc_pipe *p,
5328                                   struct torture_context *tctx,
5329                                   struct policy_handle *handle)
5330 {
5331         NTSTATUS status;
5332         struct samr_QueryDisplayInfo r;
5333         struct samr_QueryDomainInfo dom_info;
5334         union samr_DomainInfo *info = NULL;
5335         bool ret = true;
5336         uint16_t levels[] = {1, 2, 3, 4, 5};
5337         int i;
5338         bool seen_testuser = false;
5339         uint32_t total_size;
5340         uint32_t returned_size;
5341         union samr_DispInfo disp_info;
5342
5343
5344         for (i=0;i<ARRAY_SIZE(levels);i++) {
5345                 torture_comment(tctx, "Testing QueryDisplayInfo level %u\n", levels[i]);
5346
5347                 r.in.start_idx = 0;
5348                 status = STATUS_MORE_ENTRIES;
5349                 while (NT_STATUS_EQUAL(status, STATUS_MORE_ENTRIES)) {
5350                         r.in.domain_handle = handle;
5351                         r.in.level = levels[i];
5352                         r.in.max_entries = 2;
5353                         r.in.buf_size = (uint32_t)-1;
5354                         r.out.total_size = &total_size;
5355                         r.out.returned_size = &returned_size;
5356                         r.out.info = &disp_info;
5357
5358                         status = dcerpc_samr_QueryDisplayInfo(p, tctx, &r);
5359                         if (!NT_STATUS_EQUAL(status, STATUS_MORE_ENTRIES) && !NT_STATUS_IS_OK(status)) {
5360                                 torture_warning(tctx, "QueryDisplayInfo level %u failed - %s\n",
5361                                        levels[i], nt_errstr(status));
5362                                 ret = false;
5363                         }
5364                         switch (r.in.level) {
5365                         case 1:
5366                                 if (!test_each_DisplayInfo_user(p, tctx, &r, &seen_testuser)) {
5367                                         ret = false;
5368                                 }
5369                                 r.in.start_idx += r.out.info->info1.count;
5370                                 break;
5371                         case 2:
5372                                 if (!test_each_DisplayInfo_user(p, tctx, &r, NULL)) {
5373                                         ret = false;
5374                                 }
5375                                 r.in.start_idx += r.out.info->info2.count;
5376                                 break;
5377                         case 3:
5378                                 r.in.start_idx += r.out.info->info3.count;
5379                                 break;
5380                         case 4:
5381                                 r.in.start_idx += r.out.info->info4.count;
5382                                 break;
5383                         case 5:
5384                                 r.in.start_idx += r.out.info->info5.count;
5385                                 break;
5386                         }
5387                 }
5388                 dom_info.in.domain_handle = handle;
5389                 dom_info.in.level = 2;
5390                 dom_info.out.info = &info;
5391
5392                 /* Check number of users returned is correct */
5393                 status = dcerpc_samr_QueryDomainInfo(p, tctx, &dom_info);
5394                 if (!NT_STATUS_IS_OK(status)) {
5395                         torture_warning(tctx, "QueryDomainInfo level %u failed - %s\n",
5396                                r.in.level, nt_errstr(status));
5397                                 ret = false;
5398                                 break;
5399                 }
5400                 switch (r.in.level) {
5401                 case 1:
5402                 case 4:
5403                         if (info->general.num_users < r.in.start_idx) {
5404                                 torture_warning(tctx, "QueryDomainInfo indicates that QueryDisplayInfo returned more users (%d/%d) than the domain %s is said to contain!\n",
5405                                        r.in.start_idx, info->general.num_groups,
5406                                        info->general.domain_name.string);
5407                                 ret = false;
5408                         }
5409                         if (!seen_testuser) {
5410                                 struct policy_handle user_handle;
5411                                 if (NT_STATUS_IS_OK(test_OpenUser_byname(p, tctx, handle, TEST_ACCOUNT_NAME, &user_handle))) {
5412                                         torture_warning(tctx, "Didn't find test user " TEST_ACCOUNT_NAME " in enumeration of %s\n",
5413                                                info->general.domain_name.string);
5414                                         ret = false;
5415                                         test_samr_handle_Close(p, tctx, &user_handle);
5416                                 }
5417                         }
5418                         break;
5419                 case 3:
5420                 case 5:
5421                         if (info->general.num_groups != r.in.start_idx) {
5422                                 torture_warning(tctx, "QueryDomainInfo indicates that QueryDisplayInfo didn't return all (%d/%d) the groups in %s\n",
5423                                        r.in.start_idx, info->general.num_groups,
5424                                        info->general.domain_name.string);
5425                                 ret = false;
5426                         }
5427
5428                         break;
5429                 }
5430
5431         }
5432
5433         return ret;
5434 }
5435
5436 static bool test_QueryDisplayInfo2(struct dcerpc_pipe *p,
5437                                    struct torture_context *tctx,
5438                                    struct policy_handle *handle)
5439 {
5440         NTSTATUS status;
5441         struct samr_QueryDisplayInfo2 r;
5442         bool ret = true;
5443         uint16_t levels[] = {1, 2, 3, 4, 5};
5444         int i;
5445         uint32_t total_size;
5446         uint32_t returned_size;
5447         union samr_DispInfo info;
5448
5449         for (i=0;i<ARRAY_SIZE(levels);i++) {
5450                 torture_comment(tctx, "Testing QueryDisplayInfo2 level %u\n", levels[i]);
5451
5452                 r.in.domain_handle = handle;
5453                 r.in.level = levels[i];
5454                 r.in.start_idx = 0;
5455                 r.in.max_entries = 1000;
5456                 r.in.buf_size = (uint32_t)-1;
5457                 r.out.total_size = &total_size;
5458                 r.out.returned_size = &returned_size;
5459                 r.out.info = &info;
5460
5461                 status = dcerpc_samr_QueryDisplayInfo2(p, tctx, &r);
5462                 if (!NT_STATUS_IS_OK(status)) {
5463                         torture_warning(tctx, "QueryDisplayInfo2 level %u failed - %s\n",
5464                                levels[i], nt_errstr(status));
5465                         ret = false;
5466                 }
5467         }
5468
5469         return ret;
5470 }
5471
5472 static bool test_QueryDisplayInfo3(struct dcerpc_pipe *p, struct torture_context *tctx,
5473                                   struct policy_handle *handle)
5474 {
5475         NTSTATUS status;
5476         struct samr_QueryDisplayInfo3 r;
5477         bool ret = true;
5478         uint16_t levels[] = {1, 2, 3, 4, 5};
5479         int i;
5480         uint32_t total_size;
5481         uint32_t returned_size;
5482         union samr_DispInfo info;
5483
5484         for (i=0;i<ARRAY_SIZE(levels);i++) {
5485                 torture_comment(tctx, "Testing QueryDisplayInfo3 level %u\n", levels[i]);
5486
5487                 r.in.domain_handle = handle;
5488                 r.in.level = levels[i];
5489                 r.in.start_idx = 0;
5490                 r.in.max_entries = 1000;
5491                 r.in.buf_size = (uint32_t)-1;
5492                 r.out.total_size = &total_size;
5493                 r.out.returned_size = &returned_size;
5494                 r.out.info = &info;
5495
5496                 status = dcerpc_samr_QueryDisplayInfo3(p, tctx, &r);
5497                 if (!NT_STATUS_IS_OK(status)) {
5498                         torture_warning(tctx, "QueryDisplayInfo3 level %u failed - %s\n",
5499                                levels[i], nt_errstr(status));
5500                         ret = false;
5501                 }
5502         }
5503
5504         return ret;
5505 }
5506
5507
5508 static bool test_QueryDisplayInfo_continue(struct dcerpc_pipe *p,
5509                                            struct torture_context *tctx,
5510                                            struct policy_handle *handle)
5511 {
5512         NTSTATUS status;
5513         struct samr_QueryDisplayInfo r;
5514         bool ret = true;
5515         uint32_t total_size;
5516         uint32_t returned_size;
5517         union samr_DispInfo info;
5518
5519         torture_comment(tctx, "Testing QueryDisplayInfo continuation\n");
5520
5521         r.in.domain_handle = handle;
5522         r.in.level = 1;
5523         r.in.start_idx = 0;
5524         r.in.max_entries = 1;
5525         r.in.buf_size = (uint32_t)-1;
5526         r.out.total_size = &total_size;
5527         r.out.returned_size = &returned_size;
5528         r.out.info = &info;
5529
5530         do {
5531                 status = dcerpc_samr_QueryDisplayInfo(p, tctx, &r);
5532                 if (NT_STATUS_IS_OK(status) && *r.out.returned_size != 0) {
5533                         if (r.out.info->info1.entries[0].idx != r.in.start_idx + 1) {
5534                                 torture_warning(tctx, "expected idx %d but got %d\n",
5535                                        r.in.start_idx + 1,
5536                                        r.out.info->info1.entries[0].idx);
5537                                 break;
5538                         }
5539                 }
5540                 if (!NT_STATUS_EQUAL(status, STATUS_MORE_ENTRIES) &&
5541                     !NT_STATUS_IS_OK(status)) {
5542                         torture_warning(tctx, "QueryDisplayInfo level %u failed - %s\n",
5543                                r.in.level, nt_errstr(status));
5544                         ret = false;
5545                         break;
5546                 }
5547                 r.in.start_idx++;
5548         } while ((NT_STATUS_EQUAL(status, STATUS_MORE_ENTRIES) ||
5549                   NT_STATUS_IS_OK(status)) &&
5550                  *r.out.returned_size != 0);
5551
5552         return ret;
5553 }
5554
5555 static bool test_QueryDomainInfo(struct dcerpc_pipe *p, struct torture_context *tctx,
5556                                  struct policy_handle *handle)
5557 {
5558         NTSTATUS status;
5559         struct samr_QueryDomainInfo r;
5560         union samr_DomainInfo *info = NULL;
5561         struct samr_SetDomainInfo s;
5562         uint16_t levels[] = {1, 2, 3, 4, 5, 6, 7, 8, 9, 11, 12, 13};
5563         uint16_t set_ok[] = {1, 0, 1, 1, 0, 1, 1, 0, 1,  0,  1,  0};
5564         int i;
5565         bool ret = true;
5566         const char *domain_comment = talloc_asprintf(tctx,
5567                                   "Tortured by Samba4 RPC-SAMR: %s",
5568                                   timestring(tctx, time(NULL)));
5569
5570         s.in.domain_handle = handle;
5571         s.in.level = 4;
5572         s.in.info = talloc(tctx, union samr_DomainInfo);
5573
5574         s.in.info->oem.oem_information.string = domain_comment;
5575         status = dcerpc_samr_SetDomainInfo(p, tctx, &s);
5576         if (!NT_STATUS_IS_OK(status)) {
5577                 torture_warning(tctx, "SetDomainInfo level %u (set comment) failed - %s\n",
5578                        s.in.level, nt_errstr(status));
5579                 return false;
5580         }
5581
5582         for (i=0;i<ARRAY_SIZE(levels);i++) {
5583                 torture_comment(tctx, "Testing QueryDomainInfo level %u\n", levels[i]);
5584
5585                 r.in.domain_handle = handle;
5586                 r.in.level = levels[i];
5587                 r.out.info = &info;
5588
5589                 status = dcerpc_samr_QueryDomainInfo(p, tctx, &r);
5590                 if (!NT_STATUS_IS_OK(status)) {
5591                         torture_warning(tctx, "QueryDomainInfo level %u failed - %s\n",
5592                                r.in.level, nt_errstr(status));
5593                         ret = false;
5594                         continue;
5595                 }
5596
5597                 switch (levels[i]) {
5598                 case 2:
5599                         if (strcmp(info->general.oem_information.string, domain_comment) != 0) {
5600                                 torture_warning(tctx, "QueryDomainInfo level %u returned different oem_information (comment) (%s, expected %s)\n",
5601                                        levels[i], info->general.oem_information.string, domain_comment);
5602                                 if (!torture_setting_bool(tctx, "samba3", false)) {
5603                                         ret = false;
5604                                 }
5605                         }
5606                         if (!info->general.primary.string) {
5607                                 torture_warning(tctx, "QueryDomainInfo level %u returned no PDC name\n",
5608                                        levels[i]);
5609                                 ret = false;
5610                         } else if (info->general.role == SAMR_ROLE_DOMAIN_PDC) {
5611                                 if (dcerpc_server_name(p) && strcasecmp_m(dcerpc_server_name(p), info->general.primary.string) != 0) {
5612                                         torture_warning(tctx, "QueryDomainInfo level %u returned different PDC name (%s) compared to server name (%s), despite claiming to be the PDC\n",
5613                                                levels[i], info->general.primary.string, dcerpc_server_name(p));
5614                                 }
5615                         }
5616                         break;
5617                 case 4:
5618                         if (strcmp(info->oem.oem_information.string, domain_comment) != 0) {
5619                                 torture_warning(tctx, "QueryDomainInfo level %u returned different oem_information (comment) (%s, expected %s)\n",
5620                                        levels[i], info->oem.oem_information.string, domain_comment);
5621                                 if (!torture_setting_bool(tctx, "samba3", false)) {
5622                                         ret = false;
5623                                 }
5624                         }
5625                         break;
5626                 case 6:
5627                         if (!info->info6.primary.string) {
5628                                 torture_warning(tctx, "QueryDomainInfo level %u returned no PDC name\n",
5629                                        levels[i]);
5630                                 ret = false;
5631                         }
5632                         break;
5633                 case 11:
5634                         if (strcmp(info->general2.general.oem_information.string, domain_comment) != 0) {
5635                                 torture_warning(tctx, "QueryDomainInfo level %u returned different comment (%s, expected %s)\n",
5636                                        levels[i], info->general2.general.oem_information.string, domain_comment);
5637                                 if (!torture_setting_bool(tctx, "samba3", false)) {
5638                                         ret = false;
5639                                 }
5640                         }
5641                         break;
5642                 }
5643
5644                 torture_comment(tctx, "Testing SetDomainInfo level %u\n", levels[i]);
5645
5646                 s.in.domain_handle = handle;
5647                 s.in.level = levels[i];
5648                 s.in.info = info;
5649
5650                 status = dcerpc_samr_SetDomainInfo(p, tctx, &s);
5651                 if (set_ok[i]) {
5652                         if (!NT_STATUS_IS_OK(status)) {
5653                                 torture_warning(tctx, "SetDomainInfo level %u failed - %s\n",
5654                                        r.in.level, nt_errstr(status));
5655                                 ret = false;
5656                                 continue;
5657                         }
5658                 } else {
5659                         if (!NT_STATUS_EQUAL(NT_STATUS_INVALID_INFO_CLASS, status)) {
5660                                 torture_warning(tctx, "SetDomainInfo level %u gave %s - should have been NT_STATUS_INVALID_INFO_CLASS\n",
5661                                        r.in.level, nt_errstr(status));
5662                                 ret = false;
5663                                 continue;
5664                         }
5665                 }
5666
5667                 status = dcerpc_samr_QueryDomainInfo(p, tctx, &r);
5668                 if (!NT_STATUS_IS_OK(status)) {
5669                         torture_warning(tctx, "QueryDomainInfo level %u failed - %s\n",
5670                                r.in.level, nt_errstr(status));
5671                         ret = false;
5672                         continue;
5673                 }
5674         }
5675
5676         return ret;
5677 }
5678
5679
5680 static bool test_QueryDomainInfo2(struct dcerpc_pipe *p, struct torture_context *tctx,
5681                                   struct policy_handle *handle)
5682 {
5683         NTSTATUS status;
5684         struct samr_QueryDomainInfo2 r;
5685         union samr_DomainInfo *info = NULL;
5686         uint16_t levels[] = {1, 2, 3, 4, 5, 6, 7, 8, 9, 11, 12, 13};
5687         int i;
5688         bool ret = true;
5689
5690         for (i=0;i<ARRAY_SIZE(levels);i++) {
5691                 torture_comment(tctx, "Testing QueryDomainInfo2 level %u\n", levels[i]);
5692
5693                 r.in.domain_handle = handle;
5694                 r.in.level = levels[i];
5695                 r.out.info = &info;
5696
5697                 status = dcerpc_samr_QueryDomainInfo2(p, tctx, &r);
5698                 if (!NT_STATUS_IS_OK(status)) {
5699                         torture_warning(tctx, "QueryDomainInfo2 level %u failed - %s\n",
5700                                r.in.level, nt_errstr(status));
5701                         ret = false;
5702                         continue;
5703                 }
5704         }
5705
5706         return true;
5707 }
5708
5709 /* Test whether querydispinfo level 5 and enumdomgroups return the same
5710    set of group names. */
5711 static bool test_GroupList(struct dcerpc_pipe *p, struct torture_context *tctx,
5712                            struct policy_handle *handle)
5713 {
5714         struct samr_EnumDomainGroups q1;
5715         struct samr_QueryDisplayInfo q2;
5716         NTSTATUS status;
5717         uint32_t resume_handle=0;
5718         struct samr_SamArray *sam = NULL;
5719         uint32_t num_entries = 0;
5720         int i;
5721         bool ret = true;
5722         uint32_t total_size;
5723         uint32_t returned_size;
5724         union samr_DispInfo info;
5725
5726         int num_names = 0;
5727         const char **names = NULL;
5728
5729         torture_comment(tctx, "Testing coherency of querydispinfo vs enumdomgroups\n");
5730
5731         q1.in.domain_handle = handle;
5732         q1.in.resume_handle = &resume_handle;
5733         q1.in.max_size = 5;
5734         q1.out.resume_handle = &resume_handle;
5735         q1.out.num_entries = &num_entries;
5736         q1.out.sam = &sam;
5737
5738         status = STATUS_MORE_ENTRIES;
5739         while (NT_STATUS_EQUAL(status, STATUS_MORE_ENTRIES)) {
5740                 status = dcerpc_samr_EnumDomainGroups(p, tctx, &q1);
5741
5742                 if (!NT_STATUS_IS_OK(status) &&
5743                     !NT_STATUS_EQUAL(status, STATUS_MORE_ENTRIES))
5744                         break;
5745
5746                 for (i=0; i<*q1.out.num_entries; i++) {
5747                         add_string_to_array(tctx,
5748                                             sam->entries[i].name.string,
5749                                             &names, &num_names);
5750                 }
5751         }
5752
5753         torture_assert_ntstatus_ok(tctx, status, "EnumDomainGroups");
5754
5755         torture_assert(tctx, sam, "EnumDomainGroups failed to return sam");
5756
5757         q2.in.domain_handle = handle;
5758         q2.in.level = 5;
5759         q2.in.start_idx = 0;
5760         q2.in.max_entries = 5;
5761         q2.in.buf_size = (uint32_t)-1;
5762         q2.out.total_size = &total_size;
5763         q2.out.returned_size = &returned_size;
5764         q2.out.info = &info;
5765
5766         status = STATUS_MORE_ENTRIES;
5767         while (NT_STATUS_EQUAL(status, STATUS_MORE_ENTRIES)) {
5768                 status = dcerpc_samr_QueryDisplayInfo(p, tctx, &q2);
5769
5770                 if (!NT_STATUS_IS_OK(status) &&
5771                     !NT_STATUS_EQUAL(status, STATUS_MORE_ENTRIES))
5772                         break;
5773
5774                 for (i=0; i<q2.out.info->info5.count; i++) {
5775                         int j;
5776                         const char *name = q2.out.info->info5.entries[i].account_name.string;
5777                         bool found = false;
5778                         for (j=0; j<num_names; j++) {
5779                                 if (names[j] == NULL)
5780                                         continue;
5781                                 if (strequal(names[j], name)) {
5782                                         names[j] = NULL;
5783                                         found = true;
5784                                         break;
5785                                 }
5786                         }
5787
5788                         if (!found) {
5789                                 torture_warning(tctx, "QueryDisplayInfo gave name [%s] that EnumDomainGroups did not\n",
5790                                        name);
5791                                 ret = false;
5792                         }
5793                 }
5794                 q2.in.start_idx += q2.out.info->info5.count;
5795         }
5796
5797         if (!NT_STATUS_IS_OK(status)) {
5798                 torture_warning(tctx, "QueryDisplayInfo level 5 failed - %s\n",
5799                        nt_errstr(status));
5800                 ret = false;
5801         }
5802
5803         for (i=0; i<num_names; i++) {
5804                 if (names[i] != NULL) {
5805                         torture_warning(tctx, "EnumDomainGroups gave name [%s] that QueryDisplayInfo did not\n",
5806                                names[i]);
5807                         ret = false;
5808                 }
5809         }
5810
5811         return ret;
5812 }
5813
5814 static bool test_DeleteDomainGroup(struct dcerpc_pipe *p, struct torture_context *tctx,
5815                                    struct policy_handle *group_handle)
5816 {
5817         struct samr_DeleteDomainGroup d;
5818         NTSTATUS status;
5819
5820         torture_comment(tctx, "Testing DeleteDomainGroup\n");
5821
5822         d.in.group_handle = group_handle;
5823         d.out.group_handle = group_handle;
5824
5825         status = dcerpc_samr_DeleteDomainGroup(p, tctx, &d);
5826         torture_assert_ntstatus_ok(tctx, status, "DeleteDomainGroup");
5827
5828         return true;
5829 }
5830
5831 static bool test_TestPrivateFunctionsDomain(struct dcerpc_pipe *p, struct torture_context *tctx,
5832                                             struct policy_handle *domain_handle)
5833 {
5834         struct samr_TestPrivateFunctionsDomain r;
5835         NTSTATUS status;
5836         bool ret = true;
5837
5838         torture_comment(tctx, "Testing TestPrivateFunctionsDomain\n");
5839
5840         r.in.domain_handle = domain_handle;
5841
5842         status = dcerpc_samr_TestPrivateFunctionsDomain(p, tctx, &r);
5843         torture_assert_ntstatus_equal(tctx, status, NT_STATUS_NOT_IMPLEMENTED, "TestPrivateFunctionsDomain");
5844
5845         return ret;
5846 }
5847
5848 static bool test_RidToSid(struct dcerpc_pipe *p, struct torture_context *tctx,
5849                           struct dom_sid *domain_sid,
5850                           struct policy_handle *domain_handle)
5851 {
5852         struct samr_RidToSid r;
5853         NTSTATUS status;
5854         bool ret = true;
5855         struct dom_sid *calc_sid, *out_sid;
5856         int rids[] = { 0, 42, 512, 10200 };
5857         int i;
5858
5859         for (i=0;i<ARRAY_SIZE(rids);i++) {
5860                 torture_comment(tctx, "Testing RidToSid\n");
5861
5862                 calc_sid = dom_sid_dup(tctx, domain_sid);
5863                 r.in.domain_handle = domain_handle;
5864                 r.in.rid = rids[i];
5865                 r.out.sid = &out_sid;
5866
5867                 status = dcerpc_samr_RidToSid(p, tctx, &r);
5868                 if (!NT_STATUS_IS_OK(status)) {
5869                         torture_warning(tctx, "RidToSid for %d failed - %s\n", rids[i], nt_errstr(status));
5870                         ret = false;
5871                 } else {
5872                         calc_sid = dom_sid_add_rid(calc_sid, calc_sid, rids[i]);
5873
5874                         if (!dom_sid_equal(calc_sid, out_sid)) {
5875                                 torture_warning(tctx, "RidToSid for %d failed - got %s, expected %s\n", rids[i],
5876                                        dom_sid_string(tctx, out_sid),
5877                                        dom_sid_string(tctx, calc_sid));
5878                                 ret = false;
5879                         }
5880                 }
5881         }
5882
5883         return ret;
5884 }
5885
5886 static bool test_GetBootKeyInformation(struct dcerpc_pipe *p, struct torture_context *tctx,
5887                                        struct policy_handle *domain_handle)
5888 {
5889         struct samr_GetBootKeyInformation r;
5890         NTSTATUS status;
5891         bool ret = true;
5892         uint32_t unknown = 0;
5893
5894         torture_comment(tctx, "Testing GetBootKeyInformation\n");
5895
5896         r.in.domain_handle = domain_handle;
5897         r.out.unknown = &unknown;
5898
5899         status = dcerpc_samr_GetBootKeyInformation(p, tctx, &r);
5900         if (!NT_STATUS_IS_OK(status)) {
5901                 /* w2k3 seems to fail this sometimes and pass it sometimes */
5902                 torture_comment(tctx, "GetBootKeyInformation (ignored) - %s\n", nt_errstr(status));
5903         }
5904
5905         return ret;
5906 }
5907
5908 static bool test_AddGroupMember(struct dcerpc_pipe *p, struct torture_context *tctx,
5909                                 struct policy_handle *domain_handle,
5910                                 struct policy_handle *group_handle)
5911 {
5912         NTSTATUS status;
5913         struct samr_AddGroupMember r;
5914         struct samr_DeleteGroupMember d;
5915         struct samr_QueryGroupMember q;
5916         struct samr_RidTypeArray *rids = NULL;
5917         struct samr_SetMemberAttributesOfGroup s;
5918         uint32_t rid;
5919         bool found_member = false;
5920         int i;
5921
5922         status = test_LookupName(p, tctx, domain_handle, TEST_ACCOUNT_NAME, &rid);
5923         torture_assert_ntstatus_ok(tctx, status, "test_AddGroupMember looking up name " TEST_ACCOUNT_NAME);
5924
5925         r.in.group_handle = group_handle;
5926         r.in.rid = rid;
5927         r.in.flags = 0; /* ??? */
5928
5929         torture_comment(tctx, "Testing AddGroupMember, QueryGroupMember and DeleteGroupMember\n");
5930
5931         d.in.group_handle = group_handle;
5932         d.in.rid = rid;
5933
5934         status = dcerpc_samr_DeleteGroupMember(p, tctx, &d);
5935         torture_assert_ntstatus_equal(tctx, NT_STATUS_MEMBER_NOT_IN_GROUP, status, "DeleteGroupMember");
5936
5937         status = dcerpc_samr_AddGroupMember(p, tctx, &r);
5938         torture_assert_ntstatus_ok(tctx, status, "AddGroupMember");
5939
5940         status = dcerpc_samr_AddGroupMember(p, tctx, &r);
5941         torture_assert_ntstatus_equal(tctx, NT_STATUS_MEMBER_IN_GROUP, status, "AddGroupMember");
5942
5943         if (torture_setting_bool(tctx, "samba4", false) ||
5944             torture_setting_bool(tctx, "samba3", false)) {
5945                 torture_comment(tctx, "skipping SetMemberAttributesOfGroup test against Samba\n");
5946         } else {
5947                 /* this one is quite strange. I am using random inputs in the
5948                    hope of triggering an error that might give us a clue */
5949
5950                 s.in.group_handle = group_handle;
5951                 s.in.unknown1 = random();
5952                 s.in.unknown2 = random();
5953
5954                 status = dcerpc_samr_SetMemberAttributesOfGroup(p, tctx, &s);
5955                 torture_assert_ntstatus_ok(tctx, status, "SetMemberAttributesOfGroup");
5956         }
5957
5958         q.in.group_handle = group_handle;
5959         q.out.rids = &rids;
5960
5961         status = dcerpc_samr_QueryGroupMember(p, tctx, &q);
5962         torture_assert_ntstatus_ok(tctx, status, "QueryGroupMember");
5963         torture_assert(tctx, rids, "QueryGroupMember did not fill in rids structure");
5964
5965         for (i=0; i < rids->count; i++) {
5966                 if (rids->rids[i] == rid) {
5967                         found_member = true;
5968                 }
5969         }
5970
5971         torture_assert(tctx, found_member, "QueryGroupMember did not list newly added member");
5972
5973         status = dcerpc_samr_DeleteGroupMember(p, tctx, &d);
5974         torture_assert_ntstatus_ok(tctx, status, "DeleteGroupMember");
5975
5976         rids = NULL;
5977         found_member = false;
5978
5979         status = dcerpc_samr_QueryGroupMember(p, tctx, &q);
5980         torture_assert_ntstatus_ok(tctx, status, "QueryGroupMember");
5981         torture_assert(tctx, rids, "QueryGroupMember did not fill in rids structure");
5982
5983         for (i=0; i < rids->count; i++) {
5984                 if (rids->rids[i] == rid) {
5985                         found_member = true;
5986                 }
5987         }
5988
5989         torture_assert(tctx, !found_member, "QueryGroupMember does still list removed member");
5990
5991         status = dcerpc_samr_AddGroupMember(p, tctx, &r);
5992         torture_assert_ntstatus_ok(tctx, status, "AddGroupMember");
5993
5994         return true;
5995 }
5996
5997
5998 static bool test_CreateDomainGroup(struct dcerpc_pipe *p,
5999                                    struct torture_context *tctx,
6000                                    struct policy_handle *domain_handle,
6001                                    const char *group_name,
6002                                    struct policy_handle *group_handle,
6003                                    struct dom_sid *domain_sid,
6004                                    bool test_group)
6005 {
6006         NTSTATUS status;
6007         struct samr_CreateDomainGroup r;
6008         uint32_t rid;
6009         struct lsa_String name;
6010         bool ret = true;
6011
6012         init_lsa_String(&name, group_name);
6013
6014         r.in.domain_handle = domain_handle;
6015         r.in.name = &name;
6016         r.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
6017         r.out.group_handle = group_handle;
6018         r.out.rid = &rid;
6019
6020         torture_comment(tctx, "Testing CreateDomainGroup(%s)\n", r.in.name->string);
6021
6022         status = dcerpc_samr_CreateDomainGroup(p, tctx, &r);
6023
6024         if (dom_sid_equal(domain_sid, dom_sid_parse_talloc(tctx, SID_BUILTIN))) {
6025                 if (NT_STATUS_EQUAL(status, NT_STATUS_ACCESS_DENIED)) {
6026                         torture_comment(tctx, "Server correctly refused create of '%s'\n", r.in.name->string);
6027                         return true;
6028                 } else {
6029                         torture_warning(tctx, "Server should have refused create of '%s', got %s instead\n", r.in.name->string,
6030                                nt_errstr(status));
6031                         return false;
6032                 }
6033         }
6034
6035         if (NT_STATUS_EQUAL(status, NT_STATUS_GROUP_EXISTS)) {
6036                 if (!test_DeleteGroup_byname(p, tctx, domain_handle, r.in.name->string)) {
6037                         torture_warning(tctx, "CreateDomainGroup failed: Could not delete domain group %s - %s\n", r.in.name->string,
6038                                nt_errstr(status));
6039                         return false;
6040                 }
6041                 status = dcerpc_samr_CreateDomainGroup(p, tctx, &r);
6042         }
6043         if (NT_STATUS_EQUAL(status, NT_STATUS_USER_EXISTS)) {
6044                 if (!test_DeleteUser_byname(p, tctx, domain_handle, r.in.name->string)) {
6045
6046                         torture_warning(tctx, "CreateDomainGroup failed: Could not delete user %s - %s\n", r.in.name->string,
6047                                nt_errstr(status));
6048                         return false;
6049                 }
6050                 status = dcerpc_samr_CreateDomainGroup(p, tctx, &r);
6051         }
6052         torture_assert_ntstatus_ok(tctx, status, "CreateDomainGroup");
6053
6054         if (!test_group) {
6055                 return ret;
6056         }
6057
6058         if (!test_AddGroupMember(p, tctx, domain_handle, group_handle)) {
6059                 torture_warning(tctx, "CreateDomainGroup failed - %s\n", nt_errstr(status));
6060                 ret = false;
6061         }
6062
6063         if (!test_SetGroupInfo(p, tctx, group_handle)) {
6064                 ret = false;
6065         }
6066
6067         return ret;
6068 }
6069
6070
6071 /*
6072   its not totally clear what this does. It seems to accept any sid you like.
6073 */
6074 static bool test_RemoveMemberFromForeignDomain(struct dcerpc_pipe *p,
6075                                                struct torture_context *tctx,
6076                                                struct policy_handle *domain_handle)
6077 {
6078         NTSTATUS status;
6079         struct samr_RemoveMemberFromForeignDomain r;
6080
6081         r.in.domain_handle = domain_handle;
6082         r.in.sid = dom_sid_parse_talloc(tctx, "S-1-5-32-12-34-56-78");
6083
6084         status = dcerpc_samr_RemoveMemberFromForeignDomain(p, tctx, &r);
6085         torture_assert_ntstatus_ok(tctx, status, "RemoveMemberFromForeignDomain");
6086
6087         return true;
6088 }
6089
6090 static bool test_EnumDomainUsers(struct dcerpc_pipe *p,
6091                                  struct torture_context *tctx,
6092                                  struct policy_handle *domain_handle,
6093                                  uint32_t *total_num_entries_p)
6094 {
6095         NTSTATUS status;
6096         struct samr_EnumDomainUsers r;
6097         uint32_t resume_handle = 0;
6098         uint32_t num_entries = 0;
6099         uint32_t total_num_entries = 0;
6100         struct samr_SamArray *sam;
6101
6102         r.in.domain_handle = domain_handle;
6103         r.in.acct_flags = 0;
6104         r.in.max_size = (uint32_t)-1;
6105         r.in.resume_handle = &resume_handle;
6106
6107         r.out.sam = &sam;
6108         r.out.num_entries = &num_entries;
6109         r.out.resume_handle = &resume_handle;
6110
6111         torture_comment(tctx, "Testing EnumDomainUsers\n");
6112
6113         do {
6114                 status = dcerpc_samr_EnumDomainUsers(p, tctx, &r);
6115                 if (NT_STATUS_IS_ERR(status)) {
6116                         torture_assert_ntstatus_ok(tctx, status,
6117                                 "failed to enumerate users");
6118                 }
6119
6120                 total_num_entries += num_entries;
6121         } while (NT_STATUS_EQUAL(status, STATUS_MORE_ENTRIES));
6122
6123         if (total_num_entries_p) {
6124                 *total_num_entries_p = total_num_entries;
6125         }
6126
6127         return true;
6128 }
6129
6130 static bool test_EnumDomainGroups(struct dcerpc_pipe *p,
6131                                   struct torture_context *tctx,
6132                                   struct policy_handle *domain_handle,
6133                                   uint32_t *total_num_entries_p)
6134 {
6135         NTSTATUS status;
6136         struct samr_EnumDomainGroups r;
6137         uint32_t resume_handle = 0;
6138         uint32_t num_entries = 0;
6139         uint32_t total_num_entries = 0;
6140         struct samr_SamArray *sam;
6141
6142         r.in.domain_handle = domain_handle;
6143         r.in.max_size = (uint32_t)-1;
6144         r.in.resume_handle = &resume_handle;
6145
6146         r.out.sam = &sam;
6147         r.out.num_entries = &num_entries;
6148         r.out.resume_handle = &resume_handle;
6149
6150         torture_comment(tctx, "Testing EnumDomainGroups\n");
6151
6152         do {
6153                 status = dcerpc_samr_EnumDomainGroups(p, tctx, &r);
6154                 if (NT_STATUS_IS_ERR(status)) {
6155                         torture_assert_ntstatus_ok(tctx, status,
6156                                 "failed to enumerate groups");
6157                 }
6158
6159                 total_num_entries += num_entries;
6160         } while (NT_STATUS_EQUAL(status, STATUS_MORE_ENTRIES));
6161
6162         if (total_num_entries_p) {
6163                 *total_num_entries_p = total_num_entries;
6164         }
6165
6166         return true;
6167 }
6168
6169 static bool test_EnumDomainAliases(struct dcerpc_pipe *p,
6170                                    struct torture_context *tctx,
6171                                    struct policy_handle *domain_handle,
6172                                    uint32_t *total_num_entries_p)
6173 {
6174         NTSTATUS status;
6175         struct samr_EnumDomainAliases r;
6176         uint32_t resume_handle = 0;
6177         uint32_t num_entries = 0;
6178         uint32_t total_num_entries = 0;
6179         struct samr_SamArray *sam;
6180
6181         r.in.domain_handle = domain_handle;
6182         r.in.max_size = (uint32_t)-1;
6183         r.in.resume_handle = &resume_handle;
6184
6185         r.out.sam = &sam;
6186         r.out.num_entries = &num_entries;
6187         r.out.resume_handle = &resume_handle;
6188
6189         torture_comment(tctx, "Testing EnumDomainAliases\n");
6190
6191         do {
6192                 status = dcerpc_samr_EnumDomainAliases(p, tctx, &r);
6193                 if (NT_STATUS_IS_ERR(status)) {
6194                         torture_assert_ntstatus_ok(tctx, status,
6195                                 "failed to enumerate aliases");
6196                 }
6197
6198                 total_num_entries += num_entries;
6199         } while (NT_STATUS_EQUAL(status, STATUS_MORE_ENTRIES));
6200
6201         if (total_num_entries_p) {
6202                 *total_num_entries_p = total_num_entries;
6203         }
6204
6205         return true;
6206 }
6207
6208 static bool test_QueryDisplayInfo_level(struct dcerpc_pipe *p,
6209                                         struct torture_context *tctx,
6210                                         struct policy_handle *handle,
6211                                         uint16_t level,
6212                                         uint32_t *total_num_entries_p)
6213 {
6214         NTSTATUS status;
6215         struct samr_QueryDisplayInfo r;
6216         uint32_t total_num_entries = 0;
6217
6218         r.in.domain_handle = handle;
6219         r.in.level = level;
6220         r.in.start_idx = 0;
6221         r.in.max_entries = (uint32_t)-1;
6222         r.in.buf_size = (uint32_t)-1;
6223
6224         torture_comment(tctx, "Testing QueryDisplayInfo\n");
6225
6226         do {
6227                 uint32_t total_size;
6228                 uint32_t returned_size;
6229                 union samr_DispInfo info;
6230
6231                 r.out.total_size = &total_size;
6232                 r.out.returned_size = &returned_size;
6233                 r.out.info = &info;
6234
6235                 status = dcerpc_samr_QueryDisplayInfo(p, tctx, &r);
6236                 if (NT_STATUS_IS_ERR(status)) {
6237                         torture_assert_ntstatus_ok(tctx, status,
6238                                 "failed to query displayinfo");
6239                 }
6240
6241                 if (*r.out.returned_size == 0) {
6242                         break;
6243                 }
6244
6245                 switch (r.in.level) {
6246                 case 1:
6247                         total_num_entries += info.info1.count;
6248                         r.in.start_idx += info.info1.entries[info.info1.count - 1].idx + 1;
6249                         break;
6250                 case 2:
6251                         total_num_entries += info.info2.count;
6252                         r.in.start_idx += info.info2.entries[info.info2.count - 1].idx + 1;
6253                         break;
6254                 case 3:
6255                         total_num_entries += info.info3.count;
6256                         r.in.start_idx += info.info3.entries[info.info3.count - 1].idx + 1;
6257                         break;
6258                 case 4:
6259                         total_num_entries += info.info4.count;
6260                         r.in.start_idx += info.info4.entries[info.info4.count - 1].idx + 1;
6261                         break;
6262                 case 5:
6263                         total_num_entries += info.info5.count;
6264                         r.in.start_idx += info.info5.entries[info.info5.count - 1].idx + 1;
6265                         break;
6266                 default:
6267                         return false;
6268                 }
6269
6270         } while (NT_STATUS_EQUAL(status, STATUS_MORE_ENTRIES));
6271
6272         if (total_num_entries_p) {
6273                 *total_num_entries_p = total_num_entries;
6274         }
6275
6276         return true;
6277 }
6278
6279 static bool test_ManyObjects(struct dcerpc_pipe *p,
6280                              struct torture_context *tctx,
6281                              struct policy_handle *domain_handle,
6282                              struct dom_sid *domain_sid,
6283                              struct torture_samr_context *ctx)
6284 {
6285         uint32_t num_total = ctx->num_objects_large_dc;
6286         uint32_t num_enum = 0;
6287         uint32_t num_disp = 0;
6288         uint32_t num_created = 0;
6289         uint32_t num_anounced = 0;
6290         bool ret = true;
6291         NTSTATUS status;
6292         uint32_t i;
6293
6294         struct policy_handle *handles = talloc_zero_array(tctx, struct policy_handle, num_total);
6295
6296         /* query */
6297
6298         {
6299                 struct samr_QueryDomainInfo2 r;
6300                 union samr_DomainInfo *info;
6301                 r.in.domain_handle = domain_handle;
6302                 r.in.level = 2;
6303                 r.out.info = &info;
6304
6305                 status = dcerpc_samr_QueryDomainInfo2(p, tctx, &r);
6306                 torture_assert_ntstatus_ok(tctx, status,
6307                         "failed to query domain info");
6308
6309                 switch (ctx->choice) {
6310                 case TORTURE_SAMR_MANY_ACCOUNTS:
6311                         num_anounced = info->general.num_users;
6312                         break;
6313                 case TORTURE_SAMR_MANY_GROUPS:
6314                         num_anounced = info->general.num_groups;
6315                         break;
6316                 case TORTURE_SAMR_MANY_ALIASES:
6317                         num_anounced = info->general.num_aliases;
6318                         break;
6319                 default:
6320                         return false;
6321                 }
6322         }
6323
6324         /* create */
6325
6326         for (i=0; i < num_total; i++) {
6327
6328                 const char *name = NULL;
6329
6330                 switch (ctx->choice) {
6331                 case TORTURE_SAMR_MANY_ACCOUNTS:
6332                         name = talloc_asprintf(tctx, "%s%04d", TEST_ACCOUNT_NAME, i);
6333                         ret &= test_CreateUser(p, tctx, domain_handle, name, &handles[i], domain_sid, 0, NULL, false);
6334                         break;
6335                 case TORTURE_SAMR_MANY_GROUPS:
6336                         name = talloc_asprintf(tctx, "%s%04d", TEST_GROUPNAME, i);
6337                         ret &= test_CreateDomainGroup(p, tctx, domain_handle, name, &handles[i], domain_sid, false);
6338                         break;
6339                 case TORTURE_SAMR_MANY_ALIASES:
6340                         name = talloc_asprintf(tctx, "%s%04d", TEST_ALIASNAME, i);
6341                         ret &= test_CreateAlias(p, tctx, domain_handle, name, &handles[i], domain_sid, false);
6342                         break;
6343                 default:
6344                         return false;
6345                 }
6346                 if (!policy_handle_empty(&handles[i])) {
6347                         num_created++;
6348                 }
6349         }
6350
6351         /* enum */
6352
6353         switch (ctx->choice) {
6354         case TORTURE_SAMR_MANY_ACCOUNTS:
6355                 ret &= test_EnumDomainUsers(p, tctx, domain_handle, &num_enum);
6356                 break;
6357         case TORTURE_SAMR_MANY_GROUPS:
6358                 ret &= test_EnumDomainGroups(p, tctx, domain_handle, &num_enum);
6359                 break;
6360         case TORTURE_SAMR_MANY_ALIASES:
6361                 ret &= test_EnumDomainAliases(p, tctx, domain_handle, &num_enum);
6362                 break;
6363         default:
6364                 return false;
6365         }
6366
6367         /* dispinfo */
6368
6369         switch (ctx->choice) {
6370         case TORTURE_SAMR_MANY_ACCOUNTS:
6371                 ret &= test_QueryDisplayInfo_level(p, tctx, domain_handle, 1, &num_disp);
6372                 break;
6373         case TORTURE_SAMR_MANY_GROUPS:
6374                 ret &= test_QueryDisplayInfo_level(p, tctx, domain_handle, 3, &num_disp);
6375                 break;
6376         case TORTURE_SAMR_MANY_ALIASES:
6377                 /* no aliases in dispinfo */
6378                 break;
6379         default:
6380                 return false;
6381         }
6382
6383         /* close or delete */
6384
6385         for (i=0; i < num_total; i++) {
6386
6387                 if (policy_handle_empty(&handles[i])) {
6388                         continue;
6389                 }
6390
6391                 if (torture_setting_bool(tctx, "samba3", false)) {
6392                         ret &= test_samr_handle_Close(p, tctx, &handles[i]);
6393                 } else {
6394                         switch (ctx->choice) {
6395                         case TORTURE_SAMR_MANY_ACCOUNTS:
6396                                 ret &= test_DeleteUser(p, tctx, &handles[i]);
6397                                 break;
6398                         case TORTURE_SAMR_MANY_GROUPS:
6399                                 ret &= test_DeleteDomainGroup(p, tctx, &handles[i]);
6400                                 break;
6401                         case TORTURE_SAMR_MANY_ALIASES:
6402                                 ret &= test_DeleteAlias(p, tctx, &handles[i]);
6403                                 break;
6404                         default:
6405                                 return false;
6406                         }
6407                 }
6408         }
6409
6410         talloc_free(handles);
6411
6412         if (ctx->choice == TORTURE_SAMR_MANY_ACCOUNTS && num_enum != num_anounced + num_created) {
6413                 torture_comment(tctx,
6414                                 "unexpected number of results (%u) returned in enum call, expected %u\n",
6415                                 num_enum, num_anounced + num_created);
6416
6417                 torture_comment(tctx,
6418                                 "unexpected number of results (%u) returned in dispinfo, call, expected %u\n",
6419                                 num_disp, num_anounced + num_created);
6420         }
6421         return ret;
6422 }
6423
6424 static bool test_Connect(struct dcerpc_pipe *p, struct torture_context *tctx,
6425                          struct policy_handle *handle);
6426
6427 static bool test_OpenDomain(struct dcerpc_pipe *p, struct torture_context *tctx,
6428                             struct torture_samr_context *ctx, struct dom_sid *sid)
6429 {
6430         NTSTATUS status;
6431         struct samr_OpenDomain r;
6432         struct policy_handle domain_handle;
6433         struct policy_handle alias_handle;
6434         struct policy_handle user_handle;
6435         struct policy_handle group_handle;
6436         bool ret = true;
6437
6438         ZERO_STRUCT(alias_handle);
6439         ZERO_STRUCT(user_handle);
6440         ZERO_STRUCT(group_handle);
6441         ZERO_STRUCT(domain_handle);
6442
6443         torture_comment(tctx, "Testing OpenDomain of %s\n", dom_sid_string(tctx, sid));
6444
6445         r.in.connect_handle = &ctx->handle;
6446         r.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
6447         r.in.sid = sid;
6448         r.out.domain_handle = &domain_handle;
6449
6450         status = dcerpc_samr_OpenDomain(p, tctx, &r);
6451         torture_assert_ntstatus_ok(tctx, status, "OpenDomain");
6452
6453         /* run the domain tests with the main handle closed - this tests
6454            the servers reference counting */
6455         torture_assert(tctx, test_samr_handle_Close(p, tctx, &ctx->handle), "Failed to close SAMR handle");
6456
6457         switch (ctx->choice) {
6458         case TORTURE_SAMR_PASSWORDS:
6459         case TORTURE_SAMR_USER_PRIVILEGES:
6460                 if (!torture_setting_bool(tctx, "samba3", false)) {
6461                         ret &= test_CreateUser2(p, tctx, &domain_handle, sid, ctx->choice, NULL);
6462                 }
6463                 ret &= test_CreateUser(p, tctx, &domain_handle, TEST_ACCOUNT_NAME, &user_handle, sid, ctx->choice, NULL, true);
6464                 if (!ret) {
6465                         torture_warning(tctx, "Testing PASSWORDS or PRIVILEGES on domain %s failed!\n", dom_sid_string(tctx, sid));
6466                 }
6467                 break;
6468         case TORTURE_SAMR_USER_ATTRIBUTES:
6469                 if (!torture_setting_bool(tctx, "samba3", false)) {
6470                         ret &= test_CreateUser2(p, tctx, &domain_handle, sid, ctx->choice, NULL);
6471                 }
6472                 ret &= test_CreateUser(p, tctx, &domain_handle, TEST_ACCOUNT_NAME, &user_handle, sid, ctx->choice, NULL, true);
6473                 /* This test needs 'complex' users to validate */
6474                 ret &= test_QueryDisplayInfo(p, tctx, &domain_handle);
6475                 if (!ret) {
6476                         torture_warning(tctx, "Testing ATTRIBUTES on domain %s failed!\n", dom_sid_string(tctx, sid));
6477                 }
6478                 break;
6479         case TORTURE_SAMR_PASSWORDS_PWDLASTSET:
6480                 if (!torture_setting_bool(tctx, "samba3", false)) {
6481                         ret &= test_CreateUser2(p, tctx, &domain_handle, sid, ctx->choice, ctx->machine_credentials);
6482                 }
6483                 ret &= test_CreateUser(p, tctx, &domain_handle, TEST_ACCOUNT_NAME, &user_handle, sid, ctx->choice, ctx->machine_credentials, true);
6484                 if (!ret) {
6485                         torture_warning(tctx, "Testing PASSWORDS PWDLASTSET on domain %s failed!\n", dom_sid_string(tctx, sid));
6486                 }
6487                 break;
6488         case TORTURE_SAMR_MANY_ACCOUNTS:
6489         case TORTURE_SAMR_MANY_GROUPS:
6490         case TORTURE_SAMR_MANY_ALIASES:
6491                 ret &= test_ManyObjects(p, tctx, &domain_handle, sid, ctx);
6492                 if (!ret) {
6493                         torture_warning(tctx, "Testing MANY-{ACCOUNTS,GROUPS,ALIASES} on domain %s failed!\n", dom_sid_string(tctx, sid));
6494                 }
6495                 break;
6496         case TORTURE_SAMR_OTHER:
6497                 ret &= test_CreateUser(p, tctx, &domain_handle, TEST_ACCOUNT_NAME, &user_handle, sid, ctx->choice, NULL, true);
6498                 if (!ret) {
6499                         torture_warning(tctx, "Failed to CreateUser in SAMR-OTHER on domain %s!\n", dom_sid_string(tctx, sid));
6500                 }
6501                 if (!torture_setting_bool(tctx, "samba3", false)) {
6502                         ret &= test_QuerySecurity(p, tctx, &domain_handle);
6503                 }
6504                 ret &= test_RemoveMemberFromForeignDomain(p, tctx, &domain_handle);
6505                 ret &= test_CreateAlias(p, tctx, &domain_handle, TEST_ALIASNAME, &alias_handle, sid, true);
6506                 ret &= test_CreateDomainGroup(p, tctx, &domain_handle, TEST_GROUPNAME, &group_handle, sid, true);
6507                 ret &= test_QueryDomainInfo(p, tctx, &domain_handle);
6508                 ret &= test_QueryDomainInfo2(p, tctx, &domain_handle);
6509                 ret &= test_EnumDomainUsers_all(p, tctx, &domain_handle);
6510                 ret &= test_EnumDomainUsers_async(p, tctx, &domain_handle);
6511                 ret &= test_EnumDomainGroups_all(p, tctx, &domain_handle);
6512                 ret &= test_EnumDomainAliases_all(p, tctx, &domain_handle);
6513                 ret &= test_QueryDisplayInfo2(p, tctx, &domain_handle);
6514                 ret &= test_QueryDisplayInfo3(p, tctx, &domain_handle);
6515                 ret &= test_QueryDisplayInfo_continue(p, tctx, &domain_handle);
6516
6517                 if (torture_setting_bool(tctx, "samba4", false)) {
6518                         torture_comment(tctx, "skipping GetDisplayEnumerationIndex test against Samba4\n");
6519                 } else {
6520                         ret &= test_GetDisplayEnumerationIndex(p, tctx, &domain_handle);
6521                         ret &= test_GetDisplayEnumerationIndex2(p, tctx, &domain_handle);
6522                 }
6523                 ret &= test_GroupList(p, tctx, &domain_handle);
6524                 ret &= test_TestPrivateFunctionsDomain(p, tctx, &domain_handle);
6525                 ret &= test_RidToSid(p, tctx, sid, &domain_handle);
6526                 ret &= test_GetBootKeyInformation(p, tctx, &domain_handle);
6527                 if (!ret) {
6528                         torture_comment(tctx, "Testing SAMR-OTHER on domain %s failed!\n", dom_sid_string(tctx, sid));
6529                 }
6530                 break;
6531         }
6532
6533         if (!policy_handle_empty(&user_handle) &&
6534             !test_DeleteUser(p, tctx, &user_handle)) {
6535                 ret = false;
6536         }
6537
6538         if (!policy_handle_empty(&alias_handle) &&
6539             !test_DeleteAlias(p, tctx, &alias_handle)) {
6540                 ret = false;
6541         }
6542
6543         if (!policy_handle_empty(&group_handle) &&
6544             !test_DeleteDomainGroup(p, tctx, &group_handle)) {
6545                 ret = false;
6546         }
6547
6548         torture_assert(tctx, test_samr_handle_Close(p, tctx, &domain_handle), "Failed to close SAMR domain handle");
6549
6550         torture_assert(tctx, test_Connect(p, tctx, &ctx->handle), "Faile to re-connect SAMR handle");
6551         /* reconnect the main handle */
6552
6553         if (!ret) {
6554                 torture_warning(tctx, "Testing domain %s failed!\n", dom_sid_string(tctx, sid));
6555         }
6556
6557         return ret;
6558 }
6559
6560 static bool test_LookupDomain(struct dcerpc_pipe *p, struct torture_context *tctx,
6561                               struct torture_samr_context *ctx, const char *domain)
6562 {
6563         NTSTATUS status;
6564         struct samr_LookupDomain r;
6565         struct dom_sid2 *sid = NULL;
6566         struct lsa_String n1;
6567         struct lsa_String n2;
6568         bool ret = true;
6569
6570         torture_comment(tctx, "Testing LookupDomain(%s)\n", domain);
6571
6572         /* check for correct error codes */
6573         r.in.connect_handle = &ctx->handle;
6574         r.in.domain_name = &n2;
6575         r.out.sid = &sid;
6576         n2.string = NULL;
6577
6578         status = dcerpc_samr_LookupDomain(p, tctx, &r);
6579         torture_assert_ntstatus_equal(tctx, NT_STATUS_INVALID_PARAMETER, status, "LookupDomain expected NT_STATUS_INVALID_PARAMETER");
6580
6581         init_lsa_String(&n2, "xxNODOMAINxx");
6582
6583         status = dcerpc_samr_LookupDomain(p, tctx, &r);
6584         torture_assert_ntstatus_equal(tctx, NT_STATUS_NO_SUCH_DOMAIN, status, "LookupDomain expected NT_STATUS_NO_SUCH_DOMAIN");
6585
6586         r.in.connect_handle = &ctx->handle;
6587
6588         init_lsa_String(&n1, domain);
6589         r.in.domain_name = &n1;
6590
6591         status = dcerpc_samr_LookupDomain(p, tctx, &r);
6592         torture_assert_ntstatus_ok(tctx, status, "LookupDomain");
6593
6594         if (!test_GetDomPwInfo(p, tctx, &n1)) {
6595                 ret = false;
6596         }
6597
6598         if (!test_OpenDomain(p, tctx, ctx, *r.out.sid)) {
6599                 ret = false;
6600         }
6601
6602         return ret;
6603 }
6604
6605
6606 static bool test_EnumDomains(struct dcerpc_pipe *p, struct torture_context *tctx,
6607                              struct torture_samr_context *ctx)
6608 {
6609         NTSTATUS status;
6610         struct samr_EnumDomains r;
6611         uint32_t resume_handle = 0;
6612         uint32_t num_entries = 0;
6613         struct samr_SamArray *sam = NULL;
6614         int i;
6615         bool ret = true;
6616
6617         r.in.connect_handle = &ctx->handle;
6618         r.in.resume_handle = &resume_handle;
6619         r.in.buf_size = (uint32_t)-1;
6620         r.out.resume_handle = &resume_handle;
6621         r.out.num_entries = &num_entries;
6622         r.out.sam = &sam;
6623
6624         status = dcerpc_samr_EnumDomains(p, tctx, &r);
6625         torture_assert_ntstatus_ok(tctx, status, "EnumDomains");
6626
6627         if (!*r.out.sam) {
6628                 return false;
6629         }
6630
6631         for (i=0;i<sam->count;i++) {
6632                 if (!test_LookupDomain(p, tctx, ctx,
6633                                        sam->entries[i].name.string)) {
6634                         ret = false;
6635                 }
6636         }
6637
6638         status = dcerpc_samr_EnumDomains(p, tctx, &r);
6639         torture_assert_ntstatus_ok(tctx, status, "EnumDomains");
6640
6641         return ret;
6642 }
6643
6644
6645 static bool test_Connect(struct dcerpc_pipe *p, struct torture_context *tctx,
6646                          struct policy_handle *handle)
6647 {
6648         NTSTATUS status;
6649         struct samr_Connect r;
6650         struct samr_Connect2 r2;
6651         struct samr_Connect3 r3;
6652         struct samr_Connect4 r4;
6653         struct samr_Connect5 r5;
6654         union samr_ConnectInfo info;
6655         struct policy_handle h;
6656         uint32_t level_out = 0;
6657         bool ret = true, got_handle = false;
6658
6659         torture_comment(tctx, "testing samr_Connect\n");
6660
6661         r.in.system_name = 0;
6662         r.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
6663         r.out.connect_handle = &h;
6664
6665         status = dcerpc_samr_Connect(p, tctx, &r);
6666         if (!NT_STATUS_IS_OK(status)) {
6667                 torture_comment(tctx, "Connect failed - %s\n", nt_errstr(status));
6668                 ret = false;
6669         } else {
6670                 got_handle = true;
6671                 *handle = h;
6672         }
6673
6674         torture_comment(tctx, "testing samr_Connect2\n");
6675
6676         r2.in.system_name = NULL;
6677         r2.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
6678         r2.out.connect_handle = &h;
6679
6680         status = dcerpc_samr_Connect2(p, tctx, &r2);
6681         if (!NT_STATUS_IS_OK(status)) {
6682                 torture_comment(tctx, "Connect2 failed - %s\n", nt_errstr(status));
6683                 ret = false;
6684         } else {
6685                 if (got_handle) {
6686                         test_samr_handle_Close(p, tctx, handle);
6687                 }
6688                 got_handle = true;
6689                 *handle = h;
6690         }
6691
6692         torture_comment(tctx, "testing samr_Connect3\n");
6693
6694         r3.in.system_name = NULL;
6695         r3.in.unknown = 0;
6696         r3.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
6697         r3.out.connect_handle = &h;
6698
6699         status = dcerpc_samr_Connect3(p, tctx, &r3);
6700         if (!NT_STATUS_IS_OK(status)) {
6701                 torture_warning(tctx, "Connect3 failed - %s\n", nt_errstr(status));
6702                 ret = false;
6703         } else {
6704                 if (got_handle) {
6705                         test_samr_handle_Close(p, tctx, handle);
6706                 }
6707                 got_handle = true;
6708                 *handle = h;
6709         }
6710
6711         torture_comment(tctx, "testing samr_Connect4\n");
6712
6713         r4.in.system_name = "";
6714         r4.in.client_version = 0;
6715         r4.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
6716         r4.out.connect_handle = &h;
6717
6718         status = dcerpc_samr_Connect4(p, tctx, &r4);
6719         if (!NT_STATUS_IS_OK(status)) {
6720                 torture_warning(tctx, "Connect4 failed - %s\n", nt_errstr(status));
6721                 ret = false;
6722         } else {
6723                 if (got_handle) {
6724                         test_samr_handle_Close(p, tctx, handle);
6725                 }
6726                 got_handle = true;
6727                 *handle = h;
6728         }
6729
6730         torture_comment(tctx, "testing samr_Connect5\n");
6731
6732         info.info1.client_version = 0;
6733         info.info1.unknown2 = 0;
6734
6735         r5.in.system_name = "";
6736         r5.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
6737         r5.in.level_in = 1;
6738         r5.out.level_out = &level_out;
6739         r5.in.info_in = &info;
6740         r5.out.info_out = &info;
6741         r5.out.connect_handle = &h;
6742
6743         status = dcerpc_samr_Connect5(p, tctx, &r5);
6744         if (!NT_STATUS_IS_OK(status)) {
6745                 torture_warning(tctx, "Connect5 failed - %s\n", nt_errstr(status));
6746                 ret = false;
6747         } else {
6748                 if (got_handle) {
6749                         test_samr_handle_Close(p, tctx, handle);
6750                 }
6751                 got_handle = true;
6752                 *handle = h;
6753         }
6754
6755         return ret;
6756 }
6757
6758
6759 static bool test_samr_ValidatePassword(struct dcerpc_pipe *p, struct torture_context *tctx)
6760 {
6761         struct samr_ValidatePassword r;
6762         union samr_ValidatePasswordReq req;
6763         union samr_ValidatePasswordRep *repp = NULL;
6764         NTSTATUS status;
6765         const char *passwords[] = { "penguin", "p@ssw0rd", "p@ssw0rd123$", NULL };
6766         int i;
6767
6768         torture_comment(tctx, "testing samr_ValidatePassword\n");
6769
6770         ZERO_STRUCT(r);
6771         r.in.level = NetValidatePasswordReset;
6772         r.in.req = &req;
6773         r.out.rep = &repp;
6774
6775         ZERO_STRUCT(req);
6776         req.req3.account.string = "non-existant-account-aklsdji";
6777
6778         for (i=0; passwords[i]; i++) {
6779                 req.req3.password.string = passwords[i];
6780                 status = dcerpc_samr_ValidatePassword(p, tctx, &r);
6781                 torture_assert_ntstatus_ok(tctx, status, "samr_ValidatePassword");
6782                 torture_comment(tctx, "Server %s password '%s' with code %i\n",
6783                                 repp->ctr3.status==SAMR_VALIDATION_STATUS_SUCCESS?"allowed":"refused",
6784                                 req.req3.password.string, repp->ctr3.status);
6785         }
6786
6787         return true;
6788 }
6789
6790 bool torture_rpc_samr(struct torture_context *torture)
6791 {
6792         NTSTATUS status;
6793         struct dcerpc_pipe *p;
6794         bool ret = true;
6795         struct torture_samr_context *ctx;
6796
6797         status = torture_rpc_connection(torture, &p, &ndr_table_samr);
6798         if (!NT_STATUS_IS_OK(status)) {
6799                 return false;
6800         }
6801
6802         ctx = talloc_zero(torture, struct torture_samr_context);
6803
6804         ctx->choice = TORTURE_SAMR_OTHER;
6805
6806         ret &= test_Connect(p, torture, &ctx->handle);
6807
6808         if (!torture_setting_bool(torture, "samba3", false)) {
6809                 ret &= test_QuerySecurity(p, torture, &ctx->handle);
6810         }
6811
6812         ret &= test_EnumDomains(p, torture, ctx);
6813
6814         ret &= test_SetDsrmPassword(p, torture, &ctx->handle);
6815
6816         ret &= test_Shutdown(p, torture, &ctx->handle);
6817
6818         ret &= test_samr_handle_Close(p, torture, &ctx->handle);
6819
6820         return ret;
6821 }
6822
6823
6824 bool torture_rpc_samr_users(struct torture_context *torture)
6825 {
6826         NTSTATUS status;
6827         struct dcerpc_pipe *p;
6828         bool ret = true;
6829         struct torture_samr_context *ctx;
6830
6831         status = torture_rpc_connection(torture, &p, &ndr_table_samr);
6832         if (!NT_STATUS_IS_OK(status)) {
6833                 return false;
6834         }
6835
6836         ctx = talloc_zero(torture, struct torture_samr_context);
6837
6838         ctx->choice = TORTURE_SAMR_USER_ATTRIBUTES;
6839
6840         ret &= test_Connect(p, torture, &ctx->handle);
6841
6842         if (!torture_setting_bool(torture, "samba3", false)) {
6843                 ret &= test_QuerySecurity(p, torture, &ctx->handle);
6844         }
6845
6846         ret &= test_EnumDomains(p, torture, ctx);
6847
6848         ret &= test_SetDsrmPassword(p, torture, &ctx->handle);
6849
6850         ret &= test_Shutdown(p, torture, &ctx->handle);
6851
6852         ret &= test_samr_handle_Close(p, torture, &ctx->handle);
6853
6854         return ret;
6855 }
6856
6857
6858 bool torture_rpc_samr_passwords(struct torture_context *torture)
6859 {
6860         NTSTATUS status;
6861         struct dcerpc_pipe *p;
6862         bool ret = true;
6863         struct torture_samr_context *ctx;
6864
6865         status = torture_rpc_connection(torture, &p, &ndr_table_samr);
6866         if (!NT_STATUS_IS_OK(status)) {
6867                 return false;
6868         }
6869
6870         ctx = talloc_zero(torture, struct torture_samr_context);
6871
6872         ctx->choice = TORTURE_SAMR_PASSWORDS;
6873
6874         ret &= test_Connect(p, torture, &ctx->handle);
6875
6876         ret &= test_EnumDomains(p, torture, ctx);
6877
6878         ret &= test_samr_handle_Close(p, torture, &ctx->handle);
6879
6880         ret &= test_samr_ValidatePassword(p, torture);
6881
6882         return ret;
6883 }
6884
6885 static bool torture_rpc_samr_pwdlastset(struct torture_context *torture,
6886                                         struct dcerpc_pipe *p2,
6887                                         struct cli_credentials *machine_credentials)
6888 {
6889         NTSTATUS status;
6890         struct dcerpc_pipe *p;
6891         bool ret = true;
6892         struct torture_samr_context *ctx;
6893
6894         status = torture_rpc_connection(torture, &p, &ndr_table_samr);
6895         if (!NT_STATUS_IS_OK(status)) {
6896                 return false;
6897         }
6898
6899         ctx = talloc_zero(torture, struct torture_samr_context);
6900
6901         ctx->choice = TORTURE_SAMR_PASSWORDS_PWDLASTSET;
6902         ctx->machine_credentials = machine_credentials;
6903
6904         ret &= test_Connect(p, torture, &ctx->handle);
6905
6906         ret &= test_EnumDomains(p, torture, ctx);
6907
6908         ret &= test_samr_handle_Close(p, torture, &ctx->handle);
6909
6910         return ret;
6911 }
6912
6913 struct torture_suite *torture_rpc_samr_passwords_pwdlastset(TALLOC_CTX *mem_ctx)
6914 {
6915         struct torture_suite *suite = torture_suite_create(mem_ctx, "SAMR-PASSWORDS-PWDLASTSET");
6916         struct torture_rpc_tcase *tcase;
6917
6918         tcase = torture_suite_add_machine_bdc_rpc_iface_tcase(suite, "samr",
6919                                                           &ndr_table_samr,
6920                                                           TEST_ACCOUNT_NAME_PWD);
6921
6922         torture_rpc_tcase_add_test_creds(tcase, "pwdLastSet",
6923                                          torture_rpc_samr_pwdlastset);
6924
6925         return suite;
6926 }
6927
6928 static bool torture_rpc_samr_users_privileges_delete_user(struct torture_context *torture,
6929                                                           struct dcerpc_pipe *p2,
6930                                                           struct cli_credentials *machine_credentials)
6931 {
6932         NTSTATUS status;
6933         struct dcerpc_pipe *p;
6934         bool ret = true;
6935         struct torture_samr_context *ctx;
6936
6937         status = torture_rpc_connection(torture, &p, &ndr_table_samr);
6938         if (!NT_STATUS_IS_OK(status)) {
6939                 return false;
6940         }
6941
6942         ctx = talloc_zero(torture, struct torture_samr_context);
6943
6944         ctx->choice = TORTURE_SAMR_USER_PRIVILEGES;
6945         ctx->machine_credentials = machine_credentials;
6946
6947         ret &= test_Connect(p, torture, &ctx->handle);
6948
6949         ret &= test_EnumDomains(p, torture, ctx);
6950
6951         ret &= test_samr_handle_Close(p, torture, &ctx->handle);
6952
6953         return ret;
6954 }
6955
6956 struct torture_suite *torture_rpc_samr_user_privileges(TALLOC_CTX *mem_ctx)
6957 {
6958         struct torture_suite *suite = torture_suite_create(mem_ctx, "SAMR-USERS-PRIVILEGES");
6959         struct torture_rpc_tcase *tcase;
6960
6961         tcase = torture_suite_add_machine_bdc_rpc_iface_tcase(suite, "samr",
6962                                                           &ndr_table_samr,
6963                                                           TEST_ACCOUNT_NAME_PWD);
6964
6965         torture_rpc_tcase_add_test_creds(tcase, "delete_privileged_user",
6966                                          torture_rpc_samr_users_privileges_delete_user);
6967
6968         return suite;
6969 }
6970
6971 static bool torture_rpc_samr_many_accounts(struct torture_context *torture,
6972                                            struct dcerpc_pipe *p2,
6973                                            void *data)
6974 {
6975         NTSTATUS status;
6976         struct dcerpc_pipe *p;
6977         bool ret = true;
6978         struct torture_samr_context *ctx =
6979                 talloc_get_type_abort(data, struct torture_samr_context);
6980
6981         status = torture_rpc_connection(torture, &p, &ndr_table_samr);
6982         if (!NT_STATUS_IS_OK(status)) {
6983                 return false;
6984         }
6985
6986         ctx->choice = TORTURE_SAMR_MANY_ACCOUNTS;
6987         ctx->num_objects_large_dc = torture_setting_int(torture, "large_dc",
6988                                                         ctx->num_objects_large_dc);
6989
6990         ret &= test_Connect(p, torture, &ctx->handle);
6991
6992         ret &= test_EnumDomains(p, torture, ctx);
6993
6994         ret &= test_samr_handle_Close(p, torture, &ctx->handle);
6995
6996         return ret;
6997 }
6998
6999 static bool torture_rpc_samr_many_groups(struct torture_context *torture,
7000                                          struct dcerpc_pipe *p2,
7001                                          void *data)
7002 {
7003         NTSTATUS status;
7004         struct dcerpc_pipe *p;
7005         bool ret = true;
7006         struct torture_samr_context *ctx =
7007                 talloc_get_type_abort(data, struct torture_samr_context);
7008
7009         status = torture_rpc_connection(torture, &p, &ndr_table_samr);
7010         if (!NT_STATUS_IS_OK(status)) {
7011                 return false;
7012         }
7013
7014         ctx->choice = TORTURE_SAMR_MANY_GROUPS;
7015         ctx->num_objects_large_dc = torture_setting_int(torture, "large_dc",
7016                                                         ctx->num_objects_large_dc);
7017
7018         ret &= test_Connect(p, torture, &ctx->handle);
7019
7020         ret &= test_EnumDomains(p, torture, ctx);
7021
7022         ret &= test_samr_handle_Close(p, torture, &ctx->handle);
7023
7024         return ret;
7025 }
7026
7027 static bool torture_rpc_samr_many_aliases(struct torture_context *torture,
7028                                           struct dcerpc_pipe *p2,
7029                                           void *data)
7030 {
7031         NTSTATUS status;
7032         struct dcerpc_pipe *p;
7033         bool ret = true;
7034         struct torture_samr_context *ctx =
7035                 talloc_get_type_abort(data, struct torture_samr_context);
7036
7037         status = torture_rpc_connection(torture, &p, &ndr_table_samr);
7038         if (!NT_STATUS_IS_OK(status)) {
7039                 return false;
7040         }
7041
7042         ctx->choice = TORTURE_SAMR_MANY_ALIASES;
7043         ctx->num_objects_large_dc = torture_setting_int(torture, "large_dc",
7044                                                         ctx->num_objects_large_dc);
7045
7046         ret &= test_Connect(p, torture, &ctx->handle);
7047
7048         ret &= test_EnumDomains(p, torture, ctx);
7049
7050         ret &= test_samr_handle_Close(p, torture, &ctx->handle);
7051
7052         return ret;
7053 }
7054
7055 struct torture_suite *torture_rpc_samr_large_dc(TALLOC_CTX *mem_ctx)
7056 {
7057         struct torture_suite *suite = torture_suite_create(mem_ctx, "SAMR-LARGE-DC");
7058         struct torture_rpc_tcase *tcase;
7059         struct torture_samr_context *ctx;
7060
7061         tcase = torture_suite_add_rpc_iface_tcase(suite, "samr", &ndr_table_samr);
7062
7063         ctx = talloc_zero(suite, struct torture_samr_context);
7064         ctx->num_objects_large_dc = 150;
7065
7066         torture_rpc_tcase_add_test_ex(tcase, "many_aliases",
7067                                       torture_rpc_samr_many_aliases, ctx);
7068         torture_rpc_tcase_add_test_ex(tcase, "many_groups",
7069                                       torture_rpc_samr_many_groups, ctx);
7070         torture_rpc_tcase_add_test_ex(tcase, "many_accounts",
7071                                       torture_rpc_samr_many_accounts, ctx);
7072
7073         return suite;
7074 }