source4/torture/rpc/backupkey.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3    test suite for backupkey remote protocol rpc operations
   4
   5    Copyright (C) Matthieu Patou 2010
   6
   7    This program is free software; you can redistribute it and/or modify
   8    it under the terms of the GNU General Public License as published by
   9    the Free Software Foundation; either version 3 of the License, or
  10    (at your option) any later version.
  11
  12    This program is distributed in the hope that it will be useful,
  13    but WITHOUT ANY WARRANTY; without even the implied warranty of
  14    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  15    GNU General Public License for more details.
  16
  17    You should have received a copy of the GNU General Public License
  18    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  19 */
  20
  21 #include "includes.h"
  22 #include "hx_locl.h"
  23 #include "auth/auth.h"
  24 #include "lib/cmdline/popt_common.h"
  25 #include "auth/gensec/gensec.h"
  26 #include "libcli/auth/libcli_auth.h"
  27 #include "librpc/gen_ndr/ndr_backupkey_c.h"
  28 #include "librpc/gen_ndr/backupkey.h"
  29 #include "librpc/gen_ndr/ndr_backupkey.h"
  30 #include "librpc/gen_ndr/ndr_security.h"
  31 #include "libcli/security/security.h"
  32 #include "torture/rpc/torture_rpc.h"
  33 #include "param/param.h"
  34 #include "librpc/gen_ndr/ndr_lsa_c.h"
  35
  36 /* Our very special and valued secret */
  37 static char secret[] = "tata yoyo mais qu'est ce qu'il y a sous ton grand chapeau ?";
  38
  39 # if 0
  40 static void print_hex(uint8_t *tab, uint32_t size) {
  41         uint32_t i;
  42         for (i=0; i<size; i++) {
  43                 if( i%16 == 0 && i != 0) {
  44                         printf("\n");
  45                 }
  46                 printf("%02X ", tab[i]);
  47         }
  48         printf("\n");
  49 }
  50 #endif
  51
  52 static bool test_RetreiveBackupKeyGUID(struct torture_context *tctx,
  53                                         struct dcerpc_pipe *p) {
  54         struct dcerpc_binding_handle *b = p->binding_handle;
  55         struct dcerpc_binding *binding = p->binding;
  56         struct bkrp_BackupKey r;
  57         struct bkrp_client_side_wrapped data;
  58         struct GUID g;
  59         enum ndr_err_code ret;
  60         DATA_BLOB blob;
  61         DATA_BLOB out_blob;
  62
  63         binding->flags = binding->flags &(DCERPC_SEAL|DCERPC_AUTH_SPNEGO);
  64         ZERO_STRUCT(r);
  65         ZERO_STRUCT(data);
  66         GUID_from_string(BACKUPKEY_RETRIEVE_BACKUP_KEY_GUID, &g);
  67         r.in.guidActionAgent = &g;
  68         ret = ndr_push_struct_blob(&blob, tctx, &data, (ndr_push_flags_fn_t)ndr_push_bkrp_client_side_wrapped);
  69         r.in.data_in = blob.data;
  70         r.in.data_in_len = blob.length;
  71         data.version = 2;
  72         data.encrypted_secret_len = 0;
  73         data.access_check_len = 0;
  74         r.out.data_out = &out_blob.data;
  75         r.out.data_out_len = &out_blob.length;
  76
  77         //torture_comment(tctx, "No seal or sign ? %d\n", p->conn->security_state.auth_info == NULL);
  78         if( p->conn->security_state.auth_info != NULL &&
  79             p->conn->security_state.auth_info->auth_level == 6) {
  80                 torture_assert_ntstatus_ok(tctx, dcerpc_bkrp_BackupKey_r(b, tctx, &r),
  81                         "Get GUID");
  82                 torture_assert_werr_equal(tctx, r.out.result, WERR_OK, "Wrong dce/rpc error code");
  83         } else {
  84                 torture_assert_ntstatus_equal(tctx, dcerpc_bkrp_BackupKey_r(b, tctx, &r),
  85                         NT_STATUS_ACCESS_DENIED, "Get GUID");
  86         }
  87         return true;
  88 }
  89
  90 static struct dom_sid *get_user_sid(struct torture_context *tctx, struct dcerpc_pipe *p, TALLOC_CTX *mem_ctx, const char* user) {
  91         struct lsa_ObjectAttribute attr;
  92         struct lsa_QosInfo qos;
  93         struct lsa_OpenPolicy2 r;
  94         struct lsa_Close c;
  95         NTSTATUS status;
  96         struct policy_handle handle;
  97         struct lsa_LookupNames l;
  98         struct lsa_TransSidArray sids;
  99         struct lsa_RefDomainList *domains = NULL;
 100         struct lsa_String lsa_name;
 101         uint32_t count = 0;
 102         struct dom_sid *result;
 103         TALLOC_CTX *tmp_ctx;
 104         struct dcerpc_pipe *p2;
 105         struct dcerpc_binding_handle *b;
 106
 107         const char* domain = cli_credentials_get_domain(cmdline_credentials);
 108
 109         torture_assert_ntstatus_ok(tctx,
 110                 torture_rpc_connection(tctx, &p2, &ndr_table_lsarpc),
 111                 "could not open lsarpc pipe");
 112         b = p2->binding_handle;
 113
 114         if (!(tmp_ctx = talloc_new(mem_ctx))) {
 115                 return NULL;
 116         }
 117         qos.len = 0;
 118         qos.impersonation_level = 2;
 119         qos.context_mode = 1;
 120         qos.effective_only = 0;
 121
 122         attr.len = 0;
 123         attr.root_dir = NULL;
 124         attr.object_name = NULL;
 125         attr.attributes = 0;
 126         attr.sec_desc = NULL;
 127         attr.sec_qos = &qos;
 128
 129         r.in.system_name = "\\";
 130         r.in.attr = &attr;
 131         r.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
 132         r.out.handle = &handle;
 133
 134         status = dcerpc_lsa_OpenPolicy2_r(b, tmp_ctx, &r);
 135         if (!NT_STATUS_IS_OK(status)) {
 136                 torture_comment(tctx, "OpenPolicy2 failed - %s\n", nt_errstr(status));
 137                 talloc_free(tmp_ctx);
 138                 return NULL;
 139         }
 140         if (!NT_STATUS_IS_OK(r.out.result)) {
 141                 torture_comment(tctx, "OpenPolicy2_ failed - %s\n", nt_errstr(r.out.result));
 142                 talloc_free(tmp_ctx);
 143                 return NULL;
 144         }
 145
 146         sids.count = 0;
 147         sids.sids = NULL;
 148
 149         lsa_name.string = talloc_asprintf(tmp_ctx, "%s\\%s", domain, user);
 150
 151         l.in.handle = &handle;
 152         l.in.num_names = 1;
 153         l.in.names = &lsa_name;
 154         l.in.sids = &sids;
 155         l.in.level = 1;
 156         l.in.count = &count;
 157         l.out.count = &count;
 158         l.out.sids = &sids;
 159         l.out.domains = &domains;
 160
 161         status = dcerpc_lsa_LookupNames_r(b, tmp_ctx, &l);
 162         if (!NT_STATUS_IS_OK(status)) {
 163                 torture_comment(tctx, "LookupNames of %s failed - %s\n", lsa_name.string,
 164                        nt_errstr(status));
 165                 talloc_free(tmp_ctx);
 166                 return NULL;
 167         }
 168
 169         if (domains->count == 0) {
 170                 return NULL;
 171         }
 172
 173         result = dom_sid_add_rid(mem_ctx, domains->domains[0].sid,
 174                                  l.out.sids->sids[0].rid);
 175         c.in.handle = &handle;
 176         c.out.handle = &handle;
 177
 178         status = dcerpc_lsa_Close_r(b, tmp_ctx, &c);
 179         if (!NT_STATUS_IS_OK(status)) {
 180                 torture_comment(tctx, "dcerpc_lsa_Close failed - %s\n", nt_errstr(status));
 181                 talloc_free(tmp_ctx);
 182                 return NULL;
 183         }
 184         if (!NT_STATUS_IS_OK(c.out.result)) {
 185                 torture_comment(tctx, "dcerpc_lsa_Close failed - %s\n", nt_errstr(c.out.result));
 186                 talloc_free(tmp_ctx);
 187                 return NULL;
 188         }
 189
 190         talloc_free(tmp_ctx);
 191         talloc_free(p2);
 192
 193         torture_comment(tctx, "GET user finished\n");
 194         return result;
 195 }
 196
 197 static DATA_BLOB* create_unencryptedsecret(TALLOC_CTX *mem_ctx, bool broken, int version) {
 198         TALLOC_CTX *tmp_ctx = talloc_new(mem_ctx);
 199         DATA_BLOB *blob = talloc(mem_ctx, DATA_BLOB);
 200         if (version == 2) {
 201                 struct bkrp_encrypted_secret_v2 unenc_sec;
 202                 uint32_t key_size = 32;
 203                 uint8_t *tab = talloc_array(tmp_ctx, uint8_t, key_size);
 204
 205                 unenc_sec.secret_len = strlen(secret)+1;
 206                 unenc_sec.secret = (uint8_t*)secret;
 207                 unenc_sec.secret = talloc_array(tmp_ctx, uint8_t, sizeof(secret));
 208
 209                 memcpy(unenc_sec.secret, secret, sizeof(secret));
 210
 211                 generate_random_buffer(tab, key_size);
 212                 memcpy(unenc_sec.payload_key, tab, key_size);
 213
 214                 ndr_push_struct_blob(blob, mem_ctx, &unenc_sec, (ndr_push_flags_fn_t)ndr_push_bkrp_encrypted_secret_v2);
 215                 if (broken) {
 216                         /* We broke the magic value to check server behavior */
 217                         /* Was 0x20 */
 218                         ((uint8_t*)blob->data)[4] = 19; /* A great year !!! */
 219                 }
 220         }
 221         if (version ==3) {
 222                 struct bkrp_encrypted_secret_v3 unenc_sec;
 223                 uint32_t key_size = 48;
 224                 uint8_t *tab = talloc_array(tmp_ctx, uint8_t, key_size);
 225
 226                 unenc_sec.secret_len = strlen(secret)+1;
 227                 unenc_sec.secret = (uint8_t*)secret;
 228                 unenc_sec.secret = talloc_array(tmp_ctx, uint8_t, sizeof(secret));
 229
 230                 memcpy(unenc_sec.secret, secret, sizeof(secret));
 231
 232                 generate_random_buffer(tab, key_size);
 233                 memcpy(unenc_sec.payload_key, tab, key_size);
 234
 235                 ndr_push_struct_blob(blob, mem_ctx, &unenc_sec, (ndr_push_flags_fn_t)ndr_push_bkrp_encrypted_secret_v3);
 236                 if (broken) {
 237                         /* We broke the magic value to check server behavior */
 238                         /* Was 0x30 */
 239                         ((uint8_t*)blob->data)[4] = 19; /* A great year !!! */
 240                 }
 241         }
 242         talloc_free(tmp_ctx);
 243         return blob;
 244 }
 245
 246 static DATA_BLOB* create_access_check(struct torture_context *tctx, struct dcerpc_pipe *p, TALLOC_CTX *mem_ctx, const char* user, bool broken, uint32_t version) {
 247         TALLOC_CTX *tmp_ctx = talloc_new(mem_ctx);
 248         DATA_BLOB *blob = talloc(mem_ctx, DATA_BLOB);
 249         if (version == 2) {
 250                 struct bkrp_access_check_v2 access_struct;
 251                 uint32_t len = 32;
 252                 uint32_t hash_size = 20;
 253                 struct sha sctx;
 254                 DATA_BLOB buf;
 255                 struct dom_sid* sid = get_user_sid(tctx, p, tmp_ctx, user);
 256
 257                 if (sid == NULL) {
 258                         return NULL;
 259                 }
 260
 261                 buf.data = talloc_array(tmp_ctx, uint8_t, len);
 262                 buf.length = len;
 263
 264                 generate_random_buffer(buf.data, len);
 265                 access_struct.nonce_len = buf.length;
 266                 access_struct.nonce = buf.data;
 267                 access_struct.sid = *sid;
 268                 ZERO_STRUCT(access_struct.hash);
 269                 ndr_push_struct_blob(blob, mem_ctx, &access_struct, (ndr_push_flags_fn_t)ndr_push_bkrp_access_check_v2);
 270                 /*We pushed the whole structure including a null hash
 271                 * but the hash need to be calculated only up to the hash field
 272                 * so we reduce the size of what has to be calculated
 273                 */
 274                 SHA1_Init(&sctx);
 275                 SHA1_Update(&sctx, blob->data, blob->length - hash_size);
 276                 SHA1_Final(blob->data+blob->length - hash_size, &sctx);
 277                 /* Altering the SHA */
 278                 if (broken) {
 279                         blob->data[blob->length -1]++;
 280                 }
 281         }
 282         if (version == 3) {
 283                 struct bkrp_access_check_v3 access_struct;
 284                 uint32_t len = 32;
 285                 uint32_t hash_size = 64;
 286                 struct hc_sha512state sctx;
 287                 DATA_BLOB buf;
 288                 struct dom_sid* sid = get_user_sid(tctx, p, tmp_ctx, user);
 289
 290                 if (sid == NULL) {
 291                         return NULL;
 292                 }
 293
 294                 buf.data = talloc_array(tmp_ctx, uint8_t, len);
 295                 buf.length = len;
 296
 297                 generate_random_buffer(buf.data, len);
 298                 access_struct.nonce_len = buf.length;
 299                 access_struct.nonce = buf.data;
 300                 access_struct.sid = *sid;
 301                 ZERO_STRUCT(access_struct.hash);
 302                 ndr_push_struct_blob(blob, mem_ctx, &access_struct, (ndr_push_flags_fn_t)ndr_push_bkrp_access_check_v3);
 303                 /*We pushed the whole structure including a null hash
 304                 * but the hash need to be calculated only up to the hash field
 305                 * so we reduce the size of what has to be calculated
 306                 */
 307                 /*
 308                 SHA1_Init(&sctx);
 309                 SHA1_Update(&sctx, blob->data, blob->length - hash_size);
 310                 SHA1_Final(blob->data+blob->length - hash_size, &sctx);
 311                 */
 312
 313                 SHA512_Init(&sctx);
 314                 SHA512_Update(&sctx, blob->data, blob->length - hash_size);
 315                 SHA512_Final(blob->data+blob->length - hash_size, &sctx);
 316
 317                 /* Altering the SHA */
 318                 if (broken) {
 319                         blob->data[blob->length -1]++;
 320                 }
 321         }
 322         talloc_free(tmp_ctx);
 323         return blob;
 324 }
 325
 326 static DATA_BLOB* encrypt_blob_aes(struct torture_context *tctx, TALLOC_CTX *mem_ctx, DATA_BLOB *aes_key, DATA_BLOB *iv, DATA_BLOB *to_encrypt) {
 327         hx509_crypto crypto;
 328         hx509_context hctx;
 329         heim_octet_string ivos;
 330         heim_octet_string *encrypted;
 331         DATA_BLOB *blob = talloc(mem_ctx, DATA_BLOB);
 332         int res;
 333         const AlgorithmIdentifier *alg = hx509_crypto_aes256_cbc();
 334
 335         ivos.data = talloc_array(mem_ctx, uint8_t, iv->length);
 336         ivos.length = iv->length;
 337         memcpy(ivos.data, iv->data, iv->length);
 338
 339         hx509_context_init(&hctx);
 340         res = hx509_crypto_init(hctx, NULL, &(alg->algorithm), &crypto);
 341         if (res) {
 342                 torture_comment(tctx, "error while doing the init of the crypto obj\n");
 343                 return NULL;
 344         }
 345         res = hx509_crypto_set_key_data(crypto, aes_key->data, aes_key->length);
 346         if (res) {
 347                 torture_comment(tctx, "error while setting the key of the crypto object\n");
 348                 return NULL;
 349         }
 350         hx509_crypto_set_padding(crypto, HX509_CRYPTO_PADDING_NONE);
 351         res = hx509_crypto_encrypt(crypto,
 352                                         to_encrypt->data,
 353                                         to_encrypt->length,
 354                                         &ivos,
 355                                         &encrypted);
 356         if (res) {
 357                 torture_comment(tctx, "error while encrypting\n");
 358                 return NULL;
 359         }
 360
 361         blob->data = talloc_memdup(blob, encrypted->data, encrypted->length);
 362         blob->length = encrypted->length;
 363         hx509_crypto_destroy(crypto);
 364         hx509_context_free(&hctx);
 365         return blob;
 366
 367 }
 368
 369 static DATA_BLOB* encrypt_blob_3des(struct torture_context *tctx, TALLOC_CTX *mem_ctx, DATA_BLOB *des3_key, DATA_BLOB *iv, DATA_BLOB *to_encrypt) {
 370         hx509_crypto crypto;
 371         hx509_context hctx;
 372         heim_octet_string ivos;
 373         heim_octet_string *encrypted;
 374         DATA_BLOB *blob = talloc(mem_ctx, DATA_BLOB);
 375         int res;
 376         const AlgorithmIdentifier *alg2 = hx509_crypto_des_rsdi_ede3_cbc();
 377
 378         ivos.data = talloc_array(mem_ctx, uint8_t, iv->length);
 379         ivos.length = iv->length;
 380         memcpy(ivos.data, iv->data, iv->length);
 381
 382         hx509_context_init(&hctx);
 383         res = hx509_crypto_init(hctx, NULL, &(alg2->algorithm), &crypto);
 384         if (res) {
 385                 torture_comment(tctx, "error while doing the init of the crypto obj\n");
 386                 return NULL;
 387         }
 388         res = hx509_crypto_set_key_data(crypto, des3_key->data, des3_key->length);
 389         if (res) {
 390                 torture_comment(tctx, "error while setting the key of the crypto object\n");
 391                 return NULL;
 392         }
 393         hx509_crypto_set_padding(crypto, HX509_CRYPTO_PADDING_NONE);
 394         res = hx509_crypto_encrypt(crypto,
 395                                         to_encrypt->data,
 396                                         to_encrypt->length,
 397                                         &ivos,
 398                                         &encrypted);
 399         if (res) {
 400                 torture_comment(tctx, "error while encrypting\n");
 401                 return NULL;
 402         }
 403
 404         blob->data = talloc_memdup(blob, encrypted->data, encrypted->length);
 405         blob->length = encrypted->length;
 406         hx509_crypto_destroy(crypto);
 407         hx509_context_free(&hctx);
 408         return blob;
 409 }
 410
 411 static struct GUID* get_cert_guid(struct torture_context *tctx, TALLOC_CTX *mem_ctx, uint8_t *cert_data, uint32_t cert_len) {
 412                 hx509_context hctx;
 413                 hx509_cert cert;
 414                 heim_bit_string subjectuniqid;
 415                 DATA_BLOB data;
 416                 int hret;
 417                 uint32_t size;
 418                 struct GUID *guid = talloc(mem_ctx, struct GUID);
 419
 420                 hx509_context_init(&hctx);
 421
 422                 hret = hx509_cert_init_data(hctx, cert_data, cert_len, &cert);
 423                 if (hret) {
 424                         torture_comment(tctx, "error while loading the cert\n");
 425                         return NULL;
 426                 }
 427                 hret = hx509_cert_get_issuer_unique_id(hctx, cert, &subjectuniqid);
 428                 if (hret) {
 429                         torture_comment(tctx, "error while getting the certificate\n");
 430                         return NULL;
 431                 }
 432                 /* in bit string the real size has to be divided by 8*/
 433                 size = subjectuniqid.length / 8;
 434                 data.data = talloc_memdup(mem_ctx,subjectuniqid.data, size);
 435                 data.length = size;
 436                 GUID_from_data_blob(&data, guid);
 437                 talloc_free(data.data);
 438                 return guid;
 439 }
 440
 441 static DATA_BLOB* encrypt_blob_pk(struct torture_context *tctx, TALLOC_CTX *mem_ctx, uint8_t *cert_data, uint32_t cert_len, DATA_BLOB *to_encrypt) {
 442                 hx509_context hctx;
 443                 hx509_cert cert;
 444                 heim_octet_string secretdata;
 445                 heim_octet_string encrypted;
 446                 heim_oid encryption_oid;
 447                 DATA_BLOB *blob;
 448                 int hret;
 449
 450                 hx509_context_init(&hctx);
 451
 452                 hret = hx509_cert_init_data(hctx, cert_data, cert_len, &cert);
 453                 if (hret) {
 454                         torture_comment(tctx, "error while loading the cert\n");
 455                         return NULL;
 456                 }
 457
 458                 secretdata.data = to_encrypt->data;
 459                 secretdata.length = to_encrypt->length;
 460                 hret = _hx509_cert_public_encrypt(hctx, &secretdata, cert, &encryption_oid, &encrypted);
 461                 if (hret) {
 462                         torture_comment(tctx, "error while encrypting\n");
 463                         return NULL;
 464                 }
 465
 466                 blob = talloc(mem_ctx, DATA_BLOB);
 467                 blob->data = talloc_memdup(blob, encrypted.data, encrypted.length);
 468                 blob->length = encrypted.length;
 469
 470                 hx509_cert_free(cert);
 471                 hx509_context_free(&hctx);
 472                 return blob;
 473 }
 474
 475 static bool test_RestoreGUID_ko(struct torture_context *tctx,
 476                                 struct dcerpc_pipe *p) {
 477         struct dcerpc_binding_handle *b = p->binding_handle;
 478         struct dcerpc_binding *binding = p->binding;
 479         struct bkrp_BackupKey r;
 480         struct bkrp_client_side_wrapped data;
 481         struct GUID g;
 482         enum ndr_err_code ndr_err;
 483         DATA_BLOB blob;
 484         DATA_BLOB out_blob;
 485
 486         binding->flags = binding->flags &(DCERPC_SEAL|DCERPC_AUTH_SPNEGO);
 487         ZERO_STRUCT(r);
 488         ZERO_STRUCT(data);
 489         GUID_from_string(BACKUPKEY_RETRIEVE_BACKUP_KEY_GUID, &g);
 490         r.in.guidActionAgent = &g;
 491         data.version = 2;
 492         data.encrypted_secret_len = 0;
 493         data.access_check_len = 0;
 494         ndr_err = ndr_push_struct_blob(&blob, tctx, &data, (ndr_push_flags_fn_t)ndr_push_bkrp_client_side_wrapped);
 495
 496         if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
 497                 return false;
 498         }
 499
 500         r.in.data_in = blob.data;
 501         r.in.data_in_len = blob.length;
 502         r.in.param = 0;
 503         r.out.data_out = &out_blob.data;
 504         r.out.data_out_len = &out_blob.length;
 505         if( p->conn->security_state.auth_info != NULL &&
 506             p->conn->security_state.auth_info->auth_level == 6) {
 507
 508                 DATA_BLOB *xs;
 509                 DATA_BLOB *sec;
 510                 DATA_BLOB *enc_sec;
 511                 DATA_BLOB enc_sec_reverted;
 512                 DATA_BLOB *enc_xs;
 513                 DATA_BLOB des3_key;
 514                 DATA_BLOB iv;
 515                 DATA_BLOB blob2;
 516                 struct bkrp_client_side_unwrapped resp;
 517                 struct GUID * guid;
 518                 int t;
 519                 uint32_t size;
 520                 const char* user = cli_credentials_get_username(cmdline_credentials);
 521
 522                 torture_assert_ntstatus_ok(tctx, dcerpc_bkrp_BackupKey_r(b, tctx, &r),
 523                                                 "Get GUID");
 524
 525                 sec = create_unencryptedsecret(tctx, false, 2);
 526                 xs = create_access_check(tctx, p, tctx, user, false, 2);
 527                 if (xs == NULL) {
 528                         return false;
 529                 }
 530
 531                 enc_sec = encrypt_blob_pk(tctx, tctx, out_blob.data, out_blob.length, sec);
 532                 if (!enc_sec) {
 533                         return false;
 534                 }
 535                 /*
 536                 printf("Encrypted secret not encrypted\n");
 537                 print_hex(sec->data, sec->length);
 538                 printf("Access check not encrypted\n");
 539                 print_hex(xs->data, xs->length);
 540                 */
 541                 enc_sec_reverted.data = talloc_array(tctx, uint8_t, enc_sec->length);
 542                 enc_sec_reverted.length = enc_sec->length;
 543
 544                 /* We DO NOT revert the array on purpose it's in order to check that
 545                  * when the server is not able to decrypt then it answer the correct error
 546                  */
 547                 for(t=0; t< enc_sec->length; t++) {
 548                         //enc_sec_reverted.data[t] = ((uint8_t*)enc_sec->data)[enc_sec->length - t -1];
 549                         enc_sec_reverted.data[t] = ((uint8_t*)enc_sec->data)[t];
 550                 }
 551
 552                 size = sec->length;
 553                 iv.data = sec->data+(size-8);
 554                 iv.length = 8;
 555
 556                 des3_key.data = sec->data+(size-32);
 557                 des3_key.length = 24;
 558
 559                 enc_xs = encrypt_blob_3des(tctx, tctx, &des3_key, &iv, xs);
 560                 if (!enc_xs) {
 561                         return false;
 562                 }
 563                 /* To cope with the fact that heimdal do padding at the end for the moment */
 564                 enc_xs->length = xs->length;
 565
 566                 data.version = 2;
 567                 data.encrypted_secret_len = enc_sec->length;
 568                 data.access_check_len = enc_xs->length;
 569                 guid = get_cert_guid(tctx, tctx, out_blob.data, out_blob.length);
 570                 if (guid == NULL) {
 571                         return false;
 572                 }
 573                 data.guid = *guid;
 574                 data.encrypted_secret = enc_sec_reverted.data;
 575                 data.access_check = enc_xs->data;
 576                 ndr_err = ndr_push_struct_blob(&blob2, tctx, &data, (ndr_push_flags_fn_t)ndr_push_bkrp_client_side_wrapped);
 577                 ZERO_STRUCT(r);
 578                 GUID_from_string(BACKUPKEY_RESTORE_GUID, &g);
 579                 r.in.guidActionAgent = &g;
 580                 r.in.data_in = blob2.data;
 581                 r.in.data_in_len = blob2.length;
 582                 r.in.param = 0;
 583                 r.out.data_out = &out_blob.data;
 584                 r.out.data_out_len = &out_blob.length;
 585
 586                 torture_assert_ntstatus_ok(tctx, dcerpc_bkrp_BackupKey_r(b, tctx, &r), "Restore GUID");
 587                 ndr_err = ndr_pull_struct_blob(&out_blob, tctx, &resp, (ndr_pull_flags_fn_t)ndr_pull_bkrp_client_side_unwrapped);
 588                 torture_assert_int_equal(tctx, NDR_ERR_CODE_IS_SUCCESS(ndr_err), 0, "Unable to unmarshall bkrp_client_side_unwrapped");
 589                 torture_assert_werr_equal(tctx, r.out.result, WERR_INVALID_DATA, "Wrong error code");
 590         } else {
 591                 torture_assert_ntstatus_equal(tctx, dcerpc_bkrp_BackupKey_r(b, tctx, &r),
 592                         NT_STATUS_ACCESS_DENIED, "Get GUID");
 593         }
 594         return true;
 595 }
 596
 597 static bool test_RestoreGUID_wrongversion(struct torture_context *tctx,
 598                                 struct dcerpc_pipe *p) {
 599         struct dcerpc_binding_handle *b = p->binding_handle;
 600         struct dcerpc_binding *binding = p->binding;
 601         struct bkrp_BackupKey r;
 602         struct bkrp_client_side_wrapped data;
 603         struct GUID g;
 604         enum ndr_err_code ndr_err;
 605         DATA_BLOB blob;
 606         DATA_BLOB out_blob;
 607
 608         binding->flags = binding->flags &(DCERPC_SEAL|DCERPC_AUTH_SPNEGO);
 609         ZERO_STRUCT(r);
 610         ZERO_STRUCT(data);
 611         GUID_from_string(BACKUPKEY_RETRIEVE_BACKUP_KEY_GUID, &g);
 612         r.in.guidActionAgent = &g;
 613         data.version = 2;
 614         data.encrypted_secret_len = 0;
 615         data.access_check_len = 0;
 616         ndr_err = ndr_push_struct_blob(&blob, tctx, &data, (ndr_push_flags_fn_t)ndr_push_bkrp_client_side_wrapped);
 617
 618         if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
 619                 return false;
 620         }
 621
 622         r.in.data_in = blob.data;
 623         r.in.data_in_len = blob.length;
 624         r.in.param = 0;
 625         r.out.data_out = &out_blob.data;
 626         r.out.data_out_len = &out_blob.length;
 627         if( p->conn->security_state.auth_info != NULL &&
 628                 p->conn->security_state.auth_info->auth_level == 6) {
 629
 630                 DATA_BLOB *xs;
 631                 DATA_BLOB *sec;
 632                 DATA_BLOB *enc_sec;
 633                 DATA_BLOB enc_sec_reverted;
 634                 DATA_BLOB *enc_xs;
 635                 DATA_BLOB des3_key;
 636                 DATA_BLOB iv;
 637                 DATA_BLOB blob2;
 638                 struct bkrp_client_side_unwrapped resp;
 639                 struct GUID * guid;
 640                 int t;
 641                 uint32_t size;
 642
 643                 const char* user = cli_credentials_get_username(cmdline_credentials);
 644                 torture_assert_ntstatus_ok(tctx, dcerpc_bkrp_BackupKey_r(b, tctx, &r),
 645                                                 "Get GUID");
 646
 647                 sec = create_unencryptedsecret(tctx, false, 2);
 648                 xs = create_access_check(tctx, p, tctx, user, false, 2);
 649                 if (xs == NULL) {
 650                         return false;
 651                 }
 652
 653                 enc_sec = encrypt_blob_pk(tctx, tctx, out_blob.data, out_blob.length, sec);
 654                 if (!enc_sec) {
 655                         return false;
 656                 }
 657                 /*
 658                 printf("Encrypted secret not encrypted\n");
 659                 print_hex(sec->data, sec->length);
 660                 printf("Access check not encrypted\n");
 661                 print_hex(xs->data, xs->length);
 662                 */
 663                 enc_sec_reverted.data = talloc_array(tctx, uint8_t, enc_sec->length);
 664                 enc_sec_reverted.length = enc_sec->length;
 665
 666                 for(t=0; t< enc_sec->length; t++) {
 667                         enc_sec_reverted.data[t] = ((uint8_t*)enc_sec->data)[enc_sec->length - t -1];
 668                         //enc_sec_reverted.data[t] = ((uint8_t*)enc_sec->data)[t];
 669                 }
 670
 671                 size = sec->length;
 672                 iv.data = sec->data+(size-8);
 673                 iv.length = 8;
 674
 675                 des3_key.data = sec->data+(size-32);
 676                 des3_key.length = 24;
 677
 678                 /*
 679                 printf("Triple des key\n");
 680                 print_hex(des3_key.data, 24);
 681                 */
 682                 enc_xs = encrypt_blob_3des(tctx, tctx, &des3_key, &iv, xs);
 683                 if (!enc_xs) {
 684                         return false;
 685                 }
 686                 /* To cope with the fact that heimdal do padding at the end for the moment */
 687                 enc_xs->length = xs->length;
 688                 /*
 689                 printf("Access check redecrypted: %d\n", tmp.length);
 690                 print_hex(tmp.data, tmp.length);
 691                 */
 692
 693                 data.version = 1;
 694                 data.encrypted_secret_len = enc_sec->length;
 695                 data.access_check_len = enc_xs->length;
 696                 guid = get_cert_guid(tctx, tctx, out_blob.data, out_blob.length);
 697                 if (guid == NULL) {
 698                         return false;
 699                 }
 700                 data.guid = *guid;
 701                 data.encrypted_secret = enc_sec_reverted.data;
 702                 data.access_check = enc_xs->data;
 703                 ndr_err = ndr_push_struct_blob(&blob2, tctx, &data, (ndr_push_flags_fn_t)ndr_push_bkrp_client_side_wrapped);
 704                 /*
 705                 printf("Encrypted secret encrypted\n");
 706                 print_hex(enc_sec->data, enc_sec->length);
 707                 printf("Access check encrypted\n");
 708                 print_hex(enc_xs->data, enc_xs->length);
 709                 */
 710                 ZERO_STRUCT(r);
 711                 GUID_from_string(BACKUPKEY_RESTORE_GUID, &g);
 712                 r.in.guidActionAgent = &g;
 713                 r.in.data_in = blob2.data;
 714                 r.in.data_in_len = blob2.length;
 715                 r.in.param = 0;
 716                 r.out.data_out = &out_blob.data;
 717                 r.out.data_out_len = &out_blob.length;
 718
 719                 torture_assert_ntstatus_ok(tctx, dcerpc_bkrp_BackupKey_r(b, tctx, &r), "Restore GUID");
 720                 ndr_err = ndr_pull_struct_blob(&out_blob, tctx, &resp, (ndr_pull_flags_fn_t)ndr_pull_bkrp_client_side_unwrapped);
 721                 torture_assert_int_equal(tctx, NDR_ERR_CODE_IS_SUCCESS(ndr_err), 0, "Unable to unmarshall bkrp_client_side_unwrapped");
 722                 torture_assert_werr_equal(tctx, r.out.result, WERR_INVALID_PARAM, "Wrong error code on wrong version");
 723         } else {
 724                 torture_assert_ntstatus_equal(tctx, dcerpc_bkrp_BackupKey_r(b, tctx, &r),
 725                         NT_STATUS_ACCESS_DENIED, "Get GUID");
 726         }
 727         return true;
 728 }
 729
 730 static bool test_RestoreGUID_wronguser(struct torture_context *tctx,
 731                                 struct dcerpc_pipe *p) {
 732         struct dcerpc_binding_handle *b = p->binding_handle;
 733         struct dcerpc_binding *binding = p->binding;
 734         struct bkrp_BackupKey r;
 735         struct bkrp_client_side_wrapped data;
 736         struct GUID g;
 737         enum ndr_err_code ndr_err;
 738         DATA_BLOB blob;
 739         DATA_BLOB out_blob;
 740
 741         binding->flags = binding->flags &(DCERPC_SEAL|DCERPC_AUTH_SPNEGO);
 742         ZERO_STRUCT(r);
 743         ZERO_STRUCT(data);
 744         GUID_from_string(BACKUPKEY_RETRIEVE_BACKUP_KEY_GUID, &g);
 745         r.in.guidActionAgent = &g;
 746         data.version = 2;
 747         data.encrypted_secret_len = 0;
 748         data.access_check_len = 0;
 749         ndr_err = ndr_push_struct_blob(&blob, tctx, &data, (ndr_push_flags_fn_t)ndr_push_bkrp_client_side_wrapped);
 750
 751         if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
 752                 return false;
 753         }
 754
 755         r.in.data_in = blob.data;
 756         r.in.data_in_len = blob.length;
 757         r.in.param = 0;
 758         r.out.data_out = &out_blob.data;
 759         r.out.data_out_len = &out_blob.length;
 760         //DEBUG(0, ("Is the stuff not encrypted ? %s \n", p->conn->security_state.auth_info == NULL?"yes":"no"));
 761         if( p->conn->security_state.auth_info != NULL &&
 762                 p->conn->security_state.auth_info->auth_level == 6) {
 763
 764                 DATA_BLOB *xs;
 765                 DATA_BLOB *sec;
 766                 DATA_BLOB *enc_sec;
 767                 DATA_BLOB enc_sec_reverted;
 768                 DATA_BLOB *enc_xs;
 769                 DATA_BLOB des3_key;
 770                 DATA_BLOB iv;
 771                 DATA_BLOB blob2;
 772                 struct bkrp_client_side_unwrapped resp;
 773                 struct GUID * guid;
 774                 int t;
 775                 uint32_t size;
 776
 777                 torture_assert_ntstatus_ok(tctx, dcerpc_bkrp_BackupKey_r(b, tctx, &r),
 778                                                 "Get GUID");
 779
 780                 sec = create_unencryptedsecret(tctx, false, 2);
 781                 xs = create_access_check(tctx, p, tctx, "guest", false, 2);
 782                 if (xs == NULL) {
 783                         return false;
 784                 }
 785
 786                 enc_sec = encrypt_blob_pk(tctx, tctx, out_blob.data, out_blob.length, sec);
 787                 if (!enc_sec) {
 788                         return false;
 789                 }
 790                 /*
 791                 printf("Encrypted secret not encrypted\n");
 792                 print_hex(sec->data, sec->length);
 793                 printf("Access check not encrypted\n");
 794                 print_hex(xs->data, xs->length);
 795                 */
 796                 enc_sec_reverted.data = talloc_array(tctx, uint8_t, enc_sec->length);
 797                 enc_sec_reverted.length = enc_sec->length;
 798
 799                 for(t=0; t< enc_sec->length; t++) {
 800                         enc_sec_reverted.data[t] = ((uint8_t*)enc_sec->data)[enc_sec->length - t -1];
 801                         //enc_sec_reverted.data[t] = ((uint8_t*)enc_sec->data)[t];
 802                 }
 803
 804                 size = sec->length;
 805                 iv.data = sec->data+(size-8);
 806                 iv.length = 8;
 807
 808                 des3_key.data = sec->data+(size-32);
 809                 des3_key.length = 24;
 810
 811                 /*
 812                 printf("Triple des key\n");
 813                 print_hex(des3_key.data, 24);
 814                 */
 815                 enc_xs = encrypt_blob_3des(tctx, tctx, &des3_key, &iv, xs);
 816                 if (!enc_xs) {
 817                         return false;
 818                 }
 819                 /* To cope with the fact that heimdal do padding at the end for the moment */
 820                 enc_xs->length = xs->length;
 821                 /*
 822                 printf("Access check redecrypted: %d\n", tmp.length);
 823                 print_hex(tmp.data, tmp.length);
 824                 */
 825
 826                 data.version = 2;
 827                 data.encrypted_secret_len = enc_sec->length;
 828                 data.access_check_len = enc_xs->length;
 829                 guid = get_cert_guid(tctx, tctx, out_blob.data, out_blob.length);
 830                 if (guid == NULL) {
 831                         return false;
 832                 }
 833                 data.guid = *guid;
 834                 data.encrypted_secret = enc_sec_reverted.data;
 835                 data.access_check = enc_xs->data;
 836                 ndr_err = ndr_push_struct_blob(&blob2, tctx, &data, (ndr_push_flags_fn_t)ndr_push_bkrp_client_side_wrapped);
 837                 /*
 838                 printf("Encrypted secret encrypted\n");
 839                 print_hex(enc_sec->data, enc_sec->length);
 840                 printf("Access check encrypted\n");
 841                 print_hex(enc_xs->data, enc_xs->length);
 842                 */
 843                 ZERO_STRUCT(r);
 844                 GUID_from_string(BACKUPKEY_RESTORE_GUID, &g);
 845                 r.in.guidActionAgent = &g;
 846                 r.in.data_in = blob2.data;
 847                 r.in.data_in_len = blob2.length;
 848                 r.in.param = 0;
 849                 r.out.data_out = &out_blob.data;
 850                 r.out.data_out_len = &out_blob.length;
 851
 852                 torture_assert_ntstatus_ok(tctx, dcerpc_bkrp_BackupKey_r(b, tctx, &r), "Restore GUID");
 853                 ndr_err = ndr_pull_struct_blob(&out_blob, tctx, &resp, (ndr_pull_flags_fn_t)ndr_pull_bkrp_client_side_unwrapped);
 854                 torture_assert_int_equal(tctx, NDR_ERR_CODE_IS_SUCCESS(ndr_err), 0, "Unable to unmarshall bkrp_client_side_unwrapped");
 855                 torture_assert_werr_equal(tctx, r.out.result, WERR_INVALID_ACCESS, "Restore GUID");
 856         } else {
 857                 torture_assert_ntstatus_equal(tctx, dcerpc_bkrp_BackupKey_r(b, tctx, &r),
 858                         NT_STATUS_ACCESS_DENIED, "Get GUID");
 859         }
 860         return true;
 861 }
 862
 863 static bool test_RestoreGUID_v3(struct torture_context *tctx,
 864                                 struct dcerpc_pipe *p) {
 865         struct dcerpc_binding_handle *b = p->binding_handle;
 866         struct dcerpc_binding *binding = p->binding;
 867         struct bkrp_BackupKey r;
 868         struct bkrp_client_side_wrapped data;
 869         struct GUID g;
 870         enum ndr_err_code ndr_err;
 871         DATA_BLOB blob;
 872         DATA_BLOB out_blob;
 873
 874         binding->flags = binding->flags &(DCERPC_SEAL|DCERPC_AUTH_SPNEGO);
 875         ZERO_STRUCT(r);
 876         ZERO_STRUCT(data);
 877         GUID_from_string(BACKUPKEY_RETRIEVE_BACKUP_KEY_GUID, &g);
 878         r.in.guidActionAgent = &g;
 879         data.version = 3;
 880         data.encrypted_secret_len = 0;
 881         data.access_check_len = 0;
 882         ndr_err = ndr_push_struct_blob(&blob, tctx, &data, (ndr_push_flags_fn_t)ndr_push_bkrp_client_side_wrapped);
 883
 884         if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
 885                 return false;
 886         }
 887
 888         r.in.data_in = blob.data;
 889         r.in.data_in_len = blob.length;
 890         r.in.param = 0;
 891         r.out.data_out = &out_blob.data;
 892         r.out.data_out_len = &out_blob.length;
 893         if( p->conn->security_state.auth_info != NULL &&
 894                 p->conn->security_state.auth_info->auth_level == 6) {
 895
 896                 DATA_BLOB *xs;
 897                 DATA_BLOB *sec;
 898                 DATA_BLOB *enc_sec;
 899                 DATA_BLOB enc_sec_reverted;
 900                 DATA_BLOB *enc_xs;
 901                 DATA_BLOB aes_key;
 902                 DATA_BLOB iv;
 903                 DATA_BLOB blob2;
 904                 struct bkrp_client_side_unwrapped resp;
 905                 struct GUID * guid;
 906                 int t;
 907                 uint32_t size;
 908                 const char* user = cli_credentials_get_username(cmdline_credentials);
 909
 910                 torture_assert_ntstatus_ok(tctx, dcerpc_bkrp_BackupKey_r(b, tctx, &r),
 911                                                 "Get GUID");
 912
 913                 sec = create_unencryptedsecret(tctx, false, 3);
 914                 xs = create_access_check(tctx, p, tctx, user, false, 3);
 915                 if (xs == NULL) {
 916                         return false;
 917                 }
 918
 919                 enc_sec = encrypt_blob_pk(tctx, tctx, out_blob.data, out_blob.length, sec);
 920                 if (!enc_sec) {
 921                         return false;
 922                 }
 923                 /*
 924                 printf("Encrypted secret not encrypted\n");
 925                 print_hex(sec->data, sec->length);
 926                 printf("Access check not encrypted\n");
 927                 print_hex(xs->data, xs->length);
 928                 printf("\n");
 929                 for(t=0; t<xs->length-64; t++) {
 930                         fprintf(stderr, "%c", xs->data[t]);
 931                 }
 932                 print_hex(xs->data, xs->length-64);
 933                 */
 934
 935                 enc_sec_reverted.data = talloc_array(tctx, uint8_t, enc_sec->length);
 936                 enc_sec_reverted.length = enc_sec->length;
 937
 938                 for(t=0; t< enc_sec->length; t++) {
 939                         enc_sec_reverted.data[t] = ((uint8_t*)enc_sec->data)[enc_sec->length - t -1];
 940                         //enc_sec_reverted.data[t] = ((uint8_t*)enc_sec->data)[t];
 941                 }
 942
 943                 size = sec->length;
 944                 iv.data = sec->data+(size-16);
 945                 iv.length = 16;
 946
 947                 aes_key.data = sec->data+(size-48);
 948                 aes_key.length = 32;
 949
 950                 /*
 951                 printf("Triple des key\n");
 952                 print_hex(des3_key.data, 24);
 953                 */
 954                 enc_xs = encrypt_blob_aes(tctx, tctx, &aes_key, &iv, xs);
 955                 if (!enc_xs) {
 956                         return false;
 957                 }
 958                 /* To cope with the fact that heimdal do padding at the end for the moment */
 959                 enc_xs->length = xs->length;
 960                 /*
 961                 printf("Access check redecrypted: %d\n", tmp.length);
 962                 print_hex(tmp.data, tmp.length);
 963                 */
 964
 965                 data.version = 3;
 966                 data.encrypted_secret_len = enc_sec->length;
 967                 data.access_check_len = enc_xs->length;
 968                 guid = get_cert_guid(tctx, tctx, out_blob.data, out_blob.length);
 969                 if (guid == NULL) {
 970                         return false;
 971                 }
 972                 data.guid = *guid;
 973                 data.encrypted_secret = enc_sec_reverted.data;
 974                 data.access_check = enc_xs->data;
 975                 ndr_err = ndr_push_struct_blob(&blob2, tctx, &data, (ndr_push_flags_fn_t)ndr_push_bkrp_client_side_wrapped);
 976                 ZERO_STRUCT(r);
 977                 GUID_from_string(BACKUPKEY_RESTORE_GUID, &g);
 978                 r.in.guidActionAgent = &g;
 979                 r.in.data_in = blob2.data;
 980                 r.in.data_in_len = blob2.length;
 981                 r.in.param = 0;
 982                 r.out.data_out = &out_blob.data;
 983                 r.out.data_out_len = &out_blob.length;
 984
 985                 torture_assert_ntstatus_ok(tctx, dcerpc_bkrp_BackupKey_r(b, tctx, &r), "Restore GUID");
 986                 ndr_err = ndr_pull_struct_blob(&out_blob, tctx, &resp, (ndr_pull_flags_fn_t)ndr_pull_bkrp_client_side_unwrapped);
 987                 torture_assert_int_equal(tctx, NDR_ERR_CODE_IS_SUCCESS(ndr_err), 1, "Unable to unmarshall bkrp_client_side_unwrapped");
 988                 torture_assert_werr_equal(tctx, r.out.result, WERR_OK, "Restore GUID");
 989                 torture_assert_str_equal(tctx, (char*)resp.secret.data, secret, "Wrong secret");
 990         } else {
 991                 torture_assert_ntstatus_equal(tctx, dcerpc_bkrp_BackupKey_r(b, tctx, &r),
 992                         NT_STATUS_ACCESS_DENIED, "Get GUID");
 993         }
 994         return true;
 995 }
 996
 997 static bool test_RestoreGUID(struct torture_context *tctx,
 998                                 struct dcerpc_pipe *p) {
 999         struct dcerpc_binding_handle *b = p->binding_handle;
1000         struct dcerpc_binding *binding = p->binding;
1001         struct bkrp_BackupKey r;
1002         struct bkrp_client_side_wrapped data;
1003         struct GUID g;
1004         enum ndr_err_code ndr_err;
1005         DATA_BLOB blob;
1006         DATA_BLOB out_blob;
1007
1008         binding->flags = binding->flags &(DCERPC_SEAL|DCERPC_AUTH_SPNEGO);
1009         ZERO_STRUCT(r);
1010         ZERO_STRUCT(data);
1011         GUID_from_string(BACKUPKEY_RETRIEVE_BACKUP_KEY_GUID, &g);
1012         r.in.guidActionAgent = &g;
1013         data.version = 2;
1014         data.encrypted_secret_len = 0;
1015         data.access_check_len = 0;
1016         ndr_err = ndr_push_struct_blob(&blob, tctx, &data, (ndr_push_flags_fn_t)ndr_push_bkrp_client_side_wrapped);
1017
1018         if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
1019                 return false;
1020         }
1021
1022         r.in.data_in = blob.data;
1023         r.in.data_in_len = blob.length;
1024         r.in.param = 0;
1025         r.out.data_out = &out_blob.data;
1026         r.out.data_out_len = &out_blob.length;
1027         if( p->conn->security_state.auth_info != NULL &&
1028                 p->conn->security_state.auth_info->auth_level == 6) {
1029
1030                 DATA_BLOB *xs;
1031                 DATA_BLOB *sec;
1032                 DATA_BLOB *enc_sec;
1033                 DATA_BLOB enc_sec_reverted;
1034                 DATA_BLOB *enc_xs;
1035                 DATA_BLOB des3_key;
1036                 DATA_BLOB iv;
1037                 DATA_BLOB blob2;
1038                 struct bkrp_client_side_unwrapped resp;
1039                 struct GUID * guid;
1040                 int t;
1041                 uint32_t size;
1042                 const char* user = cli_credentials_get_username(cmdline_credentials);
1043
1044                 torture_assert_ntstatus_ok(tctx, dcerpc_bkrp_BackupKey_r(b, tctx, &r),
1045                                                 "Get GUID");
1046
1047                 sec = create_unencryptedsecret(tctx, false, 2);
1048                 xs = create_access_check(tctx, p, tctx, user, false, 2);
1049                 if (xs == NULL) {
1050                         return false;
1051                 }
1052
1053                 enc_sec = encrypt_blob_pk(tctx, tctx, out_blob.data, out_blob.length, sec);
1054                 if (!enc_sec) {
1055                         return false;
1056                 }
1057                 /*
1058                 printf("Encrypted secret not encrypted\n");
1059                 print_hex(sec->data, sec->length);
1060                 printf("Access check not encrypted\n");
1061                 print_hex(xs->data, xs->length);
1062                 */
1063                 enc_sec_reverted.data = talloc_array(tctx, uint8_t, enc_sec->length);
1064                 enc_sec_reverted.length = enc_sec->length;
1065
1066                 for(t=0; t< enc_sec->length; t++) {
1067                         enc_sec_reverted.data[t] = ((uint8_t*)enc_sec->data)[enc_sec->length - t -1];
1068                         //enc_sec_reverted.data[t] = ((uint8_t*)enc_sec->data)[t];
1069                 }
1070
1071                 size = sec->length;
1072                 iv.data = sec->data+(size-8);
1073                 iv.length = 8;
1074
1075                 des3_key.data = sec->data+(size-32);
1076                 des3_key.length = 24;
1077
1078                 /*
1079                 printf("Triple des key\n");
1080                 print_hex(des3_key.data, 24);
1081                 */
1082                 enc_xs = encrypt_blob_3des(tctx, tctx, &des3_key, &iv, xs);
1083                 if (!enc_xs) {
1084                         return false;
1085                 }
1086                 /* To cope with the fact that heimdal do padding at the end for the moment */
1087                 enc_xs->length = xs->length;
1088                 /*
1089                 printf("Access check redecrypted: %d\n", tmp.length);
1090                 print_hex(tmp.data, tmp.length);
1091                 */
1092
1093                 data.version = 2;
1094                 data.encrypted_secret_len = enc_sec->length;
1095                 data.access_check_len = enc_xs->length;
1096                 guid = get_cert_guid(tctx, tctx, out_blob.data, out_blob.length);
1097                 if (guid == NULL) {
1098                         return false;
1099                 }
1100                 data.guid = *guid;
1101                 data.encrypted_secret = enc_sec_reverted.data;
1102                 data.access_check = enc_xs->data;
1103                 ndr_err = ndr_push_struct_blob(&blob2, tctx, &data, (ndr_push_flags_fn_t)ndr_push_bkrp_client_side_wrapped);
1104                 ZERO_STRUCT(r);
1105                 GUID_from_string(BACKUPKEY_RESTORE_GUID, &g);
1106                 r.in.guidActionAgent = &g;
1107                 r.in.data_in = blob2.data;
1108                 r.in.data_in_len = blob2.length;
1109                 r.in.param = 0;
1110                 r.out.data_out = &out_blob.data;
1111                 r.out.data_out_len = &out_blob.length;
1112
1113                 torture_assert_ntstatus_ok(tctx, dcerpc_bkrp_BackupKey_r(b, tctx, &r), "Restore GUID");
1114                 ndr_err = ndr_pull_struct_blob(&out_blob, tctx, &resp, (ndr_pull_flags_fn_t)ndr_pull_bkrp_client_side_unwrapped);
1115                 torture_assert_int_equal(tctx, NDR_ERR_CODE_IS_SUCCESS(ndr_err), 1, "Unable to unmarshall bkrp_client_side_unwrapped");
1116                 torture_assert_werr_equal(tctx, r.out.result, WERR_OK, "Restore GUID");
1117                 torture_assert_str_equal(tctx, (char*)resp.secret.data, secret, "Wrong secret");
1118         } else {
1119                 torture_assert_ntstatus_equal(tctx, dcerpc_bkrp_BackupKey_r(b, tctx, &r),
1120                         NT_STATUS_ACCESS_DENIED, "Get GUID");
1121         }
1122         return true;
1123 }
1124
1125 static bool test_RestoreGUID_badmagiconsecret(struct torture_context *tctx,
1126                                 struct dcerpc_pipe *p) {
1127         struct dcerpc_binding_handle *b = p->binding_handle;
1128         struct dcerpc_binding *binding = p->binding;
1129         struct bkrp_BackupKey r;
1130         struct bkrp_client_side_wrapped data;
1131         struct GUID g;
1132         enum ndr_err_code ndr_err;
1133         DATA_BLOB blob;
1134         DATA_BLOB out_blob;
1135
1136         binding->flags = binding->flags &(DCERPC_SEAL|DCERPC_AUTH_SPNEGO);
1137         ZERO_STRUCT(r);
1138         ZERO_STRUCT(data);
1139         GUID_from_string(BACKUPKEY_RETRIEVE_BACKUP_KEY_GUID, &g);
1140         r.in.guidActionAgent = &g;
1141         data.version = 2;
1142         data.encrypted_secret_len = 0;
1143         data.access_check_len = 0;
1144         ndr_err = ndr_push_struct_blob(&blob, tctx, &data, (ndr_push_flags_fn_t)ndr_push_bkrp_client_side_wrapped);
1145
1146         if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
1147                 return false;
1148         }
1149
1150         r.in.data_in = blob.data;
1151         r.in.data_in_len = blob.length;
1152         r.in.param = 0;
1153         r.out.data_out = &out_blob.data;
1154         r.out.data_out_len = &out_blob.length;
1155         if( p->conn->security_state.auth_info != NULL &&
1156                 p->conn->security_state.auth_info->auth_level == 6) {
1157
1158                 DATA_BLOB *xs;
1159                 DATA_BLOB *sec;
1160                 DATA_BLOB *enc_sec;
1161                 DATA_BLOB enc_sec_reverted;
1162                 DATA_BLOB *enc_xs;
1163                 DATA_BLOB des3_key;
1164                 DATA_BLOB iv;
1165                 DATA_BLOB blob2;
1166                 struct bkrp_client_side_unwrapped resp;
1167                 struct GUID * guid;
1168                 int t;
1169                 uint32_t size;
1170                 const char* user = cli_credentials_get_username(cmdline_credentials);
1171
1172                 torture_assert_ntstatus_ok(tctx, dcerpc_bkrp_BackupKey_r(b, tctx, &r),
1173                                                 "Get GUID");
1174
1175                 sec = create_unencryptedsecret(tctx, true, 2);
1176                 xs = create_access_check(tctx, p, tctx, user, false, 2);
1177                 if (xs == NULL) {
1178                         return false;
1179                 }
1180
1181                 enc_sec = encrypt_blob_pk(tctx, tctx, out_blob.data, out_blob.length, sec);
1182                 if (!enc_sec) {
1183                         return false;
1184                 }
1185                 /*
1186                 printf("Encrypted secret not encrypted\n");
1187                 print_hex(sec->data, sec->length);
1188                 printf("Access check not encrypted\n");
1189                 print_hex(xs->data, xs->length);
1190                 */
1191                 enc_sec_reverted.data = talloc_array(tctx, uint8_t, enc_sec->length);
1192                 enc_sec_reverted.length = enc_sec->length;
1193
1194                 for(t=0; t< enc_sec->length; t++) {
1195                         enc_sec_reverted.data[t] = ((uint8_t*)enc_sec->data)[enc_sec->length - t -1];
1196                         //enc_sec_reverted.data[t] = ((uint8_t*)enc_sec->data)[t];
1197                 }
1198
1199                 size = sec->length;
1200                 iv.data = sec->data+(size-8);
1201                 iv.length = 8;
1202
1203                 des3_key.data = sec->data+(size-32);
1204                 des3_key.length = 24;
1205
1206                 /*
1207                 printf("Triple des key\n");
1208                 print_hex(des3_key.data, 24);
1209                 */
1210                 enc_xs = encrypt_blob_3des(tctx, tctx, &des3_key, &iv, xs);
1211                 if (!enc_xs) {
1212                         return false;
1213                 }
1214                 /* To cope with the fact that heimdal do padding at the end for the moment */
1215                 enc_xs->length = xs->length;
1216                 /*
1217                 printf("Access check redecrypted: %d\n", tmp.length);
1218                 print_hex(tmp.data, tmp.length);
1219                 */
1220
1221                 data.version = 2;
1222                 data.encrypted_secret_len = enc_sec->length;
1223                 data.access_check_len = enc_xs->length;
1224                 guid = get_cert_guid(tctx, tctx, out_blob.data, out_blob.length);
1225                 if (guid == NULL) {
1226                         return false;
1227                 }
1228                 data.guid = *guid;
1229                 data.encrypted_secret = enc_sec_reverted.data;
1230                 data.access_check = enc_xs->data;
1231                 ndr_err = ndr_push_struct_blob(&blob2, tctx, &data, (ndr_push_flags_fn_t)ndr_push_bkrp_client_side_wrapped);
1232                 ZERO_STRUCT(r);
1233                 GUID_from_string(BACKUPKEY_RESTORE_GUID, &g);
1234                 r.in.guidActionAgent = &g;
1235                 r.in.data_in = blob2.data;
1236                 r.in.data_in_len = blob2.length;
1237                 r.in.param = 0;
1238                 r.out.data_out = &out_blob.data;
1239                 r.out.data_out_len = &out_blob.length;
1240
1241                 torture_assert_ntstatus_ok(tctx, dcerpc_bkrp_BackupKey_r(b, tctx, &r), "Restore GUID");
1242                 ndr_err = ndr_pull_struct_blob(&out_blob, tctx, &resp, (ndr_pull_flags_fn_t)ndr_pull_bkrp_client_side_unwrapped);
1243                 torture_assert_int_equal(tctx, NDR_ERR_CODE_IS_SUCCESS(ndr_err), 0, "Unable to unmarshall bkrp_client_side_unwrapped");
1244                 torture_assert_werr_equal(tctx, r.out.result, WERR_INVALID_DATA, "Wrong error code while providing bad magic in secret");
1245         } else {
1246                 torture_assert_ntstatus_equal(tctx, dcerpc_bkrp_BackupKey_r(b, tctx, &r),
1247                         NT_STATUS_ACCESS_DENIED, "Get GUID");
1248         }
1249         return true;
1250 }
1251
1252 static bool test_RestoreGUID_emptyrequest(struct torture_context *tctx,
1253                                 struct dcerpc_pipe *p) {
1254         struct dcerpc_binding_handle *b = p->binding_handle;
1255         struct dcerpc_binding *binding = p->binding;
1256         struct bkrp_BackupKey r;
1257         struct bkrp_client_side_wrapped data;
1258         struct GUID g;
1259         enum ndr_err_code ndr_err;
1260         DATA_BLOB blob;
1261         DATA_BLOB out_blob;
1262
1263         binding->flags = binding->flags &(DCERPC_SEAL|DCERPC_AUTH_SPNEGO);
1264         ZERO_STRUCT(r);
1265         ZERO_STRUCT(data);
1266         GUID_from_string(BACKUPKEY_RETRIEVE_BACKUP_KEY_GUID, &g);
1267         r.in.guidActionAgent = &g;
1268         data.version = 2;
1269         data.encrypted_secret_len = 0;
1270         data.access_check_len = 0;
1271         ndr_err = ndr_push_struct_blob(&blob, tctx, &data, (ndr_push_flags_fn_t)ndr_push_bkrp_client_side_wrapped);
1272
1273         if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
1274                 return false;
1275         }
1276
1277         r.in.data_in = blob.data;
1278         r.in.data_in_len = blob.length;
1279         r.in.param = 0;
1280         r.out.data_out = &out_blob.data;
1281         r.out.data_out_len = &out_blob.length;
1282         if( p->conn->security_state.auth_info != NULL &&
1283                 p->conn->security_state.auth_info->auth_level == 6) {
1284
1285                 struct bkrp_client_side_unwrapped resp;
1286                 struct GUID * guid;
1287
1288                 torture_assert_ntstatus_ok(tctx, dcerpc_bkrp_BackupKey_r(b, tctx, &r),
1289                                                 "Get GUID");
1290
1291                 guid = get_cert_guid(tctx, tctx, out_blob.data, out_blob.length);
1292                 if (guid == NULL) {
1293                         return false;
1294                 }
1295                 data.guid = *guid;
1296                 ZERO_STRUCT(r);
1297                 GUID_from_string(BACKUPKEY_RESTORE_GUID, &g);
1298                 r.in.guidActionAgent = &g;
1299                 r.in.data_in = talloc(tctx, uint8_t);
1300                 r.in.data_in_len = 0;
1301                 r.in.param = 0;
1302                 r.out.data_out = &out_blob.data;
1303                 r.out.data_out_len = &out_blob.length;
1304
1305                 torture_assert_ntstatus_ok(tctx, dcerpc_bkrp_BackupKey_r(b, tctx, &r), "Restore GUID");
1306                 ndr_err = ndr_pull_struct_blob(&out_blob, tctx, &resp, (ndr_pull_flags_fn_t)ndr_pull_bkrp_client_side_unwrapped);
1307                 torture_assert_int_equal(tctx, NDR_ERR_CODE_IS_SUCCESS(ndr_err), 0, "Unable to unmarshall bkrp_client_side_unwrapped");
1308                 torture_assert_werr_equal(tctx, r.out.result, WERR_INVALID_PARAM, "Bad error code on wrong has in access check");
1309         } else {
1310                 torture_assert_ntstatus_equal(tctx, dcerpc_bkrp_BackupKey_r(b, tctx, &r),
1311                         NT_STATUS_ACCESS_DENIED, "Get GUID");
1312         }
1313         return true;
1314 }
1315
1316 static bool test_RestoreGUID_badcertguid(struct torture_context *tctx,
1317                                 struct dcerpc_pipe *p) {
1318         struct dcerpc_binding_handle *b = p->binding_handle;
1319         struct dcerpc_binding *binding = p->binding;
1320         struct bkrp_BackupKey r;
1321         struct bkrp_client_side_wrapped data;
1322         struct GUID g;
1323         enum ndr_err_code ndr_err;
1324         DATA_BLOB blob;
1325         DATA_BLOB out_blob;
1326
1327         binding->flags = binding->flags &(DCERPC_SEAL|DCERPC_AUTH_SPNEGO);
1328         ZERO_STRUCT(r);
1329         ZERO_STRUCT(data);
1330         GUID_from_string(BACKUPKEY_RETRIEVE_BACKUP_KEY_GUID, &g);
1331         r.in.guidActionAgent = &g;
1332         data.version = 2;
1333         data.encrypted_secret_len = 0;
1334         data.access_check_len = 0;
1335         ndr_err = ndr_push_struct_blob(&blob, tctx, &data, (ndr_push_flags_fn_t)ndr_push_bkrp_client_side_wrapped);
1336
1337         if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
1338                 return false;
1339         }
1340
1341         r.in.data_in = blob.data;
1342         r.in.data_in_len = blob.length;
1343         r.in.param = 0;
1344         r.out.data_out = &out_blob.data;
1345         r.out.data_out_len = &out_blob.length;
1346         if( p->conn->security_state.auth_info != NULL &&
1347                 p->conn->security_state.auth_info->auth_level == 6) {
1348
1349                 DATA_BLOB *xs;
1350                 DATA_BLOB *sec;
1351                 DATA_BLOB *enc_sec;
1352                 DATA_BLOB enc_sec_reverted;
1353                 DATA_BLOB *enc_xs;
1354                 DATA_BLOB des3_key;
1355                 DATA_BLOB iv;
1356                 DATA_BLOB blob2;
1357                 struct bkrp_client_side_unwrapped resp;
1358                 struct GUID * guid;
1359                 int t;
1360                 uint32_t size;
1361                 const char* user = cli_credentials_get_username(cmdline_credentials);
1362
1363                 torture_assert_ntstatus_ok(tctx, dcerpc_bkrp_BackupKey_r(b, tctx, &r),
1364                                                 "Get GUID");
1365
1366                 sec = create_unencryptedsecret(tctx, false, 2);
1367                 xs = create_access_check(tctx, p, tctx, user, false, 2);
1368                 if (xs == NULL) {
1369                         return false;
1370                 }
1371                 xs->data[0]++;
1372
1373                 enc_sec = encrypt_blob_pk(tctx, tctx, out_blob.data, out_blob.length, sec);
1374                 if (!enc_sec) {
1375                         return false;
1376                 }
1377                 /*
1378                 printf("Encrypted secret not encrypted\n");
1379                 print_hex(sec->data, sec->length);
1380                 printf("Access check not encrypted\n");
1381                 print_hex(xs->data, xs->length);
1382                 */
1383                 enc_sec_reverted.data = talloc_array(tctx, uint8_t, enc_sec->length);
1384                 enc_sec_reverted.length = enc_sec->length;
1385
1386                 for(t=0; t< enc_sec->length; t++) {
1387                         enc_sec_reverted.data[t] = ((uint8_t*)enc_sec->data)[enc_sec->length - t -1];
1388                         //enc_sec_reverted.data[t] = ((uint8_t*)enc_sec->data)[t];
1389                 }
1390
1391                 size = sec->length;
1392                 iv.data = sec->data+(size-8);
1393                 iv.length = 8;
1394
1395                 des3_key.data = sec->data+(size-32);
1396                 des3_key.length = 24;
1397
1398                 /*
1399                 printf("Triple des key\n");
1400                 print_hex(des3_key.data, 24);
1401                 */
1402                 enc_xs = encrypt_blob_3des(tctx, tctx, &des3_key, &iv, xs);
1403                 if (!enc_xs) {
1404                         return false;
1405                 }
1406                 /* To cope with the fact that heimdal do padding at the end for the moment */
1407                 enc_xs->length = xs->length;
1408                 /*
1409                 printf("Access check redecrypted: %d\n", tmp.length);
1410                 print_hex(tmp.data, tmp.length);
1411                 */
1412
1413                 data.version = 2;
1414                 data.encrypted_secret_len = enc_sec->length;
1415                 data.access_check_len = enc_xs->length;
1416                 guid = get_cert_guid(tctx, tctx, out_blob.data, out_blob.length);
1417                 if (guid == NULL) {
1418                         return false;
1419                 }
1420                 data.guid = GUID_random();
1421                 data.encrypted_secret = enc_sec_reverted.data;
1422                 data.access_check = enc_xs->data;
1423                 ndr_err = ndr_push_struct_blob(&blob2, tctx, &data, (ndr_push_flags_fn_t)ndr_push_bkrp_client_side_wrapped);
1424                 ZERO_STRUCT(r);
1425                 GUID_from_string(BACKUPKEY_RESTORE_GUID, &g);
1426                 r.in.guidActionAgent = &g;
1427                 r.in.data_in = blob2.data;
1428                 r.in.data_in_len = blob2.length;
1429                 r.in.param = 0;
1430                 r.out.data_out = &out_blob.data;
1431                 r.out.data_out_len = &out_blob.length;
1432
1433                 torture_assert_ntstatus_ok(tctx, dcerpc_bkrp_BackupKey_r(b, tctx, &r), "Restore GUID");
1434                 ndr_err = ndr_pull_struct_blob(&out_blob, tctx, &resp, (ndr_pull_flags_fn_t)ndr_pull_bkrp_client_side_unwrapped);
1435                 torture_assert_int_equal(tctx, NDR_ERR_CODE_IS_SUCCESS(ndr_err), 0, "Unable to unmarshall bkrp_client_side_unwrapped");
1436                 torture_assert_werr_equal(tctx, r.out.result, WERR_FILE_NOT_FOUND, "Bad error code on wrong has in access check");
1437         } else {
1438                 torture_assert_ntstatus_equal(tctx, dcerpc_bkrp_BackupKey_r(b, tctx, &r),
1439                         NT_STATUS_ACCESS_DENIED, "Get GUID");
1440         }
1441         return true;
1442 }
1443
1444 static bool test_RestoreGUID_badmagicaccesscheck(struct torture_context *tctx,
1445                                 struct dcerpc_pipe *p) {
1446         struct dcerpc_binding_handle *b = p->binding_handle;
1447         struct dcerpc_binding *binding = p->binding;
1448         struct bkrp_BackupKey r;
1449         struct bkrp_client_side_wrapped data;
1450         struct GUID g;
1451         enum ndr_err_code ndr_err;
1452         DATA_BLOB blob;
1453         DATA_BLOB out_blob;
1454
1455         binding->flags = binding->flags &(DCERPC_SEAL|DCERPC_AUTH_SPNEGO);
1456         ZERO_STRUCT(r);
1457         ZERO_STRUCT(data);
1458         GUID_from_string(BACKUPKEY_RETRIEVE_BACKUP_KEY_GUID, &g);
1459         r.in.guidActionAgent = &g;
1460         data.version = 2;
1461         data.encrypted_secret_len = 0;
1462         data.access_check_len = 0;
1463         ndr_err = ndr_push_struct_blob(&blob, tctx, &data, (ndr_push_flags_fn_t)ndr_push_bkrp_client_side_wrapped);
1464
1465         if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
1466                 return false;
1467         }
1468
1469         r.in.data_in = blob.data;
1470         r.in.data_in_len = blob.length;
1471         r.in.param = 0;
1472         r.out.data_out = &out_blob.data;
1473         r.out.data_out_len = &out_blob.length;
1474         if( p->conn->security_state.auth_info != NULL &&
1475                 p->conn->security_state.auth_info->auth_level == 6) {
1476
1477                 DATA_BLOB *xs;
1478                 DATA_BLOB *sec;
1479                 DATA_BLOB *enc_sec;
1480                 DATA_BLOB enc_sec_reverted;
1481                 DATA_BLOB *enc_xs;
1482                 DATA_BLOB des3_key;
1483                 DATA_BLOB iv;
1484                 DATA_BLOB blob2;
1485                 struct bkrp_client_side_unwrapped resp;
1486                 struct GUID * guid;
1487                 int t;
1488                 uint32_t size;
1489                 const char* user = cli_credentials_get_username(cmdline_credentials);
1490
1491                 torture_assert_ntstatus_ok(tctx, dcerpc_bkrp_BackupKey_r(b, tctx, &r),
1492                                                 "Get GUID");
1493
1494                 sec = create_unencryptedsecret(tctx, false, 2);
1495                 xs = create_access_check(tctx, p, tctx, user, false, 2);
1496                 if (xs == NULL) {
1497                         return false;
1498                 }
1499                 xs->data[0]++;
1500
1501                 enc_sec = encrypt_blob_pk(tctx, tctx, out_blob.data, out_blob.length, sec);
1502                 if (!enc_sec) {
1503                         return false;
1504                 }
1505                 /*
1506                 printf("Encrypted secret not encrypted\n");
1507                 print_hex(sec->data, sec->length);
1508                 printf("Access check not encrypted\n");
1509                 print_hex(xs->data, xs->length);
1510                 */
1511                 enc_sec_reverted.data = talloc_array(tctx, uint8_t, enc_sec->length);
1512                 enc_sec_reverted.length = enc_sec->length;
1513
1514                 for(t=0; t< enc_sec->length; t++) {
1515                         enc_sec_reverted.data[t] = ((uint8_t*)enc_sec->data)[enc_sec->length - t -1];
1516                         //enc_sec_reverted.data[t] = ((uint8_t*)enc_sec->data)[t];
1517                 }
1518
1519                 size = sec->length;
1520                 iv.data = sec->data+(size-8);
1521                 iv.length = 8;
1522
1523                 des3_key.data = sec->data+(size-32);
1524                 des3_key.length = 24;
1525
1526                 /*
1527                 printf("Triple des key\n");
1528                 print_hex(des3_key.data, 24);
1529                 */
1530                 enc_xs = encrypt_blob_3des(tctx, tctx, &des3_key, &iv, xs);
1531                 if (!enc_xs) {
1532                         return false;
1533                 }
1534                 /* To cope with the fact that heimdal do padding at the end for the moment */
1535                 enc_xs->length = xs->length;
1536                 /*
1537                 printf("Access check redecrypted: %d\n", tmp.length);
1538                 print_hex(tmp.data, tmp.length);
1539                 */
1540
1541                 data.version = 2;
1542                 data.encrypted_secret_len = enc_sec->length;
1543                 data.access_check_len = enc_xs->length;
1544                 guid = get_cert_guid(tctx, tctx, out_blob.data, out_blob.length);
1545                 if (guid == NULL) {
1546                         return false;
1547                 }
1548                 data.guid = *guid;
1549                 data.encrypted_secret = enc_sec_reverted.data;
1550                 data.access_check = enc_xs->data;
1551                 ndr_err = ndr_push_struct_blob(&blob2, tctx, &data, (ndr_push_flags_fn_t)ndr_push_bkrp_client_side_wrapped);
1552                 ZERO_STRUCT(r);
1553                 GUID_from_string(BACKUPKEY_RESTORE_GUID, &g);
1554                 r.in.guidActionAgent = &g;
1555                 r.in.data_in = blob2.data;
1556                 r.in.data_in_len = blob2.length;
1557                 r.in.param = 0;
1558                 r.out.data_out = &out_blob.data;
1559                 r.out.data_out_len = &out_blob.length;
1560
1561                 torture_assert_ntstatus_ok(tctx, dcerpc_bkrp_BackupKey_r(b, tctx, &r), "Restore GUID");
1562                 ndr_err = ndr_pull_struct_blob(&out_blob, tctx, &resp, (ndr_pull_flags_fn_t)ndr_pull_bkrp_client_side_unwrapped);
1563                 torture_assert_int_equal(tctx, NDR_ERR_CODE_IS_SUCCESS(ndr_err), 0, "Unable to unmarshall bkrp_client_side_unwrapped");
1564                 torture_assert_werr_equal(tctx, r.out.result, WERR_INVALID_DATA, "Bad error code on wrong has in access check");
1565         } else {
1566                 torture_assert_ntstatus_equal(tctx, dcerpc_bkrp_BackupKey_r(b, tctx, &r),
1567                         NT_STATUS_ACCESS_DENIED, "Get GUID");
1568         }
1569         return true;
1570 }
1571
1572 static bool test_RestoreGUID_badhashaccesscheck(struct torture_context *tctx,
1573                                 struct dcerpc_pipe *p) {
1574         struct dcerpc_binding_handle *b = p->binding_handle;
1575         struct dcerpc_binding *binding = p->binding;
1576         struct bkrp_BackupKey r;
1577         struct bkrp_client_side_wrapped data;
1578         struct GUID g;
1579         enum ndr_err_code ndr_err;
1580         DATA_BLOB blob;
1581         DATA_BLOB out_blob;
1582
1583         binding->flags = binding->flags &(DCERPC_SEAL|DCERPC_AUTH_SPNEGO);
1584         ZERO_STRUCT(r);
1585         ZERO_STRUCT(data);
1586         GUID_from_string(BACKUPKEY_RETRIEVE_BACKUP_KEY_GUID, &g);
1587         r.in.guidActionAgent = &g;
1588         data.version = 2;
1589         data.encrypted_secret_len = 0;
1590         data.access_check_len = 0;
1591         ndr_err = ndr_push_struct_blob(&blob, tctx, &data, (ndr_push_flags_fn_t)ndr_push_bkrp_client_side_wrapped);
1592
1593         if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
1594                 return false;
1595         }
1596
1597         r.in.data_in = blob.data;
1598         r.in.data_in_len = blob.length;
1599         r.in.param = 0;
1600         r.out.data_out = &out_blob.data;
1601         r.out.data_out_len = &out_blob.length;
1602         if( p->conn->security_state.auth_info != NULL &&
1603                 p->conn->security_state.auth_info->auth_level == 6) {
1604
1605                 DATA_BLOB *xs;
1606                 DATA_BLOB *sec;
1607                 DATA_BLOB *enc_sec;
1608                 DATA_BLOB enc_sec_reverted;
1609                 DATA_BLOB *enc_xs;
1610                 DATA_BLOB des3_key;
1611                 DATA_BLOB iv;
1612                 DATA_BLOB blob2;
1613                 struct bkrp_client_side_unwrapped resp;
1614                 struct GUID * guid;
1615                 int t;
1616                 uint32_t size;
1617                 const char* user = cli_credentials_get_username(cmdline_credentials);
1618
1619                 torture_assert_ntstatus_ok(tctx, dcerpc_bkrp_BackupKey_r(b, tctx, &r),
1620                                                 "Get GUID");
1621
1622                 sec = create_unencryptedsecret(tctx, false, 2);
1623                 xs = create_access_check(tctx, p, tctx, user, true, 2);
1624                 if (xs == NULL) {
1625                         return false;
1626                 }
1627
1628                 enc_sec = encrypt_blob_pk(tctx, tctx, out_blob.data, out_blob.length, sec);
1629                 if (!enc_sec) {
1630                         return false;
1631                 }
1632                 /*
1633                 printf("Encrypted secret not encrypted\n");
1634                 print_hex(sec->data, sec->length);
1635                 printf("Access check not encrypted\n");
1636                 print_hex(xs->data, xs->length);
1637                 */
1638                 enc_sec_reverted.data = talloc_array(tctx, uint8_t, enc_sec->length);
1639                 enc_sec_reverted.length = enc_sec->length;
1640
1641                 for(t=0; t< enc_sec->length; t++) {
1642                         enc_sec_reverted.data[t] = ((uint8_t*)enc_sec->data)[enc_sec->length - t -1];
1643                         //enc_sec_reverted.data[t] = ((uint8_t*)enc_sec->data)[t];
1644                 }
1645
1646                 size = sec->length;
1647                 iv.data = sec->data+(size-8);
1648                 iv.length = 8;
1649
1650                 des3_key.data = sec->data+(size-32);
1651                 des3_key.length = 24;
1652
1653                 /*
1654                 printf("Triple des key\n");
1655                 print_hex(des3_key.data, 24);
1656                 */
1657                 enc_xs = encrypt_blob_3des(tctx, tctx, &des3_key, &iv, xs);
1658                 if (!enc_xs) {
1659                         return false;
1660                 }
1661                 /* To cope with the fact that heimdal do padding at the end for the moment */
1662                 enc_xs->length = xs->length;
1663                 /*
1664                 printf("Access check redecrypted: %d\n", tmp.length);
1665                 print_hex(tmp.data, tmp.length);
1666                 */
1667
1668                 data.version = 2;
1669                 data.encrypted_secret_len = enc_sec->length;
1670                 data.access_check_len = enc_xs->length;
1671                 guid = get_cert_guid(tctx, tctx, out_blob.data, out_blob.length);
1672                 if (guid == NULL) {
1673                         return false;
1674                 }
1675                 data.guid = *guid;
1676                 data.encrypted_secret = enc_sec_reverted.data;
1677                 data.access_check = enc_xs->data;
1678                 ndr_err = ndr_push_struct_blob(&blob2, tctx, &data, (ndr_push_flags_fn_t)ndr_push_bkrp_client_side_wrapped);
1679                 ZERO_STRUCT(r);
1680                 GUID_from_string(BACKUPKEY_RESTORE_GUID, &g);
1681                 r.in.guidActionAgent = &g;
1682                 r.in.data_in = blob2.data;
1683                 r.in.data_in_len = blob2.length;
1684                 r.in.param = 0;
1685                 r.out.data_out = &out_blob.data;
1686                 r.out.data_out_len = &out_blob.length;
1687
1688                 torture_assert_ntstatus_ok(tctx, dcerpc_bkrp_BackupKey_r(b, tctx, &r), "Restore GUID");
1689                 ndr_err = ndr_pull_struct_blob(&out_blob, tctx, &resp, (ndr_pull_flags_fn_t)ndr_pull_bkrp_client_side_unwrapped);
1690                 torture_assert_int_equal(tctx, NDR_ERR_CODE_IS_SUCCESS(ndr_err), 0, "Unable to unmarshall bkrp_client_side_unwrapped");
1691                 torture_assert_werr_equal(tctx, r.out.result, WERR_INVALID_DATA, "Bad error code on wrong has in access check");
1692         } else {
1693                 torture_assert_ntstatus_equal(tctx, dcerpc_bkrp_BackupKey_r(b, tctx, &r),
1694                         NT_STATUS_ACCESS_DENIED, "Get GUID");
1695         }
1696         return true;
1697 }
1698
1699 struct torture_suite *torture_rpc_backupkey(TALLOC_CTX *mem_ctx)
1700 {
1701         struct torture_rpc_tcase *tcase;
1702         struct torture_suite *suite = torture_suite_create(mem_ctx, "BACKUPKEY");
1703         struct torture_test *test;
1704
1705         tcase = torture_suite_add_rpc_iface_tcase(suite, "backupkey",
1706                                                   &ndr_table_backupkey);
1707
1708         test = torture_rpc_tcase_add_test(tcase, "retreive_backup_key_guid",
1709                                           test_RetreiveBackupKeyGUID);
1710         test = torture_rpc_tcase_add_test(tcase, "restore_guid",
1711                                           test_RestoreGUID);
1712         test = torture_rpc_tcase_add_test(tcase, "restore_guid version 3",
1713                                           test_RestoreGUID_v3);
1714 /* We double the test in order to be sure that we don't mess stuff (ie. freeing static stuff */
1715
1716         test = torture_rpc_tcase_add_test(tcase, "restore_guid_2nd",
1717                                           test_RestoreGUID);
1718
1719         test = torture_rpc_tcase_add_test(tcase, "unable_to_decrypt_secret",
1720                                           test_RestoreGUID_ko);
1721
1722         test = torture_rpc_tcase_add_test(tcase, "wrong_user_restore_guid",
1723                                           test_RestoreGUID_wronguser);
1724
1725         test = torture_rpc_tcase_add_test(tcase, "wrong_version_restore_guid",
1726                                           test_RestoreGUID_wrongversion);
1727
1728         test = torture_rpc_tcase_add_test(tcase, "bad_magic_on_secret_restore_guid",
1729                                           test_RestoreGUID_badmagiconsecret);
1730
1731         test = torture_rpc_tcase_add_test(tcase, "bad_hash_on_secret_restore_guid",
1732                                           test_RestoreGUID_badhashaccesscheck);
1733
1734         test = torture_rpc_tcase_add_test(tcase, "bad_magic_on_accesscheck_restore_guid",
1735                                           test_RestoreGUID_badmagicaccesscheck);
1736         test = torture_rpc_tcase_add_test(tcase, "bad_cert_guid_restore_guid",
1737                                           test_RestoreGUID_badcertguid);
1738         test = torture_rpc_tcase_add_test(tcase, "empty_request_restore_guid",
1739                                           test_RestoreGUID_emptyrequest);
1740         test = torture_rpc_tcase_add_test(tcase, "empty_request_restore_guid",
1741                                           test_RestoreGUID_emptyrequest);
1742
1743         return suite;
1744 }