source4/torture/rpc/lsa.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3    test suite for lsa rpc operations
   4
   5    Copyright (C) Andrew Tridgell 2003
   6    Copyright (C) Andrew Bartlett <abartlet@samba.org> 2004-2005
   7
   8    This program is free software; you can redistribute it and/or modify
   9    it under the terms of the GNU General Public License as published by
  10    the Free Software Foundation; either version 3 of the License, or
  11    (at your option) any later version.
  12
  13    This program is distributed in the hope that it will be useful,
  14    but WITHOUT ANY WARRANTY; without even the implied warranty of
  15    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  16    GNU General Public License for more details.
  17
  18    You should have received a copy of the GNU General Public License
  19    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  20 */
  21
  22 #include "includes.h"
  23 #include "torture/torture.h"
  24 #include "librpc/gen_ndr/ndr_lsa_c.h"
  25 #include "librpc/gen_ndr/netlogon.h"
  26 #include "librpc/gen_ndr/ndr_drsblobs.h"
  27 #include "librpc/gen_ndr/ndr_netlogon_c.h"
  28 #include "lib/events/events.h"
  29 #include "libcli/security/security.h"
  30 #include "libcli/auth/libcli_auth.h"
  31 #include "torture/rpc/torture_rpc.h"
  32 #include "param/param.h"
  33 #include "../lib/crypto/crypto.h"
  34 #define TEST_MACHINENAME "lsatestmach"
  35 #define TRUSTPW "12345678"
  36
  37 static void init_lsa_String(struct lsa_String *name, const char *s)
  38 {
  39         name->string = s;
  40 }
  41
  42 static bool test_OpenPolicy(struct dcerpc_binding_handle *b,
  43                             struct torture_context *tctx)
  44 {
  45         struct lsa_ObjectAttribute attr;
  46         struct policy_handle handle;
  47         struct lsa_QosInfo qos;
  48         struct lsa_OpenPolicy r;
  49         uint16_t system_name = '\\';
  50
  51         torture_comment(tctx, "\nTesting OpenPolicy\n");
  52
  53         qos.len = 0;
  54         qos.impersonation_level = 2;
  55         qos.context_mode = 1;
  56         qos.effective_only = 0;
  57
  58         attr.len = 0;
  59         attr.root_dir = NULL;
  60         attr.object_name = NULL;
  61         attr.attributes = 0;
  62         attr.sec_desc = NULL;
  63         attr.sec_qos = &qos;
  64
  65         r.in.system_name = &system_name;
  66         r.in.attr = &attr;
  67         r.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
  68         r.out.handle = &handle;
  69
  70         torture_assert_ntstatus_ok(tctx, dcerpc_lsa_OpenPolicy_r(b, tctx, &r),
  71                                    "OpenPolicy failed");
  72
  73         torture_assert_ntstatus_ok(tctx,
  74                                    r.out.result,
  75                                    "OpenPolicy failed");
  76
  77         return true;
  78 }
  79
  80 static bool test_OpenPolicy_fail(struct dcerpc_binding_handle *b,
  81                                  struct torture_context *tctx)
  82 {
  83         struct lsa_ObjectAttribute attr;
  84         struct policy_handle handle;
  85         struct lsa_QosInfo qos;
  86         struct lsa_OpenPolicy r;
  87         uint16_t system_name = '\\';
  88         NTSTATUS status;
  89
  90         torture_comment(tctx, "\nTesting OpenPolicy_fail\n");
  91
  92         qos.len = 0;
  93         qos.impersonation_level = 2;
  94         qos.context_mode = 1;
  95         qos.effective_only = 0;
  96
  97         attr.len = 0;
  98         attr.root_dir = NULL;
  99         attr.object_name = NULL;
 100         attr.attributes = 0;
 101         attr.sec_desc = NULL;
 102         attr.sec_qos = &qos;
 103
 104         r.in.system_name = &system_name;
 105         r.in.attr = &attr;
 106         r.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
 107         r.out.handle = &handle;
 108
 109         status = dcerpc_lsa_OpenPolicy_r(b, tctx, &r);
 110         if (!NT_STATUS_IS_OK(status)) {
 111                 if (NT_STATUS_EQUAL(status, NT_STATUS_ACCESS_DENIED)) {
 112                         torture_comment(tctx,
 113                                         "OpenPolicy correctly returned with "
 114                                         "status: %s\n",
 115                                         nt_errstr(status));
 116                         return true;
 117                 }
 118
 119                 torture_assert_ntstatus_equal(tctx,
 120                                               status,
 121                                               NT_STATUS_ACCESS_DENIED,
 122                                               "OpenPolicy return value should "
 123                                               "be ACCESS_DENIED");
 124                 return true;
 125         }
 126
 127         if (!NT_STATUS_IS_OK(r.out.result)) {
 128                 if (NT_STATUS_EQUAL(r.out.result, NT_STATUS_ACCESS_DENIED) ||
 129                     NT_STATUS_EQUAL(r.out.result, NT_STATUS_RPC_PROTSEQ_NOT_SUPPORTED)) {
 130                         torture_comment(tctx,
 131                                         "OpenPolicy correctly returned with "
 132                                         "result: %s\n",
 133                                         nt_errstr(r.out.result));
 134                         return true;
 135                 }
 136         }
 137
 138         torture_assert_ntstatus_equal(tctx,
 139                                       r.out.result,
 140                                       NT_STATUS_OK,
 141                                       "OpenPolicy return value should be "
 142                                       "ACCESS_DENIED");
 143
 144         return false;
 145 }
 146
 147
 148 bool test_lsa_OpenPolicy2_ex(struct dcerpc_binding_handle *b,
 149                              struct torture_context *tctx,
 150                              struct policy_handle **handle,
 151                              NTSTATUS expected_status,
 152                              bool test_fail)
 153 {
 154         struct lsa_ObjectAttribute attr;
 155         struct lsa_QosInfo qos;
 156         struct lsa_OpenPolicy2 r;
 157         NTSTATUS status;
 158
 159         torture_comment(tctx, "\nTesting OpenPolicy2\n");
 160
 161         *handle = talloc(tctx, struct policy_handle);
 162         if (!*handle) {
 163                 return false;
 164         }
 165
 166         qos.len = 0;
 167         qos.impersonation_level = 2;
 168         qos.context_mode = 1;
 169         qos.effective_only = 0;
 170
 171         attr.len = 0;
 172         attr.root_dir = NULL;
 173         attr.object_name = NULL;
 174         attr.attributes = 0;
 175         attr.sec_desc = NULL;
 176         attr.sec_qos = &qos;
 177
 178         r.in.system_name = "\\";
 179         r.in.attr = &attr;
 180         r.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
 181         r.out.handle = *handle;
 182
 183         status = dcerpc_lsa_OpenPolicy2_r(b, tctx, &r);
 184         torture_assert_ntstatus_equal(tctx, status, expected_status,
 185                                    "OpenPolicy2 failed");
 186         if (!NT_STATUS_IS_OK(expected_status)) {
 187                 return true;
 188         }
 189         if (!NT_STATUS_IS_OK(r.out.result)) {
 190                 if (NT_STATUS_EQUAL(r.out.result, NT_STATUS_ACCESS_DENIED) ||
 191                     NT_STATUS_EQUAL(r.out.result, NT_STATUS_RPC_PROTSEQ_NOT_SUPPORTED)) {
 192                         if (test_fail) {
 193                                 torture_comment(tctx, "not considering %s to be an error\n",
 194                                                 nt_errstr(r.out.result));
 195                                 talloc_free(*handle);
 196                                 *handle = NULL;
 197                                 return true;
 198                         }
 199                 }
 200                 torture_comment(tctx, "OpenPolicy2 failed - %s\n",
 201                                 nt_errstr(r.out.result));
 202                 return false;
 203         }
 204
 205         return true;
 206 }
 207
 208
 209 bool test_lsa_OpenPolicy2(struct dcerpc_binding_handle *b,
 210                           struct torture_context *tctx,
 211                           struct policy_handle **handle)
 212 {
 213         return test_lsa_OpenPolicy2_ex(b, tctx, handle, NT_STATUS_OK, false);
 214 }
 215
 216 static bool test_LookupNames(struct dcerpc_binding_handle *b,
 217                              struct torture_context *tctx,
 218                              struct policy_handle *handle,
 219                              struct lsa_TransNameArray *tnames)
 220 {
 221         struct lsa_LookupNames r;
 222         struct lsa_TransSidArray sids;
 223         struct lsa_RefDomainList *domains = NULL;
 224         struct lsa_String *names;
 225         uint32_t count = 0;
 226         int i;
 227         uint32_t *input_idx;
 228
 229         torture_comment(tctx, "\nTesting LookupNames with %d names\n", tnames->count);
 230
 231         sids.count = 0;
 232         sids.sids = NULL;
 233
 234
 235         r.in.num_names = 0;
 236
 237         input_idx = talloc_array(tctx, uint32_t, tnames->count);
 238         names = talloc_array(tctx, struct lsa_String, tnames->count);
 239
 240         for (i=0;i<tnames->count;i++) {
 241                 if (tnames->names[i].sid_type != SID_NAME_UNKNOWN) {
 242                         init_lsa_String(&names[r.in.num_names], tnames->names[i].name.string);
 243                         input_idx[r.in.num_names] = i;
 244                         r.in.num_names++;
 245                 }
 246         }
 247
 248         r.in.handle = handle;
 249         r.in.names = names;
 250         r.in.sids = &sids;
 251         r.in.level = 1;
 252         r.in.count = &count;
 253         r.out.count = &count;
 254         r.out.sids = &sids;
 255         r.out.domains = &domains;
 256
 257         torture_assert_ntstatus_ok(tctx, dcerpc_lsa_LookupNames_r(b, tctx, &r),
 258                                    "LookupNames failed");
 259         if (NT_STATUS_EQUAL(r.out.result, STATUS_SOME_UNMAPPED) ||
 260             NT_STATUS_EQUAL(r.out.result, NT_STATUS_NONE_MAPPED)) {
 261                 for (i=0;i< r.in.num_names;i++) {
 262                         if (i < count && sids.sids[i].sid_type == SID_NAME_UNKNOWN) {
 263                                 torture_comment(tctx, "LookupName of %s was unmapped\n",
 264                                        tnames->names[i].name.string);
 265                         } else if (i >=count) {
 266                                 torture_comment(tctx, "LookupName of %s failed to return a result\n",
 267                                        tnames->names[i].name.string);
 268                         }
 269                 }
 270                 torture_comment(tctx, "LookupNames failed - %s\n",
 271                                 nt_errstr(r.out.result));
 272                 return false;
 273         } else if (!NT_STATUS_IS_OK(r.out.result)) {
 274                 torture_comment(tctx, "LookupNames failed - %s\n",
 275                                 nt_errstr(r.out.result));
 276                 return false;
 277         }
 278
 279         for (i=0;i< r.in.num_names;i++) {
 280                 if (i < count) {
 281                         if (sids.sids[i].sid_type != tnames->names[input_idx[i]].sid_type) {
 282                                 torture_comment(tctx, "LookupName of %s got unexpected name type: %s\n",
 283                                                 tnames->names[input_idx[i]].name.string,
 284                                                 sid_type_lookup(sids.sids[i].sid_type));
 285                                 return false;
 286                         }
 287                         if ((sids.sids[i].sid_type == SID_NAME_DOMAIN) &&
 288                             (sids.sids[i].rid != (uint32_t)-1)) {
 289                                 torture_comment(tctx, "LookupName of %s got unexpected rid: %d\n",
 290                                         tnames->names[input_idx[i]].name.string, sids.sids[i].rid);
 291                                 return false;
 292                         }
 293                 } else if (i >=count) {
 294                         torture_comment(tctx, "LookupName of %s failed to return a result\n",
 295                                tnames->names[input_idx[i]].name.string);
 296                         return false;
 297                 }
 298         }
 299         torture_comment(tctx, "\n");
 300
 301         return true;
 302 }
 303
 304 static bool test_LookupNames_bogus(struct dcerpc_binding_handle *b,
 305                                    struct torture_context *tctx,
 306                                    struct policy_handle *handle)
 307 {
 308         struct lsa_LookupNames r;
 309         struct lsa_TransSidArray sids;
 310         struct lsa_RefDomainList *domains = NULL;
 311         struct lsa_String names[1];
 312         uint32_t count = 0;
 313
 314         torture_comment(tctx, "\nTesting LookupNames with bogus name\n");
 315
 316         sids.count = 0;
 317         sids.sids = NULL;
 318
 319         init_lsa_String(&names[0], "NT AUTHORITY\\BOGUS");
 320
 321         r.in.handle = handle;
 322         r.in.num_names = 1;
 323         r.in.names = names;
 324         r.in.sids = &sids;
 325         r.in.level = 1;
 326         r.in.count = &count;
 327         r.out.count = &count;
 328         r.out.sids = &sids;
 329         r.out.domains = &domains;
 330
 331         torture_assert_ntstatus_ok(tctx, dcerpc_lsa_LookupNames_r(b, tctx, &r),
 332                                    "LookupNames bogus failed");
 333         if (!NT_STATUS_EQUAL(r.out.result, NT_STATUS_NONE_MAPPED)) {
 334                 torture_comment(tctx, "LookupNames failed - %s\n",
 335                                 nt_errstr(r.out.result));
 336                 return false;
 337         }
 338
 339         torture_comment(tctx, "\n");
 340
 341         return true;
 342 }
 343
 344 static bool test_LookupNames_NULL(struct dcerpc_binding_handle *b,
 345                                   struct torture_context *tctx,
 346                                   struct policy_handle *handle)
 347 {
 348         struct lsa_LookupNames r;
 349         struct lsa_TransSidArray sids;
 350         struct lsa_RefDomainList *domains = NULL;
 351         struct lsa_String names[1];
 352         uint32_t count = 0;
 353
 354         torture_comment(tctx, "\nTesting LookupNames with NULL name\n");
 355
 356         sids.count = 0;
 357         sids.sids = NULL;
 358
 359         names[0].string = NULL;
 360
 361         r.in.handle = handle;
 362         r.in.num_names = 1;
 363         r.in.names = names;
 364         r.in.sids = &sids;
 365         r.in.level = 1;
 366         r.in.count = &count;
 367         r.out.count = &count;
 368         r.out.sids = &sids;
 369         r.out.domains = &domains;
 370
 371         /* nt4 returns NT_STATUS_NONE_MAPPED with sid_type
 372          * SID_NAME_UNKNOWN, rid 0, and sid_index -1;
 373          *
 374          * w2k3/w2k8 return NT_STATUS_OK with sid_type
 375          * SID_NAME_DOMAIN, rid -1 and sid_index 0 and BUILTIN domain
 376          */
 377
 378         torture_assert_ntstatus_ok(tctx, dcerpc_lsa_LookupNames_r(b, tctx, &r),
 379                 "LookupNames with NULL name failed");
 380         torture_assert_ntstatus_ok(tctx, r.out.result,
 381                 "LookupNames with NULL name failed");
 382
 383         torture_comment(tctx, "\n");
 384
 385         return true;
 386 }
 387
 388 static bool test_LookupNames_wellknown(struct dcerpc_binding_handle *b,
 389                                        struct torture_context *tctx,
 390                                        struct policy_handle *handle)
 391 {
 392         struct lsa_TranslatedName name;
 393         struct lsa_TransNameArray tnames;
 394         bool ret = true;
 395
 396         torture_comment(tctx, "Testing LookupNames with well known names\n");
 397
 398         tnames.names = &name;
 399         tnames.count = 1;
 400         name.name.string = "NT AUTHORITY\\SYSTEM";
 401         name.sid_type = SID_NAME_WKN_GRP;
 402         ret &= test_LookupNames(b, tctx, handle, &tnames);
 403
 404         name.name.string = "NT AUTHORITY\\ANONYMOUS LOGON";
 405         name.sid_type = SID_NAME_WKN_GRP;
 406         ret &= test_LookupNames(b, tctx, handle, &tnames);
 407
 408         name.name.string = "NT AUTHORITY\\Authenticated Users";
 409         name.sid_type = SID_NAME_WKN_GRP;
 410         ret &= test_LookupNames(b, tctx, handle, &tnames);
 411
 412 #if 0
 413         name.name.string = "NT AUTHORITY";
 414         ret &= test_LookupNames(b, tctx, handle, &tnames);
 415
 416         name.name.string = "NT AUTHORITY\\";
 417         ret &= test_LookupNames(b, tctx, handle, &tnames);
 418 #endif
 419
 420         name.name.string = "BUILTIN\\";
 421         name.sid_type = SID_NAME_DOMAIN;
 422         ret &= test_LookupNames(b, tctx, handle, &tnames);
 423
 424         name.name.string = "BUILTIN\\Administrators";
 425         name.sid_type = SID_NAME_ALIAS;
 426         ret &= test_LookupNames(b, tctx, handle, &tnames);
 427
 428         name.name.string = "SYSTEM";
 429         name.sid_type = SID_NAME_WKN_GRP;
 430         ret &= test_LookupNames(b, tctx, handle, &tnames);
 431
 432         name.name.string = "Everyone";
 433         name.sid_type = SID_NAME_WKN_GRP;
 434         ret &= test_LookupNames(b, tctx, handle, &tnames);
 435         return ret;
 436 }
 437
 438 static bool test_LookupNames2(struct dcerpc_binding_handle *b,
 439                               struct torture_context *tctx,
 440                               struct policy_handle *handle,
 441                               struct lsa_TransNameArray2 *tnames,
 442                               bool check_result)
 443 {
 444         struct lsa_LookupNames2 r;
 445         struct lsa_TransSidArray2 sids;
 446         struct lsa_RefDomainList *domains = NULL;
 447         struct lsa_String *names;
 448         uint32_t *input_idx;
 449         uint32_t count = 0;
 450         int i;
 451
 452         torture_comment(tctx, "\nTesting LookupNames2 with %d names\n", tnames->count);
 453
 454         sids.count = 0;
 455         sids.sids = NULL;
 456
 457         r.in.num_names = 0;
 458
 459         input_idx = talloc_array(tctx, uint32_t, tnames->count);
 460         names = talloc_array(tctx, struct lsa_String, tnames->count);
 461
 462         for (i=0;i<tnames->count;i++) {
 463                 if (tnames->names[i].sid_type != SID_NAME_UNKNOWN) {
 464                         init_lsa_String(&names[r.in.num_names], tnames->names[i].name.string);
 465                         input_idx[r.in.num_names] = i;
 466                         r.in.num_names++;
 467                 }
 468         }
 469
 470         r.in.handle = handle;
 471         r.in.names = names;
 472         r.in.sids = &sids;
 473         r.in.level = 1;
 474         r.in.count = &count;
 475         r.in.lookup_options = 0;
 476         r.in.client_revision = 0;
 477         r.out.count = &count;
 478         r.out.sids = &sids;
 479         r.out.domains = &domains;
 480
 481         torture_assert_ntstatus_ok(tctx, dcerpc_lsa_LookupNames2_r(b, tctx, &r),
 482                 "LookupNames2 failed");
 483         if (!NT_STATUS_IS_OK(r.out.result)) {
 484                 torture_comment(tctx, "LookupNames2 failed - %s\n",
 485                                 nt_errstr(r.out.result));
 486                 return false;
 487         }
 488
 489         if (check_result) {
 490                 torture_assert_int_equal(tctx, count, sids.count,
 491                         "unexpected number of results returned");
 492                 if (sids.count > 0) {
 493                         torture_assert(tctx, sids.sids, "invalid sid buffer");
 494                 }
 495         }
 496
 497         torture_comment(tctx, "\n");
 498
 499         return true;
 500 }
 501
 502
 503 static bool test_LookupNames3(struct dcerpc_binding_handle *b,
 504                               struct torture_context *tctx,
 505                               struct policy_handle *handle,
 506                               struct lsa_TransNameArray2 *tnames,
 507                               bool check_result)
 508 {
 509         struct lsa_LookupNames3 r;
 510         struct lsa_TransSidArray3 sids;
 511         struct lsa_RefDomainList *domains = NULL;
 512         struct lsa_String *names;
 513         uint32_t count = 0;
 514         int i;
 515         uint32_t *input_idx;
 516
 517         torture_comment(tctx, "\nTesting LookupNames3 with %d names\n", tnames->count);
 518
 519         sids.count = 0;
 520         sids.sids = NULL;
 521
 522         r.in.num_names = 0;
 523
 524         input_idx = talloc_array(tctx, uint32_t, tnames->count);
 525         names = talloc_array(tctx, struct lsa_String, tnames->count);
 526         for (i=0;i<tnames->count;i++) {
 527                 if (tnames->names[i].sid_type != SID_NAME_UNKNOWN) {
 528                         init_lsa_String(&names[r.in.num_names], tnames->names[i].name.string);
 529                         input_idx[r.in.num_names] = i;
 530                         r.in.num_names++;
 531                 }
 532         }
 533
 534         r.in.handle = handle;
 535         r.in.names = names;
 536         r.in.sids = &sids;
 537         r.in.level = 1;
 538         r.in.count = &count;
 539         r.in.lookup_options = 0;
 540         r.in.client_revision = 0;
 541         r.out.count = &count;
 542         r.out.sids = &sids;
 543         r.out.domains = &domains;
 544
 545         torture_assert_ntstatus_ok(tctx, dcerpc_lsa_LookupNames3_r(b, tctx, &r),
 546                 "LookupNames3 failed");
 547         if (!NT_STATUS_IS_OK(r.out.result)) {
 548                 torture_comment(tctx, "LookupNames3 failed - %s\n",
 549                                 nt_errstr(r.out.result));
 550                 return false;
 551         }
 552
 553         if (check_result) {
 554                 torture_assert_int_equal(tctx, count, sids.count,
 555                         "unexpected number of results returned");
 556                 if (sids.count > 0) {
 557                         torture_assert(tctx, sids.sids, "invalid sid buffer");
 558                 }
 559         }
 560
 561         torture_comment(tctx, "\n");
 562
 563         return true;
 564 }
 565
 566 static bool test_LookupNames4(struct dcerpc_binding_handle *b,
 567                               struct torture_context *tctx,
 568                               struct lsa_TransNameArray2 *tnames,
 569                               bool check_result)
 570 {
 571         struct lsa_LookupNames4 r;
 572         struct lsa_TransSidArray3 sids;
 573         struct lsa_RefDomainList *domains = NULL;
 574         struct lsa_String *names;
 575         uint32_t count = 0;
 576         int i;
 577         uint32_t *input_idx;
 578
 579         torture_comment(tctx, "\nTesting LookupNames4 with %d names\n", tnames->count);
 580
 581         sids.count = 0;
 582         sids.sids = NULL;
 583
 584         r.in.num_names = 0;
 585
 586         input_idx = talloc_array(tctx, uint32_t, tnames->count);
 587         names = talloc_array(tctx, struct lsa_String, tnames->count);
 588         for (i=0;i<tnames->count;i++) {
 589                 if (tnames->names[i].sid_type != SID_NAME_UNKNOWN) {
 590                         init_lsa_String(&names[r.in.num_names], tnames->names[i].name.string);
 591                         input_idx[r.in.num_names] = i;
 592                         r.in.num_names++;
 593                 }
 594         }
 595
 596         r.in.num_names = tnames->count;
 597         r.in.names = names;
 598         r.in.sids = &sids;
 599         r.in.level = 1;
 600         r.in.count = &count;
 601         r.in.lookup_options = 0;
 602         r.in.client_revision = 0;
 603         r.out.count = &count;
 604         r.out.sids = &sids;
 605         r.out.domains = &domains;
 606
 607         torture_assert_ntstatus_ok(tctx, dcerpc_lsa_LookupNames4_r(b, tctx, &r),
 608                 "LookupNames4 failed");
 609
 610         torture_assert_ntstatus_ok(tctx,
 611                                    r.out.result,
 612                                    "LookupNames4 failed");
 613
 614         if (check_result) {
 615                 torture_assert_int_equal(tctx, count, sids.count,
 616                         "unexpected number of results returned");
 617                 if (sids.count > 0) {
 618                         torture_assert(tctx, sids.sids, "invalid sid buffer");
 619                 }
 620         }
 621
 622         torture_comment(tctx, "\n");
 623
 624         return true;
 625 }
 626
 627 static bool test_LookupNames4_fail(struct dcerpc_binding_handle *b,
 628                                    struct torture_context *tctx)
 629 {
 630         struct lsa_LookupNames4 r;
 631         struct lsa_TransSidArray3 sids;
 632         struct lsa_RefDomainList *domains = NULL;
 633         struct lsa_String *names = NULL;
 634         uint32_t count = 0;
 635         NTSTATUS status;
 636
 637         torture_comment(tctx, "\nTesting LookupNames4_fail");
 638
 639         sids.count = 0;
 640         sids.sids = NULL;
 641
 642         r.in.num_names = 0;
 643
 644         r.in.num_names = count;
 645         r.in.names = names;
 646         r.in.sids = &sids;
 647         r.in.level = 1;
 648         r.in.count = &count;
 649         r.in.lookup_options = 0;
 650         r.in.client_revision = 0;
 651         r.out.count = &count;
 652         r.out.sids = &sids;
 653         r.out.domains = &domains;
 654
 655         status = dcerpc_lsa_LookupNames4_r(b, tctx, &r);
 656         if (!NT_STATUS_IS_OK(status)) {
 657                 if (NT_STATUS_EQUAL(status, NT_STATUS_ACCESS_DENIED)) {
 658                         torture_comment(tctx,
 659                                         "LookupNames4 correctly returned with "
 660                                         "status: %s\n",
 661                                         nt_errstr(status));
 662                         return true;
 663                 }
 664
 665                 torture_assert_ntstatus_equal(tctx,
 666                                               status,
 667                                               NT_STATUS_ACCESS_DENIED,
 668                                               "LookupNames4 return value should "
 669                                               "be ACCESS_DENIED");
 670                 return true;
 671         }
 672
 673         if (!NT_STATUS_IS_OK(r.out.result)) {
 674                 if (NT_STATUS_EQUAL(r.out.result, NT_STATUS_ACCESS_DENIED) ||
 675                     NT_STATUS_EQUAL(r.out.result, NT_STATUS_RPC_PROTSEQ_NOT_SUPPORTED)) {
 676                         torture_comment(tctx,
 677                                         "LookupSids3 correctly returned with "
 678                                         "result: %s\n",
 679                                         nt_errstr(r.out.result));
 680                         return true;
 681                 }
 682         }
 683
 684         torture_assert_ntstatus_equal(tctx,
 685                                       r.out.result,
 686                                       NT_STATUS_OK,
 687                                       "LookupNames4 return value should be "
 688                                       "ACCESS_DENIED");
 689
 690         return false;
 691 }
 692
 693
 694 static bool test_LookupSids(struct dcerpc_binding_handle *b,
 695                             struct torture_context *tctx,
 696                             struct policy_handle *handle,
 697                             struct lsa_SidArray *sids)
 698 {
 699         struct lsa_LookupSids r;
 700         struct lsa_TransNameArray names;
 701         struct lsa_RefDomainList *domains = NULL;
 702         uint32_t count = sids->num_sids;
 703
 704         torture_comment(tctx, "\nTesting LookupSids\n");
 705
 706         names.count = 0;
 707         names.names = NULL;
 708
 709         r.in.handle = handle;
 710         r.in.sids = sids;
 711         r.in.names = &names;
 712         r.in.level = 1;
 713         r.in.count = &count;
 714         r.out.count = &count;
 715         r.out.names = &names;
 716         r.out.domains = &domains;
 717
 718         torture_assert_ntstatus_ok(tctx, dcerpc_lsa_LookupSids_r(b, tctx, &r),
 719                 "LookupSids failed");
 720         if (!NT_STATUS_IS_OK(r.out.result) &&
 721             !NT_STATUS_EQUAL(r.out.result, STATUS_SOME_UNMAPPED)) {
 722                 torture_comment(tctx, "LookupSids failed - %s\n",
 723                                 nt_errstr(r.out.result));
 724                 return false;
 725         }
 726
 727         torture_comment(tctx, "\n");
 728
 729         if (!test_LookupNames(b, tctx, handle, &names)) {
 730                 return false;
 731         }
 732
 733         return true;
 734 }
 735
 736
 737 static bool test_LookupSids2(struct dcerpc_binding_handle *b,
 738                             struct torture_context *tctx,
 739                             struct policy_handle *handle,
 740                             struct lsa_SidArray *sids)
 741 {
 742         struct lsa_LookupSids2 r;
 743         struct lsa_TransNameArray2 names;
 744         struct lsa_RefDomainList *domains = NULL;
 745         uint32_t count = sids->num_sids;
 746
 747         torture_comment(tctx, "\nTesting LookupSids2\n");
 748
 749         names.count = 0;
 750         names.names = NULL;
 751
 752         r.in.handle = handle;
 753         r.in.sids = sids;
 754         r.in.names = &names;
 755         r.in.level = 1;
 756         r.in.count = &count;
 757         r.in.lookup_options = 0;
 758         r.in.client_revision = 0;
 759         r.out.count = &count;
 760         r.out.names = &names;
 761         r.out.domains = &domains;
 762
 763         torture_assert_ntstatus_ok(tctx, dcerpc_lsa_LookupSids2_r(b, tctx, &r),
 764                 "LookupSids2 failed");
 765         if (!NT_STATUS_IS_OK(r.out.result) &&
 766             !NT_STATUS_EQUAL(r.out.result, STATUS_SOME_UNMAPPED)) {
 767                 torture_comment(tctx, "LookupSids2 failed - %s\n",
 768                                 nt_errstr(r.out.result));
 769                 return false;
 770         }
 771
 772         torture_comment(tctx, "\n");
 773
 774         if (!test_LookupNames2(b, tctx, handle, &names, false)) {
 775                 return false;
 776         }
 777
 778         if (!test_LookupNames3(b, tctx, handle, &names, false)) {
 779                 return false;
 780         }
 781
 782         return true;
 783 }
 784
 785 static bool test_LookupSids3(struct dcerpc_binding_handle *b,
 786                             struct torture_context *tctx,
 787                             struct lsa_SidArray *sids)
 788 {
 789         struct lsa_LookupSids3 r;
 790         struct lsa_TransNameArray2 names;
 791         struct lsa_RefDomainList *domains = NULL;
 792         uint32_t count = sids->num_sids;
 793
 794         torture_comment(tctx, "\nTesting LookupSids3\n");
 795
 796         names.count = 0;
 797         names.names = NULL;
 798
 799         r.in.sids = sids;
 800         r.in.names = &names;
 801         r.in.level = 1;
 802         r.in.count = &count;
 803         r.in.lookup_options = 0;
 804         r.in.client_revision = 0;
 805         r.out.domains = &domains;
 806         r.out.count = &count;
 807         r.out.names = &names;
 808
 809         torture_assert_ntstatus_ok(tctx, dcerpc_lsa_LookupSids3_r(b, tctx, &r),
 810                 "LookupSids3 failed");
 811
 812         torture_assert_ntstatus_ok(tctx,
 813                                    r.out.result,
 814                                    "LookupSids3 failed");
 815
 816         torture_comment(tctx, "\n");
 817
 818         return true;
 819 }
 820
 821 static bool test_LookupSids3_fail(struct dcerpc_binding_handle *b,
 822                                   struct torture_context *tctx,
 823                                   struct lsa_SidArray *sids)
 824 {
 825         struct lsa_LookupSids3 r;
 826         struct lsa_TransNameArray2 names;
 827         struct lsa_RefDomainList *domains = NULL;
 828         uint32_t count = sids->num_sids;
 829         NTSTATUS status;
 830
 831         torture_comment(tctx, "\nTesting LookupSids3\n");
 832
 833         names.count = 0;
 834         names.names = NULL;
 835
 836         r.in.sids = sids;
 837         r.in.names = &names;
 838         r.in.level = 1;
 839         r.in.count = &count;
 840         r.in.lookup_options = 0;
 841         r.in.client_revision = 0;
 842         r.out.domains = &domains;
 843         r.out.count = &count;
 844         r.out.names = &names;
 845
 846         status = dcerpc_lsa_LookupSids3_r(b, tctx, &r);
 847         if (!NT_STATUS_IS_OK(status)) {
 848                 if (NT_STATUS_EQUAL(status, NT_STATUS_ACCESS_DENIED)) {
 849                         torture_comment(tctx,
 850                                         "LookupSids3 correctly returned with "
 851                                         "status: %s\n",
 852                                         nt_errstr(status));
 853                         return true;
 854                 }
 855
 856                 torture_assert_ntstatus_equal(tctx,
 857                                               status,
 858                                               NT_STATUS_ACCESS_DENIED,
 859                                               "LookupSids3 return value should "
 860                                               "be ACCESS_DENIED");
 861                 return true;
 862         }
 863
 864         if (!NT_STATUS_IS_OK(r.out.result)) {
 865                 if (NT_STATUS_EQUAL(r.out.result, NT_STATUS_ACCESS_DENIED) ||
 866                     NT_STATUS_EQUAL(r.out.result, NT_STATUS_RPC_PROTSEQ_NOT_SUPPORTED)) {
 867                         torture_comment(tctx,
 868                                         "LookupNames4 correctly returned with "
 869                                         "result: %s\n",
 870                                         nt_errstr(r.out.result));
 871                         return true;
 872                 }
 873         }
 874
 875         torture_assert_ntstatus_equal(tctx,
 876                                       r.out.result,
 877                                       NT_STATUS_OK,
 878                                       "LookupSids3 return value should be "
 879                                       "ACCESS_DENIED");
 880
 881         return false;
 882 }
 883
 884 bool test_many_LookupSids(struct dcerpc_pipe *p,
 885                           struct torture_context *tctx,
 886                           struct policy_handle *handle)
 887 {
 888         uint32_t count;
 889         struct lsa_SidArray sids;
 890         int i;
 891         struct dcerpc_binding_handle *b = p->binding_handle;
 892
 893         torture_comment(tctx, "\nTesting LookupSids with lots of SIDs\n");
 894
 895         sids.num_sids = 100;
 896
 897         sids.sids = talloc_array(tctx, struct lsa_SidPtr, sids.num_sids);
 898
 899         for (i=0; i<sids.num_sids; i++) {
 900                 const char *sidstr = "S-1-5-32-545";
 901                 sids.sids[i].sid = dom_sid_parse_talloc(tctx, sidstr);
 902         }
 903
 904         count = sids.num_sids;
 905
 906         if (handle) {
 907                 struct lsa_LookupSids r;
 908                 struct lsa_TransNameArray names;
 909                 struct lsa_RefDomainList *domains = NULL;
 910                 names.count = 0;
 911                 names.names = NULL;
 912
 913                 r.in.handle = handle;
 914                 r.in.sids = &sids;
 915                 r.in.names = &names;
 916                 r.in.level = 1;
 917                 r.in.count = &names.count;
 918                 r.out.count = &count;
 919                 r.out.names = &names;
 920                 r.out.domains = &domains;
 921
 922                 torture_assert_ntstatus_ok(tctx, dcerpc_lsa_LookupSids_r(b, tctx, &r),
 923                         "LookupSids failed");
 924                 if (!NT_STATUS_IS_OK(r.out.result)) {
 925                         torture_comment(tctx, "LookupSids failed - %s\n",
 926                                         nt_errstr(r.out.result));
 927                         return false;
 928                 }
 929
 930                 torture_comment(tctx, "\n");
 931
 932                 if (!test_LookupNames(b, tctx, handle, &names)) {
 933                         return false;
 934                 }
 935         }
 936
 937         if (p->binding->transport == NCACN_NP) {
 938                 if (!test_LookupSids3_fail(b, tctx, &sids)) {
 939                         return false;
 940                 }
 941                 if (!test_LookupNames4_fail(b, tctx)) {
 942                         return false;
 943                 }
 944         } else if (p->binding->transport == NCACN_IP_TCP) {
 945                 struct lsa_TransNameArray2 names;
 946
 947                 names.count = 0;
 948                 names.names = NULL;
 949
 950                 if (p->conn->security_state.auth_info->auth_type == DCERPC_AUTH_TYPE_SCHANNEL &&
 951                    p->conn->security_state.auth_info->auth_level >= DCERPC_AUTH_LEVEL_INTEGRITY) {
 952                         if (!test_LookupSids3(b, tctx, &sids)) {
 953                                 return false;
 954                         }
 955                         if (!test_LookupNames4(b, tctx, &names, true)) {
 956                                 return false;
 957                         }
 958                 } else {
 959                         /*
 960                          * If we don't have a secure channel these tests must
 961                          * fail with ACCESS_DENIED.
 962                          */
 963                         if (!test_LookupSids3_fail(b, tctx, &sids)) {
 964                                 return false;
 965                         }
 966                         if (!test_LookupNames4_fail(b, tctx)) {
 967                                 return false;
 968                         }
 969                 }
 970         }
 971
 972         torture_comment(tctx, "\n");
 973
 974
 975
 976         return true;
 977 }
 978
 979 static void lookupsids_cb(struct tevent_req *subreq)
 980 {
 981         int *replies = (int *)tevent_req_callback_data_void(subreq);
 982         NTSTATUS status;
 983
 984         status = dcerpc_lsa_LookupSids_r_recv(subreq, subreq);
 985         TALLOC_FREE(subreq);
 986         if (!NT_STATUS_IS_OK(status)) {
 987                 printf("lookupsids returned %s\n", nt_errstr(status));
 988                 *replies = -1;
 989         }
 990
 991         if (*replies >= 0) {
 992                 *replies += 1;
 993         }
 994 }
 995
 996 static bool test_LookupSids_async(struct dcerpc_binding_handle *b,
 997                                   struct torture_context *tctx,
 998                                   struct policy_handle *handle)
 999 {
1000         struct lsa_SidArray sids;
1001         struct lsa_SidPtr sidptr;
1002         uint32_t *count;
1003         struct lsa_TransNameArray *names;
1004         struct lsa_LookupSids *r;
1005         struct lsa_RefDomainList *domains = NULL;
1006         struct tevent_req **req;
1007         int i, replies;
1008         bool ret = true;
1009         const int num_async_requests = 50;
1010
1011         count = talloc_array(tctx, uint32_t, num_async_requests);
1012         names = talloc_array(tctx, struct lsa_TransNameArray, num_async_requests);
1013         r = talloc_array(tctx, struct lsa_LookupSids, num_async_requests);
1014
1015         torture_comment(tctx, "\nTesting %d async lookupsids request\n", num_async_requests);
1016
1017         req = talloc_array(tctx, struct tevent_req *, num_async_requests);
1018
1019         sids.num_sids = 1;
1020         sids.sids = &sidptr;
1021         sidptr.sid = dom_sid_parse_talloc(tctx, "S-1-5-32-545");
1022
1023         replies = 0;
1024
1025         for (i=0; i<num_async_requests; i++) {
1026                 count[i] = 0;
1027                 names[i].count = 0;
1028                 names[i].names = NULL;
1029
1030                 r[i].in.handle = handle;
1031                 r[i].in.sids = &sids;
1032                 r[i].in.names = &names[i];
1033                 r[i].in.level = 1;
1034                 r[i].in.count = &names[i].count;
1035                 r[i].out.count = &count[i];
1036                 r[i].out.names = &names[i];
1037                 r[i].out.domains = &domains;
1038
1039                 req[i] = dcerpc_lsa_LookupSids_r_send(tctx, tctx->ev, b, &r[i]);
1040                 if (req[i] == NULL) {
1041                         ret = false;
1042                         break;
1043                 }
1044
1045                 tevent_req_set_callback(req[i], lookupsids_cb, &replies);
1046         }
1047
1048         while (replies >= 0 && replies < num_async_requests) {
1049                 tevent_loop_once(tctx->ev);
1050         }
1051
1052         talloc_free(req);
1053
1054         if (replies < 0) {
1055                 ret = false;
1056         }
1057
1058         return ret;
1059 }
1060
1061 static bool test_LookupPrivValue(struct dcerpc_binding_handle *b,
1062                                  struct torture_context *tctx,
1063                                  struct policy_handle *handle,
1064                                  struct lsa_String *name)
1065 {
1066         struct lsa_LookupPrivValue r;
1067         struct lsa_LUID luid;
1068
1069         r.in.handle = handle;
1070         r.in.name = name;
1071         r.out.luid = &luid;
1072
1073         torture_assert_ntstatus_ok(tctx, dcerpc_lsa_LookupPrivValue_r(b, tctx, &r),
1074                 "LookupPrivValue failed");
1075         if (!NT_STATUS_IS_OK(r.out.result)) {
1076                 torture_comment(tctx, "\nLookupPrivValue failed - %s\n",
1077                                 nt_errstr(r.out.result));
1078                 return false;
1079         }
1080
1081         return true;
1082 }
1083
1084 static bool test_LookupPrivName(struct dcerpc_binding_handle *b,
1085                                 struct torture_context *tctx,
1086                                 struct policy_handle *handle,
1087                                 struct lsa_LUID *luid)
1088 {
1089         struct lsa_LookupPrivName r;
1090         struct lsa_StringLarge *name = NULL;
1091
1092         r.in.handle = handle;
1093         r.in.luid = luid;
1094         r.out.name = &name;
1095
1096         torture_assert_ntstatus_ok(tctx, dcerpc_lsa_LookupPrivName_r(b, tctx, &r),
1097                 "LookupPrivName failed");
1098         if (!NT_STATUS_IS_OK(r.out.result)) {
1099                 torture_comment(tctx, "\nLookupPrivName failed - %s\n",
1100                                 nt_errstr(r.out.result));
1101                 return false;
1102         }
1103
1104         return true;
1105 }
1106
1107 static bool test_RemovePrivilegesFromAccount(struct dcerpc_binding_handle *b,
1108                                              struct torture_context *tctx,
1109                                              struct policy_handle *handle,
1110                                              struct policy_handle *acct_handle,
1111                                              struct lsa_LUID *luid)
1112 {
1113         struct lsa_RemovePrivilegesFromAccount r;
1114         struct lsa_PrivilegeSet privs;
1115         bool ret = true;
1116
1117         torture_comment(tctx, "\nTesting RemovePrivilegesFromAccount\n");
1118
1119         r.in.handle = acct_handle;
1120         r.in.remove_all = 0;
1121         r.in.privs = &privs;
1122
1123         privs.count = 1;
1124         privs.unknown = 0;
1125         privs.set = talloc_array(tctx, struct lsa_LUIDAttribute, 1);
1126         privs.set[0].luid = *luid;
1127         privs.set[0].attribute = 0;
1128
1129         torture_assert_ntstatus_ok(tctx, dcerpc_lsa_RemovePrivilegesFromAccount_r(b, tctx, &r),
1130                 "RemovePrivilegesFromAccount failed");
1131         if (!NT_STATUS_IS_OK(r.out.result)) {
1132
1133                 struct lsa_LookupPrivName r_name;
1134                 struct lsa_StringLarge *name = NULL;
1135
1136                 r_name.in.handle = handle;
1137                 r_name.in.luid = luid;
1138                 r_name.out.name = &name;
1139
1140                 torture_assert_ntstatus_ok(tctx, dcerpc_lsa_LookupPrivName_r(b, tctx, &r_name),
1141                         "LookupPrivName failed");
1142                 if (!NT_STATUS_IS_OK(r_name.out.result)) {
1143                         torture_comment(tctx, "\nLookupPrivName failed - %s\n",
1144                                         nt_errstr(r_name.out.result));
1145                         return false;
1146                 }
1147                 /* Windows 2008 does not allow this to be removed */
1148                 if (strcmp("SeAuditPrivilege", name->string) == 0) {
1149                         return ret;
1150                 }
1151
1152                 torture_comment(tctx, "RemovePrivilegesFromAccount failed to remove %s - %s\n",
1153                        name->string,
1154                        nt_errstr(r.out.result));
1155                 return false;
1156         }
1157
1158         return ret;
1159 }
1160
1161 static bool test_AddPrivilegesToAccount(struct dcerpc_binding_handle *b,
1162                                         struct torture_context *tctx,
1163                                         struct policy_handle *acct_handle,
1164                                         struct lsa_LUID *luid)
1165 {
1166         struct lsa_AddPrivilegesToAccount r;
1167         struct lsa_PrivilegeSet privs;
1168         bool ret = true;
1169
1170         torture_comment(tctx, "\nTesting AddPrivilegesToAccount\n");
1171
1172         r.in.handle = acct_handle;
1173         r.in.privs = &privs;
1174
1175         privs.count = 1;
1176         privs.unknown = 0;
1177         privs.set = talloc_array(tctx, struct lsa_LUIDAttribute, 1);
1178         privs.set[0].luid = *luid;
1179         privs.set[0].attribute = 0;
1180
1181         torture_assert_ntstatus_ok(tctx, dcerpc_lsa_AddPrivilegesToAccount_r(b, tctx, &r),
1182                 "AddPrivilegesToAccount failed");
1183         if (!NT_STATUS_IS_OK(r.out.result)) {
1184                 torture_comment(tctx, "AddPrivilegesToAccount failed - %s\n",
1185                                 nt_errstr(r.out.result));
1186                 return false;
1187         }
1188
1189         return ret;
1190 }
1191
1192 static bool test_EnumPrivsAccount(struct dcerpc_binding_handle *b,
1193                                   struct torture_context *tctx,
1194                                   struct policy_handle *handle,
1195                                   struct policy_handle *acct_handle)
1196 {
1197         struct lsa_EnumPrivsAccount r;
1198         struct lsa_PrivilegeSet *privs = NULL;
1199         bool ret = true;
1200
1201         torture_comment(tctx, "\nTesting EnumPrivsAccount\n");
1202
1203         r.in.handle = acct_handle;
1204         r.out.privs = &privs;
1205
1206         torture_assert_ntstatus_ok(tctx, dcerpc_lsa_EnumPrivsAccount_r(b, tctx, &r),
1207                 "EnumPrivsAccount failed");
1208         if (!NT_STATUS_IS_OK(r.out.result)) {
1209                 torture_comment(tctx, "EnumPrivsAccount failed - %s\n",
1210                                 nt_errstr(r.out.result));
1211                 return false;
1212         }
1213
1214         if (privs && privs->count > 0) {
1215                 int i;
1216                 for (i=0;i<privs->count;i++) {
1217                         test_LookupPrivName(b, tctx, handle,
1218                                             &privs->set[i].luid);
1219                 }
1220
1221                 ret &= test_RemovePrivilegesFromAccount(b, tctx, handle, acct_handle,
1222                                                         &privs->set[0].luid);
1223                 ret &= test_AddPrivilegesToAccount(b, tctx, acct_handle,
1224                                                    &privs->set[0].luid);
1225         }
1226
1227         return ret;
1228 }
1229
1230 static bool test_GetSystemAccessAccount(struct dcerpc_binding_handle *b,
1231                                         struct torture_context *tctx,
1232                                         struct policy_handle *handle,
1233                                         struct policy_handle *acct_handle)
1234 {
1235         uint32_t access_mask;
1236         struct lsa_GetSystemAccessAccount r;
1237
1238         torture_comment(tctx, "\nTesting GetSystemAccessAccount\n");
1239
1240         r.in.handle = acct_handle;
1241         r.out.access_mask = &access_mask;
1242
1243         torture_assert_ntstatus_ok(tctx, dcerpc_lsa_GetSystemAccessAccount_r(b, tctx, &r),
1244                 "GetSystemAccessAccount failed");
1245         if (!NT_STATUS_IS_OK(r.out.result)) {
1246                 torture_comment(tctx, "GetSystemAccessAccount failed - %s\n",
1247                                 nt_errstr(r.out.result));
1248                 return false;
1249         }
1250
1251         if (r.out.access_mask != NULL) {
1252                 torture_comment(tctx, "Rights:");
1253                 if (*(r.out.access_mask) & LSA_POLICY_MODE_INTERACTIVE)
1254                         torture_comment(tctx, " LSA_POLICY_MODE_INTERACTIVE");
1255                 if (*(r.out.access_mask) & LSA_POLICY_MODE_NETWORK)
1256                         torture_comment(tctx, " LSA_POLICY_MODE_NETWORK");
1257                 if (*(r.out.access_mask) & LSA_POLICY_MODE_BATCH)
1258                         torture_comment(tctx, " LSA_POLICY_MODE_BATCH");
1259                 if (*(r.out.access_mask) & LSA_POLICY_MODE_SERVICE)
1260                         torture_comment(tctx, " LSA_POLICY_MODE_SERVICE");
1261                 if (*(r.out.access_mask) & LSA_POLICY_MODE_PROXY)
1262                         torture_comment(tctx, " LSA_POLICY_MODE_PROXY");
1263                 if (*(r.out.access_mask) & LSA_POLICY_MODE_DENY_INTERACTIVE)
1264                         torture_comment(tctx, " LSA_POLICY_MODE_DENY_INTERACTIVE");
1265                 if (*(r.out.access_mask) & LSA_POLICY_MODE_DENY_NETWORK)
1266                         torture_comment(tctx, " LSA_POLICY_MODE_DENY_NETWORK");
1267                 if (*(r.out.access_mask) & LSA_POLICY_MODE_DENY_BATCH)
1268                         torture_comment(tctx, " LSA_POLICY_MODE_DENY_BATCH");
1269                 if (*(r.out.access_mask) & LSA_POLICY_MODE_DENY_SERVICE)
1270                         torture_comment(tctx, " LSA_POLICY_MODE_DENY_SERVICE");
1271                 if (*(r.out.access_mask) & LSA_POLICY_MODE_REMOTE_INTERACTIVE)
1272                         torture_comment(tctx, " LSA_POLICY_MODE_REMOTE_INTERACTIVE");
1273                 if (*(r.out.access_mask) & LSA_POLICY_MODE_DENY_REMOTE_INTERACTIVE)
1274                         torture_comment(tctx, " LSA_POLICY_MODE_DENY_REMOTE_INTERACTIVE");
1275                 if (*(r.out.access_mask) & LSA_POLICY_MODE_ALL)
1276                         torture_comment(tctx, " LSA_POLICY_MODE_ALL");
1277                 if (*(r.out.access_mask) & LSA_POLICY_MODE_ALL_NT4)
1278                         torture_comment(tctx, " LSA_POLICY_MODE_ALL_NT4");
1279                 torture_comment(tctx, "\n");
1280         }
1281
1282         return true;
1283 }
1284
1285 static bool test_Delete(struct dcerpc_binding_handle *b,
1286                         struct torture_context *tctx,
1287                         struct policy_handle *handle)
1288 {
1289         struct lsa_Delete r;
1290
1291         torture_comment(tctx, "\nTesting Delete\n");
1292
1293         r.in.handle = handle;
1294         torture_assert_ntstatus_ok(tctx, dcerpc_lsa_Delete_r(b, tctx, &r),
1295                 "Delete failed");
1296         if (!NT_STATUS_EQUAL(r.out.result, NT_STATUS_NOT_SUPPORTED)) {
1297                 torture_comment(tctx, "Delete should have failed NT_STATUS_NOT_SUPPORTED - %s\n", nt_errstr(r.out.result));
1298                 return false;
1299         }
1300
1301         return true;
1302 }
1303
1304 static bool test_DeleteObject(struct dcerpc_binding_handle *b,
1305                               struct torture_context *tctx,
1306                               struct policy_handle *handle)
1307 {
1308         struct lsa_DeleteObject r;
1309
1310         torture_comment(tctx, "\nTesting DeleteObject\n");
1311
1312         r.in.handle = handle;
1313         r.out.handle = handle;
1314         torture_assert_ntstatus_ok(tctx, dcerpc_lsa_DeleteObject_r(b, tctx, &r),
1315                 "DeleteObject failed");
1316         if (!NT_STATUS_IS_OK(r.out.result)) {
1317                 torture_comment(tctx, "DeleteObject failed - %s\n",
1318                                 nt_errstr(r.out.result));
1319                 return false;
1320         }
1321
1322         return true;
1323 }
1324
1325
1326 static bool test_CreateAccount(struct dcerpc_binding_handle *b,
1327                                struct torture_context *tctx,
1328                                struct policy_handle *handle)
1329 {
1330         struct lsa_CreateAccount r;
1331         struct dom_sid2 *newsid;
1332         struct policy_handle acct_handle;
1333
1334         newsid = dom_sid_parse_talloc(tctx, "S-1-5-12349876-4321-2854");
1335
1336         torture_comment(tctx, "\nTesting CreateAccount\n");
1337
1338         r.in.handle = handle;
1339         r.in.sid = newsid;
1340         r.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
1341         r.out.acct_handle = &acct_handle;
1342
1343         torture_assert_ntstatus_ok(tctx, dcerpc_lsa_CreateAccount_r(b, tctx, &r),
1344                 "CreateAccount failed");
1345         if (NT_STATUS_EQUAL(r.out.result, NT_STATUS_OBJECT_NAME_COLLISION)) {
1346                 struct lsa_OpenAccount r_o;
1347                 r_o.in.handle = handle;
1348                 r_o.in.sid = newsid;
1349                 r_o.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
1350                 r_o.out.acct_handle = &acct_handle;
1351
1352                 torture_assert_ntstatus_ok(tctx, dcerpc_lsa_OpenAccount_r(b, tctx, &r_o),
1353                         "OpenAccount failed");
1354                 if (!NT_STATUS_IS_OK(r_o.out.result)) {
1355                         torture_comment(tctx, "OpenAccount failed - %s\n",
1356                                         nt_errstr(r_o.out.result));
1357                         return false;
1358                 }
1359         } else if (!NT_STATUS_IS_OK(r.out.result)) {
1360                 torture_comment(tctx, "CreateAccount failed - %s\n",
1361                                 nt_errstr(r.out.result));
1362                 return false;
1363         }
1364
1365         if (!test_Delete(b, tctx, &acct_handle)) {
1366                 return false;
1367         }
1368
1369         if (!test_DeleteObject(b, tctx, &acct_handle)) {
1370                 return false;
1371         }
1372
1373         return true;
1374 }
1375
1376 static bool test_DeleteTrustedDomain(struct dcerpc_binding_handle *b,
1377                                      struct torture_context *tctx,
1378                                      struct policy_handle *handle,
1379                                      struct lsa_StringLarge name)
1380 {
1381         struct lsa_OpenTrustedDomainByName r;
1382         struct policy_handle trustdom_handle;
1383
1384         r.in.handle = handle;
1385         r.in.name.string = name.string;
1386         r.in.access_mask = SEC_STD_DELETE;
1387         r.out.trustdom_handle = &trustdom_handle;
1388
1389         torture_assert_ntstatus_ok(tctx, dcerpc_lsa_OpenTrustedDomainByName_r(b, tctx, &r),
1390                 "OpenTrustedDomainByName failed");
1391         if (!NT_STATUS_IS_OK(r.out.result)) {
1392                 torture_comment(tctx, "OpenTrustedDomainByName failed - %s\n", nt_errstr(r.out.result));
1393                 return false;
1394         }
1395
1396         if (!test_Delete(b, tctx, &trustdom_handle)) {
1397                 return false;
1398         }
1399
1400         if (!test_DeleteObject(b, tctx, &trustdom_handle)) {
1401                 return false;
1402         }
1403
1404         return true;
1405 }
1406
1407 static bool test_DeleteTrustedDomainBySid(struct dcerpc_binding_handle *b,
1408                                           struct torture_context *tctx,
1409                                           struct policy_handle *handle,
1410                                           struct dom_sid *sid)
1411 {
1412         struct lsa_DeleteTrustedDomain r;
1413
1414         r.in.handle = handle;
1415         r.in.dom_sid = sid;
1416
1417         torture_assert_ntstatus_ok(tctx, dcerpc_lsa_DeleteTrustedDomain_r(b, tctx, &r),
1418                 "DeleteTrustedDomain failed");
1419         if (!NT_STATUS_IS_OK(r.out.result)) {
1420                 torture_comment(tctx, "DeleteTrustedDomain failed - %s\n", nt_errstr(r.out.result));
1421                 return false;
1422         }
1423
1424         return true;
1425 }
1426
1427
1428 static bool test_CreateSecret(struct dcerpc_pipe *p,
1429                               struct torture_context *tctx,
1430                               struct policy_handle *handle)
1431 {
1432         NTSTATUS status;
1433         struct lsa_CreateSecret r;
1434         struct lsa_OpenSecret r2;
1435         struct lsa_SetSecret r3;
1436         struct lsa_QuerySecret r4;
1437         struct lsa_SetSecret r5;
1438         struct lsa_QuerySecret r6;
1439         struct lsa_SetSecret r7;
1440         struct lsa_QuerySecret r8;
1441         struct policy_handle sec_handle, sec_handle2, sec_handle3;
1442         struct lsa_DeleteObject d_o;
1443         struct lsa_DATA_BUF buf1;
1444         struct lsa_DATA_BUF_PTR bufp1;
1445         struct lsa_DATA_BUF_PTR bufp2;
1446         DATA_BLOB enc_key;
1447         bool ret = true;
1448         DATA_BLOB session_key;
1449         NTTIME old_mtime, new_mtime;
1450         DATA_BLOB blob1;
1451         const char *secret1 = "abcdef12345699qwerty";
1452         char *secret2;
1453         const char *secret3 = "ABCDEF12345699QWERTY";
1454         char *secret4;
1455         const char *secret5 = "NEW-SAMBA4-SECRET";
1456         char *secret6;
1457         char *secname[2];
1458         int i;
1459         const int LOCAL = 0;
1460         const int GLOBAL = 1;
1461         struct dcerpc_binding_handle *b = p->binding_handle;
1462
1463         secname[LOCAL] = talloc_asprintf(tctx, "torturesecret-%u", (unsigned int)random());
1464         secname[GLOBAL] = talloc_asprintf(tctx, "G$torturesecret-%u", (unsigned int)random());
1465
1466         for (i=0; i< 2; i++) {
1467                 torture_comment(tctx, "\nTesting CreateSecret of %s\n", secname[i]);
1468
1469                 init_lsa_String(&r.in.name, secname[i]);
1470
1471                 r.in.handle = handle;
1472                 r.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
1473                 r.out.sec_handle = &sec_handle;
1474
1475                 torture_assert_ntstatus_ok(tctx, dcerpc_lsa_CreateSecret_r(b, tctx, &r),
1476                         "CreateSecret failed");
1477                 if (!NT_STATUS_IS_OK(r.out.result)) {
1478                         torture_comment(tctx, "CreateSecret failed - %s\n", nt_errstr(r.out.result));
1479                         return false;
1480                 }
1481
1482                 r.in.handle = handle;
1483                 r.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
1484                 r.out.sec_handle = &sec_handle3;
1485
1486                 torture_assert_ntstatus_ok(tctx, dcerpc_lsa_CreateSecret_r(b, tctx, &r),
1487                         "CreateSecret failed");
1488                 if (!NT_STATUS_EQUAL(r.out.result, NT_STATUS_OBJECT_NAME_COLLISION)) {
1489                         torture_comment(tctx, "CreateSecret should have failed OBJECT_NAME_COLLISION - %s\n", nt_errstr(r.out.result));
1490                         return false;
1491                 }
1492
1493                 r2.in.handle = handle;
1494                 r2.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
1495                 r2.in.name = r.in.name;
1496                 r2.out.sec_handle = &sec_handle2;
1497
1498                 torture_comment(tctx, "Testing OpenSecret\n");
1499
1500                 torture_assert_ntstatus_ok(tctx, dcerpc_lsa_OpenSecret_r(b, tctx, &r2),
1501                         "OpenSecret failed");
1502                 if (!NT_STATUS_IS_OK(r2.out.result)) {
1503                         torture_comment(tctx, "OpenSecret failed - %s\n", nt_errstr(r2.out.result));
1504                         return false;
1505                 }
1506
1507                 status = dcerpc_fetch_session_key(p, &session_key);
1508                 if (!NT_STATUS_IS_OK(status)) {
1509                         torture_comment(tctx, "dcerpc_fetch_session_key failed - %s\n", nt_errstr(status));
1510                         return false;
1511                 }
1512
1513                 enc_key = sess_encrypt_string(secret1, &session_key);
1514
1515                 r3.in.sec_handle = &sec_handle;
1516                 r3.in.new_val = &buf1;
1517                 r3.in.old_val = NULL;
1518                 r3.in.new_val->data = enc_key.data;
1519                 r3.in.new_val->length = enc_key.length;
1520                 r3.in.new_val->size = enc_key.length;
1521
1522                 torture_comment(tctx, "Testing SetSecret\n");
1523
1524                 torture_assert_ntstatus_ok(tctx, dcerpc_lsa_SetSecret_r(b, tctx, &r3),
1525                         "SetSecret failed");
1526                 if (!NT_STATUS_IS_OK(r3.out.result)) {
1527                         torture_comment(tctx, "SetSecret failed - %s\n", nt_errstr(r3.out.result));
1528                         return false;
1529                 }
1530
1531                 r3.in.sec_handle = &sec_handle;
1532                 r3.in.new_val = &buf1;
1533                 r3.in.old_val = NULL;
1534                 r3.in.new_val->data = enc_key.data;
1535                 r3.in.new_val->length = enc_key.length;
1536                 r3.in.new_val->size = enc_key.length;
1537
1538                 /* break the encrypted data */
1539                 enc_key.data[0]++;
1540
1541                 torture_comment(tctx, "Testing SetSecret with broken key\n");
1542
1543                 torture_assert_ntstatus_ok(tctx, dcerpc_lsa_SetSecret_r(b, tctx, &r3),
1544                         "SetSecret failed");
1545                 if (!NT_STATUS_EQUAL(r3.out.result, NT_STATUS_UNKNOWN_REVISION)) {
1546                         torture_comment(tctx, "SetSecret should have failed UNKNOWN_REVISION - %s\n", nt_errstr(r3.out.result));
1547                         ret = false;
1548                 }
1549
1550                 data_blob_free(&enc_key);
1551
1552                 ZERO_STRUCT(new_mtime);
1553                 ZERO_STRUCT(old_mtime);
1554
1555                 /* fetch the secret back again */
1556                 r4.in.sec_handle = &sec_handle;
1557                 r4.in.new_val = &bufp1;
1558                 r4.in.new_mtime = &new_mtime;
1559                 r4.in.old_val = NULL;
1560                 r4.in.old_mtime = NULL;
1561
1562                 bufp1.buf = NULL;
1563
1564                 torture_comment(tctx, "Testing QuerySecret\n");
1565                 torture_assert_ntstatus_ok(tctx, dcerpc_lsa_QuerySecret_r(b, tctx, &r4),
1566                         "QuerySecret failed");
1567                 if (!NT_STATUS_IS_OK(r4.out.result)) {
1568                         torture_comment(tctx, "QuerySecret failed - %s\n", nt_errstr(r4.out.result));
1569                         ret = false;
1570                 } else {
1571                         if (r4.out.new_val == NULL || r4.out.new_val->buf == NULL) {
1572                                 torture_comment(tctx, "No secret buffer returned\n");
1573                                 ret = false;
1574                         } else {
1575                                 blob1.data = r4.out.new_val->buf->data;
1576                                 blob1.length = r4.out.new_val->buf->size;
1577
1578                                 secret2 = sess_decrypt_string(tctx,
1579                                                               &blob1, &session_key);
1580
1581                                 if (strcmp(secret1, secret2) != 0) {
1582                                         torture_comment(tctx, "Returned secret (r4) '%s' doesn't match '%s'\n",
1583                                                secret2, secret1);
1584                                         ret = false;
1585                                 }
1586                         }
1587                 }
1588
1589                 enc_key = sess_encrypt_string(secret3, &session_key);
1590
1591                 r5.in.sec_handle = &sec_handle;
1592                 r5.in.new_val = &buf1;
1593                 r5.in.old_val = NULL;
1594                 r5.in.new_val->data = enc_key.data;
1595                 r5.in.new_val->length = enc_key.length;
1596                 r5.in.new_val->size = enc_key.length;
1597
1598
1599                 smb_msleep(200);
1600                 torture_comment(tctx, "Testing SetSecret (existing value should move to old)\n");
1601
1602                 torture_assert_ntstatus_ok(tctx, dcerpc_lsa_SetSecret_r(b, tctx, &r5),
1603                         "SetSecret failed");
1604                 if (!NT_STATUS_IS_OK(r5.out.result)) {
1605                         torture_comment(tctx, "SetSecret failed - %s\n", nt_errstr(r5.out.result));
1606                         ret = false;
1607                 }
1608
1609                 data_blob_free(&enc_key);
1610
1611                 ZERO_STRUCT(new_mtime);
1612                 ZERO_STRUCT(old_mtime);
1613
1614                 /* fetch the secret back again */
1615                 r6.in.sec_handle = &sec_handle;
1616                 r6.in.new_val = &bufp1;
1617                 r6.in.new_mtime = &new_mtime;
1618                 r6.in.old_val = &bufp2;
1619                 r6.in.old_mtime = &old_mtime;
1620
1621                 bufp1.buf = NULL;
1622                 bufp2.buf = NULL;
1623
1624                 torture_assert_ntstatus_ok(tctx, dcerpc_lsa_QuerySecret_r(b, tctx, &r6),
1625                         "QuerySecret failed");
1626                 if (!NT_STATUS_IS_OK(r6.out.result)) {
1627                         torture_comment(tctx, "QuerySecret failed - %s\n", nt_errstr(r6.out.result));
1628                         ret = false;
1629                         secret4 = NULL;
1630                 } else {
1631
1632                         if (r6.out.new_val->buf == NULL || r6.out.old_val->buf == NULL
1633                                 || r6.out.new_mtime == NULL || r6.out.old_mtime == NULL) {
1634                                 torture_comment(tctx, "Both secret buffers and both times not returned\n");
1635                                 ret = false;
1636                                 secret4 = NULL;
1637                         } else {
1638                                 blob1.data = r6.out.new_val->buf->data;
1639                                 blob1.length = r6.out.new_val->buf->size;
1640
1641                                 secret4 = sess_decrypt_string(tctx,
1642                                                               &blob1, &session_key);
1643
1644                                 if (strcmp(secret3, secret4) != 0) {
1645                                         torture_comment(tctx, "Returned NEW secret %s doesn't match %s\n", secret4, secret3);
1646                                         ret = false;
1647                                 }
1648
1649                                 blob1.data = r6.out.old_val->buf->data;
1650                                 blob1.length = r6.out.old_val->buf->length;
1651
1652                                 secret2 = sess_decrypt_string(tctx,
1653                                                               &blob1, &session_key);
1654
1655                                 if (strcmp(secret1, secret2) != 0) {
1656                                         torture_comment(tctx, "Returned OLD secret %s doesn't match %s\n", secret2, secret1);
1657                                         ret = false;
1658                                 }
1659
1660                                 if (*r6.out.new_mtime == *r6.out.old_mtime) {
1661                                         torture_comment(tctx, "Returned secret (r6-%d) %s must not have same mtime for both secrets: %s != %s\n",
1662                                                i,
1663                                                secname[i],
1664                                                nt_time_string(tctx, *r6.out.old_mtime),
1665                                                nt_time_string(tctx, *r6.out.new_mtime));
1666                                         ret = false;
1667                                 }
1668                         }
1669                 }
1670
1671                 enc_key = sess_encrypt_string(secret5, &session_key);
1672
1673                 r7.in.sec_handle = &sec_handle;
1674                 r7.in.old_val = &buf1;
1675                 r7.in.old_val->data = enc_key.data;
1676                 r7.in.old_val->length = enc_key.length;
1677                 r7.in.old_val->size = enc_key.length;
1678                 r7.in.new_val = NULL;
1679
1680                 torture_comment(tctx, "Testing SetSecret of old Secret only\n");
1681
1682                 torture_assert_ntstatus_ok(tctx, dcerpc_lsa_SetSecret_r(b, tctx, &r7),
1683                         "SetSecret failed");
1684                 if (!NT_STATUS_IS_OK(r7.out.result)) {
1685                         torture_comment(tctx, "SetSecret failed - %s\n", nt_errstr(r7.out.result));
1686                         ret = false;
1687                 }
1688
1689                 data_blob_free(&enc_key);
1690
1691                 /* fetch the secret back again */
1692                 r8.in.sec_handle = &sec_handle;
1693                 r8.in.new_val = &bufp1;
1694                 r8.in.new_mtime = &new_mtime;
1695                 r8.in.old_val = &bufp2;
1696                 r8.in.old_mtime = &old_mtime;
1697
1698                 bufp1.buf = NULL;
1699                 bufp2.buf = NULL;
1700
1701                 torture_assert_ntstatus_ok(tctx, dcerpc_lsa_QuerySecret_r(b, tctx, &r8),
1702                         "QuerySecret failed");
1703                 if (!NT_STATUS_IS_OK(r8.out.result)) {
1704                         torture_comment(tctx, "QuerySecret failed - %s\n", nt_errstr(r8.out.result));
1705                         ret = false;
1706                 } else {
1707                         if (!r8.out.new_val || !r8.out.old_val) {
1708                                 torture_comment(tctx, "in/out pointers not returned, despite being set on in for QuerySecret\n");
1709                                 ret = false;
1710                         } else if (r8.out.new_val->buf != NULL) {
1711                                 torture_comment(tctx, "NEW secret buffer must not be returned after OLD set\n");
1712                                 ret = false;
1713                         } else if (r8.out.old_val->buf == NULL) {
1714                                 torture_comment(tctx, "OLD secret buffer was not returned after OLD set\n");
1715                                 ret = false;
1716                         } else if (r8.out.new_mtime == NULL || r8.out.old_mtime == NULL) {
1717                                 torture_comment(tctx, "Both times not returned after OLD set\n");
1718                                 ret = false;
1719                         } else {
1720                                 blob1.data = r8.out.old_val->buf->data;
1721                                 blob1.length = r8.out.old_val->buf->size;
1722
1723                                 secret6 = sess_decrypt_string(tctx,
1724                                                               &blob1, &session_key);
1725
1726                                 if (strcmp(secret5, secret6) != 0) {
1727                                         torture_comment(tctx, "Returned OLD secret %s doesn't match %s\n", secret5, secret6);
1728                                         ret = false;
1729                                 }
1730
1731                                 if (*r8.out.new_mtime != *r8.out.old_mtime) {
1732                                         torture_comment(tctx, "Returned secret (r8) %s did not had same mtime for both secrets: %s != %s\n",
1733                                                secname[i],
1734                                                nt_time_string(tctx, *r8.out.old_mtime),
1735                                                nt_time_string(tctx, *r8.out.new_mtime));
1736                                         ret = false;
1737                                 }
1738                         }
1739                 }
1740
1741                 if (!test_Delete(b, tctx, &sec_handle)) {
1742                         ret = false;
1743                 }
1744
1745                 if (!test_DeleteObject(b, tctx, &sec_handle)) {
1746                         return false;
1747                 }
1748
1749                 d_o.in.handle = &sec_handle2;
1750                 d_o.out.handle = &sec_handle2;
1751                 torture_assert_ntstatus_ok(tctx, dcerpc_lsa_DeleteObject_r(b, tctx, &d_o),
1752                         "DeleteObject failed");
1753                 if (!NT_STATUS_EQUAL(d_o.out.result, NT_STATUS_INVALID_HANDLE)) {
1754                         torture_comment(tctx, "Second delete expected INVALID_HANDLE - %s\n", nt_errstr(d_o.out.result));
1755                         ret = false;
1756                 } else {
1757
1758                         torture_comment(tctx, "Testing OpenSecret of just-deleted secret\n");
1759
1760                         torture_assert_ntstatus_ok(tctx, dcerpc_lsa_OpenSecret_r(b, tctx, &r2),
1761                                 "OpenSecret failed");
1762                         if (!NT_STATUS_EQUAL(r2.out.result, NT_STATUS_OBJECT_NAME_NOT_FOUND)) {
1763                                 torture_comment(tctx, "OpenSecret expected OBJECT_NAME_NOT_FOUND - %s\n", nt_errstr(r2.out.result));
1764                                 ret = false;
1765                         }
1766                 }
1767
1768         }
1769
1770         return ret;
1771 }
1772
1773
1774 static bool test_EnumAccountRights(struct dcerpc_binding_handle *b,
1775                                    struct torture_context *tctx,
1776                                    struct policy_handle *acct_handle,
1777                                    struct dom_sid *sid)
1778 {
1779         struct lsa_EnumAccountRights r;
1780         struct lsa_RightSet rights;
1781
1782         torture_comment(tctx, "\nTesting EnumAccountRights\n");
1783
1784         r.in.handle = acct_handle;
1785         r.in.sid = sid;
1786         r.out.rights = &rights;
1787
1788         torture_assert_ntstatus_ok(tctx, dcerpc_lsa_EnumAccountRights_r(b, tctx, &r),
1789                 "EnumAccountRights failed");
1790         if (!NT_STATUS_IS_OK(r.out.result)) {
1791                 torture_comment(tctx, "EnumAccountRights of %s failed - %s\n",
1792                        dom_sid_string(tctx, sid), nt_errstr(r.out.result));
1793                 return false;
1794         }
1795
1796         return true;
1797 }
1798
1799
1800 static bool test_QuerySecurity(struct dcerpc_binding_handle *b,
1801                              struct torture_context *tctx,
1802                              struct policy_handle *handle,
1803                              struct policy_handle *acct_handle)
1804 {
1805         struct lsa_QuerySecurity r;
1806         struct sec_desc_buf *sdbuf = NULL;
1807
1808         if (torture_setting_bool(tctx, "samba4", false)) {
1809                 torture_comment(tctx, "\nskipping QuerySecurity test against Samba4\n");
1810                 return true;
1811         }
1812
1813         torture_comment(tctx, "\nTesting QuerySecurity\n");
1814
1815         r.in.handle = acct_handle;
1816         r.in.sec_info = SECINFO_OWNER |
1817                         SECINFO_GROUP |
1818                         SECINFO_DACL;
1819         r.out.sdbuf = &sdbuf;
1820
1821         torture_assert_ntstatus_ok(tctx, dcerpc_lsa_QuerySecurity_r(b, tctx, &r),
1822                 "QuerySecurity failed");
1823         if (!NT_STATUS_IS_OK(r.out.result)) {
1824                 torture_comment(tctx, "QuerySecurity failed - %s\n", nt_errstr(r.out.result));
1825                 return false;
1826         }
1827
1828         return true;
1829 }
1830
1831 static bool test_OpenAccount(struct dcerpc_binding_handle *b,
1832                              struct torture_context *tctx,
1833                              struct policy_handle *handle,
1834                              struct dom_sid *sid)
1835 {
1836         struct lsa_OpenAccount r;
1837         struct policy_handle acct_handle;
1838
1839         torture_comment(tctx, "\nTesting OpenAccount\n");
1840
1841         r.in.handle = handle;
1842         r.in.sid = sid;
1843         r.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
1844         r.out.acct_handle = &acct_handle;
1845
1846         torture_assert_ntstatus_ok(tctx, dcerpc_lsa_OpenAccount_r(b, tctx, &r),
1847                 "OpenAccount failed");
1848         if (!NT_STATUS_IS_OK(r.out.result)) {
1849                 torture_comment(tctx, "OpenAccount failed - %s\n", nt_errstr(r.out.result));
1850                 return false;
1851         }
1852
1853         if (!test_EnumPrivsAccount(b, tctx, handle, &acct_handle)) {
1854                 return false;
1855         }
1856
1857         if (!test_GetSystemAccessAccount(b, tctx, handle, &acct_handle)) {
1858                 return false;
1859         }
1860
1861         if (!test_QuerySecurity(b, tctx, handle, &acct_handle)) {
1862                 return false;
1863         }
1864
1865         return true;
1866 }
1867
1868 static bool test_EnumAccounts(struct dcerpc_binding_handle *b,
1869                               struct torture_context *tctx,
1870                               struct policy_handle *handle)
1871 {
1872         struct lsa_EnumAccounts r;
1873         struct lsa_SidArray sids1, sids2;
1874         uint32_t resume_handle = 0;
1875         int i;
1876         bool ret = true;
1877
1878         torture_comment(tctx, "\nTesting EnumAccounts\n");
1879
1880         r.in.handle = handle;
1881         r.in.resume_handle = &resume_handle;
1882         r.in.num_entries = 100;
1883         r.out.resume_handle = &resume_handle;
1884         r.out.sids = &sids1;
1885
1886         resume_handle = 0;
1887         while (true) {
1888                 torture_assert_ntstatus_ok(tctx, dcerpc_lsa_EnumAccounts_r(b, tctx, &r),
1889                         "EnumAccounts failed");
1890                 if (NT_STATUS_EQUAL(r.out.result, NT_STATUS_NO_MORE_ENTRIES)) {
1891                         break;
1892                 }
1893                 if (!NT_STATUS_IS_OK(r.out.result)) {
1894                         torture_comment(tctx, "EnumAccounts failed - %s\n", nt_errstr(r.out.result));
1895                         return false;
1896                 }
1897
1898                 if (!test_LookupSids(b, tctx, handle, &sids1)) {
1899                         return false;
1900                 }
1901
1902                 if (!test_LookupSids2(b, tctx, handle, &sids1)) {
1903                         return false;
1904                 }
1905
1906                 /* Can't test lookupSids3 here, as clearly we must not
1907                  * be on schannel, or we would not be able to do the
1908                  * rest */
1909
1910                 torture_comment(tctx, "Testing all accounts\n");
1911                 for (i=0;i<sids1.num_sids;i++) {
1912                         ret &= test_OpenAccount(b, tctx, handle, sids1.sids[i].sid);
1913                         ret &= test_EnumAccountRights(b, tctx, handle, sids1.sids[i].sid);
1914                 }
1915                 torture_comment(tctx, "\n");
1916         }
1917
1918         if (sids1.num_sids < 3) {
1919                 return ret;
1920         }
1921
1922         torture_comment(tctx, "Trying EnumAccounts partial listing (asking for 1 at 2)\n");
1923         resume_handle = 2;
1924         r.in.num_entries = 1;
1925         r.out.sids = &sids2;
1926
1927         torture_assert_ntstatus_ok(tctx, dcerpc_lsa_EnumAccounts_r(b, tctx, &r),
1928                 "EnumAccounts failed");
1929         if (!NT_STATUS_IS_OK(r.out.result)) {
1930                 torture_comment(tctx, "EnumAccounts failed - %s\n", nt_errstr(r.out.result));
1931                 return false;
1932         }
1933
1934         if (sids2.num_sids != 1) {
1935                 torture_comment(tctx, "Returned wrong number of entries (%d)\n", sids2.num_sids);
1936                 return false;
1937         }
1938
1939         return true;
1940 }
1941
1942 static bool test_LookupPrivDisplayName(struct dcerpc_binding_handle *b,
1943                                        struct torture_context *tctx,
1944                                        struct policy_handle *handle,
1945                                        struct lsa_String *priv_name)
1946 {
1947         struct lsa_LookupPrivDisplayName r;
1948         /* produce a reasonable range of language output without screwing up
1949            terminals */
1950         uint16_t language_id = (random() % 4) + 0x409;
1951         uint16_t returned_language_id = 0;
1952         struct lsa_StringLarge *disp_name = NULL;
1953
1954         torture_comment(tctx, "\nTesting LookupPrivDisplayName(%s)\n", priv_name->string);
1955
1956         r.in.handle = handle;
1957         r.in.name = priv_name;
1958         r.in.language_id = language_id;
1959         r.in.language_id_sys = 0;
1960         r.out.returned_language_id = &returned_language_id;
1961         r.out.disp_name = &disp_name;
1962
1963         torture_assert_ntstatus_ok(tctx, dcerpc_lsa_LookupPrivDisplayName_r(b, tctx, &r),
1964                 "LookupPrivDisplayName failed");
1965         if (!NT_STATUS_IS_OK(r.out.result)) {
1966                 torture_comment(tctx, "LookupPrivDisplayName failed - %s\n", nt_errstr(r.out.result));
1967                 return false;
1968         }
1969         torture_comment(tctx, "%s -> \"%s\"  (language 0x%x/0x%x)\n",
1970                priv_name->string, disp_name->string,
1971                r.in.language_id, *r.out.returned_language_id);
1972
1973         return true;
1974 }
1975
1976 static bool test_EnumAccountsWithUserRight(struct dcerpc_binding_handle *b,
1977                                            struct torture_context *tctx,
1978                                            struct policy_handle *handle,
1979                                            struct lsa_String *priv_name)
1980 {
1981         struct lsa_EnumAccountsWithUserRight r;
1982         struct lsa_SidArray sids;
1983
1984         ZERO_STRUCT(sids);
1985
1986         torture_comment(tctx, "\nTesting EnumAccountsWithUserRight(%s)\n", priv_name->string);
1987
1988         r.in.handle = handle;
1989         r.in.name = priv_name;
1990         r.out.sids = &sids;
1991
1992         torture_assert_ntstatus_ok(tctx, dcerpc_lsa_EnumAccountsWithUserRight_r(b, tctx, &r),
1993                 "EnumAccountsWithUserRight failed");
1994
1995         /* NT_STATUS_NO_MORE_ENTRIES means noone has this privilege */
1996         if (NT_STATUS_EQUAL(r.out.result, NT_STATUS_NO_MORE_ENTRIES)) {
1997                 return true;
1998         }
1999
2000         if (!NT_STATUS_IS_OK(r.out.result)) {
2001                 torture_comment(tctx, "EnumAccountsWithUserRight failed - %s\n", nt_errstr(r.out.result));
2002                 return false;
2003         }
2004
2005         return true;
2006 }
2007
2008
2009 static bool test_EnumPrivs(struct dcerpc_binding_handle *b,
2010                            struct torture_context *tctx,
2011                            struct policy_handle *handle)
2012 {
2013         struct lsa_EnumPrivs r;
2014         struct lsa_PrivArray privs1;
2015         uint32_t resume_handle = 0;
2016         int i;
2017         bool ret = true;
2018
2019         torture_comment(tctx, "\nTesting EnumPrivs\n");
2020
2021         r.in.handle = handle;
2022         r.in.resume_handle = &resume_handle;
2023         r.in.max_count = 100;
2024         r.out.resume_handle = &resume_handle;
2025         r.out.privs = &privs1;
2026
2027         resume_handle = 0;
2028         torture_assert_ntstatus_ok(tctx, dcerpc_lsa_EnumPrivs_r(b, tctx, &r),
2029                 "EnumPrivs failed");
2030         if (!NT_STATUS_IS_OK(r.out.result)) {
2031                 torture_comment(tctx, "EnumPrivs failed - %s\n", nt_errstr(r.out.result));
2032                 return false;
2033         }
2034
2035         for (i = 0; i< privs1.count; i++) {
2036                 test_LookupPrivDisplayName(b, tctx, handle, (struct lsa_String *)&privs1.privs[i].name);
2037                 test_LookupPrivValue(b, tctx, handle, (struct lsa_String *)&privs1.privs[i].name);
2038                 if (!test_EnumAccountsWithUserRight(b, tctx, handle, (struct lsa_String *)&privs1.privs[i].name)) {
2039                         ret = false;
2040                 }
2041         }
2042
2043         return ret;
2044 }
2045
2046 static bool test_QueryForestTrustInformation(struct dcerpc_binding_handle *b,
2047                                              struct torture_context *tctx,
2048                                              struct policy_handle *handle,
2049                                              const char *trusted_domain_name)
2050 {
2051         bool ret = true;
2052         struct lsa_lsaRQueryForestTrustInformation r;
2053         struct lsa_String string;
2054         struct lsa_ForestTrustInformation info, *info_ptr;
2055
2056         torture_comment(tctx, "\nTesting lsaRQueryForestTrustInformation\n");
2057
2058         if (torture_setting_bool(tctx, "samba4", false)) {
2059                 torture_comment(tctx, "skipping QueryForestTrustInformation against Samba4\n");
2060                 return true;
2061         }
2062
2063         ZERO_STRUCT(string);
2064
2065         if (trusted_domain_name) {
2066                 init_lsa_String(&string, trusted_domain_name);
2067         }
2068
2069         info_ptr = &info;
2070
2071         r.in.handle = handle;
2072         r.in.trusted_domain_name = &string;
2073         r.in.unknown = 0;
2074         r.out.forest_trust_info = &info_ptr;
2075
2076         torture_assert_ntstatus_ok(tctx, dcerpc_lsa_lsaRQueryForestTrustInformation_r(b, tctx, &r),
2077                 "lsaRQueryForestTrustInformation failed");
2078
2079         if (!NT_STATUS_IS_OK(r.out.result)) {
2080                 torture_comment(tctx, "lsaRQueryForestTrustInformation of %s failed - %s\n", trusted_domain_name, nt_errstr(r.out.result));
2081                 ret = false;
2082         }
2083
2084         return ret;
2085 }
2086
2087 static bool test_query_each_TrustDomEx(struct dcerpc_binding_handle *b,
2088                                        struct torture_context *tctx,
2089                                        struct policy_handle *handle,
2090                                        struct lsa_DomainListEx *domains)
2091 {
2092         int i;
2093         bool ret = true;
2094
2095         for (i=0; i< domains->count; i++) {
2096
2097                 if (domains->domains[i].trust_attributes & NETR_TRUST_ATTRIBUTE_FOREST_TRANSITIVE) {
2098                         ret &= test_QueryForestTrustInformation(b, tctx, handle,
2099                                                                 domains->domains[i].domain_name.string);
2100                 }
2101         }
2102
2103         return ret;
2104 }
2105
2106 static bool test_query_each_TrustDom(struct dcerpc_binding_handle *b,
2107                                      struct torture_context *tctx,
2108                                      struct policy_handle *handle,
2109                                      struct lsa_DomainList *domains)
2110 {
2111         int i,j;
2112         bool ret = true;
2113
2114         torture_comment(tctx, "\nTesting OpenTrustedDomain, OpenTrustedDomainByName and QueryInfoTrustedDomain\n");
2115         for (i=0; i< domains->count; i++) {
2116                 struct lsa_OpenTrustedDomain trust;
2117                 struct lsa_OpenTrustedDomainByName trust_by_name;
2118                 struct policy_handle trustdom_handle;
2119                 struct policy_handle handle2;
2120                 struct lsa_Close c;
2121                 struct lsa_CloseTrustedDomainEx c_trust;
2122                 int levels [] = {1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13};
2123                 int ok[]      = {1, 0, 1, 0, 0, 1, 0, 1, 0,  0,  0,  1, 1};
2124
2125                 if (domains->domains[i].sid) {
2126                         trust.in.handle = handle;
2127                         trust.in.sid = domains->domains[i].sid;
2128                         trust.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
2129                         trust.out.trustdom_handle = &trustdom_handle;
2130
2131                         torture_assert_ntstatus_ok(tctx, dcerpc_lsa_OpenTrustedDomain_r(b, tctx, &trust),
2132                                 "OpenTrustedDomain failed");
2133
2134                         if (!NT_STATUS_IS_OK(trust.out.result)) {
2135                                 torture_comment(tctx, "OpenTrustedDomain failed - %s\n", nt_errstr(trust.out.result));
2136                                 return false;
2137                         }
2138
2139                         c.in.handle = &trustdom_handle;
2140                         c.out.handle = &handle2;
2141
2142                         c_trust.in.handle = &trustdom_handle;
2143                         c_trust.out.handle = &handle2;
2144
2145                         for (j=0; j < ARRAY_SIZE(levels); j++) {
2146                                 struct lsa_QueryTrustedDomainInfo q;
2147                                 union lsa_TrustedDomainInfo *info = NULL;
2148                                 q.in.trustdom_handle = &trustdom_handle;
2149                                 q.in.level = levels[j];
2150                                 q.out.info = &info;
2151                                 torture_assert_ntstatus_ok(tctx, dcerpc_lsa_QueryTrustedDomainInfo_r(b, tctx, &q),
2152                                         "QueryTrustedDomainInfo failed");
2153                                 if (!NT_STATUS_IS_OK(q.out.result) && ok[j]) {
2154                                         torture_comment(tctx, "QueryTrustedDomainInfo level %d failed - %s\n",
2155                                                levels[j], nt_errstr(q.out.result));
2156                                         ret = false;
2157                                 } else if (NT_STATUS_IS_OK(q.out.result) && !ok[j]) {
2158                                         torture_comment(tctx, "QueryTrustedDomainInfo level %d unexpectedly succeeded - %s\n",
2159                                                levels[j], nt_errstr(q.out.result));
2160                                         ret = false;
2161                                 }
2162                         }
2163
2164                         torture_assert_ntstatus_ok(tctx, dcerpc_lsa_CloseTrustedDomainEx_r(b, tctx, &c_trust),
2165                                 "CloseTrustedDomainEx failed");
2166                         if (!NT_STATUS_EQUAL(c_trust.out.result, NT_STATUS_NOT_IMPLEMENTED)) {
2167                                 torture_comment(tctx, "Expected CloseTrustedDomainEx to return NT_STATUS_NOT_IMPLEMENTED, instead - %s\n", nt_errstr(c_trust.out.result));
2168                                 return false;
2169                         }
2170
2171                         c.in.handle = &trustdom_handle;
2172                         c.out.handle = &handle2;
2173
2174                         torture_assert_ntstatus_ok(tctx, dcerpc_lsa_Close_r(b, tctx, &c),
2175                                 "Close failed");
2176                         if (!NT_STATUS_IS_OK(c.out.result)) {
2177                                 torture_comment(tctx, "Close of trusted domain failed - %s\n", nt_errstr(c.out.result));
2178                                 return false;
2179                         }
2180
2181                         for (j=0; j < ARRAY_SIZE(levels); j++) {
2182                                 struct lsa_QueryTrustedDomainInfoBySid q;
2183                                 union lsa_TrustedDomainInfo *info = NULL;
2184
2185                                 if (!domains->domains[i].sid) {
2186                                         continue;
2187                                 }
2188
2189                                 q.in.handle  = handle;
2190                                 q.in.dom_sid = domains->domains[i].sid;
2191                                 q.in.level   = levels[j];
2192                                 q.out.info   = &info;
2193
2194                                 torture_assert_ntstatus_ok(tctx, dcerpc_lsa_QueryTrustedDomainInfoBySid_r(b, tctx, &q),
2195                                         "lsa_QueryTrustedDomainInfoBySid failed");
2196                                 if (!NT_STATUS_IS_OK(q.out.result) && ok[j]) {
2197                                         torture_comment(tctx, "QueryTrustedDomainInfoBySid level %d failed - %s\n",
2198                                                levels[j], nt_errstr(q.out.result));
2199                                         ret = false;
2200                                 } else if (NT_STATUS_IS_OK(q.out.result) && !ok[j]) {
2201                                         torture_comment(tctx, "QueryTrustedDomainInfoBySid level %d unexpectedly succeeded - %s\n",
2202                                                levels[j], nt_errstr(q.out.result));
2203                                         ret = false;
2204                                 }
2205                         }
2206                 }
2207
2208                 trust_by_name.in.handle = handle;
2209                 trust_by_name.in.name.string = domains->domains[i].name.string;
2210                 trust_by_name.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
2211                 trust_by_name.out.trustdom_handle = &trustdom_handle;
2212
2213                 torture_assert_ntstatus_ok(tctx, dcerpc_lsa_OpenTrustedDomainByName_r(b, tctx, &trust_by_name),
2214                         "OpenTrustedDomainByName failed");
2215
2216                 if (!NT_STATUS_IS_OK(trust_by_name.out.result)) {
2217                         torture_comment(tctx, "OpenTrustedDomainByName failed - %s\n", nt_errstr(trust_by_name.out.result));
2218                         return false;
2219                 }
2220
2221                 for (j=0; j < ARRAY_SIZE(levels); j++) {
2222                         struct lsa_QueryTrustedDomainInfo q;
2223                         union lsa_TrustedDomainInfo *info = NULL;
2224                         q.in.trustdom_handle = &trustdom_handle;
2225                         q.in.level = levels[j];
2226                         q.out.info = &info;
2227                         torture_assert_ntstatus_ok(tctx, dcerpc_lsa_QueryTrustedDomainInfo_r(b, tctx, &q),
2228                                 "QueryTrustedDomainInfo failed");
2229                         if (!NT_STATUS_IS_OK(q.out.result) && ok[j]) {
2230                                 torture_comment(tctx, "QueryTrustedDomainInfo level %d failed - %s\n",
2231                                        levels[j], nt_errstr(q.out.result));
2232                                 ret = false;
2233                         } else if (NT_STATUS_IS_OK(q.out.result) && !ok[j]) {
2234                                 torture_comment(tctx, "QueryTrustedDomainInfo level %d unexpectedly succeeded - %s\n",
2235                                        levels[j], nt_errstr(q.out.result));
2236                                 ret = false;
2237                         }
2238                 }
2239
2240                 c.in.handle = &trustdom_handle;
2241                 c.out.handle = &handle2;
2242
2243                 torture_assert_ntstatus_ok(tctx, dcerpc_lsa_Close_r(b, tctx, &c),
2244                         "Close failed");
2245                 if (!NT_STATUS_IS_OK(c.out.result)) {
2246                         torture_comment(tctx, "Close of trusted domain failed - %s\n", nt_errstr(c.out.result));
2247                         return false;
2248                 }
2249
2250                 for (j=0; j < ARRAY_SIZE(levels); j++) {
2251                         struct lsa_QueryTrustedDomainInfoByName q;
2252                         union lsa_TrustedDomainInfo *info = NULL;
2253                         struct lsa_String name;
2254
2255                         name.string = domains->domains[i].name.string;
2256
2257                         q.in.handle         = handle;
2258                         q.in.trusted_domain = &name;
2259                         q.in.level          = levels[j];
2260                         q.out.info          = &info;
2261                         torture_assert_ntstatus_ok(tctx, dcerpc_lsa_QueryTrustedDomainInfoByName_r(b, tctx, &q),
2262                                 "QueryTrustedDomainInfoByName failed");
2263                         if (!NT_STATUS_IS_OK(q.out.result) && ok[j]) {
2264                                 torture_comment(tctx, "QueryTrustedDomainInfoByName level %d failed - %s\n",
2265                                        levels[j], nt_errstr(q.out.result));
2266                                 ret = false;
2267                         } else if (NT_STATUS_IS_OK(q.out.result) && !ok[j]) {
2268                                 torture_comment(tctx, "QueryTrustedDomainInfoByName level %d unexpectedly succeeded - %s\n",
2269                                        levels[j], nt_errstr(q.out.result));
2270                                 ret = false;
2271                         }
2272                 }
2273         }
2274         return ret;
2275 }
2276
2277 static bool test_EnumTrustDom(struct dcerpc_binding_handle *b,
2278                               struct torture_context *tctx,
2279                               struct policy_handle *handle)
2280 {
2281         struct lsa_EnumTrustDom r;
2282         uint32_t in_resume_handle = 0;
2283         uint32_t out_resume_handle;
2284         struct lsa_DomainList domains;
2285         bool ret = true;
2286
2287         torture_comment(tctx, "\nTesting EnumTrustDom\n");
2288
2289         r.in.handle = handle;
2290         r.in.resume_handle = &in_resume_handle;
2291         r.in.max_size = 0;
2292         r.out.domains = &domains;
2293         r.out.resume_handle = &out_resume_handle;
2294
2295         torture_assert_ntstatus_ok(tctx, dcerpc_lsa_EnumTrustDom_r(b, tctx, &r),
2296                 "lsa_EnumTrustDom failed");
2297
2298         /* according to MS-LSAD 3.1.4.7.8 output resume handle MUST
2299          * always be larger than the previous input resume handle, in
2300          * particular when hitting the last query it is vital to set the
2301          * resume handle correctly to avoid infinite client loops, as
2302          * seen e.g.  with Windows XP SP3 when resume handle is 0 and
2303          * status is NT_STATUS_OK - gd */
2304
2305         if (NT_STATUS_IS_OK(r.out.result) ||
2306             NT_STATUS_EQUAL(r.out.result, NT_STATUS_NO_MORE_ENTRIES) ||
2307             NT_STATUS_EQUAL(r.out.result, STATUS_MORE_ENTRIES))
2308         {
2309                 if (out_resume_handle <= in_resume_handle) {
2310                         torture_comment(tctx, "EnumTrustDom failed - should have returned output resume_handle (0x%08x) larger than input resume handle (0x%08x)\n",
2311                                 out_resume_handle, in_resume_handle);
2312                         return false;
2313                 }
2314         }
2315
2316         if (NT_STATUS_IS_OK(r.out.result)) {
2317                 if (domains.count == 0) {
2318                         torture_comment(tctx, "EnumTrustDom failed - should have returned 'NT_STATUS_NO_MORE_ENTRIES' for 0 trusted domains\n");
2319                         return false;
2320                 }
2321         } else if (!(NT_STATUS_EQUAL(r.out.result, STATUS_MORE_ENTRIES) || NT_STATUS_EQUAL(r.out.result, NT_STATUS_NO_MORE_ENTRIES))) {
2322                 torture_comment(tctx, "EnumTrustDom of zero size failed - %s\n", nt_errstr(r.out.result));
2323                 return false;
2324         }
2325
2326         /* Start from the bottom again */
2327         in_resume_handle = 0;
2328
2329         do {
2330                 r.in.handle = handle;
2331                 r.in.resume_handle = &in_resume_handle;
2332                 r.in.max_size = LSA_ENUM_TRUST_DOMAIN_MULTIPLIER * 3;
2333                 r.out.domains = &domains;
2334                 r.out.resume_handle = &out_resume_handle;
2335
2336                 torture_assert_ntstatus_ok(tctx, dcerpc_lsa_EnumTrustDom_r(b, tctx, &r),
2337                         "EnumTrustDom failed");
2338
2339                 /* according to MS-LSAD 3.1.4.7.8 output resume handle MUST
2340                  * always be larger than the previous input resume handle, in
2341                  * particular when hitting the last query it is vital to set the
2342                  * resume handle correctly to avoid infinite client loops, as
2343                  * seen e.g.  with Windows XP SP3 when resume handle is 0 and
2344                  * status is NT_STATUS_OK - gd */
2345
2346                 if (NT_STATUS_IS_OK(r.out.result) ||
2347                     NT_STATUS_EQUAL(r.out.result, NT_STATUS_NO_MORE_ENTRIES) ||
2348                     NT_STATUS_EQUAL(r.out.result, STATUS_MORE_ENTRIES))
2349                 {
2350                         if (out_resume_handle <= in_resume_handle) {
2351                                 torture_comment(tctx, "EnumTrustDom failed - should have returned output resume_handle (0x%08x) larger than input resume handle (0x%08x)\n",
2352                                         out_resume_handle, in_resume_handle);
2353                                 return false;
2354                         }
2355                 }
2356
2357                 /* NO_MORE_ENTRIES is allowed */
2358                 if (NT_STATUS_EQUAL(r.out.result, NT_STATUS_NO_MORE_ENTRIES)) {
2359                         if (domains.count == 0) {
2360                                 return true;
2361                         }
2362                         torture_comment(tctx, "EnumTrustDom failed - should have returned 0 trusted domains with 'NT_STATUS_NO_MORE_ENTRIES'\n");
2363                         return false;
2364                 } else if (NT_STATUS_EQUAL(r.out.result, STATUS_MORE_ENTRIES)) {
2365                         /* Windows 2003 gets this off by one on the first run */
2366                         if (r.out.domains->count < 3 || r.out.domains->count > 4) {
2367                                 torture_comment(tctx, "EnumTrustDom didn't fill the buffer we "
2368                                        "asked it to (got %d, expected %d / %d == %d entries)\n",
2369                                        r.out.domains->count, LSA_ENUM_TRUST_DOMAIN_MULTIPLIER * 3,
2370                                        LSA_ENUM_TRUST_DOMAIN_MULTIPLIER, r.in.max_size);
2371                                 ret = false;
2372                         }
2373                 } else if (!NT_STATUS_IS_OK(r.out.result)) {
2374                         torture_comment(tctx, "EnumTrustDom failed - %s\n", nt_errstr(r.out.result));
2375                         return false;
2376                 }
2377
2378                 if (domains.count == 0) {
2379                         torture_comment(tctx, "EnumTrustDom failed - should have returned 'NT_STATUS_NO_MORE_ENTRIES' for 0 trusted domains\n");
2380                         return false;
2381                 }
2382
2383                 ret &= test_query_each_TrustDom(b, tctx, handle, &domains);
2384
2385                 in_resume_handle = out_resume_handle;
2386
2387         } while ((NT_STATUS_EQUAL(r.out.result, STATUS_MORE_ENTRIES)));
2388
2389         return ret;
2390 }
2391
2392 static bool test_EnumTrustDomEx(struct dcerpc_binding_handle *b,
2393                                 struct torture_context *tctx,
2394                                 struct policy_handle *handle)
2395 {
2396         struct lsa_EnumTrustedDomainsEx r_ex;
2397         uint32_t resume_handle = 0;
2398         struct lsa_DomainListEx domains_ex;
2399         bool ret = true;
2400
2401         torture_comment(tctx, "\nTesting EnumTrustedDomainsEx\n");
2402
2403         r_ex.in.handle = handle;
2404         r_ex.in.resume_handle = &resume_handle;
2405         r_ex.in.max_size = LSA_ENUM_TRUST_DOMAIN_EX_MULTIPLIER * 3;
2406         r_ex.out.domains = &domains_ex;
2407         r_ex.out.resume_handle = &resume_handle;
2408
2409         torture_assert_ntstatus_ok(tctx, dcerpc_lsa_EnumTrustedDomainsEx_r(b, tctx, &r_ex),
2410                 "EnumTrustedDomainsEx failed");
2411
2412         if (!(NT_STATUS_EQUAL(r_ex.out.result, STATUS_MORE_ENTRIES) || NT_STATUS_EQUAL(r_ex.out.result, NT_STATUS_NO_MORE_ENTRIES))) {
2413                 torture_comment(tctx, "EnumTrustedDomainEx of zero size failed - %s\n", nt_errstr(r_ex.out.result));
2414                 return false;
2415         }
2416
2417         resume_handle = 0;
2418         do {
2419                 r_ex.in.handle = handle;
2420                 r_ex.in.resume_handle = &resume_handle;
2421                 r_ex.in.max_size = LSA_ENUM_TRUST_DOMAIN_EX_MULTIPLIER * 3;
2422                 r_ex.out.domains = &domains_ex;
2423                 r_ex.out.resume_handle = &resume_handle;
2424
2425                 torture_assert_ntstatus_ok(tctx, dcerpc_lsa_EnumTrustedDomainsEx_r(b, tctx, &r_ex),
2426                         "EnumTrustedDomainsEx failed");
2427
2428                 /* NO_MORE_ENTRIES is allowed */
2429                 if (NT_STATUS_EQUAL(r_ex.out.result, NT_STATUS_NO_MORE_ENTRIES)) {
2430                         if (domains_ex.count == 0) {
2431                                 return true;
2432                         }
2433                         torture_comment(tctx, "EnumTrustDomainsEx failed - should have returned 0 trusted domains with 'NT_STATUS_NO_MORE_ENTRIES'\n");
2434                         return false;
2435                 } else if (NT_STATUS_EQUAL(r_ex.out.result, STATUS_MORE_ENTRIES)) {
2436                         /* Windows 2003 gets this off by one on the first run */
2437                         if (r_ex.out.domains->count < 3 || r_ex.out.domains->count > 4) {
2438                                 torture_comment(tctx, "EnumTrustDom didn't fill the buffer we "
2439                                        "asked it to (got %d, expected %d / %d == %d entries)\n",
2440                                        r_ex.out.domains->count,
2441                                        r_ex.in.max_size,
2442                                        LSA_ENUM_TRUST_DOMAIN_EX_MULTIPLIER,
2443                                        r_ex.in.max_size / LSA_ENUM_TRUST_DOMAIN_EX_MULTIPLIER);
2444                         }
2445                 } else if (!NT_STATUS_IS_OK(r_ex.out.result)) {
2446                         torture_comment(tctx, "EnumTrustedDomainEx failed - %s\n", nt_errstr(r_ex.out.result));
2447                         return false;
2448                 }
2449
2450                 if (domains_ex.count == 0) {
2451                         torture_comment(tctx, "EnumTrustDomainEx failed - should have returned 'NT_STATUS_NO_MORE_ENTRIES' for 0 trusted domains\n");
2452                         return false;
2453                 }
2454
2455                 ret &= test_query_each_TrustDomEx(b, tctx, handle, &domains_ex);
2456
2457         } while ((NT_STATUS_EQUAL(r_ex.out.result, STATUS_MORE_ENTRIES)));
2458
2459         return ret;
2460 }
2461
2462
2463 static bool test_CreateTrustedDomain(struct dcerpc_binding_handle *b,
2464                                      struct torture_context *tctx,
2465                                      struct policy_handle *handle,
2466                                      uint32_t num_trusts)
2467 {
2468         bool ret = true;
2469         struct lsa_CreateTrustedDomain r;
2470         struct lsa_DomainInfo trustinfo;
2471         struct dom_sid **domsid;
2472         struct policy_handle *trustdom_handle;
2473         struct lsa_QueryTrustedDomainInfo q;
2474         union lsa_TrustedDomainInfo *info = NULL;
2475         int i;
2476
2477         torture_comment(tctx, "\nTesting CreateTrustedDomain for %d domains\n", num_trusts);
2478
2479         if (!test_EnumTrustDom(b, tctx, handle)) {
2480                 ret = false;
2481         }
2482
2483         if (!test_EnumTrustDomEx(b, tctx, handle)) {
2484                 ret = false;
2485         }
2486
2487         domsid = talloc_array(tctx, struct dom_sid *, num_trusts);
2488         trustdom_handle = talloc_array(tctx, struct policy_handle, num_trusts);
2489
2490         for (i=0; i< num_trusts; i++) {
2491                 char *trust_name = talloc_asprintf(tctx, "torturedom%02d", i);
2492                 char *trust_sid = talloc_asprintf(tctx, "S-1-5-21-97398-379795-100%02d", i);
2493
2494                 domsid[i] = dom_sid_parse_talloc(tctx, trust_sid);
2495
2496                 trustinfo.sid = domsid[i];
2497                 init_lsa_String((struct lsa_String *)&trustinfo.name, trust_name);
2498
2499                 r.in.policy_handle = handle;
2500                 r.in.info = &trustinfo;
2501                 r.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
2502                 r.out.trustdom_handle = &trustdom_handle[i];
2503
2504                 torture_assert_ntstatus_ok(tctx, dcerpc_lsa_CreateTrustedDomain_r(b, tctx, &r),
2505                         "CreateTrustedDomain failed");
2506                 if (NT_STATUS_EQUAL(r.out.result, NT_STATUS_OBJECT_NAME_COLLISION)) {
2507                         test_DeleteTrustedDomain(b, tctx, handle, trustinfo.name);
2508                         torture_assert_ntstatus_ok(tctx, dcerpc_lsa_CreateTrustedDomain_r(b, tctx, &r),
2509                                 "CreateTrustedDomain failed");
2510                 }
2511                 if (!NT_STATUS_IS_OK(r.out.result)) {
2512                         torture_comment(tctx, "CreateTrustedDomain failed - %s\n", nt_errstr(r.out.result));
2513                         ret = false;
2514                 } else {
2515
2516                         q.in.trustdom_handle = &trustdom_handle[i];
2517                         q.in.level = LSA_TRUSTED_DOMAIN_INFO_INFO_EX;
2518                         q.out.info = &info;
2519                         torture_assert_ntstatus_ok(tctx, dcerpc_lsa_QueryTrustedDomainInfo_r(b, tctx, &q),
2520                                 "QueryTrustedDomainInfo failed");
2521                         if (!NT_STATUS_IS_OK(q.out.result)) {
2522                                 torture_comment(tctx, "QueryTrustedDomainInfo level %d failed - %s\n", q.in.level, nt_errstr(q.out.result));
2523                                 ret = false;
2524                         } else if (!q.out.info) {
2525                                 ret = false;
2526                         } else {
2527                                 if (strcmp(info->info_ex.netbios_name.string, trustinfo.name.string) != 0) {
2528                                         torture_comment(tctx, "QueryTrustedDomainInfo returned inconsistent short name: %s != %s\n",
2529                                                info->info_ex.netbios_name.string, trustinfo.name.string);
2530                                         ret = false;
2531                                 }
2532                                 if (info->info_ex.trust_type != LSA_TRUST_TYPE_DOWNLEVEL) {
2533                                         torture_comment(tctx, "QueryTrustedDomainInfo of %s returned incorrect trust type %d != %d\n",
2534                                                trust_name, info->info_ex.trust_type, LSA_TRUST_TYPE_DOWNLEVEL);
2535                                         ret = false;
2536                                 }
2537                                 if (info->info_ex.trust_attributes != 0) {
2538                                         torture_comment(tctx, "QueryTrustedDomainInfo of %s returned incorrect trust attributes %d != %d\n",
2539                                                trust_name, info->info_ex.trust_attributes, 0);
2540                                         ret = false;
2541                                 }
2542                                 if (info->info_ex.trust_direction != LSA_TRUST_DIRECTION_OUTBOUND) {
2543                                         torture_comment(tctx, "QueryTrustedDomainInfo of %s returned incorrect trust direction %d != %d\n",
2544                                                trust_name, info->info_ex.trust_direction, LSA_TRUST_DIRECTION_OUTBOUND);
2545                                         ret = false;
2546                                 }
2547                         }
2548                 }
2549         }
2550
2551         /* now that we have some domains to look over, we can test the enum calls */
2552         if (!test_EnumTrustDom(b, tctx, handle)) {
2553                 ret = false;
2554         }
2555
2556         if (!test_EnumTrustDomEx(b, tctx, handle)) {
2557                 ret = false;
2558         }
2559
2560         for (i=0; i<num_trusts; i++) {
2561                 if (!test_DeleteTrustedDomainBySid(b, tctx, handle, domsid[i])) {
2562                         ret = false;
2563                 }
2564         }
2565
2566         return ret;
2567 }
2568
2569 static bool gen_authinfo_internal(TALLOC_CTX *mem_ctx, const char *password,
2570                                   DATA_BLOB session_key,
2571                                   struct lsa_TrustDomainInfoAuthInfoInternal **_authinfo_internal)
2572 {
2573         struct lsa_TrustDomainInfoAuthInfoInternal *authinfo_internal;
2574         struct trustDomainPasswords auth_struct;
2575         struct AuthenticationInformation *auth_info_array;
2576         size_t converted_size;
2577         DATA_BLOB auth_blob;
2578         enum ndr_err_code ndr_err;
2579
2580         authinfo_internal = talloc_zero(mem_ctx, struct lsa_TrustDomainInfoAuthInfoInternal);
2581         if (authinfo_internal == NULL) {
2582                 return false;
2583         }
2584
2585         auth_info_array = talloc_array(mem_ctx,
2586                                        struct AuthenticationInformation, 1);
2587         if (auth_info_array == NULL) {
2588                 return false;
2589         }
2590
2591         generate_random_buffer(auth_struct.confounder, sizeof(auth_struct.confounder));
2592
2593         auth_info_array[0].AuthType = TRUST_AUTH_TYPE_CLEAR;
2594
2595         if (!convert_string_talloc(mem_ctx, CH_UNIX, CH_UTF16, password,
2596                                   strlen(password),
2597                                   &auth_info_array[0].AuthInfo.clear.password,
2598                                   &converted_size)) {
2599                 return false;
2600         }
2601
2602         auth_info_array[0].AuthInfo.clear.size = converted_size;
2603
2604         auth_struct.outgoing.count = 1;
2605         auth_struct.outgoing.current.count = 1;
2606         auth_struct.outgoing.current.array = auth_info_array;
2607         auth_struct.outgoing.previous.count = 0;
2608         auth_struct.outgoing.previous.array = NULL;
2609
2610         auth_struct.incoming.count = 1;
2611         auth_struct.incoming.current.count = 1;
2612         auth_struct.incoming.current.array = auth_info_array;
2613         auth_struct.incoming.previous.count = 0;
2614         auth_struct.incoming.previous.array = NULL;
2615
2616
2617         ndr_err = ndr_push_struct_blob(&auth_blob, mem_ctx, &auth_struct,
2618                                        (ndr_push_flags_fn_t)ndr_push_trustDomainPasswords);
2619         if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
2620                 return false;
2621         }
2622
2623         arcfour_crypt_blob(auth_blob.data, auth_blob.length, &session_key);
2624
2625         authinfo_internal->auth_blob.size = auth_blob.length;
2626         authinfo_internal->auth_blob.data = auth_blob.data;
2627
2628         *_authinfo_internal = authinfo_internal;
2629
2630         return true;
2631 }
2632
2633 static bool gen_authinfo(TALLOC_CTX *mem_ctx, const char *password,
2634                          struct lsa_TrustDomainInfoAuthInfo **_authinfo)
2635 {
2636         struct lsa_TrustDomainInfoAuthInfo *authinfo;
2637         struct lsa_TrustDomainInfoBuffer *info_buffer;
2638         size_t converted_size;
2639
2640         authinfo = talloc_zero(mem_ctx, struct lsa_TrustDomainInfoAuthInfo);
2641         if (authinfo == NULL) {
2642                 return false;
2643         }
2644
2645         info_buffer = talloc_zero(mem_ctx, struct lsa_TrustDomainInfoBuffer);
2646         if (info_buffer == NULL) {
2647                 return false;
2648         }
2649
2650         info_buffer->AuthType = TRUST_AUTH_TYPE_CLEAR;
2651
2652         if (!convert_string_talloc(mem_ctx, CH_UNIX, CH_UTF16, password,
2653                                   strlen(password),
2654                                   &info_buffer->data.data,
2655                                   &converted_size)) {
2656                 return false;
2657         }
2658
2659         info_buffer->data.size = converted_size;
2660
2661         authinfo->incoming_count = 1;
2662         authinfo->incoming_current_auth_info = info_buffer;
2663         authinfo->incoming_previous_auth_info = NULL;
2664         authinfo->outgoing_count = 1;
2665         authinfo->outgoing_current_auth_info = info_buffer;
2666         authinfo->outgoing_previous_auth_info = NULL;
2667
2668         *_authinfo = authinfo;
2669
2670         return true;
2671 }
2672
2673 static bool check_pw_with_ServerAuthenticate3(struct dcerpc_pipe *p,
2674                                              struct torture_context *tctx,
2675                                              uint32_t negotiate_flags,
2676                                              struct cli_credentials *machine_credentials,
2677                                              struct netlogon_creds_CredentialState **creds_out)
2678 {
2679         struct netr_ServerReqChallenge r;
2680         struct netr_ServerAuthenticate3 a;
2681         struct netr_Credential credentials1, credentials2, credentials3;
2682         struct netlogon_creds_CredentialState *creds;
2683         struct samr_Password mach_password;
2684         uint32_t rid;
2685         const char *machine_name;
2686         const char *plain_pass;
2687         struct dcerpc_binding_handle *b = p->binding_handle;
2688
2689         machine_name = cli_credentials_get_workstation(machine_credentials);
2690         plain_pass = cli_credentials_get_password(machine_credentials);
2691
2692         r.in.server_name = NULL;
2693         r.in.computer_name = machine_name;
2694         r.in.credentials = &credentials1;
2695         r.out.return_credentials = &credentials2;
2696
2697         generate_random_buffer(credentials1.data, sizeof(credentials1.data));
2698
2699         torture_assert_ntstatus_ok(tctx, dcerpc_netr_ServerReqChallenge_r(b, tctx, &r),
2700                 "ServerReqChallenge failed");
2701         torture_assert_ntstatus_ok(tctx, r.out.result, "ServerReqChallenge failed");
2702
2703         E_md4hash(plain_pass, mach_password.hash);
2704
2705         a.in.server_name = NULL;
2706         a.in.account_name = talloc_asprintf(tctx, "%s$", machine_name);
2707         a.in.secure_channel_type = cli_credentials_get_secure_channel_type(machine_credentials);
2708         a.in.computer_name = machine_name;
2709         a.in.negotiate_flags = &negotiate_flags;
2710         a.in.credentials = &credentials3;
2711         a.out.return_credentials = &credentials3;
2712         a.out.negotiate_flags = &negotiate_flags;
2713         a.out.rid = &rid;
2714
2715         creds = netlogon_creds_client_init(tctx, a.in.account_name,
2716                                            a.in.computer_name,
2717                                            &credentials1, &credentials2,
2718                                            &mach_password, &credentials3,
2719                                            negotiate_flags);
2720
2721         torture_assert(tctx, creds != NULL, "memory allocation");
2722
2723         torture_assert_ntstatus_ok(tctx, dcerpc_netr_ServerAuthenticate3_r(b, tctx, &a),
2724                 "ServerAuthenticate3 failed");
2725         if (!NT_STATUS_IS_OK(a.out.result)) {
2726                 if (!NT_STATUS_EQUAL(a.out.result, NT_STATUS_ACCESS_DENIED)) {
2727                         torture_assert_ntstatus_ok(tctx, a.out.result,
2728                                                    "ServerAuthenticate3 failed");
2729                 }
2730                 return false;
2731         }
2732         torture_assert(tctx, netlogon_creds_client_check(creds, &credentials3), "Credential chaining failed");
2733
2734         /* Prove that requesting a challenge again won't break it */
2735         torture_assert_ntstatus_ok(tctx, dcerpc_netr_ServerReqChallenge_r(b, tctx, &r),
2736                 "ServerReqChallenge failed");
2737         torture_assert_ntstatus_ok(tctx, r.out.result, "ServerReqChallenge failed");
2738
2739         *creds_out = creds;
2740         return true;
2741 }
2742
2743 static bool check_dom_trust_pw(struct dcerpc_pipe *p,
2744                                struct torture_context *tctx,
2745                                const char *trusted_dom_name,
2746                                const char *password)
2747 {
2748         struct cli_credentials *credentials;
2749         char *dummy;
2750         struct netlogon_creds_CredentialState *creds;
2751         struct dcerpc_pipe *pipe;
2752         NTSTATUS status;
2753         bool ok;
2754
2755         credentials = cli_credentials_init(tctx);
2756         if (credentials == NULL) {
2757                 return false;
2758         }
2759
2760         dummy = talloc_asprintf(tctx, "%s$", trusted_dom_name);
2761         if (dummy == NULL) {
2762                 return false;
2763         }
2764
2765         cli_credentials_set_username(credentials, dummy, CRED_SPECIFIED);
2766         cli_credentials_set_password(credentials, password, CRED_SPECIFIED);
2767         cli_credentials_set_workstation(credentials,
2768                                         trusted_dom_name, CRED_SPECIFIED);
2769         cli_credentials_set_secure_channel_type(credentials, SEC_CHAN_DOMAIN);
2770
2771         status = dcerpc_pipe_connect_b(tctx, &pipe, p->binding,
2772                                        &ndr_table_netlogon,
2773                                        cli_credentials_init_anon(tctx),
2774                                        tctx->ev, tctx->lp_ctx);
2775         if (!NT_STATUS_IS_OK(status)) {
2776                 torture_comment(tctx, "dcerpc_pipe_connect_b failed.\n");
2777                 return false;
2778         }
2779
2780         ok = check_pw_with_ServerAuthenticate3(pipe, tctx,
2781                                                NETLOGON_NEG_AUTH2_ADS_FLAGS,
2782                                                credentials, &creds);
2783         talloc_free(pipe);
2784
2785         return ok;
2786 }
2787
2788 static bool test_CreateTrustedDomainEx_common(struct dcerpc_pipe *p,
2789                                               struct torture_context *tctx,
2790                                               struct policy_handle *handle,
2791                                               uint32_t num_trusts,
2792                                               bool ex2_call)
2793 {
2794         NTSTATUS status;
2795         bool ret = true;
2796         struct lsa_CreateTrustedDomainEx r;
2797         struct lsa_CreateTrustedDomainEx2 r2;
2798         struct lsa_TrustDomainInfoInfoEx trustinfo;
2799         struct lsa_TrustDomainInfoAuthInfoInternal *authinfo_internal;
2800         struct lsa_TrustDomainInfoAuthInfo *authinfo;
2801         struct dom_sid **domsid;
2802         struct policy_handle *trustdom_handle;
2803         struct lsa_QueryTrustedDomainInfo q;
2804         union lsa_TrustedDomainInfo *info = NULL;
2805         DATA_BLOB session_key;
2806         int i;
2807         struct dcerpc_binding_handle *b = p->binding_handle;
2808
2809         if (ex2_call) {
2810                 torture_comment(tctx, "\nTesting CreateTrustedDomainEx2 for %d domains\n", num_trusts);
2811         } else {
2812                 torture_comment(tctx, "\nTesting CreateTrustedDomainEx for %d domains\n", num_trusts);
2813         }
2814
2815         domsid = talloc_array(tctx, struct dom_sid *, num_trusts);
2816         trustdom_handle = talloc_array(tctx, struct policy_handle, num_trusts);
2817
2818         status = dcerpc_fetch_session_key(p, &session_key);
2819         if (!NT_STATUS_IS_OK(status)) {
2820                 torture_comment(tctx, "dcerpc_fetch_session_key failed - %s\n", nt_errstr(status));
2821                 return false;
2822         }
2823
2824         for (i=0; i< num_trusts; i++) {
2825                 char *trust_name = talloc_asprintf(tctx, "torturedom%02d", i);
2826                 char *trust_name_dns = talloc_asprintf(tctx, "torturedom%02d.samba.example.com", i);
2827                 char *trust_sid = talloc_asprintf(tctx, "S-1-5-21-97398-379795-100%02d", i);
2828
2829                 domsid[i] = dom_sid_parse_talloc(tctx, trust_sid);
2830
2831                 trustinfo.sid = domsid[i];
2832                 trustinfo.netbios_name.string = trust_name;
2833                 trustinfo.domain_name.string = trust_name_dns;
2834
2835                 /* Create inbound, some outbound, and some
2836                  * bi-directional trusts in a repeating pattern based
2837                  * on i */
2838
2839                 /* 1 == inbound, 2 == outbound, 3 == both */
2840                 trustinfo.trust_direction = (i % 3) + 1;
2841
2842                 /* Try different trust types too */
2843
2844                 /* 1 == downlevel (NT4), 2 == uplevel (ADS), 3 == MIT (kerberos but not AD) */
2845                 trustinfo.trust_type = (((i / 3) + 1) % 3) + 1;
2846
2847                 trustinfo.trust_attributes = LSA_TRUST_ATTRIBUTE_USES_RC4_ENCRYPTION;
2848
2849                 if (!gen_authinfo_internal(tctx, TRUSTPW, session_key, &authinfo_internal)) {
2850                         torture_comment(tctx, "gen_authinfo_internal failed");
2851                         ret = false;
2852                 }
2853
2854                 if (!gen_authinfo(tctx, TRUSTPW, &authinfo)) {
2855                         torture_comment(tctx, "gen_authinfonfo failed");
2856                         ret = false;
2857                 }
2858
2859                 if (ex2_call) {
2860
2861                         r2.in.policy_handle = handle;
2862                         r2.in.info = &trustinfo;
2863                         r2.in.auth_info_internal = authinfo_internal;
2864                         r2.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
2865                         r2.out.trustdom_handle = &trustdom_handle[i];
2866
2867                         torture_assert_ntstatus_ok(tctx,
2868                                 dcerpc_lsa_CreateTrustedDomainEx2_r(b, tctx, &r2),
2869                                 "CreateTrustedDomainEx2 failed");
2870
2871                         status = r2.out.result;
2872                 } else {
2873
2874                         r.in.policy_handle = handle;
2875                         r.in.info = &trustinfo;
2876                         r.in.auth_info = authinfo;
2877                         r.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
2878                         r.out.trustdom_handle = &trustdom_handle[i];
2879
2880                         torture_assert_ntstatus_ok(tctx,
2881                                 dcerpc_lsa_CreateTrustedDomainEx_r(b, tctx, &r),
2882                                 "CreateTrustedDomainEx failed");
2883
2884                         status = r.out.result;
2885                 }
2886
2887                 if (NT_STATUS_EQUAL(status, NT_STATUS_OBJECT_NAME_COLLISION)) {
2888                         test_DeleteTrustedDomain(b, tctx, handle, trustinfo.netbios_name);
2889                         if (ex2_call) {
2890                                 torture_assert_ntstatus_ok(tctx,
2891                                         dcerpc_lsa_CreateTrustedDomainEx2_r(b, tctx, &r2),
2892                                         "CreateTrustedDomainEx2 failed");
2893                                 status = r2.out.result;
2894                         } else {
2895                                 torture_assert_ntstatus_ok(tctx,
2896                                         dcerpc_lsa_CreateTrustedDomainEx_r(b, tctx, &r),
2897                                         "CreateTrustedDomainEx2 failed");
2898                                 status = r.out.result;
2899                         }
2900                 }
2901                 if (!NT_STATUS_IS_OK(status)) {
2902                         torture_comment(tctx, "CreateTrustedDomainEx failed2 - %s\n", nt_errstr(status));
2903                         ret = false;
2904                 } else {
2905                         /* For outbound and MIT trusts there is no trust account */
2906                         if (trustinfo.trust_direction != 2 &&
2907                             trustinfo.trust_type != 3) {
2908
2909                                 if (torture_setting_bool(tctx, "samba3", false) ||
2910                                     torture_setting_bool(tctx, "samba4", false)) {
2911                                         torture_comment(tctx, "skipping trusted domain auth tests against samba");
2912                                 } else {
2913                                         if (check_dom_trust_pw(p, tctx, trust_name,
2914                                                                 "x" TRUSTPW "x")) {
2915                                                 torture_comment(tctx, "Password check passed unexpectedly\n");
2916                                                 ret = false;
2917                                         }
2918                                         if (!check_dom_trust_pw(p, tctx, trust_name,
2919                                                                 TRUSTPW)) {
2920                                                 torture_comment(tctx, "Password check failed\n");
2921                                                 ret = false;
2922                                         }
2923                                 }
2924                         }
2925
2926                         q.in.trustdom_handle = &trustdom_handle[i];
2927                         q.in.level = LSA_TRUSTED_DOMAIN_INFO_INFO_EX;
2928                         q.out.info = &info;
2929                         torture_assert_ntstatus_ok(tctx, dcerpc_lsa_QueryTrustedDomainInfo_r(b, tctx, &q),
2930                                 "QueryTrustedDomainInfo failed");
2931                         if (!NT_STATUS_IS_OK(q.out.result)) {
2932                                 torture_comment(tctx, "QueryTrustedDomainInfo level 1 failed - %s\n", nt_errstr(q.out.result));
2933                                 ret = false;
2934                         } else if (!q.out.info) {
2935                                 torture_comment(tctx, "QueryTrustedDomainInfo level 1 failed to return an info pointer\n");
2936                                 ret = false;
2937                         } else {
2938                                 if (strcmp(info->info_ex.netbios_name.string, trustinfo.netbios_name.string) != 0) {
2939                                         torture_comment(tctx, "QueryTrustedDomainInfo returned inconsistent short name: %s != %s\n",
2940                                                info->info_ex.netbios_name.string, trustinfo.netbios_name.string);
2941                                         ret = false;
2942                                 }
2943                                 if (info->info_ex.trust_type != trustinfo.trust_type) {
2944                                         torture_comment(tctx, "QueryTrustedDomainInfo of %s returned incorrect trust type %d != %d\n",
2945                                                trust_name, info->info_ex.trust_type, trustinfo.trust_type);
2946                                         ret = false;
2947                                 }
2948                                 if (info->info_ex.trust_attributes != LSA_TRUST_ATTRIBUTE_USES_RC4_ENCRYPTION) {
2949                                         torture_comment(tctx, "QueryTrustedDomainInfo of %s returned incorrect trust attributes %d != %d\n",
2950                                                trust_name, info->info_ex.trust_attributes, LSA_TRUST_ATTRIBUTE_USES_RC4_ENCRYPTION);
2951                                         ret = false;
2952                                 }
2953                                 if (info->info_ex.trust_direction != trustinfo.trust_direction) {
2954                                         torture_comment(tctx, "QueryTrustedDomainInfo of %s returned incorrect trust direction %d != %d\n",
2955                                                trust_name, info->info_ex.trust_direction, trustinfo.trust_direction);
2956                                         ret = false;
2957                                 }
2958                         }
2959                 }
2960         }
2961
2962         /* now that we have some domains to look over, we can test the enum calls */
2963         if (!test_EnumTrustDom(b, tctx, handle)) {
2964                 torture_comment(tctx, "test_EnumTrustDom failed\n");
2965                 ret = false;
2966         }
2967
2968         if (!test_EnumTrustDomEx(b, tctx, handle)) {
2969                 torture_comment(tctx, "test_EnumTrustDomEx failed\n");
2970                 ret = false;
2971         }
2972
2973         for (i=0; i<num_trusts; i++) {
2974                 if (!test_DeleteTrustedDomainBySid(b, tctx, handle, domsid[i])) {
2975                         torture_comment(tctx, "test_DeleteTrustedDomainBySid failed\n");
2976                         ret = false;
2977                 }
2978         }
2979
2980         return ret;
2981 }
2982
2983 static bool test_CreateTrustedDomainEx2(struct dcerpc_pipe *p,
2984                                         struct torture_context *tctx,
2985                                         struct policy_handle *handle,
2986                                         uint32_t num_trusts)
2987 {
2988         return test_CreateTrustedDomainEx_common(p, tctx, handle, num_trusts, true);
2989 }
2990
2991 static bool test_CreateTrustedDomainEx(struct dcerpc_pipe *p,
2992                                        struct torture_context *tctx,
2993                                        struct policy_handle *handle,
2994                                        uint32_t num_trusts)
2995 {
2996         return test_CreateTrustedDomainEx_common(p, tctx, handle, num_trusts, false);
2997 }
2998
2999 static bool test_QueryDomainInfoPolicy(struct dcerpc_binding_handle *b,
3000                                  struct torture_context *tctx,
3001                                  struct policy_handle *handle)
3002 {
3003         struct lsa_QueryDomainInformationPolicy r;
3004         union lsa_DomainInformationPolicy *info = NULL;
3005         int i;
3006         bool ret = true;
3007
3008         if (torture_setting_bool(tctx, "samba3", false)) {
3009                 torture_skip(tctx, "skipping QueryDomainInformationPolicy test\n");
3010         }
3011
3012         torture_comment(tctx, "\nTesting QueryDomainInformationPolicy\n");
3013
3014         for (i=2;i<4;i++) {
3015                 r.in.handle = handle;
3016                 r.in.level = i;
3017                 r.out.info = &info;
3018
3019                 torture_comment(tctx, "\nTrying QueryDomainInformationPolicy level %d\n", i);
3020
3021                 torture_assert_ntstatus_ok(tctx, dcerpc_lsa_QueryDomainInformationPolicy_r(b, tctx, &r),
3022                         "QueryDomainInformationPolicy failed");
3023
3024                 /* If the server does not support EFS, then this is the correct return */
3025                 if (i == LSA_DOMAIN_INFO_POLICY_EFS && NT_STATUS_EQUAL(r.out.result, NT_STATUS_OBJECT_NAME_NOT_FOUND)) {
3026                         continue;
3027                 } else if (!NT_STATUS_IS_OK(r.out.result)) {
3028                         torture_comment(tctx, "QueryDomainInformationPolicy failed - %s\n", nt_errstr(r.out.result));
3029                         ret = false;
3030                         continue;
3031                 }
3032         }
3033
3034         return ret;
3035 }
3036
3037
3038 static bool test_QueryInfoPolicyCalls(  bool version2,
3039                                         struct dcerpc_binding_handle *b,
3040                                         struct torture_context *tctx,
3041                                         struct policy_handle *handle)
3042 {
3043         struct lsa_QueryInfoPolicy r;
3044         union lsa_PolicyInformation *info = NULL;
3045         int i;
3046         bool ret = true;
3047         const char *call = talloc_asprintf(tctx, "QueryInfoPolicy%s", version2 ? "2":"");
3048
3049         torture_comment(tctx, "\nTesting %s\n", call);
3050
3051         if (version2 && torture_setting_bool(tctx, "samba3", false)) {
3052                 torture_skip(tctx, "skipping QueryInfoPolicy2 tests\n");
3053         }
3054
3055         for (i=1;i<=14;i++) {
3056                 r.in.handle = handle;
3057                 r.in.level = i;
3058                 r.out.info = &info;
3059
3060                 torture_comment(tctx, "\nTrying %s level %d\n", call, i);
3061
3062                 if (version2)
3063                         /* We can perform the cast, because both types are
3064                            structurally equal */
3065                         torture_assert_ntstatus_ok(tctx, dcerpc_lsa_QueryInfoPolicy2_r(b, tctx,
3066                                  (struct lsa_QueryInfoPolicy2*) &r),
3067                                  "QueryInfoPolicy2 failed");
3068                 else
3069                         torture_assert_ntstatus_ok(tctx, dcerpc_lsa_QueryInfoPolicy_r(b, tctx, &r),
3070                                 "QueryInfoPolicy2 failed");
3071
3072                 switch (i) {
3073                 case LSA_POLICY_INFO_MOD:
3074                 case LSA_POLICY_INFO_AUDIT_FULL_SET:
3075                 case LSA_POLICY_INFO_AUDIT_FULL_QUERY:
3076                         if (!NT_STATUS_EQUAL(r.out.result, NT_STATUS_INVALID_PARAMETER)) {
3077                                 torture_comment(tctx, "Server should have failed level %u: %s\n", i, nt_errstr(r.out.result));
3078                                 ret = false;
3079                         }
3080                         break;
3081                 case LSA_POLICY_INFO_DOMAIN:
3082                 case LSA_POLICY_INFO_ACCOUNT_DOMAIN:
3083                 case LSA_POLICY_INFO_REPLICA:
3084                 case LSA_POLICY_INFO_QUOTA:
3085                 case LSA_POLICY_INFO_ROLE:
3086                 case LSA_POLICY_INFO_AUDIT_LOG:
3087                 case LSA_POLICY_INFO_AUDIT_EVENTS:
3088                 case LSA_POLICY_INFO_PD:
3089                         if (!NT_STATUS_IS_OK(r.out.result)) {
3090                                 torture_comment(tctx, "%s failed - %s\n", call, nt_errstr(r.out.result));
3091                                 ret = false;
3092                         }
3093                         break;
3094                 case LSA_POLICY_INFO_L_ACCOUNT_DOMAIN:
3095                 case LSA_POLICY_INFO_DNS_INT:
3096                 case LSA_POLICY_INFO_DNS:
3097                         if (torture_setting_bool(tctx, "samba3", false)) {
3098                                 /* Other levels not implemented yet */
3099                                 if (!NT_STATUS_EQUAL(r.out.result, NT_STATUS_INVALID_INFO_CLASS)) {
3100                                         torture_comment(tctx, "%s failed - %s\n", call, nt_errstr(r.out.result));
3101                                         ret = false;
3102                                 }
3103                         } else if (!NT_STATUS_IS_OK(r.out.result)) {
3104                                 torture_comment(tctx, "%s failed - %s\n", call, nt_errstr(r.out.result));
3105                                 ret = false;
3106                         }
3107                         break;
3108                 default:
3109                         if (torture_setting_bool(tctx, "samba4", false)) {
3110                                 /* Other levels not implemented yet */
3111                                 if (!NT_STATUS_EQUAL(r.out.result, NT_STATUS_INVALID_INFO_CLASS)) {
3112                                         torture_comment(tctx, "%s failed - %s\n", call, nt_errstr(r.out.result));
3113                                         ret = false;
3114                                 }
3115                         } else if (!NT_STATUS_IS_OK(r.out.result)) {
3116                                 torture_comment(tctx, "%s failed - %s\n", call, nt_errstr(r.out.result));
3117                                 ret = false;
3118                         }
3119                         break;
3120                 }
3121
3122                 if (NT_STATUS_IS_OK(r.out.result) && (i == LSA_POLICY_INFO_DNS
3123                         || i == LSA_POLICY_INFO_DNS_INT)) {
3124                         /* Let's look up some of these names */
3125
3126                         struct lsa_TransNameArray tnames;
3127                         tnames.count = 14;
3128                         tnames.names = talloc_zero_array(tctx, struct lsa_TranslatedName, tnames.count);
3129                         tnames.names[0].name.string = info->dns.name.string;
3130                         tnames.names[0].sid_type = SID_NAME_DOMAIN;
3131                         tnames.names[1].name.string = info->dns.dns_domain.string;
3132                         tnames.names[1].sid_type = SID_NAME_DOMAIN;
3133                         tnames.names[2].name.string = talloc_asprintf(tctx, "%s\\", info->dns.name.string);
3134                         tnames.names[2].sid_type = SID_NAME_DOMAIN;
3135                         tnames.names[3].name.string = talloc_asprintf(tctx, "%s\\", info->dns.dns_domain.string);
3136                         tnames.names[3].sid_type = SID_NAME_DOMAIN;
3137                         tnames.names[4].name.string = talloc_asprintf(tctx, "%s\\guest", info->dns.name.string);
3138                         tnames.names[4].sid_type = SID_NAME_USER;
3139                         tnames.names[5].name.string = talloc_asprintf(tctx, "%s\\krbtgt", info->dns.name.string);
3140                         tnames.names[5].sid_type = SID_NAME_USER;
3141                         tnames.names[6].name.string = talloc_asprintf(tctx, "%s\\guest", info->dns.dns_domain.string);
3142                         tnames.names[6].sid_type = SID_NAME_USER;
3143                         tnames.names[7].name.string = talloc_asprintf(tctx, "%s\\krbtgt", info->dns.dns_domain.string);
3144                         tnames.names[7].sid_type = SID_NAME_USER;
3145                         tnames.names[8].name.string = talloc_asprintf(tctx, "krbtgt@%s", info->dns.name.string);
3146                         tnames.names[8].sid_type = SID_NAME_USER;
3147                         tnames.names[9].name.string = talloc_asprintf(tctx, "krbtgt@%s", info->dns.dns_domain.string);
3148                         tnames.names[9].sid_type = SID_NAME_USER;
3149                         tnames.names[10].name.string = talloc_asprintf(tctx, "%s\\"TEST_MACHINENAME "$", info->dns.name.string);
3150                         tnames.names[10].sid_type = SID_NAME_USER;
3151                         tnames.names[11].name.string = talloc_asprintf(tctx, "%s\\"TEST_MACHINENAME "$", info->dns.dns_domain.string);
3152                         tnames.names[11].sid_type = SID_NAME_USER;
3153                         tnames.names[12].name.string = talloc_asprintf(tctx, TEST_MACHINENAME "$@%s", info->dns.name.string);
3154                         tnames.names[12].sid_type = SID_NAME_USER;
3155                         tnames.names[13].name.string = talloc_asprintf(tctx, TEST_MACHINENAME "$@%s", info->dns.dns_domain.string);
3156                         tnames.names[13].sid_type = SID_NAME_USER;
3157                         ret &= test_LookupNames(b, tctx, handle, &tnames);
3158
3159                 }
3160         }
3161
3162         return ret;
3163 }
3164
3165 static bool test_QueryInfoPolicy(struct dcerpc_binding_handle *b,
3166                                  struct torture_context *tctx,
3167                                  struct policy_handle *handle)
3168 {
3169         return test_QueryInfoPolicyCalls(false, b, tctx, handle);
3170 }
3171
3172 static bool test_QueryInfoPolicy2(struct dcerpc_binding_handle *b,
3173                                   struct torture_context *tctx,
3174                                   struct policy_handle *handle)
3175 {
3176         return test_QueryInfoPolicyCalls(true, b, tctx, handle);
3177 }
3178
3179 static bool test_GetUserName(struct dcerpc_binding_handle *b,
3180                              struct torture_context *tctx)
3181 {
3182         struct lsa_GetUserName r;
3183         bool ret = true;
3184         struct lsa_String *authority_name_p = NULL;
3185         struct lsa_String *account_name_p = NULL;
3186
3187         torture_comment(tctx, "\nTesting GetUserName\n");
3188
3189         r.in.system_name        = "\\";
3190         r.in.account_name       = &account_name_p;
3191         r.in.authority_name     = NULL;
3192         r.out.account_name      = &account_name_p;
3193
3194         torture_assert_ntstatus_ok(tctx, dcerpc_lsa_GetUserName_r(b, tctx, &r),
3195                 "GetUserName failed");
3196
3197         if (!NT_STATUS_IS_OK(r.out.result)) {
3198                 torture_comment(tctx, "GetUserName failed - %s\n", nt_errstr(r.out.result));
3199                 ret = false;
3200         }
3201
3202         account_name_p = NULL;
3203         r.in.account_name       = &account_name_p;
3204         r.in.authority_name     = &authority_name_p;
3205         r.out.account_name      = &account_name_p;
3206
3207         torture_assert_ntstatus_ok(tctx, dcerpc_lsa_GetUserName_r(b, tctx, &r),
3208                 "GetUserName failed");
3209
3210         if (!NT_STATUS_IS_OK(r.out.result)) {
3211                 torture_comment(tctx, "GetUserName failed - %s\n", nt_errstr(r.out.result));
3212                 ret = false;
3213         }
3214
3215         return ret;
3216 }
3217
3218 bool test_lsa_Close(struct dcerpc_binding_handle *b,
3219                     struct torture_context *tctx,
3220                     struct policy_handle *handle)
3221 {
3222         struct lsa_Close r;
3223         struct policy_handle handle2;
3224
3225         torture_comment(tctx, "\nTesting Close\n");
3226
3227         r.in.handle = handle;
3228         r.out.handle = &handle2;
3229
3230         torture_assert_ntstatus_ok(tctx, dcerpc_lsa_Close_r(b, tctx, &r),
3231                 "Close failed");
3232         if (!NT_STATUS_IS_OK(r.out.result)) {
3233                 torture_comment(tctx, "Close failed - %s\n",
3234                 nt_errstr(r.out.result));
3235                 return false;
3236         }
3237
3238         torture_assert_ntstatus_equal(tctx, dcerpc_lsa_Close_r(b, tctx, &r),
3239                 NT_STATUS_RPC_SS_CONTEXT_MISMATCH, "Close should failed");
3240
3241         torture_comment(tctx, "\n");
3242
3243         return true;
3244 }
3245
3246 bool torture_rpc_lsa(struct torture_context *tctx)
3247 {
3248         NTSTATUS status;
3249         struct dcerpc_pipe *p;
3250         bool ret = true;
3251         struct policy_handle *handle = NULL;
3252         struct test_join *join = NULL;
3253         struct cli_credentials *machine_creds;
3254         struct dcerpc_binding_handle *b;
3255
3256         status = torture_rpc_connection(tctx, &p, &ndr_table_lsarpc);
3257         if (!NT_STATUS_IS_OK(status)) {
3258                 return false;
3259         }
3260         b = p->binding_handle;
3261
3262         /* Test lsaLookupSids3 and lsaLookupNames4 over tcpip */
3263         if (p->binding->transport == NCACN_IP_TCP) {
3264                 if (!test_OpenPolicy_fail(b, tctx)) {
3265                         ret = false;
3266                 }
3267
3268                 if (!test_lsa_OpenPolicy2_ex(b, tctx, &handle,
3269                                              NT_STATUS_OK, true)) {
3270                         ret = false;
3271                 }
3272
3273                 if (!test_many_LookupSids(p, tctx, handle)) {
3274                         ret = false;
3275                 }
3276
3277                 return ret;
3278         }
3279
3280         if (!test_OpenPolicy(b, tctx)) {
3281                 ret = false;
3282         }
3283
3284         if (!test_lsa_OpenPolicy2(b, tctx, &handle)) {
3285                 ret = false;
3286         }
3287
3288         if (handle) {
3289                 join = torture_join_domain(tctx, TEST_MACHINENAME, ACB_WSTRUST, &machine_creds);
3290                 if (!join) {
3291                         ret = false;
3292                 }
3293
3294                 if (!test_LookupSids_async(b, tctx, handle)) {
3295                         ret = false;
3296                 }
3297
3298                 if (!test_QueryDomainInfoPolicy(b, tctx, handle)) {
3299                         ret = false;
3300                 }
3301
3302                 if (!test_CreateSecret(p, tctx, handle)) {
3303                         ret = false;
3304                 }
3305
3306                 if (!test_QueryInfoPolicy(b, tctx, handle)) {
3307                         ret = false;
3308                 }
3309
3310                 if (!test_QueryInfoPolicy2(b, tctx, handle)) {
3311                         ret = false;
3312                 }
3313
3314                 if (!test_Delete(b, tctx, handle)) {
3315                         ret = false;
3316                 }
3317
3318                 if (!test_many_LookupSids(p, tctx, handle)) {
3319                         ret = false;
3320                 }
3321
3322                 if (!test_lsa_Close(b, tctx, handle)) {
3323                         ret = false;
3324                 }
3325
3326                 torture_leave_domain(tctx, join);
3327
3328         } else {
3329                 if (!test_many_LookupSids(p, tctx, handle)) {
3330                         ret = false;
3331                 }
3332         }
3333
3334         if (!test_GetUserName(b, tctx)) {
3335                 ret = false;
3336         }
3337
3338         return ret;
3339 }
3340
3341 bool torture_rpc_lsa_get_user(struct torture_context *tctx)
3342 {
3343         NTSTATUS status;
3344         struct dcerpc_pipe *p;
3345         bool ret = true;
3346         struct dcerpc_binding_handle *b;
3347
3348         status = torture_rpc_connection(tctx, &p, &ndr_table_lsarpc);
3349         if (!NT_STATUS_IS_OK(status)) {
3350                 return false;
3351         }
3352         b = p->binding_handle;
3353
3354         if (!test_GetUserName(b, tctx)) {
3355                 ret = false;
3356         }
3357
3358         return ret;
3359 }
3360
3361 static bool testcase_LookupNames(struct torture_context *tctx,
3362                                  struct dcerpc_pipe *p)
3363 {
3364         bool ret = true;
3365         struct policy_handle *handle;
3366         struct lsa_TransNameArray tnames;
3367         struct lsa_TransNameArray2 tnames2;
3368         struct dcerpc_binding_handle *b = p->binding_handle;
3369
3370         if (p->binding->transport != NCACN_NP &&
3371             p->binding->transport != NCALRPC) {
3372                 torture_comment(tctx, "testcase_LookupNames is only available "
3373                                 "over NCACN_NP or NCALRPC");
3374                 return true;
3375         }
3376
3377         if (!test_OpenPolicy(b, tctx)) {
3378                 ret = false;
3379         }
3380
3381         if (!test_lsa_OpenPolicy2(b, tctx, &handle)) {
3382                 ret = false;
3383         }
3384
3385         if (!handle) {
3386                 ret = false;
3387         }
3388
3389         tnames.count = 1;
3390         tnames.names = talloc_array(tctx, struct lsa_TranslatedName, tnames.count);
3391         ZERO_STRUCT(tnames.names[0]);
3392         tnames.names[0].name.string = "BUILTIN";
3393         tnames.names[0].sid_type = SID_NAME_DOMAIN;
3394
3395         if (!test_LookupNames(b, tctx, handle, &tnames)) {
3396                 ret = false;
3397         }
3398
3399         tnames2.count = 1;
3400         tnames2.names = talloc_array(tctx, struct lsa_TranslatedName2, tnames2.count);
3401         ZERO_STRUCT(tnames2.names[0]);
3402         tnames2.names[0].name.string = "BUILTIN";
3403         tnames2.names[0].sid_type = SID_NAME_DOMAIN;
3404
3405         if (!test_LookupNames2(b, tctx, handle, &tnames2, true)) {
3406                 ret = false;
3407         }
3408
3409         if (!test_LookupNames3(b, tctx, handle, &tnames2, true)) {
3410                 ret = false;
3411         }
3412
3413         if (!test_LookupNames_wellknown(b, tctx, handle)) {
3414                 ret = false;
3415         }
3416
3417         if (!test_LookupNames_NULL(b, tctx, handle)) {
3418                 ret = false;
3419         }
3420
3421         if (!test_LookupNames_bogus(b, tctx, handle)) {
3422                 ret = false;
3423         }
3424
3425         if (!test_lsa_Close(b, tctx, handle)) {
3426                 ret = false;
3427         }
3428
3429         return ret;
3430 }
3431
3432 struct torture_suite *torture_rpc_lsa_lookup_names(TALLOC_CTX *mem_ctx)
3433 {
3434         struct torture_suite *suite;
3435         struct torture_rpc_tcase *tcase;
3436
3437         suite = torture_suite_create(mem_ctx, "lsa.lookupnames");
3438
3439         tcase = torture_suite_add_rpc_iface_tcase(suite, "lsa",
3440                                                   &ndr_table_lsarpc);
3441         torture_rpc_tcase_add_test(tcase, "LookupNames",
3442                                    testcase_LookupNames);
3443
3444         return suite;
3445 }
3446
3447 struct lsa_trustdom_state {
3448         uint32_t num_trusts;
3449 };
3450
3451 static bool testcase_TrustedDomains(struct torture_context *tctx,
3452                                     struct dcerpc_pipe *p,
3453                                     void *data)
3454 {
3455         bool ret = true;
3456         struct policy_handle *handle;
3457         struct lsa_trustdom_state *state =
3458                 talloc_get_type_abort(data, struct lsa_trustdom_state);
3459         struct dcerpc_binding_handle *b = p->binding_handle;
3460
3461         if (p->binding->transport != NCACN_NP &&
3462             p->binding->transport != NCALRPC) {
3463                 torture_comment(tctx, "testcase_TrustedDomains is only available "
3464                                 "over NCACN_NP or NCALRPC");
3465                 return true;
3466         }
3467
3468         torture_comment(tctx, "Testing %d domains\n", state->num_trusts);
3469
3470         if (!test_OpenPolicy(b, tctx)) {
3471                 ret = false;
3472         }
3473
3474         if (!test_lsa_OpenPolicy2(b, tctx, &handle)) {
3475                 ret = false;
3476         }
3477
3478         if (!handle) {
3479                 ret = false;
3480         }
3481
3482         if (!test_CreateTrustedDomain(b, tctx, handle, state->num_trusts)) {
3483                 ret = false;
3484         }
3485
3486         if (!test_CreateTrustedDomainEx(p, tctx, handle, state->num_trusts)) {
3487                 ret = false;
3488         }
3489
3490         if (!test_CreateTrustedDomainEx2(p, tctx, handle, state->num_trusts)) {
3491                 ret = false;
3492         }
3493
3494         if (!test_lsa_Close(b, tctx, handle)) {
3495                 ret = false;
3496         }
3497
3498         return ret;
3499 }
3500
3501 struct torture_suite *torture_rpc_lsa_trusted_domains(TALLOC_CTX *mem_ctx)
3502 {
3503         struct torture_suite *suite;
3504         struct torture_rpc_tcase *tcase;
3505         struct lsa_trustdom_state *state;
3506
3507         state = talloc(mem_ctx, struct lsa_trustdom_state);
3508
3509         state->num_trusts = 12;
3510
3511         suite = torture_suite_create(mem_ctx, "lsa.trusted.domains");
3512
3513         tcase = torture_suite_add_rpc_iface_tcase(suite, "lsa",
3514                                                   &ndr_table_lsarpc);
3515         torture_rpc_tcase_add_test_ex(tcase, "TrustedDomains",
3516                                       testcase_TrustedDomains,
3517                                       state);
3518
3519         return suite;
3520 }
3521
3522 static bool testcase_Privileges(struct torture_context *tctx,
3523                                 struct dcerpc_pipe *p)
3524 {
3525         bool ret = true;
3526         struct policy_handle *handle;
3527         struct dcerpc_binding_handle *b = p->binding_handle;
3528
3529         if (p->binding->transport != NCACN_NP &&
3530             p->binding->transport != NCALRPC) {
3531                 torture_comment(tctx, "testcase_Privileges is only available "
3532                                 "over NCACN_NP or NCALRPC");
3533                 return true;
3534         }
3535
3536         if (!test_OpenPolicy(b, tctx)) {
3537                 ret = false;
3538         }
3539
3540         if (!test_lsa_OpenPolicy2(b, tctx, &handle)) {
3541                 ret = false;
3542         }
3543
3544         if (!handle) {
3545                 ret = false;
3546         }
3547
3548         if (!test_CreateAccount(b, tctx, handle)) {
3549                 ret = false;
3550         }
3551
3552         if (!test_EnumAccounts(b, tctx, handle)) {
3553                 ret = false;
3554         }
3555
3556         if (!test_EnumPrivs(b, tctx, handle)) {
3557                 ret = false;
3558         }
3559
3560         if (!test_lsa_Close(b, tctx, handle)) {
3561                 ret = false;
3562         }
3563
3564         return ret;
3565 }
3566
3567
3568 struct torture_suite *torture_rpc_lsa_privileges(TALLOC_CTX *mem_ctx)
3569 {
3570         struct torture_suite *suite;
3571         struct torture_rpc_tcase *tcase;
3572
3573         suite = torture_suite_create(mem_ctx, "lsa.privileges");
3574
3575         tcase = torture_suite_add_rpc_iface_tcase(suite, "lsa",
3576                                                   &ndr_table_lsarpc);
3577         torture_rpc_tcase_add_test(tcase, "Privileges",
3578                                    testcase_Privileges);
3579
3580         return suite;
3581 }