source4/torture/rpc/samba3rpc.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3
   4    dcerpc torture tests, designed to walk Samba3 code paths
   5
   6    Copyright (C) Volker Lendecke 2006
   7
   8    This program is free software; you can redistribute it and/or modify
   9    it under the terms of the GNU General Public License as published by
  10    the Free Software Foundation; either version 3 of the License, or
  11    (at your option) any later version.
  12
  13    This program is distributed in the hope that it will be useful,
  14    but WITHOUT ANY WARRANTY; without even the implied warranty of
  15    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  16    GNU General Public License for more details.
  17
  18    You should have received a copy of the GNU General Public License
  19    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  20 */
  21
  22 #include "includes.h"
  23 #include "libcli/raw/libcliraw.h"
  24 #include "libcli/raw/raw_proto.h"
  25 #include "torture/util.h"
  26 #include "libcli/rap/rap.h"
  27 #include "librpc/gen_ndr/ndr_lsa_c.h"
  28 #include "librpc/gen_ndr/ndr_samr_c.h"
  29 #include "librpc/gen_ndr/ndr_netlogon_c.h"
  30 #include "librpc/gen_ndr/ndr_srvsvc_c.h"
  31 #include "librpc/gen_ndr/ndr_spoolss_c.h"
  32 #include "librpc/gen_ndr/ndr_winreg_c.h"
  33 #include "librpc/gen_ndr/ndr_wkssvc_c.h"
  34 #include "lib/cmdline/popt_common.h"
  35 #include "torture/rpc/torture_rpc.h"
  36 #include "libcli/libcli.h"
  37 #include "libcli/smb_composite/smb_composite.h"
  38 #include "libcli/auth/libcli_auth.h"
  39 #include "../lib/crypto/crypto.h"
  40 #include "libcli/security/security.h"
  41 #include "param/param.h"
  42 #include "lib/registry/registry.h"
  43 #include "libcli/resolve/resolve.h"
  44 #include "torture/ndr/ndr.h"
  45 #include "libcli/smb2/smb2.h"
  46 #include "libcli/smb2/smb2_calls.h"
  47 #include "librpc/rpc/dcerpc.h"
  48 #include "librpc/rpc/dcerpc_proto.h"
  49 #include "../source3/libsmb/smb2cli.h"
  50 #include "libcli/smb/smbXcli_base.h"
  51
  52 /*
  53  * This tests a RPC call using an invalid vuid
  54  */
  55
  56 bool torture_bind_authcontext(struct torture_context *torture)
  57 {
  58         TALLOC_CTX *mem_ctx;
  59         NTSTATUS status;
  60         bool ret = false;
  61         struct lsa_ObjectAttribute objectattr;
  62         struct lsa_OpenPolicy2 openpolicy;
  63         struct policy_handle handle;
  64         struct lsa_Close close_handle;
  65         struct smbcli_session *tmp;
  66         uint16_t tmp_vuid;
  67         struct smbcli_session *session2;
  68         struct smbcli_state *cli;
  69         struct dcerpc_pipe *lsa_pipe;
  70         struct dcerpc_binding_handle *lsa_handle;
  71         struct cli_credentials *anon_creds;
  72         struct smb_composite_sesssetup setup;
  73         struct smbcli_options options;
  74         struct smbcli_session_options session_options;
  75
  76         mem_ctx = talloc_init("torture_bind_authcontext");
  77
  78         if (mem_ctx == NULL) {
  79                 torture_comment(torture, "talloc_init failed\n");
  80                 return false;
  81         }
  82
  83         lpcfg_smbcli_options(torture->lp_ctx, &options);
  84         lpcfg_smbcli_session_options(torture->lp_ctx, &session_options);
  85
  86         status = smbcli_full_connection(mem_ctx, &cli,
  87                                         torture_setting_string(torture, "host", NULL),
  88                                         lpcfg_smb_ports(torture->lp_ctx),
  89                                         "IPC$", NULL,
  90                                         lpcfg_socket_options(torture->lp_ctx),
  91                                         cmdline_credentials,
  92                                         lpcfg_resolve_context(torture->lp_ctx),
  93                                         torture->ev, &options, &session_options,
  94                                         lpcfg_gensec_settings(torture, torture->lp_ctx));
  95         if (!NT_STATUS_IS_OK(status)) {
  96                 torture_comment(torture, "smbcli_full_connection failed: %s\n",
  97                          nt_errstr(status));
  98                 goto done;
  99         }
 100
 101         lsa_pipe = dcerpc_pipe_init(mem_ctx, torture->ev);
 102         if (lsa_pipe == NULL) {
 103                 torture_comment(torture, "dcerpc_pipe_init failed\n");
 104                 goto done;
 105         }
 106         lsa_handle = lsa_pipe->binding_handle;
 107
 108         status = dcerpc_pipe_open_smb(lsa_pipe, cli->tree, "\\lsarpc");
 109         if (!NT_STATUS_IS_OK(status)) {
 110                 torture_comment(torture, "dcerpc_pipe_open_smb failed: %s\n",
 111                          nt_errstr(status));
 112                 goto done;
 113         }
 114
 115         status = dcerpc_bind_auth_none(lsa_pipe, &ndr_table_lsarpc);
 116         if (!NT_STATUS_IS_OK(status)) {
 117                 torture_comment(torture, "dcerpc_bind_auth_none failed: %s\n",
 118                          nt_errstr(status));
 119                 goto done;
 120         }
 121
 122         openpolicy.in.system_name =talloc_asprintf(
 123                 mem_ctx, "\\\\%s", dcerpc_server_name(lsa_pipe));
 124         ZERO_STRUCT(objectattr);
 125         openpolicy.in.attr = &objectattr;
 126         openpolicy.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
 127         openpolicy.out.handle = &handle;
 128
 129         status = dcerpc_lsa_OpenPolicy2_r(lsa_handle, mem_ctx, &openpolicy);
 130
 131         if (!NT_STATUS_IS_OK(status)) {
 132                 torture_comment(torture, "dcerpc_lsa_OpenPolicy2 failed: %s\n",
 133                          nt_errstr(status));
 134                 goto done;
 135         }
 136         if (!NT_STATUS_IS_OK(openpolicy.out.result)) {
 137                 torture_comment(torture, "dcerpc_lsa_OpenPolicy2 failed: %s\n",
 138                          nt_errstr(openpolicy.out.result));
 139                 goto done;
 140         }
 141
 142         close_handle.in.handle = &handle;
 143         close_handle.out.handle = &handle;
 144
 145         status = dcerpc_lsa_Close_r(lsa_handle, mem_ctx, &close_handle);
 146         if (!NT_STATUS_IS_OK(status)) {
 147                 torture_comment(torture, "dcerpc_lsa_Close failed: %s\n",
 148                          nt_errstr(status));
 149                 goto done;
 150         }
 151         if (!NT_STATUS_IS_OK(close_handle.out.result)) {
 152                 torture_comment(torture, "dcerpc_lsa_Close failed: %s\n",
 153                          nt_errstr(close_handle.out.result));
 154                 goto done;
 155         }
 156
 157         session2 = smbcli_session_init(cli->transport, mem_ctx, false, session_options);
 158         if (session2 == NULL) {
 159                 torture_comment(torture, "smbcli_session_init failed\n");
 160                 goto done;
 161         }
 162
 163         if (!(anon_creds = cli_credentials_init_anon(mem_ctx))) {
 164                 torture_comment(torture, "create_anon_creds failed\n");
 165                 goto done;
 166         }
 167
 168         setup.in.sesskey = cli->transport->negotiate.sesskey;
 169         setup.in.capabilities = cli->transport->negotiate.capabilities;
 170         setup.in.workgroup = "";
 171         setup.in.credentials = anon_creds;
 172         setup.in.gensec_settings = lpcfg_gensec_settings(torture, torture->lp_ctx);
 173
 174         status = smb_composite_sesssetup(session2, &setup);
 175         if (!NT_STATUS_IS_OK(status)) {
 176                 torture_comment(torture, "anon session setup failed: %s\n",
 177                          nt_errstr(status));
 178                 goto done;
 179         }
 180         session2->vuid = setup.out.vuid;
 181
 182         tmp = cli->tree->session;
 183         tmp_vuid = smb1cli_session_current_id(tmp->smbXcli);
 184         smb1cli_session_set_id(tmp->smbXcli, session2->vuid);
 185         cli->tree->session = session2;
 186
 187         status = dcerpc_lsa_OpenPolicy2_r(lsa_handle, mem_ctx, &openpolicy);
 188
 189         smb1cli_session_set_id(tmp->smbXcli, tmp_vuid);
 190         cli->tree->session = tmp;
 191         talloc_free(lsa_pipe);
 192         lsa_pipe = NULL;
 193
 194         if (!NT_STATUS_EQUAL(status, NT_STATUS_INVALID_HANDLE)) {
 195                 torture_comment(torture, "dcerpc_lsa_OpenPolicy2 with wrong vuid gave %s, "
 196                          "expected NT_STATUS_INVALID_HANDLE\n",
 197                          nt_errstr(status));
 198                 goto done;
 199         }
 200
 201         ret = true;
 202  done:
 203         talloc_free(mem_ctx);
 204         return ret;
 205 }
 206
 207 /*
 208  * Bind to lsa using a specific auth method
 209  */
 210
 211 static bool bindtest(struct torture_context *tctx,
 212                      struct smbcli_state *cli,
 213                      struct cli_credentials *credentials,
 214                      uint8_t auth_type, uint8_t auth_level)
 215 {
 216         TALLOC_CTX *mem_ctx;
 217         bool ret = false;
 218         NTSTATUS status;
 219
 220         struct dcerpc_pipe *lsa_pipe;
 221         struct dcerpc_binding_handle *lsa_handle;
 222         struct lsa_ObjectAttribute objectattr;
 223         struct lsa_OpenPolicy2 openpolicy;
 224         struct lsa_QueryInfoPolicy query;
 225         union lsa_PolicyInformation *info = NULL;
 226         struct policy_handle handle;
 227         struct lsa_Close close_handle;
 228
 229         if ((mem_ctx = talloc_init("bindtest")) == NULL) {
 230                 torture_comment(tctx, "talloc_init failed\n");
 231                 return false;
 232         }
 233
 234         lsa_pipe = dcerpc_pipe_init(mem_ctx, tctx->ev);
 235         if (lsa_pipe == NULL) {
 236                 torture_comment(tctx, "dcerpc_pipe_init failed\n");
 237                 goto done;
 238         }
 239         lsa_handle = lsa_pipe->binding_handle;
 240
 241         status = dcerpc_pipe_open_smb(lsa_pipe, cli->tree, "\\lsarpc");
 242         if (!NT_STATUS_IS_OK(status)) {
 243                 torture_comment(tctx, "dcerpc_pipe_open_smb failed: %s\n",
 244                          nt_errstr(status));
 245                 goto done;
 246         }
 247
 248         status = dcerpc_bind_auth(lsa_pipe, &ndr_table_lsarpc,
 249                                   credentials, lpcfg_gensec_settings(tctx->lp_ctx, tctx->lp_ctx), auth_type, auth_level,
 250                                   NULL);
 251         if (!NT_STATUS_IS_OK(status)) {
 252                 torture_comment(tctx, "dcerpc_bind_auth failed: %s\n", nt_errstr(status));
 253                 goto done;
 254         }
 255
 256         openpolicy.in.system_name =talloc_asprintf(
 257                 mem_ctx, "\\\\%s", dcerpc_server_name(lsa_pipe));
 258         ZERO_STRUCT(objectattr);
 259         openpolicy.in.attr = &objectattr;
 260         openpolicy.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
 261         openpolicy.out.handle = &handle;
 262
 263         status = dcerpc_lsa_OpenPolicy2_r(lsa_handle, mem_ctx, &openpolicy);
 264
 265         if (!NT_STATUS_IS_OK(status)) {
 266                 torture_comment(tctx, "dcerpc_lsa_OpenPolicy2 failed: %s\n",
 267                          nt_errstr(status));
 268                 goto done;
 269         }
 270         if (!NT_STATUS_IS_OK(openpolicy.out.result)) {
 271                 torture_comment(tctx, "dcerpc_lsa_OpenPolicy2 failed: %s\n",
 272                          nt_errstr(openpolicy.out.result));
 273                 goto done;
 274         }
 275
 276         query.in.handle = &handle;
 277         query.in.level = LSA_POLICY_INFO_DOMAIN;
 278         query.out.info = &info;
 279
 280         status = dcerpc_lsa_QueryInfoPolicy_r(lsa_handle, mem_ctx, &query);
 281         if (!NT_STATUS_IS_OK(status)) {
 282                 torture_comment(tctx, "dcerpc_lsa_QueryInfoPolicy failed: %s\n",
 283                          nt_errstr(status));
 284                 goto done;
 285         }
 286         if (!NT_STATUS_IS_OK(query.out.result)) {
 287                 torture_comment(tctx, "dcerpc_lsa_QueryInfoPolicy failed: %s\n",
 288                          nt_errstr(query.out.result));
 289                 goto done;
 290         }
 291
 292         close_handle.in.handle = &handle;
 293         close_handle.out.handle = &handle;
 294
 295         status = dcerpc_lsa_Close_r(lsa_handle, mem_ctx, &close_handle);
 296         if (!NT_STATUS_IS_OK(status)) {
 297                 torture_comment(tctx, "dcerpc_lsa_Close failed: %s\n",
 298                          nt_errstr(status));
 299                 goto done;
 300         }
 301         if (!NT_STATUS_IS_OK(close_handle.out.result)) {
 302                 torture_comment(tctx, "dcerpc_lsa_Close failed: %s\n",
 303                          nt_errstr(close_handle.out.result));
 304                 goto done;
 305         }
 306
 307
 308         ret = true;
 309  done:
 310         talloc_free(mem_ctx);
 311         return ret;
 312 }
 313
 314 /*
 315  * test authenticated RPC binds with the variants Samba3 does support
 316  */
 317
 318 static bool torture_bind_samba3(struct torture_context *torture)
 319 {
 320         TALLOC_CTX *mem_ctx;
 321         NTSTATUS status;
 322         bool ret = false;
 323         struct smbcli_state *cli;
 324         struct smbcli_options options;
 325         struct smbcli_session_options session_options;
 326
 327         mem_ctx = talloc_init("torture_bind_authcontext");
 328
 329         if (mem_ctx == NULL) {
 330                 torture_comment(torture, "talloc_init failed\n");
 331                 return false;
 332         }
 333
 334         lpcfg_smbcli_options(torture->lp_ctx, &options);
 335         lpcfg_smbcli_session_options(torture->lp_ctx, &session_options);
 336
 337         status = smbcli_full_connection(mem_ctx, &cli,
 338                                         torture_setting_string(torture, "host", NULL),
 339                                         lpcfg_smb_ports(torture->lp_ctx),
 340                                         "IPC$", NULL,
 341                                         lpcfg_socket_options(torture->lp_ctx),
 342                                         cmdline_credentials,
 343                                         lpcfg_resolve_context(torture->lp_ctx),
 344                                         torture->ev, &options, &session_options,
 345                                         lpcfg_gensec_settings(torture, torture->lp_ctx));
 346         if (!NT_STATUS_IS_OK(status)) {
 347                 torture_comment(torture, "smbcli_full_connection failed: %s\n",
 348                          nt_errstr(status));
 349                 goto done;
 350         }
 351
 352         ret = true;
 353
 354         ret &= bindtest(torture, cli, cmdline_credentials, DCERPC_AUTH_TYPE_NTLMSSP,
 355                         DCERPC_AUTH_LEVEL_INTEGRITY);
 356         ret &= bindtest(torture, cli, cmdline_credentials, DCERPC_AUTH_TYPE_NTLMSSP,
 357                         DCERPC_AUTH_LEVEL_PRIVACY);
 358         ret &= bindtest(torture, cli, cmdline_credentials, DCERPC_AUTH_TYPE_SPNEGO,
 359                         DCERPC_AUTH_LEVEL_INTEGRITY);
 360         ret &= bindtest(torture, cli, cmdline_credentials, DCERPC_AUTH_TYPE_SPNEGO,
 361                         DCERPC_AUTH_LEVEL_PRIVACY);
 362
 363  done:
 364         talloc_free(mem_ctx);
 365         return ret;
 366 }
 367
 368 /*
 369  * Lookup or create a user and return all necessary info
 370  */
 371
 372 static bool get_usr_handle(struct torture_context *tctx,
 373                            struct smbcli_state *cli,
 374                            TALLOC_CTX *mem_ctx,
 375                            struct cli_credentials *admin_creds,
 376                            uint8_t auth_type,
 377                            uint8_t auth_level,
 378                            const char *username,
 379                            char **domain,
 380                            struct dcerpc_pipe **result_pipe,
 381                            struct policy_handle **result_handle,
 382                            struct dom_sid **sid_p)
 383 {
 384         struct dcerpc_pipe *samr_pipe;
 385         struct dcerpc_binding_handle *samr_handle;
 386         NTSTATUS status;
 387         struct policy_handle conn_handle;
 388         struct policy_handle domain_handle;
 389         struct policy_handle *user_handle;
 390         struct samr_Connect2 conn;
 391         struct samr_EnumDomains enumdom;
 392         uint32_t resume_handle = 0;
 393         uint32_t num_entries = 0;
 394         struct samr_SamArray *sam = NULL;
 395         struct samr_LookupDomain l;
 396         struct dom_sid2 *sid = NULL;
 397         int dom_idx;
 398         struct lsa_String domain_name;
 399         struct lsa_String user_name;
 400         struct samr_OpenDomain o;
 401         struct samr_CreateUser2 c;
 402         uint32_t user_rid,access_granted;
 403
 404         samr_pipe = dcerpc_pipe_init(mem_ctx, tctx->ev);
 405         torture_assert(tctx, samr_pipe, "dcerpc_pipe_init failed");
 406 #if 0
 407         samr_pipe->conn->flags |= DCERPC_DEBUG_PRINT_IN | DCERPC_DEBUG_PRINT_OUT;
 408 #endif
 409         samr_handle = samr_pipe->binding_handle;
 410
 411         torture_assert_ntstatus_ok(tctx,
 412                 dcerpc_pipe_open_smb(samr_pipe, cli->tree, "\\samr"),
 413                 "dcerpc_pipe_open_smb failed");
 414
 415         if (admin_creds != NULL) {
 416                 torture_assert_ntstatus_ok(tctx,
 417                         dcerpc_bind_auth(samr_pipe, &ndr_table_samr,
 418                                           admin_creds, lpcfg_gensec_settings(tctx->lp_ctx, tctx->lp_ctx), auth_type, auth_level,
 419                                           NULL),
 420                         "dcerpc_bind_auth failed");
 421         } else {
 422                 /* We must have an authenticated SMB connection */
 423                 torture_assert_ntstatus_ok(tctx,
 424                         dcerpc_bind_auth_none(samr_pipe, &ndr_table_samr),
 425                         "dcerpc_bind_auth_none failed");
 426         }
 427
 428         conn.in.system_name = talloc_asprintf(
 429                 mem_ctx, "\\\\%s", dcerpc_server_name(samr_pipe));
 430         conn.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
 431         conn.out.connect_handle = &conn_handle;
 432
 433         torture_assert_ntstatus_ok(tctx,
 434                 dcerpc_samr_Connect2_r(samr_handle, mem_ctx, &conn),
 435                 "samr_Connect2 failed");
 436         torture_assert_ntstatus_ok(tctx, conn.out.result,
 437                 "samr_Connect2 failed");
 438
 439         enumdom.in.connect_handle = &conn_handle;
 440         enumdom.in.resume_handle = &resume_handle;
 441         enumdom.in.buf_size = (uint32_t)-1;
 442         enumdom.out.resume_handle = &resume_handle;
 443         enumdom.out.num_entries = &num_entries;
 444         enumdom.out.sam = &sam;
 445
 446         torture_assert_ntstatus_ok(tctx,
 447                 dcerpc_samr_EnumDomains_r(samr_handle, mem_ctx, &enumdom),
 448                 "samr_EnumDomains failed");
 449         torture_assert_ntstatus_ok(tctx, enumdom.out.result,
 450                 "samr_EnumDomains failed");
 451
 452         torture_assert_int_equal(tctx, *enumdom.out.num_entries, 2,
 453                 "samr_EnumDomains returned unexpected num_entries");
 454
 455         dom_idx = strequal(sam->entries[0].name.string,
 456                            "builtin") ? 1:0;
 457
 458         l.in.connect_handle = &conn_handle;
 459         domain_name.string = sam->entries[dom_idx].name.string;
 460         *domain = talloc_strdup(mem_ctx, domain_name.string);
 461         l.in.domain_name = &domain_name;
 462         l.out.sid = &sid;
 463
 464         torture_assert_ntstatus_ok(tctx,
 465                 dcerpc_samr_LookupDomain_r(samr_handle, mem_ctx, &l),
 466                 "samr_LookupDomain failed");
 467         torture_assert_ntstatus_ok(tctx, l.out.result,
 468                 "samr_LookupDomain failed");
 469
 470         o.in.connect_handle = &conn_handle;
 471         o.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
 472         o.in.sid = *l.out.sid;
 473         o.out.domain_handle = &domain_handle;
 474
 475         torture_assert_ntstatus_ok(tctx,
 476                 dcerpc_samr_OpenDomain_r(samr_handle, mem_ctx, &o),
 477                 "samr_OpenDomain failed");
 478         torture_assert_ntstatus_ok(tctx, o.out.result,
 479                 "samr_OpenDomain failed");
 480
 481         c.in.domain_handle = &domain_handle;
 482         user_name.string = username;
 483         c.in.account_name = &user_name;
 484         c.in.acct_flags = ACB_NORMAL;
 485         c.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
 486         user_handle = talloc(mem_ctx, struct policy_handle);
 487         c.out.user_handle = user_handle;
 488         c.out.access_granted = &access_granted;
 489         c.out.rid = &user_rid;
 490
 491         torture_assert_ntstatus_ok(tctx,
 492                 dcerpc_samr_CreateUser2_r(samr_handle, mem_ctx, &c),
 493                 "samr_CreateUser2 failed");
 494
 495         if (NT_STATUS_EQUAL(c.out.result, NT_STATUS_USER_EXISTS)) {
 496                 struct samr_LookupNames ln;
 497                 struct samr_OpenUser ou;
 498                 struct samr_Ids rids, types;
 499
 500                 ln.in.domain_handle = &domain_handle;
 501                 ln.in.num_names = 1;
 502                 ln.in.names = &user_name;
 503                 ln.out.rids = &rids;
 504                 ln.out.types = &types;
 505
 506                 torture_assert_ntstatus_ok(tctx,
 507                         dcerpc_samr_LookupNames_r(samr_handle, mem_ctx, &ln),
 508                         "samr_LookupNames failed");
 509                 torture_assert_ntstatus_ok(tctx, ln.out.result,
 510                         "samr_LookupNames failed");
 511
 512                 ou.in.domain_handle = &domain_handle;
 513                 ou.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
 514                 user_rid = ou.in.rid = ln.out.rids->ids[0];
 515                 ou.out.user_handle = user_handle;
 516
 517                 torture_assert_ntstatus_ok(tctx,
 518                         dcerpc_samr_OpenUser_r(samr_handle, mem_ctx, &ou),
 519                         "samr_OpenUser failed");
 520                 status = ou.out.result;
 521         } else {
 522                 status = c.out.result;
 523         }
 524
 525         torture_assert_ntstatus_ok(tctx, status,
 526                 "samr_CreateUser failed");
 527
 528         *result_pipe = samr_pipe;
 529         *result_handle = user_handle;
 530         if (sid_p != NULL) {
 531                 *sid_p = dom_sid_add_rid(mem_ctx, *l.out.sid, user_rid);
 532         }
 533         return true;
 534
 535 }
 536
 537 /*
 538  * Create a test user
 539  */
 540
 541 static bool create_user(struct torture_context *tctx,
 542                         TALLOC_CTX *mem_ctx, struct smbcli_state *cli,
 543                         struct cli_credentials *admin_creds,
 544                         const char *username, const char *password,
 545                         char **domain_name,
 546                         struct dom_sid **user_sid)
 547 {
 548         TALLOC_CTX *tmp_ctx;
 549         NTSTATUS status;
 550         struct dcerpc_pipe *samr_pipe;
 551         struct dcerpc_binding_handle *samr_handle;
 552         struct policy_handle *wks_handle;
 553         bool ret = false;
 554
 555         if (!(tmp_ctx = talloc_new(mem_ctx))) {
 556                 torture_comment(tctx, "talloc_init failed\n");
 557                 return false;
 558         }
 559
 560         ret = get_usr_handle(tctx, cli, tmp_ctx, admin_creds,
 561                              DCERPC_AUTH_TYPE_NTLMSSP,
 562                              DCERPC_AUTH_LEVEL_INTEGRITY,
 563                              username, domain_name, &samr_pipe, &wks_handle,
 564                              user_sid);
 565         if (ret == false) {
 566                 torture_comment(tctx, "get_usr_handle failed\n");
 567                 goto done;
 568         }
 569         samr_handle = samr_pipe->binding_handle;
 570
 571         {
 572                 struct samr_SetUserInfo2 sui2;
 573                 struct samr_SetUserInfo sui;
 574                 struct samr_QueryUserInfo qui;
 575                 union samr_UserInfo u_info;
 576                 union samr_UserInfo *info;
 577                 DATA_BLOB session_key;
 578
 579
 580                 ZERO_STRUCT(u_info);
 581                 encode_pw_buffer(u_info.info23.password.data, password,
 582                                  STR_UNICODE);
 583
 584                 status = dcerpc_fetch_session_key(samr_pipe, &session_key);
 585                 if (!NT_STATUS_IS_OK(status)) {
 586                         torture_comment(tctx, "dcerpc_fetch_session_key failed\n");
 587                         goto done;
 588                 }
 589                 arcfour_crypt_blob(u_info.info23.password.data, 516,
 590                                    &session_key);
 591                 u_info.info23.info.password_expired = 0;
 592                 u_info.info23.info.fields_present = SAMR_FIELD_NT_PASSWORD_PRESENT |
 593                                                     SAMR_FIELD_LM_PASSWORD_PRESENT |
 594                                                     SAMR_FIELD_EXPIRED_FLAG;
 595                 sui2.in.user_handle = wks_handle;
 596                 sui2.in.info = &u_info;
 597                 sui2.in.level = 23;
 598
 599                 status = dcerpc_samr_SetUserInfo2_r(samr_handle, tmp_ctx, &sui2);
 600                 if (!NT_STATUS_IS_OK(status)) {
 601                         torture_comment(tctx, "samr_SetUserInfo(23) failed: %s\n",
 602                                  nt_errstr(status));
 603                         goto done;
 604                 }
 605                 if (!NT_STATUS_IS_OK(sui2.out.result)) {
 606                         torture_comment(tctx, "samr_SetUserInfo(23) failed: %s\n",
 607                                  nt_errstr(sui2.out.result));
 608                         goto done;
 609                 }
 610
 611                 u_info.info16.acct_flags = ACB_NORMAL;
 612                 sui.in.user_handle = wks_handle;
 613                 sui.in.info = &u_info;
 614                 sui.in.level = 16;
 615
 616                 status = dcerpc_samr_SetUserInfo_r(samr_handle, tmp_ctx, &sui);
 617                 if (!NT_STATUS_IS_OK(status) || !NT_STATUS_IS_OK(sui.out.result)) {
 618                         torture_comment(tctx, "samr_SetUserInfo(16) failed\n");
 619                         goto done;
 620                 }
 621
 622                 qui.in.user_handle = wks_handle;
 623                 qui.in.level = 21;
 624                 qui.out.info = &info;
 625
 626                 status = dcerpc_samr_QueryUserInfo_r(samr_handle, tmp_ctx, &qui);
 627                 if (!NT_STATUS_IS_OK(status) || !NT_STATUS_IS_OK(qui.out.result)) {
 628                         torture_comment(tctx, "samr_QueryUserInfo(21) failed\n");
 629                         goto done;
 630                 }
 631
 632                 info->info21.allow_password_change = 0;
 633                 info->info21.force_password_change = 0;
 634                 info->info21.account_name.string = NULL;
 635                 info->info21.rid = 0;
 636                 info->info21.acct_expiry = 0;
 637                 info->info21.fields_present = 0x81827fa; /* copy usrmgr.exe */
 638
 639                 u_info.info21 = info->info21;
 640                 sui.in.user_handle = wks_handle;
 641                 sui.in.info = &u_info;
 642                 sui.in.level = 21;
 643
 644                 status = dcerpc_samr_SetUserInfo_r(samr_handle, tmp_ctx, &sui);
 645                 if (!NT_STATUS_IS_OK(status) || !NT_STATUS_IS_OK(sui.out.result)) {
 646                         torture_comment(tctx, "samr_SetUserInfo(21) failed\n");
 647                         goto done;
 648                 }
 649         }
 650
 651         *domain_name= talloc_steal(mem_ctx, *domain_name);
 652         *user_sid = talloc_steal(mem_ctx, *user_sid);
 653         ret = true;
 654  done:
 655         talloc_free(tmp_ctx);
 656         return ret;
 657 }
 658
 659 /*
 660  * Delete a test user
 661  */
 662
 663 static bool delete_user(struct torture_context *tctx,
 664                         struct smbcli_state *cli,
 665                         struct cli_credentials *admin_creds,
 666                         const char *username)
 667 {
 668         TALLOC_CTX *mem_ctx;
 669         NTSTATUS status;
 670         char *dom_name;
 671         struct dcerpc_pipe *samr_pipe;
 672         struct dcerpc_binding_handle *samr_handle;
 673         struct policy_handle *user_handle;
 674         bool ret = false;
 675
 676         if ((mem_ctx = talloc_init("leave")) == NULL) {
 677                 torture_comment(tctx, "talloc_init failed\n");
 678                 return false;
 679         }
 680
 681         ret = get_usr_handle(tctx, cli, mem_ctx, admin_creds,
 682                              DCERPC_AUTH_TYPE_NTLMSSP,
 683                              DCERPC_AUTH_LEVEL_INTEGRITY,
 684                              username, &dom_name, &samr_pipe,
 685                              &user_handle, NULL);
 686         if (ret == false) {
 687                 torture_comment(tctx, "get_wks_handle failed\n");
 688                 goto done;
 689         }
 690         samr_handle = samr_pipe->binding_handle;
 691
 692         {
 693                 struct samr_DeleteUser d;
 694
 695                 d.in.user_handle = user_handle;
 696                 d.out.user_handle = user_handle;
 697
 698                 status = dcerpc_samr_DeleteUser_r(samr_handle, mem_ctx, &d);
 699                 if (!NT_STATUS_IS_OK(status)) {
 700                         torture_comment(tctx, "samr_DeleteUser failed %s\n", nt_errstr(status));
 701                         goto done;
 702                 }
 703                 if (!NT_STATUS_IS_OK(d.out.result)) {
 704                         torture_comment(tctx, "samr_DeleteUser failed %s\n", nt_errstr(d.out.result));
 705                         goto done;
 706                 }
 707
 708         }
 709
 710         ret = true;
 711
 712  done:
 713         talloc_free(mem_ctx);
 714         return ret;
 715 }
 716
 717 /*
 718  * Do a Samba3-style join
 719  */
 720
 721 static bool join3(struct torture_context *tctx,
 722                   struct smbcli_state *cli,
 723                   bool use_level25,
 724                   struct cli_credentials *admin_creds,
 725                   struct cli_credentials *wks_creds)
 726 {
 727         TALLOC_CTX *mem_ctx;
 728         NTSTATUS status;
 729         char *dom_name;
 730         struct dcerpc_pipe *samr_pipe;
 731         struct dcerpc_binding_handle *samr_handle;
 732         struct policy_handle *wks_handle;
 733         bool ret = false;
 734         NTTIME last_password_change;
 735
 736         if ((mem_ctx = talloc_init("join3")) == NULL) {
 737                 torture_comment(tctx, "talloc_init failed\n");
 738                 return false;
 739         }
 740
 741         ret = get_usr_handle(
 742                 tctx, cli, mem_ctx, admin_creds,
 743                 DCERPC_AUTH_TYPE_NTLMSSP,
 744                 DCERPC_AUTH_LEVEL_PRIVACY,
 745                 talloc_asprintf(mem_ctx, "%s$",
 746                                 cli_credentials_get_workstation(wks_creds)),
 747                 &dom_name, &samr_pipe, &wks_handle, NULL);
 748         if (ret == false) {
 749                 torture_comment(tctx, "get_wks_handle failed\n");
 750                 goto done;
 751         }
 752         samr_handle = samr_pipe->binding_handle;
 753         ret = false;
 754         {
 755                 struct samr_QueryUserInfo q;
 756                 union samr_UserInfo *info;
 757
 758                 q.in.user_handle = wks_handle;
 759                 q.in.level = 21;
 760                 q.out.info = &info;
 761
 762                 status = dcerpc_samr_QueryUserInfo_r(samr_handle, mem_ctx, &q);
 763                 if (!NT_STATUS_IS_OK(status)) {
 764                         torture_warning(tctx, "QueryUserInfo failed: %s\n",
 765                                   nt_errstr(status));
 766                         goto done;
 767                 }
 768                 if (!NT_STATUS_IS_OK(q.out.result)) {
 769                         torture_warning(tctx, "QueryUserInfo failed: %s\n",
 770                                   nt_errstr(q.out.result));
 771                         goto done;
 772                 }
 773
 774
 775                 last_password_change = info->info21.last_password_change;
 776         }
 777
 778         cli_credentials_set_domain(wks_creds, dom_name, CRED_SPECIFIED);
 779
 780         if (use_level25) {
 781                 struct samr_SetUserInfo2 sui2;
 782                 union samr_UserInfo u_info;
 783                 struct samr_UserInfo21 *i21 = &u_info.info25.info;
 784                 DATA_BLOB session_key;
 785                 DATA_BLOB confounded_session_key = data_blob_talloc(
 786                         mem_ctx, NULL, 16);
 787                 MD5_CTX ctx;
 788                 uint8_t confounder[16];
 789
 790                 ZERO_STRUCT(u_info);
 791
 792                 i21->full_name.string = talloc_asprintf(
 793                         mem_ctx, "%s$",
 794                         cli_credentials_get_workstation(wks_creds));
 795                 i21->acct_flags = ACB_WSTRUST;
 796                 i21->fields_present = SAMR_FIELD_FULL_NAME |
 797                         SAMR_FIELD_ACCT_FLAGS | SAMR_FIELD_NT_PASSWORD_PRESENT;
 798                 /* this would break the test result expectations
 799                 i21->fields_present |= SAMR_FIELD_EXPIRED_FLAG;
 800                 i21->password_expired = 1;
 801                 */
 802
 803                 encode_pw_buffer(u_info.info25.password.data,
 804                                  cli_credentials_get_password(wks_creds),
 805                                  STR_UNICODE);
 806                 status = dcerpc_fetch_session_key(samr_pipe, &session_key);
 807                 if (!NT_STATUS_IS_OK(status)) {
 808                         torture_comment(tctx, "dcerpc_fetch_session_key failed: %s\n",
 809                                  nt_errstr(status));
 810                         goto done;
 811                 }
 812                 generate_random_buffer((uint8_t *)confounder, 16);
 813
 814                 MD5Init(&ctx);
 815                 MD5Update(&ctx, confounder, 16);
 816                 MD5Update(&ctx, session_key.data, session_key.length);
 817                 MD5Final(confounded_session_key.data, &ctx);
 818
 819                 arcfour_crypt_blob(u_info.info25.password.data, 516,
 820                                    &confounded_session_key);
 821                 memcpy(&u_info.info25.password.data[516], confounder, 16);
 822
 823                 sui2.in.user_handle = wks_handle;
 824                 sui2.in.level = 25;
 825                 sui2.in.info = &u_info;
 826
 827                 status = dcerpc_samr_SetUserInfo2_r(samr_handle, mem_ctx, &sui2);
 828                 if (!NT_STATUS_IS_OK(status)) {
 829                         torture_comment(tctx, "samr_SetUserInfo2(25) failed: %s\n",
 830                                  nt_errstr(status));
 831                         goto done;
 832                 }
 833                 if (!NT_STATUS_IS_OK(sui2.out.result)) {
 834                         torture_comment(tctx, "samr_SetUserInfo2(25) failed: %s\n",
 835                                  nt_errstr(sui2.out.result));
 836                         goto done;
 837                 }
 838         } else {
 839                 struct samr_SetUserInfo2 sui2;
 840                 struct samr_SetUserInfo sui;
 841                 union samr_UserInfo u_info;
 842                 DATA_BLOB session_key;
 843
 844                 encode_pw_buffer(u_info.info24.password.data,
 845                                  cli_credentials_get_password(wks_creds),
 846                                  STR_UNICODE);
 847                 /* just to make this test pass */
 848                 u_info.info24.password_expired = 1;
 849
 850                 status = dcerpc_fetch_session_key(samr_pipe, &session_key);
 851                 if (!NT_STATUS_IS_OK(status)) {
 852                         torture_comment(tctx, "dcerpc_fetch_session_key failed\n");
 853                         goto done;
 854                 }
 855                 arcfour_crypt_blob(u_info.info24.password.data, 516,
 856                                    &session_key);
 857                 sui2.in.user_handle = wks_handle;
 858                 sui2.in.info = &u_info;
 859                 sui2.in.level = 24;
 860
 861                 status = dcerpc_samr_SetUserInfo2_r(samr_handle, mem_ctx, &sui2);
 862                 if (!NT_STATUS_IS_OK(status)) {
 863                         torture_comment(tctx, "samr_SetUserInfo(24) failed: %s\n",
 864                                  nt_errstr(status));
 865                         goto done;
 866                 }
 867                 if (!NT_STATUS_IS_OK(sui2.out.result)) {
 868                         torture_comment(tctx, "samr_SetUserInfo(24) failed: %s\n",
 869                                  nt_errstr(sui2.out.result));
 870                         goto done;
 871                 }
 872
 873                 u_info.info16.acct_flags = ACB_WSTRUST;
 874                 sui.in.user_handle = wks_handle;
 875                 sui.in.info = &u_info;
 876                 sui.in.level = 16;
 877
 878                 status = dcerpc_samr_SetUserInfo_r(samr_handle, mem_ctx, &sui);
 879                 if (!NT_STATUS_IS_OK(status) || !NT_STATUS_IS_OK(sui.out.result)) {
 880                         torture_comment(tctx, "samr_SetUserInfo(16) failed\n");
 881                         goto done;
 882                 }
 883         }
 884
 885         {
 886                 struct samr_QueryUserInfo q;
 887                 union samr_UserInfo *info;
 888
 889                 q.in.user_handle = wks_handle;
 890                 q.in.level = 21;
 891                 q.out.info = &info;
 892
 893                 status = dcerpc_samr_QueryUserInfo_r(samr_handle, mem_ctx, &q);
 894                 if (!NT_STATUS_IS_OK(status)) {
 895                         torture_warning(tctx, "QueryUserInfo failed: %s\n",
 896                                   nt_errstr(status));
 897                         goto done;
 898                 }
 899                 if (!NT_STATUS_IS_OK(q.out.result)) {
 900                         torture_warning(tctx, "QueryUserInfo failed: %s\n",
 901                                   nt_errstr(q.out.result));
 902                         goto done;
 903                 }
 904
 905                 if (use_level25) {
 906                         if (last_password_change
 907                             == info->info21.last_password_change) {
 908                                 torture_warning(tctx, "last_password_change unchanged "
 909                                          "during join, level25 must change "
 910                                          "it\n");
 911                                 goto done;
 912                         }
 913                 }
 914                 else {
 915                         if (last_password_change
 916                             != info->info21.last_password_change) {
 917                                 torture_warning(tctx, "last_password_change changed "
 918                                          "during join, level24 doesn't "
 919                                          "change it\n");
 920                                 goto done;
 921                         }
 922                 }
 923         }
 924
 925         ret = true;
 926
 927  done:
 928         talloc_free(mem_ctx);
 929         return ret;
 930 }
 931
 932 /*
 933  * Do a ReqChallenge/Auth2 and get the wks creds
 934  */
 935
 936 static bool auth2(struct torture_context *tctx,
 937                   struct smbcli_state *cli,
 938                   struct cli_credentials *wks_cred)
 939 {
 940         TALLOC_CTX *mem_ctx;
 941         struct dcerpc_pipe *net_pipe;
 942         struct dcerpc_binding_handle *net_handle;
 943         bool result = false;
 944         NTSTATUS status;
 945         struct netr_ServerReqChallenge r;
 946         struct netr_Credential netr_cli_creds;
 947         struct netr_Credential netr_srv_creds;
 948         uint32_t negotiate_flags;
 949         struct netr_ServerAuthenticate2 a;
 950         struct netlogon_creds_CredentialState *creds_state;
 951         struct netr_Credential netr_cred;
 952         struct samr_Password mach_pw;
 953
 954         mem_ctx = talloc_new(NULL);
 955         if (mem_ctx == NULL) {
 956                 torture_comment(tctx, "talloc_new failed\n");
 957                 return false;
 958         }
 959
 960         net_pipe = dcerpc_pipe_init(mem_ctx, tctx->ev);
 961         if (net_pipe == NULL) {
 962                 torture_comment(tctx, "dcerpc_pipe_init failed\n");
 963                 goto done;
 964         }
 965         net_handle = net_pipe->binding_handle;
 966
 967         status = dcerpc_pipe_open_smb(net_pipe, cli->tree, "\\netlogon");
 968         if (!NT_STATUS_IS_OK(status)) {
 969                 torture_comment(tctx, "dcerpc_pipe_open_smb failed: %s\n",
 970                          nt_errstr(status));
 971                 goto done;
 972         }
 973
 974         status = dcerpc_bind_auth_none(net_pipe, &ndr_table_netlogon);
 975         if (!NT_STATUS_IS_OK(status)) {
 976                 torture_comment(tctx, "dcerpc_bind_auth_none failed: %s\n",
 977                          nt_errstr(status));
 978                 goto done;
 979         }
 980
 981         r.in.computer_name = cli_credentials_get_workstation(wks_cred);
 982         r.in.server_name = talloc_asprintf(
 983                 mem_ctx, "\\\\%s", dcerpc_server_name(net_pipe));
 984         if (r.in.server_name == NULL) {
 985                 torture_comment(tctx, "talloc_asprintf failed\n");
 986                 goto done;
 987         }
 988         generate_random_buffer(netr_cli_creds.data,
 989                                sizeof(netr_cli_creds.data));
 990         r.in.credentials = &netr_cli_creds;
 991         r.out.return_credentials = &netr_srv_creds;
 992
 993         status = dcerpc_netr_ServerReqChallenge_r(net_handle, mem_ctx, &r);
 994         if (!NT_STATUS_IS_OK(status)) {
 995                 torture_comment(tctx, "netr_ServerReqChallenge failed: %s\n",
 996                          nt_errstr(status));
 997                 goto done;
 998         }
 999         if (!NT_STATUS_IS_OK(r.out.result)) {
1000                 torture_comment(tctx, "netr_ServerReqChallenge failed: %s\n",
1001                          nt_errstr(r.out.result));
1002                 goto done;
1003         }
1004
1005         negotiate_flags = NETLOGON_NEG_AUTH2_FLAGS;
1006         E_md4hash(cli_credentials_get_password(wks_cred), mach_pw.hash);
1007
1008         a.in.server_name = talloc_asprintf(
1009                 mem_ctx, "\\\\%s", dcerpc_server_name(net_pipe));
1010         a.in.account_name = talloc_asprintf(
1011                 mem_ctx, "%s$", cli_credentials_get_workstation(wks_cred));
1012         a.in.computer_name = cli_credentials_get_workstation(wks_cred);
1013         a.in.secure_channel_type = SEC_CHAN_WKSTA;
1014         a.in.negotiate_flags = &negotiate_flags;
1015         a.out.negotiate_flags = &negotiate_flags;
1016         a.in.credentials = &netr_cred;
1017         a.out.return_credentials = &netr_cred;
1018
1019         creds_state = netlogon_creds_client_init(mem_ctx,
1020                                                  a.in.account_name,
1021                                                  a.in.computer_name,
1022                                                  a.in.secure_channel_type,
1023                                                  r.in.credentials,
1024                                                  r.out.return_credentials, &mach_pw,
1025                                                  &netr_cred, negotiate_flags);
1026         torture_assert(tctx, (creds_state != NULL), "memory allocation failed");
1027
1028         status = dcerpc_netr_ServerAuthenticate2_r(net_handle, mem_ctx, &a);
1029         if (!NT_STATUS_IS_OK(status)) {
1030                 torture_comment(tctx, "netr_ServerServerAuthenticate2 failed: %s\n",
1031                          nt_errstr(status));
1032                 goto done;
1033         }
1034         if (!NT_STATUS_IS_OK(a.out.result)) {
1035                 torture_comment(tctx, "netr_ServerServerAuthenticate2 failed: %s\n",
1036                          nt_errstr(a.out.result));
1037                 goto done;
1038         }
1039
1040         if (!netlogon_creds_client_check(creds_state, a.out.return_credentials)) {
1041                 torture_comment(tctx, "creds_client_check failed\n");
1042                 goto done;
1043         }
1044
1045         cli_credentials_set_netlogon_creds(wks_cred, creds_state);
1046
1047         result = true;
1048
1049  done:
1050         talloc_free(mem_ctx);
1051         return result;
1052 }
1053
1054 /*
1055  * Do a couple of schannel protected Netlogon ops: Interactive and Network
1056  * login, and change the wks password
1057  */
1058
1059 static bool schan(struct torture_context *tctx,
1060                   struct smbcli_state *cli,
1061                   struct cli_credentials *wks_creds,
1062                   struct cli_credentials *user_creds)
1063 {
1064         TALLOC_CTX *mem_ctx;
1065         NTSTATUS status;
1066         bool ret = false;
1067         struct dcerpc_pipe *net_pipe;
1068         struct dcerpc_binding_handle *net_handle;
1069         int i;
1070
1071         mem_ctx = talloc_new(NULL);
1072         if (mem_ctx == NULL) {
1073                 torture_comment(tctx, "talloc_new failed\n");
1074                 return false;
1075         }
1076
1077         net_pipe = dcerpc_pipe_init(mem_ctx, tctx->ev);
1078         if (net_pipe == NULL) {
1079                 torture_comment(tctx, "dcerpc_pipe_init failed\n");
1080                 goto done;
1081         }
1082         net_handle = net_pipe->binding_handle;
1083
1084         status = dcerpc_pipe_open_smb(net_pipe, cli->tree, "\\netlogon");
1085         if (!NT_STATUS_IS_OK(status)) {
1086                 torture_comment(tctx, "dcerpc_pipe_open_smb failed: %s\n",
1087                          nt_errstr(status));
1088                 goto done;
1089         }
1090
1091 #if 0
1092         net_pipe->conn->flags |= DCERPC_DEBUG_PRINT_IN |
1093                 DCERPC_DEBUG_PRINT_OUT;
1094 #endif
1095 #if 1
1096         net_pipe->conn->flags |= (DCERPC_SIGN | DCERPC_SEAL);
1097         status = dcerpc_bind_auth(net_pipe, &ndr_table_netlogon,
1098                                   wks_creds, lpcfg_gensec_settings(tctx->lp_ctx, tctx->lp_ctx), DCERPC_AUTH_TYPE_SCHANNEL,
1099                                   DCERPC_AUTH_LEVEL_PRIVACY,
1100                                   NULL);
1101 #else
1102         status = dcerpc_bind_auth_none(net_pipe, &ndr_table_netlogon);
1103 #endif
1104         if (!NT_STATUS_IS_OK(status)) {
1105                 torture_comment(tctx, "schannel bind failed: %s\n", nt_errstr(status));
1106                 goto done;
1107         }
1108
1109
1110         for (i=2; i<4; i++) {
1111                 int flags;
1112                 DATA_BLOB chal, nt_resp, lm_resp, names_blob;
1113                 struct netlogon_creds_CredentialState *creds_state;
1114                 struct netr_Authenticator netr_auth, netr_auth2;
1115                 struct netr_NetworkInfo ninfo;
1116                 struct netr_PasswordInfo pinfo;
1117                 struct netr_LogonSamLogon r;
1118                 union netr_LogonLevel logon;
1119                 union netr_Validation validation;
1120                 uint8_t authoritative;
1121                 struct netr_Authenticator return_authenticator;
1122
1123                 flags = CLI_CRED_LANMAN_AUTH | CLI_CRED_NTLM_AUTH |
1124                         CLI_CRED_NTLMv2_AUTH;
1125
1126                 chal = data_blob_talloc(mem_ctx, NULL, 8);
1127                 if (chal.data == NULL) {
1128                         torture_comment(tctx, "data_blob_talloc failed\n");
1129                         goto done;
1130                 }
1131
1132                 generate_random_buffer(chal.data, chal.length);
1133                 names_blob = NTLMv2_generate_names_blob(
1134                         mem_ctx,
1135                         cli_credentials_get_workstation(user_creds),
1136                         cli_credentials_get_domain(user_creds));
1137                 status = cli_credentials_get_ntlm_response(
1138                         user_creds, mem_ctx, &flags, chal, names_blob,
1139                         &lm_resp, &nt_resp, NULL, NULL);
1140                 if (!NT_STATUS_IS_OK(status)) {
1141                         torture_comment(tctx, "cli_credentials_get_ntlm_response failed:"
1142                                  " %s\n", nt_errstr(status));
1143                         goto done;
1144                 }
1145
1146                 creds_state = cli_credentials_get_netlogon_creds(wks_creds);
1147                 netlogon_creds_client_authenticator(creds_state, &netr_auth);
1148
1149                 ninfo.identity_info.account_name.string =
1150                         cli_credentials_get_username(user_creds);
1151                 ninfo.identity_info.domain_name.string =
1152                         cli_credentials_get_domain(user_creds);
1153                 ninfo.identity_info.parameter_control = 0;
1154                 ninfo.identity_info.logon_id_low = 0;
1155                 ninfo.identity_info.logon_id_high = 0;
1156                 ninfo.identity_info.workstation.string =
1157                         cli_credentials_get_workstation(user_creds);
1158                 memcpy(ninfo.challenge, chal.data, sizeof(ninfo.challenge));
1159                 ninfo.nt.length = nt_resp.length;
1160                 ninfo.nt.data = nt_resp.data;
1161                 ninfo.lm.length = lm_resp.length;
1162                 ninfo.lm.data = lm_resp.data;
1163
1164                 logon.network = &ninfo;
1165
1166                 r.in.server_name = talloc_asprintf(
1167                         mem_ctx, "\\\\%s", dcerpc_server_name(net_pipe));
1168                 ZERO_STRUCT(netr_auth2);
1169                 r.in.computer_name =
1170                         cli_credentials_get_workstation(wks_creds);
1171                 r.in.credential = &netr_auth;
1172                 r.in.return_authenticator = &netr_auth2;
1173                 r.in.logon_level = NetlogonNetworkInformation;
1174                 r.in.validation_level = i;
1175                 r.in.logon = &logon;
1176                 r.out.validation = &validation;
1177                 r.out.authoritative = &authoritative;
1178                 r.out.return_authenticator = &return_authenticator;
1179
1180                 status = dcerpc_netr_LogonSamLogon_r(net_handle, mem_ctx, &r);
1181                 if (!NT_STATUS_IS_OK(status)) {
1182                         torture_comment(tctx, "netr_LogonSamLogon failed: %s\n",
1183                                  nt_errstr(status));
1184                         goto done;
1185                 }
1186                 if (!NT_STATUS_IS_OK(r.out.result)) {
1187                         torture_comment(tctx, "netr_LogonSamLogon failed: %s\n",
1188                                  nt_errstr(r.out.result));
1189                         goto done;
1190                 }
1191
1192                 if ((r.out.return_authenticator == NULL) ||
1193                     (!netlogon_creds_client_check(creds_state,
1194                                          &r.out.return_authenticator->cred))) {
1195                         torture_comment(tctx, "Credentials check failed!\n");
1196                         goto done;
1197                 }
1198
1199                 netlogon_creds_client_authenticator(creds_state, &netr_auth);
1200
1201                 pinfo.identity_info = ninfo.identity_info;
1202                 ZERO_STRUCT(pinfo.lmpassword.hash);
1203                 E_md4hash(cli_credentials_get_password(user_creds),
1204                           pinfo.ntpassword.hash);
1205
1206                 netlogon_creds_arcfour_crypt(creds_state, pinfo.ntpassword.hash, 16);
1207
1208                 logon.password = &pinfo;
1209
1210                 r.in.logon_level = NetlogonInteractiveInformation;
1211                 r.in.logon = &logon;
1212                 r.out.return_authenticator = &return_authenticator;
1213
1214                 status = dcerpc_netr_LogonSamLogon_r(net_handle, mem_ctx, &r);
1215                 if (!NT_STATUS_IS_OK(status)) {
1216                         torture_comment(tctx, "netr_LogonSamLogon failed: %s\n",
1217                                  nt_errstr(status));
1218                         goto done;
1219                 }
1220                 if (!NT_STATUS_IS_OK(r.out.result)) {
1221                         torture_comment(tctx, "netr_LogonSamLogon failed: %s\n",
1222                                  nt_errstr(r.out.result));
1223                         goto done;
1224                 }
1225
1226                 if ((r.out.return_authenticator == NULL) ||
1227                     (!netlogon_creds_client_check(creds_state,
1228                                          &r.out.return_authenticator->cred))) {
1229                         torture_comment(tctx, "Credentials check failed!\n");
1230                         goto done;
1231                 }
1232         }
1233
1234         {
1235                 struct netr_ServerPasswordSet s;
1236                 char *password = generate_random_password(wks_creds, 8, 255);
1237                 struct netlogon_creds_CredentialState *creds_state;
1238                 struct netr_Authenticator credential, return_authenticator;
1239                 struct samr_Password new_password;
1240
1241                 s.in.server_name = talloc_asprintf(
1242                         mem_ctx, "\\\\%s", dcerpc_server_name(net_pipe));
1243                 s.in.computer_name = cli_credentials_get_workstation(wks_creds);
1244                 s.in.account_name = talloc_asprintf(
1245                         mem_ctx, "%s$", s.in.computer_name);
1246                 s.in.secure_channel_type = SEC_CHAN_WKSTA;
1247                 s.in.credential = &credential;
1248                 s.in.new_password = &new_password;
1249                 s.out.return_authenticator = &return_authenticator;
1250
1251                 E_md4hash(password, new_password.hash);
1252
1253                 creds_state = cli_credentials_get_netlogon_creds(wks_creds);
1254                 netlogon_creds_des_encrypt(creds_state, &new_password);
1255                 netlogon_creds_client_authenticator(creds_state, &credential);
1256
1257                 status = dcerpc_netr_ServerPasswordSet_r(net_handle, mem_ctx, &s);
1258                 if (!NT_STATUS_IS_OK(status)) {
1259                         torture_comment(tctx, "ServerPasswordSet - %s\n", nt_errstr(status));
1260                         goto done;
1261                 }
1262                 if (!NT_STATUS_IS_OK(s.out.result)) {
1263                         torture_comment(tctx, "ServerPasswordSet - %s\n", nt_errstr(s.out.result));
1264                         goto done;
1265                 }
1266
1267                 if (!netlogon_creds_client_check(creds_state,
1268                                                  &s.out.return_authenticator->cred)) {
1269                         torture_comment(tctx, "Credential chaining failed\n");
1270                 }
1271
1272                 cli_credentials_set_password(wks_creds, password,
1273                                              CRED_SPECIFIED);
1274         }
1275
1276         ret = true;
1277  done:
1278         talloc_free(mem_ctx);
1279         return ret;
1280 }
1281
1282 /*
1283  * Delete the wks account again
1284  */
1285
1286 static bool leave(struct torture_context *tctx,
1287                   struct smbcli_state *cli,
1288                   struct cli_credentials *admin_creds,
1289                   struct cli_credentials *wks_creds)
1290 {
1291         char *wks_name = talloc_asprintf(
1292                 NULL, "%s$", cli_credentials_get_workstation(wks_creds));
1293         bool ret;
1294
1295         ret = delete_user(tctx, cli, admin_creds, wks_name);
1296         talloc_free(wks_name);
1297         return ret;
1298 }
1299
1300 /*
1301  * Test the Samba3 DC code a bit. Join, do some schan netlogon ops, leave
1302  */
1303
1304 static bool torture_netlogon_samba3(struct torture_context *torture)
1305 {
1306         NTSTATUS status;
1307         struct smbcli_state *cli;
1308         struct cli_credentials *anon_creds;
1309         struct cli_credentials *wks_creds;
1310         const char *wks_name;
1311         int i;
1312         struct smbcli_options options;
1313         struct smbcli_session_options session_options;
1314
1315         wks_name = torture_setting_string(torture, "wksname", NULL);
1316         if (wks_name == NULL) {
1317                 wks_name = get_myname(torture);
1318         }
1319
1320         if (!(anon_creds = cli_credentials_init_anon(torture))) {
1321                 torture_fail(torture, "create_anon_creds failed\n");
1322         }
1323
1324         lpcfg_smbcli_options(torture->lp_ctx, &options);
1325         lpcfg_smbcli_session_options(torture->lp_ctx, &session_options);
1326
1327         status = smbcli_full_connection(torture, &cli,
1328                                         torture_setting_string(torture, "host", NULL),
1329                                         lpcfg_smb_ports(torture->lp_ctx),
1330                                         "IPC$", NULL,
1331                                         lpcfg_socket_options(torture->lp_ctx),
1332                                         anon_creds,
1333                                         lpcfg_resolve_context(torture->lp_ctx),
1334                                         torture->ev, &options, &session_options,
1335                                         lpcfg_gensec_settings(torture, torture->lp_ctx));
1336         torture_assert_ntstatus_ok(torture, status, "smbcli_full_connection failed\n");
1337
1338         wks_creds = cli_credentials_init(torture);
1339         if (wks_creds == NULL) {
1340                 torture_fail(torture, "cli_credentials_init failed\n");
1341         }
1342
1343         cli_credentials_set_conf(wks_creds, torture->lp_ctx);
1344         cli_credentials_set_secure_channel_type(wks_creds, SEC_CHAN_WKSTA);
1345         cli_credentials_set_username(wks_creds, wks_name, CRED_SPECIFIED);
1346         cli_credentials_set_workstation(wks_creds, wks_name, CRED_SPECIFIED);
1347         cli_credentials_set_password(wks_creds,
1348                                      generate_random_password(wks_creds, 8, 255),
1349                                      CRED_SPECIFIED);
1350
1351         torture_assert(torture,
1352                 join3(torture, cli, false, cmdline_credentials, wks_creds),
1353                 "join failed");
1354
1355         cli_credentials_set_domain(
1356                 cmdline_credentials, cli_credentials_get_domain(wks_creds),
1357                 CRED_SPECIFIED);
1358
1359         for (i=0; i<2; i++) {
1360
1361                 /* Do this more than once, the routine "schan" changes
1362                  * the workstation password using the netlogon
1363                  * password change routine */
1364
1365                 int j;
1366
1367                 torture_assert(torture,
1368                         auth2(torture, cli, wks_creds),
1369                         "auth2 failed");
1370
1371                 for (j=0; j<2; j++) {
1372                         torture_assert(torture,
1373                                 schan(torture, cli, wks_creds, cmdline_credentials),
1374                                 "schan failed");
1375                 }
1376         }
1377
1378         torture_assert(torture,
1379                 leave(torture, cli, cmdline_credentials, wks_creds),
1380                 "leave failed");
1381
1382         return true;
1383 }
1384
1385 /*
1386  * Do a simple join, testjoin and leave using specified smb and samr
1387  * credentials
1388  */
1389
1390 static bool test_join3(struct torture_context *tctx,
1391                        bool use_level25,
1392                        struct cli_credentials *smb_creds,
1393                        struct cli_credentials *samr_creds,
1394                        const char *wks_name)
1395 {
1396         NTSTATUS status;
1397         struct smbcli_state *cli;
1398         struct cli_credentials *wks_creds;
1399         struct smbcli_options options;
1400         struct smbcli_session_options session_options;
1401
1402         lpcfg_smbcli_options(tctx->lp_ctx, &options);
1403         lpcfg_smbcli_session_options(tctx->lp_ctx, &session_options);
1404
1405         status = smbcli_full_connection(tctx, &cli,
1406                                         torture_setting_string(tctx, "host", NULL),
1407                                         lpcfg_smb_ports(tctx->lp_ctx),
1408                                         "IPC$", NULL, lpcfg_socket_options(tctx->lp_ctx),
1409                                         smb_creds, lpcfg_resolve_context(tctx->lp_ctx),
1410                                         tctx->ev, &options, &session_options,
1411                                         lpcfg_gensec_settings(tctx, tctx->lp_ctx));
1412         torture_assert_ntstatus_ok(tctx, status,
1413                 "smbcli_full_connection failed");
1414
1415         wks_creds = cli_credentials_init(cli);
1416         torture_assert(tctx, wks_creds, "cli_credentials_init failed");
1417
1418         cli_credentials_set_conf(wks_creds, tctx->lp_ctx);
1419         cli_credentials_set_secure_channel_type(wks_creds, SEC_CHAN_WKSTA);
1420         cli_credentials_set_username(wks_creds, wks_name, CRED_SPECIFIED);
1421         cli_credentials_set_workstation(wks_creds, wks_name, CRED_SPECIFIED);
1422         cli_credentials_set_password(wks_creds,
1423                                      generate_random_password(wks_creds, 8, 255),
1424                                      CRED_SPECIFIED);
1425
1426         torture_assert(tctx,
1427                 join3(tctx, cli, use_level25, samr_creds, wks_creds),
1428                 "join failed");
1429
1430         cli_credentials_set_domain(
1431                 cmdline_credentials, cli_credentials_get_domain(wks_creds),
1432                 CRED_SPECIFIED);
1433
1434         torture_assert(tctx,
1435                 auth2(tctx, cli, wks_creds),
1436                 "auth2 failed");
1437
1438         torture_assert(tctx,
1439                 leave(tctx, cli, samr_creds, wks_creds),
1440                 "leave failed");
1441
1442         talloc_free(cli);
1443
1444         return true;
1445 }
1446
1447 /*
1448  * Test the different session key variants. Do it by joining, this uses the
1449  * session key in the setpassword routine. Test the join by doing the auth2.
1450  */
1451
1452 static bool torture_samba3_sessionkey(struct torture_context *torture)
1453 {
1454         struct cli_credentials *anon_creds;
1455         const char *wks_name;
1456
1457         wks_name = torture_setting_string(torture, "wksname", get_myname(torture));
1458
1459         if (!(anon_creds = cli_credentials_init_anon(torture))) {
1460                 torture_fail(torture, "create_anon_creds failed\n");
1461         }
1462
1463         cli_credentials_set_workstation(anon_creds, wks_name, CRED_SPECIFIED);
1464
1465
1466         if (!torture_setting_bool(torture, "samba3", false)) {
1467
1468                 /* Samba3 in the build farm right now does this happily. Need
1469                  * to fix :-) */
1470
1471                 if (test_join3(torture, false, anon_creds, NULL, wks_name)) {
1472                         torture_fail(torture, "join using anonymous bind on an anonymous smb "
1473                                  "connection succeeded -- HUH??\n");
1474                 }
1475         }
1476
1477         torture_assert(torture,
1478                 test_join3(torture, false, anon_creds, cmdline_credentials, wks_name),
1479                 "join using ntlmssp bind on an anonymous smb connection failed");
1480
1481         torture_assert(torture,
1482                 test_join3(torture, false, cmdline_credentials, NULL, wks_name),
1483                 "join using anonymous bind on an authenticated smb connection failed");
1484
1485         torture_assert(torture,
1486                 test_join3(torture, false, cmdline_credentials, cmdline_credentials, wks_name),
1487                 "join using ntlmssp bind on an authenticated smb connection failed");
1488
1489         /*
1490          * The following two are tests for setuserinfolevel 25
1491          */
1492
1493         torture_assert(torture,
1494                 test_join3(torture, true, anon_creds, cmdline_credentials, wks_name),
1495                 "join using ntlmssp bind on an anonymous smb connection failed");
1496
1497         torture_assert(torture,
1498                 test_join3(torture, true, cmdline_credentials, NULL, wks_name),
1499                 "join using anonymous bind on an authenticated smb connection failed");
1500
1501         return true;
1502 }
1503
1504 /*
1505  * open pipe and bind, given an IPC$ context
1506  */
1507
1508 static NTSTATUS pipe_bind_smb(struct torture_context *tctx,
1509                               TALLOC_CTX *mem_ctx,
1510                               struct smbcli_tree *tree,
1511                               const char *pipe_name,
1512                               const struct ndr_interface_table *iface,
1513                               struct dcerpc_pipe **p)
1514 {
1515         struct dcerpc_pipe *result;
1516         NTSTATUS status;
1517
1518         if (!(result = dcerpc_pipe_init(mem_ctx, tctx->ev))) {
1519                 return NT_STATUS_NO_MEMORY;
1520         }
1521
1522         status = dcerpc_pipe_open_smb(result, tree, pipe_name);
1523         if (!NT_STATUS_IS_OK(status)) {
1524                 torture_comment(tctx, "dcerpc_pipe_open_smb failed: %s\n",
1525                          nt_errstr(status));
1526                 talloc_free(result);
1527                 return status;
1528         }
1529
1530         status = dcerpc_bind_auth_none(result, iface);
1531         if (!NT_STATUS_IS_OK(status)) {
1532                 torture_comment(tctx, "schannel bind failed: %s\n", nt_errstr(status));
1533                 talloc_free(result);
1534                 return status;
1535         }
1536
1537         *p = result;
1538         return NT_STATUS_OK;
1539 }
1540
1541 /*
1542  * Sane wrapper around lsa_LookupNames
1543  */
1544
1545 static struct dom_sid *name2sid(struct torture_context *tctx,
1546                                 TALLOC_CTX *mem_ctx,
1547                                 struct dcerpc_pipe *p,
1548                                 const char *name,
1549                                 const char *domain)
1550 {
1551         struct lsa_ObjectAttribute attr;
1552         struct lsa_QosInfo qos;
1553         struct lsa_OpenPolicy2 r;
1554         struct lsa_Close c;
1555         NTSTATUS status;
1556         struct policy_handle handle;
1557         struct lsa_LookupNames l;
1558         struct lsa_TransSidArray sids;
1559         struct lsa_RefDomainList *domains = NULL;
1560         struct lsa_String lsa_name;
1561         uint32_t count = 0;
1562         struct dom_sid *result;
1563         TALLOC_CTX *tmp_ctx;
1564         struct dcerpc_binding_handle *b = p->binding_handle;
1565
1566         if (!(tmp_ctx = talloc_new(mem_ctx))) {
1567                 return NULL;
1568         }
1569
1570         qos.len = 0;
1571         qos.impersonation_level = 2;
1572         qos.context_mode = 1;
1573         qos.effective_only = 0;
1574
1575         attr.len = 0;
1576         attr.root_dir = NULL;
1577         attr.object_name = NULL;
1578         attr.attributes = 0;
1579         attr.sec_desc = NULL;
1580         attr.sec_qos = &qos;
1581
1582         r.in.system_name = "\\";
1583         r.in.attr = &attr;
1584         r.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
1585         r.out.handle = &handle;
1586
1587         status = dcerpc_lsa_OpenPolicy2_r(b, tmp_ctx, &r);
1588         if (!NT_STATUS_IS_OK(status)) {
1589                 torture_comment(tctx, "OpenPolicy2 failed - %s\n", nt_errstr(status));
1590                 talloc_free(tmp_ctx);
1591                 return NULL;
1592         }
1593         if (!NT_STATUS_IS_OK(r.out.result)) {
1594                 torture_comment(tctx, "OpenPolicy2 failed - %s\n", nt_errstr(r.out.result));
1595                 talloc_free(tmp_ctx);
1596                 return NULL;
1597         }
1598
1599         sids.count = 0;
1600         sids.sids = NULL;
1601
1602         lsa_name.string = talloc_asprintf(tmp_ctx, "%s\\%s", domain, name);
1603
1604         l.in.handle = &handle;
1605         l.in.num_names = 1;
1606         l.in.names = &lsa_name;
1607         l.in.sids = &sids;
1608         l.in.level = 1;
1609         l.in.count = &count;
1610         l.out.count = &count;
1611         l.out.sids = &sids;
1612         l.out.domains = &domains;
1613
1614         status = dcerpc_lsa_LookupNames_r(b, tmp_ctx, &l);
1615         if (!NT_STATUS_IS_OK(status)) {
1616                 torture_comment(tctx, "LookupNames of %s failed - %s\n", lsa_name.string,
1617                        nt_errstr(status));
1618                 talloc_free(tmp_ctx);
1619                 return NULL;
1620         }
1621         if (!NT_STATUS_IS_OK(l.out.result)) {
1622                 torture_comment(tctx, "LookupNames of %s failed - %s\n", lsa_name.string,
1623                        nt_errstr(l.out.result));
1624                 talloc_free(tmp_ctx);
1625                 return NULL;
1626         }
1627
1628         result = dom_sid_add_rid(mem_ctx, domains->domains[0].sid,
1629                                  l.out.sids->sids[0].rid);
1630
1631         c.in.handle = &handle;
1632         c.out.handle = &handle;
1633
1634         status = dcerpc_lsa_Close_r(b, tmp_ctx, &c);
1635         if (!NT_STATUS_IS_OK(status)) {
1636                 torture_comment(tctx, "dcerpc_lsa_Close failed - %s\n", nt_errstr(status));
1637                 talloc_free(tmp_ctx);
1638                 return NULL;
1639         }
1640         if (!NT_STATUS_IS_OK(c.out.result)) {
1641                 torture_comment(tctx, "dcerpc_lsa_Close failed - %s\n", nt_errstr(c.out.result));
1642                 talloc_free(tmp_ctx);
1643                 return NULL;
1644         }
1645
1646         talloc_free(tmp_ctx);
1647         return result;
1648 }
1649
1650 /*
1651  * Find out the user SID on this connection
1652  */
1653
1654 static struct dom_sid *whoami(struct torture_context *tctx,
1655                               TALLOC_CTX *mem_ctx,
1656                               struct smbcli_tree *tree)
1657 {
1658         struct dcerpc_pipe *lsa;
1659         struct dcerpc_binding_handle *lsa_handle;
1660         struct lsa_GetUserName r;
1661         NTSTATUS status;
1662         struct lsa_String *authority_name_p = NULL;
1663         struct lsa_String *account_name_p = NULL;
1664         struct dom_sid *result;
1665
1666         status = pipe_bind_smb(tctx, mem_ctx, tree, "\\pipe\\lsarpc",
1667                                &ndr_table_lsarpc, &lsa);
1668         if (!NT_STATUS_IS_OK(status)) {
1669                 torture_warning(tctx, "Could not bind to LSA: %s\n",
1670                          nt_errstr(status));
1671                 return NULL;
1672         }
1673         lsa_handle = lsa->binding_handle;
1674
1675         r.in.system_name = "\\";
1676         r.in.account_name = &account_name_p;
1677         r.in.authority_name = &authority_name_p;
1678         r.out.account_name = &account_name_p;
1679
1680         status = dcerpc_lsa_GetUserName_r(lsa_handle, mem_ctx, &r);
1681
1682         authority_name_p = *r.out.authority_name;
1683
1684         if (!NT_STATUS_IS_OK(status)) {
1685                 torture_warning(tctx, "GetUserName failed - %s\n",
1686                        nt_errstr(status));
1687                 talloc_free(lsa);
1688                 return NULL;
1689         }
1690         if (!NT_STATUS_IS_OK(r.out.result)) {
1691                 torture_warning(tctx, "GetUserName failed - %s\n",
1692                        nt_errstr(r.out.result));
1693                 talloc_free(lsa);
1694                 return NULL;
1695         }
1696
1697         result = name2sid(tctx, mem_ctx, lsa, account_name_p->string,
1698                           authority_name_p->string);
1699
1700         talloc_free(lsa);
1701         return result;
1702 }
1703
1704 static int destroy_tree(struct smbcli_tree *tree)
1705 {
1706         smb_tree_disconnect(tree);
1707         return 0;
1708 }
1709
1710 /*
1711  * Do a tcon, given a session
1712  */
1713
1714 static NTSTATUS secondary_tcon(struct torture_context *tctx,
1715                                TALLOC_CTX *mem_ctx,
1716                                struct smbcli_session *session,
1717                                const char *sharename,
1718                                struct smbcli_tree **res)
1719 {
1720         struct smbcli_tree *result;
1721         TALLOC_CTX *tmp_ctx;
1722         union smb_tcon tcon;
1723         NTSTATUS status;
1724
1725         if (!(tmp_ctx = talloc_new(mem_ctx))) {
1726                 return NT_STATUS_NO_MEMORY;
1727         }
1728
1729         if (!(result = smbcli_tree_init(session, mem_ctx, false))) {
1730                 talloc_free(tmp_ctx);
1731                 return NT_STATUS_NO_MEMORY;
1732         }
1733
1734         tcon.generic.level = RAW_TCON_TCONX;
1735         tcon.tconx.in.flags = TCONX_FLAG_EXTENDED_RESPONSE;
1736         tcon.tconx.in.flags |= TCONX_FLAG_EXTENDED_SIGNATURES;
1737         tcon.tconx.in.password = data_blob(NULL, 0);
1738         tcon.tconx.in.path = sharename;
1739         tcon.tconx.in.device = "?????";
1740
1741         status = smb_raw_tcon(result, tmp_ctx, &tcon);
1742         if (!NT_STATUS_IS_OK(status)) {
1743                 torture_warning(tctx, "smb_raw_tcon failed: %s\n",
1744                          nt_errstr(status));
1745                 talloc_free(tmp_ctx);
1746                 return status;
1747         }
1748
1749         result->tid = tcon.tconx.out.tid;
1750
1751         if (tcon.tconx.out.options & SMB_EXTENDED_SIGNATURES) {
1752                 smb1cli_session_protect_session_key(result->session->smbXcli);
1753         }
1754
1755         result = talloc_steal(mem_ctx, result);
1756         talloc_set_destructor(result, destroy_tree);
1757         talloc_free(tmp_ctx);
1758         *res = result;
1759         return NT_STATUS_OK;
1760 }
1761
1762 /*
1763  * Test the getusername behaviour
1764  */
1765
1766 static bool torture_samba3_rpc_getusername(struct torture_context *torture)
1767 {
1768         NTSTATUS status;
1769         struct smbcli_state *cli;
1770         bool ret = true;
1771         struct dom_sid *user_sid;
1772         struct dom_sid *created_sid;
1773         struct cli_credentials *anon_creds;
1774         struct cli_credentials *user_creds;
1775         char *domain_name;
1776         struct smbcli_options options;
1777         struct smbcli_session_options session_options;
1778
1779         lpcfg_smbcli_options(torture->lp_ctx, &options);
1780         lpcfg_smbcli_session_options(torture->lp_ctx, &session_options);
1781
1782         status = smbcli_full_connection(
1783                 torture, &cli, torture_setting_string(torture, "host", NULL),
1784                 lpcfg_smb_ports(torture->lp_ctx),
1785                 "IPC$", NULL, lpcfg_socket_options(torture->lp_ctx), cmdline_credentials,
1786                 lpcfg_resolve_context(torture->lp_ctx), torture->ev, &options,
1787                 &session_options, lpcfg_gensec_settings(torture, torture->lp_ctx));
1788         torture_assert_ntstatus_ok(torture, status, "smbcli_full_connection failed\n");
1789
1790         if (!(user_sid = whoami(torture, torture, cli->tree))) {
1791                 torture_fail(torture, "whoami on auth'ed connection failed\n");
1792         }
1793
1794         talloc_free(cli);
1795
1796         if (!(anon_creds = cli_credentials_init_anon(torture))) {
1797                 torture_fail(torture, "create_anon_creds failed\n");
1798         }
1799
1800         status = smbcli_full_connection(
1801                 torture, &cli, torture_setting_string(torture, "host", NULL),
1802                 lpcfg_smb_ports(torture->lp_ctx), "IPC$", NULL,
1803                 lpcfg_socket_options(torture->lp_ctx), anon_creds,
1804                 lpcfg_resolve_context(torture->lp_ctx),
1805                 torture->ev, &options, &session_options,
1806                 lpcfg_gensec_settings(torture, torture->lp_ctx));
1807         torture_assert_ntstatus_ok(torture, status, "anon smbcli_full_connection failed\n");
1808
1809         if (!(user_sid = whoami(torture, torture, cli->tree))) {
1810                 torture_fail(torture, "whoami on anon connection failed\n");
1811         }
1812
1813         torture_assert_sid_equal(torture, user_sid, dom_sid_parse_talloc(torture, "s-1-5-7"),
1814                 "Anon lsa_GetUserName returned unexpected SID");
1815
1816         if (!(user_creds = cli_credentials_init(torture))) {
1817                 torture_fail(torture, "cli_credentials_init failed\n");
1818         }
1819
1820         cli_credentials_set_conf(user_creds, torture->lp_ctx);
1821         cli_credentials_set_username(user_creds, "torture_username",
1822                                      CRED_SPECIFIED);
1823         cli_credentials_set_password(user_creds,
1824                                      generate_random_password(user_creds, 8, 255),
1825                                      CRED_SPECIFIED);
1826
1827         if (!create_user(torture, torture, cli, cmdline_credentials,
1828                          cli_credentials_get_username(user_creds),
1829                          cli_credentials_get_password(user_creds),
1830                          &domain_name, &created_sid)) {
1831                 torture_fail(torture, "create_user failed\n");
1832         }
1833
1834         cli_credentials_set_domain(user_creds, domain_name,
1835                                    CRED_SPECIFIED);
1836
1837         {
1838                 struct smbcli_session *session2;
1839                 struct smb_composite_sesssetup setup;
1840                 struct smbcli_tree *tree;
1841
1842                 session2 = smbcli_session_init(cli->transport, torture, false, session_options);
1843                 if (session2 == NULL) {
1844                         torture_fail(torture, "smbcli_session_init failed\n");
1845                 }
1846
1847                 setup.in.sesskey = cli->transport->negotiate.sesskey;
1848                 setup.in.capabilities = cli->transport->negotiate.capabilities;
1849                 setup.in.workgroup = "";
1850                 setup.in.credentials = user_creds;
1851                 setup.in.gensec_settings = lpcfg_gensec_settings(torture, torture->lp_ctx);
1852
1853                 status = smb_composite_sesssetup(session2, &setup);
1854                 torture_assert_ntstatus_ok(torture, status, "session setup with new user failed");
1855
1856                 session2->vuid = setup.out.vuid;
1857
1858                 if (!NT_STATUS_IS_OK(secondary_tcon(torture, torture, session2,
1859                                                     "IPC$", &tree))) {
1860                         torture_fail(torture, "secondary_tcon failed\n");
1861                 }
1862
1863                 if (!(user_sid = whoami(torture, torture, tree))) {
1864                         torture_fail_goto(torture, del, "whoami on user connection failed\n");
1865                         ret = false;
1866                         goto del;
1867                 }
1868
1869                 talloc_free(tree);
1870         }
1871
1872         torture_comment(torture, "Created %s, found %s\n",
1873                  dom_sid_string(torture, created_sid),
1874                  dom_sid_string(torture, user_sid));
1875
1876         if (!dom_sid_equal(created_sid, user_sid)) {
1877                 ret = false;
1878         }
1879
1880  del:
1881         if (!delete_user(torture, cli,
1882                          cmdline_credentials,
1883                          cli_credentials_get_username(user_creds))) {
1884                 torture_fail(torture, "delete_user failed\n");
1885         }
1886
1887         return ret;
1888 }
1889
1890 static bool test_NetShareGetInfo(struct torture_context *tctx,
1891                                  struct dcerpc_pipe *p,
1892                                  const char *sharename)
1893 {
1894         NTSTATUS status;
1895         struct srvsvc_NetShareGetInfo r;
1896         union srvsvc_NetShareInfo info;
1897         uint32_t levels[] = { 0, 1, 2, 501, 502, 1004, 1005, 1006, 1007, 1501 };
1898         int i;
1899         bool ret = true;
1900         struct dcerpc_binding_handle *b = p->binding_handle;
1901
1902         r.in.server_unc = talloc_asprintf(tctx, "\\\\%s",
1903                                           dcerpc_server_name(p));
1904         r.in.share_name = sharename;
1905         r.out.info = &info;
1906
1907         for (i=0;i<ARRAY_SIZE(levels);i++) {
1908                 r.in.level = levels[i];
1909
1910                 torture_comment(tctx, "Testing NetShareGetInfo level %u on share '%s'\n",
1911                        r.in.level, r.in.share_name);
1912
1913                 status = dcerpc_srvsvc_NetShareGetInfo_r(b, tctx, &r);
1914                 if (!NT_STATUS_IS_OK(status)) {
1915                         torture_warning(tctx, "NetShareGetInfo level %u on share '%s' failed"
1916                                " - %s\n", r.in.level, r.in.share_name,
1917                                nt_errstr(status));
1918                         ret = false;
1919                         continue;
1920                 }
1921                 if (!W_ERROR_IS_OK(r.out.result)) {
1922                         torture_warning(tctx, "NetShareGetInfo level %u on share '%s' failed "
1923                                "- %s\n", r.in.level, r.in.share_name,
1924                                win_errstr(r.out.result));
1925                         ret = false;
1926                         continue;
1927                 }
1928         }
1929
1930         return ret;
1931 }
1932
1933 static bool test_NetShareEnum(struct torture_context *tctx,
1934                               struct dcerpc_pipe *p,
1935                               const char **one_sharename)
1936 {
1937         NTSTATUS status;
1938         struct srvsvc_NetShareEnum r;
1939         struct srvsvc_NetShareInfoCtr info_ctr;
1940         struct srvsvc_NetShareCtr0 c0;
1941         struct srvsvc_NetShareCtr1 c1;
1942         struct srvsvc_NetShareCtr2 c2;
1943         struct srvsvc_NetShareCtr501 c501;
1944         struct srvsvc_NetShareCtr502 c502;
1945         struct srvsvc_NetShareCtr1004 c1004;
1946         struct srvsvc_NetShareCtr1005 c1005;
1947         struct srvsvc_NetShareCtr1006 c1006;
1948         struct srvsvc_NetShareCtr1007 c1007;
1949         uint32_t totalentries = 0;
1950         uint32_t levels[] = { 0, 1, 2, 501, 502, 1004, 1005, 1006, 1007 };
1951         int i;
1952         bool ret = true;
1953         struct dcerpc_binding_handle *b = p->binding_handle;
1954
1955         ZERO_STRUCT(info_ctr);
1956
1957         r.in.server_unc = talloc_asprintf(tctx,"\\\\%s",dcerpc_server_name(p));
1958         r.in.info_ctr = &info_ctr;
1959         r.in.max_buffer = (uint32_t)-1;
1960         r.in.resume_handle = NULL;
1961         r.out.totalentries = &totalentries;
1962         r.out.info_ctr = &info_ctr;
1963
1964         for (i=0;i<ARRAY_SIZE(levels);i++) {
1965                 info_ctr.level = levels[i];
1966
1967                 switch (info_ctr.level) {
1968                 case 0:
1969                         ZERO_STRUCT(c0);
1970                         info_ctr.ctr.ctr0 = &c0;
1971                         break;
1972                 case 1:
1973                         ZERO_STRUCT(c1);
1974                         info_ctr.ctr.ctr1 = &c1;
1975                         break;
1976                 case 2:
1977                         ZERO_STRUCT(c2);
1978                         info_ctr.ctr.ctr2 = &c2;
1979                         break;
1980                 case 501:
1981                         ZERO_STRUCT(c501);
1982                         info_ctr.ctr.ctr501 = &c501;
1983                         break;
1984                 case 502:
1985                         ZERO_STRUCT(c502);
1986                         info_ctr.ctr.ctr502 = &c502;
1987                         break;
1988                 case 1004:
1989                         ZERO_STRUCT(c1004);
1990                         info_ctr.ctr.ctr1004 = &c1004;
1991                         break;
1992                 case 1005:
1993                         ZERO_STRUCT(c1005);
1994                         info_ctr.ctr.ctr1005 = &c1005;
1995                         break;
1996                 case 1006:
1997                         ZERO_STRUCT(c1006);
1998                         info_ctr.ctr.ctr1006 = &c1006;
1999                         break;
2000                 case 1007:
2001                         ZERO_STRUCT(c1007);
2002                         info_ctr.ctr.ctr1007 = &c1007;
2003                         break;
2004                 }
2005
2006                 torture_comment(tctx, "Testing NetShareEnum level %u\n", info_ctr.level);
2007
2008                 status = dcerpc_srvsvc_NetShareEnum_r(b, tctx, &r);
2009                 if (!NT_STATUS_IS_OK(status)) {
2010                         torture_warning(tctx, "NetShareEnum level %u failed - %s\n",
2011                                info_ctr.level, nt_errstr(status));
2012                         ret = false;
2013                         continue;
2014                 }
2015                 if (!W_ERROR_IS_OK(r.out.result)) {
2016                         torture_warning(tctx, "NetShareEnum level %u failed - %s\n",
2017                                info_ctr.level, win_errstr(r.out.result));
2018                         continue;
2019                 }
2020                 if (info_ctr.level == 0) {
2021                         struct srvsvc_NetShareCtr0 *ctr = r.out.info_ctr->ctr.ctr0;
2022                         if (ctr->count > 0) {
2023                                 *one_sharename = ctr->array[0].name;
2024                         }
2025                 }
2026         }
2027
2028         return ret;
2029 }
2030
2031 static bool torture_samba3_rpc_srvsvc(struct torture_context *torture)
2032 {
2033         struct dcerpc_pipe *p;
2034         const char *sharename = NULL;
2035         bool ret = true;
2036
2037         torture_assert_ntstatus_ok(torture,
2038                 torture_rpc_connection(torture, &p, &ndr_table_srvsvc),
2039                 "failed to open srvsvc");
2040
2041         ret &= test_NetShareEnum(torture, p, &sharename);
2042         if (sharename == NULL) {
2043                 torture_comment(torture, "did not get sharename\n");
2044         } else {
2045                 ret &= test_NetShareGetInfo(torture, p, sharename);
2046         }
2047
2048         return ret;
2049 }
2050
2051 /*
2052  * Do a ReqChallenge/Auth2 with a random wks name, make sure it returns
2053  * NT_STATUS_NO_SAM_ACCOUNT
2054  */
2055
2056 static bool torture_samba3_rpc_randomauth2(struct torture_context *torture)
2057 {
2058         TALLOC_CTX *mem_ctx;
2059         struct dcerpc_pipe *net_pipe;
2060         struct dcerpc_binding_handle *net_handle;
2061         char *wksname;
2062         bool result = false;
2063         NTSTATUS status;
2064         struct netr_ServerReqChallenge r;
2065         struct netr_Credential netr_cli_creds;
2066         struct netr_Credential netr_srv_creds;
2067         uint32_t negotiate_flags;
2068         struct netr_ServerAuthenticate2 a;
2069         struct netlogon_creds_CredentialState *creds_state;
2070         struct netr_Credential netr_cred;
2071         struct samr_Password mach_pw;
2072         struct smbcli_state *cli;
2073
2074         if (!(mem_ctx = talloc_new(torture))) {
2075                 torture_comment(torture, "talloc_new failed\n");
2076                 return false;
2077         }
2078
2079         if (!(wksname = generate_random_str_list(
2080                       mem_ctx, 14, "ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789"))) {
2081                 torture_comment(torture, "generate_random_str_list failed\n");
2082                 goto done;
2083         }
2084
2085         if (!(torture_open_connection_share(
2086                       mem_ctx, &cli,
2087                       torture, torture_setting_string(torture, "host", NULL),
2088                       "IPC$", torture->ev))) {
2089                 torture_comment(torture, "IPC$ connection failed\n");
2090                 goto done;
2091         }
2092
2093         if (!(net_pipe = dcerpc_pipe_init(mem_ctx, torture->ev))) {
2094                 torture_comment(torture, "dcerpc_pipe_init failed\n");
2095                 goto done;
2096         }
2097         net_handle = net_pipe->binding_handle;
2098
2099         status = dcerpc_pipe_open_smb(net_pipe, cli->tree, "\\netlogon");
2100         if (!NT_STATUS_IS_OK(status)) {
2101                 torture_comment(torture, "dcerpc_pipe_open_smb failed: %s\n",
2102                          nt_errstr(status));
2103                 goto done;
2104         }
2105
2106         status = dcerpc_bind_auth_none(net_pipe, &ndr_table_netlogon);
2107         if (!NT_STATUS_IS_OK(status)) {
2108                 torture_comment(torture, "dcerpc_bind_auth_none failed: %s\n",
2109                          nt_errstr(status));
2110                 goto done;
2111         }
2112
2113         r.in.computer_name = wksname;
2114         r.in.server_name = talloc_asprintf(
2115                 mem_ctx, "\\\\%s", dcerpc_server_name(net_pipe));
2116         if (r.in.server_name == NULL) {
2117                 torture_comment(torture, "talloc_asprintf failed\n");
2118                 goto done;
2119         }
2120         generate_random_buffer(netr_cli_creds.data,
2121                                sizeof(netr_cli_creds.data));
2122         r.in.credentials = &netr_cli_creds;
2123         r.out.return_credentials = &netr_srv_creds;
2124
2125         status = dcerpc_netr_ServerReqChallenge_r(net_handle, mem_ctx, &r);
2126         if (!NT_STATUS_IS_OK(status)) {
2127                 torture_comment(torture, "netr_ServerReqChallenge failed: %s\n",
2128                          nt_errstr(status));
2129                 goto done;
2130         }
2131         if (!NT_STATUS_IS_OK(r.out.result)) {
2132                 torture_comment(torture, "netr_ServerReqChallenge failed: %s\n",
2133                          nt_errstr(r.out.result));
2134                 goto done;
2135         }
2136
2137         negotiate_flags = NETLOGON_NEG_AUTH2_FLAGS;
2138         E_md4hash("foobar", mach_pw.hash);
2139
2140         a.in.server_name = talloc_asprintf(
2141                 mem_ctx, "\\\\%s", dcerpc_server_name(net_pipe));
2142         a.in.account_name = talloc_asprintf(
2143                 mem_ctx, "%s$", wksname);
2144         a.in.computer_name = wksname;
2145         a.in.secure_channel_type = SEC_CHAN_WKSTA;
2146         a.in.negotiate_flags = &negotiate_flags;
2147         a.out.negotiate_flags = &negotiate_flags;
2148         a.in.credentials = &netr_cred;
2149         a.out.return_credentials = &netr_cred;
2150
2151         creds_state = netlogon_creds_client_init(mem_ctx,
2152                                                  a.in.account_name,
2153                                                  a.in.computer_name,
2154                                                  a.in.secure_channel_type,
2155                                                  r.in.credentials,
2156                                                  r.out.return_credentials, &mach_pw,
2157                                                  &netr_cred, negotiate_flags);
2158         torture_assert(torture, (creds_state != NULL), "memory allocation failed");
2159
2160         status = dcerpc_netr_ServerAuthenticate2_r(net_handle, mem_ctx, &a);
2161         if (!NT_STATUS_IS_OK(status)) {
2162                 goto done;
2163         }
2164         if (!NT_STATUS_EQUAL(a.out.result, NT_STATUS_NO_TRUST_SAM_ACCOUNT)) {
2165                 torture_comment(torture, "dcerpc_netr_ServerAuthenticate2 returned %s, "
2166                          "expected NT_STATUS_NO_TRUST_SAM_ACCOUNT\n",
2167                          nt_errstr(a.out.result));
2168                 goto done;
2169         }
2170
2171         result = true;
2172  done:
2173         talloc_free(mem_ctx);
2174         return result;
2175 }
2176
2177 static struct security_descriptor *get_sharesec(struct torture_context *tctx,
2178                                                 TALLOC_CTX *mem_ctx,
2179                                                 struct smbcli_session *sess,
2180                                                 const char *sharename)
2181 {
2182         struct smbcli_tree *tree;
2183         TALLOC_CTX *tmp_ctx;
2184         struct dcerpc_pipe *p;
2185         struct dcerpc_binding_handle *b;
2186         NTSTATUS status;
2187         struct srvsvc_NetShareGetInfo r;
2188         union srvsvc_NetShareInfo info;
2189         struct security_descriptor *result;
2190
2191         if (!(tmp_ctx = talloc_new(mem_ctx))) {
2192                 torture_comment(tctx, "talloc_new failed\n");
2193                 return NULL;
2194         }
2195
2196         if (!NT_STATUS_IS_OK(secondary_tcon(tctx, tmp_ctx, sess, "IPC$", &tree))) {
2197                 torture_comment(tctx, "secondary_tcon failed\n");
2198                 talloc_free(tmp_ctx);
2199                 return NULL;
2200         }
2201
2202         status = pipe_bind_smb(tctx, mem_ctx, tree, "\\pipe\\srvsvc",
2203                                &ndr_table_srvsvc, &p);
2204         if (!NT_STATUS_IS_OK(status)) {
2205                 torture_warning(tctx, "could not bind to srvsvc pipe: %s\n",
2206                          nt_errstr(status));
2207                 talloc_free(tmp_ctx);
2208                 return NULL;
2209         }
2210         b = p->binding_handle;
2211
2212 #if 0
2213         p->conn->flags |= DCERPC_DEBUG_PRINT_IN | DCERPC_DEBUG_PRINT_OUT;
2214 #endif
2215
2216         r.in.server_unc = talloc_asprintf(tmp_ctx, "\\\\%s",
2217                                           dcerpc_server_name(p));
2218         r.in.share_name = sharename;
2219         r.in.level = 502;
2220         r.out.info = &info;
2221
2222         status = dcerpc_srvsvc_NetShareGetInfo_r(b, tmp_ctx, &r);
2223         if (!NT_STATUS_IS_OK(status)) {
2224                 torture_comment(tctx, "srvsvc_NetShareGetInfo failed: %s\n",
2225                          nt_errstr(status));
2226                 talloc_free(tmp_ctx);
2227                 return NULL;
2228         }
2229         if (!W_ERROR_IS_OK(r.out.result)) {
2230                 torture_comment(tctx, "srvsvc_NetShareGetInfo failed: %s\n",
2231                          win_errstr(r.out.result));
2232                 talloc_free(tmp_ctx);
2233                 return NULL;
2234         }
2235
2236         result = talloc_steal(mem_ctx, info.info502->sd_buf.sd);
2237         talloc_free(tmp_ctx);
2238         return result;
2239 }
2240
2241 static NTSTATUS set_sharesec(struct torture_context *tctx,
2242                              TALLOC_CTX *mem_ctx,
2243                              struct smbcli_session *sess,
2244                              const char *sharename,
2245                              struct security_descriptor *sd)
2246 {
2247         struct smbcli_tree *tree;
2248         TALLOC_CTX *tmp_ctx;
2249         struct dcerpc_pipe *p;
2250         struct dcerpc_binding_handle *b;
2251         NTSTATUS status;
2252         struct sec_desc_buf i;
2253         struct srvsvc_NetShareSetInfo r;
2254         union srvsvc_NetShareInfo info;
2255         uint32_t error = 0;
2256
2257         if (!(tmp_ctx = talloc_new(mem_ctx))) {
2258                 torture_comment(tctx, "talloc_new failed\n");
2259                 return NT_STATUS_NO_MEMORY;
2260         }
2261
2262         if (!NT_STATUS_IS_OK(secondary_tcon(tctx, tmp_ctx, sess, "IPC$", &tree))) {
2263                 torture_comment(tctx, "secondary_tcon failed\n");
2264                 talloc_free(tmp_ctx);
2265                 return NT_STATUS_UNSUCCESSFUL;
2266         }
2267
2268         status = pipe_bind_smb(tctx, mem_ctx, tree, "\\pipe\\srvsvc",
2269                                &ndr_table_srvsvc, &p);
2270         if (!NT_STATUS_IS_OK(status)) {
2271                 torture_warning(tctx, "could not bind to srvsvc pipe: %s\n",
2272                          nt_errstr(status));
2273                 talloc_free(tmp_ctx);
2274                 return NT_STATUS_UNSUCCESSFUL;
2275         }
2276         b = p->binding_handle;
2277
2278 #if 0
2279         p->conn->flags |= DCERPC_DEBUG_PRINT_IN | DCERPC_DEBUG_PRINT_OUT;
2280 #endif
2281
2282         r.in.server_unc = talloc_asprintf(tmp_ctx, "\\\\%s",
2283                                           dcerpc_server_name(p));
2284         r.in.share_name = sharename;
2285         r.in.level = 1501;
2286         i.sd = sd;
2287         info.info1501 = &i;
2288         r.in.info = &info;
2289         r.in.parm_error = &error;
2290
2291         status = dcerpc_srvsvc_NetShareSetInfo_r(b, tmp_ctx, &r);
2292         if (!NT_STATUS_IS_OK(status)) {
2293                 torture_comment(tctx, "srvsvc_NetShareSetInfo failed: %s\n",
2294                          nt_errstr(status));
2295         }
2296         if (!W_ERROR_IS_OK(r.out.result)) {
2297                 torture_comment(tctx, "srvsvc_NetShareSetInfo failed: %s\n",
2298                         win_errstr(r.out.result));
2299                 status = werror_to_ntstatus(r.out.result);
2300         }
2301         talloc_free(tmp_ctx);
2302         return status;
2303 }
2304
2305 bool try_tcon(struct torture_context *tctx,
2306               TALLOC_CTX *mem_ctx,
2307               struct security_descriptor *orig_sd,
2308               struct smbcli_session *session,
2309               const char *sharename, const struct dom_sid *user_sid,
2310               unsigned int access_mask, NTSTATUS expected_tcon,
2311               NTSTATUS expected_mkdir)
2312 {
2313         TALLOC_CTX *tmp_ctx;
2314         struct smbcli_tree *rmdir_tree, *tree;
2315         struct dom_sid *domain_sid;
2316         uint32_t rid;
2317         struct security_descriptor *sd;
2318         NTSTATUS status;
2319         bool ret = true;
2320
2321         if (!(tmp_ctx = talloc_new(mem_ctx))) {
2322                 torture_comment(tctx, "talloc_new failed\n");
2323                 return false;
2324         }
2325
2326         status = secondary_tcon(tctx, tmp_ctx, session, sharename, &rmdir_tree);
2327         if (!NT_STATUS_IS_OK(status)) {
2328                 torture_comment(tctx, "first tcon to delete dir failed\n");
2329                 talloc_free(tmp_ctx);
2330                 return false;
2331         }
2332
2333         smbcli_rmdir(rmdir_tree, "sharesec_testdir");
2334
2335         if (!NT_STATUS_IS_OK(dom_sid_split_rid(tmp_ctx, user_sid,
2336                                                &domain_sid, &rid))) {
2337                 torture_comment(tctx, "dom_sid_split_rid failed\n");
2338                 talloc_free(tmp_ctx);
2339                 return false;
2340         }
2341
2342         sd = security_descriptor_dacl_create(
2343                 tmp_ctx, 0, "S-1-5-32-544",
2344                 dom_sid_string(mem_ctx, dom_sid_add_rid(mem_ctx, domain_sid,
2345                                                         DOMAIN_RID_USERS)),
2346                 dom_sid_string(mem_ctx, user_sid),
2347                 SEC_ACE_TYPE_ACCESS_ALLOWED, access_mask, 0, NULL);
2348         if (sd == NULL) {
2349                 torture_comment(tctx, "security_descriptor_dacl_create failed\n");
2350                 talloc_free(tmp_ctx);
2351                 return false;
2352         }
2353
2354         status = set_sharesec(tctx, mem_ctx, session, sharename, sd);
2355         if (!NT_STATUS_IS_OK(status)) {
2356                 torture_comment(tctx, "custom set_sharesec failed: %s\n",
2357                          nt_errstr(status));
2358                 talloc_free(tmp_ctx);
2359                 return false;
2360         }
2361
2362         status = secondary_tcon(tctx, tmp_ctx, session, sharename, &tree);
2363         if (!NT_STATUS_EQUAL(status, expected_tcon)) {
2364                 torture_comment(tctx, "Expected %s, got %s\n", nt_errstr(expected_tcon),
2365                          nt_errstr(status));
2366                 ret = false;
2367                 goto done;
2368         }
2369
2370         if (!NT_STATUS_IS_OK(status)) {
2371                 /* An expected non-access, no point in trying to write */
2372                 goto done;
2373         }
2374
2375         status = smbcli_mkdir(tree, "sharesec_testdir");
2376         if (!NT_STATUS_EQUAL(status, expected_mkdir)) {
2377                 torture_warning(tctx, "Expected %s, got %s\n",
2378                          nt_errstr(expected_mkdir), nt_errstr(status));
2379                 ret = false;
2380         }
2381
2382  done:
2383         smbcli_rmdir(rmdir_tree, "sharesec_testdir");
2384
2385         status = set_sharesec(tctx, mem_ctx, session, sharename, orig_sd);
2386         if (!NT_STATUS_IS_OK(status)) {
2387                 torture_comment(tctx, "custom set_sharesec failed: %s\n",
2388                          nt_errstr(status));
2389                 talloc_free(tmp_ctx);
2390                 return false;
2391         }
2392
2393         talloc_free(tmp_ctx);
2394         return ret;
2395 }
2396
2397 static bool torture_samba3_rpc_sharesec(struct torture_context *torture)
2398 {
2399         struct smbcli_state *cli = NULL;
2400         struct security_descriptor *sd = NULL;
2401         struct dom_sid *user_sid = NULL;
2402         const char *testuser_passwd = NULL;
2403         struct cli_credentials *test_credentials = NULL;
2404         struct smbcli_options options;
2405         struct smbcli_session_options session_options;
2406         NTSTATUS status;
2407         struct test_join *tj = NULL;
2408         struct dcerpc_pipe *lsa_pipe = NULL;
2409         const char *priv_array[1];
2410
2411         /* Create a new user. The normal user has SeBackup and SeRestore
2412            privs so we can't lock them out with a share security descriptor. */
2413         tj = torture_create_testuser(torture,
2414                                         "sharesec_user",
2415                                         torture_setting_string(torture, "workgroup", NULL),
2416                                         ACB_NORMAL,
2417                                         &testuser_passwd);
2418         if (!tj) {
2419                 torture_fail(torture, "Creating sharesec_user failed\n");
2420         }
2421
2422         /* Give them SeDiskOperatorPrivilege but no other privs. */
2423         status = torture_rpc_connection(torture, &lsa_pipe, &ndr_table_lsarpc);
2424         if (!NT_STATUS_IS_OK(status)) {
2425                 torture_delete_testuser(torture, tj, "sharesec_user");
2426                 talloc_free(tj);
2427                 torture_fail(torture, "Error connecting to LSA pipe");
2428         }
2429
2430         priv_array[0] = "SeDiskOperatorPrivilege";
2431         if (!torture_setup_privs(torture,
2432                                 lsa_pipe,
2433                                 1,
2434                                 priv_array,
2435                                 torture_join_user_sid(tj))) {
2436                 talloc_free(lsa_pipe);
2437                 torture_delete_testuser(torture, tj, "sharesec_user");
2438                 talloc_free(tj);
2439                 torture_fail(torture, "Failed to setup privs\n");
2440         }
2441         talloc_free(lsa_pipe);
2442
2443         test_credentials = cli_credentials_init(torture);
2444         cli_credentials_set_workstation(test_credentials, "localhost", CRED_SPECIFIED);
2445         cli_credentials_set_domain(test_credentials, lpcfg_workgroup(torture->lp_ctx),
2446                         CRED_SPECIFIED);
2447         cli_credentials_set_username(test_credentials, "sharesec_user", CRED_SPECIFIED);
2448         cli_credentials_set_password(test_credentials, testuser_passwd, CRED_SPECIFIED);
2449
2450         ZERO_STRUCT(options);
2451         ZERO_STRUCT(session_options);
2452         lpcfg_smbcli_options(torture->lp_ctx, &options);
2453         lpcfg_smbcli_session_options(torture->lp_ctx, &session_options);
2454
2455         status = smbcli_full_connection(torture,
2456                                         &cli,
2457                                         torture_setting_string(torture, "host", NULL),
2458                                         lpcfg_smb_ports(torture->lp_ctx),
2459                                         "IPC$",
2460                                         NULL,
2461                                         lpcfg_socket_options(torture->lp_ctx),
2462                                         test_credentials,
2463                                         lpcfg_resolve_context(torture->lp_ctx),
2464                                         torture->ev,
2465                                         &options,
2466                                         &session_options,
2467                                         lpcfg_gensec_settings(torture, torture->lp_ctx));
2468         if (!NT_STATUS_IS_OK(status)) {
2469                 talloc_free(cli);
2470                 torture_delete_testuser(torture, tj, "sharesec_user");
2471                 talloc_free(tj);
2472                 torture_fail(torture, "Failed to open connection\n");
2473         }
2474
2475         if (!(user_sid = whoami(torture, torture, cli->tree))) {
2476                 talloc_free(cli);
2477                 torture_delete_testuser(torture, tj, "sharesec_user");
2478                 talloc_free(tj);
2479                 torture_fail(torture, "whoami failed\n");
2480         }
2481
2482         sd = get_sharesec(torture, torture, cli->session,
2483                           torture_setting_string(torture, "share", NULL));
2484
2485         if (!try_tcon(torture, torture, sd, cli->session,
2486                         torture_setting_string(torture, "share", NULL),
2487                         user_sid, 0, NT_STATUS_ACCESS_DENIED, NT_STATUS_OK)) {
2488                 talloc_free(cli);
2489                 torture_delete_testuser(torture, tj, "sharesec_user");
2490                 talloc_free(tj);
2491                 torture_fail(torture, "failed to test tcon with 0 access_mask");
2492         }
2493
2494         if (!try_tcon(torture, torture, sd, cli->session,
2495                         torture_setting_string(torture, "share", NULL),
2496                         user_sid, SEC_FILE_READ_DATA, NT_STATUS_OK,
2497                         NT_STATUS_MEDIA_WRITE_PROTECTED)) {
2498                 talloc_free(cli);
2499                 torture_delete_testuser(torture, tj, "sharesec_user");
2500                 talloc_free(tj);
2501                 torture_fail(torture, "failed to test tcon with SEC_FILE_READ_DATA access_mask");
2502         }
2503
2504         /* sharesec_user doesn't have any rights on the underlying file system.
2505            Go back to the normal user. */
2506
2507         talloc_free(cli);
2508         cli = NULL;
2509         torture_delete_testuser(torture, tj, "sharesec_user");
2510         talloc_free(tj);
2511         tj = NULL;
2512
2513         if (!(torture_open_connection_share(
2514                       torture, &cli, torture, torture_setting_string(torture, "host", NULL),
2515                       "IPC$", torture->ev))) {
2516                 torture_fail(torture, "IPC$ connection failed\n");
2517         }
2518
2519         if (!(user_sid = whoami(torture, torture, cli->tree))) {
2520                 torture_fail(torture, "whoami failed\n");
2521         }
2522         torture_assert(torture, try_tcon(
2523                         torture, torture, sd, cli->session,
2524                         torture_setting_string(torture, "share", NULL),
2525                         user_sid, SEC_FILE_ALL, NT_STATUS_OK, NT_STATUS_OK),
2526                         "failed to test tcon with SEC_FILE_ALL access_mask")
2527
2528         return true;
2529 }
2530
2531 static bool torture_samba3_rpc_lsa(struct torture_context *torture)
2532 {
2533         struct dcerpc_pipe *p;
2534         struct dcerpc_binding_handle *b;
2535         struct policy_handle lsa_handle;
2536
2537         torture_assert_ntstatus_ok(torture,
2538                 torture_rpc_connection(torture, &p, &ndr_table_lsarpc),
2539                 "failed to setup lsarpc");
2540
2541         b = p->binding_handle;
2542
2543         {
2544                 struct lsa_ObjectAttribute attr;
2545                 struct lsa_OpenPolicy2 o;
2546                 o.in.system_name = talloc_asprintf(
2547                         torture, "\\\\%s", dcerpc_server_name(p));
2548                 ZERO_STRUCT(attr);
2549                 o.in.attr = &attr;
2550                 o.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
2551                 o.out.handle = &lsa_handle;
2552
2553                 torture_assert_ntstatus_ok(torture,
2554                         dcerpc_lsa_OpenPolicy2_r(b, torture, &o),
2555                         "dcerpc_lsa_OpenPolicy2 failed");
2556                 torture_assert_ntstatus_ok(torture, o.out.result,
2557                         "dcerpc_lsa_OpenPolicy2 failed");
2558         }
2559
2560         {
2561                 int i;
2562                 int levels[] = { 2,3,5,6 };
2563
2564                 for (i=0; i<ARRAY_SIZE(levels); i++) {
2565                         struct lsa_QueryInfoPolicy r;
2566                         union lsa_PolicyInformation *info = NULL;
2567                         r.in.handle = &lsa_handle;
2568                         r.in.level = levels[i];
2569                         r.out.info = &info;
2570
2571                         torture_assert_ntstatus_ok(torture,
2572                                 dcerpc_lsa_QueryInfoPolicy_r(b, torture, &r),
2573                                 talloc_asprintf(torture, "dcerpc_lsa_QueryInfoPolicy level %d failed", levels[i]));
2574                         torture_assert_ntstatus_ok(torture, r.out.result,
2575                                 talloc_asprintf(torture, "dcerpc_lsa_QueryInfoPolicy level %d failed", levels[i]));
2576                 }
2577         }
2578
2579         return true;
2580 }
2581
2582 static NTSTATUS get_servername(TALLOC_CTX *mem_ctx, struct smbcli_tree *tree,
2583                                char **name)
2584 {
2585         struct rap_WserverGetInfo r;
2586         NTSTATUS status;
2587         char servername[17];
2588         size_t converted_size;
2589
2590         r.in.level = 0;
2591         r.in.bufsize = 0xffff;
2592
2593         status = smbcli_rap_netservergetinfo(tree, mem_ctx, &r);
2594         if (!NT_STATUS_IS_OK(status)) {
2595                 return status;
2596         }
2597
2598         memcpy(servername, r.out.info.info0.name, 16);
2599         servername[16] = '\0';
2600
2601         if (!pull_ascii_talloc(mem_ctx, name, servername, &converted_size)) {
2602                 return NT_STATUS_NO_MEMORY;
2603         }
2604
2605         return NT_STATUS_OK;
2606 }
2607
2608 static bool rap_get_servername(struct torture_context *tctx,
2609                                char **servername)
2610 {
2611         struct smbcli_state *cli;
2612
2613         torture_assert(tctx,
2614                 torture_open_connection_share(tctx, &cli, tctx, torture_setting_string(tctx, "host", NULL),
2615                                               "IPC$", tctx->ev),
2616                 "IPC$ connection failed");
2617
2618         torture_assert_ntstatus_ok(tctx,
2619                 get_servername(tctx, cli->tree, servername),
2620                 "get_servername failed");
2621
2622         talloc_free(cli);
2623
2624         return true;
2625 }
2626
2627 static bool find_printers(struct torture_context *tctx,
2628                           struct dcerpc_pipe *p,
2629                           const char ***printers,
2630                           int *num_printers)
2631 {
2632         struct srvsvc_NetShareEnum r;
2633         struct srvsvc_NetShareInfoCtr info_ctr;
2634         struct srvsvc_NetShareCtr1 c1_in;
2635         struct srvsvc_NetShareCtr1 *c1;
2636         uint32_t totalentries = 0;
2637         int i;
2638         struct dcerpc_binding_handle *b = p->binding_handle;
2639
2640         ZERO_STRUCT(c1_in);
2641         info_ctr.level = 1;
2642         info_ctr.ctr.ctr1 = &c1_in;
2643
2644         r.in.server_unc = talloc_asprintf(
2645                 tctx, "\\\\%s", dcerpc_server_name(p));
2646         r.in.info_ctr = &info_ctr;
2647         r.in.max_buffer = (uint32_t)-1;
2648         r.in.resume_handle = NULL;
2649         r.out.totalentries = &totalentries;
2650         r.out.info_ctr = &info_ctr;
2651
2652         torture_assert_ntstatus_ok(tctx,
2653                 dcerpc_srvsvc_NetShareEnum_r(b, tctx, &r),
2654                 "NetShareEnum level 1 failed");
2655         torture_assert_werr_ok(tctx, r.out.result,
2656                 "NetShareEnum level 1 failed");
2657
2658         *printers = NULL;
2659         *num_printers = 0;
2660         c1 = r.out.info_ctr->ctr.ctr1;
2661         for (i=0; i<c1->count; i++) {
2662                 if (c1->array[i].type != STYPE_PRINTQ) {
2663                         continue;
2664                 }
2665                 if (!add_string_to_array(tctx, c1->array[i].name,
2666                                          printers, num_printers)) {
2667                         return false;
2668                 }
2669         }
2670
2671         return true;
2672 }
2673
2674 static bool enumprinters(struct torture_context *tctx,
2675                          struct dcerpc_binding_handle *b,
2676                          const char *servername, int level, int *num_printers)
2677 {
2678         struct spoolss_EnumPrinters r;
2679         DATA_BLOB blob;
2680         uint32_t needed;
2681         uint32_t count;
2682         union spoolss_PrinterInfo *info;
2683
2684         r.in.flags = PRINTER_ENUM_LOCAL;
2685         r.in.server = talloc_asprintf(tctx, "\\\\%s", servername);
2686         r.in.level = level;
2687         r.in.buffer = NULL;
2688         r.in.offered = 0;
2689         r.out.needed = &needed;
2690         r.out.count = &count;
2691         r.out.info = &info;
2692
2693         torture_assert_ntstatus_ok(tctx,
2694                 dcerpc_spoolss_EnumPrinters_r(b, tctx, &r),
2695                 "dcerpc_spoolss_EnumPrinters failed");
2696         torture_assert_werr_equal(tctx, r.out.result, WERR_INSUFFICIENT_BUFFER,
2697                 "EnumPrinters unexpected return code should be WERR_INSUFFICIENT_BUFFER");
2698
2699         blob = data_blob_talloc_zero(tctx, needed);
2700         if (blob.data == NULL) {
2701                 return false;
2702         }
2703
2704         r.in.buffer = &blob;
2705         r.in.offered = needed;
2706
2707         torture_assert_ntstatus_ok(tctx,
2708                 dcerpc_spoolss_EnumPrinters_r(b, tctx, &r),
2709                 "dcerpc_spoolss_EnumPrinters failed");
2710         torture_assert_werr_ok(tctx, r.out.result,
2711                 "dcerpc_spoolss_EnumPrinters failed");
2712
2713         *num_printers = count;
2714
2715         return true;
2716 }
2717
2718 static bool getprinterinfo(struct torture_context *tctx,
2719                            struct dcerpc_binding_handle *b,
2720                            struct policy_handle *handle, int level,
2721                            union spoolss_PrinterInfo **res)
2722 {
2723         struct spoolss_GetPrinter r;
2724         DATA_BLOB blob;
2725         uint32_t needed;
2726
2727         r.in.handle = handle;
2728         r.in.level = level;
2729         r.in.buffer = NULL;
2730         r.in.offered = 0;
2731         r.out.needed = &needed;
2732
2733         torture_assert_ntstatus_ok(tctx,
2734                 dcerpc_spoolss_GetPrinter_r(b, tctx, &r),
2735                 "dcerpc_spoolss_GetPrinter failed");
2736         torture_assert_werr_equal(tctx, r.out.result, WERR_INSUFFICIENT_BUFFER,
2737                 "GetPrinter unexpected return code should be WERR_INSUFFICIENT_BUFFER");
2738
2739         r.in.handle = handle;
2740         r.in.level = level;
2741         blob = data_blob_talloc_zero(tctx, needed);
2742         if (blob.data == NULL) {
2743                 return false;
2744         }
2745         r.in.buffer = &blob;
2746         r.in.offered = needed;
2747
2748         torture_assert_ntstatus_ok(tctx,
2749                 dcerpc_spoolss_GetPrinter_r(b, tctx, &r),
2750                 "dcerpc_spoolss_GetPrinter failed");
2751         torture_assert_werr_ok(tctx, r.out.result,
2752                 "dcerpc_spoolss_GetPrinter failed");
2753
2754         if (res != NULL) {
2755                 *res = talloc_steal(tctx, r.out.info);
2756         }
2757
2758         return true;
2759 }
2760
2761 static bool torture_samba3_rpc_spoolss(struct torture_context *torture)
2762 {
2763         struct dcerpc_pipe *p, *p2;
2764         struct dcerpc_binding_handle *b;
2765         struct policy_handle server_handle, printer_handle;
2766         const char **printers;
2767         int num_printers;
2768         struct spoolss_UserLevel1 userlevel1;
2769         char *servername;
2770
2771         torture_assert(torture,
2772                 rap_get_servername(torture, &servername),
2773                 "failed to rap servername");
2774
2775         torture_assert_ntstatus_ok(torture,
2776                 torture_rpc_connection(torture, &p2, &ndr_table_srvsvc),
2777                 "failed to setup srvsvc");
2778
2779         torture_assert(torture,
2780                 find_printers(torture, p2, &printers, &num_printers),
2781                 "failed to find printers via srvsvc");
2782
2783         talloc_free(p2);
2784
2785         if (num_printers == 0) {
2786                 torture_skip(torture, "Did not find printers\n");
2787                 return true;
2788         }
2789
2790         torture_assert_ntstatus_ok(torture,
2791                 torture_rpc_connection(torture, &p, &ndr_table_spoolss),
2792                 "failed to setup spoolss");
2793
2794         b = p->binding_handle;
2795
2796         ZERO_STRUCT(userlevel1);
2797         userlevel1.client = talloc_asprintf(
2798                 torture, "\\\\%s", lpcfg_netbios_name(torture->lp_ctx));
2799         userlevel1.user = cli_credentials_get_username(cmdline_credentials);
2800         userlevel1.build = 2600;
2801         userlevel1.major = 3;
2802         userlevel1.minor = 0;
2803         userlevel1.processor = 0;
2804
2805         {
2806                 struct spoolss_OpenPrinterEx r;
2807
2808                 ZERO_STRUCT(r);
2809                 r.in.printername = talloc_asprintf(torture, "\\\\%s",
2810                                                    servername);
2811                 r.in.datatype = NULL;
2812                 r.in.access_mask = 0;
2813                 r.in.userlevel_ctr.level = 1;
2814                 r.in.userlevel_ctr.user_info.level1 = &userlevel1;
2815                 r.out.handle = &server_handle;
2816
2817                 torture_assert_ntstatus_ok(torture,
2818                         dcerpc_spoolss_OpenPrinterEx_r(b, torture, &r),
2819                         "dcerpc_spoolss_OpenPrinterEx failed");
2820                 torture_assert_werr_ok(torture, r.out.result,
2821                         "dcerpc_spoolss_OpenPrinterEx failed");
2822         }
2823
2824         {
2825                 struct spoolss_ClosePrinter r;
2826
2827                 r.in.handle = &server_handle;
2828                 r.out.handle = &server_handle;
2829
2830                 torture_assert_ntstatus_ok(torture,
2831                         dcerpc_spoolss_ClosePrinter_r(b, torture, &r),
2832                         "dcerpc_spoolss_ClosePrinter failed");
2833                 torture_assert_werr_ok(torture, r.out.result,
2834                         "dcerpc_spoolss_ClosePrinter failed");
2835         }
2836
2837         {
2838                 struct spoolss_OpenPrinterEx r;
2839
2840                 ZERO_STRUCT(r);
2841                 r.in.printername = talloc_asprintf(
2842                         torture, "\\\\%s\\%s", servername, printers[0]);
2843                 r.in.datatype = NULL;
2844                 r.in.access_mask = 0;
2845                 r.in.userlevel_ctr.level = 1;
2846                 r.in.userlevel_ctr.user_info.level1 = &userlevel1;
2847                 r.out.handle = &printer_handle;
2848
2849                 torture_assert_ntstatus_ok(torture,
2850                         dcerpc_spoolss_OpenPrinterEx_r(b, torture, &r),
2851                         "dcerpc_spoolss_OpenPrinterEx failed");
2852                 torture_assert_werr_ok(torture, r.out.result,
2853                         "dcerpc_spoolss_OpenPrinterEx failed");
2854         }
2855
2856         {
2857                 int i;
2858
2859                 for (i=0; i<8; i++) {
2860                         torture_assert(torture,
2861                                 getprinterinfo(torture, b, &printer_handle, i, NULL),
2862                                 talloc_asprintf(torture, "getprinterinfo %d failed", i));
2863                 }
2864         }
2865
2866         {
2867                 struct spoolss_ClosePrinter r;
2868
2869                 r.in.handle = &printer_handle;
2870                 r.out.handle = &printer_handle;
2871
2872                 torture_assert_ntstatus_ok(torture,
2873                         dcerpc_spoolss_ClosePrinter_r(b, torture, &r),
2874                         "dcerpc_spoolss_ClosePrinter failed");
2875                 torture_assert_werr_ok(torture, r.out.result,
2876                         "dcerpc_spoolss_ClosePrinter failed");
2877         }
2878
2879         {
2880                 int num_enumerated;
2881
2882                 torture_assert(torture,
2883                         enumprinters(torture, b, servername, 1, &num_enumerated),
2884                         "enumprinters failed");
2885
2886                 torture_assert_int_equal(torture, num_printers, num_enumerated,
2887                         "netshareenum / enumprinters lvl 1 numprinter mismatch");
2888         }
2889
2890         {
2891                 int num_enumerated;
2892
2893                 torture_assert(torture,
2894                         enumprinters(torture, b, servername, 2, &num_enumerated),
2895                         "enumprinters failed");
2896
2897                 torture_assert_int_equal(torture, num_printers, num_enumerated,
2898                         "netshareenum / enumprinters lvl 2 numprinter mismatch");
2899         }
2900
2901         return true;
2902 }
2903
2904 static bool torture_samba3_rpc_wkssvc(struct torture_context *torture)
2905 {
2906         struct dcerpc_pipe *p;
2907         struct dcerpc_binding_handle *b;
2908         char *servername;
2909
2910         torture_assert(torture,
2911                 rap_get_servername(torture, &servername),
2912                 "failed to rap servername");
2913
2914         torture_assert_ntstatus_ok(torture,
2915                 torture_rpc_connection(torture, &p, &ndr_table_wkssvc),
2916                 "failed to setup wkssvc");
2917
2918         b = p->binding_handle;
2919
2920         {
2921                 struct wkssvc_NetWkstaInfo100 wks100;
2922                 union wkssvc_NetWkstaInfo info;
2923                 struct wkssvc_NetWkstaGetInfo r;
2924
2925                 r.in.server_name = "\\foo";
2926                 r.in.level = 100;
2927                 info.info100 = &wks100;
2928                 r.out.info = &info;
2929
2930                 torture_assert_ntstatus_ok(torture,
2931                         dcerpc_wkssvc_NetWkstaGetInfo_r(b, torture, &r),
2932                         "dcerpc_wkssvc_NetWksGetInfo failed");
2933                 torture_assert_werr_ok(torture, r.out.result,
2934                         "dcerpc_wkssvc_NetWksGetInfo failed");
2935
2936                 torture_assert_str_equal(torture, servername, r.out.info->info100->server_name,
2937                         "servername RAP / DCERPC inconsistency");
2938         }
2939
2940         return true;
2941 }
2942
2943 static bool winreg_close(struct torture_context *tctx,
2944                          struct dcerpc_binding_handle *b,
2945                          struct policy_handle *handle)
2946 {
2947         struct winreg_CloseKey c;
2948
2949         c.in.handle = c.out.handle = handle;
2950
2951         torture_assert_ntstatus_ok(tctx,
2952                 dcerpc_winreg_CloseKey_r(b, tctx, &c),
2953                 "winreg_CloseKey failed");
2954         torture_assert_werr_ok(tctx, c.out.result,
2955                 "winreg_CloseKey failed");
2956
2957         return true;
2958 }
2959
2960 static bool enumvalues(struct torture_context *tctx,
2961                        struct dcerpc_binding_handle *b,
2962                        struct policy_handle *handle)
2963 {
2964         uint32_t enum_index = 0;
2965
2966         while (1) {
2967                 struct winreg_EnumValue r;
2968                 struct winreg_ValNameBuf name;
2969                 enum winreg_Type type = 0;
2970                 uint8_t buf8[1024];
2971                 NTSTATUS status;
2972                 uint32_t size, length;
2973
2974                 r.in.handle = handle;
2975                 r.in.enum_index = enum_index;
2976                 name.name = "";
2977                 name.size = 1024;
2978                 r.in.name = r.out.name = &name;
2979                 size = 1024;
2980                 length = 5;
2981                 r.in.type = &type;
2982                 r.in.value = buf8;
2983                 r.in.size = &size;
2984                 r.in.length = &length;
2985
2986                 status = dcerpc_winreg_EnumValue_r(b, tctx, &r);
2987                 if (!NT_STATUS_IS_OK(status) || !W_ERROR_IS_OK(r.out.result)) {
2988                         return true;
2989                 }
2990                 enum_index += 1;
2991         }
2992 }
2993
2994 static bool enumkeys(struct torture_context *tctx,
2995                      struct dcerpc_binding_handle *b,
2996                      struct policy_handle *handle,
2997                      int depth)
2998 {
2999         struct winreg_EnumKey r;
3000         struct winreg_StringBuf kclass, name;
3001         NTSTATUS status;
3002         NTTIME t = 0;
3003
3004         if (depth <= 0) {
3005                 return true;
3006         }
3007
3008         kclass.name   = "";
3009         kclass.size   = 1024;
3010
3011         r.in.handle = handle;
3012         r.in.enum_index = 0;
3013         r.in.name = &name;
3014         r.in.keyclass = &kclass;
3015         r.out.name = &name;
3016         r.in.last_changed_time = &t;
3017
3018         do {
3019                 struct winreg_OpenKey o;
3020                 struct policy_handle key_handle;
3021                 int i;
3022
3023                 name.name = NULL;
3024                 name.size = 1024;
3025
3026                 status = dcerpc_winreg_EnumKey_r(b, tctx, &r);
3027                 if (!NT_STATUS_IS_OK(status) || !W_ERROR_IS_OK(r.out.result)) {
3028                         /* We're done enumerating */
3029                         return true;
3030                 }
3031
3032                 for (i=0; i<10-depth; i++) {
3033                         torture_comment(tctx, " ");
3034                 }
3035                 torture_comment(tctx, "%s\n", r.out.name->name);
3036
3037                 o.in.parent_handle = handle;
3038                 o.in.keyname.name = r.out.name->name;
3039                 o.in.options = 0;
3040                 o.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
3041                 o.out.handle = &key_handle;
3042
3043                 status = dcerpc_winreg_OpenKey_r(b, tctx, &o);
3044                 if (NT_STATUS_IS_OK(status) && W_ERROR_IS_OK(o.out.result)) {
3045                         enumkeys(tctx, b, &key_handle, depth-1);
3046                         enumvalues(tctx, b, &key_handle);
3047                         torture_assert(tctx, winreg_close(tctx, b, &key_handle), "");
3048                 }
3049
3050                 r.in.enum_index += 1;
3051         } while(true);
3052
3053         return true;
3054 }
3055
3056 typedef NTSTATUS (*winreg_open_fn)(struct dcerpc_binding_handle *, TALLOC_CTX *, void *);
3057
3058 static bool test_Open3(struct torture_context *tctx,
3059                        struct dcerpc_binding_handle *b,
3060                        const char *name, winreg_open_fn open_fn)
3061 {
3062         struct policy_handle handle;
3063         struct winreg_OpenHKLM r;
3064
3065         r.in.system_name = 0;
3066         r.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
3067         r.out.handle = &handle;
3068
3069         torture_assert_ntstatus_ok(tctx,
3070                 open_fn(b, tctx, &r),
3071                 talloc_asprintf(tctx, "%s failed", name));
3072         torture_assert_werr_ok(tctx, r.out.result,
3073                 talloc_asprintf(tctx, "%s failed", name));
3074
3075         enumkeys(tctx, b, &handle, 4);
3076
3077         torture_assert(tctx,
3078                 winreg_close(tctx, b, &handle),
3079                 "dcerpc_CloseKey failed");
3080
3081         return true;
3082 }
3083
3084 static bool torture_samba3_rpc_winreg(struct torture_context *torture)
3085 {
3086         struct dcerpc_pipe *p;
3087         struct dcerpc_binding_handle *b;
3088         bool ret = true;
3089         struct {
3090                 const char *name;
3091                 winreg_open_fn fn;
3092         } open_fns[] = {
3093                 {"OpenHKLM", (winreg_open_fn)dcerpc_winreg_OpenHKLM_r },
3094                 {"OpenHKU",  (winreg_open_fn)dcerpc_winreg_OpenHKU_r },
3095                 {"OpenHKPD", (winreg_open_fn)dcerpc_winreg_OpenHKPD_r },
3096                 {"OpenHKPT", (winreg_open_fn)dcerpc_winreg_OpenHKPT_r },
3097                 {"OpenHKCR", (winreg_open_fn)dcerpc_winreg_OpenHKCR_r }};
3098 #if 0
3099         int i;
3100 #endif
3101
3102         torture_assert_ntstatus_ok(torture,
3103                 torture_rpc_connection(torture, &p, &ndr_table_winreg),
3104                 "failed to setup winreg");
3105
3106         b = p->binding_handle;
3107
3108 #if 1
3109         ret = test_Open3(torture, b, open_fns[0].name, open_fns[0].fn);
3110 #else
3111         for (i = 0; i < ARRAY_SIZE(open_fns); i++) {
3112                 if (!test_Open3(torture, b, open_fns[i].name, open_fns[i].fn))
3113                         ret = false;
3114         }
3115 #endif
3116         return ret;
3117 }
3118
3119 static bool get_shareinfo(struct torture_context *tctx,
3120                           struct dcerpc_binding_handle *b,
3121                           const char *servername,
3122                           const char *share,
3123                           struct srvsvc_NetShareInfo502 **info502)
3124 {
3125         struct srvsvc_NetShareGetInfo r;
3126         union srvsvc_NetShareInfo info;
3127
3128         r.in.server_unc = talloc_asprintf(tctx, "\\\\%s", servername);
3129         r.in.share_name = share;
3130         r.in.level = 502;
3131         r.out.info = &info;
3132
3133         torture_assert_ntstatus_ok(tctx,
3134                 dcerpc_srvsvc_NetShareGetInfo_r(b, tctx, &r),
3135                 "srvsvc_NetShareGetInfo failed");
3136         torture_assert_werr_ok(tctx, r.out.result,
3137                 "srvsvc_NetShareGetInfo failed");
3138
3139         *info502 = talloc_move(tctx, &info.info502);
3140
3141         return true;
3142 }
3143
3144 /*
3145  * Get us a handle on HKLM\
3146  */
3147
3148 static bool get_hklm_handle(struct torture_context *tctx,
3149                             struct dcerpc_binding_handle *b,
3150                             struct policy_handle *handle)
3151 {
3152         struct winreg_OpenHKLM r;
3153         struct policy_handle result;
3154
3155         r.in.system_name = 0;
3156         r.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
3157         r.out.handle = &result;
3158
3159         torture_assert_ntstatus_ok(tctx,
3160                 dcerpc_winreg_OpenHKLM_r(b, tctx, &r),
3161                 "OpenHKLM failed");
3162         torture_assert_werr_ok(tctx, r.out.result,
3163                 "OpenHKLM failed");
3164
3165         *handle = result;
3166
3167         return true;
3168 }
3169
3170 static bool torture_samba3_createshare(struct torture_context *tctx,
3171                                        struct dcerpc_binding_handle *b,
3172                                        const char *sharename)
3173 {
3174         struct policy_handle hklm;
3175         struct policy_handle new_handle;
3176         struct winreg_CreateKey c;
3177         struct winreg_CloseKey cl;
3178         enum winreg_CreateAction action_taken;
3179
3180         c.in.handle = &hklm;
3181         c.in.name.name = talloc_asprintf(
3182                 tctx, "software\\samba\\smbconf\\%s", sharename);
3183         torture_assert(tctx, c.in.name.name, "talloc_asprintf failed");
3184
3185         c.in.keyclass.name = "";
3186         c.in.options = 0;
3187         c.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
3188         c.in.secdesc = NULL;
3189         c.in.action_taken = &action_taken;
3190         c.out.new_handle = &new_handle;
3191         c.out.action_taken = &action_taken;
3192
3193         torture_assert_ntstatus_ok(tctx,
3194                 dcerpc_winreg_CreateKey_r(b, tctx, &c),
3195                 "OpenKey failed");
3196         torture_assert_werr_ok(tctx, c.out.result,
3197                 "OpenKey failed");
3198
3199         cl.in.handle = &new_handle;
3200         cl.out.handle = &new_handle;
3201
3202         torture_assert_ntstatus_ok(tctx,
3203                 dcerpc_winreg_CloseKey_r(b, tctx, &cl),
3204                 "CloseKey failed");
3205         torture_assert_werr_ok(tctx, cl.out.result,
3206                 "CloseKey failed");
3207
3208         return true;
3209 }
3210
3211 static bool torture_samba3_deleteshare(struct torture_context *tctx,
3212                                        struct dcerpc_binding_handle *b,
3213                                        const char *sharename)
3214 {
3215         struct policy_handle hklm;
3216         struct winreg_DeleteKey d;
3217
3218         torture_assert(tctx,
3219                 get_hklm_handle(tctx, b, &hklm),
3220                 "get_hklm_handle failed");
3221
3222         d.in.handle = &hklm;
3223         d.in.key.name = talloc_asprintf(
3224                 tctx, "software\\samba\\smbconf\\%s", sharename);
3225         torture_assert(tctx, d.in.key.name, "talloc_asprintf failed");
3226
3227         torture_assert_ntstatus_ok(tctx,
3228                 dcerpc_winreg_DeleteKey_r(b, tctx, &d),
3229                 "DeleteKey failed");
3230         torture_assert_werr_ok(tctx, d.out.result,
3231                 "DeleteKey failed");
3232
3233         return true;
3234 }
3235
3236 static bool torture_samba3_setconfig(struct torture_context *tctx,
3237                                      struct dcerpc_binding_handle *b,
3238                                      const char *sharename,
3239                                      const char *parameter,
3240                                      const char *value)
3241 {
3242         struct policy_handle hklm, key_handle;
3243         struct winreg_OpenKey o;
3244         struct winreg_SetValue s;
3245         uint32_t type;
3246         DATA_BLOB val;
3247
3248         torture_assert(tctx,
3249                 get_hklm_handle(tctx, b, &hklm),
3250                 "get_hklm_handle failed");
3251
3252         o.in.parent_handle = &hklm;
3253         o.in.keyname.name = talloc_asprintf(
3254                 tctx, "software\\samba\\smbconf\\%s", sharename);
3255         torture_assert(tctx, o.in.keyname.name, "talloc_asprintf failed");
3256
3257         o.in.options = 0;
3258         o.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
3259         o.out.handle = &key_handle;
3260
3261         torture_assert_ntstatus_ok(tctx,
3262                 dcerpc_winreg_OpenKey_r(b, tctx, &o),
3263                 "OpenKey failed");
3264         torture_assert_werr_ok(tctx, o.out.result,
3265                 "OpenKey failed");
3266
3267         torture_assert(tctx,
3268                 reg_string_to_val(tctx, "REG_SZ", value, &type, &val),
3269                 "reg_string_to_val failed");
3270
3271         s.in.handle = &key_handle;
3272         s.in.name.name = parameter;
3273         s.in.type = type;
3274         s.in.data = val.data;
3275         s.in.size = val.length;
3276
3277         torture_assert_ntstatus_ok(tctx,
3278                 dcerpc_winreg_SetValue_r(b, tctx, &s),
3279                 "SetValue failed");
3280         torture_assert_werr_ok(tctx, s.out.result,
3281                 "SetValue failed");
3282
3283         return true;
3284 }
3285
3286 static bool torture_samba3_regconfig(struct torture_context *torture)
3287 {
3288         struct srvsvc_NetShareInfo502 *i = NULL;
3289         const char *comment = "Dummer Kommentar";
3290         struct dcerpc_pipe *srvsvc_pipe, *winreg_pipe;
3291
3292         torture_assert_ntstatus_ok(torture,
3293                 torture_rpc_connection(torture, &srvsvc_pipe, &ndr_table_srvsvc),
3294                 "failed to setup srvsvc");
3295
3296         torture_assert_ntstatus_ok(torture,
3297                 torture_rpc_connection(torture, &winreg_pipe, &ndr_table_winreg),
3298                 "failed to setup winreg");
3299
3300         torture_assert(torture,
3301                 torture_samba3_createshare(torture, winreg_pipe->binding_handle, "blubber"),
3302                 "torture_samba3_createshare failed");
3303
3304         torture_assert(torture,
3305                 torture_samba3_setconfig(torture, winreg_pipe->binding_handle, "blubber", "comment", comment),
3306                 "torture_samba3_setconfig failed");
3307
3308         torture_assert(torture,
3309                 get_shareinfo(torture, srvsvc_pipe->binding_handle, dcerpc_server_name(srvsvc_pipe), "blubber", &i),
3310                 "get_shareinfo failed");
3311
3312         torture_assert_str_equal(torture, comment, i->comment,
3313                 "got unexpected comment");
3314
3315         torture_assert(torture,
3316                 torture_samba3_deleteshare(torture, winreg_pipe->binding_handle, "blubber"),
3317                 "torture_samba3_deleteshare failed");
3318
3319         return true;
3320 }
3321
3322 /*
3323  * Test that even with a result of 0 rids the array is returned as a
3324  * non-NULL pointer. Yes, XP does notice.
3325  */
3326
3327 bool torture_samba3_getaliasmembership_0(struct torture_context *torture)
3328 {
3329         struct dcerpc_pipe *p;
3330         struct dcerpc_binding_handle *b;
3331         struct samr_Connect2 c;
3332         struct samr_OpenDomain o;
3333         struct dom_sid sid;
3334         struct lsa_SidPtr ptr;
3335         struct lsa_SidArray sids;
3336         struct samr_GetAliasMembership g;
3337         struct samr_Ids rids;
3338         struct policy_handle samr, domain;
3339
3340         torture_assert_ntstatus_ok(torture,
3341                 torture_rpc_connection(torture, &p, &ndr_table_samr),
3342                 "failed to setup samr");
3343
3344         b = p->binding_handle;
3345
3346         c.in.system_name = NULL;
3347         c.in.access_mask = SAMR_ACCESS_LOOKUP_DOMAIN;
3348         c.out.connect_handle = &samr;
3349         torture_assert_ntstatus_ok(torture,
3350                 dcerpc_samr_Connect2_r(b, torture, &c),
3351                 "");
3352         torture_assert_ntstatus_ok(torture, c.out.result,
3353                 "");
3354         dom_sid_parse("S-1-5-32", &sid);
3355         o.in.connect_handle = &samr;
3356         o.in.access_mask = SAMR_DOMAIN_ACCESS_LOOKUP_ALIAS;
3357         o.in.sid = &sid;
3358         o.out.domain_handle = &domain;
3359         torture_assert_ntstatus_ok(torture,
3360                 dcerpc_samr_OpenDomain_r(b, torture, &o),
3361                 "");
3362         torture_assert_ntstatus_ok(torture, o.out.result,
3363                 "");
3364         dom_sid_parse("S-1-2-3-4-5", &sid);
3365         ptr.sid = &sid;
3366         sids.num_sids = 1;
3367         sids.sids = &ptr;
3368         g.in.domain_handle = &domain;
3369         g.in.sids = &sids;
3370         g.out.rids = &rids;
3371         torture_assert_ntstatus_ok(torture,
3372                 dcerpc_samr_GetAliasMembership_r(b, torture, &g),
3373                 "");
3374         torture_assert_ntstatus_ok(torture, g.out.result,
3375                 "");
3376         if (rids.ids == NULL) {
3377                 /* This is the piece to test here */
3378                 torture_fail(torture,
3379                         "torture_samba3_getaliasmembership_0: "
3380                         "Server returns NULL rids array\n");
3381         }
3382
3383         return true;
3384 }
3385
3386 /**
3387  * Test smb reauthentication while rpc pipe is in use.
3388  */
3389 static bool torture_rpc_smb_reauth1(struct torture_context *torture)
3390 {
3391         TALLOC_CTX *mem_ctx;
3392         NTSTATUS status;
3393         bool ret = false;
3394         struct smbcli_state *cli;
3395         struct smbcli_options options;
3396         struct smbcli_session_options session_options;
3397
3398         struct dcerpc_pipe *lsa_pipe;
3399         struct dcerpc_binding_handle *lsa_handle;
3400         struct lsa_GetUserName r;
3401         struct lsa_String *authority_name_p = NULL;
3402         char *authority_name_saved = NULL;
3403         struct lsa_String *account_name_p = NULL;
3404         char *account_name_saved = NULL;
3405         struct cli_credentials *anon_creds = NULL;
3406         struct smb_composite_sesssetup io;
3407
3408         mem_ctx = talloc_init("torture_samba3_reauth");
3409         torture_assert(torture, (mem_ctx != NULL), "talloc_init failed");
3410
3411         lpcfg_smbcli_options(torture->lp_ctx, &options);
3412         lpcfg_smbcli_session_options(torture->lp_ctx, &session_options);
3413
3414         status = smbcli_full_connection(mem_ctx, &cli,
3415                                         torture_setting_string(torture, "host", NULL),
3416                                         lpcfg_smb_ports(torture->lp_ctx),
3417                                         "IPC$", NULL,
3418                                         lpcfg_socket_options(torture->lp_ctx),
3419                                         cmdline_credentials,
3420                                         lpcfg_resolve_context(torture->lp_ctx),
3421                                         torture->ev, &options, &session_options,
3422                                         lpcfg_gensec_settings(torture, torture->lp_ctx));
3423         torture_assert_ntstatus_ok_goto(torture, status, ret, done,
3424                                         "smbcli_full_connection failed");
3425
3426         lsa_pipe = dcerpc_pipe_init(mem_ctx, torture->ev);
3427         torture_assert_goto(torture, (lsa_pipe != NULL), ret, done,
3428                             "dcerpc_pipe_init failed");
3429         lsa_handle = lsa_pipe->binding_handle;
3430
3431         status = dcerpc_pipe_open_smb(lsa_pipe, cli->tree, "\\lsarpc");
3432         torture_assert_ntstatus_ok_goto(torture, status, ret, done,
3433                                         "dcerpc_pipe_open failed");
3434
3435         status = dcerpc_bind_auth_none(lsa_pipe, &ndr_table_lsarpc);
3436         torture_assert_ntstatus_ok_goto(torture, status, ret, done,
3437                                         "dcerpc_bind_auth_none failed");
3438
3439         /* lsa getusername */
3440
3441         ZERO_STRUCT(r);
3442         r.in.system_name = "\\";
3443         r.in.account_name = &account_name_p;
3444         r.in.authority_name = &authority_name_p;
3445         r.out.account_name = &account_name_p;
3446
3447         status = dcerpc_lsa_GetUserName_r(lsa_handle, mem_ctx, &r);
3448
3449         authority_name_p = *r.out.authority_name;
3450
3451         torture_assert_ntstatus_ok_goto(torture, status, ret, done,
3452                                         "GetUserName failed");
3453         torture_assert_ntstatus_ok_goto(torture, r.out.result, ret, done,
3454                                         "GetUserName failed");
3455
3456         torture_comment(torture, "lsa_GetUserName gave '%s\\%s'\n",
3457                         authority_name_p->string,
3458                         account_name_p->string);
3459
3460         account_name_saved = talloc_strdup(mem_ctx, account_name_p->string);
3461         torture_assert_goto(torture, (account_name_saved != NULL), ret, done,
3462                             "talloc failed");
3463         authority_name_saved = talloc_strdup(mem_ctx, authority_name_p->string);
3464         torture_assert_goto(torture, (authority_name_saved != NULL), ret, done,
3465                             "talloc failed");
3466
3467         /* smb re-authenticate as anonymous */
3468
3469         anon_creds = cli_credentials_init_anon(mem_ctx);
3470
3471         ZERO_STRUCT(io);
3472         io.in.sesskey         = cli->transport->negotiate.sesskey;
3473         io.in.capabilities    = cli->transport->negotiate.capabilities;
3474         io.in.credentials     = anon_creds;
3475         io.in.workgroup       = lpcfg_workgroup(torture->lp_ctx);
3476         io.in.gensec_settings = lpcfg_gensec_settings(torture, torture->lp_ctx);
3477
3478         status = smb_composite_sesssetup(cli->session, &io);
3479         torture_assert_ntstatus_ok_goto(torture, status, ret, done,
3480                                         "session reauth to anon failed");
3481
3482         /* re-do lsa getusername after reauth */
3483
3484         TALLOC_FREE(authority_name_p);
3485         TALLOC_FREE(account_name_p);
3486         ZERO_STRUCT(r);
3487         r.in.system_name = "\\";
3488         r.in.account_name = &account_name_p;
3489         r.in.authority_name = &authority_name_p;
3490         r.out.account_name = &account_name_p;
3491
3492         status = dcerpc_lsa_GetUserName_r(lsa_handle, mem_ctx, &r);
3493
3494         authority_name_p = *r.out.authority_name;
3495
3496         torture_assert_ntstatus_ok_goto(torture, status, ret, done,
3497                                         "GetUserName failed");
3498         torture_assert_ntstatus_ok_goto(torture, r.out.result, ret, done,
3499                                         "GetUserName failed");
3500
3501         torture_assert_goto(torture, (strcmp(authority_name_p->string, authority_name_saved) == 0),
3502                             ret, done, "authority_name not equal after reauth to anon");
3503         torture_assert_goto(torture, (strcmp(account_name_p->string, account_name_saved) == 0),
3504                             ret, done, "account_name not equal after reauth to anon");
3505
3506         /* smb re-auth again to the original user */
3507
3508         ZERO_STRUCT(io);
3509         io.in.sesskey         = cli->transport->negotiate.sesskey;
3510         io.in.capabilities    = cli->transport->negotiate.capabilities;
3511         io.in.credentials     = cmdline_credentials;
3512         io.in.workgroup       = lpcfg_workgroup(torture->lp_ctx);
3513         io.in.gensec_settings = lpcfg_gensec_settings(torture, torture->lp_ctx);
3514
3515         status = smb_composite_sesssetup(cli->session, &io);
3516         torture_assert_ntstatus_ok_goto(torture, status, ret, done,
3517                                         "session reauth to anon failed");
3518
3519         /* re-do lsa getusername */
3520
3521         TALLOC_FREE(authority_name_p);
3522         TALLOC_FREE(account_name_p);
3523         ZERO_STRUCT(r);
3524         r.in.system_name = "\\";
3525         r.in.account_name = &account_name_p;
3526         r.in.authority_name = &authority_name_p;
3527         r.out.account_name = &account_name_p;
3528
3529         status = dcerpc_lsa_GetUserName_r(lsa_handle, mem_ctx, &r);
3530
3531         authority_name_p = *r.out.authority_name;
3532
3533         torture_assert_ntstatus_ok_goto(torture, status, ret, done,
3534                                         "GetUserName failed");
3535         torture_assert_ntstatus_ok_goto(torture, r.out.result, ret, done,
3536                                         "GetUserName failed");
3537
3538         torture_assert_goto(torture, (strcmp(authority_name_p->string, authority_name_saved) == 0),
3539                             ret, done, "authority_name not equal after reauth to anon");
3540         torture_assert_goto(torture, (strcmp(account_name_p->string, account_name_saved) == 0),
3541                             ret, done, "account_name not equal after reauth to anon");
3542
3543         ret = true;
3544
3545 done:
3546         talloc_free(mem_ctx);
3547         return ret;
3548 }
3549
3550 /**
3551  * Test smb reauthentication while rpc pipe is in use.
3552  * Open a second lsa bind after reauth to anon.
3553  * Do lsa getusername on that second bind.
3554  */
3555 static bool torture_rpc_smb_reauth2(struct torture_context *torture)
3556 {
3557         TALLOC_CTX *mem_ctx;
3558         NTSTATUS status;
3559         bool ret = false;
3560         struct smbcli_state *cli;
3561         struct smbcli_options options;
3562         struct smbcli_session_options session_options;
3563
3564         struct dcerpc_pipe *lsa_pipe;
3565         struct dcerpc_binding_handle *lsa_handle;
3566         struct lsa_GetUserName r;
3567         struct lsa_String *authority_name_p = NULL;
3568         char *authority_name_saved = NULL;
3569         struct lsa_String *account_name_p = NULL;
3570         char *account_name_saved = NULL;
3571         struct cli_credentials *anon_creds = NULL;
3572         struct smb_composite_sesssetup io;
3573
3574         mem_ctx = talloc_init("torture_samba3_reauth");
3575         torture_assert(torture, (mem_ctx != NULL), "talloc_init failed");
3576
3577         lpcfg_smbcli_options(torture->lp_ctx, &options);
3578         lpcfg_smbcli_session_options(torture->lp_ctx, &session_options);
3579
3580         status = smbcli_full_connection(mem_ctx, &cli,
3581                                         torture_setting_string(torture, "host", NULL),
3582                                         lpcfg_smb_ports(torture->lp_ctx),
3583                                         "IPC$", NULL,
3584                                         lpcfg_socket_options(torture->lp_ctx),
3585                                         cmdline_credentials,
3586                                         lpcfg_resolve_context(torture->lp_ctx),
3587                                         torture->ev, &options, &session_options,
3588                                         lpcfg_gensec_settings(torture, torture->lp_ctx));
3589         torture_assert_ntstatus_ok_goto(torture, status, ret, done,
3590                                         "smbcli_full_connection failed");
3591
3592         /* smb re-authenticate as anonymous */
3593
3594         anon_creds = cli_credentials_init_anon(mem_ctx);
3595
3596         ZERO_STRUCT(io);
3597         io.in.sesskey         = cli->transport->negotiate.sesskey;
3598         io.in.capabilities    = cli->transport->negotiate.capabilities;
3599         io.in.credentials     = anon_creds;
3600         io.in.workgroup       = lpcfg_workgroup(torture->lp_ctx);
3601         io.in.gensec_settings = lpcfg_gensec_settings(torture, torture->lp_ctx);
3602
3603         status = smb_composite_sesssetup(cli->session, &io);
3604         torture_assert_ntstatus_ok_goto(torture, status, ret, done,
3605                                         "session reauth to anon failed");
3606
3607         /* open the lsa pipe */
3608
3609         lsa_pipe = dcerpc_pipe_init(mem_ctx, torture->ev);
3610         torture_assert_goto(torture, (lsa_pipe != NULL), ret, done,
3611                             "dcerpc_pipe_init failed");
3612         lsa_handle = lsa_pipe->binding_handle;
3613
3614         status = dcerpc_pipe_open_smb(lsa_pipe, cli->tree, "\\lsarpc");
3615         torture_assert_ntstatus_ok_goto(torture, status, ret, done,
3616                                         "dcerpc_pipe_open failed");
3617
3618         status = dcerpc_bind_auth_none(lsa_pipe, &ndr_table_lsarpc);
3619         torture_assert_ntstatus_ok_goto(torture, status, ret, done,
3620                                         "dcerpc_bind_auth_none failed");
3621
3622         /* lsa getusername */
3623
3624         ZERO_STRUCT(r);
3625         r.in.system_name = "\\";
3626         r.in.account_name = &account_name_p;
3627         r.in.authority_name = &authority_name_p;
3628         r.out.account_name = &account_name_p;
3629
3630         status = dcerpc_lsa_GetUserName_r(lsa_handle, mem_ctx, &r);
3631
3632         authority_name_p = *r.out.authority_name;
3633
3634         torture_assert_ntstatus_ok_goto(torture, status, ret, done,
3635                                         "GetUserName failed");
3636         torture_assert_ntstatus_ok_goto(torture, r.out.result, ret, done,
3637                                         "GetUserName failed");
3638
3639         torture_comment(torture, "lsa_GetUserName gave '%s\\%s'\n",
3640                         authority_name_p->string,
3641                         account_name_p->string);
3642
3643         account_name_saved = talloc_strdup(mem_ctx, account_name_p->string);
3644         torture_assert_goto(torture, (account_name_saved != NULL), ret, done,
3645                             "talloc failed");
3646         authority_name_saved = talloc_strdup(mem_ctx, authority_name_p->string);
3647         torture_assert_goto(torture, (authority_name_saved != NULL), ret, done,
3648                             "talloc failed");
3649
3650         /* smb re-auth again to the original user */
3651
3652         ZERO_STRUCT(io);
3653         io.in.sesskey         = cli->transport->negotiate.sesskey;
3654         io.in.capabilities    = cli->transport->negotiate.capabilities;
3655         io.in.credentials     = cmdline_credentials;
3656         io.in.workgroup       = lpcfg_workgroup(torture->lp_ctx);
3657         io.in.gensec_settings = lpcfg_gensec_settings(torture, torture->lp_ctx);
3658
3659         status = smb_composite_sesssetup(cli->session, &io);
3660         torture_assert_ntstatus_ok_goto(torture, status, ret, done,
3661                                         "session reauth to anon failed");
3662
3663         /* re-do lsa getusername after reauth */
3664
3665         TALLOC_FREE(authority_name_p);
3666         TALLOC_FREE(account_name_p);
3667         ZERO_STRUCT(r);
3668         r.in.system_name = "\\";
3669         r.in.account_name = &account_name_p;
3670         r.in.authority_name = &authority_name_p;
3671         r.out.account_name = &account_name_p;
3672
3673         status = dcerpc_lsa_GetUserName_r(lsa_handle, mem_ctx, &r);
3674
3675         authority_name_p = *r.out.authority_name;
3676
3677         torture_assert_ntstatus_ok_goto(torture, status, ret, done,
3678                                         "GetUserName failed");
3679         torture_assert_ntstatus_ok_goto(torture, r.out.result, ret, done,
3680                                         "GetUserName failed");
3681
3682         torture_assert_goto(torture, (strcmp(authority_name_p->string, authority_name_saved) == 0),
3683                             ret, done, "authority_name not equal after reauth to anon");
3684         torture_assert_goto(torture, (strcmp(account_name_p->string, account_name_saved) == 0),
3685                             ret, done, "account_name not equal after reauth to anon");
3686
3687         ret = true;
3688
3689 done:
3690         talloc_free(mem_ctx);
3691         return ret;
3692 }
3693
3694 /**
3695  * Test smb2 reauthentication while rpc pipe is in use.
3696  */
3697 static bool torture_rpc_smb2_reauth1(struct torture_context *torture)
3698 {
3699         TALLOC_CTX *mem_ctx;
3700         NTSTATUS status;
3701         bool ret = false;
3702         struct smbcli_options options;
3703
3704         struct dcerpc_pipe *lsa_pipe;
3705         struct dcerpc_binding_handle *lsa_handle;
3706         struct lsa_GetUserName r;
3707         struct lsa_String *authority_name_p = NULL;
3708         char *authority_name_saved = NULL;
3709         struct lsa_String *account_name_p = NULL;
3710         char *account_name_saved = NULL;
3711         struct cli_credentials *anon_creds = NULL;
3712         const char *host = torture_setting_string(torture, "host", NULL);
3713         struct smb2_tree *tree;
3714
3715         mem_ctx = talloc_init("torture_samba3_reauth");
3716         torture_assert(torture, (mem_ctx != NULL), "talloc_init failed");
3717
3718         lpcfg_smbcli_options(torture->lp_ctx, &options);
3719
3720         status = smb2_connect(mem_ctx,
3721                               host,
3722                               lpcfg_smb_ports(torture->lp_ctx),
3723                               "IPC$",
3724                               lpcfg_resolve_context(torture->lp_ctx),
3725                               cmdline_credentials,
3726                               &tree,
3727                               torture->ev,
3728                               &options,
3729                               lpcfg_socket_options(torture->lp_ctx),
3730                               lpcfg_gensec_settings(torture, torture->lp_ctx)
3731                               );
3732         torture_assert_ntstatus_ok_goto(torture, status, ret, done,
3733                                         "smb2_connect failed");
3734
3735         lsa_pipe = dcerpc_pipe_init(mem_ctx, torture->ev);
3736         torture_assert_goto(torture, (lsa_pipe != NULL), ret, done,
3737                             "dcerpc_pipe_init failed");
3738         lsa_handle = lsa_pipe->binding_handle;
3739
3740         status = dcerpc_pipe_open_smb2(lsa_pipe, tree, "lsarpc");
3741         torture_assert_ntstatus_ok_goto(torture, status, ret, done,
3742                                         "dcerpc_pipe_open_smb2 failed");
3743
3744         status = dcerpc_bind_auth_none(lsa_pipe, &ndr_table_lsarpc);
3745         torture_assert_ntstatus_ok_goto(torture, status, ret, done,
3746                                         "dcerpc_bind_auth_none failed");
3747
3748         /* lsa getusername */
3749
3750         ZERO_STRUCT(r);
3751         r.in.system_name = "\\";
3752         r.in.account_name = &account_name_p;
3753         r.in.authority_name = &authority_name_p;
3754         r.out.account_name = &account_name_p;
3755
3756         status = dcerpc_lsa_GetUserName_r(lsa_handle, mem_ctx, &r);
3757
3758         authority_name_p = *r.out.authority_name;
3759
3760         torture_assert_ntstatus_ok_goto(torture, status, ret, done,
3761                                         "GetUserName failed");
3762         torture_assert_ntstatus_ok_goto(torture, r.out.result, ret, done,
3763                                         "GetUserName failed");
3764
3765         torture_comment(torture, "lsa_GetUserName gave '%s\\%s'\n",
3766                         authority_name_p->string,
3767                         account_name_p->string);
3768
3769         account_name_saved = talloc_strdup(mem_ctx, account_name_p->string);
3770         torture_assert_goto(torture, (account_name_saved != NULL), ret, done,
3771                             "talloc failed");
3772         authority_name_saved = talloc_strdup(mem_ctx, authority_name_p->string);
3773         torture_assert_goto(torture, (authority_name_saved != NULL), ret, done,
3774                             "talloc failed");
3775
3776         /* smb re-authenticate as anonymous */
3777
3778         anon_creds = cli_credentials_init_anon(mem_ctx);
3779
3780         status = smb2_session_setup_spnego(tree->session,
3781                                            anon_creds,
3782                                            0 /* previous_session_id */);
3783         torture_assert_ntstatus_ok_goto(torture, status, ret, done,
3784                                         "session reauth to anon failed");
3785
3786         /* re-do lsa getusername after reauth */
3787
3788         TALLOC_FREE(authority_name_p);
3789         TALLOC_FREE(account_name_p);
3790         ZERO_STRUCT(r);
3791         r.in.system_name = "\\";
3792         r.in.account_name = &account_name_p;
3793         r.in.authority_name = &authority_name_p;
3794         r.out.account_name = &account_name_p;
3795
3796         status = dcerpc_lsa_GetUserName_r(lsa_handle, mem_ctx, &r);
3797
3798         authority_name_p = *r.out.authority_name;
3799
3800         torture_assert_ntstatus_ok_goto(torture, status, ret, done,
3801                                         "GetUserName failed");
3802         torture_assert_ntstatus_ok_goto(torture, r.out.result, ret, done,
3803                                         "GetUserName failed");
3804
3805         torture_assert_goto(torture, (strcmp(authority_name_p->string, authority_name_saved) == 0),
3806                             ret, done, "authority_name not equal after reauth to anon");
3807         torture_assert_goto(torture, (strcmp(account_name_p->string, account_name_saved) == 0),
3808                             ret, done, "account_name not equal after reauth to anon");
3809
3810         /* smb re-auth again to the original user */
3811
3812         status = smb2_session_setup_spnego(tree->session,
3813                                            cmdline_credentials,
3814                                            0 /* previous_session_id */);
3815         torture_assert_ntstatus_ok_goto(torture, status, ret, done,
3816                                         "session reauth to anon failed");
3817
3818         /* re-do lsa getusername */
3819
3820         TALLOC_FREE(authority_name_p);
3821         TALLOC_FREE(account_name_p);
3822         ZERO_STRUCT(r);
3823         r.in.system_name = "\\";
3824         r.in.account_name = &account_name_p;
3825         r.in.authority_name = &authority_name_p;
3826         r.out.account_name = &account_name_p;
3827
3828         status = dcerpc_lsa_GetUserName_r(lsa_handle, mem_ctx, &r);
3829
3830         authority_name_p = *r.out.authority_name;
3831
3832         torture_assert_ntstatus_ok_goto(torture, status, ret, done,
3833                                         "GetUserName failed");
3834         torture_assert_ntstatus_ok_goto(torture, r.out.result, ret, done,
3835                                         "GetUserName failed");
3836
3837         torture_assert_goto(torture, (strcmp(authority_name_p->string, authority_name_saved) == 0),
3838                             ret, done, "authority_name not equal after reauth to anon");
3839         torture_assert_goto(torture, (strcmp(account_name_p->string, account_name_saved) == 0),
3840                             ret, done, "account_name not equal after reauth to anon");
3841
3842         ret = true;
3843
3844 done:
3845         talloc_free(mem_ctx);
3846         return ret;
3847 }
3848
3849 /**
3850  * Test smb2 reauthentication while rpc pipe is in use.
3851  * Open a second lsa bind after reauth to anon.
3852  * Do lsa getusername on that second bind.
3853  */
3854 static bool torture_rpc_smb2_reauth2(struct torture_context *torture)
3855 {
3856         TALLOC_CTX *mem_ctx;
3857         NTSTATUS status;
3858         bool ret = false;
3859         struct smbcli_options options;
3860
3861         struct dcerpc_pipe *lsa_pipe;
3862         struct dcerpc_binding_handle *lsa_handle;
3863         struct lsa_GetUserName r;
3864         struct lsa_String *authority_name_p = NULL;
3865         char *authority_name_saved = NULL;
3866         struct lsa_String *account_name_p = NULL;
3867         char *account_name_saved = NULL;
3868         struct cli_credentials *anon_creds = NULL;
3869         const char *host = torture_setting_string(torture, "host", NULL);
3870         struct smb2_tree *tree;
3871
3872         mem_ctx = talloc_init("torture_samba3_reauth");
3873         torture_assert(torture, (mem_ctx != NULL), "talloc_init failed");
3874
3875         lpcfg_smbcli_options(torture->lp_ctx, &options);
3876
3877         status = smb2_connect(mem_ctx,
3878                               host,
3879                               lpcfg_smb_ports(torture->lp_ctx),
3880                               "IPC$",
3881                               lpcfg_resolve_context(torture->lp_ctx),
3882                               cmdline_credentials,
3883                               &tree,
3884                               torture->ev,
3885                               &options,
3886                               lpcfg_socket_options(torture->lp_ctx),
3887                               lpcfg_gensec_settings(torture, torture->lp_ctx)
3888                               );
3889         torture_assert_ntstatus_ok_goto(torture, status, ret, done,
3890                                         "smb2_connect failed");
3891
3892         /* smb re-authenticate as anonymous */
3893
3894         anon_creds = cli_credentials_init_anon(mem_ctx);
3895
3896         status = smb2_session_setup_spnego(tree->session,
3897                                            anon_creds,
3898                                            0 /* previous_session_id */);
3899         torture_assert_ntstatus_ok_goto(torture, status, ret, done,
3900                                         "session reauth to anon failed");
3901
3902         /* open the lsa pipe */
3903
3904         lsa_pipe = dcerpc_pipe_init(mem_ctx, torture->ev);
3905         torture_assert_goto(torture, (lsa_pipe != NULL), ret, done,
3906                             "dcerpc_pipe_init failed");
3907         lsa_handle = lsa_pipe->binding_handle;
3908
3909         status = dcerpc_pipe_open_smb2(lsa_pipe, tree, "lsarpc");
3910         torture_assert_ntstatus_ok_goto(torture, status, ret, done,
3911                                         "dcerpc_pipe_open_smb2 failed");
3912
3913         status = dcerpc_bind_auth_none(lsa_pipe, &ndr_table_lsarpc);
3914         torture_assert_ntstatus_ok_goto(torture, status, ret, done,
3915                                         "dcerpc_bind_auth_none failed");
3916
3917         /* lsa getusername */
3918
3919         ZERO_STRUCT(r);
3920         r.in.system_name = "\\";
3921         r.in.account_name = &account_name_p;
3922         r.in.authority_name = &authority_name_p;
3923         r.out.account_name = &account_name_p;
3924
3925         status = dcerpc_lsa_GetUserName_r(lsa_handle, mem_ctx, &r);
3926
3927         authority_name_p = *r.out.authority_name;
3928
3929         torture_assert_ntstatus_ok_goto(torture, status, ret, done,
3930                                         "GetUserName failed");
3931         torture_assert_ntstatus_ok_goto(torture, r.out.result, ret, done,
3932                                         "GetUserName failed");
3933
3934         torture_comment(torture, "lsa_GetUserName gave '%s\\%s'\n",
3935                         authority_name_p->string,
3936                         account_name_p->string);
3937
3938         account_name_saved = talloc_strdup(mem_ctx, account_name_p->string);
3939         torture_assert_goto(torture, (account_name_saved != NULL), ret, done,
3940                             "talloc failed");
3941         authority_name_saved = talloc_strdup(mem_ctx, authority_name_p->string);
3942         torture_assert_goto(torture, (authority_name_saved != NULL), ret, done,
3943                             "talloc failed");
3944
3945         /* smb re-auth again to the original user */
3946
3947         status = smb2_session_setup_spnego(tree->session,
3948                                            cmdline_credentials,
3949                                            0 /* previous_session_id */);
3950         torture_assert_ntstatus_ok_goto(torture, status, ret, done,
3951                                         "session reauth to anon failed");
3952
3953         /* re-do lsa getusername */
3954
3955         TALLOC_FREE(authority_name_p);
3956         TALLOC_FREE(account_name_p);
3957         ZERO_STRUCT(r);
3958         r.in.system_name = "\\";
3959         r.in.account_name = &account_name_p;
3960         r.in.authority_name = &authority_name_p;
3961         r.out.account_name = &account_name_p;
3962
3963         status = dcerpc_lsa_GetUserName_r(lsa_handle, mem_ctx, &r);
3964
3965         authority_name_p = *r.out.authority_name;
3966
3967         torture_assert_ntstatus_ok_goto(torture, status, ret, done,
3968                                         "GetUserName failed");
3969         torture_assert_ntstatus_ok_goto(torture, r.out.result, ret, done,
3970                                         "GetUserName failed");
3971
3972         torture_assert_goto(torture, (strcmp(authority_name_p->string, authority_name_saved) == 0),
3973                             ret, done, "authority_name not equal after reauth to anon");
3974         torture_assert_goto(torture, (strcmp(account_name_p->string, account_name_saved) == 0),
3975                             ret, done, "account_name not equal after reauth to anon");
3976
3977         ret = true;
3978
3979 done:
3980         talloc_free(mem_ctx);
3981         return ret;
3982 }
3983
3984 static bool torture_rpc_smb1_pipe_name(struct torture_context *torture)
3985 {
3986         TALLOC_CTX *mem_ctx;
3987         NTSTATUS status;
3988         bool ret = false;
3989         struct smbcli_state *cli;
3990         struct smbcli_options options;
3991         struct smbcli_session_options session_options;
3992         union smb_open io;
3993         union smb_close cl;
3994         uint16_t fnum;
3995
3996         mem_ctx = talloc_init("torture_samba3_smb1_pipe_name");
3997         torture_assert(torture, (mem_ctx != NULL), "talloc_init failed");
3998
3999         lpcfg_smbcli_options(torture->lp_ctx, &options);
4000         lpcfg_smbcli_session_options(torture->lp_ctx, &session_options);
4001
4002         status = smbcli_full_connection(mem_ctx, &cli,
4003                                         torture_setting_string(torture, "host", NULL),
4004                                         lpcfg_smb_ports(torture->lp_ctx),
4005                                         "IPC$", NULL,
4006                                         lpcfg_socket_options(torture->lp_ctx),
4007                                         cmdline_credentials,
4008                                         lpcfg_resolve_context(torture->lp_ctx),
4009                                         torture->ev, &options, &session_options,
4010                                         lpcfg_gensec_settings(torture, torture->lp_ctx));
4011         torture_assert_ntstatus_ok_goto(torture, status, ret, done,
4012                                         "smbcli_full_connection failed");
4013
4014         ZERO_STRUCT(io);
4015         io.generic.level = RAW_OPEN_NTCREATEX;
4016         io.ntcreatex.in.access_mask = DESIRED_ACCESS_PIPE;
4017         io.ntcreatex.in.share_access = NTCREATEX_SHARE_ACCESS_READ|
4018                                        NTCREATEX_SHARE_ACCESS_WRITE;
4019         io.ntcreatex.in.open_disposition = NTCREATEX_DISP_OPEN;
4020         io.ntcreatex.in.impersonation = NTCREATEX_IMPERSONATION_IMPERSONATION;
4021         io.ntcreatex.in.security_flags = 0;
4022
4023         io.ntcreatex.in.fname = "__none__";
4024         status = smb_raw_open(cli->tree, torture, &io);
4025         torture_assert_ntstatus_equal_goto(torture, status, NT_STATUS_OBJECT_NAME_NOT_FOUND,
4026                                            ret, done,
4027                                            "smb_raw_open for '__none__'");
4028
4029         io.ntcreatex.in.fname = "pipe\\srvsvc";
4030         status = smb_raw_open(cli->tree, torture, &io);
4031         torture_assert_ntstatus_equal_goto(torture, status, NT_STATUS_OBJECT_NAME_NOT_FOUND,
4032                                            ret, done,
4033                                            "smb_raw_open for 'pipe\\srvsvc'");
4034
4035         io.ntcreatex.in.fname = "\\pipe\\srvsvc";
4036         status = smb_raw_open(cli->tree, torture, &io);
4037         torture_assert_ntstatus_equal_goto(torture, status, NT_STATUS_OBJECT_NAME_NOT_FOUND,
4038                                            ret, done,
4039                                            "smb_raw_open for '\\pipe\\srvsvc'");
4040
4041         io.ntcreatex.in.fname = "srvsvc";
4042         status = smb_raw_open(cli->tree, torture, &io);
4043         torture_assert_ntstatus_ok_goto(torture, status, ret, done,
4044                                         "smb2_create failed for 'srvsvc'");
4045         fnum = io.ntcreatex.out.file.fnum;
4046         ZERO_STRUCT(cl);
4047         cl.generic.level = RAW_CLOSE_CLOSE;
4048         cl.close.in.file.fnum = fnum;
4049         status = smb_raw_close(cli->tree, &cl);
4050         torture_assert_ntstatus_ok_goto(torture, status, ret, done,
4051                                         "smb_raw_close failed");
4052
4053         io.ntcreatex.in.fname = "\\srvsvc";
4054         status = smb_raw_open(cli->tree, torture, &io);
4055         torture_assert_ntstatus_ok_goto(torture, status, ret, done,
4056                                         "smb2_create failed for '\\srvsvc'");
4057         fnum = io.ntcreatex.out.file.fnum;
4058         ZERO_STRUCT(cl);
4059         cl.generic.level = RAW_CLOSE_CLOSE;
4060         cl.close.in.file.fnum = fnum;
4061         status = smb_raw_close(cli->tree, &cl);
4062         torture_assert_ntstatus_ok_goto(torture, status, ret, done,
4063                                         "smb_raw_close failed");
4064
4065         io.ntcreatex.in.fname = "\\\\\\\\\\srvsvc";
4066         status = smb_raw_open(cli->tree, torture, &io);
4067         torture_assert_ntstatus_ok_goto(torture, status, ret, done,
4068                                         "smb2_create failed for '\\\\\\\\\\srvsvc'");
4069         fnum = io.ntcreatex.out.file.fnum;
4070         ZERO_STRUCT(cl);
4071         cl.generic.level = RAW_CLOSE_CLOSE;
4072         cl.close.in.file.fnum = fnum;
4073         status = smb_raw_close(cli->tree, &cl);
4074         torture_assert_ntstatus_ok_goto(torture, status, ret, done,
4075                                         "smb_raw_close failed");
4076
4077         ZERO_STRUCT(io);
4078         io.generic.level = RAW_OPEN_NTTRANS_CREATE;
4079         io.nttrans.in.access_mask = DESIRED_ACCESS_PIPE;
4080         io.nttrans.in.share_access = NTCREATEX_SHARE_ACCESS_READ|
4081                                        NTCREATEX_SHARE_ACCESS_WRITE;
4082         io.nttrans.in.open_disposition = NTCREATEX_DISP_OPEN;
4083         io.nttrans.in.impersonation = NTCREATEX_IMPERSONATION_IMPERSONATION;
4084         io.nttrans.in.security_flags = 0;
4085
4086         io.nttrans.in.fname = "__none__";
4087         status = smb_raw_open(cli->tree, torture, &io);
4088         torture_assert_ntstatus_equal_goto(torture, status, NT_STATUS_OBJECT_NAME_NOT_FOUND,
4089                                            ret, done,
4090                                            "smb_raw_open for '__none__'");
4091
4092         io.nttrans.in.fname = "pipe\\srvsvc";
4093         status = smb_raw_open(cli->tree, torture, &io);
4094         torture_assert_ntstatus_equal_goto(torture, status, NT_STATUS_OBJECT_NAME_NOT_FOUND,
4095                                            ret, done,
4096                                            "smb_raw_open for 'pipe\\srvsvc'");
4097
4098         io.nttrans.in.fname = "\\pipe\\srvsvc";
4099         status = smb_raw_open(cli->tree, torture, &io);
4100         torture_assert_ntstatus_equal_goto(torture, status, NT_STATUS_OBJECT_NAME_NOT_FOUND,
4101                                            ret, done,
4102                                            "smb_raw_open for '\\pipe\\srvsvc'");
4103
4104         io.nttrans.in.fname = "srvsvc";
4105         status = smb_raw_open(cli->tree, torture, &io);
4106         torture_assert_ntstatus_ok_goto(torture, status, ret, done,
4107                                         "smb2_create failed for 'srvsvc'");
4108         fnum = io.nttrans.out.file.fnum;
4109         ZERO_STRUCT(cl);
4110         cl.generic.level = RAW_CLOSE_CLOSE;
4111         cl.close.in.file.fnum = fnum;
4112         status = smb_raw_close(cli->tree, &cl);
4113         torture_assert_ntstatus_ok_goto(torture, status, ret, done,
4114                                         "smb_raw_close failed");
4115
4116         io.nttrans.in.fname = "\\srvsvc";
4117         status = smb_raw_open(cli->tree, torture, &io);
4118         torture_assert_ntstatus_ok_goto(torture, status, ret, done,
4119                                         "smb2_create failed for '\\srvsvc'");
4120         fnum = io.nttrans.out.file.fnum;
4121         ZERO_STRUCT(cl);
4122         cl.generic.level = RAW_CLOSE_CLOSE;
4123         cl.close.in.file.fnum = fnum;
4124         status = smb_raw_close(cli->tree, &cl);
4125         torture_assert_ntstatus_ok_goto(torture, status, ret, done,
4126                                         "smb_raw_close failed");
4127
4128         io.nttrans.in.fname = "\\\\\\\\\\srvsvc";
4129         status = smb_raw_open(cli->tree, torture, &io);
4130         torture_assert_ntstatus_ok_goto(torture, status, ret, done,
4131                                         "smb2_create failed for '\\\\\\\\\\srvsvc'");
4132         fnum = io.nttrans.out.file.fnum;
4133         ZERO_STRUCT(cl);
4134         cl.generic.level = RAW_CLOSE_CLOSE;
4135         cl.close.in.file.fnum = fnum;
4136         status = smb_raw_close(cli->tree, &cl);
4137         torture_assert_ntstatus_ok_goto(torture, status, ret, done,
4138                                         "smb_raw_close failed");
4139
4140         ZERO_STRUCT(io);
4141         io.generic.level = RAW_OPEN_OPENX;
4142         io.openx.in.open_mode = OPENX_MODE_ACCESS_RDWR;
4143         io.openx.in.open_func = OPENX_OPEN_FUNC_OPEN;
4144
4145         io.openx.in.fname = "__none__";
4146         status = smb_raw_open(cli->tree, torture, &io);
4147         torture_assert_ntstatus_equal_goto(torture, status, NT_STATUS_OBJECT_PATH_SYNTAX_BAD,
4148                                            ret, done,
4149                                            "smb_raw_open for '__none__'");
4150
4151         io.openx.in.fname = "srvsvc";
4152         status = smb_raw_open(cli->tree, torture, &io);
4153         torture_assert_ntstatus_equal_goto(torture, status, NT_STATUS_OBJECT_PATH_SYNTAX_BAD,
4154                                            ret, done,
4155                                            "smb_raw_open for 'srvsvc'");
4156
4157         io.openx.in.fname = "\\srvsvc";
4158         status = smb_raw_open(cli->tree, torture, &io);
4159         torture_assert_ntstatus_equal_goto(torture, status, NT_STATUS_OBJECT_PATH_SYNTAX_BAD,
4160                                            ret, done,
4161                                            "smb_raw_open for '\\srvsvc'");
4162
4163         io.openx.in.fname = "\\pipesrvsvc";
4164         status = smb_raw_open(cli->tree, torture, &io);
4165         torture_assert_ntstatus_equal_goto(torture, status, NT_STATUS_OBJECT_PATH_SYNTAX_BAD,
4166                                            ret, done,
4167                                            "smb_raw_open for '\\pipesrvsvc'");
4168
4169         io.openx.in.fname = "pipe\\__none__";
4170         status = smb_raw_open(cli->tree, torture, &io);
4171         torture_assert_ntstatus_equal_goto(torture, status, NT_STATUS_OBJECT_NAME_NOT_FOUND,
4172                                            ret, done,
4173                                            "smb_raw_open for 'pipe\\__none__'");
4174
4175         io.openx.in.fname = "\\pipe\\__none__";
4176         status = smb_raw_open(cli->tree, torture, &io);
4177         torture_assert_ntstatus_equal_goto(torture, status, NT_STATUS_OBJECT_NAME_NOT_FOUND,
4178                                            ret, done,
4179                                            "smb_raw_open for '\\pipe\\__none__'");
4180
4181         io.openx.in.fname = "pipe\\srvsvc";
4182         status = smb_raw_open(cli->tree, torture, &io);
4183         torture_assert_ntstatus_ok_goto(torture, status, ret, done,
4184                                         "smb2_create failed for 'pipe\\srvsvc'");
4185         fnum = io.openx.out.file.fnum;
4186         ZERO_STRUCT(cl);
4187         cl.generic.level = RAW_CLOSE_CLOSE;
4188         cl.close.in.file.fnum = fnum;
4189         status = smb_raw_close(cli->tree, &cl);
4190         torture_assert_ntstatus_ok_goto(torture, status, ret, done,
4191                                         "smb_raw_close failed");
4192
4193         io.openx.in.fname = "\\pipe\\srvsvc";
4194         status = smb_raw_open(cli->tree, torture, &io);
4195         torture_assert_ntstatus_ok_goto(torture, status, ret, done,
4196                                         "smb2_create failed for '\\pipe\\srvsvc'");
4197         fnum = io.openx.out.file.fnum;
4198         ZERO_STRUCT(cl);
4199         cl.generic.level = RAW_CLOSE_CLOSE;
4200         cl.close.in.file.fnum = fnum;
4201         status = smb_raw_close(cli->tree, &cl);
4202         torture_assert_ntstatus_ok_goto(torture, status, ret, done,
4203                                         "smb_raw_close failed");
4204
4205         io.openx.in.fname = "\\\\\\\\\\pipe\\srvsvc";
4206         status = smb_raw_open(cli->tree, torture, &io);
4207         torture_assert_ntstatus_ok_goto(torture, status, ret, done,
4208                                         "smb2_create failed for '\\\\\\\\\\pipe\\srvsvc'");
4209         fnum = io.openx.out.file.fnum;
4210         ZERO_STRUCT(cl);
4211         cl.generic.level = RAW_CLOSE_CLOSE;
4212         cl.close.in.file.fnum = fnum;
4213         status = smb_raw_close(cli->tree, &cl);
4214         torture_assert_ntstatus_ok_goto(torture, status, ret, done,
4215                                         "smb_raw_close failed");
4216
4217         io.openx.in.fname = "\\\\\\\\\\pipe\\\\\\\\\\srvsvc";
4218         status = smb_raw_open(cli->tree, torture, &io);
4219         torture_assert_ntstatus_ok_goto(torture, status, ret, done,
4220                                         "smb2_create failed for '\\\\\\\\\\pipe\\\\\\\\\\srvsvc'");
4221         fnum = io.openx.out.file.fnum;
4222         ZERO_STRUCT(cl);
4223         cl.generic.level = RAW_CLOSE_CLOSE;
4224         cl.close.in.file.fnum = fnum;
4225         status = smb_raw_close(cli->tree, &cl);
4226         torture_assert_ntstatus_ok_goto(torture, status, ret, done,
4227                                         "smb_raw_close failed");
4228         ret = true;
4229
4230 done:
4231         talloc_free(mem_ctx);
4232         return ret;
4233 }
4234
4235 static bool torture_rpc_smb2_pipe_name(struct torture_context *torture)
4236 {
4237         TALLOC_CTX *mem_ctx;
4238         NTSTATUS status;
4239         bool ret = false;
4240         struct smbcli_options options;
4241         const char *host = torture_setting_string(torture, "host", NULL);
4242         struct smb2_tree *tree;
4243         struct smb2_handle h;
4244         struct smb2_create io;
4245
4246         mem_ctx = talloc_init("torture_samba3_smb2_pipe_name");
4247         torture_assert(torture, (mem_ctx != NULL), "talloc_init failed");
4248
4249         lpcfg_smbcli_options(torture->lp_ctx, &options);
4250
4251         status = smb2_connect(mem_ctx,
4252                               host,
4253                               lpcfg_smb_ports(torture->lp_ctx),
4254                               "IPC$",
4255                               lpcfg_resolve_context(torture->lp_ctx),
4256                               cmdline_credentials,
4257                               &tree,
4258                               torture->ev,
4259                               &options,
4260                               lpcfg_socket_options(torture->lp_ctx),
4261                               lpcfg_gensec_settings(torture, torture->lp_ctx)
4262                               );
4263         torture_assert_ntstatus_ok_goto(torture, status, ret, done,
4264                                         "smb2_connect failed");
4265
4266         ZERO_STRUCT(io);
4267         io.in.oplock_level = 0;
4268         io.in.desired_access = DESIRED_ACCESS_PIPE;
4269         io.in.impersonation_level = SMB2_IMPERSONATION_IMPERSONATION;
4270         io.in.file_attributes = 0;
4271         io.in.create_disposition = NTCREATEX_DISP_OPEN;
4272         io.in.share_access =
4273                 NTCREATEX_SHARE_ACCESS_READ|
4274                 NTCREATEX_SHARE_ACCESS_WRITE;
4275         io.in.create_options = 0;
4276
4277         io.in.fname = "__none__";
4278         status = smb2_create(tree, tree, &io);
4279         torture_assert_ntstatus_equal_goto(torture, status, NT_STATUS_OBJECT_NAME_NOT_FOUND,
4280                                            ret, done,
4281                                            "smb2_create for '__none__'");
4282
4283         io.in.fname = "\\srvsvc";
4284         status = smb2_create(tree, tree, &io);
4285         torture_assert_ntstatus_equal_goto(torture, status, NT_STATUS_OBJECT_NAME_NOT_FOUND,
4286                                            ret, done,
4287                                            "smb2_create for '\\srvsvc'");
4288
4289         io.in.fname = "\\pipe\\srvsvc";
4290         status = smb2_create(tree, tree, &io);
4291         torture_assert_ntstatus_equal_goto(torture, status, NT_STATUS_OBJECT_NAME_NOT_FOUND,
4292                                            ret, done,
4293                                            "smb2_create for '\\pipe\\srvsvc'");
4294
4295         io.in.fname = "pipe\\srvsvc";
4296         status = smb2_create(tree, tree, &io);
4297         torture_assert_ntstatus_equal_goto(torture, status, NT_STATUS_OBJECT_NAME_NOT_FOUND,
4298                                            ret, done,
4299                                            "smb2_create for 'pipe\\srvsvc'");
4300
4301         io.in.fname = "srvsvc";
4302         status = smb2_create(tree, tree, &io);
4303         torture_assert_ntstatus_ok_goto(torture, status, ret, done,
4304                                         "smb2_create failed for 'srvsvc'");
4305
4306         h = io.out.file.handle;
4307
4308         status = smb2_util_close(tree, h);
4309         torture_assert_ntstatus_ok_goto(torture, status, ret, done,
4310                                         "smb2_util_close failed");
4311
4312         ret = true;
4313 done:
4314         talloc_free(mem_ctx);
4315         return ret;
4316 }
4317
4318 /**
4319  * Test behaviour of a waiting read call on a pipe when
4320  * the pipe handle is closed:
4321  * - open a pipe via smb2
4322  * - trigger a read which hangs since there is nothing to read
4323  * - close the pipe file handle
4324  * - wait for the read to return and check the status
4325  *   (STATUS_PIPE_BROKEN)
4326  */
4327 static bool torture_rpc_smb2_pipe_read_close(struct torture_context *torture)
4328 {
4329         TALLOC_CTX *mem_ctx;
4330         NTSTATUS status;
4331         bool ret = false;
4332         struct smbcli_options options;
4333         const char *host = torture_setting_string(torture, "host", NULL);
4334         struct smb2_tree *tree;
4335         struct smb2_handle h;
4336         struct smb2_request *smb2req;
4337         struct smb2_create io;
4338         struct smb2_read rd;
4339
4340         mem_ctx = talloc_init("torture_samba3_pipe_read_close");
4341         torture_assert(torture, (mem_ctx != NULL), "talloc_init failed");
4342
4343         lpcfg_smbcli_options(torture->lp_ctx, &options);
4344
4345         status = smb2_connect(mem_ctx,
4346                               host,
4347                               lpcfg_smb_ports(torture->lp_ctx),
4348                               "IPC$",
4349                               lpcfg_resolve_context(torture->lp_ctx),
4350                               cmdline_credentials,
4351                               &tree,
4352                               torture->ev,
4353                               &options,
4354                               lpcfg_socket_options(torture->lp_ctx),
4355                               lpcfg_gensec_settings(torture, torture->lp_ctx)
4356                               );
4357         torture_assert_ntstatus_ok_goto(torture, status, ret, done,
4358                                         "smb2_connect failed");
4359
4360         ZERO_STRUCT(io);
4361         io.in.oplock_level = 0;
4362         io.in.desired_access = DESIRED_ACCESS_PIPE;
4363         io.in.impersonation_level = SMB2_IMPERSONATION_IMPERSONATION;
4364         io.in.file_attributes = 0;
4365         io.in.create_disposition = NTCREATEX_DISP_OPEN;
4366         io.in.share_access =
4367                 NTCREATEX_SHARE_ACCESS_READ|
4368                 NTCREATEX_SHARE_ACCESS_WRITE;
4369         io.in.create_options = 0;
4370         io.in.fname = "lsarpc";
4371
4372         status = smb2_create(tree, tree, &io);
4373         torture_assert_ntstatus_ok_goto(torture, status, ret, done,
4374                                         "smb2_create failed for 'lsarpc'");
4375
4376         h = io.out.file.handle;
4377
4378         ZERO_STRUCT(rd);
4379         rd.in.file.handle = h;
4380         rd.in.length = 1024;
4381         rd.in.offset = 0;
4382         rd.in.min_count = 0;
4383
4384         smb2req = smb2_read_send(tree, &rd);
4385         torture_assert_goto(torture, (smb2req != NULL), ret, done,
4386                             "smb2_read_send failed");
4387
4388         status = smb2_util_close(tree, h);
4389         torture_assert_ntstatus_ok_goto(torture, status, ret, done,
4390                                         "smb2_util_close failed");
4391
4392         status = smb2_read_recv(smb2req, mem_ctx, &rd);
4393         torture_assert_ntstatus_equal_goto(torture, status, NT_STATUS_PIPE_BROKEN, ret, done,
4394                                            "smb2_read_recv: unexpected return code");
4395
4396         ret = true;
4397 done:
4398         talloc_free(mem_ctx);
4399         return ret;
4400 }
4401
4402 /**
4403  * Test behaviour of a waiting read call on a pipe when
4404  * the tree is disconnected.
4405  * - open a pipe via smb2
4406  * - trigger a read which hangs since there is nothing to read
4407  * - do a tree disconnect
4408  * - wait for the read to return and check the status
4409  *   (STATUS_PIPE_BROKEN)
4410  */
4411 static bool torture_rpc_smb2_pipe_read_tdis(struct torture_context *torture)
4412 {
4413         TALLOC_CTX *mem_ctx;
4414         NTSTATUS status;
4415         bool ret = false;
4416         struct smbcli_options options;
4417         const char *host = torture_setting_string(torture, "host", NULL);
4418         struct smb2_tree *tree;
4419         struct smb2_handle h;
4420         struct smb2_request *smb2req;
4421         struct smb2_create io;
4422         struct smb2_read rd;
4423
4424         mem_ctx = talloc_init("torture_samba3_pipe_read_tdis");
4425         torture_assert(torture, (mem_ctx != NULL), "talloc_init failed");
4426
4427         lpcfg_smbcli_options(torture->lp_ctx, &options);
4428
4429         status = smb2_connect(mem_ctx,
4430                               host,
4431                               lpcfg_smb_ports(torture->lp_ctx),
4432                               "IPC$",
4433                               lpcfg_resolve_context(torture->lp_ctx),
4434                               cmdline_credentials,
4435                               &tree,
4436                               torture->ev,
4437                               &options,
4438                               lpcfg_socket_options(torture->lp_ctx),
4439                               lpcfg_gensec_settings(torture, torture->lp_ctx)
4440                               );
4441         torture_assert_ntstatus_ok_goto(torture, status, ret, done,
4442                                         "smb2_connect failed");
4443
4444         ZERO_STRUCT(io);
4445         io.in.oplock_level = 0;
4446         io.in.desired_access = DESIRED_ACCESS_PIPE;
4447         io.in.impersonation_level = SMB2_IMPERSONATION_IMPERSONATION;
4448         io.in.file_attributes = 0;
4449         io.in.create_disposition = NTCREATEX_DISP_OPEN;
4450         io.in.share_access =
4451                 NTCREATEX_SHARE_ACCESS_READ|
4452                 NTCREATEX_SHARE_ACCESS_WRITE;
4453         io.in.create_options = 0;
4454         io.in.fname = "lsarpc";
4455
4456         status = smb2_create(tree, tree, &io);
4457         torture_assert_ntstatus_ok_goto(torture, status, ret, done,
4458                                         "smb2_create failed for 'lsarpc'");
4459
4460         h = io.out.file.handle;
4461
4462         ZERO_STRUCT(rd);
4463         rd.in.file.handle = h;
4464         rd.in.length = 1024;
4465         rd.in.offset = 0;
4466         rd.in.min_count = 0;
4467
4468         smb2req = smb2_read_send(tree, &rd);
4469         torture_assert_goto(torture, (smb2req != NULL), ret, done,
4470                             "smb2_read_send failed");
4471
4472         status = smb2_tdis(tree);
4473         torture_assert_ntstatus_ok_goto(torture, status, ret, done,
4474                                         "smb2_tdis failed");
4475
4476         status = smb2_read_recv(smb2req, mem_ctx, &rd);
4477         torture_assert_ntstatus_equal_goto(torture, status, NT_STATUS_PIPE_BROKEN, ret, done,
4478                                            "smb2_read_recv: unexpected return code");
4479
4480         ret = true;
4481 done:
4482         talloc_free(mem_ctx);
4483         return ret;
4484 }
4485
4486 /**
4487  * Test behaviour of a waiting read call on a pipe when
4488  * the user logs off
4489  * - open a pipe via smb2
4490  * - trigger a read which hangs since there is nothing to read
4491  * - do a logoff
4492  * - wait for the read to return and check the status
4493  *   (STATUS_PIPE_BROKEN)
4494  */
4495 static bool torture_rpc_smb2_pipe_read_logoff(struct torture_context *torture)
4496 {
4497         TALLOC_CTX *mem_ctx;
4498         NTSTATUS status;
4499         bool ret = false;
4500         struct smbcli_options options;
4501         const char *host = torture_setting_string(torture, "host", NULL);
4502         struct smb2_tree *tree;
4503         struct smb2_handle h;
4504         struct smb2_request *smb2req;
4505         struct smb2_create io;
4506         struct smb2_read rd;
4507
4508         mem_ctx = talloc_init("torture_samba3_pipe_read_tdis");
4509         torture_assert(torture, (mem_ctx != NULL), "talloc_init failed");
4510
4511         lpcfg_smbcli_options(torture->lp_ctx, &options);
4512
4513         status = smb2_connect(mem_ctx,
4514                               host,
4515                               lpcfg_smb_ports(torture->lp_ctx),
4516                               "IPC$",
4517                               lpcfg_resolve_context(torture->lp_ctx),
4518                               cmdline_credentials,
4519                               &tree,
4520                               torture->ev,
4521                               &options,
4522                               lpcfg_socket_options(torture->lp_ctx),
4523                               lpcfg_gensec_settings(torture, torture->lp_ctx)
4524                               );
4525         torture_assert_ntstatus_ok_goto(torture, status, ret, done,
4526                                         "smb2_connect failed");
4527
4528         ZERO_STRUCT(io);
4529         io.in.oplock_level = 0;
4530         io.in.desired_access = DESIRED_ACCESS_PIPE;
4531         io.in.impersonation_level = SMB2_IMPERSONATION_IMPERSONATION;
4532         io.in.file_attributes = 0;
4533         io.in.create_disposition = NTCREATEX_DISP_OPEN;
4534         io.in.share_access =
4535                 NTCREATEX_SHARE_ACCESS_READ|
4536                 NTCREATEX_SHARE_ACCESS_WRITE;
4537         io.in.create_options = 0;
4538         io.in.fname = "lsarpc";
4539
4540         status = smb2_create(tree, tree, &io);
4541         torture_assert_ntstatus_ok_goto(torture, status, ret, done,
4542                                         "smb2_create failed for 'lsarpc'");
4543
4544         h = io.out.file.handle;
4545
4546         ZERO_STRUCT(rd);
4547         rd.in.file.handle = h;
4548         rd.in.length = 1024;
4549         rd.in.offset = 0;
4550         rd.in.min_count = 0;
4551
4552         smb2req = smb2_read_send(tree, &rd);
4553         torture_assert_goto(torture, (smb2req != NULL), ret, done,
4554                             "smb2_read_send failed");
4555
4556         status = smb2_logoff(tree->session);
4557         torture_assert_ntstatus_ok_goto(torture, status, ret, done,
4558                                         "smb2_logoff failed");
4559
4560         status = smb2_read_recv(smb2req, mem_ctx, &rd);
4561         torture_assert_ntstatus_equal_goto(torture, status, NT_STATUS_PIPE_BROKEN, ret, done,
4562                                            "smb2_read_recv: unexpected return code");
4563
4564         ret = true;
4565 done:
4566         talloc_free(mem_ctx);
4567         return ret;
4568 }
4569
4570
4571 struct torture_suite *torture_rpc_samba3(TALLOC_CTX *mem_ctx)
4572 {
4573         struct torture_suite *suite = torture_suite_create(mem_ctx, "samba3");
4574
4575         torture_suite_add_simple_test(suite, "bind", torture_bind_samba3);
4576         torture_suite_add_simple_test(suite, "netlogon", torture_netlogon_samba3);
4577         torture_suite_add_simple_test(suite, "sessionkey", torture_samba3_sessionkey);
4578         torture_suite_add_simple_test(suite, "srvsvc", torture_samba3_rpc_srvsvc);
4579         torture_suite_add_simple_test(suite, "sharesec", torture_samba3_rpc_sharesec);
4580         torture_suite_add_simple_test(suite, "getusername", torture_samba3_rpc_getusername);
4581         torture_suite_add_simple_test(suite, "randomauth2", torture_samba3_rpc_randomauth2);
4582         torture_suite_add_simple_test(suite, "lsa", torture_samba3_rpc_lsa);
4583         torture_suite_add_simple_test(suite, "spoolss", torture_samba3_rpc_spoolss);
4584         torture_suite_add_simple_test(suite, "wkssvc", torture_samba3_rpc_wkssvc);
4585         torture_suite_add_simple_test(suite, "winreg", torture_samba3_rpc_winreg);
4586         torture_suite_add_simple_test(suite, "getaliasmembership-0", torture_samba3_getaliasmembership_0);
4587         torture_suite_add_simple_test(suite, "regconfig", torture_samba3_regconfig);
4588         torture_suite_add_simple_test(suite, "smb-reauth1", torture_rpc_smb_reauth1);
4589         torture_suite_add_simple_test(suite, "smb-reauth2", torture_rpc_smb_reauth2);
4590         torture_suite_add_simple_test(suite, "smb2-reauth1", torture_rpc_smb2_reauth1);
4591         torture_suite_add_simple_test(suite, "smb2-reauth2", torture_rpc_smb2_reauth2);
4592         torture_suite_add_simple_test(suite, "smb1-pipe-name", torture_rpc_smb1_pipe_name);
4593         torture_suite_add_simple_test(suite, "smb2-pipe-name", torture_rpc_smb2_pipe_name);
4594         torture_suite_add_simple_test(suite, "smb2-pipe-read-close", torture_rpc_smb2_pipe_read_close);
4595         torture_suite_add_simple_test(suite, "smb2-pipe-read-tdis", torture_rpc_smb2_pipe_read_tdis);
4596         torture_suite_add_simple_test(suite, "smb2-pipe-read-logoff", torture_rpc_smb2_pipe_read_logoff);
4597
4598         suite->description = talloc_strdup(suite, "samba3 DCERPC interface tests");
4599
4600         return suite;
4601 }