source4/torture/rpc/samba3rpc.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3
   4    dcerpc torture tests, designed to walk Samba3 code paths
   5
   6    Copyright (C) Volker Lendecke 2006
   7
   8    This program is free software; you can redistribute it and/or modify
   9    it under the terms of the GNU General Public License as published by
  10    the Free Software Foundation; either version 3 of the License, or
  11    (at your option) any later version.
  12
  13    This program is distributed in the hope that it will be useful,
  14    but WITHOUT ANY WARRANTY; without even the implied warranty of
  15    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  16    GNU General Public License for more details.
  17
  18    You should have received a copy of the GNU General Public License
  19    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  20 */
  21
  22 #include "includes.h"
  23 #include "libcli/raw/libcliraw.h"
  24 #include "libcli/raw/raw_proto.h"
  25 #include "torture/util.h"
  26 #include "libcli/rap/rap.h"
  27 #include "librpc/gen_ndr/ndr_lsa_c.h"
  28 #include "librpc/gen_ndr/ndr_samr_c.h"
  29 #include "librpc/gen_ndr/ndr_netlogon_c.h"
  30 #include "librpc/gen_ndr/ndr_srvsvc_c.h"
  31 #include "librpc/gen_ndr/ndr_spoolss_c.h"
  32 #include "librpc/gen_ndr/ndr_winreg_c.h"
  33 #include "librpc/gen_ndr/ndr_wkssvc_c.h"
  34 #include "lib/cmdline/popt_common.h"
  35 #include "torture/rpc/torture_rpc.h"
  36 #include "libcli/libcli.h"
  37 #include "libcli/smb_composite/smb_composite.h"
  38 #include "libcli/auth/libcli_auth.h"
  39 #include "../lib/crypto/crypto.h"
  40 #include "libcli/security/security.h"
  41 #include "param/param.h"
  42 #include "lib/registry/registry.h"
  43 #include "libcli/resolve/resolve.h"
  44 #include "torture/ndr/ndr.h"
  45 #include "libcli/smb2/smb2.h"
  46 #include "libcli/smb2/smb2_calls.h"
  47 #include "librpc/rpc/dcerpc.h"
  48 #include "librpc/rpc/dcerpc_proto.h"
  49 #include "../source3/libsmb/smb2cli.h"
  50 #include "libcli/smb/smbXcli_base.h"
  51
  52 /*
  53  * This tests a RPC call using an invalid vuid
  54  */
  55
  56 bool torture_bind_authcontext(struct torture_context *torture)
  57 {
  58         TALLOC_CTX *mem_ctx;
  59         NTSTATUS status;
  60         bool ret = false;
  61         struct lsa_ObjectAttribute objectattr;
  62         struct lsa_OpenPolicy2 openpolicy;
  63         struct policy_handle handle;
  64         struct lsa_Close close_handle;
  65         struct smbcli_session *tmp;
  66         uint16_t tmp_vuid;
  67         struct smbcli_session *session2;
  68         struct smbcli_state *cli;
  69         struct dcerpc_pipe *lsa_pipe;
  70         struct dcerpc_binding_handle *lsa_handle;
  71         struct cli_credentials *anon_creds;
  72         struct smb_composite_sesssetup setup;
  73         struct smbcli_options options;
  74         struct smbcli_session_options session_options;
  75
  76         mem_ctx = talloc_init("torture_bind_authcontext");
  77
  78         if (mem_ctx == NULL) {
  79                 torture_comment(torture, "talloc_init failed\n");
  80                 return false;
  81         }
  82
  83         lpcfg_smbcli_options(torture->lp_ctx, &options);
  84         lpcfg_smbcli_session_options(torture->lp_ctx, &session_options);
  85
  86         status = smbcli_full_connection(mem_ctx, &cli,
  87                                         torture_setting_string(torture, "host", NULL),
  88                                         lpcfg_smb_ports(torture->lp_ctx),
  89                                         "IPC$", NULL,
  90                                         lpcfg_socket_options(torture->lp_ctx),
  91                                         cmdline_credentials,
  92                                         lpcfg_resolve_context(torture->lp_ctx),
  93                                         torture->ev, &options, &session_options,
  94                                         lpcfg_gensec_settings(torture, torture->lp_ctx));
  95         if (!NT_STATUS_IS_OK(status)) {
  96                 torture_comment(torture, "smbcli_full_connection failed: %s\n",
  97                          nt_errstr(status));
  98                 goto done;
  99         }
 100
 101         lsa_pipe = dcerpc_pipe_init(mem_ctx, torture->ev);
 102         if (lsa_pipe == NULL) {
 103                 torture_comment(torture, "dcerpc_pipe_init failed\n");
 104                 goto done;
 105         }
 106         lsa_handle = lsa_pipe->binding_handle;
 107
 108         status = dcerpc_pipe_open_smb(lsa_pipe, cli->tree, "\\lsarpc");
 109         if (!NT_STATUS_IS_OK(status)) {
 110                 torture_comment(torture, "dcerpc_pipe_open_smb failed: %s\n",
 111                          nt_errstr(status));
 112                 goto done;
 113         }
 114
 115         status = dcerpc_bind_auth_none(lsa_pipe, &ndr_table_lsarpc);
 116         if (!NT_STATUS_IS_OK(status)) {
 117                 torture_comment(torture, "dcerpc_bind_auth_none failed: %s\n",
 118                          nt_errstr(status));
 119                 goto done;
 120         }
 121
 122         openpolicy.in.system_name =talloc_asprintf(
 123                 mem_ctx, "\\\\%s", dcerpc_server_name(lsa_pipe));
 124         ZERO_STRUCT(objectattr);
 125         openpolicy.in.attr = &objectattr;
 126         openpolicy.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
 127         openpolicy.out.handle = &handle;
 128
 129         status = dcerpc_lsa_OpenPolicy2_r(lsa_handle, mem_ctx, &openpolicy);
 130
 131         if (!NT_STATUS_IS_OK(status)) {
 132                 torture_comment(torture, "dcerpc_lsa_OpenPolicy2 failed: %s\n",
 133                          nt_errstr(status));
 134                 goto done;
 135         }
 136         if (!NT_STATUS_IS_OK(openpolicy.out.result)) {
 137                 torture_comment(torture, "dcerpc_lsa_OpenPolicy2 failed: %s\n",
 138                          nt_errstr(openpolicy.out.result));
 139                 goto done;
 140         }
 141
 142         close_handle.in.handle = &handle;
 143         close_handle.out.handle = &handle;
 144
 145         status = dcerpc_lsa_Close_r(lsa_handle, mem_ctx, &close_handle);
 146         if (!NT_STATUS_IS_OK(status)) {
 147                 torture_comment(torture, "dcerpc_lsa_Close failed: %s\n",
 148                          nt_errstr(status));
 149                 goto done;
 150         }
 151         if (!NT_STATUS_IS_OK(close_handle.out.result)) {
 152                 torture_comment(torture, "dcerpc_lsa_Close failed: %s\n",
 153                          nt_errstr(close_handle.out.result));
 154                 goto done;
 155         }
 156
 157         session2 = smbcli_session_init(cli->transport, mem_ctx, false, session_options);
 158         if (session2 == NULL) {
 159                 torture_comment(torture, "smbcli_session_init failed\n");
 160                 goto done;
 161         }
 162
 163         if (!(anon_creds = cli_credentials_init_anon(mem_ctx))) {
 164                 torture_comment(torture, "create_anon_creds failed\n");
 165                 goto done;
 166         }
 167
 168         setup.in.sesskey = cli->transport->negotiate.sesskey;
 169         setup.in.capabilities = cli->transport->negotiate.capabilities;
 170         setup.in.workgroup = "";
 171         setup.in.credentials = anon_creds;
 172         setup.in.gensec_settings = lpcfg_gensec_settings(torture, torture->lp_ctx);
 173
 174         status = smb_composite_sesssetup(session2, &setup);
 175         if (!NT_STATUS_IS_OK(status)) {
 176                 torture_comment(torture, "anon session setup failed: %s\n",
 177                          nt_errstr(status));
 178                 goto done;
 179         }
 180         session2->vuid = setup.out.vuid;
 181
 182         tmp = cli->tree->session;
 183         tmp_vuid = smb1cli_session_current_id(tmp->smbXcli);
 184         smb1cli_session_set_id(tmp->smbXcli, session2->vuid);
 185         cli->tree->session = session2;
 186
 187         status = dcerpc_lsa_OpenPolicy2_r(lsa_handle, mem_ctx, &openpolicy);
 188
 189         torture_assert(torture, smbXcli_conn_is_connected(cli->transport->conn),
 190                        "smb still connected");
 191         torture_assert(torture, !dcerpc_binding_handle_is_connected(lsa_handle),
 192                        "dcerpc disonnected");
 193
 194         if (NT_STATUS_EQUAL(status, NT_STATUS_INVALID_HANDLE)) {
 195                 torture_comment(torture, "dcerpc_lsa_OpenPolicy2 with wrong vuid gave %s, "
 196                          "expected NT_STATUS_IO_DEVICE_ERROR\n",
 197                          nt_errstr(status));
 198                 status = NT_STATUS_IO_DEVICE_ERROR;
 199         }
 200
 201         torture_assert_ntstatus_equal(torture, status, NT_STATUS_IO_DEVICE_ERROR,
 202                                       "lsa io device error");
 203
 204         smb1cli_session_set_id(tmp->smbXcli, tmp_vuid);
 205         cli->tree->session = tmp;
 206         talloc_free(lsa_pipe);
 207         lsa_pipe = NULL;
 208
 209         ret = true;
 210  done:
 211         talloc_free(mem_ctx);
 212         return ret;
 213 }
 214
 215 /*
 216  * Bind to lsa using a specific auth method
 217  */
 218
 219 static bool bindtest(struct torture_context *tctx,
 220                      struct smbcli_state *cli,
 221                      struct cli_credentials *credentials,
 222                      uint8_t auth_type, uint8_t auth_level)
 223 {
 224         TALLOC_CTX *mem_ctx;
 225         bool ret = false;
 226         NTSTATUS status;
 227
 228         struct dcerpc_pipe *lsa_pipe;
 229         struct dcerpc_binding_handle *lsa_handle;
 230         struct lsa_ObjectAttribute objectattr;
 231         struct lsa_OpenPolicy2 openpolicy;
 232         struct lsa_QueryInfoPolicy query;
 233         union lsa_PolicyInformation *info = NULL;
 234         struct policy_handle handle;
 235         struct lsa_Close close_handle;
 236
 237         if ((mem_ctx = talloc_init("bindtest")) == NULL) {
 238                 torture_comment(tctx, "talloc_init failed\n");
 239                 return false;
 240         }
 241
 242         lsa_pipe = dcerpc_pipe_init(mem_ctx, tctx->ev);
 243         if (lsa_pipe == NULL) {
 244                 torture_comment(tctx, "dcerpc_pipe_init failed\n");
 245                 goto done;
 246         }
 247         lsa_handle = lsa_pipe->binding_handle;
 248
 249         status = dcerpc_pipe_open_smb(lsa_pipe, cli->tree, "\\lsarpc");
 250         if (!NT_STATUS_IS_OK(status)) {
 251                 torture_comment(tctx, "dcerpc_pipe_open_smb failed: %s\n",
 252                          nt_errstr(status));
 253                 goto done;
 254         }
 255
 256         status = dcerpc_bind_auth(lsa_pipe, &ndr_table_lsarpc,
 257                                   credentials, lpcfg_gensec_settings(tctx->lp_ctx, tctx->lp_ctx), auth_type, auth_level,
 258                                   NULL);
 259         if (!NT_STATUS_IS_OK(status)) {
 260                 torture_comment(tctx, "dcerpc_bind_auth failed: %s\n", nt_errstr(status));
 261                 goto done;
 262         }
 263
 264         openpolicy.in.system_name =talloc_asprintf(
 265                 mem_ctx, "\\\\%s", dcerpc_server_name(lsa_pipe));
 266         ZERO_STRUCT(objectattr);
 267         openpolicy.in.attr = &objectattr;
 268         openpolicy.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
 269         openpolicy.out.handle = &handle;
 270
 271         status = dcerpc_lsa_OpenPolicy2_r(lsa_handle, mem_ctx, &openpolicy);
 272
 273         if (!NT_STATUS_IS_OK(status)) {
 274                 torture_comment(tctx, "dcerpc_lsa_OpenPolicy2 failed: %s\n",
 275                          nt_errstr(status));
 276                 goto done;
 277         }
 278         if (!NT_STATUS_IS_OK(openpolicy.out.result)) {
 279                 torture_comment(tctx, "dcerpc_lsa_OpenPolicy2 failed: %s\n",
 280                          nt_errstr(openpolicy.out.result));
 281                 goto done;
 282         }
 283
 284         query.in.handle = &handle;
 285         query.in.level = LSA_POLICY_INFO_DOMAIN;
 286         query.out.info = &info;
 287
 288         status = dcerpc_lsa_QueryInfoPolicy_r(lsa_handle, mem_ctx, &query);
 289         if (!NT_STATUS_IS_OK(status)) {
 290                 torture_comment(tctx, "dcerpc_lsa_QueryInfoPolicy failed: %s\n",
 291                          nt_errstr(status));
 292                 goto done;
 293         }
 294         if (!NT_STATUS_IS_OK(query.out.result)) {
 295                 torture_comment(tctx, "dcerpc_lsa_QueryInfoPolicy failed: %s\n",
 296                          nt_errstr(query.out.result));
 297                 goto done;
 298         }
 299
 300         close_handle.in.handle = &handle;
 301         close_handle.out.handle = &handle;
 302
 303         status = dcerpc_lsa_Close_r(lsa_handle, mem_ctx, &close_handle);
 304         if (!NT_STATUS_IS_OK(status)) {
 305                 torture_comment(tctx, "dcerpc_lsa_Close failed: %s\n",
 306                          nt_errstr(status));
 307                 goto done;
 308         }
 309         if (!NT_STATUS_IS_OK(close_handle.out.result)) {
 310                 torture_comment(tctx, "dcerpc_lsa_Close failed: %s\n",
 311                          nt_errstr(close_handle.out.result));
 312                 goto done;
 313         }
 314
 315
 316         ret = true;
 317  done:
 318         talloc_free(mem_ctx);
 319         return ret;
 320 }
 321
 322 /*
 323  * test authenticated RPC binds with the variants Samba3 does support
 324  */
 325
 326 static bool torture_bind_samba3(struct torture_context *torture)
 327 {
 328         TALLOC_CTX *mem_ctx;
 329         NTSTATUS status;
 330         bool ret = false;
 331         struct smbcli_state *cli;
 332         struct smbcli_options options;
 333         struct smbcli_session_options session_options;
 334
 335         mem_ctx = talloc_init("torture_bind_authcontext");
 336
 337         if (mem_ctx == NULL) {
 338                 torture_comment(torture, "talloc_init failed\n");
 339                 return false;
 340         }
 341
 342         lpcfg_smbcli_options(torture->lp_ctx, &options);
 343         lpcfg_smbcli_session_options(torture->lp_ctx, &session_options);
 344
 345         status = smbcli_full_connection(mem_ctx, &cli,
 346                                         torture_setting_string(torture, "host", NULL),
 347                                         lpcfg_smb_ports(torture->lp_ctx),
 348                                         "IPC$", NULL,
 349                                         lpcfg_socket_options(torture->lp_ctx),
 350                                         cmdline_credentials,
 351                                         lpcfg_resolve_context(torture->lp_ctx),
 352                                         torture->ev, &options, &session_options,
 353                                         lpcfg_gensec_settings(torture, torture->lp_ctx));
 354         if (!NT_STATUS_IS_OK(status)) {
 355                 torture_comment(torture, "smbcli_full_connection failed: %s\n",
 356                          nt_errstr(status));
 357                 goto done;
 358         }
 359
 360         ret = true;
 361
 362         ret &= bindtest(torture, cli, cmdline_credentials, DCERPC_AUTH_TYPE_NTLMSSP,
 363                         DCERPC_AUTH_LEVEL_INTEGRITY);
 364         ret &= bindtest(torture, cli, cmdline_credentials, DCERPC_AUTH_TYPE_NTLMSSP,
 365                         DCERPC_AUTH_LEVEL_PRIVACY);
 366         ret &= bindtest(torture, cli, cmdline_credentials, DCERPC_AUTH_TYPE_SPNEGO,
 367                         DCERPC_AUTH_LEVEL_INTEGRITY);
 368         ret &= bindtest(torture, cli, cmdline_credentials, DCERPC_AUTH_TYPE_SPNEGO,
 369                         DCERPC_AUTH_LEVEL_PRIVACY);
 370
 371  done:
 372         talloc_free(mem_ctx);
 373         return ret;
 374 }
 375
 376 /*
 377  * Lookup or create a user and return all necessary info
 378  */
 379
 380 static bool get_usr_handle(struct torture_context *tctx,
 381                            struct smbcli_state *cli,
 382                            TALLOC_CTX *mem_ctx,
 383                            struct cli_credentials *admin_creds,
 384                            uint8_t auth_type,
 385                            uint8_t auth_level,
 386                            const char *username,
 387                            char **domain,
 388                            struct dcerpc_pipe **result_pipe,
 389                            struct policy_handle **result_handle,
 390                            struct dom_sid **sid_p)
 391 {
 392         struct dcerpc_pipe *samr_pipe;
 393         struct dcerpc_binding_handle *samr_handle;
 394         NTSTATUS status;
 395         struct policy_handle conn_handle;
 396         struct policy_handle domain_handle;
 397         struct policy_handle *user_handle;
 398         struct samr_Connect2 conn;
 399         struct samr_EnumDomains enumdom;
 400         uint32_t resume_handle = 0;
 401         uint32_t num_entries = 0;
 402         struct samr_SamArray *sam = NULL;
 403         struct samr_LookupDomain l;
 404         struct dom_sid2 *sid = NULL;
 405         int dom_idx;
 406         struct lsa_String domain_name;
 407         struct lsa_String user_name;
 408         struct samr_OpenDomain o;
 409         struct samr_CreateUser2 c;
 410         uint32_t user_rid,access_granted;
 411
 412         samr_pipe = dcerpc_pipe_init(mem_ctx, tctx->ev);
 413         torture_assert(tctx, samr_pipe, "dcerpc_pipe_init failed");
 414 #if 0
 415         samr_pipe->conn->flags |= DCERPC_DEBUG_PRINT_IN | DCERPC_DEBUG_PRINT_OUT;
 416 #endif
 417         samr_handle = samr_pipe->binding_handle;
 418
 419         torture_assert_ntstatus_ok(tctx,
 420                 dcerpc_pipe_open_smb(samr_pipe, cli->tree, "\\samr"),
 421                 "dcerpc_pipe_open_smb failed");
 422
 423         if (admin_creds != NULL) {
 424                 torture_assert_ntstatus_ok(tctx,
 425                         dcerpc_bind_auth(samr_pipe, &ndr_table_samr,
 426                                           admin_creds, lpcfg_gensec_settings(tctx->lp_ctx, tctx->lp_ctx), auth_type, auth_level,
 427                                           NULL),
 428                         "dcerpc_bind_auth failed");
 429         } else {
 430                 /* We must have an authenticated SMB connection */
 431                 torture_assert_ntstatus_ok(tctx,
 432                         dcerpc_bind_auth_none(samr_pipe, &ndr_table_samr),
 433                         "dcerpc_bind_auth_none failed");
 434         }
 435
 436         conn.in.system_name = talloc_asprintf(
 437                 mem_ctx, "\\\\%s", dcerpc_server_name(samr_pipe));
 438         conn.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
 439         conn.out.connect_handle = &conn_handle;
 440
 441         torture_assert_ntstatus_ok(tctx,
 442                 dcerpc_samr_Connect2_r(samr_handle, mem_ctx, &conn),
 443                 "samr_Connect2 failed");
 444         torture_assert_ntstatus_ok(tctx, conn.out.result,
 445                 "samr_Connect2 failed");
 446
 447         enumdom.in.connect_handle = &conn_handle;
 448         enumdom.in.resume_handle = &resume_handle;
 449         enumdom.in.buf_size = (uint32_t)-1;
 450         enumdom.out.resume_handle = &resume_handle;
 451         enumdom.out.num_entries = &num_entries;
 452         enumdom.out.sam = &sam;
 453
 454         torture_assert_ntstatus_ok(tctx,
 455                 dcerpc_samr_EnumDomains_r(samr_handle, mem_ctx, &enumdom),
 456                 "samr_EnumDomains failed");
 457         torture_assert_ntstatus_ok(tctx, enumdom.out.result,
 458                 "samr_EnumDomains failed");
 459
 460         torture_assert_int_equal(tctx, *enumdom.out.num_entries, 2,
 461                 "samr_EnumDomains returned unexpected num_entries");
 462
 463         dom_idx = strequal(sam->entries[0].name.string,
 464                            "builtin") ? 1:0;
 465
 466         l.in.connect_handle = &conn_handle;
 467         domain_name.string = sam->entries[dom_idx].name.string;
 468         *domain = talloc_strdup(mem_ctx, domain_name.string);
 469         l.in.domain_name = &domain_name;
 470         l.out.sid = &sid;
 471
 472         torture_assert_ntstatus_ok(tctx,
 473                 dcerpc_samr_LookupDomain_r(samr_handle, mem_ctx, &l),
 474                 "samr_LookupDomain failed");
 475         torture_assert_ntstatus_ok(tctx, l.out.result,
 476                 "samr_LookupDomain failed");
 477
 478         o.in.connect_handle = &conn_handle;
 479         o.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
 480         o.in.sid = *l.out.sid;
 481         o.out.domain_handle = &domain_handle;
 482
 483         torture_assert_ntstatus_ok(tctx,
 484                 dcerpc_samr_OpenDomain_r(samr_handle, mem_ctx, &o),
 485                 "samr_OpenDomain failed");
 486         torture_assert_ntstatus_ok(tctx, o.out.result,
 487                 "samr_OpenDomain failed");
 488
 489         c.in.domain_handle = &domain_handle;
 490         user_name.string = username;
 491         c.in.account_name = &user_name;
 492         c.in.acct_flags = ACB_NORMAL;
 493         c.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
 494         user_handle = talloc(mem_ctx, struct policy_handle);
 495         c.out.user_handle = user_handle;
 496         c.out.access_granted = &access_granted;
 497         c.out.rid = &user_rid;
 498
 499         torture_assert_ntstatus_ok(tctx,
 500                 dcerpc_samr_CreateUser2_r(samr_handle, mem_ctx, &c),
 501                 "samr_CreateUser2 failed");
 502
 503         if (NT_STATUS_EQUAL(c.out.result, NT_STATUS_USER_EXISTS)) {
 504                 struct samr_LookupNames ln;
 505                 struct samr_OpenUser ou;
 506                 struct samr_Ids rids, types;
 507
 508                 ln.in.domain_handle = &domain_handle;
 509                 ln.in.num_names = 1;
 510                 ln.in.names = &user_name;
 511                 ln.out.rids = &rids;
 512                 ln.out.types = &types;
 513
 514                 torture_assert_ntstatus_ok(tctx,
 515                         dcerpc_samr_LookupNames_r(samr_handle, mem_ctx, &ln),
 516                         "samr_LookupNames failed");
 517                 torture_assert_ntstatus_ok(tctx, ln.out.result,
 518                         "samr_LookupNames failed");
 519
 520                 ou.in.domain_handle = &domain_handle;
 521                 ou.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
 522                 user_rid = ou.in.rid = ln.out.rids->ids[0];
 523                 ou.out.user_handle = user_handle;
 524
 525                 torture_assert_ntstatus_ok(tctx,
 526                         dcerpc_samr_OpenUser_r(samr_handle, mem_ctx, &ou),
 527                         "samr_OpenUser failed");
 528                 status = ou.out.result;
 529         } else {
 530                 status = c.out.result;
 531         }
 532
 533         torture_assert_ntstatus_ok(tctx, status,
 534                 "samr_CreateUser failed");
 535
 536         *result_pipe = samr_pipe;
 537         *result_handle = user_handle;
 538         if (sid_p != NULL) {
 539                 *sid_p = dom_sid_add_rid(mem_ctx, *l.out.sid, user_rid);
 540         }
 541         return true;
 542
 543 }
 544
 545 /*
 546  * Create a test user
 547  */
 548
 549 static bool create_user(struct torture_context *tctx,
 550                         TALLOC_CTX *mem_ctx, struct smbcli_state *cli,
 551                         struct cli_credentials *admin_creds,
 552                         const char *username, const char *password,
 553                         char **domain_name,
 554                         struct dom_sid **user_sid)
 555 {
 556         TALLOC_CTX *tmp_ctx;
 557         NTSTATUS status;
 558         struct dcerpc_pipe *samr_pipe;
 559         struct dcerpc_binding_handle *samr_handle;
 560         struct policy_handle *wks_handle;
 561         bool ret = false;
 562
 563         if (!(tmp_ctx = talloc_new(mem_ctx))) {
 564                 torture_comment(tctx, "talloc_init failed\n");
 565                 return false;
 566         }
 567
 568         ret = get_usr_handle(tctx, cli, tmp_ctx, admin_creds,
 569                              DCERPC_AUTH_TYPE_NTLMSSP,
 570                              DCERPC_AUTH_LEVEL_INTEGRITY,
 571                              username, domain_name, &samr_pipe, &wks_handle,
 572                              user_sid);
 573         if (ret == false) {
 574                 torture_comment(tctx, "get_usr_handle failed\n");
 575                 goto done;
 576         }
 577         samr_handle = samr_pipe->binding_handle;
 578
 579         {
 580                 struct samr_SetUserInfo2 sui2;
 581                 struct samr_SetUserInfo sui;
 582                 struct samr_QueryUserInfo qui;
 583                 union samr_UserInfo u_info;
 584                 union samr_UserInfo *info;
 585                 DATA_BLOB session_key;
 586
 587
 588                 ZERO_STRUCT(u_info);
 589                 encode_pw_buffer(u_info.info23.password.data, password,
 590                                  STR_UNICODE);
 591
 592                 status = dcerpc_fetch_session_key(samr_pipe, &session_key);
 593                 if (!NT_STATUS_IS_OK(status)) {
 594                         torture_comment(tctx, "dcerpc_fetch_session_key failed\n");
 595                         goto done;
 596                 }
 597                 arcfour_crypt_blob(u_info.info23.password.data, 516,
 598                                    &session_key);
 599                 u_info.info23.info.password_expired = 0;
 600                 u_info.info23.info.fields_present = SAMR_FIELD_NT_PASSWORD_PRESENT |
 601                                                     SAMR_FIELD_LM_PASSWORD_PRESENT |
 602                                                     SAMR_FIELD_EXPIRED_FLAG;
 603                 sui2.in.user_handle = wks_handle;
 604                 sui2.in.info = &u_info;
 605                 sui2.in.level = 23;
 606
 607                 status = dcerpc_samr_SetUserInfo2_r(samr_handle, tmp_ctx, &sui2);
 608                 if (!NT_STATUS_IS_OK(status)) {
 609                         torture_comment(tctx, "samr_SetUserInfo(23) failed: %s\n",
 610                                  nt_errstr(status));
 611                         goto done;
 612                 }
 613                 if (!NT_STATUS_IS_OK(sui2.out.result)) {
 614                         torture_comment(tctx, "samr_SetUserInfo(23) failed: %s\n",
 615                                  nt_errstr(sui2.out.result));
 616                         goto done;
 617                 }
 618
 619                 u_info.info16.acct_flags = ACB_NORMAL;
 620                 sui.in.user_handle = wks_handle;
 621                 sui.in.info = &u_info;
 622                 sui.in.level = 16;
 623
 624                 status = dcerpc_samr_SetUserInfo_r(samr_handle, tmp_ctx, &sui);
 625                 if (!NT_STATUS_IS_OK(status) || !NT_STATUS_IS_OK(sui.out.result)) {
 626                         torture_comment(tctx, "samr_SetUserInfo(16) failed\n");
 627                         goto done;
 628                 }
 629
 630                 qui.in.user_handle = wks_handle;
 631                 qui.in.level = 21;
 632                 qui.out.info = &info;
 633
 634                 status = dcerpc_samr_QueryUserInfo_r(samr_handle, tmp_ctx, &qui);
 635                 if (!NT_STATUS_IS_OK(status) || !NT_STATUS_IS_OK(qui.out.result)) {
 636                         torture_comment(tctx, "samr_QueryUserInfo(21) failed\n");
 637                         goto done;
 638                 }
 639
 640                 info->info21.allow_password_change = 0;
 641                 info->info21.force_password_change = 0;
 642                 info->info21.account_name.string = NULL;
 643                 info->info21.rid = 0;
 644                 info->info21.acct_expiry = 0;
 645                 info->info21.fields_present = 0x81827fa; /* copy usrmgr.exe */
 646
 647                 u_info.info21 = info->info21;
 648                 sui.in.user_handle = wks_handle;
 649                 sui.in.info = &u_info;
 650                 sui.in.level = 21;
 651
 652                 status = dcerpc_samr_SetUserInfo_r(samr_handle, tmp_ctx, &sui);
 653                 if (!NT_STATUS_IS_OK(status) || !NT_STATUS_IS_OK(sui.out.result)) {
 654                         torture_comment(tctx, "samr_SetUserInfo(21) failed\n");
 655                         goto done;
 656                 }
 657         }
 658
 659         *domain_name= talloc_steal(mem_ctx, *domain_name);
 660         *user_sid = talloc_steal(mem_ctx, *user_sid);
 661         ret = true;
 662  done:
 663         talloc_free(tmp_ctx);
 664         return ret;
 665 }
 666
 667 /*
 668  * Delete a test user
 669  */
 670
 671 static bool delete_user(struct torture_context *tctx,
 672                         struct smbcli_state *cli,
 673                         struct cli_credentials *admin_creds,
 674                         const char *username)
 675 {
 676         TALLOC_CTX *mem_ctx;
 677         NTSTATUS status;
 678         char *dom_name;
 679         struct dcerpc_pipe *samr_pipe;
 680         struct dcerpc_binding_handle *samr_handle;
 681         struct policy_handle *user_handle;
 682         bool ret = false;
 683
 684         if ((mem_ctx = talloc_init("leave")) == NULL) {
 685                 torture_comment(tctx, "talloc_init failed\n");
 686                 return false;
 687         }
 688
 689         ret = get_usr_handle(tctx, cli, mem_ctx, admin_creds,
 690                              DCERPC_AUTH_TYPE_NTLMSSP,
 691                              DCERPC_AUTH_LEVEL_INTEGRITY,
 692                              username, &dom_name, &samr_pipe,
 693                              &user_handle, NULL);
 694         if (ret == false) {
 695                 torture_comment(tctx, "get_wks_handle failed\n");
 696                 goto done;
 697         }
 698         samr_handle = samr_pipe->binding_handle;
 699
 700         {
 701                 struct samr_DeleteUser d;
 702
 703                 d.in.user_handle = user_handle;
 704                 d.out.user_handle = user_handle;
 705
 706                 status = dcerpc_samr_DeleteUser_r(samr_handle, mem_ctx, &d);
 707                 if (!NT_STATUS_IS_OK(status)) {
 708                         torture_comment(tctx, "samr_DeleteUser failed %s\n", nt_errstr(status));
 709                         goto done;
 710                 }
 711                 if (!NT_STATUS_IS_OK(d.out.result)) {
 712                         torture_comment(tctx, "samr_DeleteUser failed %s\n", nt_errstr(d.out.result));
 713                         goto done;
 714                 }
 715
 716         }
 717
 718         ret = true;
 719
 720  done:
 721         talloc_free(mem_ctx);
 722         return ret;
 723 }
 724
 725 /*
 726  * Do a Samba3-style join
 727  */
 728
 729 static bool join3(struct torture_context *tctx,
 730                   struct smbcli_state *cli,
 731                   bool use_level25,
 732                   struct cli_credentials *admin_creds,
 733                   struct cli_credentials *wks_creds)
 734 {
 735         TALLOC_CTX *mem_ctx;
 736         NTSTATUS status;
 737         char *dom_name;
 738         struct dcerpc_pipe *samr_pipe;
 739         struct dcerpc_binding_handle *samr_handle;
 740         struct policy_handle *wks_handle;
 741         bool ret = false;
 742         NTTIME last_password_change;
 743
 744         if ((mem_ctx = talloc_init("join3")) == NULL) {
 745                 torture_comment(tctx, "talloc_init failed\n");
 746                 return false;
 747         }
 748
 749         ret = get_usr_handle(
 750                 tctx, cli, mem_ctx, admin_creds,
 751                 DCERPC_AUTH_TYPE_NTLMSSP,
 752                 DCERPC_AUTH_LEVEL_PRIVACY,
 753                 talloc_asprintf(mem_ctx, "%s$",
 754                                 cli_credentials_get_workstation(wks_creds)),
 755                 &dom_name, &samr_pipe, &wks_handle, NULL);
 756         if (ret == false) {
 757                 torture_comment(tctx, "get_wks_handle failed\n");
 758                 goto done;
 759         }
 760         samr_handle = samr_pipe->binding_handle;
 761         ret = false;
 762         {
 763                 struct samr_QueryUserInfo q;
 764                 union samr_UserInfo *info;
 765
 766                 q.in.user_handle = wks_handle;
 767                 q.in.level = 21;
 768                 q.out.info = &info;
 769
 770                 status = dcerpc_samr_QueryUserInfo_r(samr_handle, mem_ctx, &q);
 771                 if (!NT_STATUS_IS_OK(status)) {
 772                         torture_warning(tctx, "QueryUserInfo failed: %s\n",
 773                                   nt_errstr(status));
 774                         goto done;
 775                 }
 776                 if (!NT_STATUS_IS_OK(q.out.result)) {
 777                         torture_warning(tctx, "QueryUserInfo failed: %s\n",
 778                                   nt_errstr(q.out.result));
 779                         goto done;
 780                 }
 781
 782
 783                 last_password_change = info->info21.last_password_change;
 784         }
 785
 786         cli_credentials_set_domain(wks_creds, dom_name, CRED_SPECIFIED);
 787
 788         if (use_level25) {
 789                 struct samr_SetUserInfo2 sui2;
 790                 union samr_UserInfo u_info;
 791                 struct samr_UserInfo21 *i21 = &u_info.info25.info;
 792                 DATA_BLOB session_key;
 793                 DATA_BLOB confounded_session_key = data_blob_talloc(
 794                         mem_ctx, NULL, 16);
 795                 MD5_CTX ctx;
 796                 uint8_t confounder[16];
 797
 798                 ZERO_STRUCT(u_info);
 799
 800                 i21->full_name.string = talloc_asprintf(
 801                         mem_ctx, "%s$",
 802                         cli_credentials_get_workstation(wks_creds));
 803                 i21->acct_flags = ACB_WSTRUST;
 804                 i21->fields_present = SAMR_FIELD_FULL_NAME |
 805                         SAMR_FIELD_ACCT_FLAGS | SAMR_FIELD_NT_PASSWORD_PRESENT;
 806                 /* this would break the test result expectations
 807                 i21->fields_present |= SAMR_FIELD_EXPIRED_FLAG;
 808                 i21->password_expired = 1;
 809                 */
 810
 811                 encode_pw_buffer(u_info.info25.password.data,
 812                                  cli_credentials_get_password(wks_creds),
 813                                  STR_UNICODE);
 814                 status = dcerpc_fetch_session_key(samr_pipe, &session_key);
 815                 if (!NT_STATUS_IS_OK(status)) {
 816                         torture_comment(tctx, "dcerpc_fetch_session_key failed: %s\n",
 817                                  nt_errstr(status));
 818                         goto done;
 819                 }
 820                 generate_random_buffer((uint8_t *)confounder, 16);
 821
 822                 MD5Init(&ctx);
 823                 MD5Update(&ctx, confounder, 16);
 824                 MD5Update(&ctx, session_key.data, session_key.length);
 825                 MD5Final(confounded_session_key.data, &ctx);
 826
 827                 arcfour_crypt_blob(u_info.info25.password.data, 516,
 828                                    &confounded_session_key);
 829                 memcpy(&u_info.info25.password.data[516], confounder, 16);
 830
 831                 sui2.in.user_handle = wks_handle;
 832                 sui2.in.level = 25;
 833                 sui2.in.info = &u_info;
 834
 835                 status = dcerpc_samr_SetUserInfo2_r(samr_handle, mem_ctx, &sui2);
 836                 if (!NT_STATUS_IS_OK(status)) {
 837                         torture_comment(tctx, "samr_SetUserInfo2(25) failed: %s\n",
 838                                  nt_errstr(status));
 839                         goto done;
 840                 }
 841                 if (!NT_STATUS_IS_OK(sui2.out.result)) {
 842                         torture_comment(tctx, "samr_SetUserInfo2(25) failed: %s\n",
 843                                  nt_errstr(sui2.out.result));
 844                         goto done;
 845                 }
 846         } else {
 847                 struct samr_SetUserInfo2 sui2;
 848                 struct samr_SetUserInfo sui;
 849                 union samr_UserInfo u_info;
 850                 DATA_BLOB session_key;
 851
 852                 encode_pw_buffer(u_info.info24.password.data,
 853                                  cli_credentials_get_password(wks_creds),
 854                                  STR_UNICODE);
 855                 /* just to make this test pass */
 856                 u_info.info24.password_expired = 1;
 857
 858                 status = dcerpc_fetch_session_key(samr_pipe, &session_key);
 859                 if (!NT_STATUS_IS_OK(status)) {
 860                         torture_comment(tctx, "dcerpc_fetch_session_key failed\n");
 861                         goto done;
 862                 }
 863                 arcfour_crypt_blob(u_info.info24.password.data, 516,
 864                                    &session_key);
 865                 sui2.in.user_handle = wks_handle;
 866                 sui2.in.info = &u_info;
 867                 sui2.in.level = 24;
 868
 869                 status = dcerpc_samr_SetUserInfo2_r(samr_handle, mem_ctx, &sui2);
 870                 if (!NT_STATUS_IS_OK(status)) {
 871                         torture_comment(tctx, "samr_SetUserInfo(24) failed: %s\n",
 872                                  nt_errstr(status));
 873                         goto done;
 874                 }
 875                 if (!NT_STATUS_IS_OK(sui2.out.result)) {
 876                         torture_comment(tctx, "samr_SetUserInfo(24) failed: %s\n",
 877                                  nt_errstr(sui2.out.result));
 878                         goto done;
 879                 }
 880
 881                 u_info.info16.acct_flags = ACB_WSTRUST;
 882                 sui.in.user_handle = wks_handle;
 883                 sui.in.info = &u_info;
 884                 sui.in.level = 16;
 885
 886                 status = dcerpc_samr_SetUserInfo_r(samr_handle, mem_ctx, &sui);
 887                 if (!NT_STATUS_IS_OK(status) || !NT_STATUS_IS_OK(sui.out.result)) {
 888                         torture_comment(tctx, "samr_SetUserInfo(16) failed\n");
 889                         goto done;
 890                 }
 891         }
 892
 893         {
 894                 struct samr_QueryUserInfo q;
 895                 union samr_UserInfo *info;
 896
 897                 q.in.user_handle = wks_handle;
 898                 q.in.level = 21;
 899                 q.out.info = &info;
 900
 901                 status = dcerpc_samr_QueryUserInfo_r(samr_handle, mem_ctx, &q);
 902                 if (!NT_STATUS_IS_OK(status)) {
 903                         torture_warning(tctx, "QueryUserInfo failed: %s\n",
 904                                   nt_errstr(status));
 905                         goto done;
 906                 }
 907                 if (!NT_STATUS_IS_OK(q.out.result)) {
 908                         torture_warning(tctx, "QueryUserInfo failed: %s\n",
 909                                   nt_errstr(q.out.result));
 910                         goto done;
 911                 }
 912
 913                 if (use_level25) {
 914                         if (last_password_change
 915                             == info->info21.last_password_change) {
 916                                 torture_warning(tctx, "last_password_change unchanged "
 917                                          "during join, level25 must change "
 918                                          "it\n");
 919                                 goto done;
 920                         }
 921                 }
 922                 else {
 923                         if (last_password_change
 924                             != info->info21.last_password_change) {
 925                                 torture_warning(tctx, "last_password_change changed "
 926                                          "during join, level24 doesn't "
 927                                          "change it\n");
 928                                 goto done;
 929                         }
 930                 }
 931         }
 932
 933         ret = true;
 934
 935  done:
 936         talloc_free(mem_ctx);
 937         return ret;
 938 }
 939
 940 /*
 941  * Do a ReqChallenge/Auth2 and get the wks creds
 942  */
 943
 944 static bool auth2(struct torture_context *tctx,
 945                   struct smbcli_state *cli,
 946                   struct cli_credentials *wks_cred)
 947 {
 948         TALLOC_CTX *mem_ctx;
 949         struct dcerpc_pipe *net_pipe;
 950         struct dcerpc_binding_handle *net_handle;
 951         bool result = false;
 952         NTSTATUS status;
 953         struct netr_ServerReqChallenge r;
 954         struct netr_Credential netr_cli_creds;
 955         struct netr_Credential netr_srv_creds;
 956         uint32_t negotiate_flags;
 957         struct netr_ServerAuthenticate2 a;
 958         struct netlogon_creds_CredentialState *creds_state;
 959         struct netr_Credential netr_cred;
 960         struct samr_Password mach_pw;
 961
 962         mem_ctx = talloc_new(NULL);
 963         if (mem_ctx == NULL) {
 964                 torture_comment(tctx, "talloc_new failed\n");
 965                 return false;
 966         }
 967
 968         net_pipe = dcerpc_pipe_init(mem_ctx, tctx->ev);
 969         if (net_pipe == NULL) {
 970                 torture_comment(tctx, "dcerpc_pipe_init failed\n");
 971                 goto done;
 972         }
 973         net_handle = net_pipe->binding_handle;
 974
 975         status = dcerpc_pipe_open_smb(net_pipe, cli->tree, "\\netlogon");
 976         if (!NT_STATUS_IS_OK(status)) {
 977                 torture_comment(tctx, "dcerpc_pipe_open_smb failed: %s\n",
 978                          nt_errstr(status));
 979                 goto done;
 980         }
 981
 982         status = dcerpc_bind_auth_none(net_pipe, &ndr_table_netlogon);
 983         if (!NT_STATUS_IS_OK(status)) {
 984                 torture_comment(tctx, "dcerpc_bind_auth_none failed: %s\n",
 985                          nt_errstr(status));
 986                 goto done;
 987         }
 988
 989         r.in.computer_name = cli_credentials_get_workstation(wks_cred);
 990         r.in.server_name = talloc_asprintf(
 991                 mem_ctx, "\\\\%s", dcerpc_server_name(net_pipe));
 992         if (r.in.server_name == NULL) {
 993                 torture_comment(tctx, "talloc_asprintf failed\n");
 994                 goto done;
 995         }
 996         generate_random_buffer(netr_cli_creds.data,
 997                                sizeof(netr_cli_creds.data));
 998         r.in.credentials = &netr_cli_creds;
 999         r.out.return_credentials = &netr_srv_creds;
1000
1001         status = dcerpc_netr_ServerReqChallenge_r(net_handle, mem_ctx, &r);
1002         if (!NT_STATUS_IS_OK(status)) {
1003                 torture_comment(tctx, "netr_ServerReqChallenge failed: %s\n",
1004                          nt_errstr(status));
1005                 goto done;
1006         }
1007         if (!NT_STATUS_IS_OK(r.out.result)) {
1008                 torture_comment(tctx, "netr_ServerReqChallenge failed: %s\n",
1009                          nt_errstr(r.out.result));
1010                 goto done;
1011         }
1012
1013         negotiate_flags = NETLOGON_NEG_AUTH2_FLAGS;
1014         E_md4hash(cli_credentials_get_password(wks_cred), mach_pw.hash);
1015
1016         a.in.server_name = talloc_asprintf(
1017                 mem_ctx, "\\\\%s", dcerpc_server_name(net_pipe));
1018         a.in.account_name = talloc_asprintf(
1019                 mem_ctx, "%s$", cli_credentials_get_workstation(wks_cred));
1020         a.in.computer_name = cli_credentials_get_workstation(wks_cred);
1021         a.in.secure_channel_type = SEC_CHAN_WKSTA;
1022         a.in.negotiate_flags = &negotiate_flags;
1023         a.out.negotiate_flags = &negotiate_flags;
1024         a.in.credentials = &netr_cred;
1025         a.out.return_credentials = &netr_cred;
1026
1027         creds_state = netlogon_creds_client_init(mem_ctx,
1028                                                  a.in.account_name,
1029                                                  a.in.computer_name,
1030                                                  a.in.secure_channel_type,
1031                                                  r.in.credentials,
1032                                                  r.out.return_credentials, &mach_pw,
1033                                                  &netr_cred, negotiate_flags);
1034         torture_assert(tctx, (creds_state != NULL), "memory allocation failed");
1035
1036         status = dcerpc_netr_ServerAuthenticate2_r(net_handle, mem_ctx, &a);
1037         if (!NT_STATUS_IS_OK(status)) {
1038                 torture_comment(tctx, "netr_ServerServerAuthenticate2 failed: %s\n",
1039                          nt_errstr(status));
1040                 goto done;
1041         }
1042         if (!NT_STATUS_IS_OK(a.out.result)) {
1043                 torture_comment(tctx, "netr_ServerServerAuthenticate2 failed: %s\n",
1044                          nt_errstr(a.out.result));
1045                 goto done;
1046         }
1047
1048         if (!netlogon_creds_client_check(creds_state, a.out.return_credentials)) {
1049                 torture_comment(tctx, "creds_client_check failed\n");
1050                 goto done;
1051         }
1052
1053         cli_credentials_set_netlogon_creds(wks_cred, creds_state);
1054
1055         result = true;
1056
1057  done:
1058         talloc_free(mem_ctx);
1059         return result;
1060 }
1061
1062 /*
1063  * Do a couple of schannel protected Netlogon ops: Interactive and Network
1064  * login, and change the wks password
1065  */
1066
1067 static bool schan(struct torture_context *tctx,
1068                   struct smbcli_state *cli,
1069                   struct cli_credentials *wks_creds,
1070                   struct cli_credentials *user_creds)
1071 {
1072         TALLOC_CTX *mem_ctx;
1073         NTSTATUS status;
1074         bool ret = false;
1075         struct dcerpc_pipe *net_pipe;
1076         struct dcerpc_binding_handle *net_handle;
1077         int i;
1078
1079         mem_ctx = talloc_new(NULL);
1080         if (mem_ctx == NULL) {
1081                 torture_comment(tctx, "talloc_new failed\n");
1082                 return false;
1083         }
1084
1085         net_pipe = dcerpc_pipe_init(mem_ctx, tctx->ev);
1086         if (net_pipe == NULL) {
1087                 torture_comment(tctx, "dcerpc_pipe_init failed\n");
1088                 goto done;
1089         }
1090         net_handle = net_pipe->binding_handle;
1091
1092         status = dcerpc_pipe_open_smb(net_pipe, cli->tree, "\\netlogon");
1093         if (!NT_STATUS_IS_OK(status)) {
1094                 torture_comment(tctx, "dcerpc_pipe_open_smb failed: %s\n",
1095                          nt_errstr(status));
1096                 goto done;
1097         }
1098
1099 #if 0
1100         net_pipe->conn->flags |= DCERPC_DEBUG_PRINT_IN |
1101                 DCERPC_DEBUG_PRINT_OUT;
1102 #endif
1103 #if 1
1104         net_pipe->conn->flags |= (DCERPC_SIGN | DCERPC_SEAL);
1105         status = dcerpc_bind_auth(net_pipe, &ndr_table_netlogon,
1106                                   wks_creds, lpcfg_gensec_settings(tctx->lp_ctx, tctx->lp_ctx), DCERPC_AUTH_TYPE_SCHANNEL,
1107                                   DCERPC_AUTH_LEVEL_PRIVACY,
1108                                   NULL);
1109 #else
1110         status = dcerpc_bind_auth_none(net_pipe, &ndr_table_netlogon);
1111 #endif
1112         if (!NT_STATUS_IS_OK(status)) {
1113                 torture_comment(tctx, "schannel bind failed: %s\n", nt_errstr(status));
1114                 goto done;
1115         }
1116
1117
1118         for (i=2; i<4; i++) {
1119                 int flags;
1120                 DATA_BLOB chal, nt_resp, lm_resp, names_blob;
1121                 struct netlogon_creds_CredentialState *creds_state;
1122                 struct netr_Authenticator netr_auth, netr_auth2;
1123                 struct netr_NetworkInfo ninfo;
1124                 struct netr_PasswordInfo pinfo;
1125                 struct netr_LogonSamLogon r;
1126                 union netr_LogonLevel logon;
1127                 union netr_Validation validation;
1128                 uint8_t authoritative;
1129                 struct netr_Authenticator return_authenticator;
1130
1131                 flags = CLI_CRED_LANMAN_AUTH | CLI_CRED_NTLM_AUTH |
1132                         CLI_CRED_NTLMv2_AUTH;
1133
1134                 chal = data_blob_talloc(mem_ctx, NULL, 8);
1135                 if (chal.data == NULL) {
1136                         torture_comment(tctx, "data_blob_talloc failed\n");
1137                         goto done;
1138                 }
1139
1140                 generate_random_buffer(chal.data, chal.length);
1141                 names_blob = NTLMv2_generate_names_blob(
1142                         mem_ctx,
1143                         cli_credentials_get_workstation(user_creds),
1144                         cli_credentials_get_domain(user_creds));
1145                 status = cli_credentials_get_ntlm_response(
1146                         user_creds, mem_ctx, &flags, chal, names_blob,
1147                         &lm_resp, &nt_resp, NULL, NULL);
1148                 if (!NT_STATUS_IS_OK(status)) {
1149                         torture_comment(tctx, "cli_credentials_get_ntlm_response failed:"
1150                                  " %s\n", nt_errstr(status));
1151                         goto done;
1152                 }
1153
1154                 creds_state = cli_credentials_get_netlogon_creds(wks_creds);
1155                 netlogon_creds_client_authenticator(creds_state, &netr_auth);
1156
1157                 ninfo.identity_info.account_name.string =
1158                         cli_credentials_get_username(user_creds);
1159                 ninfo.identity_info.domain_name.string =
1160                         cli_credentials_get_domain(user_creds);
1161                 ninfo.identity_info.parameter_control = 0;
1162                 ninfo.identity_info.logon_id_low = 0;
1163                 ninfo.identity_info.logon_id_high = 0;
1164                 ninfo.identity_info.workstation.string =
1165                         cli_credentials_get_workstation(user_creds);
1166                 memcpy(ninfo.challenge, chal.data, sizeof(ninfo.challenge));
1167                 ninfo.nt.length = nt_resp.length;
1168                 ninfo.nt.data = nt_resp.data;
1169                 ninfo.lm.length = lm_resp.length;
1170                 ninfo.lm.data = lm_resp.data;
1171
1172                 logon.network = &ninfo;
1173
1174                 r.in.server_name = talloc_asprintf(
1175                         mem_ctx, "\\\\%s", dcerpc_server_name(net_pipe));
1176                 ZERO_STRUCT(netr_auth2);
1177                 r.in.computer_name =
1178                         cli_credentials_get_workstation(wks_creds);
1179                 r.in.credential = &netr_auth;
1180                 r.in.return_authenticator = &netr_auth2;
1181                 r.in.logon_level = NetlogonNetworkInformation;
1182                 r.in.validation_level = i;
1183                 r.in.logon = &logon;
1184                 r.out.validation = &validation;
1185                 r.out.authoritative = &authoritative;
1186                 r.out.return_authenticator = &return_authenticator;
1187
1188                 status = dcerpc_netr_LogonSamLogon_r(net_handle, mem_ctx, &r);
1189                 if (!NT_STATUS_IS_OK(status)) {
1190                         torture_comment(tctx, "netr_LogonSamLogon failed: %s\n",
1191                                  nt_errstr(status));
1192                         goto done;
1193                 }
1194                 if (!NT_STATUS_IS_OK(r.out.result)) {
1195                         torture_comment(tctx, "netr_LogonSamLogon failed: %s\n",
1196                                  nt_errstr(r.out.result));
1197                         goto done;
1198                 }
1199
1200                 if ((r.out.return_authenticator == NULL) ||
1201                     (!netlogon_creds_client_check(creds_state,
1202                                          &r.out.return_authenticator->cred))) {
1203                         torture_comment(tctx, "Credentials check failed!\n");
1204                         goto done;
1205                 }
1206
1207                 netlogon_creds_client_authenticator(creds_state, &netr_auth);
1208
1209                 pinfo.identity_info = ninfo.identity_info;
1210                 ZERO_STRUCT(pinfo.lmpassword.hash);
1211                 E_md4hash(cli_credentials_get_password(user_creds),
1212                           pinfo.ntpassword.hash);
1213
1214                 netlogon_creds_arcfour_crypt(creds_state, pinfo.ntpassword.hash, 16);
1215
1216                 logon.password = &pinfo;
1217
1218                 r.in.logon_level = NetlogonInteractiveInformation;
1219                 r.in.logon = &logon;
1220                 r.out.return_authenticator = &return_authenticator;
1221
1222                 status = dcerpc_netr_LogonSamLogon_r(net_handle, mem_ctx, &r);
1223                 if (!NT_STATUS_IS_OK(status)) {
1224                         torture_comment(tctx, "netr_LogonSamLogon failed: %s\n",
1225                                  nt_errstr(status));
1226                         goto done;
1227                 }
1228                 if (!NT_STATUS_IS_OK(r.out.result)) {
1229                         torture_comment(tctx, "netr_LogonSamLogon failed: %s\n",
1230                                  nt_errstr(r.out.result));
1231                         goto done;
1232                 }
1233
1234                 if ((r.out.return_authenticator == NULL) ||
1235                     (!netlogon_creds_client_check(creds_state,
1236                                          &r.out.return_authenticator->cred))) {
1237                         torture_comment(tctx, "Credentials check failed!\n");
1238                         goto done;
1239                 }
1240         }
1241
1242         {
1243                 struct netr_ServerPasswordSet s;
1244                 char *password = generate_random_password(wks_creds, 8, 255);
1245                 struct netlogon_creds_CredentialState *creds_state;
1246                 struct netr_Authenticator credential, return_authenticator;
1247                 struct samr_Password new_password;
1248
1249                 s.in.server_name = talloc_asprintf(
1250                         mem_ctx, "\\\\%s", dcerpc_server_name(net_pipe));
1251                 s.in.computer_name = cli_credentials_get_workstation(wks_creds);
1252                 s.in.account_name = talloc_asprintf(
1253                         mem_ctx, "%s$", s.in.computer_name);
1254                 s.in.secure_channel_type = SEC_CHAN_WKSTA;
1255                 s.in.credential = &credential;
1256                 s.in.new_password = &new_password;
1257                 s.out.return_authenticator = &return_authenticator;
1258
1259                 E_md4hash(password, new_password.hash);
1260
1261                 creds_state = cli_credentials_get_netlogon_creds(wks_creds);
1262                 netlogon_creds_des_encrypt(creds_state, &new_password);
1263                 netlogon_creds_client_authenticator(creds_state, &credential);
1264
1265                 status = dcerpc_netr_ServerPasswordSet_r(net_handle, mem_ctx, &s);
1266                 if (!NT_STATUS_IS_OK(status)) {
1267                         torture_comment(tctx, "ServerPasswordSet - %s\n", nt_errstr(status));
1268                         goto done;
1269                 }
1270                 if (!NT_STATUS_IS_OK(s.out.result)) {
1271                         torture_comment(tctx, "ServerPasswordSet - %s\n", nt_errstr(s.out.result));
1272                         goto done;
1273                 }
1274
1275                 if (!netlogon_creds_client_check(creds_state,
1276                                                  &s.out.return_authenticator->cred)) {
1277                         torture_comment(tctx, "Credential chaining failed\n");
1278                 }
1279
1280                 cli_credentials_set_password(wks_creds, password,
1281                                              CRED_SPECIFIED);
1282         }
1283
1284         ret = true;
1285  done:
1286         talloc_free(mem_ctx);
1287         return ret;
1288 }
1289
1290 /*
1291  * Delete the wks account again
1292  */
1293
1294 static bool leave(struct torture_context *tctx,
1295                   struct smbcli_state *cli,
1296                   struct cli_credentials *admin_creds,
1297                   struct cli_credentials *wks_creds)
1298 {
1299         char *wks_name = talloc_asprintf(
1300                 NULL, "%s$", cli_credentials_get_workstation(wks_creds));
1301         bool ret;
1302
1303         ret = delete_user(tctx, cli, admin_creds, wks_name);
1304         talloc_free(wks_name);
1305         return ret;
1306 }
1307
1308 /*
1309  * Test the Samba3 DC code a bit. Join, do some schan netlogon ops, leave
1310  */
1311
1312 static bool torture_netlogon_samba3(struct torture_context *torture)
1313 {
1314         NTSTATUS status;
1315         struct smbcli_state *cli;
1316         struct cli_credentials *anon_creds;
1317         struct cli_credentials *wks_creds;
1318         const char *wks_name;
1319         int i;
1320         struct smbcli_options options;
1321         struct smbcli_session_options session_options;
1322
1323         wks_name = torture_setting_string(torture, "wksname", NULL);
1324         if (wks_name == NULL) {
1325                 wks_name = get_myname(torture);
1326         }
1327
1328         if (!(anon_creds = cli_credentials_init_anon(torture))) {
1329                 torture_fail(torture, "create_anon_creds failed\n");
1330         }
1331
1332         lpcfg_smbcli_options(torture->lp_ctx, &options);
1333         lpcfg_smbcli_session_options(torture->lp_ctx, &session_options);
1334
1335         status = smbcli_full_connection(torture, &cli,
1336                                         torture_setting_string(torture, "host", NULL),
1337                                         lpcfg_smb_ports(torture->lp_ctx),
1338                                         "IPC$", NULL,
1339                                         lpcfg_socket_options(torture->lp_ctx),
1340                                         anon_creds,
1341                                         lpcfg_resolve_context(torture->lp_ctx),
1342                                         torture->ev, &options, &session_options,
1343                                         lpcfg_gensec_settings(torture, torture->lp_ctx));
1344         torture_assert_ntstatus_ok(torture, status, "smbcli_full_connection failed\n");
1345
1346         wks_creds = cli_credentials_init(torture);
1347         if (wks_creds == NULL) {
1348                 torture_fail(torture, "cli_credentials_init failed\n");
1349         }
1350
1351         cli_credentials_set_conf(wks_creds, torture->lp_ctx);
1352         cli_credentials_set_secure_channel_type(wks_creds, SEC_CHAN_WKSTA);
1353         cli_credentials_set_username(wks_creds, wks_name, CRED_SPECIFIED);
1354         cli_credentials_set_workstation(wks_creds, wks_name, CRED_SPECIFIED);
1355         cli_credentials_set_password(wks_creds,
1356                                      generate_random_password(wks_creds, 8, 255),
1357                                      CRED_SPECIFIED);
1358
1359         torture_assert(torture,
1360                 join3(torture, cli, false, cmdline_credentials, wks_creds),
1361                 "join failed");
1362
1363         cli_credentials_set_domain(
1364                 cmdline_credentials, cli_credentials_get_domain(wks_creds),
1365                 CRED_SPECIFIED);
1366
1367         for (i=0; i<2; i++) {
1368
1369                 /* Do this more than once, the routine "schan" changes
1370                  * the workstation password using the netlogon
1371                  * password change routine */
1372
1373                 int j;
1374
1375                 torture_assert(torture,
1376                         auth2(torture, cli, wks_creds),
1377                         "auth2 failed");
1378
1379                 for (j=0; j<2; j++) {
1380                         torture_assert(torture,
1381                                 schan(torture, cli, wks_creds, cmdline_credentials),
1382                                 "schan failed");
1383                 }
1384         }
1385
1386         torture_assert(torture,
1387                 leave(torture, cli, cmdline_credentials, wks_creds),
1388                 "leave failed");
1389
1390         return true;
1391 }
1392
1393 /*
1394  * Do a simple join, testjoin and leave using specified smb and samr
1395  * credentials
1396  */
1397
1398 static bool test_join3(struct torture_context *tctx,
1399                        bool use_level25,
1400                        struct cli_credentials *smb_creds,
1401                        struct cli_credentials *samr_creds,
1402                        const char *wks_name)
1403 {
1404         NTSTATUS status;
1405         struct smbcli_state *cli;
1406         struct cli_credentials *wks_creds;
1407         struct smbcli_options options;
1408         struct smbcli_session_options session_options;
1409
1410         lpcfg_smbcli_options(tctx->lp_ctx, &options);
1411         lpcfg_smbcli_session_options(tctx->lp_ctx, &session_options);
1412
1413         status = smbcli_full_connection(tctx, &cli,
1414                                         torture_setting_string(tctx, "host", NULL),
1415                                         lpcfg_smb_ports(tctx->lp_ctx),
1416                                         "IPC$", NULL, lpcfg_socket_options(tctx->lp_ctx),
1417                                         smb_creds, lpcfg_resolve_context(tctx->lp_ctx),
1418                                         tctx->ev, &options, &session_options,
1419                                         lpcfg_gensec_settings(tctx, tctx->lp_ctx));
1420         torture_assert_ntstatus_ok(tctx, status,
1421                 "smbcli_full_connection failed");
1422
1423         wks_creds = cli_credentials_init(cli);
1424         torture_assert(tctx, wks_creds, "cli_credentials_init failed");
1425
1426         cli_credentials_set_conf(wks_creds, tctx->lp_ctx);
1427         cli_credentials_set_secure_channel_type(wks_creds, SEC_CHAN_WKSTA);
1428         cli_credentials_set_username(wks_creds, wks_name, CRED_SPECIFIED);
1429         cli_credentials_set_workstation(wks_creds, wks_name, CRED_SPECIFIED);
1430         cli_credentials_set_password(wks_creds,
1431                                      generate_random_password(wks_creds, 8, 255),
1432                                      CRED_SPECIFIED);
1433
1434         torture_assert(tctx,
1435                 join3(tctx, cli, use_level25, samr_creds, wks_creds),
1436                 "join failed");
1437
1438         cli_credentials_set_domain(
1439                 cmdline_credentials, cli_credentials_get_domain(wks_creds),
1440                 CRED_SPECIFIED);
1441
1442         torture_assert(tctx,
1443                 auth2(tctx, cli, wks_creds),
1444                 "auth2 failed");
1445
1446         torture_assert(tctx,
1447                 leave(tctx, cli, samr_creds, wks_creds),
1448                 "leave failed");
1449
1450         talloc_free(cli);
1451
1452         return true;
1453 }
1454
1455 /*
1456  * Test the different session key variants. Do it by joining, this uses the
1457  * session key in the setpassword routine. Test the join by doing the auth2.
1458  */
1459
1460 static bool torture_samba3_sessionkey(struct torture_context *torture)
1461 {
1462         struct cli_credentials *anon_creds;
1463         const char *wks_name;
1464
1465         wks_name = torture_setting_string(torture, "wksname", get_myname(torture));
1466
1467         if (!(anon_creds = cli_credentials_init_anon(torture))) {
1468                 torture_fail(torture, "create_anon_creds failed\n");
1469         }
1470
1471         cli_credentials_set_workstation(anon_creds, wks_name, CRED_SPECIFIED);
1472
1473
1474         if (!torture_setting_bool(torture, "samba3", false)) {
1475
1476                 /* Samba3 in the build farm right now does this happily. Need
1477                  * to fix :-) */
1478
1479                 if (test_join3(torture, false, anon_creds, NULL, wks_name)) {
1480                         torture_fail(torture, "join using anonymous bind on an anonymous smb "
1481                                  "connection succeeded -- HUH??\n");
1482                 }
1483         }
1484
1485         torture_assert(torture,
1486                 test_join3(torture, false, anon_creds, cmdline_credentials, wks_name),
1487                 "join using ntlmssp bind on an anonymous smb connection failed");
1488
1489         torture_assert(torture,
1490                 test_join3(torture, false, cmdline_credentials, NULL, wks_name),
1491                 "join using anonymous bind on an authenticated smb connection failed");
1492
1493         torture_assert(torture,
1494                 test_join3(torture, false, cmdline_credentials, cmdline_credentials, wks_name),
1495                 "join using ntlmssp bind on an authenticated smb connection failed");
1496
1497         /*
1498          * The following two are tests for setuserinfolevel 25
1499          */
1500
1501         torture_assert(torture,
1502                 test_join3(torture, true, anon_creds, cmdline_credentials, wks_name),
1503                 "join using ntlmssp bind on an anonymous smb connection failed");
1504
1505         torture_assert(torture,
1506                 test_join3(torture, true, cmdline_credentials, NULL, wks_name),
1507                 "join using anonymous bind on an authenticated smb connection failed");
1508
1509         return true;
1510 }
1511
1512 /*
1513  * open pipe and bind, given an IPC$ context
1514  */
1515
1516 static NTSTATUS pipe_bind_smb(struct torture_context *tctx,
1517                               TALLOC_CTX *mem_ctx,
1518                               struct smbcli_tree *tree,
1519                               const char *pipe_name,
1520                               const struct ndr_interface_table *iface,
1521                               struct dcerpc_pipe **p)
1522 {
1523         struct dcerpc_pipe *result;
1524         NTSTATUS status;
1525
1526         if (!(result = dcerpc_pipe_init(mem_ctx, tctx->ev))) {
1527                 return NT_STATUS_NO_MEMORY;
1528         }
1529
1530         status = dcerpc_pipe_open_smb(result, tree, pipe_name);
1531         if (!NT_STATUS_IS_OK(status)) {
1532                 torture_comment(tctx, "dcerpc_pipe_open_smb failed: %s\n",
1533                          nt_errstr(status));
1534                 talloc_free(result);
1535                 return status;
1536         }
1537
1538         status = dcerpc_bind_auth_none(result, iface);
1539         if (!NT_STATUS_IS_OK(status)) {
1540                 torture_comment(tctx, "schannel bind failed: %s\n", nt_errstr(status));
1541                 talloc_free(result);
1542                 return status;
1543         }
1544
1545         *p = result;
1546         return NT_STATUS_OK;
1547 }
1548
1549 /*
1550  * Sane wrapper around lsa_LookupNames
1551  */
1552
1553 static struct dom_sid *name2sid(struct torture_context *tctx,
1554                                 TALLOC_CTX *mem_ctx,
1555                                 struct dcerpc_pipe *p,
1556                                 const char *name,
1557                                 const char *domain)
1558 {
1559         struct lsa_ObjectAttribute attr;
1560         struct lsa_QosInfo qos;
1561         struct lsa_OpenPolicy2 r;
1562         struct lsa_Close c;
1563         NTSTATUS status;
1564         struct policy_handle handle;
1565         struct lsa_LookupNames l;
1566         struct lsa_TransSidArray sids;
1567         struct lsa_RefDomainList *domains = NULL;
1568         struct lsa_String lsa_name;
1569         uint32_t count = 0;
1570         struct dom_sid *result;
1571         TALLOC_CTX *tmp_ctx;
1572         struct dcerpc_binding_handle *b = p->binding_handle;
1573
1574         if (!(tmp_ctx = talloc_new(mem_ctx))) {
1575                 return NULL;
1576         }
1577
1578         qos.len = 0;
1579         qos.impersonation_level = 2;
1580         qos.context_mode = 1;
1581         qos.effective_only = 0;
1582
1583         attr.len = 0;
1584         attr.root_dir = NULL;
1585         attr.object_name = NULL;
1586         attr.attributes = 0;
1587         attr.sec_desc = NULL;
1588         attr.sec_qos = &qos;
1589
1590         r.in.system_name = "\\";
1591         r.in.attr = &attr;
1592         r.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
1593         r.out.handle = &handle;
1594
1595         status = dcerpc_lsa_OpenPolicy2_r(b, tmp_ctx, &r);
1596         if (!NT_STATUS_IS_OK(status)) {
1597                 torture_comment(tctx, "OpenPolicy2 failed - %s\n", nt_errstr(status));
1598                 talloc_free(tmp_ctx);
1599                 return NULL;
1600         }
1601         if (!NT_STATUS_IS_OK(r.out.result)) {
1602                 torture_comment(tctx, "OpenPolicy2 failed - %s\n", nt_errstr(r.out.result));
1603                 talloc_free(tmp_ctx);
1604                 return NULL;
1605         }
1606
1607         sids.count = 0;
1608         sids.sids = NULL;
1609
1610         lsa_name.string = talloc_asprintf(tmp_ctx, "%s\\%s", domain, name);
1611
1612         l.in.handle = &handle;
1613         l.in.num_names = 1;
1614         l.in.names = &lsa_name;
1615         l.in.sids = &sids;
1616         l.in.level = 1;
1617         l.in.count = &count;
1618         l.out.count = &count;
1619         l.out.sids = &sids;
1620         l.out.domains = &domains;
1621
1622         status = dcerpc_lsa_LookupNames_r(b, tmp_ctx, &l);
1623         if (!NT_STATUS_IS_OK(status)) {
1624                 torture_comment(tctx, "LookupNames of %s failed - %s\n", lsa_name.string,
1625                        nt_errstr(status));
1626                 talloc_free(tmp_ctx);
1627                 return NULL;
1628         }
1629         if (!NT_STATUS_IS_OK(l.out.result)) {
1630                 torture_comment(tctx, "LookupNames of %s failed - %s\n", lsa_name.string,
1631                        nt_errstr(l.out.result));
1632                 talloc_free(tmp_ctx);
1633                 return NULL;
1634         }
1635
1636         result = dom_sid_add_rid(mem_ctx, domains->domains[0].sid,
1637                                  l.out.sids->sids[0].rid);
1638
1639         c.in.handle = &handle;
1640         c.out.handle = &handle;
1641
1642         status = dcerpc_lsa_Close_r(b, tmp_ctx, &c);
1643         if (!NT_STATUS_IS_OK(status)) {
1644                 torture_comment(tctx, "dcerpc_lsa_Close failed - %s\n", nt_errstr(status));
1645                 talloc_free(tmp_ctx);
1646                 return NULL;
1647         }
1648         if (!NT_STATUS_IS_OK(c.out.result)) {
1649                 torture_comment(tctx, "dcerpc_lsa_Close failed - %s\n", nt_errstr(c.out.result));
1650                 talloc_free(tmp_ctx);
1651                 return NULL;
1652         }
1653
1654         talloc_free(tmp_ctx);
1655         return result;
1656 }
1657
1658 /*
1659  * Find out the user SID on this connection
1660  */
1661
1662 static struct dom_sid *whoami(struct torture_context *tctx,
1663                               TALLOC_CTX *mem_ctx,
1664                               struct smbcli_tree *tree)
1665 {
1666         struct dcerpc_pipe *lsa;
1667         struct dcerpc_binding_handle *lsa_handle;
1668         struct lsa_GetUserName r;
1669         NTSTATUS status;
1670         struct lsa_String *authority_name_p = NULL;
1671         struct lsa_String *account_name_p = NULL;
1672         struct dom_sid *result;
1673
1674         status = pipe_bind_smb(tctx, mem_ctx, tree, "\\pipe\\lsarpc",
1675                                &ndr_table_lsarpc, &lsa);
1676         if (!NT_STATUS_IS_OK(status)) {
1677                 torture_warning(tctx, "Could not bind to LSA: %s\n",
1678                          nt_errstr(status));
1679                 return NULL;
1680         }
1681         lsa_handle = lsa->binding_handle;
1682
1683         r.in.system_name = "\\";
1684         r.in.account_name = &account_name_p;
1685         r.in.authority_name = &authority_name_p;
1686         r.out.account_name = &account_name_p;
1687
1688         status = dcerpc_lsa_GetUserName_r(lsa_handle, mem_ctx, &r);
1689
1690         authority_name_p = *r.out.authority_name;
1691
1692         if (!NT_STATUS_IS_OK(status)) {
1693                 torture_warning(tctx, "GetUserName failed - %s\n",
1694                        nt_errstr(status));
1695                 talloc_free(lsa);
1696                 return NULL;
1697         }
1698         if (!NT_STATUS_IS_OK(r.out.result)) {
1699                 torture_warning(tctx, "GetUserName failed - %s\n",
1700                        nt_errstr(r.out.result));
1701                 talloc_free(lsa);
1702                 return NULL;
1703         }
1704
1705         result = name2sid(tctx, mem_ctx, lsa, account_name_p->string,
1706                           authority_name_p->string);
1707
1708         talloc_free(lsa);
1709         return result;
1710 }
1711
1712 static int destroy_tree(struct smbcli_tree *tree)
1713 {
1714         smb_tree_disconnect(tree);
1715         return 0;
1716 }
1717
1718 /*
1719  * Do a tcon, given a session
1720  */
1721
1722 static NTSTATUS secondary_tcon(struct torture_context *tctx,
1723                                TALLOC_CTX *mem_ctx,
1724                                struct smbcli_session *session,
1725                                const char *sharename,
1726                                struct smbcli_tree **res)
1727 {
1728         struct smbcli_tree *result;
1729         TALLOC_CTX *tmp_ctx;
1730         union smb_tcon tcon;
1731         NTSTATUS status;
1732
1733         if (!(tmp_ctx = talloc_new(mem_ctx))) {
1734                 return NT_STATUS_NO_MEMORY;
1735         }
1736
1737         if (!(result = smbcli_tree_init(session, mem_ctx, false))) {
1738                 talloc_free(tmp_ctx);
1739                 return NT_STATUS_NO_MEMORY;
1740         }
1741
1742         tcon.generic.level = RAW_TCON_TCONX;
1743         tcon.tconx.in.flags = TCONX_FLAG_EXTENDED_RESPONSE;
1744         tcon.tconx.in.flags |= TCONX_FLAG_EXTENDED_SIGNATURES;
1745         tcon.tconx.in.password = data_blob(NULL, 0);
1746         tcon.tconx.in.path = sharename;
1747         tcon.tconx.in.device = "?????";
1748
1749         status = smb_raw_tcon(result, tmp_ctx, &tcon);
1750         if (!NT_STATUS_IS_OK(status)) {
1751                 torture_warning(tctx, "smb_raw_tcon failed: %s\n",
1752                          nt_errstr(status));
1753                 talloc_free(tmp_ctx);
1754                 return status;
1755         }
1756
1757         result->tid = tcon.tconx.out.tid;
1758
1759         if (tcon.tconx.out.options & SMB_EXTENDED_SIGNATURES) {
1760                 smb1cli_session_protect_session_key(result->session->smbXcli);
1761         }
1762
1763         result = talloc_steal(mem_ctx, result);
1764         talloc_set_destructor(result, destroy_tree);
1765         talloc_free(tmp_ctx);
1766         *res = result;
1767         return NT_STATUS_OK;
1768 }
1769
1770 /*
1771  * Test the getusername behaviour
1772  */
1773
1774 static bool torture_samba3_rpc_getusername(struct torture_context *torture)
1775 {
1776         NTSTATUS status;
1777         struct smbcli_state *cli;
1778         bool ret = true;
1779         struct dom_sid *user_sid;
1780         struct dom_sid *created_sid;
1781         struct cli_credentials *anon_creds;
1782         struct cli_credentials *user_creds;
1783         char *domain_name;
1784         struct smbcli_options options;
1785         struct smbcli_session_options session_options;
1786
1787         lpcfg_smbcli_options(torture->lp_ctx, &options);
1788         lpcfg_smbcli_session_options(torture->lp_ctx, &session_options);
1789
1790         status = smbcli_full_connection(
1791                 torture, &cli, torture_setting_string(torture, "host", NULL),
1792                 lpcfg_smb_ports(torture->lp_ctx),
1793                 "IPC$", NULL, lpcfg_socket_options(torture->lp_ctx), cmdline_credentials,
1794                 lpcfg_resolve_context(torture->lp_ctx), torture->ev, &options,
1795                 &session_options, lpcfg_gensec_settings(torture, torture->lp_ctx));
1796         torture_assert_ntstatus_ok(torture, status, "smbcli_full_connection failed\n");
1797
1798         if (!(user_sid = whoami(torture, torture, cli->tree))) {
1799                 torture_fail(torture, "whoami on auth'ed connection failed\n");
1800         }
1801
1802         talloc_free(cli);
1803
1804         if (!(anon_creds = cli_credentials_init_anon(torture))) {
1805                 torture_fail(torture, "create_anon_creds failed\n");
1806         }
1807
1808         status = smbcli_full_connection(
1809                 torture, &cli, torture_setting_string(torture, "host", NULL),
1810                 lpcfg_smb_ports(torture->lp_ctx), "IPC$", NULL,
1811                 lpcfg_socket_options(torture->lp_ctx), anon_creds,
1812                 lpcfg_resolve_context(torture->lp_ctx),
1813                 torture->ev, &options, &session_options,
1814                 lpcfg_gensec_settings(torture, torture->lp_ctx));
1815         torture_assert_ntstatus_ok(torture, status, "anon smbcli_full_connection failed\n");
1816
1817         if (!(user_sid = whoami(torture, torture, cli->tree))) {
1818                 torture_fail(torture, "whoami on anon connection failed\n");
1819         }
1820
1821         torture_assert_sid_equal(torture, user_sid, dom_sid_parse_talloc(torture, "s-1-5-7"),
1822                 "Anon lsa_GetUserName returned unexpected SID");
1823
1824         if (!(user_creds = cli_credentials_init(torture))) {
1825                 torture_fail(torture, "cli_credentials_init failed\n");
1826         }
1827
1828         cli_credentials_set_conf(user_creds, torture->lp_ctx);
1829         cli_credentials_set_username(user_creds, "torture_username",
1830                                      CRED_SPECIFIED);
1831         cli_credentials_set_password(user_creds,
1832                                      generate_random_password(user_creds, 8, 255),
1833                                      CRED_SPECIFIED);
1834
1835         if (!create_user(torture, torture, cli, cmdline_credentials,
1836                          cli_credentials_get_username(user_creds),
1837                          cli_credentials_get_password(user_creds),
1838                          &domain_name, &created_sid)) {
1839                 torture_fail(torture, "create_user failed\n");
1840         }
1841
1842         cli_credentials_set_domain(user_creds, domain_name,
1843                                    CRED_SPECIFIED);
1844
1845         {
1846                 struct smbcli_session *session2;
1847                 struct smb_composite_sesssetup setup;
1848                 struct smbcli_tree *tree;
1849
1850                 session2 = smbcli_session_init(cli->transport, torture, false, session_options);
1851                 if (session2 == NULL) {
1852                         torture_fail(torture, "smbcli_session_init failed\n");
1853                 }
1854
1855                 setup.in.sesskey = cli->transport->negotiate.sesskey;
1856                 setup.in.capabilities = cli->transport->negotiate.capabilities;
1857                 setup.in.workgroup = "";
1858                 setup.in.credentials = user_creds;
1859                 setup.in.gensec_settings = lpcfg_gensec_settings(torture, torture->lp_ctx);
1860
1861                 status = smb_composite_sesssetup(session2, &setup);
1862                 torture_assert_ntstatus_ok(torture, status, "session setup with new user failed");
1863
1864                 session2->vuid = setup.out.vuid;
1865
1866                 if (!NT_STATUS_IS_OK(secondary_tcon(torture, torture, session2,
1867                                                     "IPC$", &tree))) {
1868                         torture_fail(torture, "secondary_tcon failed\n");
1869                 }
1870
1871                 if (!(user_sid = whoami(torture, torture, tree))) {
1872                         torture_fail_goto(torture, del, "whoami on user connection failed\n");
1873                         ret = false;
1874                         goto del;
1875                 }
1876
1877                 talloc_free(tree);
1878         }
1879
1880         torture_comment(torture, "Created %s, found %s\n",
1881                  dom_sid_string(torture, created_sid),
1882                  dom_sid_string(torture, user_sid));
1883
1884         if (!dom_sid_equal(created_sid, user_sid)) {
1885                 ret = false;
1886         }
1887
1888  del:
1889         if (!delete_user(torture, cli,
1890                          cmdline_credentials,
1891                          cli_credentials_get_username(user_creds))) {
1892                 torture_fail(torture, "delete_user failed\n");
1893         }
1894
1895         return ret;
1896 }
1897
1898 static bool test_NetShareGetInfo(struct torture_context *tctx,
1899                                  struct dcerpc_pipe *p,
1900                                  const char *sharename)
1901 {
1902         NTSTATUS status;
1903         struct srvsvc_NetShareGetInfo r;
1904         union srvsvc_NetShareInfo info;
1905         uint32_t levels[] = { 0, 1, 2, 501, 502, 1004, 1005, 1006, 1007, 1501 };
1906         int i;
1907         bool ret = true;
1908         struct dcerpc_binding_handle *b = p->binding_handle;
1909
1910         r.in.server_unc = talloc_asprintf(tctx, "\\\\%s",
1911                                           dcerpc_server_name(p));
1912         r.in.share_name = sharename;
1913         r.out.info = &info;
1914
1915         for (i=0;i<ARRAY_SIZE(levels);i++) {
1916                 r.in.level = levels[i];
1917
1918                 torture_comment(tctx, "Testing NetShareGetInfo level %u on share '%s'\n",
1919                        r.in.level, r.in.share_name);
1920
1921                 status = dcerpc_srvsvc_NetShareGetInfo_r(b, tctx, &r);
1922                 if (!NT_STATUS_IS_OK(status)) {
1923                         torture_warning(tctx, "NetShareGetInfo level %u on share '%s' failed"
1924                                " - %s\n", r.in.level, r.in.share_name,
1925                                nt_errstr(status));
1926                         ret = false;
1927                         continue;
1928                 }
1929                 if (!W_ERROR_IS_OK(r.out.result)) {
1930                         torture_warning(tctx, "NetShareGetInfo level %u on share '%s' failed "
1931                                "- %s\n", r.in.level, r.in.share_name,
1932                                win_errstr(r.out.result));
1933                         ret = false;
1934                         continue;
1935                 }
1936         }
1937
1938         return ret;
1939 }
1940
1941 static bool test_NetShareEnum(struct torture_context *tctx,
1942                               struct dcerpc_pipe *p,
1943                               const char **one_sharename)
1944 {
1945         NTSTATUS status;
1946         struct srvsvc_NetShareEnum r;
1947         struct srvsvc_NetShareInfoCtr info_ctr;
1948         struct srvsvc_NetShareCtr0 c0;
1949         struct srvsvc_NetShareCtr1 c1;
1950         struct srvsvc_NetShareCtr2 c2;
1951         struct srvsvc_NetShareCtr501 c501;
1952         struct srvsvc_NetShareCtr502 c502;
1953         struct srvsvc_NetShareCtr1004 c1004;
1954         struct srvsvc_NetShareCtr1005 c1005;
1955         struct srvsvc_NetShareCtr1006 c1006;
1956         struct srvsvc_NetShareCtr1007 c1007;
1957         uint32_t totalentries = 0;
1958         uint32_t levels[] = { 0, 1, 2, 501, 502, 1004, 1005, 1006, 1007 };
1959         int i;
1960         bool ret = true;
1961         struct dcerpc_binding_handle *b = p->binding_handle;
1962
1963         ZERO_STRUCT(info_ctr);
1964
1965         r.in.server_unc = talloc_asprintf(tctx,"\\\\%s",dcerpc_server_name(p));
1966         r.in.info_ctr = &info_ctr;
1967         r.in.max_buffer = (uint32_t)-1;
1968         r.in.resume_handle = NULL;
1969         r.out.totalentries = &totalentries;
1970         r.out.info_ctr = &info_ctr;
1971
1972         for (i=0;i<ARRAY_SIZE(levels);i++) {
1973                 info_ctr.level = levels[i];
1974
1975                 switch (info_ctr.level) {
1976                 case 0:
1977                         ZERO_STRUCT(c0);
1978                         info_ctr.ctr.ctr0 = &c0;
1979                         break;
1980                 case 1:
1981                         ZERO_STRUCT(c1);
1982                         info_ctr.ctr.ctr1 = &c1;
1983                         break;
1984                 case 2:
1985                         ZERO_STRUCT(c2);
1986                         info_ctr.ctr.ctr2 = &c2;
1987                         break;
1988                 case 501:
1989                         ZERO_STRUCT(c501);
1990                         info_ctr.ctr.ctr501 = &c501;
1991                         break;
1992                 case 502:
1993                         ZERO_STRUCT(c502);
1994                         info_ctr.ctr.ctr502 = &c502;
1995                         break;
1996                 case 1004:
1997                         ZERO_STRUCT(c1004);
1998                         info_ctr.ctr.ctr1004 = &c1004;
1999                         break;
2000                 case 1005:
2001                         ZERO_STRUCT(c1005);
2002                         info_ctr.ctr.ctr1005 = &c1005;
2003                         break;
2004                 case 1006:
2005                         ZERO_STRUCT(c1006);
2006                         info_ctr.ctr.ctr1006 = &c1006;
2007                         break;
2008                 case 1007:
2009                         ZERO_STRUCT(c1007);
2010                         info_ctr.ctr.ctr1007 = &c1007;
2011                         break;
2012                 }
2013
2014                 torture_comment(tctx, "Testing NetShareEnum level %u\n", info_ctr.level);
2015
2016                 status = dcerpc_srvsvc_NetShareEnum_r(b, tctx, &r);
2017                 if (!NT_STATUS_IS_OK(status)) {
2018                         torture_warning(tctx, "NetShareEnum level %u failed - %s\n",
2019                                info_ctr.level, nt_errstr(status));
2020                         ret = false;
2021                         continue;
2022                 }
2023                 if (!W_ERROR_IS_OK(r.out.result)) {
2024                         torture_warning(tctx, "NetShareEnum level %u failed - %s\n",
2025                                info_ctr.level, win_errstr(r.out.result));
2026                         continue;
2027                 }
2028                 if (info_ctr.level == 0) {
2029                         struct srvsvc_NetShareCtr0 *ctr = r.out.info_ctr->ctr.ctr0;
2030                         if (ctr->count > 0) {
2031                                 *one_sharename = ctr->array[0].name;
2032                         }
2033                 }
2034         }
2035
2036         return ret;
2037 }
2038
2039 static bool torture_samba3_rpc_srvsvc(struct torture_context *torture)
2040 {
2041         struct dcerpc_pipe *p;
2042         const char *sharename = NULL;
2043         bool ret = true;
2044
2045         torture_assert_ntstatus_ok(torture,
2046                 torture_rpc_connection(torture, &p, &ndr_table_srvsvc),
2047                 "failed to open srvsvc");
2048
2049         ret &= test_NetShareEnum(torture, p, &sharename);
2050         if (sharename == NULL) {
2051                 torture_comment(torture, "did not get sharename\n");
2052         } else {
2053                 ret &= test_NetShareGetInfo(torture, p, sharename);
2054         }
2055
2056         return ret;
2057 }
2058
2059 /*
2060  * Do a ReqChallenge/Auth2 with a random wks name, make sure it returns
2061  * NT_STATUS_NO_SAM_ACCOUNT
2062  */
2063
2064 static bool torture_samba3_rpc_randomauth2(struct torture_context *torture)
2065 {
2066         TALLOC_CTX *mem_ctx;
2067         struct dcerpc_pipe *net_pipe;
2068         struct dcerpc_binding_handle *net_handle;
2069         char *wksname;
2070         bool result = false;
2071         NTSTATUS status;
2072         struct netr_ServerReqChallenge r;
2073         struct netr_Credential netr_cli_creds;
2074         struct netr_Credential netr_srv_creds;
2075         uint32_t negotiate_flags;
2076         struct netr_ServerAuthenticate2 a;
2077         struct netlogon_creds_CredentialState *creds_state;
2078         struct netr_Credential netr_cred;
2079         struct samr_Password mach_pw;
2080         struct smbcli_state *cli;
2081
2082         if (!(mem_ctx = talloc_new(torture))) {
2083                 torture_comment(torture, "talloc_new failed\n");
2084                 return false;
2085         }
2086
2087         if (!(wksname = generate_random_str_list(
2088                       mem_ctx, 14, "ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789"))) {
2089                 torture_comment(torture, "generate_random_str_list failed\n");
2090                 goto done;
2091         }
2092
2093         if (!(torture_open_connection_share(
2094                       mem_ctx, &cli,
2095                       torture, torture_setting_string(torture, "host", NULL),
2096                       "IPC$", torture->ev))) {
2097                 torture_comment(torture, "IPC$ connection failed\n");
2098                 goto done;
2099         }
2100
2101         if (!(net_pipe = dcerpc_pipe_init(mem_ctx, torture->ev))) {
2102                 torture_comment(torture, "dcerpc_pipe_init failed\n");
2103                 goto done;
2104         }
2105         net_handle = net_pipe->binding_handle;
2106
2107         status = dcerpc_pipe_open_smb(net_pipe, cli->tree, "\\netlogon");
2108         if (!NT_STATUS_IS_OK(status)) {
2109                 torture_comment(torture, "dcerpc_pipe_open_smb failed: %s\n",
2110                          nt_errstr(status));
2111                 goto done;
2112         }
2113
2114         status = dcerpc_bind_auth_none(net_pipe, &ndr_table_netlogon);
2115         if (!NT_STATUS_IS_OK(status)) {
2116                 torture_comment(torture, "dcerpc_bind_auth_none failed: %s\n",
2117                          nt_errstr(status));
2118                 goto done;
2119         }
2120
2121         r.in.computer_name = wksname;
2122         r.in.server_name = talloc_asprintf(
2123                 mem_ctx, "\\\\%s", dcerpc_server_name(net_pipe));
2124         if (r.in.server_name == NULL) {
2125                 torture_comment(torture, "talloc_asprintf failed\n");
2126                 goto done;
2127         }
2128         generate_random_buffer(netr_cli_creds.data,
2129                                sizeof(netr_cli_creds.data));
2130         r.in.credentials = &netr_cli_creds;
2131         r.out.return_credentials = &netr_srv_creds;
2132
2133         status = dcerpc_netr_ServerReqChallenge_r(net_handle, mem_ctx, &r);
2134         if (!NT_STATUS_IS_OK(status)) {
2135                 torture_comment(torture, "netr_ServerReqChallenge failed: %s\n",
2136                          nt_errstr(status));
2137                 goto done;
2138         }
2139         if (!NT_STATUS_IS_OK(r.out.result)) {
2140                 torture_comment(torture, "netr_ServerReqChallenge failed: %s\n",
2141                          nt_errstr(r.out.result));
2142                 goto done;
2143         }
2144
2145         negotiate_flags = NETLOGON_NEG_AUTH2_FLAGS;
2146         E_md4hash("foobar", mach_pw.hash);
2147
2148         a.in.server_name = talloc_asprintf(
2149                 mem_ctx, "\\\\%s", dcerpc_server_name(net_pipe));
2150         a.in.account_name = talloc_asprintf(
2151                 mem_ctx, "%s$", wksname);
2152         a.in.computer_name = wksname;
2153         a.in.secure_channel_type = SEC_CHAN_WKSTA;
2154         a.in.negotiate_flags = &negotiate_flags;
2155         a.out.negotiate_flags = &negotiate_flags;
2156         a.in.credentials = &netr_cred;
2157         a.out.return_credentials = &netr_cred;
2158
2159         creds_state = netlogon_creds_client_init(mem_ctx,
2160                                                  a.in.account_name,
2161                                                  a.in.computer_name,
2162                                                  a.in.secure_channel_type,
2163                                                  r.in.credentials,
2164                                                  r.out.return_credentials, &mach_pw,
2165                                                  &netr_cred, negotiate_flags);
2166         torture_assert(torture, (creds_state != NULL), "memory allocation failed");
2167
2168         status = dcerpc_netr_ServerAuthenticate2_r(net_handle, mem_ctx, &a);
2169         if (!NT_STATUS_IS_OK(status)) {
2170                 goto done;
2171         }
2172         if (!NT_STATUS_EQUAL(a.out.result, NT_STATUS_NO_TRUST_SAM_ACCOUNT)) {
2173                 torture_comment(torture, "dcerpc_netr_ServerAuthenticate2 returned %s, "
2174                          "expected NT_STATUS_NO_TRUST_SAM_ACCOUNT\n",
2175                          nt_errstr(a.out.result));
2176                 goto done;
2177         }
2178
2179         result = true;
2180  done:
2181         talloc_free(mem_ctx);
2182         return result;
2183 }
2184
2185 static struct security_descriptor *get_sharesec(struct torture_context *tctx,
2186                                                 TALLOC_CTX *mem_ctx,
2187                                                 struct smbcli_session *sess,
2188                                                 const char *sharename)
2189 {
2190         struct smbcli_tree *tree;
2191         TALLOC_CTX *tmp_ctx;
2192         struct dcerpc_pipe *p;
2193         struct dcerpc_binding_handle *b;
2194         NTSTATUS status;
2195         struct srvsvc_NetShareGetInfo r;
2196         union srvsvc_NetShareInfo info;
2197         struct security_descriptor *result;
2198
2199         if (!(tmp_ctx = talloc_new(mem_ctx))) {
2200                 torture_comment(tctx, "talloc_new failed\n");
2201                 return NULL;
2202         }
2203
2204         if (!NT_STATUS_IS_OK(secondary_tcon(tctx, tmp_ctx, sess, "IPC$", &tree))) {
2205                 torture_comment(tctx, "secondary_tcon failed\n");
2206                 talloc_free(tmp_ctx);
2207                 return NULL;
2208         }
2209
2210         status = pipe_bind_smb(tctx, mem_ctx, tree, "\\pipe\\srvsvc",
2211                                &ndr_table_srvsvc, &p);
2212         if (!NT_STATUS_IS_OK(status)) {
2213                 torture_warning(tctx, "could not bind to srvsvc pipe: %s\n",
2214                          nt_errstr(status));
2215                 talloc_free(tmp_ctx);
2216                 return NULL;
2217         }
2218         b = p->binding_handle;
2219
2220 #if 0
2221         p->conn->flags |= DCERPC_DEBUG_PRINT_IN | DCERPC_DEBUG_PRINT_OUT;
2222 #endif
2223
2224         r.in.server_unc = talloc_asprintf(tmp_ctx, "\\\\%s",
2225                                           dcerpc_server_name(p));
2226         r.in.share_name = sharename;
2227         r.in.level = 502;
2228         r.out.info = &info;
2229
2230         status = dcerpc_srvsvc_NetShareGetInfo_r(b, tmp_ctx, &r);
2231         if (!NT_STATUS_IS_OK(status)) {
2232                 torture_comment(tctx, "srvsvc_NetShareGetInfo failed: %s\n",
2233                          nt_errstr(status));
2234                 talloc_free(tmp_ctx);
2235                 return NULL;
2236         }
2237         if (!W_ERROR_IS_OK(r.out.result)) {
2238                 torture_comment(tctx, "srvsvc_NetShareGetInfo failed: %s\n",
2239                          win_errstr(r.out.result));
2240                 talloc_free(tmp_ctx);
2241                 return NULL;
2242         }
2243
2244         result = talloc_steal(mem_ctx, info.info502->sd_buf.sd);
2245         talloc_free(tmp_ctx);
2246         return result;
2247 }
2248
2249 static NTSTATUS set_sharesec(struct torture_context *tctx,
2250                              TALLOC_CTX *mem_ctx,
2251                              struct smbcli_session *sess,
2252                              const char *sharename,
2253                              struct security_descriptor *sd)
2254 {
2255         struct smbcli_tree *tree;
2256         TALLOC_CTX *tmp_ctx;
2257         struct dcerpc_pipe *p;
2258         struct dcerpc_binding_handle *b;
2259         NTSTATUS status;
2260         struct sec_desc_buf i;
2261         struct srvsvc_NetShareSetInfo r;
2262         union srvsvc_NetShareInfo info;
2263         uint32_t error = 0;
2264
2265         if (!(tmp_ctx = talloc_new(mem_ctx))) {
2266                 torture_comment(tctx, "talloc_new failed\n");
2267                 return NT_STATUS_NO_MEMORY;
2268         }
2269
2270         if (!NT_STATUS_IS_OK(secondary_tcon(tctx, tmp_ctx, sess, "IPC$", &tree))) {
2271                 torture_comment(tctx, "secondary_tcon failed\n");
2272                 talloc_free(tmp_ctx);
2273                 return NT_STATUS_UNSUCCESSFUL;
2274         }
2275
2276         status = pipe_bind_smb(tctx, mem_ctx, tree, "\\pipe\\srvsvc",
2277                                &ndr_table_srvsvc, &p);
2278         if (!NT_STATUS_IS_OK(status)) {
2279                 torture_warning(tctx, "could not bind to srvsvc pipe: %s\n",
2280                          nt_errstr(status));
2281                 talloc_free(tmp_ctx);
2282                 return NT_STATUS_UNSUCCESSFUL;
2283         }
2284         b = p->binding_handle;
2285
2286 #if 0
2287         p->conn->flags |= DCERPC_DEBUG_PRINT_IN | DCERPC_DEBUG_PRINT_OUT;
2288 #endif
2289
2290         r.in.server_unc = talloc_asprintf(tmp_ctx, "\\\\%s",
2291                                           dcerpc_server_name(p));
2292         r.in.share_name = sharename;
2293         r.in.level = 1501;
2294         i.sd = sd;
2295         info.info1501 = &i;
2296         r.in.info = &info;
2297         r.in.parm_error = &error;
2298
2299         status = dcerpc_srvsvc_NetShareSetInfo_r(b, tmp_ctx, &r);
2300         if (!NT_STATUS_IS_OK(status)) {
2301                 torture_comment(tctx, "srvsvc_NetShareSetInfo failed: %s\n",
2302                          nt_errstr(status));
2303         }
2304         if (!W_ERROR_IS_OK(r.out.result)) {
2305                 torture_comment(tctx, "srvsvc_NetShareSetInfo failed: %s\n",
2306                         win_errstr(r.out.result));
2307                 status = werror_to_ntstatus(r.out.result);
2308         }
2309         talloc_free(tmp_ctx);
2310         return status;
2311 }
2312
2313 bool try_tcon(struct torture_context *tctx,
2314               TALLOC_CTX *mem_ctx,
2315               struct security_descriptor *orig_sd,
2316               struct smbcli_session *session,
2317               const char *sharename, const struct dom_sid *user_sid,
2318               unsigned int access_mask, NTSTATUS expected_tcon,
2319               NTSTATUS expected_mkdir)
2320 {
2321         TALLOC_CTX *tmp_ctx;
2322         struct smbcli_tree *rmdir_tree, *tree;
2323         struct dom_sid *domain_sid;
2324         uint32_t rid;
2325         struct security_descriptor *sd;
2326         NTSTATUS status;
2327         bool ret = true;
2328
2329         if (!(tmp_ctx = talloc_new(mem_ctx))) {
2330                 torture_comment(tctx, "talloc_new failed\n");
2331                 return false;
2332         }
2333
2334         status = secondary_tcon(tctx, tmp_ctx, session, sharename, &rmdir_tree);
2335         if (!NT_STATUS_IS_OK(status)) {
2336                 torture_comment(tctx, "first tcon to delete dir failed\n");
2337                 talloc_free(tmp_ctx);
2338                 return false;
2339         }
2340
2341         smbcli_rmdir(rmdir_tree, "sharesec_testdir");
2342
2343         if (!NT_STATUS_IS_OK(dom_sid_split_rid(tmp_ctx, user_sid,
2344                                                &domain_sid, &rid))) {
2345                 torture_comment(tctx, "dom_sid_split_rid failed\n");
2346                 talloc_free(tmp_ctx);
2347                 return false;
2348         }
2349
2350         sd = security_descriptor_dacl_create(
2351                 tmp_ctx, 0, "S-1-5-32-544",
2352                 dom_sid_string(mem_ctx, dom_sid_add_rid(mem_ctx, domain_sid,
2353                                                         DOMAIN_RID_USERS)),
2354                 dom_sid_string(mem_ctx, user_sid),
2355                 SEC_ACE_TYPE_ACCESS_ALLOWED, access_mask, 0, NULL);
2356         if (sd == NULL) {
2357                 torture_comment(tctx, "security_descriptor_dacl_create failed\n");
2358                 talloc_free(tmp_ctx);
2359                 return false;
2360         }
2361
2362         status = set_sharesec(tctx, mem_ctx, session, sharename, sd);
2363         if (!NT_STATUS_IS_OK(status)) {
2364                 torture_comment(tctx, "custom set_sharesec failed: %s\n",
2365                          nt_errstr(status));
2366                 talloc_free(tmp_ctx);
2367                 return false;
2368         }
2369
2370         status = secondary_tcon(tctx, tmp_ctx, session, sharename, &tree);
2371         if (!NT_STATUS_EQUAL(status, expected_tcon)) {
2372                 torture_comment(tctx, "Expected %s, got %s\n", nt_errstr(expected_tcon),
2373                          nt_errstr(status));
2374                 ret = false;
2375                 goto done;
2376         }
2377
2378         if (!NT_STATUS_IS_OK(status)) {
2379                 /* An expected non-access, no point in trying to write */
2380                 goto done;
2381         }
2382
2383         status = smbcli_mkdir(tree, "sharesec_testdir");
2384         if (!NT_STATUS_EQUAL(status, expected_mkdir)) {
2385                 torture_warning(tctx, "Expected %s, got %s\n",
2386                          nt_errstr(expected_mkdir), nt_errstr(status));
2387                 ret = false;
2388         }
2389
2390  done:
2391         smbcli_rmdir(rmdir_tree, "sharesec_testdir");
2392
2393         status = set_sharesec(tctx, mem_ctx, session, sharename, orig_sd);
2394         if (!NT_STATUS_IS_OK(status)) {
2395                 torture_comment(tctx, "custom set_sharesec failed: %s\n",
2396                          nt_errstr(status));
2397                 talloc_free(tmp_ctx);
2398                 return false;
2399         }
2400
2401         talloc_free(tmp_ctx);
2402         return ret;
2403 }
2404
2405 static bool torture_samba3_rpc_sharesec(struct torture_context *torture)
2406 {
2407         struct smbcli_state *cli = NULL;
2408         struct security_descriptor *sd = NULL;
2409         struct dom_sid *user_sid = NULL;
2410         const char *testuser_passwd = NULL;
2411         struct cli_credentials *test_credentials = NULL;
2412         struct smbcli_options options;
2413         struct smbcli_session_options session_options;
2414         NTSTATUS status;
2415         struct test_join *tj = NULL;
2416         struct dcerpc_pipe *lsa_pipe = NULL;
2417         const char *priv_array[1];
2418
2419         /* Create a new user. The normal user has SeBackup and SeRestore
2420            privs so we can't lock them out with a share security descriptor. */
2421         tj = torture_create_testuser(torture,
2422                                         "sharesec_user",
2423                                         torture_setting_string(torture, "workgroup", NULL),
2424                                         ACB_NORMAL,
2425                                         &testuser_passwd);
2426         if (!tj) {
2427                 torture_fail(torture, "Creating sharesec_user failed\n");
2428         }
2429
2430         /* Give them SeDiskOperatorPrivilege but no other privs. */
2431         status = torture_rpc_connection(torture, &lsa_pipe, &ndr_table_lsarpc);
2432         if (!NT_STATUS_IS_OK(status)) {
2433                 torture_delete_testuser(torture, tj, "sharesec_user");
2434                 talloc_free(tj);
2435                 torture_fail(torture, "Error connecting to LSA pipe");
2436         }
2437
2438         priv_array[0] = "SeDiskOperatorPrivilege";
2439         if (!torture_setup_privs(torture,
2440                                 lsa_pipe,
2441                                 1,
2442                                 priv_array,
2443                                 torture_join_user_sid(tj))) {
2444                 talloc_free(lsa_pipe);
2445                 torture_delete_testuser(torture, tj, "sharesec_user");
2446                 talloc_free(tj);
2447                 torture_fail(torture, "Failed to setup privs\n");
2448         }
2449         talloc_free(lsa_pipe);
2450
2451         test_credentials = cli_credentials_init(torture);
2452         cli_credentials_set_workstation(test_credentials, "localhost", CRED_SPECIFIED);
2453         cli_credentials_set_domain(test_credentials, lpcfg_workgroup(torture->lp_ctx),
2454                         CRED_SPECIFIED);
2455         cli_credentials_set_username(test_credentials, "sharesec_user", CRED_SPECIFIED);
2456         cli_credentials_set_password(test_credentials, testuser_passwd, CRED_SPECIFIED);
2457
2458         ZERO_STRUCT(options);
2459         ZERO_STRUCT(session_options);
2460         lpcfg_smbcli_options(torture->lp_ctx, &options);
2461         lpcfg_smbcli_session_options(torture->lp_ctx, &session_options);
2462
2463         status = smbcli_full_connection(torture,
2464                                         &cli,
2465                                         torture_setting_string(torture, "host", NULL),
2466                                         lpcfg_smb_ports(torture->lp_ctx),
2467                                         "IPC$",
2468                                         NULL,
2469                                         lpcfg_socket_options(torture->lp_ctx),
2470                                         test_credentials,
2471                                         lpcfg_resolve_context(torture->lp_ctx),
2472                                         torture->ev,
2473                                         &options,
2474                                         &session_options,
2475                                         lpcfg_gensec_settings(torture, torture->lp_ctx));
2476         if (!NT_STATUS_IS_OK(status)) {
2477                 talloc_free(cli);
2478                 torture_delete_testuser(torture, tj, "sharesec_user");
2479                 talloc_free(tj);
2480                 torture_fail(torture, "Failed to open connection\n");
2481         }
2482
2483         if (!(user_sid = whoami(torture, torture, cli->tree))) {
2484                 talloc_free(cli);
2485                 torture_delete_testuser(torture, tj, "sharesec_user");
2486                 talloc_free(tj);
2487                 torture_fail(torture, "whoami failed\n");
2488         }
2489
2490         sd = get_sharesec(torture, torture, cli->session,
2491                           torture_setting_string(torture, "share", NULL));
2492
2493         if (!try_tcon(torture, torture, sd, cli->session,
2494                         torture_setting_string(torture, "share", NULL),
2495                         user_sid, 0, NT_STATUS_ACCESS_DENIED, NT_STATUS_OK)) {
2496                 talloc_free(cli);
2497                 torture_delete_testuser(torture, tj, "sharesec_user");
2498                 talloc_free(tj);
2499                 torture_fail(torture, "failed to test tcon with 0 access_mask");
2500         }
2501
2502         if (!try_tcon(torture, torture, sd, cli->session,
2503                         torture_setting_string(torture, "share", NULL),
2504                         user_sid, SEC_FILE_READ_DATA, NT_STATUS_OK,
2505                         NT_STATUS_MEDIA_WRITE_PROTECTED)) {
2506                 talloc_free(cli);
2507                 torture_delete_testuser(torture, tj, "sharesec_user");
2508                 talloc_free(tj);
2509                 torture_fail(torture, "failed to test tcon with SEC_FILE_READ_DATA access_mask");
2510         }
2511
2512         /* sharesec_user doesn't have any rights on the underlying file system.
2513            Go back to the normal user. */
2514
2515         talloc_free(cli);
2516         cli = NULL;
2517         torture_delete_testuser(torture, tj, "sharesec_user");
2518         talloc_free(tj);
2519         tj = NULL;
2520
2521         if (!(torture_open_connection_share(
2522                       torture, &cli, torture, torture_setting_string(torture, "host", NULL),
2523                       "IPC$", torture->ev))) {
2524                 torture_fail(torture, "IPC$ connection failed\n");
2525         }
2526
2527         if (!(user_sid = whoami(torture, torture, cli->tree))) {
2528                 torture_fail(torture, "whoami failed\n");
2529         }
2530         torture_assert(torture, try_tcon(
2531                         torture, torture, sd, cli->session,
2532                         torture_setting_string(torture, "share", NULL),
2533                         user_sid, SEC_FILE_ALL, NT_STATUS_OK, NT_STATUS_OK),
2534                         "failed to test tcon with SEC_FILE_ALL access_mask")
2535
2536         return true;
2537 }
2538
2539 static bool torture_samba3_rpc_lsa(struct torture_context *torture)
2540 {
2541         struct dcerpc_pipe *p;
2542         struct dcerpc_binding_handle *b;
2543         struct policy_handle lsa_handle;
2544
2545         torture_assert_ntstatus_ok(torture,
2546                 torture_rpc_connection(torture, &p, &ndr_table_lsarpc),
2547                 "failed to setup lsarpc");
2548
2549         b = p->binding_handle;
2550
2551         {
2552                 struct lsa_ObjectAttribute attr;
2553                 struct lsa_OpenPolicy2 o;
2554                 o.in.system_name = talloc_asprintf(
2555                         torture, "\\\\%s", dcerpc_server_name(p));
2556                 ZERO_STRUCT(attr);
2557                 o.in.attr = &attr;
2558                 o.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
2559                 o.out.handle = &lsa_handle;
2560
2561                 torture_assert_ntstatus_ok(torture,
2562                         dcerpc_lsa_OpenPolicy2_r(b, torture, &o),
2563                         "dcerpc_lsa_OpenPolicy2 failed");
2564                 torture_assert_ntstatus_ok(torture, o.out.result,
2565                         "dcerpc_lsa_OpenPolicy2 failed");
2566         }
2567
2568         {
2569                 int i;
2570                 int levels[] = { 2,3,5,6 };
2571
2572                 for (i=0; i<ARRAY_SIZE(levels); i++) {
2573                         struct lsa_QueryInfoPolicy r;
2574                         union lsa_PolicyInformation *info = NULL;
2575                         r.in.handle = &lsa_handle;
2576                         r.in.level = levels[i];
2577                         r.out.info = &info;
2578
2579                         torture_assert_ntstatus_ok(torture,
2580                                 dcerpc_lsa_QueryInfoPolicy_r(b, torture, &r),
2581                                 talloc_asprintf(torture, "dcerpc_lsa_QueryInfoPolicy level %d failed", levels[i]));
2582                         torture_assert_ntstatus_ok(torture, r.out.result,
2583                                 talloc_asprintf(torture, "dcerpc_lsa_QueryInfoPolicy level %d failed", levels[i]));
2584                 }
2585         }
2586
2587         return true;
2588 }
2589
2590 static NTSTATUS get_servername(TALLOC_CTX *mem_ctx, struct smbcli_tree *tree,
2591                                char **name)
2592 {
2593         struct rap_WserverGetInfo r;
2594         NTSTATUS status;
2595         char servername[17];
2596         size_t converted_size;
2597
2598         r.in.level = 0;
2599         r.in.bufsize = 0xffff;
2600
2601         status = smbcli_rap_netservergetinfo(tree, mem_ctx, &r);
2602         if (!NT_STATUS_IS_OK(status)) {
2603                 return status;
2604         }
2605
2606         memcpy(servername, r.out.info.info0.name, 16);
2607         servername[16] = '\0';
2608
2609         if (!pull_ascii_talloc(mem_ctx, name, servername, &converted_size)) {
2610                 return NT_STATUS_NO_MEMORY;
2611         }
2612
2613         return NT_STATUS_OK;
2614 }
2615
2616 static bool rap_get_servername(struct torture_context *tctx,
2617                                char **servername)
2618 {
2619         struct smbcli_state *cli;
2620
2621         torture_assert(tctx,
2622                 torture_open_connection_share(tctx, &cli, tctx, torture_setting_string(tctx, "host", NULL),
2623                                               "IPC$", tctx->ev),
2624                 "IPC$ connection failed");
2625
2626         torture_assert_ntstatus_ok(tctx,
2627                 get_servername(tctx, cli->tree, servername),
2628                 "get_servername failed");
2629
2630         talloc_free(cli);
2631
2632         return true;
2633 }
2634
2635 static bool find_printers(struct torture_context *tctx,
2636                           struct dcerpc_pipe *p,
2637                           const char ***printers,
2638                           int *num_printers)
2639 {
2640         struct srvsvc_NetShareEnum r;
2641         struct srvsvc_NetShareInfoCtr info_ctr;
2642         struct srvsvc_NetShareCtr1 c1_in;
2643         struct srvsvc_NetShareCtr1 *c1;
2644         uint32_t totalentries = 0;
2645         int i;
2646         struct dcerpc_binding_handle *b = p->binding_handle;
2647
2648         ZERO_STRUCT(c1_in);
2649         info_ctr.level = 1;
2650         info_ctr.ctr.ctr1 = &c1_in;
2651
2652         r.in.server_unc = talloc_asprintf(
2653                 tctx, "\\\\%s", dcerpc_server_name(p));
2654         r.in.info_ctr = &info_ctr;
2655         r.in.max_buffer = (uint32_t)-1;
2656         r.in.resume_handle = NULL;
2657         r.out.totalentries = &totalentries;
2658         r.out.info_ctr = &info_ctr;
2659
2660         torture_assert_ntstatus_ok(tctx,
2661                 dcerpc_srvsvc_NetShareEnum_r(b, tctx, &r),
2662                 "NetShareEnum level 1 failed");
2663         torture_assert_werr_ok(tctx, r.out.result,
2664                 "NetShareEnum level 1 failed");
2665
2666         *printers = NULL;
2667         *num_printers = 0;
2668         c1 = r.out.info_ctr->ctr.ctr1;
2669         for (i=0; i<c1->count; i++) {
2670                 if (c1->array[i].type != STYPE_PRINTQ) {
2671                         continue;
2672                 }
2673                 if (!add_string_to_array(tctx, c1->array[i].name,
2674                                          printers, num_printers)) {
2675                         return false;
2676                 }
2677         }
2678
2679         return true;
2680 }
2681
2682 static bool enumprinters(struct torture_context *tctx,
2683                          struct dcerpc_binding_handle *b,
2684                          const char *servername, int level, int *num_printers)
2685 {
2686         struct spoolss_EnumPrinters r;
2687         DATA_BLOB blob;
2688         uint32_t needed;
2689         uint32_t count;
2690         union spoolss_PrinterInfo *info;
2691
2692         r.in.flags = PRINTER_ENUM_LOCAL;
2693         r.in.server = talloc_asprintf(tctx, "\\\\%s", servername);
2694         r.in.level = level;
2695         r.in.buffer = NULL;
2696         r.in.offered = 0;
2697         r.out.needed = &needed;
2698         r.out.count = &count;
2699         r.out.info = &info;
2700
2701         torture_assert_ntstatus_ok(tctx,
2702                 dcerpc_spoolss_EnumPrinters_r(b, tctx, &r),
2703                 "dcerpc_spoolss_EnumPrinters failed");
2704         torture_assert_werr_equal(tctx, r.out.result, WERR_INSUFFICIENT_BUFFER,
2705                 "EnumPrinters unexpected return code should be WERR_INSUFFICIENT_BUFFER");
2706
2707         blob = data_blob_talloc_zero(tctx, needed);
2708         if (blob.data == NULL) {
2709                 return false;
2710         }
2711
2712         r.in.buffer = &blob;
2713         r.in.offered = needed;
2714
2715         torture_assert_ntstatus_ok(tctx,
2716                 dcerpc_spoolss_EnumPrinters_r(b, tctx, &r),
2717                 "dcerpc_spoolss_EnumPrinters failed");
2718         torture_assert_werr_ok(tctx, r.out.result,
2719                 "dcerpc_spoolss_EnumPrinters failed");
2720
2721         *num_printers = count;
2722
2723         return true;
2724 }
2725
2726 static bool getprinterinfo(struct torture_context *tctx,
2727                            struct dcerpc_binding_handle *b,
2728                            struct policy_handle *handle, int level,
2729                            union spoolss_PrinterInfo **res)
2730 {
2731         struct spoolss_GetPrinter r;
2732         DATA_BLOB blob;
2733         uint32_t needed;
2734
2735         r.in.handle = handle;
2736         r.in.level = level;
2737         r.in.buffer = NULL;
2738         r.in.offered = 0;
2739         r.out.needed = &needed;
2740
2741         torture_assert_ntstatus_ok(tctx,
2742                 dcerpc_spoolss_GetPrinter_r(b, tctx, &r),
2743                 "dcerpc_spoolss_GetPrinter failed");
2744         torture_assert_werr_equal(tctx, r.out.result, WERR_INSUFFICIENT_BUFFER,
2745                 "GetPrinter unexpected return code should be WERR_INSUFFICIENT_BUFFER");
2746
2747         r.in.handle = handle;
2748         r.in.level = level;
2749         blob = data_blob_talloc_zero(tctx, needed);
2750         if (blob.data == NULL) {
2751                 return false;
2752         }
2753         r.in.buffer = &blob;
2754         r.in.offered = needed;
2755
2756         torture_assert_ntstatus_ok(tctx,
2757                 dcerpc_spoolss_GetPrinter_r(b, tctx, &r),
2758                 "dcerpc_spoolss_GetPrinter failed");
2759         torture_assert_werr_ok(tctx, r.out.result,
2760                 "dcerpc_spoolss_GetPrinter failed");
2761
2762         if (res != NULL) {
2763                 *res = talloc_steal(tctx, r.out.info);
2764         }
2765
2766         return true;
2767 }
2768
2769 static bool torture_samba3_rpc_spoolss(struct torture_context *torture)
2770 {
2771         struct dcerpc_pipe *p, *p2;
2772         struct dcerpc_binding_handle *b;
2773         struct policy_handle server_handle, printer_handle;
2774         const char **printers;
2775         int num_printers;
2776         struct spoolss_UserLevel1 userlevel1;
2777         char *servername;
2778
2779         torture_assert(torture,
2780                 rap_get_servername(torture, &servername),
2781                 "failed to rap servername");
2782
2783         torture_assert_ntstatus_ok(torture,
2784                 torture_rpc_connection(torture, &p2, &ndr_table_srvsvc),
2785                 "failed to setup srvsvc");
2786
2787         torture_assert(torture,
2788                 find_printers(torture, p2, &printers, &num_printers),
2789                 "failed to find printers via srvsvc");
2790
2791         talloc_free(p2);
2792
2793         if (num_printers == 0) {
2794                 torture_skip(torture, "Did not find printers\n");
2795                 return true;
2796         }
2797
2798         torture_assert_ntstatus_ok(torture,
2799                 torture_rpc_connection(torture, &p, &ndr_table_spoolss),
2800                 "failed to setup spoolss");
2801
2802         b = p->binding_handle;
2803
2804         ZERO_STRUCT(userlevel1);
2805         userlevel1.client = talloc_asprintf(
2806                 torture, "\\\\%s", lpcfg_netbios_name(torture->lp_ctx));
2807         userlevel1.user = cli_credentials_get_username(cmdline_credentials);
2808         userlevel1.build = 2600;
2809         userlevel1.major = 3;
2810         userlevel1.minor = 0;
2811         userlevel1.processor = 0;
2812
2813         {
2814                 struct spoolss_OpenPrinterEx r;
2815
2816                 ZERO_STRUCT(r);
2817                 r.in.printername = talloc_asprintf(torture, "\\\\%s",
2818                                                    servername);
2819                 r.in.datatype = NULL;
2820                 r.in.access_mask = 0;
2821                 r.in.userlevel_ctr.level = 1;
2822                 r.in.userlevel_ctr.user_info.level1 = &userlevel1;
2823                 r.out.handle = &server_handle;
2824
2825                 torture_assert_ntstatus_ok(torture,
2826                         dcerpc_spoolss_OpenPrinterEx_r(b, torture, &r),
2827                         "dcerpc_spoolss_OpenPrinterEx failed");
2828                 torture_assert_werr_ok(torture, r.out.result,
2829                         "dcerpc_spoolss_OpenPrinterEx failed");
2830         }
2831
2832         {
2833                 struct spoolss_ClosePrinter r;
2834
2835                 r.in.handle = &server_handle;
2836                 r.out.handle = &server_handle;
2837
2838                 torture_assert_ntstatus_ok(torture,
2839                         dcerpc_spoolss_ClosePrinter_r(b, torture, &r),
2840                         "dcerpc_spoolss_ClosePrinter failed");
2841                 torture_assert_werr_ok(torture, r.out.result,
2842                         "dcerpc_spoolss_ClosePrinter failed");
2843         }
2844
2845         {
2846                 struct spoolss_OpenPrinterEx r;
2847
2848                 ZERO_STRUCT(r);
2849                 r.in.printername = talloc_asprintf(
2850                         torture, "\\\\%s\\%s", servername, printers[0]);
2851                 r.in.datatype = NULL;
2852                 r.in.access_mask = 0;
2853                 r.in.userlevel_ctr.level = 1;
2854                 r.in.userlevel_ctr.user_info.level1 = &userlevel1;
2855                 r.out.handle = &printer_handle;
2856
2857                 torture_assert_ntstatus_ok(torture,
2858                         dcerpc_spoolss_OpenPrinterEx_r(b, torture, &r),
2859                         "dcerpc_spoolss_OpenPrinterEx failed");
2860                 torture_assert_werr_ok(torture, r.out.result,
2861                         "dcerpc_spoolss_OpenPrinterEx failed");
2862         }
2863
2864         {
2865                 int i;
2866
2867                 for (i=0; i<8; i++) {
2868                         torture_assert(torture,
2869                                 getprinterinfo(torture, b, &printer_handle, i, NULL),
2870                                 talloc_asprintf(torture, "getprinterinfo %d failed", i));
2871                 }
2872         }
2873
2874         {
2875                 struct spoolss_ClosePrinter r;
2876
2877                 r.in.handle = &printer_handle;
2878                 r.out.handle = &printer_handle;
2879
2880                 torture_assert_ntstatus_ok(torture,
2881                         dcerpc_spoolss_ClosePrinter_r(b, torture, &r),
2882                         "dcerpc_spoolss_ClosePrinter failed");
2883                 torture_assert_werr_ok(torture, r.out.result,
2884                         "dcerpc_spoolss_ClosePrinter failed");
2885         }
2886
2887         {
2888                 int num_enumerated;
2889
2890                 torture_assert(torture,
2891                         enumprinters(torture, b, servername, 1, &num_enumerated),
2892                         "enumprinters failed");
2893
2894                 torture_assert_int_equal(torture, num_printers, num_enumerated,
2895                         "netshareenum / enumprinters lvl 1 numprinter mismatch");
2896         }
2897
2898         {
2899                 int num_enumerated;
2900
2901                 torture_assert(torture,
2902                         enumprinters(torture, b, servername, 2, &num_enumerated),
2903                         "enumprinters failed");
2904
2905                 torture_assert_int_equal(torture, num_printers, num_enumerated,
2906                         "netshareenum / enumprinters lvl 2 numprinter mismatch");
2907         }
2908
2909         return true;
2910 }
2911
2912 static bool torture_samba3_rpc_wkssvc(struct torture_context *torture)
2913 {
2914         struct dcerpc_pipe *p;
2915         struct dcerpc_binding_handle *b;
2916         char *servername;
2917
2918         torture_assert(torture,
2919                 rap_get_servername(torture, &servername),
2920                 "failed to rap servername");
2921
2922         torture_assert_ntstatus_ok(torture,
2923                 torture_rpc_connection(torture, &p, &ndr_table_wkssvc),
2924                 "failed to setup wkssvc");
2925
2926         b = p->binding_handle;
2927
2928         {
2929                 struct wkssvc_NetWkstaInfo100 wks100;
2930                 union wkssvc_NetWkstaInfo info;
2931                 struct wkssvc_NetWkstaGetInfo r;
2932
2933                 r.in.server_name = "\\foo";
2934                 r.in.level = 100;
2935                 info.info100 = &wks100;
2936                 r.out.info = &info;
2937
2938                 torture_assert_ntstatus_ok(torture,
2939                         dcerpc_wkssvc_NetWkstaGetInfo_r(b, torture, &r),
2940                         "dcerpc_wkssvc_NetWksGetInfo failed");
2941                 torture_assert_werr_ok(torture, r.out.result,
2942                         "dcerpc_wkssvc_NetWksGetInfo failed");
2943
2944                 torture_assert_str_equal(torture, servername, r.out.info->info100->server_name,
2945                         "servername RAP / DCERPC inconsistency");
2946         }
2947
2948         return true;
2949 }
2950
2951 static bool winreg_close(struct torture_context *tctx,
2952                          struct dcerpc_binding_handle *b,
2953                          struct policy_handle *handle)
2954 {
2955         struct winreg_CloseKey c;
2956
2957         c.in.handle = c.out.handle = handle;
2958
2959         torture_assert_ntstatus_ok(tctx,
2960                 dcerpc_winreg_CloseKey_r(b, tctx, &c),
2961                 "winreg_CloseKey failed");
2962         torture_assert_werr_ok(tctx, c.out.result,
2963                 "winreg_CloseKey failed");
2964
2965         return true;
2966 }
2967
2968 static bool enumvalues(struct torture_context *tctx,
2969                        struct dcerpc_binding_handle *b,
2970                        struct policy_handle *handle)
2971 {
2972         uint32_t enum_index = 0;
2973
2974         while (1) {
2975                 struct winreg_EnumValue r;
2976                 struct winreg_ValNameBuf name;
2977                 enum winreg_Type type = 0;
2978                 uint8_t buf8[1024];
2979                 NTSTATUS status;
2980                 uint32_t size, length;
2981
2982                 r.in.handle = handle;
2983                 r.in.enum_index = enum_index;
2984                 name.name = "";
2985                 name.size = 1024;
2986                 r.in.name = r.out.name = &name;
2987                 size = 1024;
2988                 length = 5;
2989                 r.in.type = &type;
2990                 r.in.value = buf8;
2991                 r.in.size = &size;
2992                 r.in.length = &length;
2993
2994                 status = dcerpc_winreg_EnumValue_r(b, tctx, &r);
2995                 if (!NT_STATUS_IS_OK(status) || !W_ERROR_IS_OK(r.out.result)) {
2996                         return true;
2997                 }
2998                 enum_index += 1;
2999         }
3000 }
3001
3002 static bool enumkeys(struct torture_context *tctx,
3003                      struct dcerpc_binding_handle *b,
3004                      struct policy_handle *handle,
3005                      int depth)
3006 {
3007         struct winreg_EnumKey r;
3008         struct winreg_StringBuf kclass, name;
3009         NTSTATUS status;
3010         NTTIME t = 0;
3011
3012         if (depth <= 0) {
3013                 return true;
3014         }
3015
3016         kclass.name   = "";
3017         kclass.size   = 1024;
3018
3019         r.in.handle = handle;
3020         r.in.enum_index = 0;
3021         r.in.name = &name;
3022         r.in.keyclass = &kclass;
3023         r.out.name = &name;
3024         r.in.last_changed_time = &t;
3025
3026         do {
3027                 struct winreg_OpenKey o;
3028                 struct policy_handle key_handle;
3029                 int i;
3030
3031                 name.name = NULL;
3032                 name.size = 1024;
3033
3034                 status = dcerpc_winreg_EnumKey_r(b, tctx, &r);
3035                 if (!NT_STATUS_IS_OK(status) || !W_ERROR_IS_OK(r.out.result)) {
3036                         /* We're done enumerating */
3037                         return true;
3038                 }
3039
3040                 for (i=0; i<10-depth; i++) {
3041                         torture_comment(tctx, " ");
3042                 }
3043                 torture_comment(tctx, "%s\n", r.out.name->name);
3044
3045                 o.in.parent_handle = handle;
3046                 o.in.keyname.name = r.out.name->name;
3047                 o.in.options = 0;
3048                 o.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
3049                 o.out.handle = &key_handle;
3050
3051                 status = dcerpc_winreg_OpenKey_r(b, tctx, &o);
3052                 if (NT_STATUS_IS_OK(status) && W_ERROR_IS_OK(o.out.result)) {
3053                         enumkeys(tctx, b, &key_handle, depth-1);
3054                         enumvalues(tctx, b, &key_handle);
3055                         torture_assert(tctx, winreg_close(tctx, b, &key_handle), "");
3056                 }
3057
3058                 r.in.enum_index += 1;
3059         } while(true);
3060
3061         return true;
3062 }
3063
3064 typedef NTSTATUS (*winreg_open_fn)(struct dcerpc_binding_handle *, TALLOC_CTX *, void *);
3065
3066 static bool test_Open3(struct torture_context *tctx,
3067                        struct dcerpc_binding_handle *b,
3068                        const char *name, winreg_open_fn open_fn)
3069 {
3070         struct policy_handle handle;
3071         struct winreg_OpenHKLM r;
3072
3073         r.in.system_name = 0;
3074         r.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
3075         r.out.handle = &handle;
3076
3077         torture_assert_ntstatus_ok(tctx,
3078                 open_fn(b, tctx, &r),
3079                 talloc_asprintf(tctx, "%s failed", name));
3080         torture_assert_werr_ok(tctx, r.out.result,
3081                 talloc_asprintf(tctx, "%s failed", name));
3082
3083         enumkeys(tctx, b, &handle, 4);
3084
3085         torture_assert(tctx,
3086                 winreg_close(tctx, b, &handle),
3087                 "dcerpc_CloseKey failed");
3088
3089         return true;
3090 }
3091
3092 static bool torture_samba3_rpc_winreg(struct torture_context *torture)
3093 {
3094         struct dcerpc_pipe *p;
3095         struct dcerpc_binding_handle *b;
3096         bool ret = true;
3097         struct {
3098                 const char *name;
3099                 winreg_open_fn fn;
3100         } open_fns[] = {
3101                 {"OpenHKLM", (winreg_open_fn)dcerpc_winreg_OpenHKLM_r },
3102                 {"OpenHKU",  (winreg_open_fn)dcerpc_winreg_OpenHKU_r },
3103                 {"OpenHKPD", (winreg_open_fn)dcerpc_winreg_OpenHKPD_r },
3104                 {"OpenHKPT", (winreg_open_fn)dcerpc_winreg_OpenHKPT_r },
3105                 {"OpenHKCR", (winreg_open_fn)dcerpc_winreg_OpenHKCR_r }};
3106 #if 0
3107         int i;
3108 #endif
3109
3110         torture_assert_ntstatus_ok(torture,
3111                 torture_rpc_connection(torture, &p, &ndr_table_winreg),
3112                 "failed to setup winreg");
3113
3114         b = p->binding_handle;
3115
3116 #if 1
3117         ret = test_Open3(torture, b, open_fns[0].name, open_fns[0].fn);
3118 #else
3119         for (i = 0; i < ARRAY_SIZE(open_fns); i++) {
3120                 if (!test_Open3(torture, b, open_fns[i].name, open_fns[i].fn))
3121                         ret = false;
3122         }
3123 #endif
3124         return ret;
3125 }
3126
3127 static bool get_shareinfo(struct torture_context *tctx,
3128                           struct dcerpc_binding_handle *b,
3129                           const char *servername,
3130                           const char *share,
3131                           struct srvsvc_NetShareInfo502 **info502)
3132 {
3133         struct srvsvc_NetShareGetInfo r;
3134         union srvsvc_NetShareInfo info;
3135
3136         r.in.server_unc = talloc_asprintf(tctx, "\\\\%s", servername);
3137         r.in.share_name = share;
3138         r.in.level = 502;
3139         r.out.info = &info;
3140
3141         torture_assert_ntstatus_ok(tctx,
3142                 dcerpc_srvsvc_NetShareGetInfo_r(b, tctx, &r),
3143                 "srvsvc_NetShareGetInfo failed");
3144         torture_assert_werr_ok(tctx, r.out.result,
3145                 "srvsvc_NetShareGetInfo failed");
3146
3147         *info502 = talloc_move(tctx, &info.info502);
3148
3149         return true;
3150 }
3151
3152 /*
3153  * Get us a handle on HKLM\
3154  */
3155
3156 static bool get_hklm_handle(struct torture_context *tctx,
3157                             struct dcerpc_binding_handle *b,
3158                             struct policy_handle *handle)
3159 {
3160         struct winreg_OpenHKLM r;
3161         struct policy_handle result;
3162
3163         r.in.system_name = 0;
3164         r.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
3165         r.out.handle = &result;
3166
3167         torture_assert_ntstatus_ok(tctx,
3168                 dcerpc_winreg_OpenHKLM_r(b, tctx, &r),
3169                 "OpenHKLM failed");
3170         torture_assert_werr_ok(tctx, r.out.result,
3171                 "OpenHKLM failed");
3172
3173         *handle = result;
3174
3175         return true;
3176 }
3177
3178 static bool torture_samba3_createshare(struct torture_context *tctx,
3179                                        struct dcerpc_binding_handle *b,
3180                                        const char *sharename)
3181 {
3182         struct policy_handle hklm;
3183         struct policy_handle new_handle;
3184         struct winreg_CreateKey c;
3185         struct winreg_CloseKey cl;
3186         enum winreg_CreateAction action_taken;
3187
3188         c.in.handle = &hklm;
3189         c.in.name.name = talloc_asprintf(
3190                 tctx, "software\\samba\\smbconf\\%s", sharename);
3191         torture_assert(tctx, c.in.name.name, "talloc_asprintf failed");
3192
3193         c.in.keyclass.name = "";
3194         c.in.options = 0;
3195         c.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
3196         c.in.secdesc = NULL;
3197         c.in.action_taken = &action_taken;
3198         c.out.new_handle = &new_handle;
3199         c.out.action_taken = &action_taken;
3200
3201         torture_assert_ntstatus_ok(tctx,
3202                 dcerpc_winreg_CreateKey_r(b, tctx, &c),
3203                 "OpenKey failed");
3204         torture_assert_werr_ok(tctx, c.out.result,
3205                 "OpenKey failed");
3206
3207         cl.in.handle = &new_handle;
3208         cl.out.handle = &new_handle;
3209
3210         torture_assert_ntstatus_ok(tctx,
3211                 dcerpc_winreg_CloseKey_r(b, tctx, &cl),
3212                 "CloseKey failed");
3213         torture_assert_werr_ok(tctx, cl.out.result,
3214                 "CloseKey failed");
3215
3216         return true;
3217 }
3218
3219 static bool torture_samba3_deleteshare(struct torture_context *tctx,
3220                                        struct dcerpc_binding_handle *b,
3221                                        const char *sharename)
3222 {
3223         struct policy_handle hklm;
3224         struct winreg_DeleteKey d;
3225
3226         torture_assert(tctx,
3227                 get_hklm_handle(tctx, b, &hklm),
3228                 "get_hklm_handle failed");
3229
3230         d.in.handle = &hklm;
3231         d.in.key.name = talloc_asprintf(
3232                 tctx, "software\\samba\\smbconf\\%s", sharename);
3233         torture_assert(tctx, d.in.key.name, "talloc_asprintf failed");
3234
3235         torture_assert_ntstatus_ok(tctx,
3236                 dcerpc_winreg_DeleteKey_r(b, tctx, &d),
3237                 "DeleteKey failed");
3238         torture_assert_werr_ok(tctx, d.out.result,
3239                 "DeleteKey failed");
3240
3241         return true;
3242 }
3243
3244 static bool torture_samba3_setconfig(struct torture_context *tctx,
3245                                      struct dcerpc_binding_handle *b,
3246                                      const char *sharename,
3247                                      const char *parameter,
3248                                      const char *value)
3249 {
3250         struct policy_handle hklm, key_handle;
3251         struct winreg_OpenKey o;
3252         struct winreg_SetValue s;
3253         uint32_t type;
3254         DATA_BLOB val;
3255
3256         torture_assert(tctx,
3257                 get_hklm_handle(tctx, b, &hklm),
3258                 "get_hklm_handle failed");
3259
3260         o.in.parent_handle = &hklm;
3261         o.in.keyname.name = talloc_asprintf(
3262                 tctx, "software\\samba\\smbconf\\%s", sharename);
3263         torture_assert(tctx, o.in.keyname.name, "talloc_asprintf failed");
3264
3265         o.in.options = 0;
3266         o.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
3267         o.out.handle = &key_handle;
3268
3269         torture_assert_ntstatus_ok(tctx,
3270                 dcerpc_winreg_OpenKey_r(b, tctx, &o),
3271                 "OpenKey failed");
3272         torture_assert_werr_ok(tctx, o.out.result,
3273                 "OpenKey failed");
3274
3275         torture_assert(tctx,
3276                 reg_string_to_val(tctx, "REG_SZ", value, &type, &val),
3277                 "reg_string_to_val failed");
3278
3279         s.in.handle = &key_handle;
3280         s.in.name.name = parameter;
3281         s.in.type = type;
3282         s.in.data = val.data;
3283         s.in.size = val.length;
3284
3285         torture_assert_ntstatus_ok(tctx,
3286                 dcerpc_winreg_SetValue_r(b, tctx, &s),
3287                 "SetValue failed");
3288         torture_assert_werr_ok(tctx, s.out.result,
3289                 "SetValue failed");
3290
3291         return true;
3292 }
3293
3294 static bool torture_samba3_regconfig(struct torture_context *torture)
3295 {
3296         struct srvsvc_NetShareInfo502 *i = NULL;
3297         const char *comment = "Dummer Kommentar";
3298         struct dcerpc_pipe *srvsvc_pipe, *winreg_pipe;
3299
3300         torture_assert_ntstatus_ok(torture,
3301                 torture_rpc_connection(torture, &srvsvc_pipe, &ndr_table_srvsvc),
3302                 "failed to setup srvsvc");
3303
3304         torture_assert_ntstatus_ok(torture,
3305                 torture_rpc_connection(torture, &winreg_pipe, &ndr_table_winreg),
3306                 "failed to setup winreg");
3307
3308         torture_assert(torture,
3309                 torture_samba3_createshare(torture, winreg_pipe->binding_handle, "blubber"),
3310                 "torture_samba3_createshare failed");
3311
3312         torture_assert(torture,
3313                 torture_samba3_setconfig(torture, winreg_pipe->binding_handle, "blubber", "comment", comment),
3314                 "torture_samba3_setconfig failed");
3315
3316         torture_assert(torture,
3317                 get_shareinfo(torture, srvsvc_pipe->binding_handle, dcerpc_server_name(srvsvc_pipe), "blubber", &i),
3318                 "get_shareinfo failed");
3319
3320         torture_assert_str_equal(torture, comment, i->comment,
3321                 "got unexpected comment");
3322
3323         torture_assert(torture,
3324                 torture_samba3_deleteshare(torture, winreg_pipe->binding_handle, "blubber"),
3325                 "torture_samba3_deleteshare failed");
3326
3327         return true;
3328 }
3329
3330 /*
3331  * Test that even with a result of 0 rids the array is returned as a
3332  * non-NULL pointer. Yes, XP does notice.
3333  */
3334
3335 bool torture_samba3_getaliasmembership_0(struct torture_context *torture)
3336 {
3337         struct dcerpc_pipe *p;
3338         struct dcerpc_binding_handle *b;
3339         struct samr_Connect2 c;
3340         struct samr_OpenDomain o;
3341         struct dom_sid sid;
3342         struct lsa_SidPtr ptr;
3343         struct lsa_SidArray sids;
3344         struct samr_GetAliasMembership g;
3345         struct samr_Ids rids;
3346         struct policy_handle samr, domain;
3347
3348         torture_assert_ntstatus_ok(torture,
3349                 torture_rpc_connection(torture, &p, &ndr_table_samr),
3350                 "failed to setup samr");
3351
3352         b = p->binding_handle;
3353
3354         c.in.system_name = NULL;
3355         c.in.access_mask = SAMR_ACCESS_LOOKUP_DOMAIN;
3356         c.out.connect_handle = &samr;
3357         torture_assert_ntstatus_ok(torture,
3358                 dcerpc_samr_Connect2_r(b, torture, &c),
3359                 "");
3360         torture_assert_ntstatus_ok(torture, c.out.result,
3361                 "");
3362         dom_sid_parse("S-1-5-32", &sid);
3363         o.in.connect_handle = &samr;
3364         o.in.access_mask = SAMR_DOMAIN_ACCESS_LOOKUP_ALIAS;
3365         o.in.sid = &sid;
3366         o.out.domain_handle = &domain;
3367         torture_assert_ntstatus_ok(torture,
3368                 dcerpc_samr_OpenDomain_r(b, torture, &o),
3369                 "");
3370         torture_assert_ntstatus_ok(torture, o.out.result,
3371                 "");
3372         dom_sid_parse("S-1-2-3-4-5", &sid);
3373         ptr.sid = &sid;
3374         sids.num_sids = 1;
3375         sids.sids = &ptr;
3376         g.in.domain_handle = &domain;
3377         g.in.sids = &sids;
3378         g.out.rids = &rids;
3379         torture_assert_ntstatus_ok(torture,
3380                 dcerpc_samr_GetAliasMembership_r(b, torture, &g),
3381                 "");
3382         torture_assert_ntstatus_ok(torture, g.out.result,
3383                 "");
3384         if (rids.ids == NULL) {
3385                 /* This is the piece to test here */
3386                 torture_fail(torture,
3387                         "torture_samba3_getaliasmembership_0: "
3388                         "Server returns NULL rids array\n");
3389         }
3390
3391         return true;
3392 }
3393
3394 /**
3395  * Test smb reauthentication while rpc pipe is in use.
3396  */
3397 static bool torture_rpc_smb_reauth1(struct torture_context *torture)
3398 {
3399         TALLOC_CTX *mem_ctx;
3400         NTSTATUS status;
3401         bool ret = false;
3402         struct smbcli_state *cli;
3403         struct smbcli_options options;
3404         struct smbcli_session_options session_options;
3405
3406         struct dcerpc_pipe *lsa_pipe;
3407         struct dcerpc_binding_handle *lsa_handle;
3408         struct lsa_GetUserName r;
3409         struct lsa_String *authority_name_p = NULL;
3410         char *authority_name_saved = NULL;
3411         struct lsa_String *account_name_p = NULL;
3412         char *account_name_saved = NULL;
3413         struct cli_credentials *anon_creds = NULL;
3414         struct smb_composite_sesssetup io;
3415
3416         mem_ctx = talloc_init("torture_samba3_reauth");
3417         torture_assert(torture, (mem_ctx != NULL), "talloc_init failed");
3418
3419         lpcfg_smbcli_options(torture->lp_ctx, &options);
3420         lpcfg_smbcli_session_options(torture->lp_ctx, &session_options);
3421
3422         status = smbcli_full_connection(mem_ctx, &cli,
3423                                         torture_setting_string(torture, "host", NULL),
3424                                         lpcfg_smb_ports(torture->lp_ctx),
3425                                         "IPC$", NULL,
3426                                         lpcfg_socket_options(torture->lp_ctx),
3427                                         cmdline_credentials,
3428                                         lpcfg_resolve_context(torture->lp_ctx),
3429                                         torture->ev, &options, &session_options,
3430                                         lpcfg_gensec_settings(torture, torture->lp_ctx));
3431         torture_assert_ntstatus_ok_goto(torture, status, ret, done,
3432                                         "smbcli_full_connection failed");
3433
3434         lsa_pipe = dcerpc_pipe_init(mem_ctx, torture->ev);
3435         torture_assert_goto(torture, (lsa_pipe != NULL), ret, done,
3436                             "dcerpc_pipe_init failed");
3437         lsa_handle = lsa_pipe->binding_handle;
3438
3439         status = dcerpc_pipe_open_smb(lsa_pipe, cli->tree, "\\lsarpc");
3440         torture_assert_ntstatus_ok_goto(torture, status, ret, done,
3441                                         "dcerpc_pipe_open failed");
3442
3443         status = dcerpc_bind_auth_none(lsa_pipe, &ndr_table_lsarpc);
3444         torture_assert_ntstatus_ok_goto(torture, status, ret, done,
3445                                         "dcerpc_bind_auth_none failed");
3446
3447         /* lsa getusername */
3448
3449         ZERO_STRUCT(r);
3450         r.in.system_name = "\\";
3451         r.in.account_name = &account_name_p;
3452         r.in.authority_name = &authority_name_p;
3453         r.out.account_name = &account_name_p;
3454
3455         status = dcerpc_lsa_GetUserName_r(lsa_handle, mem_ctx, &r);
3456
3457         authority_name_p = *r.out.authority_name;
3458
3459         torture_assert_ntstatus_ok_goto(torture, status, ret, done,
3460                                         "GetUserName failed");
3461         torture_assert_ntstatus_ok_goto(torture, r.out.result, ret, done,
3462                                         "GetUserName failed");
3463
3464         torture_comment(torture, "lsa_GetUserName gave '%s\\%s'\n",
3465                         authority_name_p->string,
3466                         account_name_p->string);
3467
3468         account_name_saved = talloc_strdup(mem_ctx, account_name_p->string);
3469         torture_assert_goto(torture, (account_name_saved != NULL), ret, done,
3470                             "talloc failed");
3471         authority_name_saved = talloc_strdup(mem_ctx, authority_name_p->string);
3472         torture_assert_goto(torture, (authority_name_saved != NULL), ret, done,
3473                             "talloc failed");
3474
3475         /* smb re-authenticate as anonymous */
3476
3477         anon_creds = cli_credentials_init_anon(mem_ctx);
3478
3479         ZERO_STRUCT(io);
3480         io.in.sesskey         = cli->transport->negotiate.sesskey;
3481         io.in.capabilities    = cli->transport->negotiate.capabilities;
3482         io.in.credentials     = anon_creds;
3483         io.in.workgroup       = lpcfg_workgroup(torture->lp_ctx);
3484         io.in.gensec_settings = lpcfg_gensec_settings(torture, torture->lp_ctx);
3485
3486         status = smb_composite_sesssetup(cli->session, &io);
3487         torture_assert_ntstatus_ok_goto(torture, status, ret, done,
3488                                         "session reauth to anon failed");
3489
3490         /* re-do lsa getusername after reauth */
3491
3492         TALLOC_FREE(authority_name_p);
3493         TALLOC_FREE(account_name_p);
3494         ZERO_STRUCT(r);
3495         r.in.system_name = "\\";
3496         r.in.account_name = &account_name_p;
3497         r.in.authority_name = &authority_name_p;
3498         r.out.account_name = &account_name_p;
3499
3500         status = dcerpc_lsa_GetUserName_r(lsa_handle, mem_ctx, &r);
3501
3502         authority_name_p = *r.out.authority_name;
3503
3504         torture_assert_ntstatus_ok_goto(torture, status, ret, done,
3505                                         "GetUserName failed");
3506         torture_assert_ntstatus_ok_goto(torture, r.out.result, ret, done,
3507                                         "GetUserName failed");
3508
3509         torture_assert_goto(torture, (strcmp(authority_name_p->string, authority_name_saved) == 0),
3510                             ret, done, "authority_name not equal after reauth to anon");
3511         torture_assert_goto(torture, (strcmp(account_name_p->string, account_name_saved) == 0),
3512                             ret, done, "account_name not equal after reauth to anon");
3513
3514         /* smb re-auth again to the original user */
3515
3516         ZERO_STRUCT(io);
3517         io.in.sesskey         = cli->transport->negotiate.sesskey;
3518         io.in.capabilities    = cli->transport->negotiate.capabilities;
3519         io.in.credentials     = cmdline_credentials;
3520         io.in.workgroup       = lpcfg_workgroup(torture->lp_ctx);
3521         io.in.gensec_settings = lpcfg_gensec_settings(torture, torture->lp_ctx);
3522
3523         status = smb_composite_sesssetup(cli->session, &io);
3524         torture_assert_ntstatus_ok_goto(torture, status, ret, done,
3525                                         "session reauth to anon failed");
3526
3527         /* re-do lsa getusername */
3528
3529         TALLOC_FREE(authority_name_p);
3530         TALLOC_FREE(account_name_p);
3531         ZERO_STRUCT(r);
3532         r.in.system_name = "\\";
3533         r.in.account_name = &account_name_p;
3534         r.in.authority_name = &authority_name_p;
3535         r.out.account_name = &account_name_p;
3536
3537         status = dcerpc_lsa_GetUserName_r(lsa_handle, mem_ctx, &r);
3538
3539         authority_name_p = *r.out.authority_name;
3540
3541         torture_assert_ntstatus_ok_goto(torture, status, ret, done,
3542                                         "GetUserName failed");
3543         torture_assert_ntstatus_ok_goto(torture, r.out.result, ret, done,
3544                                         "GetUserName failed");
3545
3546         torture_assert_goto(torture, (strcmp(authority_name_p->string, authority_name_saved) == 0),
3547                             ret, done, "authority_name not equal after reauth to anon");
3548         torture_assert_goto(torture, (strcmp(account_name_p->string, account_name_saved) == 0),
3549                             ret, done, "account_name not equal after reauth to anon");
3550
3551         ret = true;
3552
3553 done:
3554         talloc_free(mem_ctx);
3555         return ret;
3556 }
3557
3558 /**
3559  * Test smb reauthentication while rpc pipe is in use.
3560  * Open a second lsa bind after reauth to anon.
3561  * Do lsa getusername on that second bind.
3562  */
3563 static bool torture_rpc_smb_reauth2(struct torture_context *torture)
3564 {
3565         TALLOC_CTX *mem_ctx;
3566         NTSTATUS status;
3567         bool ret = false;
3568         struct smbcli_state *cli;
3569         struct smbcli_options options;
3570         struct smbcli_session_options session_options;
3571
3572         struct dcerpc_pipe *lsa_pipe;
3573         struct dcerpc_binding_handle *lsa_handle;
3574         struct lsa_GetUserName r;
3575         struct lsa_String *authority_name_p = NULL;
3576         char *authority_name_saved = NULL;
3577         struct lsa_String *account_name_p = NULL;
3578         char *account_name_saved = NULL;
3579         struct cli_credentials *anon_creds = NULL;
3580         struct smb_composite_sesssetup io;
3581
3582         mem_ctx = talloc_init("torture_samba3_reauth");
3583         torture_assert(torture, (mem_ctx != NULL), "talloc_init failed");
3584
3585         lpcfg_smbcli_options(torture->lp_ctx, &options);
3586         lpcfg_smbcli_session_options(torture->lp_ctx, &session_options);
3587
3588         status = smbcli_full_connection(mem_ctx, &cli,
3589                                         torture_setting_string(torture, "host", NULL),
3590                                         lpcfg_smb_ports(torture->lp_ctx),
3591                                         "IPC$", NULL,
3592                                         lpcfg_socket_options(torture->lp_ctx),
3593                                         cmdline_credentials,
3594                                         lpcfg_resolve_context(torture->lp_ctx),
3595                                         torture->ev, &options, &session_options,
3596                                         lpcfg_gensec_settings(torture, torture->lp_ctx));
3597         torture_assert_ntstatus_ok_goto(torture, status, ret, done,
3598                                         "smbcli_full_connection failed");
3599
3600         /* smb re-authenticate as anonymous */
3601
3602         anon_creds = cli_credentials_init_anon(mem_ctx);
3603
3604         ZERO_STRUCT(io);
3605         io.in.sesskey         = cli->transport->negotiate.sesskey;
3606         io.in.capabilities    = cli->transport->negotiate.capabilities;
3607         io.in.credentials     = anon_creds;
3608         io.in.workgroup       = lpcfg_workgroup(torture->lp_ctx);
3609         io.in.gensec_settings = lpcfg_gensec_settings(torture, torture->lp_ctx);
3610
3611         status = smb_composite_sesssetup(cli->session, &io);
3612         torture_assert_ntstatus_ok_goto(torture, status, ret, done,
3613                                         "session reauth to anon failed");
3614
3615         /* open the lsa pipe */
3616
3617         lsa_pipe = dcerpc_pipe_init(mem_ctx, torture->ev);
3618         torture_assert_goto(torture, (lsa_pipe != NULL), ret, done,
3619                             "dcerpc_pipe_init failed");
3620         lsa_handle = lsa_pipe->binding_handle;
3621
3622         status = dcerpc_pipe_open_smb(lsa_pipe, cli->tree, "\\lsarpc");
3623         torture_assert_ntstatus_ok_goto(torture, status, ret, done,
3624                                         "dcerpc_pipe_open failed");
3625
3626         status = dcerpc_bind_auth_none(lsa_pipe, &ndr_table_lsarpc);
3627         torture_assert_ntstatus_ok_goto(torture, status, ret, done,
3628                                         "dcerpc_bind_auth_none failed");
3629
3630         /* lsa getusername */
3631
3632         ZERO_STRUCT(r);
3633         r.in.system_name = "\\";
3634         r.in.account_name = &account_name_p;
3635         r.in.authority_name = &authority_name_p;
3636         r.out.account_name = &account_name_p;
3637
3638         status = dcerpc_lsa_GetUserName_r(lsa_handle, mem_ctx, &r);
3639
3640         authority_name_p = *r.out.authority_name;
3641
3642         torture_assert_ntstatus_ok_goto(torture, status, ret, done,
3643                                         "GetUserName failed");
3644         torture_assert_ntstatus_ok_goto(torture, r.out.result, ret, done,
3645                                         "GetUserName failed");
3646
3647         torture_comment(torture, "lsa_GetUserName gave '%s\\%s'\n",
3648                         authority_name_p->string,
3649                         account_name_p->string);
3650
3651         account_name_saved = talloc_strdup(mem_ctx, account_name_p->string);
3652         torture_assert_goto(torture, (account_name_saved != NULL), ret, done,
3653                             "talloc failed");
3654         authority_name_saved = talloc_strdup(mem_ctx, authority_name_p->string);
3655         torture_assert_goto(torture, (authority_name_saved != NULL), ret, done,
3656                             "talloc failed");
3657
3658         /* smb re-auth again to the original user */
3659
3660         ZERO_STRUCT(io);
3661         io.in.sesskey         = cli->transport->negotiate.sesskey;
3662         io.in.capabilities    = cli->transport->negotiate.capabilities;
3663         io.in.credentials     = cmdline_credentials;
3664         io.in.workgroup       = lpcfg_workgroup(torture->lp_ctx);
3665         io.in.gensec_settings = lpcfg_gensec_settings(torture, torture->lp_ctx);
3666
3667         status = smb_composite_sesssetup(cli->session, &io);
3668         torture_assert_ntstatus_ok_goto(torture, status, ret, done,
3669                                         "session reauth to anon failed");
3670
3671         /* re-do lsa getusername after reauth */
3672
3673         TALLOC_FREE(authority_name_p);
3674         TALLOC_FREE(account_name_p);
3675         ZERO_STRUCT(r);
3676         r.in.system_name = "\\";
3677         r.in.account_name = &account_name_p;
3678         r.in.authority_name = &authority_name_p;
3679         r.out.account_name = &account_name_p;
3680
3681         status = dcerpc_lsa_GetUserName_r(lsa_handle, mem_ctx, &r);
3682
3683         authority_name_p = *r.out.authority_name;
3684
3685         torture_assert_ntstatus_ok_goto(torture, status, ret, done,
3686                                         "GetUserName failed");
3687         torture_assert_ntstatus_ok_goto(torture, r.out.result, ret, done,
3688                                         "GetUserName failed");
3689
3690         torture_assert_goto(torture, (strcmp(authority_name_p->string, authority_name_saved) == 0),
3691                             ret, done, "authority_name not equal after reauth to anon");
3692         torture_assert_goto(torture, (strcmp(account_name_p->string, account_name_saved) == 0),
3693                             ret, done, "account_name not equal after reauth to anon");
3694
3695         ret = true;
3696
3697 done:
3698         talloc_free(mem_ctx);
3699         return ret;
3700 }
3701
3702 /**
3703  * Test smb2 reauthentication while rpc pipe is in use.
3704  */
3705 static bool torture_rpc_smb2_reauth1(struct torture_context *torture)
3706 {
3707         TALLOC_CTX *mem_ctx;
3708         NTSTATUS status;
3709         bool ret = false;
3710         struct smbcli_options options;
3711
3712         struct dcerpc_pipe *lsa_pipe;
3713         struct dcerpc_binding_handle *lsa_handle;
3714         struct lsa_GetUserName r;
3715         struct lsa_String *authority_name_p = NULL;
3716         char *authority_name_saved = NULL;
3717         struct lsa_String *account_name_p = NULL;
3718         char *account_name_saved = NULL;
3719         struct cli_credentials *anon_creds = NULL;
3720         const char *host = torture_setting_string(torture, "host", NULL);
3721         struct smb2_tree *tree;
3722
3723         mem_ctx = talloc_init("torture_samba3_reauth");
3724         torture_assert(torture, (mem_ctx != NULL), "talloc_init failed");
3725
3726         lpcfg_smbcli_options(torture->lp_ctx, &options);
3727
3728         status = smb2_connect(mem_ctx,
3729                               host,
3730                               lpcfg_smb_ports(torture->lp_ctx),
3731                               "IPC$",
3732                               lpcfg_resolve_context(torture->lp_ctx),
3733                               cmdline_credentials,
3734                               &tree,
3735                               torture->ev,
3736                               &options,
3737                               lpcfg_socket_options(torture->lp_ctx),
3738                               lpcfg_gensec_settings(torture, torture->lp_ctx)
3739                               );
3740         torture_assert_ntstatus_ok_goto(torture, status, ret, done,
3741                                         "smb2_connect failed");
3742
3743         lsa_pipe = dcerpc_pipe_init(mem_ctx, torture->ev);
3744         torture_assert_goto(torture, (lsa_pipe != NULL), ret, done,
3745                             "dcerpc_pipe_init failed");
3746         lsa_handle = lsa_pipe->binding_handle;
3747
3748         status = dcerpc_pipe_open_smb2(lsa_pipe, tree, "lsarpc");
3749         torture_assert_ntstatus_ok_goto(torture, status, ret, done,
3750                                         "dcerpc_pipe_open_smb2 failed");
3751
3752         status = dcerpc_bind_auth_none(lsa_pipe, &ndr_table_lsarpc);
3753         torture_assert_ntstatus_ok_goto(torture, status, ret, done,
3754                                         "dcerpc_bind_auth_none failed");
3755
3756         /* lsa getusername */
3757
3758         ZERO_STRUCT(r);
3759         r.in.system_name = "\\";
3760         r.in.account_name = &account_name_p;
3761         r.in.authority_name = &authority_name_p;
3762         r.out.account_name = &account_name_p;
3763
3764         status = dcerpc_lsa_GetUserName_r(lsa_handle, mem_ctx, &r);
3765
3766         authority_name_p = *r.out.authority_name;
3767
3768         torture_assert_ntstatus_ok_goto(torture, status, ret, done,
3769                                         "GetUserName failed");
3770         torture_assert_ntstatus_ok_goto(torture, r.out.result, ret, done,
3771                                         "GetUserName failed");
3772
3773         torture_comment(torture, "lsa_GetUserName gave '%s\\%s'\n",
3774                         authority_name_p->string,
3775                         account_name_p->string);
3776
3777         account_name_saved = talloc_strdup(mem_ctx, account_name_p->string);
3778         torture_assert_goto(torture, (account_name_saved != NULL), ret, done,
3779                             "talloc failed");
3780         authority_name_saved = talloc_strdup(mem_ctx, authority_name_p->string);
3781         torture_assert_goto(torture, (authority_name_saved != NULL), ret, done,
3782                             "talloc failed");
3783
3784         /* smb re-authenticate as anonymous */
3785
3786         anon_creds = cli_credentials_init_anon(mem_ctx);
3787
3788         status = smb2_session_setup_spnego(tree->session,
3789                                            anon_creds,
3790                                            0 /* previous_session_id */);
3791         torture_assert_ntstatus_ok_goto(torture, status, ret, done,
3792                                         "session reauth to anon failed");
3793
3794         /* re-do lsa getusername after reauth */
3795
3796         TALLOC_FREE(authority_name_p);
3797         TALLOC_FREE(account_name_p);
3798         ZERO_STRUCT(r);
3799         r.in.system_name = "\\";
3800         r.in.account_name = &account_name_p;
3801         r.in.authority_name = &authority_name_p;
3802         r.out.account_name = &account_name_p;
3803
3804         status = dcerpc_lsa_GetUserName_r(lsa_handle, mem_ctx, &r);
3805
3806         authority_name_p = *r.out.authority_name;
3807
3808         torture_assert_ntstatus_ok_goto(torture, status, ret, done,
3809                                         "GetUserName failed");
3810         torture_assert_ntstatus_ok_goto(torture, r.out.result, ret, done,
3811                                         "GetUserName failed");
3812
3813         torture_assert_goto(torture, (strcmp(authority_name_p->string, authority_name_saved) == 0),
3814                             ret, done, "authority_name not equal after reauth to anon");
3815         torture_assert_goto(torture, (strcmp(account_name_p->string, account_name_saved) == 0),
3816                             ret, done, "account_name not equal after reauth to anon");
3817
3818         /* smb re-auth again to the original user */
3819
3820         status = smb2_session_setup_spnego(tree->session,
3821                                            cmdline_credentials,
3822                                            0 /* previous_session_id */);
3823         torture_assert_ntstatus_ok_goto(torture, status, ret, done,
3824                                         "session reauth to anon failed");
3825
3826         /* re-do lsa getusername */
3827
3828         TALLOC_FREE(authority_name_p);
3829         TALLOC_FREE(account_name_p);
3830         ZERO_STRUCT(r);
3831         r.in.system_name = "\\";
3832         r.in.account_name = &account_name_p;
3833         r.in.authority_name = &authority_name_p;
3834         r.out.account_name = &account_name_p;
3835
3836         status = dcerpc_lsa_GetUserName_r(lsa_handle, mem_ctx, &r);
3837
3838         authority_name_p = *r.out.authority_name;
3839
3840         torture_assert_ntstatus_ok_goto(torture, status, ret, done,
3841                                         "GetUserName failed");
3842         torture_assert_ntstatus_ok_goto(torture, r.out.result, ret, done,
3843                                         "GetUserName failed");
3844
3845         torture_assert_goto(torture, (strcmp(authority_name_p->string, authority_name_saved) == 0),
3846                             ret, done, "authority_name not equal after reauth to anon");
3847         torture_assert_goto(torture, (strcmp(account_name_p->string, account_name_saved) == 0),
3848                             ret, done, "account_name not equal after reauth to anon");
3849
3850         ret = true;
3851
3852 done:
3853         talloc_free(mem_ctx);
3854         return ret;
3855 }
3856
3857 /**
3858  * Test smb2 reauthentication while rpc pipe is in use.
3859  * Open a second lsa bind after reauth to anon.
3860  * Do lsa getusername on that second bind.
3861  */
3862 static bool torture_rpc_smb2_reauth2(struct torture_context *torture)
3863 {
3864         TALLOC_CTX *mem_ctx;
3865         NTSTATUS status;
3866         bool ret = false;
3867         struct smbcli_options options;
3868
3869         struct dcerpc_pipe *lsa_pipe;
3870         struct dcerpc_binding_handle *lsa_handle;
3871         struct lsa_GetUserName r;
3872         struct lsa_String *authority_name_p = NULL;
3873         char *authority_name_saved = NULL;
3874         struct lsa_String *account_name_p = NULL;
3875         char *account_name_saved = NULL;
3876         struct cli_credentials *anon_creds = NULL;
3877         const char *host = torture_setting_string(torture, "host", NULL);
3878         struct smb2_tree *tree;
3879
3880         mem_ctx = talloc_init("torture_samba3_reauth");
3881         torture_assert(torture, (mem_ctx != NULL), "talloc_init failed");
3882
3883         lpcfg_smbcli_options(torture->lp_ctx, &options);
3884
3885         status = smb2_connect(mem_ctx,
3886                               host,
3887                               lpcfg_smb_ports(torture->lp_ctx),
3888                               "IPC$",
3889                               lpcfg_resolve_context(torture->lp_ctx),
3890                               cmdline_credentials,
3891                               &tree,
3892                               torture->ev,
3893                               &options,
3894                               lpcfg_socket_options(torture->lp_ctx),
3895                               lpcfg_gensec_settings(torture, torture->lp_ctx)
3896                               );
3897         torture_assert_ntstatus_ok_goto(torture, status, ret, done,
3898                                         "smb2_connect failed");
3899
3900         /* smb re-authenticate as anonymous */
3901
3902         anon_creds = cli_credentials_init_anon(mem_ctx);
3903
3904         status = smb2_session_setup_spnego(tree->session,
3905                                            anon_creds,
3906                                            0 /* previous_session_id */);
3907         torture_assert_ntstatus_ok_goto(torture, status, ret, done,
3908                                         "session reauth to anon failed");
3909
3910         /* open the lsa pipe */
3911
3912         lsa_pipe = dcerpc_pipe_init(mem_ctx, torture->ev);
3913         torture_assert_goto(torture, (lsa_pipe != NULL), ret, done,
3914                             "dcerpc_pipe_init failed");
3915         lsa_handle = lsa_pipe->binding_handle;
3916
3917         status = dcerpc_pipe_open_smb2(lsa_pipe, tree, "lsarpc");
3918         torture_assert_ntstatus_ok_goto(torture, status, ret, done,
3919                                         "dcerpc_pipe_open_smb2 failed");
3920
3921         status = dcerpc_bind_auth_none(lsa_pipe, &ndr_table_lsarpc);
3922         torture_assert_ntstatus_ok_goto(torture, status, ret, done,
3923                                         "dcerpc_bind_auth_none failed");
3924
3925         /* lsa getusername */
3926
3927         ZERO_STRUCT(r);
3928         r.in.system_name = "\\";
3929         r.in.account_name = &account_name_p;
3930         r.in.authority_name = &authority_name_p;
3931         r.out.account_name = &account_name_p;
3932
3933         status = dcerpc_lsa_GetUserName_r(lsa_handle, mem_ctx, &r);
3934
3935         authority_name_p = *r.out.authority_name;
3936
3937         torture_assert_ntstatus_ok_goto(torture, status, ret, done,
3938                                         "GetUserName failed");
3939         torture_assert_ntstatus_ok_goto(torture, r.out.result, ret, done,
3940                                         "GetUserName failed");
3941
3942         torture_comment(torture, "lsa_GetUserName gave '%s\\%s'\n",
3943                         authority_name_p->string,
3944                         account_name_p->string);
3945
3946         account_name_saved = talloc_strdup(mem_ctx, account_name_p->string);
3947         torture_assert_goto(torture, (account_name_saved != NULL), ret, done,
3948                             "talloc failed");
3949         authority_name_saved = talloc_strdup(mem_ctx, authority_name_p->string);
3950         torture_assert_goto(torture, (authority_name_saved != NULL), ret, done,
3951                             "talloc failed");
3952
3953         /* smb re-auth again to the original user */
3954
3955         status = smb2_session_setup_spnego(tree->session,
3956                                            cmdline_credentials,
3957                                            0 /* previous_session_id */);
3958         torture_assert_ntstatus_ok_goto(torture, status, ret, done,
3959                                         "session reauth to anon failed");
3960
3961         /* re-do lsa getusername */
3962
3963         TALLOC_FREE(authority_name_p);
3964         TALLOC_FREE(account_name_p);
3965         ZERO_STRUCT(r);
3966         r.in.system_name = "\\";
3967         r.in.account_name = &account_name_p;
3968         r.in.authority_name = &authority_name_p;
3969         r.out.account_name = &account_name_p;
3970
3971         status = dcerpc_lsa_GetUserName_r(lsa_handle, mem_ctx, &r);
3972
3973         authority_name_p = *r.out.authority_name;
3974
3975         torture_assert_ntstatus_ok_goto(torture, status, ret, done,
3976                                         "GetUserName failed");
3977         torture_assert_ntstatus_ok_goto(torture, r.out.result, ret, done,
3978                                         "GetUserName failed");
3979
3980         torture_assert_goto(torture, (strcmp(authority_name_p->string, authority_name_saved) == 0),
3981                             ret, done, "authority_name not equal after reauth to anon");
3982         torture_assert_goto(torture, (strcmp(account_name_p->string, account_name_saved) == 0),
3983                             ret, done, "account_name not equal after reauth to anon");
3984
3985         ret = true;
3986
3987 done:
3988         talloc_free(mem_ctx);
3989         return ret;
3990 }
3991
3992 static bool torture_rpc_smb1_pipe_name(struct torture_context *torture)
3993 {
3994         TALLOC_CTX *mem_ctx;
3995         NTSTATUS status;
3996         bool ret = false;
3997         struct smbcli_state *cli;
3998         struct smbcli_options options;
3999         struct smbcli_session_options session_options;
4000         union smb_open io;
4001         union smb_close cl;
4002         uint16_t fnum;
4003
4004         mem_ctx = talloc_init("torture_samba3_smb1_pipe_name");
4005         torture_assert(torture, (mem_ctx != NULL), "talloc_init failed");
4006
4007         lpcfg_smbcli_options(torture->lp_ctx, &options);
4008         lpcfg_smbcli_session_options(torture->lp_ctx, &session_options);
4009
4010         status = smbcli_full_connection(mem_ctx, &cli,
4011                                         torture_setting_string(torture, "host", NULL),
4012                                         lpcfg_smb_ports(torture->lp_ctx),
4013                                         "IPC$", NULL,
4014                                         lpcfg_socket_options(torture->lp_ctx),
4015                                         cmdline_credentials,
4016                                         lpcfg_resolve_context(torture->lp_ctx),
4017                                         torture->ev, &options, &session_options,
4018                                         lpcfg_gensec_settings(torture, torture->lp_ctx));
4019         torture_assert_ntstatus_ok_goto(torture, status, ret, done,
4020                                         "smbcli_full_connection failed");
4021
4022         ZERO_STRUCT(io);
4023         io.generic.level = RAW_OPEN_NTCREATEX;
4024         io.ntcreatex.in.access_mask = DESIRED_ACCESS_PIPE;
4025         io.ntcreatex.in.share_access = NTCREATEX_SHARE_ACCESS_READ|
4026                                        NTCREATEX_SHARE_ACCESS_WRITE;
4027         io.ntcreatex.in.open_disposition = NTCREATEX_DISP_OPEN;
4028         io.ntcreatex.in.impersonation = NTCREATEX_IMPERSONATION_IMPERSONATION;
4029         io.ntcreatex.in.security_flags = 0;
4030
4031         io.ntcreatex.in.fname = "__none__";
4032         status = smb_raw_open(cli->tree, torture, &io);
4033         torture_assert_ntstatus_equal_goto(torture, status, NT_STATUS_OBJECT_NAME_NOT_FOUND,
4034                                            ret, done,
4035                                            "smb_raw_open for '__none__'");
4036
4037         io.ntcreatex.in.fname = "pipe\\srvsvc";
4038         status = smb_raw_open(cli->tree, torture, &io);
4039         torture_assert_ntstatus_equal_goto(torture, status, NT_STATUS_OBJECT_NAME_NOT_FOUND,
4040                                            ret, done,
4041                                            "smb_raw_open for 'pipe\\srvsvc'");
4042
4043         io.ntcreatex.in.fname = "\\pipe\\srvsvc";
4044         status = smb_raw_open(cli->tree, torture, &io);
4045         torture_assert_ntstatus_equal_goto(torture, status, NT_STATUS_OBJECT_NAME_NOT_FOUND,
4046                                            ret, done,
4047                                            "smb_raw_open for '\\pipe\\srvsvc'");
4048
4049         io.ntcreatex.in.fname = "srvsvc";
4050         status = smb_raw_open(cli->tree, torture, &io);
4051         torture_assert_ntstatus_ok_goto(torture, status, ret, done,
4052                                         "smb2_create failed for 'srvsvc'");
4053         fnum = io.ntcreatex.out.file.fnum;
4054         ZERO_STRUCT(cl);
4055         cl.generic.level = RAW_CLOSE_CLOSE;
4056         cl.close.in.file.fnum = fnum;
4057         status = smb_raw_close(cli->tree, &cl);
4058         torture_assert_ntstatus_ok_goto(torture, status, ret, done,
4059                                         "smb_raw_close failed");
4060
4061         io.ntcreatex.in.fname = "\\srvsvc";
4062         status = smb_raw_open(cli->tree, torture, &io);
4063         torture_assert_ntstatus_ok_goto(torture, status, ret, done,
4064                                         "smb2_create failed for '\\srvsvc'");
4065         fnum = io.ntcreatex.out.file.fnum;
4066         ZERO_STRUCT(cl);
4067         cl.generic.level = RAW_CLOSE_CLOSE;
4068         cl.close.in.file.fnum = fnum;
4069         status = smb_raw_close(cli->tree, &cl);
4070         torture_assert_ntstatus_ok_goto(torture, status, ret, done,
4071                                         "smb_raw_close failed");
4072
4073         io.ntcreatex.in.fname = "\\\\\\\\\\srvsvc";
4074         status = smb_raw_open(cli->tree, torture, &io);
4075         torture_assert_ntstatus_ok_goto(torture, status, ret, done,
4076                                         "smb2_create failed for '\\\\\\\\\\srvsvc'");
4077         fnum = io.ntcreatex.out.file.fnum;
4078         ZERO_STRUCT(cl);
4079         cl.generic.level = RAW_CLOSE_CLOSE;
4080         cl.close.in.file.fnum = fnum;
4081         status = smb_raw_close(cli->tree, &cl);
4082         torture_assert_ntstatus_ok_goto(torture, status, ret, done,
4083                                         "smb_raw_close failed");
4084
4085         ZERO_STRUCT(io);
4086         io.generic.level = RAW_OPEN_NTTRANS_CREATE;
4087         io.nttrans.in.access_mask = DESIRED_ACCESS_PIPE;
4088         io.nttrans.in.share_access = NTCREATEX_SHARE_ACCESS_READ|
4089                                        NTCREATEX_SHARE_ACCESS_WRITE;
4090         io.nttrans.in.open_disposition = NTCREATEX_DISP_OPEN;
4091         io.nttrans.in.impersonation = NTCREATEX_IMPERSONATION_IMPERSONATION;
4092         io.nttrans.in.security_flags = 0;
4093
4094         io.nttrans.in.fname = "__none__";
4095         status = smb_raw_open(cli->tree, torture, &io);
4096         torture_assert_ntstatus_equal_goto(torture, status, NT_STATUS_OBJECT_NAME_NOT_FOUND,
4097                                            ret, done,
4098                                            "smb_raw_open for '__none__'");
4099
4100         io.nttrans.in.fname = "pipe\\srvsvc";
4101         status = smb_raw_open(cli->tree, torture, &io);
4102         torture_assert_ntstatus_equal_goto(torture, status, NT_STATUS_OBJECT_NAME_NOT_FOUND,
4103                                            ret, done,
4104                                            "smb_raw_open for 'pipe\\srvsvc'");
4105
4106         io.nttrans.in.fname = "\\pipe\\srvsvc";
4107         status = smb_raw_open(cli->tree, torture, &io);
4108         torture_assert_ntstatus_equal_goto(torture, status, NT_STATUS_OBJECT_NAME_NOT_FOUND,
4109                                            ret, done,
4110                                            "smb_raw_open for '\\pipe\\srvsvc'");
4111
4112         io.nttrans.in.fname = "srvsvc";
4113         status = smb_raw_open(cli->tree, torture, &io);
4114         torture_assert_ntstatus_ok_goto(torture, status, ret, done,
4115                                         "smb2_create failed for 'srvsvc'");
4116         fnum = io.nttrans.out.file.fnum;
4117         ZERO_STRUCT(cl);
4118         cl.generic.level = RAW_CLOSE_CLOSE;
4119         cl.close.in.file.fnum = fnum;
4120         status = smb_raw_close(cli->tree, &cl);
4121         torture_assert_ntstatus_ok_goto(torture, status, ret, done,
4122                                         "smb_raw_close failed");
4123
4124         io.nttrans.in.fname = "\\srvsvc";
4125         status = smb_raw_open(cli->tree, torture, &io);
4126         torture_assert_ntstatus_ok_goto(torture, status, ret, done,
4127                                         "smb2_create failed for '\\srvsvc'");
4128         fnum = io.nttrans.out.file.fnum;
4129         ZERO_STRUCT(cl);
4130         cl.generic.level = RAW_CLOSE_CLOSE;
4131         cl.close.in.file.fnum = fnum;
4132         status = smb_raw_close(cli->tree, &cl);
4133         torture_assert_ntstatus_ok_goto(torture, status, ret, done,
4134                                         "smb_raw_close failed");
4135
4136         io.nttrans.in.fname = "\\\\\\\\\\srvsvc";
4137         status = smb_raw_open(cli->tree, torture, &io);
4138         torture_assert_ntstatus_ok_goto(torture, status, ret, done,
4139                                         "smb2_create failed for '\\\\\\\\\\srvsvc'");
4140         fnum = io.nttrans.out.file.fnum;
4141         ZERO_STRUCT(cl);
4142         cl.generic.level = RAW_CLOSE_CLOSE;
4143         cl.close.in.file.fnum = fnum;
4144         status = smb_raw_close(cli->tree, &cl);
4145         torture_assert_ntstatus_ok_goto(torture, status, ret, done,
4146                                         "smb_raw_close failed");
4147
4148         ZERO_STRUCT(io);
4149         io.generic.level = RAW_OPEN_OPENX;
4150         io.openx.in.open_mode = OPENX_MODE_ACCESS_RDWR;
4151         io.openx.in.open_func = OPENX_OPEN_FUNC_OPEN;
4152
4153         io.openx.in.fname = "__none__";
4154         status = smb_raw_open(cli->tree, torture, &io);
4155         torture_assert_ntstatus_equal_goto(torture, status, NT_STATUS_OBJECT_PATH_SYNTAX_BAD,
4156                                            ret, done,
4157                                            "smb_raw_open for '__none__'");
4158
4159         io.openx.in.fname = "srvsvc";
4160         status = smb_raw_open(cli->tree, torture, &io);
4161         torture_assert_ntstatus_equal_goto(torture, status, NT_STATUS_OBJECT_PATH_SYNTAX_BAD,
4162                                            ret, done,
4163                                            "smb_raw_open for 'srvsvc'");
4164
4165         io.openx.in.fname = "\\srvsvc";
4166         status = smb_raw_open(cli->tree, torture, &io);
4167         torture_assert_ntstatus_equal_goto(torture, status, NT_STATUS_OBJECT_PATH_SYNTAX_BAD,
4168                                            ret, done,
4169                                            "smb_raw_open for '\\srvsvc'");
4170
4171         io.openx.in.fname = "\\pipesrvsvc";
4172         status = smb_raw_open(cli->tree, torture, &io);
4173         torture_assert_ntstatus_equal_goto(torture, status, NT_STATUS_OBJECT_PATH_SYNTAX_BAD,
4174                                            ret, done,
4175                                            "smb_raw_open for '\\pipesrvsvc'");
4176
4177         io.openx.in.fname = "pipe\\__none__";
4178         status = smb_raw_open(cli->tree, torture, &io);
4179         torture_assert_ntstatus_equal_goto(torture, status, NT_STATUS_OBJECT_NAME_NOT_FOUND,
4180                                            ret, done,
4181                                            "smb_raw_open for 'pipe\\__none__'");
4182
4183         io.openx.in.fname = "\\pipe\\__none__";
4184         status = smb_raw_open(cli->tree, torture, &io);
4185         torture_assert_ntstatus_equal_goto(torture, status, NT_STATUS_OBJECT_NAME_NOT_FOUND,
4186                                            ret, done,
4187                                            "smb_raw_open for '\\pipe\\__none__'");
4188
4189         io.openx.in.fname = "pipe\\srvsvc";
4190         status = smb_raw_open(cli->tree, torture, &io);
4191         torture_assert_ntstatus_ok_goto(torture, status, ret, done,
4192                                         "smb2_create failed for 'pipe\\srvsvc'");
4193         fnum = io.openx.out.file.fnum;
4194         ZERO_STRUCT(cl);
4195         cl.generic.level = RAW_CLOSE_CLOSE;
4196         cl.close.in.file.fnum = fnum;
4197         status = smb_raw_close(cli->tree, &cl);
4198         torture_assert_ntstatus_ok_goto(torture, status, ret, done,
4199                                         "smb_raw_close failed");
4200
4201         io.openx.in.fname = "\\pipe\\srvsvc";
4202         status = smb_raw_open(cli->tree, torture, &io);
4203         torture_assert_ntstatus_ok_goto(torture, status, ret, done,
4204                                         "smb2_create failed for '\\pipe\\srvsvc'");
4205         fnum = io.openx.out.file.fnum;
4206         ZERO_STRUCT(cl);
4207         cl.generic.level = RAW_CLOSE_CLOSE;
4208         cl.close.in.file.fnum = fnum;
4209         status = smb_raw_close(cli->tree, &cl);
4210         torture_assert_ntstatus_ok_goto(torture, status, ret, done,
4211                                         "smb_raw_close failed");
4212
4213         io.openx.in.fname = "\\\\\\\\\\pipe\\srvsvc";
4214         status = smb_raw_open(cli->tree, torture, &io);
4215         torture_assert_ntstatus_ok_goto(torture, status, ret, done,
4216                                         "smb2_create failed for '\\\\\\\\\\pipe\\srvsvc'");
4217         fnum = io.openx.out.file.fnum;
4218         ZERO_STRUCT(cl);
4219         cl.generic.level = RAW_CLOSE_CLOSE;
4220         cl.close.in.file.fnum = fnum;
4221         status = smb_raw_close(cli->tree, &cl);
4222         torture_assert_ntstatus_ok_goto(torture, status, ret, done,
4223                                         "smb_raw_close failed");
4224
4225         io.openx.in.fname = "\\\\\\\\\\pipe\\\\\\\\\\srvsvc";
4226         status = smb_raw_open(cli->tree, torture, &io);
4227         torture_assert_ntstatus_ok_goto(torture, status, ret, done,
4228                                         "smb2_create failed for '\\\\\\\\\\pipe\\\\\\\\\\srvsvc'");
4229         fnum = io.openx.out.file.fnum;
4230         ZERO_STRUCT(cl);
4231         cl.generic.level = RAW_CLOSE_CLOSE;
4232         cl.close.in.file.fnum = fnum;
4233         status = smb_raw_close(cli->tree, &cl);
4234         torture_assert_ntstatus_ok_goto(torture, status, ret, done,
4235                                         "smb_raw_close failed");
4236         ret = true;
4237
4238 done:
4239         talloc_free(mem_ctx);
4240         return ret;
4241 }
4242
4243 static bool torture_rpc_smb2_pipe_name(struct torture_context *torture)
4244 {
4245         TALLOC_CTX *mem_ctx;
4246         NTSTATUS status;
4247         bool ret = false;
4248         struct smbcli_options options;
4249         const char *host = torture_setting_string(torture, "host", NULL);
4250         struct smb2_tree *tree;
4251         struct smb2_handle h;
4252         struct smb2_create io;
4253
4254         mem_ctx = talloc_init("torture_samba3_smb2_pipe_name");
4255         torture_assert(torture, (mem_ctx != NULL), "talloc_init failed");
4256
4257         lpcfg_smbcli_options(torture->lp_ctx, &options);
4258
4259         status = smb2_connect(mem_ctx,
4260                               host,
4261                               lpcfg_smb_ports(torture->lp_ctx),
4262                               "IPC$",
4263                               lpcfg_resolve_context(torture->lp_ctx),
4264                               cmdline_credentials,
4265                               &tree,
4266                               torture->ev,
4267                               &options,
4268                               lpcfg_socket_options(torture->lp_ctx),
4269                               lpcfg_gensec_settings(torture, torture->lp_ctx)
4270                               );
4271         torture_assert_ntstatus_ok_goto(torture, status, ret, done,
4272                                         "smb2_connect failed");
4273
4274         ZERO_STRUCT(io);
4275         io.in.oplock_level = 0;
4276         io.in.desired_access = DESIRED_ACCESS_PIPE;
4277         io.in.impersonation_level = SMB2_IMPERSONATION_IMPERSONATION;
4278         io.in.file_attributes = 0;
4279         io.in.create_disposition = NTCREATEX_DISP_OPEN;
4280         io.in.share_access =
4281                 NTCREATEX_SHARE_ACCESS_READ|
4282                 NTCREATEX_SHARE_ACCESS_WRITE;
4283         io.in.create_options = 0;
4284
4285         io.in.fname = "__none__";
4286         status = smb2_create(tree, tree, &io);
4287         torture_assert_ntstatus_equal_goto(torture, status, NT_STATUS_OBJECT_NAME_NOT_FOUND,
4288                                            ret, done,
4289                                            "smb2_create for '__none__'");
4290
4291         io.in.fname = "\\srvsvc";
4292         status = smb2_create(tree, tree, &io);
4293         torture_assert_ntstatus_equal_goto(torture, status, NT_STATUS_OBJECT_NAME_NOT_FOUND,
4294                                            ret, done,
4295                                            "smb2_create for '\\srvsvc'");
4296
4297         io.in.fname = "\\pipe\\srvsvc";
4298         status = smb2_create(tree, tree, &io);
4299         torture_assert_ntstatus_equal_goto(torture, status, NT_STATUS_OBJECT_NAME_NOT_FOUND,
4300                                            ret, done,
4301                                            "smb2_create for '\\pipe\\srvsvc'");
4302
4303         io.in.fname = "pipe\\srvsvc";
4304         status = smb2_create(tree, tree, &io);
4305         torture_assert_ntstatus_equal_goto(torture, status, NT_STATUS_OBJECT_NAME_NOT_FOUND,
4306                                            ret, done,
4307                                            "smb2_create for 'pipe\\srvsvc'");
4308
4309         io.in.fname = "srvsvc";
4310         status = smb2_create(tree, tree, &io);
4311         torture_assert_ntstatus_ok_goto(torture, status, ret, done,
4312                                         "smb2_create failed for 'srvsvc'");
4313
4314         h = io.out.file.handle;
4315
4316         status = smb2_util_close(tree, h);
4317         torture_assert_ntstatus_ok_goto(torture, status, ret, done,
4318                                         "smb2_util_close failed");
4319
4320         ret = true;
4321 done:
4322         talloc_free(mem_ctx);
4323         return ret;
4324 }
4325
4326 /**
4327  * Test behaviour of a waiting read call on a pipe when
4328  * the pipe handle is closed:
4329  * - open a pipe via smb2
4330  * - trigger a read which hangs since there is nothing to read
4331  * - close the pipe file handle
4332  * - wait for the read to return and check the status
4333  *   (STATUS_PIPE_BROKEN)
4334  */
4335 static bool torture_rpc_smb2_pipe_read_close(struct torture_context *torture)
4336 {
4337         TALLOC_CTX *mem_ctx;
4338         NTSTATUS status;
4339         bool ret = false;
4340         struct smbcli_options options;
4341         const char *host = torture_setting_string(torture, "host", NULL);
4342         struct smb2_tree *tree;
4343         struct smb2_handle h;
4344         struct smb2_request *smb2req;
4345         struct smb2_create io;
4346         struct smb2_read rd;
4347
4348         mem_ctx = talloc_init("torture_samba3_pipe_read_close");
4349         torture_assert(torture, (mem_ctx != NULL), "talloc_init failed");
4350
4351         lpcfg_smbcli_options(torture->lp_ctx, &options);
4352
4353         status = smb2_connect(mem_ctx,
4354                               host,
4355                               lpcfg_smb_ports(torture->lp_ctx),
4356                               "IPC$",
4357                               lpcfg_resolve_context(torture->lp_ctx),
4358                               cmdline_credentials,
4359                               &tree,
4360                               torture->ev,
4361                               &options,
4362                               lpcfg_socket_options(torture->lp_ctx),
4363                               lpcfg_gensec_settings(torture, torture->lp_ctx)
4364                               );
4365         torture_assert_ntstatus_ok_goto(torture, status, ret, done,
4366                                         "smb2_connect failed");
4367
4368         ZERO_STRUCT(io);
4369         io.in.oplock_level = 0;
4370         io.in.desired_access = DESIRED_ACCESS_PIPE;
4371         io.in.impersonation_level = SMB2_IMPERSONATION_IMPERSONATION;
4372         io.in.file_attributes = 0;
4373         io.in.create_disposition = NTCREATEX_DISP_OPEN;
4374         io.in.share_access =
4375                 NTCREATEX_SHARE_ACCESS_READ|
4376                 NTCREATEX_SHARE_ACCESS_WRITE;
4377         io.in.create_options = 0;
4378         io.in.fname = "lsarpc";
4379
4380         status = smb2_create(tree, tree, &io);
4381         torture_assert_ntstatus_ok_goto(torture, status, ret, done,
4382                                         "smb2_create failed for 'lsarpc'");
4383
4384         h = io.out.file.handle;
4385
4386         ZERO_STRUCT(rd);
4387         rd.in.file.handle = h;
4388         rd.in.length = 1024;
4389         rd.in.offset = 0;
4390         rd.in.min_count = 0;
4391
4392         smb2req = smb2_read_send(tree, &rd);
4393         torture_assert_goto(torture, (smb2req != NULL), ret, done,
4394                             "smb2_read_send failed");
4395
4396         status = smb2_util_close(tree, h);
4397         torture_assert_ntstatus_ok_goto(torture, status, ret, done,
4398                                         "smb2_util_close failed");
4399
4400         status = smb2_read_recv(smb2req, mem_ctx, &rd);
4401         torture_assert_ntstatus_equal_goto(torture, status, NT_STATUS_PIPE_BROKEN, ret, done,
4402                                            "smb2_read_recv: unexpected return code");
4403
4404         ret = true;
4405 done:
4406         talloc_free(mem_ctx);
4407         return ret;
4408 }
4409
4410 /**
4411  * Test behaviour of a waiting read call on a pipe when
4412  * the tree is disconnected.
4413  * - open a pipe via smb2
4414  * - trigger a read which hangs since there is nothing to read
4415  * - do a tree disconnect
4416  * - wait for the read to return and check the status
4417  *   (STATUS_PIPE_BROKEN)
4418  */
4419 static bool torture_rpc_smb2_pipe_read_tdis(struct torture_context *torture)
4420 {
4421         TALLOC_CTX *mem_ctx;
4422         NTSTATUS status;
4423         bool ret = false;
4424         struct smbcli_options options;
4425         const char *host = torture_setting_string(torture, "host", NULL);
4426         struct smb2_tree *tree;
4427         struct smb2_handle h;
4428         struct smb2_request *smb2req;
4429         struct smb2_create io;
4430         struct smb2_read rd;
4431
4432         mem_ctx = talloc_init("torture_samba3_pipe_read_tdis");
4433         torture_assert(torture, (mem_ctx != NULL), "talloc_init failed");
4434
4435         lpcfg_smbcli_options(torture->lp_ctx, &options);
4436
4437         status = smb2_connect(mem_ctx,
4438                               host,
4439                               lpcfg_smb_ports(torture->lp_ctx),
4440                               "IPC$",
4441                               lpcfg_resolve_context(torture->lp_ctx),
4442                               cmdline_credentials,
4443                               &tree,
4444                               torture->ev,
4445                               &options,
4446                               lpcfg_socket_options(torture->lp_ctx),
4447                               lpcfg_gensec_settings(torture, torture->lp_ctx)
4448                               );
4449         torture_assert_ntstatus_ok_goto(torture, status, ret, done,
4450                                         "smb2_connect failed");
4451
4452         ZERO_STRUCT(io);
4453         io.in.oplock_level = 0;
4454         io.in.desired_access = DESIRED_ACCESS_PIPE;
4455         io.in.impersonation_level = SMB2_IMPERSONATION_IMPERSONATION;
4456         io.in.file_attributes = 0;
4457         io.in.create_disposition = NTCREATEX_DISP_OPEN;
4458         io.in.share_access =
4459                 NTCREATEX_SHARE_ACCESS_READ|
4460                 NTCREATEX_SHARE_ACCESS_WRITE;
4461         io.in.create_options = 0;
4462         io.in.fname = "lsarpc";
4463
4464         status = smb2_create(tree, tree, &io);
4465         torture_assert_ntstatus_ok_goto(torture, status, ret, done,
4466                                         "smb2_create failed for 'lsarpc'");
4467
4468         h = io.out.file.handle;
4469
4470         ZERO_STRUCT(rd);
4471         rd.in.file.handle = h;
4472         rd.in.length = 1024;
4473         rd.in.offset = 0;
4474         rd.in.min_count = 0;
4475
4476         smb2req = smb2_read_send(tree, &rd);
4477         torture_assert_goto(torture, (smb2req != NULL), ret, done,
4478                             "smb2_read_send failed");
4479
4480         status = smb2_tdis(tree);
4481         torture_assert_ntstatus_ok_goto(torture, status, ret, done,
4482                                         "smb2_tdis failed");
4483
4484         status = smb2_read_recv(smb2req, mem_ctx, &rd);
4485         torture_assert_ntstatus_equal_goto(torture, status, NT_STATUS_PIPE_BROKEN, ret, done,
4486                                            "smb2_read_recv: unexpected return code");
4487
4488         ret = true;
4489 done:
4490         talloc_free(mem_ctx);
4491         return ret;
4492 }
4493
4494 /**
4495  * Test behaviour of a waiting read call on a pipe when
4496  * the user logs off
4497  * - open a pipe via smb2
4498  * - trigger a read which hangs since there is nothing to read
4499  * - do a logoff
4500  * - wait for the read to return and check the status
4501  *   (STATUS_PIPE_BROKEN)
4502  */
4503 static bool torture_rpc_smb2_pipe_read_logoff(struct torture_context *torture)
4504 {
4505         TALLOC_CTX *mem_ctx;
4506         NTSTATUS status;
4507         bool ret = false;
4508         struct smbcli_options options;
4509         const char *host = torture_setting_string(torture, "host", NULL);
4510         struct smb2_tree *tree;
4511         struct smb2_handle h;
4512         struct smb2_request *smb2req;
4513         struct smb2_create io;
4514         struct smb2_read rd;
4515
4516         mem_ctx = talloc_init("torture_samba3_pipe_read_tdis");
4517         torture_assert(torture, (mem_ctx != NULL), "talloc_init failed");
4518
4519         lpcfg_smbcli_options(torture->lp_ctx, &options);
4520
4521         status = smb2_connect(mem_ctx,
4522                               host,
4523                               lpcfg_smb_ports(torture->lp_ctx),
4524                               "IPC$",
4525                               lpcfg_resolve_context(torture->lp_ctx),
4526                               cmdline_credentials,
4527                               &tree,
4528                               torture->ev,
4529                               &options,
4530                               lpcfg_socket_options(torture->lp_ctx),
4531                               lpcfg_gensec_settings(torture, torture->lp_ctx)
4532                               );
4533         torture_assert_ntstatus_ok_goto(torture, status, ret, done,
4534                                         "smb2_connect failed");
4535
4536         ZERO_STRUCT(io);
4537         io.in.oplock_level = 0;
4538         io.in.desired_access = DESIRED_ACCESS_PIPE;
4539         io.in.impersonation_level = SMB2_IMPERSONATION_IMPERSONATION;
4540         io.in.file_attributes = 0;
4541         io.in.create_disposition = NTCREATEX_DISP_OPEN;
4542         io.in.share_access =
4543                 NTCREATEX_SHARE_ACCESS_READ|
4544                 NTCREATEX_SHARE_ACCESS_WRITE;
4545         io.in.create_options = 0;
4546         io.in.fname = "lsarpc";
4547
4548         status = smb2_create(tree, tree, &io);
4549         torture_assert_ntstatus_ok_goto(torture, status, ret, done,
4550                                         "smb2_create failed for 'lsarpc'");
4551
4552         h = io.out.file.handle;
4553
4554         ZERO_STRUCT(rd);
4555         rd.in.file.handle = h;
4556         rd.in.length = 1024;
4557         rd.in.offset = 0;
4558         rd.in.min_count = 0;
4559
4560         smb2req = smb2_read_send(tree, &rd);
4561         torture_assert_goto(torture, (smb2req != NULL), ret, done,
4562                             "smb2_read_send failed");
4563
4564         status = smb2_logoff(tree->session);
4565         torture_assert_ntstatus_ok_goto(torture, status, ret, done,
4566                                         "smb2_logoff failed");
4567
4568         status = smb2_read_recv(smb2req, mem_ctx, &rd);
4569         torture_assert_ntstatus_equal_goto(torture, status, NT_STATUS_PIPE_BROKEN, ret, done,
4570                                            "smb2_read_recv: unexpected return code");
4571
4572         ret = true;
4573 done:
4574         talloc_free(mem_ctx);
4575         return ret;
4576 }
4577
4578
4579 struct torture_suite *torture_rpc_samba3(TALLOC_CTX *mem_ctx)
4580 {
4581         struct torture_suite *suite = torture_suite_create(mem_ctx, "samba3");
4582
4583         torture_suite_add_simple_test(suite, "bind", torture_bind_samba3);
4584         torture_suite_add_simple_test(suite, "netlogon", torture_netlogon_samba3);
4585         torture_suite_add_simple_test(suite, "sessionkey", torture_samba3_sessionkey);
4586         torture_suite_add_simple_test(suite, "srvsvc", torture_samba3_rpc_srvsvc);
4587         torture_suite_add_simple_test(suite, "sharesec", torture_samba3_rpc_sharesec);
4588         torture_suite_add_simple_test(suite, "getusername", torture_samba3_rpc_getusername);
4589         torture_suite_add_simple_test(suite, "randomauth2", torture_samba3_rpc_randomauth2);
4590         torture_suite_add_simple_test(suite, "lsa", torture_samba3_rpc_lsa);
4591         torture_suite_add_simple_test(suite, "spoolss", torture_samba3_rpc_spoolss);
4592         torture_suite_add_simple_test(suite, "wkssvc", torture_samba3_rpc_wkssvc);
4593         torture_suite_add_simple_test(suite, "winreg", torture_samba3_rpc_winreg);
4594         torture_suite_add_simple_test(suite, "getaliasmembership-0", torture_samba3_getaliasmembership_0);
4595         torture_suite_add_simple_test(suite, "regconfig", torture_samba3_regconfig);
4596         torture_suite_add_simple_test(suite, "smb-reauth1", torture_rpc_smb_reauth1);
4597         torture_suite_add_simple_test(suite, "smb-reauth2", torture_rpc_smb_reauth2);
4598         torture_suite_add_simple_test(suite, "smb2-reauth1", torture_rpc_smb2_reauth1);
4599         torture_suite_add_simple_test(suite, "smb2-reauth2", torture_rpc_smb2_reauth2);
4600         torture_suite_add_simple_test(suite, "smb1-pipe-name", torture_rpc_smb1_pipe_name);
4601         torture_suite_add_simple_test(suite, "smb2-pipe-name", torture_rpc_smb2_pipe_name);
4602         torture_suite_add_simple_test(suite, "smb2-pipe-read-close", torture_rpc_smb2_pipe_read_close);
4603         torture_suite_add_simple_test(suite, "smb2-pipe-read-tdis", torture_rpc_smb2_pipe_read_tdis);
4604         torture_suite_add_simple_test(suite, "smb2-pipe-read-logoff", torture_rpc_smb2_pipe_read_logoff);
4605
4606         suite->description = talloc_strdup(suite, "samba3 DCERPC interface tests");
4607
4608         return suite;
4609 }