source4/torture/rpc/lsa.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3    test suite for lsa rpc operations
   4
   5    Copyright (C) Andrew Tridgell 2003
   6    Copyright (C) Andrew Bartlett <abartlet@samba.org> 2004-2005
   7
   8    This program is free software; you can redistribute it and/or modify
   9    it under the terms of the GNU General Public License as published by
  10    the Free Software Foundation; either version 2 of the License, or
  11    (at your option) any later version.
  12
  13    This program is distributed in the hope that it will be useful,
  14    but WITHOUT ANY WARRANTY; without even the implied warranty of
  15    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  16    GNU General Public License for more details.
  17
  18    You should have received a copy of the GNU General Public License
  19    along with this program; if not, write to the Free Software
  20    Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  21 */
  22
  23 #include "includes.h"
  24 #include "torture/torture.h"
  25 #include "librpc/gen_ndr/ndr_lsa.h"
  26 #include "lib/events/events.h"
  27 #include "libcli/security/proto.h"
  28 #include "auth/credentials/credentials.h"
  29 #include "libcli/auth/proto.h"
  30
  31 static void init_lsa_String(struct lsa_String *name, const char *s)
  32 {
  33         name->string = s;
  34 }
  35
  36 static BOOL test_OpenPolicy(struct dcerpc_pipe *p, TALLOC_CTX *mem_ctx)
  37 {
  38         struct lsa_ObjectAttribute attr;
  39         struct policy_handle handle;
  40         struct lsa_QosInfo qos;
  41         struct lsa_OpenPolicy r;
  42         NTSTATUS status;
  43         uint16_t system_name = '\\';
  44
  45         printf("\ntesting OpenPolicy\n");
  46
  47         qos.len = 0;
  48         qos.impersonation_level = 2;
  49         qos.context_mode = 1;
  50         qos.effective_only = 0;
  51
  52         attr.len = 0;
  53         attr.root_dir = NULL;
  54         attr.object_name = NULL;
  55         attr.attributes = 0;
  56         attr.sec_desc = NULL;
  57         attr.sec_qos = &qos;
  58
  59         r.in.system_name = &system_name;
  60         r.in.attr = &attr;
  61         r.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
  62         r.out.handle = &handle;
  63
  64         status = dcerpc_lsa_OpenPolicy(p, mem_ctx, &r);
  65         if (!NT_STATUS_IS_OK(status)) {
  66                 if (NT_STATUS_EQUAL(status, NT_STATUS_ACCESS_DENIED) ||
  67                     NT_STATUS_EQUAL(status, NT_STATUS_RPC_PROTSEQ_NOT_SUPPORTED)) {
  68                         printf("not considering %s to be an error\n", nt_errstr(status));
  69                         return True;
  70                 }
  71                 printf("OpenPolicy failed - %s\n", nt_errstr(status));
  72                 return False;
  73         }
  74
  75         return True;
  76 }
  77
  78
  79 BOOL test_lsa_OpenPolicy2(struct dcerpc_pipe *p, TALLOC_CTX *mem_ctx,
  80                           struct policy_handle **handle)
  81 {
  82         struct lsa_ObjectAttribute attr;
  83         struct lsa_QosInfo qos;
  84         struct lsa_OpenPolicy2 r;
  85         NTSTATUS status;
  86
  87         printf("\ntesting OpenPolicy2\n");
  88
  89         *handle = talloc(mem_ctx, struct policy_handle);
  90         if (!*handle) {
  91                 return False;
  92         }
  93
  94         qos.len = 0;
  95         qos.impersonation_level = 2;
  96         qos.context_mode = 1;
  97         qos.effective_only = 0;
  98
  99         attr.len = 0;
 100         attr.root_dir = NULL;
 101         attr.object_name = NULL;
 102         attr.attributes = 0;
 103         attr.sec_desc = NULL;
 104         attr.sec_qos = &qos;
 105
 106         r.in.system_name = "\\";
 107         r.in.attr = &attr;
 108         r.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
 109         r.out.handle = *handle;
 110
 111         status = dcerpc_lsa_OpenPolicy2(p, mem_ctx, &r);
 112         if (!NT_STATUS_IS_OK(status)) {
 113                 if (NT_STATUS_EQUAL(status, NT_STATUS_ACCESS_DENIED) ||
 114                     NT_STATUS_EQUAL(status, NT_STATUS_RPC_PROTSEQ_NOT_SUPPORTED)) {
 115                         printf("not considering %s to be an error\n", nt_errstr(status));
 116                         talloc_free(*handle);
 117                         *handle = NULL;
 118                         return True;
 119                 }
 120                 printf("OpenPolicy2 failed - %s\n", nt_errstr(status));
 121                 return False;
 122         }
 123
 124         return True;
 125 }
 126
 127 static BOOL test_LookupNames(struct dcerpc_pipe *p,
 128                             TALLOC_CTX *mem_ctx,
 129                             struct policy_handle *handle,
 130                             struct lsa_TransNameArray *tnames)
 131 {
 132         struct lsa_LookupNames r;
 133         struct lsa_TransSidArray sids;
 134         struct lsa_String *names;
 135         uint32_t count = 0;
 136         NTSTATUS status;
 137         int i;
 138
 139         printf("\nTesting LookupNames with %d names\n", tnames->count);
 140
 141         sids.count = 0;
 142         sids.sids = NULL;
 143
 144         names = talloc_array(mem_ctx, struct lsa_String, tnames->count);
 145         for (i=0;i<tnames->count;i++) {
 146                 init_lsa_String(&names[i], tnames->names[i].name.string);
 147         }
 148
 149         r.in.handle = handle;
 150         r.in.num_names = tnames->count;
 151         r.in.names = names;
 152         r.in.sids = &sids;
 153         r.in.level = 1;
 154         r.in.count = &count;
 155         r.out.count = &count;
 156         r.out.sids = &sids;
 157
 158         status = dcerpc_lsa_LookupNames(p, mem_ctx, &r);
 159         if (!NT_STATUS_IS_OK(status) && !NT_STATUS_EQUAL(status, STATUS_SOME_UNMAPPED)) {
 160                 printf("LookupNames failed - %s\n", nt_errstr(status));
 161                 return False;
 162         }
 163
 164         printf("\n");
 165
 166         return True;
 167 }
 168
 169 static BOOL test_LookupNames2(struct dcerpc_pipe *p,
 170                               TALLOC_CTX *mem_ctx,
 171                               struct policy_handle *handle,
 172                               struct lsa_TransNameArray2 *tnames)
 173 {
 174         struct lsa_LookupNames2 r;
 175         struct lsa_TransSidArray2 sids;
 176         struct lsa_String *names;
 177         uint32_t count = 0;
 178         NTSTATUS status;
 179         int i;
 180
 181         printf("\nTesting LookupNames2 with %d names\n", tnames->count);
 182
 183         sids.count = 0;
 184         sids.sids = NULL;
 185
 186         names = talloc_array(mem_ctx, struct lsa_String, tnames->count);
 187         for (i=0;i<tnames->count;i++) {
 188                 init_lsa_String(&names[i], tnames->names[i].name.string);
 189         }
 190
 191         r.in.handle = handle;
 192         r.in.num_names = tnames->count;
 193         r.in.names = names;
 194         r.in.sids = &sids;
 195         r.in.level = 1;
 196         r.in.count = &count;
 197         r.in.unknown1 = 0;
 198         r.in.unknown2 = 0;
 199         r.out.count = &count;
 200         r.out.sids = &sids;
 201
 202         status = dcerpc_lsa_LookupNames2(p, mem_ctx, &r);
 203         if (!NT_STATUS_IS_OK(status) && !NT_STATUS_EQUAL(status, STATUS_SOME_UNMAPPED)) {
 204                 printf("LookupNames2 failed - %s\n", nt_errstr(status));
 205                 return False;
 206         }
 207
 208         printf("\n");
 209
 210         return True;
 211 }
 212
 213
 214 static BOOL test_LookupNames3(struct dcerpc_pipe *p,
 215                               TALLOC_CTX *mem_ctx,
 216                               struct policy_handle *handle,
 217                               struct lsa_TransNameArray2 *tnames)
 218 {
 219         struct lsa_LookupNames3 r;
 220         struct lsa_TransSidArray3 sids;
 221         struct lsa_String *names;
 222         uint32_t count = 0;
 223         NTSTATUS status;
 224         int i;
 225
 226         printf("\nTesting LookupNames3 with %d names\n", tnames->count);
 227
 228         sids.count = 0;
 229         sids.sids = NULL;
 230
 231         names = talloc_array(mem_ctx, struct lsa_String, tnames->count);
 232         for (i=0;i<tnames->count;i++) {
 233                 init_lsa_String(&names[i], tnames->names[i].name.string);
 234         }
 235
 236         r.in.handle = handle;
 237         r.in.num_names = tnames->count;
 238         r.in.names = names;
 239         r.in.sids = &sids;
 240         r.in.level = 1;
 241         r.in.count = &count;
 242         r.in.unknown1 = 0;
 243         r.in.unknown2 = 0;
 244         r.out.count = &count;
 245         r.out.sids = &sids;
 246
 247         status = dcerpc_lsa_LookupNames3(p, mem_ctx, &r);
 248         if (!NT_STATUS_IS_OK(status) && !NT_STATUS_EQUAL(status, STATUS_SOME_UNMAPPED)) {
 249                 printf("LookupNames3 failed - %s\n", nt_errstr(status));
 250                 return False;
 251         }
 252
 253         printf("\n");
 254
 255         return True;
 256 }
 257
 258 static BOOL test_LookupNames4(struct dcerpc_pipe *p,
 259                               TALLOC_CTX *mem_ctx,
 260                               struct lsa_TransNameArray2 *tnames)
 261 {
 262         struct lsa_LookupNames4 r;
 263         struct lsa_TransSidArray3 sids;
 264         struct lsa_String *names;
 265         uint32_t count = 0;
 266         NTSTATUS status;
 267         int i;
 268
 269         printf("\nTesting LookupNames4 with %d names\n", tnames->count);
 270
 271         sids.count = 0;
 272         sids.sids = NULL;
 273
 274         names = talloc_array(mem_ctx, struct lsa_String, tnames->count);
 275         for (i=0;i<tnames->count;i++) {
 276                 init_lsa_String(&names[i], tnames->names[i].name.string);
 277         }
 278
 279         r.in.num_names = tnames->count;
 280         r.in.names = names;
 281         r.in.sids = &sids;
 282         r.in.level = 1;
 283         r.in.count = &count;
 284         r.in.unknown1 = 0;
 285         r.in.unknown2 = 0;
 286         r.out.count = &count;
 287         r.out.sids = &sids;
 288
 289         status = dcerpc_lsa_LookupNames4(p, mem_ctx, &r);
 290         if (!NT_STATUS_IS_OK(status) && !NT_STATUS_EQUAL(status, STATUS_SOME_UNMAPPED)) {
 291                 printf("LookupNames4 failed - %s\n", nt_errstr(status));
 292                 return False;
 293         }
 294
 295         printf("\n");
 296
 297         return True;
 298 }
 299
 300
 301 static BOOL test_LookupSids(struct dcerpc_pipe *p,
 302                             TALLOC_CTX *mem_ctx,
 303                             struct policy_handle *handle,
 304                             struct lsa_SidArray *sids)
 305 {
 306         struct lsa_LookupSids r;
 307         struct lsa_TransNameArray names;
 308         uint32_t count = sids->num_sids;
 309         NTSTATUS status;
 310
 311         printf("\nTesting LookupSids\n");
 312
 313         names.count = 0;
 314         names.names = NULL;
 315
 316         r.in.handle = handle;
 317         r.in.sids = sids;
 318         r.in.names = &names;
 319         r.in.level = 1;
 320         r.in.count = &count;
 321         r.out.count = &count;
 322         r.out.names = &names;
 323
 324         status = dcerpc_lsa_LookupSids(p, mem_ctx, &r);
 325         if (!NT_STATUS_IS_OK(status) && !NT_STATUS_EQUAL(status, STATUS_SOME_UNMAPPED)) {
 326                 printf("LookupSids failed - %s\n", nt_errstr(status));
 327                 return False;
 328         }
 329
 330         printf("\n");
 331
 332         if (!test_LookupNames(p, mem_ctx, handle, &names)) {
 333                 return False;
 334         }
 335
 336         return True;
 337 }
 338
 339
 340 static BOOL test_LookupSids2(struct dcerpc_pipe *p,
 341                             TALLOC_CTX *mem_ctx,
 342                             struct policy_handle *handle,
 343                             struct lsa_SidArray *sids)
 344 {
 345         struct lsa_LookupSids2 r;
 346         struct lsa_TransNameArray2 names;
 347         uint32_t count = sids->num_sids;
 348         NTSTATUS status;
 349
 350         printf("\nTesting LookupSids2\n");
 351
 352         names.count = 0;
 353         names.names = NULL;
 354
 355         r.in.handle = handle;
 356         r.in.sids = sids;
 357         r.in.names = &names;
 358         r.in.level = 1;
 359         r.in.count = &count;
 360         r.in.unknown1 = 0;
 361         r.in.unknown2 = 0;
 362         r.out.count = &count;
 363         r.out.names = &names;
 364
 365         status = dcerpc_lsa_LookupSids2(p, mem_ctx, &r);
 366         if (!NT_STATUS_IS_OK(status) && !NT_STATUS_EQUAL(status, STATUS_SOME_UNMAPPED)) {
 367                 printf("LookupSids2 failed - %s\n", nt_errstr(status));
 368                 return False;
 369         }
 370
 371         printf("\n");
 372
 373         if (!test_LookupNames2(p, mem_ctx, handle, &names)) {
 374                 return False;
 375         }
 376
 377         if (!test_LookupNames3(p, mem_ctx, handle, &names)) {
 378                 return False;
 379         }
 380
 381         return True;
 382 }
 383
 384 static BOOL test_LookupSids3(struct dcerpc_pipe *p,
 385                             TALLOC_CTX *mem_ctx,
 386                             struct lsa_SidArray *sids)
 387 {
 388         struct lsa_LookupSids3 r;
 389         struct lsa_TransNameArray2 names;
 390         uint32_t count = sids->num_sids;
 391         NTSTATUS status;
 392
 393         printf("\nTesting LookupSids3\n");
 394
 395         names.count = 0;
 396         names.names = NULL;
 397
 398         r.in.sids = sids;
 399         r.in.names = &names;
 400         r.in.level = 1;
 401         r.in.count = &count;
 402         r.in.unknown1 = 0;
 403         r.in.unknown2 = 0;
 404         r.out.count = &count;
 405         r.out.names = &names;
 406
 407         status = dcerpc_lsa_LookupSids3(p, mem_ctx, &r);
 408         if (!NT_STATUS_IS_OK(status) && !NT_STATUS_EQUAL(status, STATUS_SOME_UNMAPPED)) {
 409                 if (NT_STATUS_EQUAL(status, NT_STATUS_ACCESS_DENIED) ||
 410                     NT_STATUS_EQUAL(status, NT_STATUS_RPC_PROTSEQ_NOT_SUPPORTED)) {
 411                         printf("not considering %s to be an error\n", nt_errstr(status));
 412                         return True;
 413                 }
 414                 printf("LookupSids3 failed - %s - not considered an error\n",
 415                        nt_errstr(status));
 416                 return False;
 417         }
 418
 419         printf("\n");
 420
 421         if (!test_LookupNames4(p, mem_ctx, &names)) {
 422                 return False;
 423         }
 424
 425         return True;
 426 }
 427
 428 BOOL test_many_LookupSids(struct dcerpc_pipe *p,
 429                           TALLOC_CTX *mem_ctx,
 430                           struct policy_handle *handle)
 431 {
 432         uint32_t count;
 433         NTSTATUS status;
 434         struct lsa_SidArray sids;
 435         int i;
 436
 437         printf("\nTesting LookupSids with lots of SIDs\n");
 438
 439         sids.num_sids = 100;
 440
 441         sids.sids = talloc_array(mem_ctx, struct lsa_SidPtr, sids.num_sids);
 442
 443         for (i=0; i<sids.num_sids; i++) {
 444                 const char *sidstr = "S-1-5-32-545";
 445                 sids.sids[i].sid = dom_sid_parse_talloc(mem_ctx, sidstr);
 446         }
 447
 448         count = sids.num_sids;
 449
 450         if (handle) {
 451                 struct lsa_LookupSids r;
 452                 struct lsa_TransNameArray names;
 453                 names.count = 0;
 454                 names.names = NULL;
 455
 456                 r.in.handle = handle;
 457                 r.in.sids = &sids;
 458                 r.in.names = &names;
 459                 r.in.level = 1;
 460                 r.in.count = &names.count;
 461                 r.out.count = &count;
 462                 r.out.names = &names;
 463
 464                 status = dcerpc_lsa_LookupSids(p, mem_ctx, &r);
 465                 if (!NT_STATUS_IS_OK(status) &&
 466                     !NT_STATUS_EQUAL(status, STATUS_SOME_UNMAPPED)) {
 467                         printf("LookupSids failed - %s\n", nt_errstr(status));
 468                         return False;
 469                 }
 470
 471                 printf("\n");
 472
 473                 if (!test_LookupNames(p, mem_ctx, handle, &names)) {
 474                         return False;
 475                 }
 476         } else {
 477                 struct lsa_LookupSids3 r;
 478                 struct lsa_TransNameArray2 names;
 479
 480                 names.count = 0;
 481                 names.names = NULL;
 482
 483                 printf("\nTesting LookupSids3\n");
 484
 485                 r.in.sids = &sids;
 486                 r.in.names = &names;
 487                 r.in.level = 1;
 488                 r.in.count = &count;
 489                 r.in.unknown1 = 0;
 490                 r.in.unknown2 = 0;
 491                 r.out.count = &count;
 492                 r.out.names = &names;
 493
 494                 status = dcerpc_lsa_LookupSids3(p, mem_ctx, &r);
 495                 if (!NT_STATUS_IS_OK(status) && !NT_STATUS_EQUAL(status, STATUS_SOME_UNMAPPED)) {
 496                         if (NT_STATUS_EQUAL(status, NT_STATUS_ACCESS_DENIED) ||
 497                             NT_STATUS_EQUAL(status, NT_STATUS_RPC_PROTSEQ_NOT_SUPPORTED)) {
 498                                 printf("not considering %s to be an error\n", nt_errstr(status));
 499                                 return True;
 500                         }
 501                         printf("LookupSids3 failed - %s\n",
 502                                nt_errstr(status));
 503                         return False;
 504                 }
 505                 if (!test_LookupNames4(p, mem_ctx, &names)) {
 506                         return False;
 507                 }
 508         }
 509
 510         printf("\n");
 511
 512
 513
 514         return True;
 515 }
 516
 517 #define NUM_ASYNC_REQUESTS 1000
 518
 519 static void lookupsids_cb(struct rpc_request *req)
 520 {
 521         int *replies = (int *)req->async.private;
 522         NTSTATUS status;
 523
 524         status = dcerpc_ndr_request_recv(req);
 525         DEBUG(3, ("lookupsids returned %s\n", nt_errstr(status)));
 526         if (!NT_STATUS_IS_OK(status)) {
 527                 *replies = -1;
 528         }
 529
 530         *replies += 1;
 531 }
 532
 533 static BOOL test_LookupSids_async(struct dcerpc_pipe *p,
 534                                   TALLOC_CTX *mem_ctx,
 535                                   struct policy_handle *handle)
 536 {
 537         struct lsa_SidArray sids;
 538         struct lsa_SidPtr sidptr;
 539
 540         uint32_t count[NUM_ASYNC_REQUESTS];
 541         struct lsa_TransNameArray names[NUM_ASYNC_REQUESTS];
 542         struct lsa_LookupSids r[NUM_ASYNC_REQUESTS];
 543         struct rpc_request **req;
 544
 545         int i, replies;
 546         BOOL ret = True;
 547
 548         printf("\nTesting %d async lookupsids request\n", 100);
 549
 550         req = talloc_array(mem_ctx, struct rpc_request *, NUM_ASYNC_REQUESTS);
 551
 552         sids.num_sids = 1;
 553         sids.sids = &sidptr;
 554         sidptr.sid = dom_sid_parse_talloc(mem_ctx, "S-1-5-32-545");
 555
 556         replies = 0;
 557
 558         for (i=0; i<NUM_ASYNC_REQUESTS; i++) {
 559                 count[i] = 0;
 560                 names[i].count = 0;
 561                 names[i].names = NULL;
 562
 563                 r[i].in.handle = handle;
 564                 r[i].in.sids = &sids;
 565                 r[i].in.names = &names[i];
 566                 r[i].in.level = 1;
 567                 r[i].in.count = &names[i].count;
 568                 r[i].out.count = &count[i];
 569                 r[i].out.names = &names[i];
 570
 571                 req[i] = dcerpc_lsa_LookupSids_send(p, req, &r[i]);
 572                 if (req[i] == NULL) {
 573                         ret = False;
 574                         break;
 575                 }
 576
 577                 req[i]->async.callback = lookupsids_cb;
 578                 req[i]->async.private = &replies;
 579         }
 580
 581         while (replies < NUM_ASYNC_REQUESTS) {
 582                 event_loop_once(p->conn->event_ctx);
 583                 if (replies < 0) {
 584                         ret = False;
 585                         break;
 586                 }
 587         }
 588
 589         talloc_free(req);
 590
 591         return ret;
 592 }
 593
 594 static BOOL test_LookupPrivValue(struct dcerpc_pipe *p,
 595                                  TALLOC_CTX *mem_ctx,
 596                                  struct policy_handle *handle,
 597                                  struct lsa_String *name)
 598 {
 599         NTSTATUS status;
 600         struct lsa_LookupPrivValue r;
 601         struct lsa_LUID luid;
 602
 603         r.in.handle = handle;
 604         r.in.name = name;
 605         r.out.luid = &luid;
 606
 607         status = dcerpc_lsa_LookupPrivValue(p, mem_ctx, &r);
 608         if (!NT_STATUS_IS_OK(status)) {
 609                 printf("\nLookupPrivValue failed - %s\n", nt_errstr(status));
 610                 return False;
 611         }
 612
 613         return True;
 614 }
 615
 616 static BOOL test_LookupPrivName(struct dcerpc_pipe *p,
 617                                 TALLOC_CTX *mem_ctx,
 618                                 struct policy_handle *handle,
 619                                 struct lsa_LUID *luid)
 620 {
 621         NTSTATUS status;
 622         struct lsa_LookupPrivName r;
 623
 624         r.in.handle = handle;
 625         r.in.luid = luid;
 626
 627         status = dcerpc_lsa_LookupPrivName(p, mem_ctx, &r);
 628         if (!NT_STATUS_IS_OK(status)) {
 629                 printf("\nLookupPrivName failed - %s\n", nt_errstr(status));
 630                 return False;
 631         }
 632
 633         return True;
 634 }
 635
 636 static BOOL test_RemovePrivilegesFromAccount(struct dcerpc_pipe *p,
 637                                              TALLOC_CTX *mem_ctx,
 638                                              struct policy_handle *acct_handle,
 639                                              struct lsa_LUID *luid)
 640 {
 641         NTSTATUS status;
 642         struct lsa_RemovePrivilegesFromAccount r;
 643         struct lsa_PrivilegeSet privs;
 644         BOOL ret = True;
 645
 646         printf("Testing RemovePrivilegesFromAccount\n");
 647
 648         r.in.handle = acct_handle;
 649         r.in.remove_all = 0;
 650         r.in.privs = &privs;
 651
 652         privs.count = 1;
 653         privs.unknown = 0;
 654         privs.set = talloc_array(mem_ctx, struct lsa_LUIDAttribute, 1);
 655         privs.set[0].luid = *luid;
 656         privs.set[0].attribute = 0;
 657
 658         status = dcerpc_lsa_RemovePrivilegesFromAccount(p, mem_ctx, &r);
 659         if (!NT_STATUS_IS_OK(status)) {
 660                 printf("RemovePrivilegesFromAccount failed - %s\n", nt_errstr(status));
 661                 return False;
 662         }
 663
 664         return ret;
 665 }
 666
 667 static BOOL test_AddPrivilegesToAccount(struct dcerpc_pipe *p,
 668                                         TALLOC_CTX *mem_ctx,
 669                                         struct policy_handle *acct_handle,
 670                                         struct lsa_LUID *luid)
 671 {
 672         NTSTATUS status;
 673         struct lsa_AddPrivilegesToAccount r;
 674         struct lsa_PrivilegeSet privs;
 675         BOOL ret = True;
 676
 677         printf("Testing AddPrivilegesToAccount\n");
 678
 679         r.in.handle = acct_handle;
 680         r.in.privs = &privs;
 681
 682         privs.count = 1;
 683         privs.unknown = 0;
 684         privs.set = talloc_array(mem_ctx, struct lsa_LUIDAttribute, 1);
 685         privs.set[0].luid = *luid;
 686         privs.set[0].attribute = 0;
 687
 688         status = dcerpc_lsa_AddPrivilegesToAccount(p, mem_ctx, &r);
 689         if (!NT_STATUS_IS_OK(status)) {
 690                 printf("AddPrivilegesToAccount failed - %s\n", nt_errstr(status));
 691                 return False;
 692         }
 693
 694         return ret;
 695 }
 696
 697 static BOOL test_EnumPrivsAccount(struct dcerpc_pipe *p,
 698                                   TALLOC_CTX *mem_ctx,
 699                                   struct policy_handle *handle,
 700                                   struct policy_handle *acct_handle)
 701 {
 702         NTSTATUS status;
 703         struct lsa_EnumPrivsAccount r;
 704         BOOL ret = True;
 705
 706         printf("Testing EnumPrivsAccount\n");
 707
 708         r.in.handle = acct_handle;
 709
 710         status = dcerpc_lsa_EnumPrivsAccount(p, mem_ctx, &r);
 711         if (!NT_STATUS_IS_OK(status)) {
 712                 printf("EnumPrivsAccount failed - %s\n", nt_errstr(status));
 713                 return False;
 714         }
 715
 716         if (r.out.privs && r.out.privs->count > 0) {
 717                 int i;
 718                 for (i=0;i<r.out.privs->count;i++) {
 719                         test_LookupPrivName(p, mem_ctx, handle,
 720                                             &r.out.privs->set[i].luid);
 721                 }
 722
 723                 ret &= test_RemovePrivilegesFromAccount(p, mem_ctx, acct_handle,
 724                                                         &r.out.privs->set[0].luid);
 725                 ret &= test_AddPrivilegesToAccount(p, mem_ctx, acct_handle,
 726                                                    &r.out.privs->set[0].luid);
 727         }
 728
 729         return ret;
 730 }
 731
 732 static BOOL test_Delete(struct dcerpc_pipe *p,
 733                        TALLOC_CTX *mem_ctx,
 734                        struct policy_handle *handle)
 735 {
 736         NTSTATUS status;
 737         struct lsa_Delete r;
 738
 739         printf("testing Delete\n");
 740
 741         r.in.handle = handle;
 742         status = dcerpc_lsa_Delete(p, mem_ctx, &r);
 743         if (!NT_STATUS_IS_OK(status)) {
 744                 printf("Delete failed - %s\n", nt_errstr(status));
 745                 return False;
 746         }
 747
 748         return True;
 749 }
 750
 751
 752 static BOOL test_CreateAccount(struct dcerpc_pipe *p,
 753                                TALLOC_CTX *mem_ctx,
 754                                struct policy_handle *handle)
 755 {
 756         NTSTATUS status;
 757         struct lsa_CreateAccount r;
 758         struct dom_sid2 *newsid;
 759         struct policy_handle acct_handle;
 760
 761         newsid = dom_sid_parse_talloc(mem_ctx, "S-1-5-12349876-4321-2854");
 762
 763         printf("Testing CreateAccount\n");
 764
 765         r.in.handle = handle;
 766         r.in.sid = newsid;
 767         r.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
 768         r.out.acct_handle = &acct_handle;
 769
 770         status = dcerpc_lsa_CreateAccount(p, mem_ctx, &r);
 771         if (!NT_STATUS_IS_OK(status)) {
 772                 printf("CreateAccount failed - %s\n", nt_errstr(status));
 773                 return False;
 774         }
 775
 776         if (!test_Delete(p, mem_ctx, &acct_handle)) {
 777                 return False;
 778         }
 779
 780         return True;
 781 }
 782
 783 static BOOL test_DeleteTrustedDomain(struct dcerpc_pipe *p,
 784                                      TALLOC_CTX *mem_ctx,
 785                                      struct policy_handle *handle,
 786                                      struct lsa_StringLarge name)
 787 {
 788         NTSTATUS status;
 789         struct lsa_OpenTrustedDomainByName r;
 790         struct policy_handle trustdom_handle;
 791
 792         r.in.handle = handle;
 793         r.in.name.string = name.string;
 794         r.in.access_mask = SEC_STD_DELETE;
 795         r.out.trustdom_handle = &trustdom_handle;
 796
 797         status = dcerpc_lsa_OpenTrustedDomainByName(p, mem_ctx, &r);
 798         if (!NT_STATUS_IS_OK(status)) {
 799                 printf("lsa_OpenTrustedDomainByName failed - %s\n", nt_errstr(status));
 800                 return False;
 801         }
 802
 803         if (!test_Delete(p, mem_ctx, &trustdom_handle)) {
 804                 return False;
 805         }
 806
 807         return True;
 808 }
 809
 810
 811 static BOOL test_CreateSecret(struct dcerpc_pipe *p,
 812                               TALLOC_CTX *mem_ctx,
 813                               struct policy_handle *handle)
 814 {
 815         NTSTATUS status;
 816         struct lsa_CreateSecret r;
 817         struct lsa_OpenSecret r2;
 818         struct lsa_SetSecret r3;
 819         struct lsa_QuerySecret r4;
 820         struct lsa_SetSecret r5;
 821         struct lsa_QuerySecret r6;
 822         struct lsa_SetSecret r7;
 823         struct lsa_QuerySecret r8;
 824         struct policy_handle sec_handle, sec_handle2, sec_handle3;
 825         struct lsa_Delete d;
 826         struct lsa_DATA_BUF buf1;
 827         struct lsa_DATA_BUF_PTR bufp1;
 828         struct lsa_DATA_BUF_PTR bufp2;
 829         DATA_BLOB enc_key;
 830         BOOL ret = True;
 831         DATA_BLOB session_key;
 832         NTTIME old_mtime, new_mtime;
 833         DATA_BLOB blob1, blob2;
 834         const char *secret1 = "abcdef12345699qwerty";
 835         char *secret2;
 836         const char *secret3 = "ABCDEF12345699QWERTY";
 837         char *secret4;
 838         const char *secret5 = "NEW-SAMBA4-SECRET";
 839         char *secret6;
 840         char *secname[2];
 841         int i;
 842         const int LOCAL = 0;
 843         const int GLOBAL = 1;
 844
 845         secname[LOCAL] = talloc_asprintf(mem_ctx, "torturesecret-%u", (uint_t)random());
 846         secname[GLOBAL] = talloc_asprintf(mem_ctx, "G$torturesecret-%u", (uint_t)random());
 847
 848         for (i=0; i< 2; i++) {
 849                 printf("Testing CreateSecret of %s\n", secname[i]);
 850
 851                 init_lsa_String(&r.in.name, secname[i]);
 852
 853                 r.in.handle = handle;
 854                 r.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
 855                 r.out.sec_handle = &sec_handle;
 856
 857                 status = dcerpc_lsa_CreateSecret(p, mem_ctx, &r);
 858                 if (!NT_STATUS_IS_OK(status)) {
 859                         printf("CreateSecret failed - %s\n", nt_errstr(status));
 860                         return False;
 861                 }
 862
 863                 r.in.handle = handle;
 864                 r.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
 865                 r.out.sec_handle = &sec_handle3;
 866
 867                 status = dcerpc_lsa_CreateSecret(p, mem_ctx, &r);
 868                 if (!NT_STATUS_EQUAL(status, NT_STATUS_OBJECT_NAME_COLLISION)) {
 869                         printf("CreateSecret should have failed OBJECT_NAME_COLLISION - %s\n", nt_errstr(status));
 870                         return False;
 871                 }
 872
 873                 r2.in.handle = handle;
 874                 r2.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
 875                 r2.in.name = r.in.name;
 876                 r2.out.sec_handle = &sec_handle2;
 877
 878                 printf("Testing OpenSecret\n");
 879
 880                 status = dcerpc_lsa_OpenSecret(p, mem_ctx, &r2);
 881                 if (!NT_STATUS_IS_OK(status)) {
 882                         printf("OpenSecret failed - %s\n", nt_errstr(status));
 883                         return False;
 884                 }
 885
 886                 status = dcerpc_fetch_session_key(p, &session_key);
 887                 if (!NT_STATUS_IS_OK(status)) {
 888                         printf("dcerpc_fetch_session_key failed - %s\n", nt_errstr(status));
 889                         return False;
 890                 }
 891
 892                 enc_key = sess_encrypt_string(secret1, &session_key);
 893
 894                 r3.in.sec_handle = &sec_handle;
 895                 r3.in.new_val = &buf1;
 896                 r3.in.old_val = NULL;
 897                 r3.in.new_val->data = enc_key.data;
 898                 r3.in.new_val->length = enc_key.length;
 899                 r3.in.new_val->size = enc_key.length;
 900
 901                 printf("Testing SetSecret\n");
 902
 903                 status = dcerpc_lsa_SetSecret(p, mem_ctx, &r3);
 904                 if (!NT_STATUS_IS_OK(status)) {
 905                         printf("SetSecret failed - %s\n", nt_errstr(status));
 906                         return False;
 907                 }
 908
 909                 r3.in.sec_handle = &sec_handle;
 910                 r3.in.new_val = &buf1;
 911                 r3.in.old_val = NULL;
 912                 r3.in.new_val->data = enc_key.data;
 913                 r3.in.new_val->length = enc_key.length;
 914                 r3.in.new_val->size = enc_key.length;
 915
 916                 /* break the encrypted data */
 917                 enc_key.data[0]++;
 918
 919                 printf("Testing SetSecret with broken key\n");
 920
 921                 status = dcerpc_lsa_SetSecret(p, mem_ctx, &r3);
 922                 if (!NT_STATUS_EQUAL(status, NT_STATUS_UNKNOWN_REVISION)) {
 923                         printf("SetSecret should have failed UNKNOWN_REVISION - %s\n", nt_errstr(status));
 924                         ret = False;
 925                 }
 926
 927                 data_blob_free(&enc_key);
 928
 929                 ZERO_STRUCT(new_mtime);
 930                 ZERO_STRUCT(old_mtime);
 931
 932                 /* fetch the secret back again */
 933                 r4.in.sec_handle = &sec_handle;
 934                 r4.in.new_val = &bufp1;
 935                 r4.in.new_mtime = &new_mtime;
 936                 r4.in.old_val = NULL;
 937                 r4.in.old_mtime = NULL;
 938
 939                 bufp1.buf = NULL;
 940
 941                 printf("Testing QuerySecret\n");
 942                 status = dcerpc_lsa_QuerySecret(p, mem_ctx, &r4);
 943                 if (!NT_STATUS_IS_OK(status)) {
 944                         printf("QuerySecret failed - %s\n", nt_errstr(status));
 945                         ret = False;
 946                 } else {
 947                         if (r4.out.new_val == NULL || r4.out.new_val->buf == NULL) {
 948                                 printf("No secret buffer returned\n");
 949                                 ret = False;
 950                         } else {
 951                                 blob1.data = r4.out.new_val->buf->data;
 952                                 blob1.length = r4.out.new_val->buf->size;
 953
 954                                 blob2 = data_blob_talloc(mem_ctx, NULL, blob1.length);
 955
 956                                 secret2 = sess_decrypt_string(&blob1, &session_key);
 957
 958                                 if (strcmp(secret1, secret2) != 0) {
 959                                         printf("Returned secret '%s' doesn't match '%s'\n",
 960                                                secret2, secret1);
 961                                         ret = False;
 962                                 }
 963                         }
 964                 }
 965
 966                 enc_key = sess_encrypt_string(secret3, &session_key);
 967
 968                 r5.in.sec_handle = &sec_handle;
 969                 r5.in.new_val = &buf1;
 970                 r5.in.old_val = NULL;
 971                 r5.in.new_val->data = enc_key.data;
 972                 r5.in.new_val->length = enc_key.length;
 973                 r5.in.new_val->size = enc_key.length;
 974
 975                 printf("Testing SetSecret (existing value should move to old)\n");
 976
 977                 status = dcerpc_lsa_SetSecret(p, mem_ctx, &r5);
 978                 if (!NT_STATUS_IS_OK(status)) {
 979                         printf("SetSecret failed - %s\n", nt_errstr(status));
 980                         ret = False;
 981                 }
 982
 983                 data_blob_free(&enc_key);
 984
 985                 ZERO_STRUCT(new_mtime);
 986                 ZERO_STRUCT(old_mtime);
 987
 988                 /* fetch the secret back again */
 989                 r6.in.sec_handle = &sec_handle;
 990                 r6.in.new_val = &bufp1;
 991                 r6.in.new_mtime = &new_mtime;
 992                 r6.in.old_val = &bufp2;
 993                 r6.in.old_mtime = &old_mtime;
 994
 995                 bufp1.buf = NULL;
 996                 bufp2.buf = NULL;
 997
 998                 status = dcerpc_lsa_QuerySecret(p, mem_ctx, &r6);
 999                 if (!NT_STATUS_IS_OK(status)) {
1000                         printf("QuerySecret failed - %s\n", nt_errstr(status));
1001                         ret = False;
1002                         secret4 = NULL;
1003                 } else {
1004
1005                         if (r6.out.new_val->buf == NULL || r6.out.old_val->buf == NULL
1006                                 || r6.out.new_mtime == NULL || r6.out.old_mtime == NULL) {
1007                                 printf("Both secret buffers and both times not returned\n");
1008                                 ret = False;
1009                                 secret4 = NULL;
1010                         } else {
1011                                 blob1.data = r6.out.new_val->buf->data;
1012                                 blob1.length = r6.out.new_val->buf->size;
1013
1014                                 blob2 = data_blob_talloc(mem_ctx, NULL, blob1.length);
1015
1016                                 secret4 = sess_decrypt_string(&blob1, &session_key);
1017
1018                                 if (strcmp(secret3, secret4) != 0) {
1019                                         printf("Returned NEW secret %s doesn't match %s\n", secret4, secret3);
1020                                         ret = False;
1021                                 }
1022
1023                                 blob1.data = r6.out.old_val->buf->data;
1024                                 blob1.length = r6.out.old_val->buf->length;
1025
1026                                 blob2 = data_blob_talloc(mem_ctx, NULL, blob1.length);
1027
1028                                 secret2 = sess_decrypt_string(&blob1, &session_key);
1029
1030                                 if (strcmp(secret1, secret2) != 0) {
1031                                         printf("Returned OLD secret %s doesn't match %s\n", secret2, secret1);
1032                                         ret = False;
1033                                 }
1034
1035                                 if (*r6.out.new_mtime == *r6.out.old_mtime) {
1036                                         printf("Returned secret %s had same mtime for both secrets: %s\n",
1037                                                secname[i],
1038                                                nt_time_string(mem_ctx, *r6.out.new_mtime));
1039                                         ret = False;
1040                                 }
1041                         }
1042                 }
1043
1044                 enc_key = sess_encrypt_string(secret5, &session_key);
1045
1046                 r7.in.sec_handle = &sec_handle;
1047                 r7.in.old_val = &buf1;
1048                 r7.in.old_val->data = enc_key.data;
1049                 r7.in.old_val->length = enc_key.length;
1050                 r7.in.old_val->size = enc_key.length;
1051                 r7.in.new_val = NULL;
1052
1053                 printf("Testing SetSecret of old Secret only\n");
1054
1055                 status = dcerpc_lsa_SetSecret(p, mem_ctx, &r7);
1056                 if (!NT_STATUS_IS_OK(status)) {
1057                         printf("SetSecret failed - %s\n", nt_errstr(status));
1058                         ret = False;
1059                 }
1060
1061                 data_blob_free(&enc_key);
1062
1063                 /* fetch the secret back again */
1064                 r8.in.sec_handle = &sec_handle;
1065                 r8.in.new_val = &bufp1;
1066                 r8.in.new_mtime = &new_mtime;
1067                 r8.in.old_val = &bufp2;
1068                 r8.in.old_mtime = &old_mtime;
1069
1070                 bufp1.buf = NULL;
1071                 bufp2.buf = NULL;
1072
1073                 status = dcerpc_lsa_QuerySecret(p, mem_ctx, &r8);
1074                 if (!NT_STATUS_IS_OK(status)) {
1075                         printf("QuerySecret failed - %s\n", nt_errstr(status));
1076                         ret = False;
1077                 } else {
1078                         if (!r8.out.new_val || !r8.out.old_val) {
1079                                 printf("in/out pointers not returned, despite being set on in for QuerySecret\n");
1080                                 ret = False;
1081                         } else if (r8.out.new_val->buf == NULL) {
1082                                 if (i != LOCAL) {
1083                                         printf("NEW secret buffer not returned after GLOBAL OLD set\n");
1084                                         ret = False;
1085                                 }
1086                         } else if (r8.out.old_val->buf == NULL) {
1087                                 printf("OLD secret buffer not returned after OLD set\n");
1088                                 ret = False;
1089                         } else if (r8.out.new_mtime == NULL || r8.out.old_mtime == NULL) {
1090                                 printf("Both times not returned after OLD set\n");
1091                                 ret = False;
1092                         } else {
1093                                 if (i == LOCAL) {
1094                                         printf("NEW secret buffer should not be returned after LOCAL OLD set\n");
1095                                         ret = False;
1096                                 }
1097                                 blob1.data = r8.out.new_val->buf->data;
1098                                 blob1.length = r8.out.new_val->buf->length;
1099
1100                                 blob2 = data_blob_talloc(mem_ctx, NULL, blob1.length);
1101
1102                                 secret6 = sess_decrypt_string(&blob1, &session_key);
1103
1104                                 if (strcmp(secret3, secret4) != 0) {
1105                                         printf("Returned NEW secret '%s' doesn't match '%s'\n", secret4, secret3);
1106                                         ret = False;
1107                                 }
1108
1109                                 blob1.data = r8.out.old_val->buf->data;
1110                                 blob1.length = r8.out.old_val->buf->size;
1111
1112                                 blob2 = data_blob_talloc(mem_ctx, NULL, blob1.length);
1113
1114                                 secret6 = sess_decrypt_string(&blob1, &session_key);
1115
1116                                 if (strcmp(secret5, secret6) != 0) {
1117                                         printf("Returned OLD secret %s doesn't match %s\n", secret5, secret6);
1118                                         ret = False;
1119                                 }
1120
1121                                 if (*r8.out.new_mtime == *r8.out.old_mtime) {
1122                                         if (i != GLOBAL) {
1123                                                 printf("Returned secret %s had same mtime for both secrets: %s\n",
1124                                                        secname[i],
1125                                                        nt_time_string(mem_ctx, *r8.out.new_mtime));
1126                                                 ret = False;
1127                                         }
1128                                 } else {
1129                                         printf("Returned secret %s should have had same mtime for both secrets: %s != %s\n",
1130                                                secname[i],
1131                                                nt_time_string(mem_ctx, *r8.out.old_mtime),
1132                                                nt_time_string(mem_ctx, *r8.out.new_mtime));
1133                                         ret = False;
1134                                 }
1135                         }
1136                 }
1137
1138                 if (!test_Delete(p, mem_ctx, &sec_handle)) {
1139                         ret = False;
1140                 }
1141
1142                 d.in.handle = &sec_handle2;
1143                 status = dcerpc_lsa_Delete(p, mem_ctx, &d);
1144                 if (!NT_STATUS_EQUAL(status, NT_STATUS_INVALID_HANDLE)) {
1145                         printf("Second delete expected INVALID_HANDLE - %s\n", nt_errstr(status));
1146                         ret = False;
1147                 } else {
1148
1149                         printf("Testing OpenSecret of just-deleted secret\n");
1150
1151                         status = dcerpc_lsa_OpenSecret(p, mem_ctx, &r2);
1152                         if (!NT_STATUS_EQUAL(status, NT_STATUS_OBJECT_NAME_NOT_FOUND)) {
1153                                 printf("OpenSecret expected OBJECT_NAME_NOT_FOUND - %s\n", nt_errstr(status));
1154                                 ret = False;
1155                         }
1156                 }
1157
1158         }
1159
1160         return ret;
1161 }
1162
1163
1164 static BOOL test_EnumAccountRights(struct dcerpc_pipe *p,
1165                                    TALLOC_CTX *mem_ctx,
1166                                    struct policy_handle *acct_handle,
1167                                    struct dom_sid *sid)
1168 {
1169         NTSTATUS status;
1170         struct lsa_EnumAccountRights r;
1171         struct lsa_RightSet rights;
1172
1173         printf("Testing EnumAccountRights\n");
1174
1175         r.in.handle = acct_handle;
1176         r.in.sid = sid;
1177         r.out.rights = &rights;
1178
1179         status = dcerpc_lsa_EnumAccountRights(p, mem_ctx, &r);
1180         if (!NT_STATUS_IS_OK(status)) {
1181                 printf("EnumAccountRights failed - %s\n", nt_errstr(status));
1182                 return False;
1183         }
1184
1185         return True;
1186 }
1187
1188
1189 static BOOL test_QuerySecurity(struct dcerpc_pipe *p,
1190                              TALLOC_CTX *mem_ctx,
1191                              struct policy_handle *handle,
1192                              struct policy_handle *acct_handle)
1193 {
1194         NTSTATUS status;
1195         struct lsa_QuerySecurity r;
1196
1197         printf("Testing QuerySecurity\n");
1198
1199         r.in.handle = acct_handle;
1200         r.in.sec_info = 7;
1201
1202         status = dcerpc_lsa_QuerySecurity(p, mem_ctx, &r);
1203         if (!NT_STATUS_IS_OK(status)) {
1204                 printf("QuerySecurity failed - %s\n", nt_errstr(status));
1205                 return False;
1206         }
1207
1208         return True;
1209 }
1210
1211 static BOOL test_OpenAccount(struct dcerpc_pipe *p,
1212                              TALLOC_CTX *mem_ctx,
1213                              struct policy_handle *handle,
1214                              struct dom_sid *sid)
1215 {
1216         NTSTATUS status;
1217         struct lsa_OpenAccount r;
1218         struct policy_handle acct_handle;
1219
1220         printf("Testing OpenAccount\n");
1221
1222         r.in.handle = handle;
1223         r.in.sid = sid;
1224         r.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
1225         r.out.acct_handle = &acct_handle;
1226
1227         status = dcerpc_lsa_OpenAccount(p, mem_ctx, &r);
1228         if (!NT_STATUS_IS_OK(status)) {
1229                 printf("OpenAccount failed - %s\n", nt_errstr(status));
1230                 return False;
1231         }
1232
1233         if (!test_EnumPrivsAccount(p, mem_ctx, handle, &acct_handle)) {
1234                 return False;
1235         }
1236
1237         if (!test_QuerySecurity(p, mem_ctx, handle, &acct_handle)) {
1238                 return False;
1239         }
1240
1241         return True;
1242 }
1243
1244 static BOOL test_EnumAccounts(struct dcerpc_pipe *p,
1245                           TALLOC_CTX *mem_ctx,
1246                           struct policy_handle *handle)
1247 {
1248         NTSTATUS status;
1249         struct lsa_EnumAccounts r;
1250         struct lsa_SidArray sids1, sids2;
1251         uint32_t resume_handle = 0;
1252         int i;
1253
1254         printf("\ntesting EnumAccounts\n");
1255
1256         r.in.handle = handle;
1257         r.in.resume_handle = &resume_handle;
1258         r.in.num_entries = 100;
1259         r.out.resume_handle = &resume_handle;
1260         r.out.sids = &sids1;
1261
1262         resume_handle = 0;
1263         while (True) {
1264                 status = dcerpc_lsa_EnumAccounts(p, mem_ctx, &r);
1265                 if (NT_STATUS_EQUAL(status, NT_STATUS_NO_MORE_ENTRIES)) {
1266                         break;
1267                 }
1268                 if (!NT_STATUS_IS_OK(status)) {
1269                         printf("EnumAccounts failed - %s\n", nt_errstr(status));
1270                         return False;
1271                 }
1272
1273                 if (!test_LookupSids(p, mem_ctx, handle, &sids1)) {
1274                         return False;
1275                 }
1276
1277                 if (!test_LookupSids2(p, mem_ctx, handle, &sids1)) {
1278                         return False;
1279                 }
1280
1281                 if (!test_LookupSids3(p, mem_ctx, &sids1)) {
1282                         return False;
1283                 }
1284
1285                 printf("testing all accounts\n");
1286                 for (i=0;i<sids1.num_sids;i++) {
1287                         test_OpenAccount(p, mem_ctx, handle, sids1.sids[i].sid);
1288                         test_EnumAccountRights(p, mem_ctx, handle, sids1.sids[i].sid);
1289                 }
1290                 printf("\n");
1291         }
1292
1293         if (sids1.num_sids < 3) {
1294                 return True;
1295         }
1296
1297         printf("trying EnumAccounts partial listing (asking for 1 at 2)\n");
1298         resume_handle = 2;
1299         r.in.num_entries = 1;
1300         r.out.sids = &sids2;
1301
1302         status = dcerpc_lsa_EnumAccounts(p, mem_ctx, &r);
1303         if (!NT_STATUS_IS_OK(status)) {
1304                 printf("EnumAccounts failed - %s\n", nt_errstr(status));
1305                 return False;
1306         }
1307
1308         if (sids2.num_sids != 1) {
1309                 printf("Returned wrong number of entries (%d)\n", sids2.num_sids);
1310                 return False;
1311         }
1312
1313         return True;
1314 }
1315
1316 static BOOL test_LookupPrivDisplayName(struct dcerpc_pipe *p,
1317                                 TALLOC_CTX *mem_ctx,
1318                                 struct policy_handle *handle,
1319                                 struct lsa_String *priv_name)
1320 {
1321         struct lsa_LookupPrivDisplayName r;
1322         NTSTATUS status;
1323         /* produce a reasonable range of language output without screwing up
1324            terminals */
1325         uint16_t language_id = (random() % 4) + 0x409;
1326
1327         printf("testing LookupPrivDisplayName(%s)\n", priv_name->string);
1328
1329         r.in.handle = handle;
1330         r.in.name = priv_name;
1331         r.in.language_id = &language_id;
1332         r.out.language_id = &language_id;
1333         r.in.unknown = 0;
1334
1335         status = dcerpc_lsa_LookupPrivDisplayName(p, mem_ctx, &r);
1336         if (!NT_STATUS_IS_OK(status)) {
1337                 printf("LookupPrivDisplayName failed - %s\n", nt_errstr(status));
1338                 return False;
1339         }
1340         printf("%s -> \"%s\"  (language 0x%x/0x%x)\n",
1341                priv_name->string, r.out.disp_name->string,
1342                *r.in.language_id, *r.out.language_id);
1343
1344         return True;
1345 }
1346
1347 static BOOL test_EnumAccountsWithUserRight(struct dcerpc_pipe *p,
1348                                 TALLOC_CTX *mem_ctx,
1349                                 struct policy_handle *handle,
1350                                 struct lsa_String *priv_name)
1351 {
1352         struct lsa_EnumAccountsWithUserRight r;
1353         struct lsa_SidArray sids;
1354         NTSTATUS status;
1355
1356         ZERO_STRUCT(sids);
1357
1358         printf("testing EnumAccountsWithUserRight(%s)\n", priv_name->string);
1359
1360         r.in.handle = handle;
1361         r.in.name = priv_name;
1362         r.out.sids = &sids;
1363
1364         status = dcerpc_lsa_EnumAccountsWithUserRight(p, mem_ctx, &r);
1365
1366         /* NT_STATUS_NO_MORE_ENTRIES means noone has this privilege */
1367         if (NT_STATUS_EQUAL(status, NT_STATUS_NO_MORE_ENTRIES)) {
1368                 return True;
1369         }
1370
1371         if (!NT_STATUS_IS_OK(status)) {
1372                 printf("EnumAccountsWithUserRight failed - %s\n", nt_errstr(status));
1373                 return False;
1374         }
1375
1376         return True;
1377 }
1378
1379
1380 static BOOL test_EnumPrivs(struct dcerpc_pipe *p,
1381                            TALLOC_CTX *mem_ctx,
1382                            struct policy_handle *handle)
1383 {
1384         NTSTATUS status;
1385         struct lsa_EnumPrivs r;
1386         struct lsa_PrivArray privs1;
1387         uint32_t resume_handle = 0;
1388         int i;
1389         BOOL ret = True;
1390
1391         printf("\ntesting EnumPrivs\n");
1392
1393         r.in.handle = handle;
1394         r.in.resume_handle = &resume_handle;
1395         r.in.max_count = 100;
1396         r.out.resume_handle = &resume_handle;
1397         r.out.privs = &privs1;
1398
1399         resume_handle = 0;
1400         status = dcerpc_lsa_EnumPrivs(p, mem_ctx, &r);
1401         if (!NT_STATUS_IS_OK(status)) {
1402                 printf("EnumPrivs failed - %s\n", nt_errstr(status));
1403                 return False;
1404         }
1405
1406         for (i = 0; i< privs1.count; i++) {
1407                 test_LookupPrivDisplayName(p, mem_ctx, handle, (struct lsa_String *)&privs1.privs[i].name);
1408                 test_LookupPrivValue(p, mem_ctx, handle, (struct lsa_String *)&privs1.privs[i].name);
1409                 if (!test_EnumAccountsWithUserRight(p, mem_ctx, handle, (struct lsa_String *)&privs1.privs[i].name)) {
1410                         ret = False;
1411                 }
1412         }
1413
1414         return ret;
1415 }
1416
1417 static BOOL test_query_each_TrustDom(struct dcerpc_pipe *p,
1418                                      TALLOC_CTX *mem_ctx,
1419                                      struct policy_handle *handle,
1420                                      struct lsa_DomainList *domains)
1421 {
1422         NTSTATUS status;
1423         int i,j;
1424         BOOL ret = True;
1425
1426         printf("\nTesting OpenTrustedDomain, OpenTrustedDomainByName and QueryInfoTrustedDomain\n");
1427         for (i=0; i< domains->count; i++) {
1428                 struct lsa_OpenTrustedDomain trust;
1429                 struct lsa_OpenTrustedDomainByName trust_by_name;
1430                 struct policy_handle trustdom_handle;
1431                 struct policy_handle handle2;
1432                 struct lsa_Close c;
1433                 int levels [] = {1, 3, 6, 8, 12};
1434
1435                 if (domains->domains[i].sid) {
1436                         trust.in.handle = handle;
1437                         trust.in.sid = domains->domains[i].sid;
1438                         trust.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
1439                         trust.out.trustdom_handle = &trustdom_handle;
1440
1441                         status = dcerpc_lsa_OpenTrustedDomain(p, mem_ctx, &trust);
1442
1443                         if (!NT_STATUS_IS_OK(status)) {
1444                                 printf("OpenTrustedDomain failed - %s\n", nt_errstr(status));
1445                                 return False;
1446                         }
1447
1448                         c.in.handle = &trustdom_handle;
1449                         c.out.handle = &handle2;
1450
1451                         for (j=0; j < ARRAY_SIZE(levels); j++) {
1452                                 struct lsa_QueryTrustedDomainInfo q;
1453                                 union lsa_TrustedDomainInfo info;
1454                                 q.in.trustdom_handle = &trustdom_handle;
1455                                 q.in.level = levels[j];
1456                                 q.out.info = &info;
1457                                 status = dcerpc_lsa_QueryTrustedDomainInfo(p, mem_ctx, &q);
1458                                 if (!NT_STATUS_IS_OK(status)) {
1459                                         printf("QueryTrustedDomainInfo level %d failed - %s\n",
1460                                                levels[j], nt_errstr(status));
1461                                         ret = False;
1462                                 }
1463                         }
1464
1465                         status = dcerpc_lsa_Close(p, mem_ctx, &c);
1466                         if (!NT_STATUS_IS_OK(status)) {
1467                                 printf("Close of trusted domain failed - %s\n", nt_errstr(status));
1468                                 return False;
1469                         }
1470                 }
1471
1472                 trust_by_name.in.handle = handle;
1473                 trust_by_name.in.name.string = domains->domains[i].name.string;
1474                 trust_by_name.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
1475                 trust_by_name.out.trustdom_handle = &trustdom_handle;
1476
1477                 status = dcerpc_lsa_OpenTrustedDomainByName(p, mem_ctx, &trust_by_name);
1478
1479                 if (!NT_STATUS_IS_OK(status)) {
1480                         printf("OpenTrustedDomainByName failed - %s\n", nt_errstr(status));
1481                         return False;
1482                 }
1483
1484                 for (j=0; j < ARRAY_SIZE(levels); j++) {
1485                         struct lsa_QueryTrustedDomainInfo q;
1486                         union lsa_TrustedDomainInfo info;
1487                         q.in.trustdom_handle = &trustdom_handle;
1488                         q.in.level = levels[j];
1489                         q.out.info = &info;
1490                         status = dcerpc_lsa_QueryTrustedDomainInfo(p, mem_ctx, &q);
1491                         if (!NT_STATUS_IS_OK(status)) {
1492                                 printf("QueryTrustedDomainInfo level %d failed - %s\n",
1493                                        levels[j], nt_errstr(status));
1494                                 ret = False;
1495                         }
1496                 }
1497
1498                 c.in.handle = &trustdom_handle;
1499                 c.out.handle = &handle2;
1500
1501                 status = dcerpc_lsa_Close(p, mem_ctx, &c);
1502                 if (!NT_STATUS_IS_OK(status)) {
1503                         printf("Close of trusted domain failed - %s\n", nt_errstr(status));
1504                         return False;
1505                 }
1506
1507                 for (j=0; j < ARRAY_SIZE(levels); j++) {
1508                         struct lsa_QueryTrustedDomainInfoBySid q;
1509                         union lsa_TrustedDomainInfo info;
1510
1511                         if (!domains->domains[i].sid) {
1512                                 continue;
1513                         }
1514
1515                         q.in.handle  = handle;
1516                         q.in.dom_sid = domains->domains[i].sid;
1517                         q.in.level   = levels[j];
1518                         q.out.info   = &info;
1519                         status = dcerpc_lsa_QueryTrustedDomainInfoBySid(p, mem_ctx, &q);
1520                         if (!NT_STATUS_IS_OK(status)) {
1521                                 printf("QueryTrustedDomainInfoBySid level %d failed - %s\n",
1522                                        levels[j], nt_errstr(status));
1523                                 ret = False;
1524                         }
1525                 }
1526
1527                 for (j=0; j < ARRAY_SIZE(levels); j++) {
1528                         struct lsa_QueryTrustedDomainInfoByName q;
1529                         union lsa_TrustedDomainInfo info;
1530                         q.in.handle         = handle;
1531                         q.in.trusted_domain.string = domains->domains[i].name.string;
1532                         q.in.level          = levels[j];
1533                         q.out.info          = &info;
1534                         status = dcerpc_lsa_QueryTrustedDomainInfoByName(p, mem_ctx, &q);
1535                         if (!NT_STATUS_IS_OK(status)) {
1536                                 printf("QueryTrustedDomainInfoByName level %d failed - %s\n",
1537                                        levels[j], nt_errstr(status));
1538                                 ret = False;
1539                         }
1540                 }
1541         }
1542         return ret;
1543 }
1544
1545 static BOOL test_EnumTrustDom(struct dcerpc_pipe *p,
1546                               TALLOC_CTX *mem_ctx,
1547                               struct policy_handle *handle)
1548 {
1549         struct lsa_EnumTrustDom r;
1550         NTSTATUS enum_status;
1551         uint32_t resume_handle = 0;
1552         struct lsa_DomainList domains;
1553         BOOL ret = True;
1554
1555         printf("\nTesting EnumTrustDom\n");
1556
1557         do {
1558                 r.in.handle = handle;
1559                 r.in.resume_handle = &resume_handle;
1560                 r.in.max_size = LSA_ENUM_TRUST_DOMAIN_MULTIPLIER * 3;
1561                 r.out.domains = &domains;
1562                 r.out.resume_handle = &resume_handle;
1563
1564                 enum_status = dcerpc_lsa_EnumTrustDom(p, mem_ctx, &r);
1565
1566                 /* NO_MORE_ENTRIES is allowed */
1567                 if (NT_STATUS_EQUAL(enum_status, NT_STATUS_NO_MORE_ENTRIES)) {
1568                         return True;
1569                 } else if (NT_STATUS_EQUAL(enum_status, STATUS_MORE_ENTRIES)) {
1570                         /* Windows 2003 gets this off by one on the first run */
1571                         if (r.out.domains->count < 3 || r.out.domains->count > 4) {
1572                                 printf("EnumTrustDom didn't fill the buffer we "
1573                                        "asked it to (got %d, expected %d / %d == %d entries)\n",
1574                                        r.out.domains->count, LSA_ENUM_TRUST_DOMAIN_MULTIPLIER * 3,
1575                                        LSA_ENUM_TRUST_DOMAIN_MULTIPLIER, r.in.max_size);
1576                                 ret = False;
1577                         }
1578                 } else if (!NT_STATUS_IS_OK(enum_status)) {
1579                         printf("EnumTrustDom failed - %s\n", nt_errstr(enum_status));
1580                         return False;
1581                 }
1582
1583                 ret &= test_query_each_TrustDom(p, mem_ctx, handle, &domains);
1584
1585         } while ((NT_STATUS_EQUAL(enum_status, STATUS_MORE_ENTRIES)));
1586
1587         return ret;
1588 }
1589
1590 static BOOL test_CreateTrustedDomain(struct dcerpc_pipe *p,
1591                                      TALLOC_CTX *mem_ctx,
1592                                      struct policy_handle *handle)
1593 {
1594         NTSTATUS status;
1595         BOOL ret = True;
1596         struct lsa_CreateTrustedDomain r;
1597         struct lsa_TrustInformation trustinfo;
1598         struct dom_sid *domsid[12];
1599         struct policy_handle trustdom_handle[12];
1600         struct lsa_QueryTrustedDomainInfo q;
1601         int i;
1602
1603         printf("Testing CreateTrustedDomain for 12 domains\n");
1604
1605         for (i=0; i< 12; i++) {
1606                 char *trust_name = talloc_asprintf(mem_ctx, "torturedom%02d", i);
1607                 char *trust_sid = talloc_asprintf(mem_ctx, "S-1-5-21-97398-379795-100%02d", i);
1608
1609                 domsid[i] = dom_sid_parse_talloc(mem_ctx, trust_sid);
1610
1611                 trustinfo.sid = domsid[i];
1612                 init_lsa_String((struct lsa_String *)&trustinfo.name, trust_name);
1613
1614                 r.in.handle = handle;
1615                 r.in.info = &trustinfo;
1616                 r.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
1617                 r.out.trustdom_handle = &trustdom_handle[i];
1618
1619                 status = dcerpc_lsa_CreateTrustedDomain(p, mem_ctx, &r);
1620                 if (NT_STATUS_EQUAL(status, NT_STATUS_OBJECT_NAME_COLLISION)) {
1621                         test_DeleteTrustedDomain(p, mem_ctx, handle, trustinfo.name);
1622                         status = dcerpc_lsa_CreateTrustedDomain(p, mem_ctx, &r);
1623                 }
1624                 if (!NT_STATUS_IS_OK(status)) {
1625                         printf("CreateTrustedDomain failed - %s\n", nt_errstr(status));
1626                         ret = False;
1627                 } else {
1628
1629                         q.in.trustdom_handle = &trustdom_handle[i];
1630                         q.in.level = LSA_TRUSTED_DOMAIN_INFO_NAME;
1631                         status = dcerpc_lsa_QueryTrustedDomainInfo(p, mem_ctx, &q);
1632                         if (!NT_STATUS_IS_OK(status)) {
1633                                 printf("QueryTrustedDomainInfo level 1 failed - %s\n", nt_errstr(status));
1634                                 ret = False;
1635                         } else if (!q.out.info) {
1636                                 ret = False;
1637                         } else {
1638                                 if (strcmp(q.out.info->name.netbios_name.string, trustinfo.name.string) != 0) {
1639                                         printf("QueryTrustedDomainInfo returned inconsistant short name: %s != %s\n",
1640                                                q.out.info->name.netbios_name.string, trustinfo.name.string);
1641                                         ret = False;
1642                                 }
1643                         }
1644                 }
1645         }
1646
1647         /* now that we have some domains to look over, we can test the enum calls */
1648         if (!test_EnumTrustDom(p, mem_ctx, handle)) {
1649                 ret = False;
1650         }
1651
1652         for (i=0; i<12; i++) {
1653                 if (!test_Delete(p, mem_ctx, &trustdom_handle[i])) {
1654                         ret = False;
1655                 }
1656         }
1657
1658         return ret;
1659 }
1660
1661 static BOOL test_QueryDomainInfoPolicy(struct dcerpc_pipe *p,
1662                                  TALLOC_CTX *mem_ctx,
1663                                  struct policy_handle *handle)
1664 {
1665         struct lsa_QueryDomainInformationPolicy r;
1666         NTSTATUS status;
1667         int i;
1668         BOOL ret = True;
1669         printf("\nTesting QueryDomainInformationPolicy\n");
1670
1671         for (i=2;i<4;i++) {
1672                 r.in.handle = handle;
1673                 r.in.level = i;
1674
1675                 printf("\ntrying QueryDomainInformationPolicy level %d\n", i);
1676
1677                 status = dcerpc_lsa_QueryDomainInformationPolicy(p, mem_ctx, &r);
1678
1679                 if (!NT_STATUS_IS_OK(status)) {
1680                         printf("QueryDomainInformationPolicy failed - %s\n", nt_errstr(status));
1681                         ret = False;
1682                         continue;
1683                 }
1684         }
1685
1686         return ret;
1687 }
1688
1689
1690 static BOOL test_QueryInfoPolicy(struct dcerpc_pipe *p,
1691                                  TALLOC_CTX *mem_ctx,
1692                                  struct policy_handle *handle)
1693 {
1694         struct lsa_QueryInfoPolicy r;
1695         NTSTATUS status;
1696         int i;
1697         BOOL ret = True;
1698         printf("\nTesting QueryInfoPolicy\n");
1699
1700         for (i=1;i<13;i++) {
1701                 r.in.handle = handle;
1702                 r.in.level = i;
1703
1704                 printf("\ntrying QueryInfoPolicy level %d\n", i);
1705
1706                 status = dcerpc_lsa_QueryInfoPolicy(p, mem_ctx, &r);
1707
1708                 if ((i == 9 || i == 10 || i == 11) &&
1709                     NT_STATUS_EQUAL(status, NT_STATUS_INVALID_PARAMETER)) {
1710                         printf("server failed level %u (OK)\n", i);
1711                         continue;
1712                 }
1713
1714                 if (!NT_STATUS_IS_OK(status)) {
1715                         printf("QueryInfoPolicy failed - %s\n", nt_errstr(status));
1716                         ret = False;
1717                         continue;
1718                 }
1719         }
1720
1721         return ret;
1722 }
1723
1724 static BOOL test_QueryInfoPolicy2(struct dcerpc_pipe *p,
1725                                   TALLOC_CTX *mem_ctx,
1726                                   struct policy_handle *handle)
1727 {
1728         struct lsa_QueryInfoPolicy2 r;
1729         NTSTATUS status;
1730         int i;
1731         BOOL ret = True;
1732         printf("\nTesting QueryInfoPolicy2\n");
1733
1734         for (i=1;i<13;i++) {
1735                 r.in.handle = handle;
1736                 r.in.level = i;
1737
1738                 printf("\ntrying QueryInfoPolicy2 level %d\n", i);
1739
1740                 status = dcerpc_lsa_QueryInfoPolicy2(p, mem_ctx, &r);
1741
1742                 if ((i == 9 || i == 10 || i == 11) &&
1743                     NT_STATUS_EQUAL(status, NT_STATUS_INVALID_PARAMETER)) {
1744                         printf("server failed level %u (OK)\n", i);
1745                         continue;
1746                 }
1747
1748                 if (!NT_STATUS_IS_OK(status)) {
1749                         printf("QueryInfoPolicy2 failed - %s\n", nt_errstr(status));
1750                         ret = False;
1751                         continue;
1752                 }
1753         }
1754
1755         return ret;
1756 }
1757
1758 static BOOL test_GetUserName(struct dcerpc_pipe *p,
1759                                   TALLOC_CTX *mem_ctx,
1760                                   struct policy_handle *handle)
1761 {
1762         struct lsa_GetUserName r;
1763         NTSTATUS status;
1764         BOOL ret = True;
1765         struct lsa_StringPointer authority_name_p;
1766
1767         printf("\nTesting GetUserName\n");
1768
1769         r.in.system_name = "\\";
1770         r.in.account_name = NULL;
1771         r.in.authority_name = &authority_name_p;
1772         authority_name_p.string = NULL;
1773
1774         status = dcerpc_lsa_GetUserName(p, mem_ctx, &r);
1775
1776         if (!NT_STATUS_IS_OK(status)) {
1777                 printf("GetUserName failed - %s\n", nt_errstr(status));
1778                 ret = False;
1779         }
1780
1781         return ret;
1782 }
1783
1784 BOOL test_lsa_Close(struct dcerpc_pipe *p,
1785                     TALLOC_CTX *mem_ctx,
1786                     struct policy_handle *handle)
1787 {
1788         NTSTATUS status;
1789         struct lsa_Close r;
1790         struct policy_handle handle2;
1791
1792         printf("\ntesting Close\n");
1793
1794         r.in.handle = handle;
1795         r.out.handle = &handle2;
1796
1797         status = dcerpc_lsa_Close(p, mem_ctx, &r);
1798         if (!NT_STATUS_IS_OK(status)) {
1799                 printf("Close failed - %s\n", nt_errstr(status));
1800                 return False;
1801         }
1802
1803         status = dcerpc_lsa_Close(p, mem_ctx, &r);
1804         /* its really a fault - we need a status code for rpc fault */
1805         if (!NT_STATUS_EQUAL(status, NT_STATUS_NET_WRITE_FAULT)) {
1806                 printf("Close failed - %s\n", nt_errstr(status));
1807                 return False;
1808         }
1809
1810         printf("\n");
1811
1812         return True;
1813 }
1814
1815 BOOL torture_rpc_lsa(void)
1816 {
1817         NTSTATUS status;
1818         struct dcerpc_pipe *p;
1819         TALLOC_CTX *mem_ctx;
1820         BOOL ret = True;
1821         struct policy_handle *handle;
1822
1823         mem_ctx = talloc_init("torture_rpc_lsa");
1824
1825         status = torture_rpc_connection(mem_ctx, &p, &dcerpc_table_lsarpc);
1826         if (!NT_STATUS_IS_OK(status)) {
1827                 talloc_free(mem_ctx);
1828                 return False;
1829         }
1830
1831         if (!test_OpenPolicy(p, mem_ctx)) {
1832                 ret = False;
1833         }
1834
1835         if (!test_lsa_OpenPolicy2(p, mem_ctx, &handle)) {
1836                 ret = False;
1837         }
1838
1839         if (handle) {
1840                 if (!test_LookupSids_async(p, mem_ctx, handle)) {
1841                         ret = False;
1842                 }
1843
1844                 if (!test_QueryDomainInfoPolicy(p, mem_ctx, handle)) {
1845                         ret = False;
1846                 }
1847
1848                 if (!test_CreateAccount(p, mem_ctx, handle)) {
1849                         ret = False;
1850                 }
1851
1852                 if (!test_CreateSecret(p, mem_ctx, handle)) {
1853                         ret = False;
1854                 }
1855
1856                 if (!test_CreateTrustedDomain(p, mem_ctx, handle)) {
1857                         ret = False;
1858                 }
1859
1860                 if (!test_EnumAccounts(p, mem_ctx, handle)) {
1861                         ret = False;
1862                 }
1863
1864                 if (!test_EnumPrivs(p, mem_ctx, handle)) {
1865                         ret = False;
1866                 }
1867
1868                 if (!test_QueryInfoPolicy(p, mem_ctx, handle)) {
1869                         ret = False;
1870                 }
1871
1872                 if (!test_QueryInfoPolicy2(p, mem_ctx, handle)) {
1873                         ret = False;
1874                 }
1875
1876                 if (!test_GetUserName(p, mem_ctx, handle)) {
1877                         ret = False;
1878                 }
1879
1880 #if 0
1881                 if (!test_Delete(p, mem_ctx, handle)) {
1882                         ret = False;
1883                 }
1884 #endif
1885
1886                 if (!test_many_LookupSids(p, mem_ctx, handle)) {
1887                         ret = False;
1888                 }
1889
1890                 if (!test_lsa_Close(p, mem_ctx, handle)) {
1891                         ret = False;
1892                 }
1893         } else {
1894                 if (!test_many_LookupSids(p, mem_ctx, handle)) {
1895                         ret = False;
1896                 }
1897         }
1898
1899         talloc_free(mem_ctx);
1900
1901         return ret;
1902 }