From a8feb556318049ee0da2db372bbc58cb5bdc63e4 Mon Sep 17 00:00:00 2001
From: Stefan Metzmacher <metze@samba.org>
Date: Wed, 12 Dec 2018 13:43:45 +0100
Subject: [PATCH] py:dcerpc/raw_protocol: add test_assoc_group_fail3()

This demonstrates that assoc groups are only shared on the
same transport (endpoint).

BUG: https://bugzilla.samba.org/show_bug.cgi?id=7113
BUG: https://bugzilla.samba.org/show_bug.cgi?id=11892

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
---
 python/samba/tests/dcerpc/raw_protocol.py   | 45 +++++++++++++++++++++
 selftest/knownfail.d/test_assoc_group_fail3 |  1 +
 2 files changed, 46 insertions(+)
 create mode 100644 selftest/knownfail.d/test_assoc_group_fail3

diff --git a/python/samba/tests/dcerpc/raw_protocol.py b/python/samba/tests/dcerpc/raw_protocol.py
index 60e753c2d4e..f5895078645 100755
--- a/python/samba/tests/dcerpc/raw_protocol.py
+++ b/python/samba/tests/dcerpc/raw_protocol.py
@@ -5015,6 +5015,51 @@ class TestDCERPC_BIND(RawDCERPCTest):
         conn2._disconnect("End of Test")
         return
 
+    def test_assoc_group_fail3(self):
+        abstract = samba.dcerpc.mgmt.abstract_syntax()
+        transfer = base.transfer_syntax_ndr()
+
+        (ctx1, ack1) = self.prepare_presentation(abstract, transfer,
+                                                 context_id=1, return_ack=True)
+
+        # assoc groups are per transport
+        connF = self.second_connection(primary_address="\\pipe\\lsass",
+                                       transport_creds=self.get_user_creds())
+        tsfF_list = [transfer]
+        ctxF = samba.dcerpc.dcerpc.ctx_list()
+        ctxF.context_id = 0xF
+        ctxF.num_transfer_syntaxes = len(tsfF_list)
+        ctxF.abstract_syntax = abstract
+        ctxF.transfer_syntaxes = tsfF_list
+        ack = connF.do_generic_bind(ctx=ctxF, assoc_group_id=ack1.u.assoc_group_id,
+                                    nak_reason=dcerpc.DCERPC_BIND_NAK_REASON_NOT_SPECIFIED)
+        # wait for a disconnect
+        rep = connF.recv_pdu()
+        self.assertIsNone(rep)
+        connF.assertNotConnected()
+
+        conn2 = self.second_connection()
+        (ctx2, ack2) = conn2.prepare_presentation(abstract, transfer,
+                                                  assoc_group_id=ack1.u.assoc_group_id,
+                                                  context_id=2, return_ack=True)
+
+        inq_if_ids = samba.dcerpc.mgmt.inq_if_ids()
+        self.do_single_request(call_id=1, ctx=ctx1, io=inq_if_ids)
+        conn2.do_single_request(call_id=1, ctx=ctx2, io=inq_if_ids)
+
+        conn2.do_single_request(call_id=1, ctx=ctx1, io=inq_if_ids,
+                                fault_pfc_flags=(
+                                    samba.dcerpc.dcerpc.DCERPC_PFC_FLAG_FIRST |
+                                    samba.dcerpc.dcerpc.DCERPC_PFC_FLAG_LAST |
+                                    samba.dcerpc.dcerpc.DCERPC_PFC_FLAG_DID_NOT_EXECUTE),
+                                fault_status=dcerpc.DCERPC_NCA_S_UNKNOWN_IF,
+                                fault_context_id=0)
+
+        self.do_single_request(call_id=1, ctx=ctx1, io=inq_if_ids)
+        conn2.do_single_request(call_id=1, ctx=ctx2, io=inq_if_ids)
+        conn2._disconnect("End of Test")
+        return
+
     def _test_krb5_hdr_sign_delayed1(self, do_upgrade):
         auth_type = dcerpc.DCERPC_AUTH_TYPE_KRB5
         auth_level = dcerpc.DCERPC_AUTH_LEVEL_INTEGRITY
diff --git a/selftest/knownfail.d/test_assoc_group_fail3 b/selftest/knownfail.d/test_assoc_group_fail3
new file mode 100644
index 00000000000..037f2b7c7a5
--- /dev/null
+++ b/selftest/knownfail.d/test_assoc_group_fail3
@@ -0,0 +1 @@
+^samba.tests.dcerpc.raw_protocol.*.TestDCERPC_BIND.test_assoc_group_fail3