mirror of
https://github.com/samba-team/samba.git
synced 2024-12-27 03:21:53 +03:00
63f649f860
Against ad_dc we get NT_STATUS_OK, but against nt_dc we get NT_STATUS_NO_SUCH_PRIVILEGE, so check for both. We can't use TARGET_IS_SAMBA3() here as this is set for talking to smbd even when run under the ad_dc. Signed-off-by: Jeremy Allison <jra@samba.org> Reviewed-by: Volker Lendecke <vl@samba.org>
8868 lines
266 KiB
C
8868 lines
266 KiB
C
/*
|
|
Unix SMB/CIFS implementation.
|
|
test suite for samr rpc operations
|
|
|
|
Copyright (C) Andrew Tridgell 2003
|
|
Copyright (C) Andrew Bartlett <abartlet@samba.org> 2003
|
|
Copyright (C) Jelmer Vernooij 2005-2007
|
|
Copyright (C) Guenther Deschner 2008-2010
|
|
|
|
This program is free software; you can redistribute it and/or modify
|
|
it under the terms of the GNU General Public License as published by
|
|
the Free Software Foundation; either version 3 of the License, or
|
|
(at your option) any later version.
|
|
|
|
This program is distributed in the hope that it will be useful,
|
|
but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
GNU General Public License for more details.
|
|
|
|
You should have received a copy of the GNU General Public License
|
|
along with this program. If not, see <http://www.gnu.org/licenses/>.
|
|
*/
|
|
|
|
#include "includes.h"
|
|
#include "torture/torture.h"
|
|
#include <tevent.h>
|
|
#include "system/time.h"
|
|
#include "system/network.h"
|
|
#include "librpc/gen_ndr/lsa.h"
|
|
#include "librpc/gen_ndr/ndr_netlogon.h"
|
|
#include "librpc/gen_ndr/ndr_netlogon_c.h"
|
|
#include "librpc/gen_ndr/ndr_samr_c.h"
|
|
#include "librpc/gen_ndr/ndr_lsa_c.h"
|
|
#include "../lib/crypto/crypto.h"
|
|
#include "libcli/auth/libcli_auth.h"
|
|
#include "libcli/security/security.h"
|
|
#include "torture/rpc/torture_rpc.h"
|
|
#include "param/param.h"
|
|
#include "auth/gensec/gensec.h"
|
|
#include "auth/gensec/gensec_proto.h"
|
|
#include "../libcli/auth/schannel.h"
|
|
#include "torture/util.h"
|
|
|
|
#define TEST_ACCOUNT_NAME "samrtorturetest"
|
|
#define TEST_ACCOUNT_NAME_PWD "samrpwdlastset"
|
|
#define TEST_ALIASNAME "samrtorturetestalias"
|
|
#define TEST_GROUPNAME "samrtorturetestgroup"
|
|
#define TEST_MACHINENAME "samrtestmach$"
|
|
#define TEST_DOMAINNAME "samrtestdom$"
|
|
|
|
enum torture_samr_choice {
|
|
TORTURE_SAMR_PASSWORDS,
|
|
TORTURE_SAMR_PASSWORDS_PWDLASTSET,
|
|
TORTURE_SAMR_PASSWORDS_BADPWDCOUNT,
|
|
TORTURE_SAMR_PASSWORDS_LOCKOUT,
|
|
TORTURE_SAMR_USER_ATTRIBUTES,
|
|
TORTURE_SAMR_USER_PRIVILEGES,
|
|
TORTURE_SAMR_OTHER,
|
|
TORTURE_SAMR_MANY_ACCOUNTS,
|
|
TORTURE_SAMR_MANY_GROUPS,
|
|
TORTURE_SAMR_MANY_ALIASES
|
|
};
|
|
|
|
struct torture_samr_context {
|
|
struct policy_handle handle;
|
|
struct cli_credentials *machine_credentials;
|
|
enum torture_samr_choice choice;
|
|
uint32_t num_objects_large_dc;
|
|
};
|
|
|
|
static bool test_QueryUserInfo(struct dcerpc_binding_handle *b,
|
|
struct torture_context *tctx,
|
|
struct policy_handle *handle);
|
|
|
|
static bool test_QueryUserInfo2(struct dcerpc_binding_handle *b,
|
|
struct torture_context *tctx,
|
|
struct policy_handle *handle);
|
|
|
|
static bool test_QueryAliasInfo(struct dcerpc_binding_handle *b,
|
|
struct torture_context *tctx,
|
|
struct policy_handle *handle);
|
|
|
|
static bool test_ChangePassword(struct dcerpc_pipe *p,
|
|
struct torture_context *tctx,
|
|
const char *acct_name,
|
|
struct policy_handle *domain_handle, char **password);
|
|
|
|
static void init_lsa_String(struct lsa_String *string, const char *s)
|
|
{
|
|
string->string = s;
|
|
}
|
|
|
|
static void init_lsa_StringLarge(struct lsa_StringLarge *string, const char *s)
|
|
{
|
|
string->string = s;
|
|
}
|
|
|
|
static void init_lsa_BinaryString(struct lsa_BinaryString *string, const char *s, uint32_t length)
|
|
{
|
|
string->length = length;
|
|
string->size = length;
|
|
string->array = (uint16_t *)discard_const(s);
|
|
}
|
|
|
|
bool test_samr_handle_Close(struct dcerpc_binding_handle *b,
|
|
struct torture_context *tctx,
|
|
struct policy_handle *handle)
|
|
{
|
|
struct samr_Close r;
|
|
|
|
r.in.handle = handle;
|
|
r.out.handle = handle;
|
|
|
|
torture_assert_ntstatus_ok(tctx, dcerpc_samr_Close_r(b, tctx, &r),
|
|
"Close failed");
|
|
torture_assert_ntstatus_ok(tctx, r.out.result, "Close failed");
|
|
|
|
return true;
|
|
}
|
|
|
|
static bool test_Shutdown(struct dcerpc_binding_handle *b,
|
|
struct torture_context *tctx,
|
|
struct policy_handle *handle)
|
|
{
|
|
struct samr_Shutdown r;
|
|
|
|
if (!torture_setting_bool(tctx, "dangerous", false)) {
|
|
torture_skip(tctx, "samr_Shutdown disabled - enable dangerous tests to use\n");
|
|
return true;
|
|
}
|
|
|
|
r.in.connect_handle = handle;
|
|
|
|
torture_comment(tctx, "Testing samr_Shutdown\n");
|
|
|
|
torture_assert_ntstatus_ok(tctx, dcerpc_samr_Shutdown_r(b, tctx, &r),
|
|
"Shutdown failed");
|
|
torture_assert_ntstatus_ok(tctx, r.out.result, "Shutdown failed");
|
|
|
|
return true;
|
|
}
|
|
|
|
static bool test_SetDsrmPassword(struct dcerpc_binding_handle *b,
|
|
struct torture_context *tctx,
|
|
struct policy_handle *handle)
|
|
{
|
|
struct samr_SetDsrmPassword r;
|
|
struct lsa_String string;
|
|
struct samr_Password hash;
|
|
|
|
if (!torture_setting_bool(tctx, "dangerous", false)) {
|
|
torture_skip(tctx, "samr_SetDsrmPassword disabled - enable dangerous tests to use");
|
|
}
|
|
|
|
E_md4hash("TeSTDSRM123", hash.hash);
|
|
|
|
init_lsa_String(&string, "Administrator");
|
|
|
|
r.in.name = &string;
|
|
r.in.unknown = 0;
|
|
r.in.hash = &hash;
|
|
|
|
torture_comment(tctx, "Testing samr_SetDsrmPassword\n");
|
|
|
|
torture_assert_ntstatus_ok(tctx, dcerpc_samr_SetDsrmPassword_r(b, tctx, &r),
|
|
"SetDsrmPassword failed");
|
|
torture_assert_ntstatus_equal(tctx, r.out.result, NT_STATUS_NOT_SUPPORTED, "SetDsrmPassword failed");
|
|
|
|
return true;
|
|
}
|
|
|
|
|
|
static bool test_QuerySecurity(struct dcerpc_binding_handle *b,
|
|
struct torture_context *tctx,
|
|
struct policy_handle *handle)
|
|
{
|
|
struct samr_QuerySecurity r;
|
|
struct samr_SetSecurity s;
|
|
struct sec_desc_buf *sdbuf = NULL;
|
|
|
|
r.in.handle = handle;
|
|
r.in.sec_info = 7;
|
|
r.out.sdbuf = &sdbuf;
|
|
|
|
torture_assert_ntstatus_ok(tctx, dcerpc_samr_QuerySecurity_r(b, tctx, &r),
|
|
"QuerySecurity failed");
|
|
torture_assert_ntstatus_ok(tctx, r.out.result, "QuerySecurity failed");
|
|
|
|
torture_assert(tctx, sdbuf != NULL, "sdbuf is NULL");
|
|
|
|
s.in.handle = handle;
|
|
s.in.sec_info = 7;
|
|
s.in.sdbuf = sdbuf;
|
|
|
|
if (torture_setting_bool(tctx, "samba4", false)) {
|
|
torture_skip(tctx, "skipping SetSecurity test against Samba4\n");
|
|
}
|
|
|
|
torture_assert_ntstatus_ok(tctx, dcerpc_samr_SetSecurity_r(b, tctx, &s),
|
|
"SetSecurity failed");
|
|
torture_assert_ntstatus_ok(tctx, r.out.result, "SetSecurity failed");
|
|
|
|
torture_assert_ntstatus_ok(tctx, dcerpc_samr_QuerySecurity_r(b, tctx, &r),
|
|
"QuerySecurity failed");
|
|
torture_assert_ntstatus_ok(tctx, r.out.result, "QuerySecurity failed");
|
|
|
|
return true;
|
|
}
|
|
|
|
|
|
static bool test_SetUserInfo(struct dcerpc_binding_handle *b, struct torture_context *tctx,
|
|
struct policy_handle *handle, uint32_t base_acct_flags,
|
|
const char *base_account_name)
|
|
{
|
|
struct samr_SetUserInfo s;
|
|
struct samr_SetUserInfo2 s2;
|
|
struct samr_QueryUserInfo q;
|
|
struct samr_QueryUserInfo q0;
|
|
union samr_UserInfo u;
|
|
union samr_UserInfo *info;
|
|
bool ret = true;
|
|
const char *test_account_name;
|
|
|
|
uint32_t user_extra_flags = 0;
|
|
|
|
if (!torture_setting_bool(tctx, "samba3", false)) {
|
|
if (base_acct_flags == ACB_NORMAL) {
|
|
/* When created, accounts are expired by default */
|
|
user_extra_flags = ACB_PW_EXPIRED;
|
|
}
|
|
}
|
|
|
|
s.in.user_handle = handle;
|
|
s.in.info = &u;
|
|
|
|
s2.in.user_handle = handle;
|
|
s2.in.info = &u;
|
|
|
|
q.in.user_handle = handle;
|
|
q.out.info = &info;
|
|
q0 = q;
|
|
|
|
#define TESTCALL(call, r) \
|
|
torture_assert_ntstatus_ok(tctx, dcerpc_samr_ ##call## _r(b, tctx, &r),\
|
|
#call " failed"); \
|
|
if (!NT_STATUS_IS_OK(r.out.result)) { \
|
|
torture_result(tctx, TORTURE_FAIL, #call " level %u failed - %s (%s)\n", \
|
|
r.in.level, nt_errstr(r.out.result), __location__); \
|
|
ret = false; \
|
|
break; \
|
|
}
|
|
|
|
#define STRING_EQUAL(s1, s2, field) \
|
|
torture_assert_str_equal(tctx, s1, s2, "Failed to set " #field)
|
|
|
|
#define MEM_EQUAL(s1, s2, length, field) \
|
|
torture_assert_mem_equal(tctx, s1, s2, length, "Failed to set " #field)
|
|
|
|
#define INT_EQUAL(i1, i2, field) \
|
|
torture_assert_int_equal(tctx, i1, i2, "Failed to set " #field)
|
|
|
|
#define TEST_USERINFO_STRING(lvl1, field1, lvl2, field2, value, fpval) do { \
|
|
torture_comment(tctx, "field test %d/%s vs %d/%s\n", lvl1, #field1, lvl2, #field2); \
|
|
q.in.level = lvl1; \
|
|
TESTCALL(QueryUserInfo, q) \
|
|
s.in.level = lvl1; \
|
|
s2.in.level = lvl1; \
|
|
u = *info; \
|
|
if (lvl1 == 21) { \
|
|
ZERO_STRUCT(u.info21); \
|
|
u.info21.fields_present = fpval; \
|
|
} \
|
|
init_lsa_String(&u.info ## lvl1.field1, value); \
|
|
TESTCALL(SetUserInfo, s) \
|
|
TESTCALL(SetUserInfo2, s2) \
|
|
init_lsa_String(&u.info ## lvl1.field1, ""); \
|
|
TESTCALL(QueryUserInfo, q); \
|
|
u = *info; \
|
|
STRING_EQUAL(u.info ## lvl1.field1.string, value, field1); \
|
|
q.in.level = lvl2; \
|
|
TESTCALL(QueryUserInfo, q) \
|
|
u = *info; \
|
|
STRING_EQUAL(u.info ## lvl2.field2.string, value, field2); \
|
|
} while (0)
|
|
|
|
#define TEST_USERINFO_BINARYSTRING(lvl1, field1, lvl2, field2, value, fpval) do { \
|
|
torture_comment(tctx, "field test %d/%s vs %d/%s\n", lvl1, #field1, lvl2, #field2); \
|
|
q.in.level = lvl1; \
|
|
TESTCALL(QueryUserInfo, q) \
|
|
s.in.level = lvl1; \
|
|
s2.in.level = lvl1; \
|
|
u = *info; \
|
|
if (lvl1 == 21) { \
|
|
ZERO_STRUCT(u.info21); \
|
|
u.info21.fields_present = fpval; \
|
|
} \
|
|
init_lsa_BinaryString(&u.info ## lvl1.field1, value, strlen(value)); \
|
|
TESTCALL(SetUserInfo, s) \
|
|
TESTCALL(SetUserInfo2, s2) \
|
|
init_lsa_BinaryString(&u.info ## lvl1.field1, "", 1); \
|
|
TESTCALL(QueryUserInfo, q); \
|
|
u = *info; \
|
|
MEM_EQUAL(u.info ## lvl1.field1.array, value, strlen(value), field1); \
|
|
q.in.level = lvl2; \
|
|
TESTCALL(QueryUserInfo, q) \
|
|
u = *info; \
|
|
MEM_EQUAL(u.info ## lvl2.field2.array, value, strlen(value), field2); \
|
|
} while (0)
|
|
|
|
#define TEST_USERINFO_INT_EXP(lvl1, field1, lvl2, field2, value, exp_value, fpval) do { \
|
|
torture_comment(tctx, "field test %d/%s vs %d/%s\n", lvl1, #field1, lvl2, #field2); \
|
|
q.in.level = lvl1; \
|
|
TESTCALL(QueryUserInfo, q) \
|
|
s.in.level = lvl1; \
|
|
s2.in.level = lvl1; \
|
|
u = *info; \
|
|
if (lvl1 == 21) { \
|
|
uint8_t *bits = u.info21.logon_hours.bits; \
|
|
ZERO_STRUCT(u.info21); \
|
|
if (fpval == SAMR_FIELD_LOGON_HOURS) { \
|
|
u.info21.logon_hours.units_per_week = 168; \
|
|
u.info21.logon_hours.bits = bits; \
|
|
} \
|
|
u.info21.fields_present = fpval; \
|
|
} \
|
|
u.info ## lvl1.field1 = value; \
|
|
TESTCALL(SetUserInfo, s) \
|
|
TESTCALL(SetUserInfo2, s2) \
|
|
u.info ## lvl1.field1 = 0; \
|
|
TESTCALL(QueryUserInfo, q); \
|
|
u = *info; \
|
|
INT_EQUAL(u.info ## lvl1.field1, exp_value, field1); \
|
|
q.in.level = lvl2; \
|
|
TESTCALL(QueryUserInfo, q) \
|
|
u = *info; \
|
|
INT_EQUAL(u.info ## lvl2.field2, exp_value, field1); \
|
|
} while (0)
|
|
|
|
#define TEST_USERINFO_INT(lvl1, field1, lvl2, field2, value, fpval) do { \
|
|
TEST_USERINFO_INT_EXP(lvl1, field1, lvl2, field2, value, value, fpval); \
|
|
} while (0)
|
|
|
|
q0.in.level = 12;
|
|
do { TESTCALL(QueryUserInfo, q0) } while (0);
|
|
|
|
TEST_USERINFO_STRING(2, comment, 1, comment, "xx2-1 comment", 0);
|
|
TEST_USERINFO_STRING(2, comment, 21, comment, "xx2-21 comment", 0);
|
|
TEST_USERINFO_STRING(21, comment, 21, comment, "xx21-21 comment",
|
|
SAMR_FIELD_COMMENT);
|
|
|
|
test_account_name = talloc_asprintf(tctx, "%sxx7-1", base_account_name);
|
|
TEST_USERINFO_STRING(7, account_name, 1, account_name, test_account_name, 0);
|
|
test_account_name = talloc_asprintf(tctx, "%sxx7-3", base_account_name);
|
|
TEST_USERINFO_STRING(7, account_name, 3, account_name, test_account_name, 0);
|
|
test_account_name = talloc_asprintf(tctx, "%sxx7-5", base_account_name);
|
|
TEST_USERINFO_STRING(7, account_name, 5, account_name, test_account_name, 0);
|
|
test_account_name = talloc_asprintf(tctx, "%sxx7-6", base_account_name);
|
|
TEST_USERINFO_STRING(7, account_name, 6, account_name, test_account_name, 0);
|
|
test_account_name = talloc_asprintf(tctx, "%sxx7-7", base_account_name);
|
|
TEST_USERINFO_STRING(7, account_name, 7, account_name, test_account_name, 0);
|
|
test_account_name = talloc_asprintf(tctx, "%sxx7-21", base_account_name);
|
|
TEST_USERINFO_STRING(7, account_name, 21, account_name, test_account_name, 0);
|
|
test_account_name = base_account_name;
|
|
TEST_USERINFO_STRING(21, account_name, 21, account_name, test_account_name,
|
|
SAMR_FIELD_ACCOUNT_NAME);
|
|
|
|
TEST_USERINFO_STRING(6, full_name, 1, full_name, "xx6-1 full_name", 0);
|
|
TEST_USERINFO_STRING(6, full_name, 3, full_name, "xx6-3 full_name", 0);
|
|
TEST_USERINFO_STRING(6, full_name, 5, full_name, "xx6-5 full_name", 0);
|
|
TEST_USERINFO_STRING(6, full_name, 6, full_name, "xx6-6 full_name", 0);
|
|
TEST_USERINFO_STRING(6, full_name, 8, full_name, "xx6-8 full_name", 0);
|
|
TEST_USERINFO_STRING(6, full_name, 21, full_name, "xx6-21 full_name", 0);
|
|
TEST_USERINFO_STRING(8, full_name, 21, full_name, "xx8-21 full_name", 0);
|
|
TEST_USERINFO_STRING(21, full_name, 21, full_name, "xx21-21 full_name",
|
|
SAMR_FIELD_FULL_NAME);
|
|
|
|
TEST_USERINFO_STRING(6, full_name, 1, full_name, "", 0);
|
|
TEST_USERINFO_STRING(6, full_name, 3, full_name, "", 0);
|
|
TEST_USERINFO_STRING(6, full_name, 5, full_name, "", 0);
|
|
TEST_USERINFO_STRING(6, full_name, 6, full_name, "", 0);
|
|
TEST_USERINFO_STRING(6, full_name, 8, full_name, "", 0);
|
|
TEST_USERINFO_STRING(6, full_name, 21, full_name, "", 0);
|
|
TEST_USERINFO_STRING(8, full_name, 21, full_name, "", 0);
|
|
TEST_USERINFO_STRING(21, full_name, 21, full_name, "",
|
|
SAMR_FIELD_FULL_NAME);
|
|
|
|
TEST_USERINFO_STRING(11, logon_script, 3, logon_script, "xx11-3 logon_script", 0);
|
|
TEST_USERINFO_STRING(11, logon_script, 5, logon_script, "xx11-5 logon_script", 0);
|
|
TEST_USERINFO_STRING(11, logon_script, 21, logon_script, "xx11-21 logon_script", 0);
|
|
TEST_USERINFO_STRING(21, logon_script, 21, logon_script, "xx21-21 logon_script",
|
|
SAMR_FIELD_LOGON_SCRIPT);
|
|
|
|
TEST_USERINFO_STRING(12, profile_path, 3, profile_path, "xx12-3 profile_path", 0);
|
|
TEST_USERINFO_STRING(12, profile_path, 5, profile_path, "xx12-5 profile_path", 0);
|
|
TEST_USERINFO_STRING(12, profile_path, 21, profile_path, "xx12-21 profile_path", 0);
|
|
TEST_USERINFO_STRING(21, profile_path, 21, profile_path, "xx21-21 profile_path",
|
|
SAMR_FIELD_PROFILE_PATH);
|
|
|
|
TEST_USERINFO_STRING(10, home_directory, 3, home_directory, "xx10-3 home_directory", 0);
|
|
TEST_USERINFO_STRING(10, home_directory, 5, home_directory, "xx10-5 home_directory", 0);
|
|
TEST_USERINFO_STRING(10, home_directory, 21, home_directory, "xx10-21 home_directory", 0);
|
|
TEST_USERINFO_STRING(21, home_directory, 21, home_directory, "xx21-21 home_directory",
|
|
SAMR_FIELD_HOME_DIRECTORY);
|
|
TEST_USERINFO_STRING(21, home_directory, 10, home_directory, "xx21-10 home_directory",
|
|
SAMR_FIELD_HOME_DIRECTORY);
|
|
|
|
TEST_USERINFO_STRING(10, home_drive, 3, home_drive, "xx10-3 home_drive", 0);
|
|
TEST_USERINFO_STRING(10, home_drive, 5, home_drive, "xx10-5 home_drive", 0);
|
|
TEST_USERINFO_STRING(10, home_drive, 21, home_drive, "xx10-21 home_drive", 0);
|
|
TEST_USERINFO_STRING(21, home_drive, 21, home_drive, "xx21-21 home_drive",
|
|
SAMR_FIELD_HOME_DRIVE);
|
|
TEST_USERINFO_STRING(21, home_drive, 10, home_drive, "xx21-10 home_drive",
|
|
SAMR_FIELD_HOME_DRIVE);
|
|
|
|
TEST_USERINFO_STRING(13, description, 1, description, "xx13-1 description", 0);
|
|
TEST_USERINFO_STRING(13, description, 5, description, "xx13-5 description", 0);
|
|
TEST_USERINFO_STRING(13, description, 21, description, "xx13-21 description", 0);
|
|
TEST_USERINFO_STRING(21, description, 21, description, "xx21-21 description",
|
|
SAMR_FIELD_DESCRIPTION);
|
|
|
|
TEST_USERINFO_STRING(14, workstations, 3, workstations, "14workstation3", 0);
|
|
TEST_USERINFO_STRING(14, workstations, 5, workstations, "14workstation4", 0);
|
|
TEST_USERINFO_STRING(14, workstations, 21, workstations, "14workstation21", 0);
|
|
TEST_USERINFO_STRING(21, workstations, 21, workstations, "21workstation21",
|
|
SAMR_FIELD_WORKSTATIONS);
|
|
TEST_USERINFO_STRING(21, workstations, 3, workstations, "21workstation3",
|
|
SAMR_FIELD_WORKSTATIONS);
|
|
TEST_USERINFO_STRING(21, workstations, 5, workstations, "21workstation5",
|
|
SAMR_FIELD_WORKSTATIONS);
|
|
TEST_USERINFO_STRING(21, workstations, 14, workstations, "21workstation14",
|
|
SAMR_FIELD_WORKSTATIONS);
|
|
|
|
TEST_USERINFO_BINARYSTRING(20, parameters, 21, parameters, "xx20-21 parameters", 0);
|
|
TEST_USERINFO_BINARYSTRING(21, parameters, 21, parameters, "xx21-21 parameters",
|
|
SAMR_FIELD_PARAMETERS);
|
|
TEST_USERINFO_BINARYSTRING(21, parameters, 20, parameters, "xx21-20 parameters",
|
|
SAMR_FIELD_PARAMETERS);
|
|
/* also empty user parameters are allowed */
|
|
TEST_USERINFO_BINARYSTRING(20, parameters, 21, parameters, "", 0);
|
|
TEST_USERINFO_BINARYSTRING(21, parameters, 21, parameters, "",
|
|
SAMR_FIELD_PARAMETERS);
|
|
TEST_USERINFO_BINARYSTRING(21, parameters, 20, parameters, "",
|
|
SAMR_FIELD_PARAMETERS);
|
|
|
|
/* Samba 3 cannot store country_code and code_page atm. - gd */
|
|
if (!torture_setting_bool(tctx, "samba3", false)) {
|
|
TEST_USERINFO_INT(2, country_code, 2, country_code, __LINE__, 0);
|
|
TEST_USERINFO_INT(2, country_code, 21, country_code, __LINE__, 0);
|
|
TEST_USERINFO_INT(21, country_code, 21, country_code, __LINE__,
|
|
SAMR_FIELD_COUNTRY_CODE);
|
|
TEST_USERINFO_INT(21, country_code, 2, country_code, __LINE__,
|
|
SAMR_FIELD_COUNTRY_CODE);
|
|
|
|
TEST_USERINFO_INT(2, code_page, 21, code_page, __LINE__, 0);
|
|
TEST_USERINFO_INT(21, code_page, 21, code_page, __LINE__,
|
|
SAMR_FIELD_CODE_PAGE);
|
|
TEST_USERINFO_INT(21, code_page, 2, code_page, __LINE__,
|
|
SAMR_FIELD_CODE_PAGE);
|
|
}
|
|
|
|
if (!torture_setting_bool(tctx, "samba3", false)) {
|
|
TEST_USERINFO_INT(17, acct_expiry, 21, acct_expiry, __LINE__, 0);
|
|
TEST_USERINFO_INT(17, acct_expiry, 5, acct_expiry, __LINE__, 0);
|
|
TEST_USERINFO_INT(21, acct_expiry, 21, acct_expiry, __LINE__,
|
|
SAMR_FIELD_ACCT_EXPIRY);
|
|
TEST_USERINFO_INT(21, acct_expiry, 5, acct_expiry, __LINE__,
|
|
SAMR_FIELD_ACCT_EXPIRY);
|
|
TEST_USERINFO_INT(21, acct_expiry, 17, acct_expiry, __LINE__,
|
|
SAMR_FIELD_ACCT_EXPIRY);
|
|
} else {
|
|
/* Samba 3 can only store seconds / time_t in passdb - gd */
|
|
NTTIME nt;
|
|
unix_to_nt_time(&nt, time(NULL) + __LINE__);
|
|
TEST_USERINFO_INT(17, acct_expiry, 21, acct_expiry, nt, 0);
|
|
unix_to_nt_time(&nt, time(NULL) + __LINE__);
|
|
TEST_USERINFO_INT(17, acct_expiry, 5, acct_expiry, nt, 0);
|
|
unix_to_nt_time(&nt, time(NULL) + __LINE__);
|
|
TEST_USERINFO_INT(21, acct_expiry, 21, acct_expiry, nt, SAMR_FIELD_ACCT_EXPIRY);
|
|
unix_to_nt_time(&nt, time(NULL) + __LINE__);
|
|
TEST_USERINFO_INT(21, acct_expiry, 5, acct_expiry, nt, SAMR_FIELD_ACCT_EXPIRY);
|
|
unix_to_nt_time(&nt, time(NULL) + __LINE__);
|
|
TEST_USERINFO_INT(21, acct_expiry, 17, acct_expiry, nt, SAMR_FIELD_ACCT_EXPIRY);
|
|
}
|
|
|
|
TEST_USERINFO_INT(4, logon_hours.bits[3], 3, logon_hours.bits[3], 1, 0);
|
|
TEST_USERINFO_INT(4, logon_hours.bits[3], 5, logon_hours.bits[3], 2, 0);
|
|
TEST_USERINFO_INT(4, logon_hours.bits[3], 21, logon_hours.bits[3], 3, 0);
|
|
TEST_USERINFO_INT(21, logon_hours.bits[3], 21, logon_hours.bits[3], 4,
|
|
SAMR_FIELD_LOGON_HOURS);
|
|
|
|
TEST_USERINFO_INT_EXP(16, acct_flags, 5, acct_flags,
|
|
(base_acct_flags | ACB_DISABLED | ACB_HOMDIRREQ),
|
|
(base_acct_flags | ACB_DISABLED | ACB_HOMDIRREQ | user_extra_flags),
|
|
0);
|
|
TEST_USERINFO_INT_EXP(16, acct_flags, 5, acct_flags,
|
|
(base_acct_flags | ACB_DISABLED),
|
|
(base_acct_flags | ACB_DISABLED | user_extra_flags),
|
|
0);
|
|
|
|
/* Setting PWNOEXP clears the magic ACB_PW_EXPIRED flag */
|
|
TEST_USERINFO_INT_EXP(16, acct_flags, 5, acct_flags,
|
|
(base_acct_flags | ACB_DISABLED | ACB_PWNOEXP),
|
|
(base_acct_flags | ACB_DISABLED | ACB_PWNOEXP),
|
|
0);
|
|
TEST_USERINFO_INT_EXP(16, acct_flags, 21, acct_flags,
|
|
(base_acct_flags | ACB_DISABLED | ACB_HOMDIRREQ),
|
|
(base_acct_flags | ACB_DISABLED | ACB_HOMDIRREQ | user_extra_flags),
|
|
0);
|
|
|
|
|
|
/* The 'autolock' flag doesn't stick - check this */
|
|
TEST_USERINFO_INT_EXP(16, acct_flags, 21, acct_flags,
|
|
(base_acct_flags | ACB_DISABLED | ACB_AUTOLOCK),
|
|
(base_acct_flags | ACB_DISABLED | user_extra_flags),
|
|
0);
|
|
#if 0
|
|
/* Removing the 'disabled' flag doesn't stick - check this */
|
|
TEST_USERINFO_INT_EXP(16, acct_flags, 21, acct_flags,
|
|
(base_acct_flags),
|
|
(base_acct_flags | ACB_DISABLED | user_extra_flags),
|
|
0);
|
|
#endif
|
|
|
|
/* Samba3 cannot store these atm */
|
|
if (!torture_setting_bool(tctx, "samba3", false)) {
|
|
/* The 'store plaintext' flag does stick */
|
|
TEST_USERINFO_INT_EXP(16, acct_flags, 21, acct_flags,
|
|
(base_acct_flags | ACB_DISABLED | ACB_ENC_TXT_PWD_ALLOWED),
|
|
(base_acct_flags | ACB_DISABLED | ACB_ENC_TXT_PWD_ALLOWED | user_extra_flags),
|
|
0);
|
|
/* The 'use DES' flag does stick */
|
|
TEST_USERINFO_INT_EXP(16, acct_flags, 21, acct_flags,
|
|
(base_acct_flags | ACB_DISABLED | ACB_USE_DES_KEY_ONLY),
|
|
(base_acct_flags | ACB_DISABLED | ACB_USE_DES_KEY_ONLY | user_extra_flags),
|
|
0);
|
|
/* The 'don't require kerberos pre-authentication flag does stick */
|
|
TEST_USERINFO_INT_EXP(16, acct_flags, 21, acct_flags,
|
|
(base_acct_flags | ACB_DISABLED | ACB_DONT_REQUIRE_PREAUTH),
|
|
(base_acct_flags | ACB_DISABLED | ACB_DONT_REQUIRE_PREAUTH | user_extra_flags),
|
|
0);
|
|
/* The 'no kerberos PAC required' flag sticks */
|
|
TEST_USERINFO_INT_EXP(16, acct_flags, 21, acct_flags,
|
|
(base_acct_flags | ACB_DISABLED | ACB_NO_AUTH_DATA_REQD),
|
|
(base_acct_flags | ACB_DISABLED | ACB_NO_AUTH_DATA_REQD | user_extra_flags),
|
|
0);
|
|
}
|
|
TEST_USERINFO_INT_EXP(21, acct_flags, 21, acct_flags,
|
|
(base_acct_flags | ACB_DISABLED),
|
|
(base_acct_flags | ACB_DISABLED | user_extra_flags),
|
|
SAMR_FIELD_ACCT_FLAGS);
|
|
|
|
#if 0
|
|
/* these fail with win2003 - it appears you can't set the primary gid?
|
|
the set succeeds, but the gid isn't changed. Very weird! */
|
|
TEST_USERINFO_INT(9, primary_gid, 1, primary_gid, 513);
|
|
TEST_USERINFO_INT(9, primary_gid, 3, primary_gid, 513);
|
|
TEST_USERINFO_INT(9, primary_gid, 5, primary_gid, 513);
|
|
TEST_USERINFO_INT(9, primary_gid, 21, primary_gid, 513);
|
|
#endif
|
|
|
|
return ret;
|
|
}
|
|
|
|
/*
|
|
generate a random password for password change tests
|
|
*/
|
|
static char *samr_rand_pass_silent(TALLOC_CTX *mem_ctx, int min_len)
|
|
{
|
|
size_t len = MAX(8, min_len);
|
|
char *s = generate_random_password(mem_ctx, len, len+6);
|
|
return s;
|
|
}
|
|
|
|
static char *samr_rand_pass(TALLOC_CTX *mem_ctx, int min_len)
|
|
{
|
|
char *s = samr_rand_pass_silent(mem_ctx, min_len);
|
|
printf("Generated password '%s'\n", s);
|
|
return s;
|
|
|
|
}
|
|
|
|
/*
|
|
generate a random password for password change tests
|
|
*/
|
|
static DATA_BLOB samr_very_rand_pass(TALLOC_CTX *mem_ctx, int len)
|
|
{
|
|
int i;
|
|
DATA_BLOB password = data_blob_talloc(mem_ctx, NULL, len * 2 /* number of unicode chars */);
|
|
generate_random_buffer(password.data, password.length);
|
|
|
|
for (i=0; i < len; i++) {
|
|
if (((uint16_t *)password.data)[i] == 0) {
|
|
((uint16_t *)password.data)[i] = 1;
|
|
}
|
|
}
|
|
|
|
return password;
|
|
}
|
|
|
|
/*
|
|
generate a random password for password change tests (fixed length)
|
|
*/
|
|
static char *samr_rand_pass_fixed_len(TALLOC_CTX *mem_ctx, int len)
|
|
{
|
|
char *s = generate_random_password(mem_ctx, len, len);
|
|
printf("Generated password '%s'\n", s);
|
|
return s;
|
|
}
|
|
|
|
static bool test_SetUserPass(struct dcerpc_pipe *p, struct torture_context *tctx,
|
|
struct policy_handle *handle, char **password)
|
|
{
|
|
NTSTATUS status;
|
|
struct samr_SetUserInfo s;
|
|
union samr_UserInfo u;
|
|
bool ret = true;
|
|
DATA_BLOB session_key;
|
|
char *newpass;
|
|
struct dcerpc_binding_handle *b = p->binding_handle;
|
|
struct samr_GetUserPwInfo pwp;
|
|
struct samr_PwInfo info;
|
|
int policy_min_pw_len = 0;
|
|
pwp.in.user_handle = handle;
|
|
pwp.out.info = &info;
|
|
|
|
torture_assert_ntstatus_ok(tctx, dcerpc_samr_GetUserPwInfo_r(b, tctx, &pwp),
|
|
"GetUserPwInfo failed");
|
|
if (NT_STATUS_IS_OK(pwp.out.result)) {
|
|
policy_min_pw_len = pwp.out.info->min_password_length;
|
|
}
|
|
newpass = samr_rand_pass(tctx, policy_min_pw_len);
|
|
|
|
s.in.user_handle = handle;
|
|
s.in.info = &u;
|
|
s.in.level = 24;
|
|
|
|
encode_pw_buffer(u.info24.password.data, newpass, STR_UNICODE);
|
|
u.info24.password_expired = 0;
|
|
|
|
status = dcerpc_fetch_session_key(p, &session_key);
|
|
if (!NT_STATUS_IS_OK(status)) {
|
|
torture_result(tctx, TORTURE_FAIL, "SetUserInfo level %u - no session key - %s\n",
|
|
s.in.level, nt_errstr(status));
|
|
return false;
|
|
}
|
|
|
|
arcfour_crypt_blob(u.info24.password.data, 516, &session_key);
|
|
|
|
torture_comment(tctx, "Testing SetUserInfo level 24 (set password)\n");
|
|
|
|
torture_assert_ntstatus_ok(tctx, dcerpc_samr_SetUserInfo_r(b, tctx, &s),
|
|
"SetUserInfo failed");
|
|
torture_comment(tctx, "(%s:%s) new_password[%s] status[%s]\n",
|
|
__location__, __FUNCTION__,
|
|
newpass, nt_errstr(s.out.result));
|
|
if (!NT_STATUS_IS_OK(s.out.result)) {
|
|
torture_result(tctx, TORTURE_FAIL, "SetUserInfo level %u failed - %s\n",
|
|
s.in.level, nt_errstr(s.out.result));
|
|
ret = false;
|
|
} else {
|
|
*password = newpass;
|
|
}
|
|
|
|
return ret;
|
|
}
|
|
|
|
|
|
static bool test_SetUserPass_23(struct dcerpc_pipe *p, struct torture_context *tctx,
|
|
struct policy_handle *handle, uint32_t fields_present,
|
|
char **password)
|
|
{
|
|
NTSTATUS status;
|
|
struct samr_SetUserInfo s;
|
|
union samr_UserInfo u;
|
|
bool ret = true;
|
|
DATA_BLOB session_key;
|
|
struct dcerpc_binding_handle *b = p->binding_handle;
|
|
char *newpass;
|
|
struct samr_GetUserPwInfo pwp;
|
|
struct samr_PwInfo info;
|
|
int policy_min_pw_len = 0;
|
|
pwp.in.user_handle = handle;
|
|
pwp.out.info = &info;
|
|
|
|
torture_assert_ntstatus_ok(tctx, dcerpc_samr_GetUserPwInfo_r(b, tctx, &pwp),
|
|
"GetUserPwInfo failed");
|
|
if (NT_STATUS_IS_OK(pwp.out.result)) {
|
|
policy_min_pw_len = pwp.out.info->min_password_length;
|
|
}
|
|
newpass = samr_rand_pass(tctx, policy_min_pw_len);
|
|
|
|
s.in.user_handle = handle;
|
|
s.in.info = &u;
|
|
s.in.level = 23;
|
|
|
|
ZERO_STRUCT(u);
|
|
|
|
u.info23.info.fields_present = fields_present;
|
|
|
|
encode_pw_buffer(u.info23.password.data, newpass, STR_UNICODE);
|
|
|
|
status = dcerpc_fetch_session_key(p, &session_key);
|
|
if (!NT_STATUS_IS_OK(status)) {
|
|
torture_result(tctx, TORTURE_FAIL, "SetUserInfo level %u - no session key - %s\n",
|
|
s.in.level, nt_errstr(status));
|
|
return false;
|
|
}
|
|
|
|
arcfour_crypt_blob(u.info23.password.data, 516, &session_key);
|
|
|
|
torture_comment(tctx, "Testing SetUserInfo level 23 (set password)\n");
|
|
|
|
torture_assert_ntstatus_ok(tctx, dcerpc_samr_SetUserInfo_r(b, tctx, &s),
|
|
"SetUserInfo failed");
|
|
torture_comment(tctx, "(%s:%s) new_password[%s] status[%s]\n",
|
|
__location__, __FUNCTION__,
|
|
newpass, nt_errstr(s.out.result));
|
|
if (!NT_STATUS_IS_OK(s.out.result)) {
|
|
torture_result(tctx, TORTURE_FAIL, "SetUserInfo level %u failed - %s\n",
|
|
s.in.level, nt_errstr(s.out.result));
|
|
ret = false;
|
|
} else {
|
|
*password = newpass;
|
|
}
|
|
|
|
encode_pw_buffer(u.info23.password.data, newpass, STR_UNICODE);
|
|
|
|
status = dcerpc_fetch_session_key(p, &session_key);
|
|
if (!NT_STATUS_IS_OK(status)) {
|
|
torture_result(tctx, TORTURE_FAIL, "SetUserInfo level %u - no session key - %s\n",
|
|
s.in.level, nt_errstr(status));
|
|
return false;
|
|
}
|
|
|
|
/* This should break the key nicely */
|
|
session_key.length--;
|
|
arcfour_crypt_blob(u.info23.password.data, 516, &session_key);
|
|
|
|
torture_comment(tctx, "Testing SetUserInfo level 23 (set password) with wrong password\n");
|
|
|
|
torture_assert_ntstatus_ok(tctx, dcerpc_samr_SetUserInfo_r(b, tctx, &s),
|
|
"SetUserInfo failed");
|
|
torture_comment(tctx, "(%s:%s) new_password[%s] status[%s]\n",
|
|
__location__, __FUNCTION__,
|
|
newpass, nt_errstr(s.out.result));
|
|
if (!NT_STATUS_EQUAL(s.out.result, NT_STATUS_WRONG_PASSWORD)) {
|
|
torture_result(tctx, TORTURE_FAIL, "SetUserInfo level %u should have failed with WRONG_PASSWORD- %s\n",
|
|
s.in.level, nt_errstr(s.out.result));
|
|
ret = false;
|
|
}
|
|
|
|
return ret;
|
|
}
|
|
|
|
|
|
static bool test_SetUserPassEx(struct dcerpc_pipe *p, struct torture_context *tctx,
|
|
struct policy_handle *handle, bool makeshort,
|
|
char **password)
|
|
{
|
|
NTSTATUS status;
|
|
struct samr_SetUserInfo s;
|
|
union samr_UserInfo u;
|
|
bool ret = true;
|
|
DATA_BLOB session_key;
|
|
DATA_BLOB confounded_session_key = data_blob_talloc(tctx, NULL, 16);
|
|
uint8_t confounder[16];
|
|
char *newpass;
|
|
struct dcerpc_binding_handle *b = p->binding_handle;
|
|
MD5_CTX ctx;
|
|
struct samr_GetUserPwInfo pwp;
|
|
struct samr_PwInfo info;
|
|
int policy_min_pw_len = 0;
|
|
pwp.in.user_handle = handle;
|
|
pwp.out.info = &info;
|
|
|
|
torture_assert_ntstatus_ok(tctx, dcerpc_samr_GetUserPwInfo_r(b, tctx, &pwp),
|
|
"GetUserPwInfo failed");
|
|
if (NT_STATUS_IS_OK(pwp.out.result)) {
|
|
policy_min_pw_len = pwp.out.info->min_password_length;
|
|
}
|
|
if (makeshort && policy_min_pw_len) {
|
|
newpass = samr_rand_pass_fixed_len(tctx, policy_min_pw_len - 1);
|
|
} else {
|
|
newpass = samr_rand_pass(tctx, policy_min_pw_len);
|
|
}
|
|
|
|
s.in.user_handle = handle;
|
|
s.in.info = &u;
|
|
s.in.level = 26;
|
|
|
|
encode_pw_buffer(u.info26.password.data, newpass, STR_UNICODE);
|
|
u.info26.password_expired = 0;
|
|
|
|
status = dcerpc_fetch_session_key(p, &session_key);
|
|
if (!NT_STATUS_IS_OK(status)) {
|
|
torture_result(tctx, TORTURE_FAIL, "SetUserInfo level %u - no session key - %s\n",
|
|
s.in.level, nt_errstr(status));
|
|
return false;
|
|
}
|
|
|
|
generate_random_buffer((uint8_t *)confounder, 16);
|
|
|
|
MD5Init(&ctx);
|
|
MD5Update(&ctx, confounder, 16);
|
|
MD5Update(&ctx, session_key.data, session_key.length);
|
|
MD5Final(confounded_session_key.data, &ctx);
|
|
|
|
arcfour_crypt_blob(u.info26.password.data, 516, &confounded_session_key);
|
|
memcpy(&u.info26.password.data[516], confounder, 16);
|
|
|
|
torture_comment(tctx, "Testing SetUserInfo level 26 (set password ex)\n");
|
|
|
|
torture_assert_ntstatus_ok(tctx, dcerpc_samr_SetUserInfo_r(b, tctx, &s),
|
|
"SetUserInfo failed");
|
|
torture_comment(tctx, "(%s:%s) new_password[%s] status[%s]\n",
|
|
__location__, __FUNCTION__,
|
|
newpass, nt_errstr(s.out.result));
|
|
if (!NT_STATUS_IS_OK(s.out.result)) {
|
|
torture_result(tctx, TORTURE_FAIL, "SetUserInfo level %u failed - %s\n",
|
|
s.in.level, nt_errstr(s.out.result));
|
|
ret = false;
|
|
} else {
|
|
*password = newpass;
|
|
}
|
|
|
|
/* This should break the key nicely */
|
|
confounded_session_key.data[0]++;
|
|
|
|
arcfour_crypt_blob(u.info26.password.data, 516, &confounded_session_key);
|
|
memcpy(&u.info26.password.data[516], confounder, 16);
|
|
|
|
torture_comment(tctx, "Testing SetUserInfo level 26 (set password ex) with wrong session key\n");
|
|
|
|
torture_assert_ntstatus_ok(tctx, dcerpc_samr_SetUserInfo_r(b, tctx, &s),
|
|
"SetUserInfo failed");
|
|
torture_comment(tctx, "(%s:%s) new_password[%s] status[%s]\n",
|
|
__location__, __FUNCTION__,
|
|
newpass, nt_errstr(s.out.result));
|
|
if (!NT_STATUS_EQUAL(s.out.result, NT_STATUS_WRONG_PASSWORD)) {
|
|
torture_result(tctx, TORTURE_FAIL, "SetUserInfo level %u should have failed with WRONG_PASSWORD: %s\n",
|
|
s.in.level, nt_errstr(s.out.result));
|
|
ret = false;
|
|
} else {
|
|
*password = newpass;
|
|
}
|
|
|
|
return ret;
|
|
}
|
|
|
|
static bool test_SetUserPass_25(struct dcerpc_pipe *p, struct torture_context *tctx,
|
|
struct policy_handle *handle, uint32_t fields_present,
|
|
char **password)
|
|
{
|
|
NTSTATUS status;
|
|
struct samr_SetUserInfo s;
|
|
union samr_UserInfo u;
|
|
bool ret = true;
|
|
DATA_BLOB session_key;
|
|
DATA_BLOB confounded_session_key = data_blob_talloc(tctx, NULL, 16);
|
|
MD5_CTX ctx;
|
|
uint8_t confounder[16];
|
|
char *newpass;
|
|
struct dcerpc_binding_handle *b = p->binding_handle;
|
|
struct samr_GetUserPwInfo pwp;
|
|
struct samr_PwInfo info;
|
|
int policy_min_pw_len = 0;
|
|
pwp.in.user_handle = handle;
|
|
pwp.out.info = &info;
|
|
|
|
torture_assert_ntstatus_ok(tctx, dcerpc_samr_GetUserPwInfo_r(b, tctx, &pwp),
|
|
"GetUserPwInfo failed");
|
|
if (NT_STATUS_IS_OK(pwp.out.result)) {
|
|
policy_min_pw_len = pwp.out.info->min_password_length;
|
|
}
|
|
newpass = samr_rand_pass(tctx, policy_min_pw_len);
|
|
|
|
s.in.user_handle = handle;
|
|
s.in.info = &u;
|
|
s.in.level = 25;
|
|
|
|
ZERO_STRUCT(u);
|
|
|
|
u.info25.info.fields_present = fields_present;
|
|
|
|
encode_pw_buffer(u.info25.password.data, newpass, STR_UNICODE);
|
|
|
|
status = dcerpc_fetch_session_key(p, &session_key);
|
|
if (!NT_STATUS_IS_OK(status)) {
|
|
torture_result(tctx, TORTURE_FAIL, "SetUserInfo level %u - no session key - %s\n",
|
|
s.in.level, nt_errstr(status));
|
|
return false;
|
|
}
|
|
|
|
generate_random_buffer((uint8_t *)confounder, 16);
|
|
|
|
MD5Init(&ctx);
|
|
MD5Update(&ctx, confounder, 16);
|
|
MD5Update(&ctx, session_key.data, session_key.length);
|
|
MD5Final(confounded_session_key.data, &ctx);
|
|
|
|
arcfour_crypt_blob(u.info25.password.data, 516, &confounded_session_key);
|
|
memcpy(&u.info25.password.data[516], confounder, 16);
|
|
|
|
torture_comment(tctx, "Testing SetUserInfo level 25 (set password ex)\n");
|
|
|
|
torture_assert_ntstatus_ok(tctx, dcerpc_samr_SetUserInfo_r(b, tctx, &s),
|
|
"SetUserInfo failed");
|
|
torture_comment(tctx, "(%s:%s) new_password[%s] status[%s]\n",
|
|
__location__, __FUNCTION__,
|
|
newpass, nt_errstr(s.out.result));
|
|
if (!NT_STATUS_IS_OK(s.out.result)) {
|
|
torture_result(tctx, TORTURE_FAIL, "SetUserInfo level %u failed - %s\n",
|
|
s.in.level, nt_errstr(s.out.result));
|
|
ret = false;
|
|
} else {
|
|
*password = newpass;
|
|
}
|
|
|
|
/* This should break the key nicely */
|
|
confounded_session_key.data[0]++;
|
|
|
|
arcfour_crypt_blob(u.info25.password.data, 516, &confounded_session_key);
|
|
memcpy(&u.info25.password.data[516], confounder, 16);
|
|
|
|
torture_comment(tctx, "Testing SetUserInfo level 25 (set password ex) with wrong session key\n");
|
|
|
|
torture_assert_ntstatus_ok(tctx, dcerpc_samr_SetUserInfo_r(b, tctx, &s),
|
|
"SetUserInfo failed");
|
|
torture_comment(tctx, "(%s:%s) new_password[%s] status[%s]\n",
|
|
__location__, __FUNCTION__,
|
|
newpass, nt_errstr(s.out.result));
|
|
if (!NT_STATUS_EQUAL(s.out.result, NT_STATUS_WRONG_PASSWORD)) {
|
|
torture_result(tctx, TORTURE_FAIL, "SetUserInfo level %u should have failed with WRONG_PASSWORD- %s\n",
|
|
s.in.level, nt_errstr(s.out.result));
|
|
ret = false;
|
|
}
|
|
|
|
return ret;
|
|
}
|
|
|
|
static bool test_SetUserPass_18(struct dcerpc_pipe *p, struct torture_context *tctx,
|
|
struct policy_handle *handle, char **password)
|
|
{
|
|
NTSTATUS status;
|
|
struct samr_SetUserInfo s;
|
|
union samr_UserInfo u;
|
|
bool ret = true;
|
|
DATA_BLOB session_key;
|
|
char *newpass;
|
|
struct dcerpc_binding_handle *b = p->binding_handle;
|
|
struct samr_GetUserPwInfo pwp;
|
|
struct samr_PwInfo info;
|
|
int policy_min_pw_len = 0;
|
|
uint8_t lm_hash[16], nt_hash[16];
|
|
|
|
pwp.in.user_handle = handle;
|
|
pwp.out.info = &info;
|
|
|
|
torture_assert_ntstatus_ok(tctx, dcerpc_samr_GetUserPwInfo_r(b, tctx, &pwp),
|
|
"GetUserPwInfo failed");
|
|
if (NT_STATUS_IS_OK(pwp.out.result)) {
|
|
policy_min_pw_len = pwp.out.info->min_password_length;
|
|
}
|
|
newpass = samr_rand_pass(tctx, policy_min_pw_len);
|
|
|
|
s.in.user_handle = handle;
|
|
s.in.info = &u;
|
|
s.in.level = 18;
|
|
|
|
ZERO_STRUCT(u);
|
|
|
|
u.info18.nt_pwd_active = true;
|
|
u.info18.lm_pwd_active = true;
|
|
|
|
E_md4hash(newpass, nt_hash);
|
|
E_deshash(newpass, lm_hash);
|
|
|
|
status = dcerpc_fetch_session_key(p, &session_key);
|
|
if (!NT_STATUS_IS_OK(status)) {
|
|
torture_result(tctx, TORTURE_FAIL, "SetUserInfo level %u - no session key - %s\n",
|
|
s.in.level, nt_errstr(status));
|
|
return false;
|
|
}
|
|
|
|
{
|
|
DATA_BLOB in,out;
|
|
in = data_blob_const(nt_hash, 16);
|
|
out = data_blob_talloc_zero(tctx, 16);
|
|
sess_crypt_blob(&out, &in, &session_key, true);
|
|
memcpy(u.info18.nt_pwd.hash, out.data, out.length);
|
|
}
|
|
{
|
|
DATA_BLOB in,out;
|
|
in = data_blob_const(lm_hash, 16);
|
|
out = data_blob_talloc_zero(tctx, 16);
|
|
sess_crypt_blob(&out, &in, &session_key, true);
|
|
memcpy(u.info18.lm_pwd.hash, out.data, out.length);
|
|
}
|
|
|
|
torture_comment(tctx, "Testing SetUserInfo level 18 (set password hash)\n");
|
|
|
|
torture_assert_ntstatus_ok(tctx, dcerpc_samr_SetUserInfo_r(b, tctx, &s),
|
|
"SetUserInfo failed");
|
|
if (!NT_STATUS_IS_OK(s.out.result)) {
|
|
torture_result(tctx, TORTURE_FAIL, "SetUserInfo level %u failed - %s\n",
|
|
s.in.level, nt_errstr(s.out.result));
|
|
ret = false;
|
|
} else {
|
|
*password = newpass;
|
|
}
|
|
|
|
return ret;
|
|
}
|
|
|
|
static bool test_SetUserPass_21(struct dcerpc_pipe *p, struct torture_context *tctx,
|
|
struct policy_handle *handle, uint32_t fields_present,
|
|
char **password)
|
|
{
|
|
NTSTATUS status;
|
|
struct samr_SetUserInfo s;
|
|
union samr_UserInfo u;
|
|
bool ret = true;
|
|
DATA_BLOB session_key;
|
|
char *newpass;
|
|
struct dcerpc_binding_handle *b = p->binding_handle;
|
|
struct samr_GetUserPwInfo pwp;
|
|
struct samr_PwInfo info;
|
|
int policy_min_pw_len = 0;
|
|
uint8_t lm_hash[16], nt_hash[16];
|
|
|
|
pwp.in.user_handle = handle;
|
|
pwp.out.info = &info;
|
|
|
|
torture_assert_ntstatus_ok(tctx, dcerpc_samr_GetUserPwInfo_r(b, tctx, &pwp),
|
|
"GetUserPwInfo failed");
|
|
if (NT_STATUS_IS_OK(pwp.out.result)) {
|
|
policy_min_pw_len = pwp.out.info->min_password_length;
|
|
}
|
|
newpass = samr_rand_pass(tctx, policy_min_pw_len);
|
|
|
|
s.in.user_handle = handle;
|
|
s.in.info = &u;
|
|
s.in.level = 21;
|
|
|
|
E_md4hash(newpass, nt_hash);
|
|
E_deshash(newpass, lm_hash);
|
|
|
|
ZERO_STRUCT(u);
|
|
|
|
u.info21.fields_present = fields_present;
|
|
|
|
if (fields_present & SAMR_FIELD_LM_PASSWORD_PRESENT) {
|
|
u.info21.lm_owf_password.length = 16;
|
|
u.info21.lm_owf_password.size = 16;
|
|
u.info21.lm_owf_password.array = (uint16_t *)lm_hash;
|
|
u.info21.lm_password_set = true;
|
|
}
|
|
|
|
if (fields_present & SAMR_FIELD_NT_PASSWORD_PRESENT) {
|
|
u.info21.nt_owf_password.length = 16;
|
|
u.info21.nt_owf_password.size = 16;
|
|
u.info21.nt_owf_password.array = (uint16_t *)nt_hash;
|
|
u.info21.nt_password_set = true;
|
|
}
|
|
|
|
status = dcerpc_fetch_session_key(p, &session_key);
|
|
if (!NT_STATUS_IS_OK(status)) {
|
|
torture_result(tctx, TORTURE_FAIL, "SetUserInfo level %u - no session key - %s\n",
|
|
s.in.level, nt_errstr(status));
|
|
return false;
|
|
}
|
|
|
|
if (fields_present & SAMR_FIELD_LM_PASSWORD_PRESENT) {
|
|
DATA_BLOB in,out;
|
|
in = data_blob_const(u.info21.lm_owf_password.array,
|
|
u.info21.lm_owf_password.length);
|
|
out = data_blob_talloc_zero(tctx, 16);
|
|
sess_crypt_blob(&out, &in, &session_key, true);
|
|
u.info21.lm_owf_password.array = (uint16_t *)out.data;
|
|
}
|
|
|
|
if (fields_present & SAMR_FIELD_NT_PASSWORD_PRESENT) {
|
|
DATA_BLOB in,out;
|
|
in = data_blob_const(u.info21.nt_owf_password.array,
|
|
u.info21.nt_owf_password.length);
|
|
out = data_blob_talloc_zero(tctx, 16);
|
|
sess_crypt_blob(&out, &in, &session_key, true);
|
|
u.info21.nt_owf_password.array = (uint16_t *)out.data;
|
|
}
|
|
|
|
torture_comment(tctx, "Testing SetUserInfo level 21 (set password hash)\n");
|
|
|
|
torture_assert_ntstatus_ok(tctx, dcerpc_samr_SetUserInfo_r(b, tctx, &s),
|
|
"SetUserInfo failed");
|
|
if (!NT_STATUS_IS_OK(s.out.result)) {
|
|
torture_result(tctx, TORTURE_FAIL, "SetUserInfo level %u failed - %s\n",
|
|
s.in.level, nt_errstr(s.out.result));
|
|
ret = false;
|
|
} else {
|
|
*password = newpass;
|
|
}
|
|
|
|
/* try invalid length */
|
|
if (fields_present & SAMR_FIELD_NT_PASSWORD_PRESENT) {
|
|
|
|
u.info21.nt_owf_password.length++;
|
|
|
|
torture_assert_ntstatus_ok(tctx, dcerpc_samr_SetUserInfo_r(b, tctx, &s),
|
|
"SetUserInfo failed");
|
|
if (!NT_STATUS_EQUAL(s.out.result, NT_STATUS_INVALID_PARAMETER)) {
|
|
torture_result(tctx, TORTURE_FAIL, "SetUserInfo level %u should have failed with NT_STATUS_INVALID_PARAMETER - %s\n",
|
|
s.in.level, nt_errstr(s.out.result));
|
|
ret = false;
|
|
}
|
|
}
|
|
|
|
if (fields_present & SAMR_FIELD_LM_PASSWORD_PRESENT) {
|
|
|
|
u.info21.lm_owf_password.length++;
|
|
|
|
torture_assert_ntstatus_ok(tctx, dcerpc_samr_SetUserInfo_r(b, tctx, &s),
|
|
"SetUserInfo failed");
|
|
if (!NT_STATUS_EQUAL(s.out.result, NT_STATUS_INVALID_PARAMETER)) {
|
|
torture_result(tctx, TORTURE_FAIL, "SetUserInfo level %u should have failed with NT_STATUS_INVALID_PARAMETER - %s\n",
|
|
s.in.level, nt_errstr(s.out.result));
|
|
ret = false;
|
|
}
|
|
}
|
|
|
|
return ret;
|
|
}
|
|
|
|
static bool test_SetUserPass_level_ex(struct dcerpc_pipe *p,
|
|
struct torture_context *tctx,
|
|
struct policy_handle *handle,
|
|
uint16_t level,
|
|
uint32_t fields_present,
|
|
char **password, uint8_t password_expired,
|
|
bool use_setinfo2,
|
|
bool *matched_expected_error)
|
|
{
|
|
NTSTATUS status;
|
|
NTSTATUS expected_error = NT_STATUS_OK;
|
|
struct samr_SetUserInfo s;
|
|
struct samr_SetUserInfo2 s2;
|
|
union samr_UserInfo u;
|
|
bool ret = true;
|
|
DATA_BLOB session_key;
|
|
DATA_BLOB confounded_session_key = data_blob_talloc(tctx, NULL, 16);
|
|
MD5_CTX ctx;
|
|
uint8_t confounder[16];
|
|
char *newpass;
|
|
struct dcerpc_binding_handle *b = p->binding_handle;
|
|
struct samr_GetUserPwInfo pwp;
|
|
struct samr_PwInfo info;
|
|
int policy_min_pw_len = 0;
|
|
const char *comment = NULL;
|
|
uint8_t lm_hash[16], nt_hash[16];
|
|
|
|
pwp.in.user_handle = handle;
|
|
pwp.out.info = &info;
|
|
|
|
torture_assert_ntstatus_ok(tctx, dcerpc_samr_GetUserPwInfo_r(b, tctx, &pwp),
|
|
"GetUserPwInfo failed");
|
|
if (NT_STATUS_IS_OK(pwp.out.result)) {
|
|
policy_min_pw_len = pwp.out.info->min_password_length;
|
|
}
|
|
newpass = samr_rand_pass_silent(tctx, policy_min_pw_len);
|
|
|
|
if (use_setinfo2) {
|
|
s2.in.user_handle = handle;
|
|
s2.in.info = &u;
|
|
s2.in.level = level;
|
|
} else {
|
|
s.in.user_handle = handle;
|
|
s.in.info = &u;
|
|
s.in.level = level;
|
|
}
|
|
|
|
if (fields_present & SAMR_FIELD_COMMENT) {
|
|
comment = talloc_asprintf(tctx, "comment: %ld\n", (long int) time(NULL));
|
|
}
|
|
|
|
ZERO_STRUCT(u);
|
|
|
|
switch (level) {
|
|
case 18:
|
|
E_md4hash(newpass, nt_hash);
|
|
E_deshash(newpass, lm_hash);
|
|
|
|
u.info18.nt_pwd_active = true;
|
|
u.info18.lm_pwd_active = true;
|
|
u.info18.password_expired = password_expired;
|
|
|
|
memcpy(u.info18.lm_pwd.hash, lm_hash, 16);
|
|
memcpy(u.info18.nt_pwd.hash, nt_hash, 16);
|
|
|
|
break;
|
|
case 21:
|
|
E_md4hash(newpass, nt_hash);
|
|
E_deshash(newpass, lm_hash);
|
|
|
|
u.info21.fields_present = fields_present;
|
|
u.info21.password_expired = password_expired;
|
|
u.info21.comment.string = comment;
|
|
|
|
if (fields_present & SAMR_FIELD_LM_PASSWORD_PRESENT) {
|
|
u.info21.lm_owf_password.length = 16;
|
|
u.info21.lm_owf_password.size = 16;
|
|
u.info21.lm_owf_password.array = (uint16_t *)lm_hash;
|
|
u.info21.lm_password_set = true;
|
|
}
|
|
|
|
if (fields_present & SAMR_FIELD_NT_PASSWORD_PRESENT) {
|
|
u.info21.nt_owf_password.length = 16;
|
|
u.info21.nt_owf_password.size = 16;
|
|
u.info21.nt_owf_password.array = (uint16_t *)nt_hash;
|
|
u.info21.nt_password_set = true;
|
|
}
|
|
|
|
break;
|
|
case 23:
|
|
u.info23.info.fields_present = fields_present;
|
|
u.info23.info.password_expired = password_expired;
|
|
u.info23.info.comment.string = comment;
|
|
|
|
encode_pw_buffer(u.info23.password.data, newpass, STR_UNICODE);
|
|
|
|
break;
|
|
case 24:
|
|
u.info24.password_expired = password_expired;
|
|
|
|
encode_pw_buffer(u.info24.password.data, newpass, STR_UNICODE);
|
|
|
|
break;
|
|
case 25:
|
|
u.info25.info.fields_present = fields_present;
|
|
u.info25.info.password_expired = password_expired;
|
|
u.info25.info.comment.string = comment;
|
|
|
|
encode_pw_buffer(u.info25.password.data, newpass, STR_UNICODE);
|
|
|
|
break;
|
|
case 26:
|
|
u.info26.password_expired = password_expired;
|
|
|
|
encode_pw_buffer(u.info26.password.data, newpass, STR_UNICODE);
|
|
|
|
break;
|
|
}
|
|
|
|
status = dcerpc_fetch_session_key(p, &session_key);
|
|
if (!NT_STATUS_IS_OK(status)) {
|
|
torture_result(tctx, TORTURE_FAIL, "SetUserInfo level %u - no session key - %s\n",
|
|
s.in.level, nt_errstr(status));
|
|
return false;
|
|
}
|
|
|
|
generate_random_buffer((uint8_t *)confounder, 16);
|
|
|
|
MD5Init(&ctx);
|
|
MD5Update(&ctx, confounder, 16);
|
|
MD5Update(&ctx, session_key.data, session_key.length);
|
|
MD5Final(confounded_session_key.data, &ctx);
|
|
|
|
switch (level) {
|
|
case 18:
|
|
{
|
|
DATA_BLOB in,out;
|
|
in = data_blob_const(u.info18.nt_pwd.hash, 16);
|
|
out = data_blob_talloc_zero(tctx, 16);
|
|
sess_crypt_blob(&out, &in, &session_key, true);
|
|
memcpy(u.info18.nt_pwd.hash, out.data, out.length);
|
|
}
|
|
{
|
|
DATA_BLOB in,out;
|
|
in = data_blob_const(u.info18.lm_pwd.hash, 16);
|
|
out = data_blob_talloc_zero(tctx, 16);
|
|
sess_crypt_blob(&out, &in, &session_key, true);
|
|
memcpy(u.info18.lm_pwd.hash, out.data, out.length);
|
|
}
|
|
|
|
break;
|
|
case 21:
|
|
if (fields_present & SAMR_FIELD_LM_PASSWORD_PRESENT) {
|
|
DATA_BLOB in,out;
|
|
in = data_blob_const(u.info21.lm_owf_password.array,
|
|
u.info21.lm_owf_password.length);
|
|
out = data_blob_talloc_zero(tctx, 16);
|
|
sess_crypt_blob(&out, &in, &session_key, true);
|
|
u.info21.lm_owf_password.array = (uint16_t *)out.data;
|
|
}
|
|
if (fields_present & SAMR_FIELD_NT_PASSWORD_PRESENT) {
|
|
DATA_BLOB in,out;
|
|
in = data_blob_const(u.info21.nt_owf_password.array,
|
|
u.info21.nt_owf_password.length);
|
|
out = data_blob_talloc_zero(tctx, 16);
|
|
sess_crypt_blob(&out, &in, &session_key, true);
|
|
u.info21.nt_owf_password.array = (uint16_t *)out.data;
|
|
}
|
|
break;
|
|
case 23:
|
|
arcfour_crypt_blob(u.info23.password.data, 516, &session_key);
|
|
break;
|
|
case 24:
|
|
arcfour_crypt_blob(u.info24.password.data, 516, &session_key);
|
|
break;
|
|
case 25:
|
|
arcfour_crypt_blob(u.info25.password.data, 516, &confounded_session_key);
|
|
memcpy(&u.info25.password.data[516], confounder, 16);
|
|
break;
|
|
case 26:
|
|
arcfour_crypt_blob(u.info26.password.data, 516, &confounded_session_key);
|
|
memcpy(&u.info26.password.data[516], confounder, 16);
|
|
break;
|
|
}
|
|
|
|
if (use_setinfo2) {
|
|
torture_assert_ntstatus_ok(tctx, dcerpc_samr_SetUserInfo2_r(b, tctx, &s2),
|
|
"SetUserInfo2 failed");
|
|
torture_comment(tctx, "(%s:%s) new_password[%s] status[%s]\n",
|
|
__location__, __FUNCTION__,
|
|
newpass, nt_errstr(s2.out.result));
|
|
status = s2.out.result;
|
|
} else {
|
|
torture_assert_ntstatus_ok(tctx, dcerpc_samr_SetUserInfo_r(b, tctx, &s),
|
|
"SetUserInfo failed");
|
|
torture_comment(tctx, "(%s:%s) new_password[%s] status[%s]\n",
|
|
__location__, __FUNCTION__,
|
|
newpass, nt_errstr(s.out.result));
|
|
status = s.out.result;
|
|
}
|
|
|
|
if (!NT_STATUS_IS_OK(status)) {
|
|
if (fields_present == 0) {
|
|
expected_error = NT_STATUS_INVALID_PARAMETER;
|
|
}
|
|
if (fields_present & SAMR_FIELD_LAST_PWD_CHANGE) {
|
|
expected_error = NT_STATUS_ACCESS_DENIED;
|
|
}
|
|
}
|
|
|
|
if (!NT_STATUS_IS_OK(expected_error)) {
|
|
if (use_setinfo2) {
|
|
torture_assert_ntstatus_equal(tctx,
|
|
s2.out.result,
|
|
expected_error, "SetUserInfo2 failed");
|
|
} else {
|
|
torture_assert_ntstatus_equal(tctx,
|
|
s.out.result,
|
|
expected_error, "SetUserInfo failed");
|
|
}
|
|
*matched_expected_error = true;
|
|
return true;
|
|
}
|
|
|
|
if (!NT_STATUS_IS_OK(status)) {
|
|
torture_result(tctx, TORTURE_FAIL, "SetUserInfo%s level %u failed - %s\n",
|
|
use_setinfo2 ? "2":"", level, nt_errstr(status));
|
|
ret = false;
|
|
} else {
|
|
*password = newpass;
|
|
}
|
|
|
|
return ret;
|
|
}
|
|
|
|
static bool test_SetAliasInfo(struct dcerpc_binding_handle *b,
|
|
struct torture_context *tctx,
|
|
struct policy_handle *handle)
|
|
{
|
|
struct samr_SetAliasInfo r;
|
|
struct samr_QueryAliasInfo q;
|
|
union samr_AliasInfo *info;
|
|
uint16_t levels[] = {2, 3};
|
|
int i;
|
|
bool ret = true;
|
|
|
|
/* Ignoring switch level 1, as that includes the number of members for the alias
|
|
* and setting this to a wrong value might have negative consequences
|
|
*/
|
|
|
|
for (i=0;i<ARRAY_SIZE(levels);i++) {
|
|
torture_comment(tctx, "Testing SetAliasInfo level %u\n", levels[i]);
|
|
|
|
r.in.alias_handle = handle;
|
|
r.in.level = levels[i];
|
|
r.in.info = talloc(tctx, union samr_AliasInfo);
|
|
switch (r.in.level) {
|
|
case ALIASINFONAME: init_lsa_String(&r.in.info->name,TEST_ALIASNAME); break;
|
|
case ALIASINFODESCRIPTION: init_lsa_String(&r.in.info->description,
|
|
"Test Description, should test I18N as well"); break;
|
|
case ALIASINFOALL: torture_comment(tctx, "ALIASINFOALL ignored\n"); break;
|
|
}
|
|
|
|
torture_assert_ntstatus_ok(tctx, dcerpc_samr_SetAliasInfo_r(b, tctx, &r),
|
|
"SetAliasInfo failed");
|
|
if (!NT_STATUS_IS_OK(r.out.result)) {
|
|
torture_result(tctx, TORTURE_FAIL, "SetAliasInfo level %u failed - %s\n",
|
|
levels[i], nt_errstr(r.out.result));
|
|
ret = false;
|
|
}
|
|
|
|
q.in.alias_handle = handle;
|
|
q.in.level = levels[i];
|
|
q.out.info = &info;
|
|
|
|
torture_assert_ntstatus_ok(tctx, dcerpc_samr_QueryAliasInfo_r(b, tctx, &q),
|
|
"QueryAliasInfo failed");
|
|
if (!NT_STATUS_IS_OK(q.out.result)) {
|
|
torture_result(tctx, TORTURE_FAIL, "QueryAliasInfo level %u failed - %s\n",
|
|
levels[i], nt_errstr(q.out.result));
|
|
ret = false;
|
|
}
|
|
}
|
|
|
|
return ret;
|
|
}
|
|
|
|
static bool test_GetGroupsForUser(struct dcerpc_binding_handle *b,
|
|
struct torture_context *tctx,
|
|
struct policy_handle *user_handle)
|
|
{
|
|
struct samr_GetGroupsForUser r;
|
|
struct samr_RidWithAttributeArray *rids = NULL;
|
|
|
|
torture_comment(tctx, "Testing GetGroupsForUser\n");
|
|
|
|
r.in.user_handle = user_handle;
|
|
r.out.rids = &rids;
|
|
|
|
torture_assert_ntstatus_ok(tctx, dcerpc_samr_GetGroupsForUser_r(b, tctx, &r),
|
|
"GetGroupsForUser failed");
|
|
torture_assert_ntstatus_ok(tctx, r.out.result, "GetGroupsForUser failed");
|
|
|
|
return true;
|
|
|
|
}
|
|
|
|
static bool test_GetDomPwInfo(struct dcerpc_pipe *p, struct torture_context *tctx,
|
|
struct lsa_String *domain_name)
|
|
{
|
|
struct samr_GetDomPwInfo r;
|
|
struct samr_PwInfo info;
|
|
struct dcerpc_binding_handle *b = p->binding_handle;
|
|
|
|
r.in.domain_name = domain_name;
|
|
r.out.info = &info;
|
|
|
|
torture_comment(tctx, "Testing GetDomPwInfo with name %s\n", r.in.domain_name->string);
|
|
|
|
torture_assert_ntstatus_ok(tctx, dcerpc_samr_GetDomPwInfo_r(b, tctx, &r),
|
|
"GetDomPwInfo failed");
|
|
torture_assert_ntstatus_ok(tctx, r.out.result, "GetDomPwInfo failed");
|
|
|
|
r.in.domain_name->string = talloc_asprintf(tctx, "\\\\%s", dcerpc_server_name(p));
|
|
torture_comment(tctx, "Testing GetDomPwInfo with name %s\n", r.in.domain_name->string);
|
|
|
|
torture_assert_ntstatus_ok(tctx, dcerpc_samr_GetDomPwInfo_r(b, tctx, &r),
|
|
"GetDomPwInfo failed");
|
|
torture_assert_ntstatus_ok(tctx, r.out.result, "GetDomPwInfo failed");
|
|
|
|
r.in.domain_name->string = "\\\\__NONAME__";
|
|
torture_comment(tctx, "Testing GetDomPwInfo with name %s\n", r.in.domain_name->string);
|
|
|
|
torture_assert_ntstatus_ok(tctx, dcerpc_samr_GetDomPwInfo_r(b, tctx, &r),
|
|
"GetDomPwInfo failed");
|
|
torture_assert_ntstatus_ok(tctx, r.out.result, "GetDomPwInfo failed");
|
|
|
|
r.in.domain_name->string = "\\\\Builtin";
|
|
torture_comment(tctx, "Testing GetDomPwInfo with name %s\n", r.in.domain_name->string);
|
|
|
|
torture_assert_ntstatus_ok(tctx, dcerpc_samr_GetDomPwInfo_r(b, tctx, &r),
|
|
"GetDomPwInfo failed");
|
|
torture_assert_ntstatus_ok(tctx, r.out.result, "GetDomPwInfo failed");
|
|
|
|
return true;
|
|
}
|
|
|
|
static bool test_GetUserPwInfo(struct dcerpc_binding_handle *b,
|
|
struct torture_context *tctx,
|
|
struct policy_handle *handle)
|
|
{
|
|
struct samr_GetUserPwInfo r;
|
|
struct samr_PwInfo info;
|
|
|
|
torture_comment(tctx, "Testing GetUserPwInfo\n");
|
|
|
|
r.in.user_handle = handle;
|
|
r.out.info = &info;
|
|
|
|
torture_assert_ntstatus_ok(tctx, dcerpc_samr_GetUserPwInfo_r(b, tctx, &r),
|
|
"GetUserPwInfo failed");
|
|
torture_assert_ntstatus_ok(tctx, r.out.result, "GetUserPwInfo");
|
|
|
|
return true;
|
|
}
|
|
|
|
static NTSTATUS test_LookupName(struct dcerpc_binding_handle *b,
|
|
struct torture_context *tctx,
|
|
struct policy_handle *domain_handle, const char *name,
|
|
uint32_t *rid)
|
|
{
|
|
NTSTATUS status;
|
|
struct samr_LookupNames n;
|
|
struct lsa_String sname[2];
|
|
struct samr_Ids rids, types;
|
|
|
|
init_lsa_String(&sname[0], name);
|
|
|
|
n.in.domain_handle = domain_handle;
|
|
n.in.num_names = 1;
|
|
n.in.names = sname;
|
|
n.out.rids = &rids;
|
|
n.out.types = &types;
|
|
status = dcerpc_samr_LookupNames_r(b, tctx, &n);
|
|
if (!NT_STATUS_IS_OK(status)) {
|
|
return status;
|
|
}
|
|
if (NT_STATUS_IS_OK(n.out.result)) {
|
|
*rid = n.out.rids->ids[0];
|
|
} else {
|
|
return n.out.result;
|
|
}
|
|
|
|
init_lsa_String(&sname[1], "xxNONAMExx");
|
|
n.in.num_names = 2;
|
|
status = dcerpc_samr_LookupNames_r(b, tctx, &n);
|
|
if (!NT_STATUS_IS_OK(status)) {
|
|
return status;
|
|
}
|
|
if (!NT_STATUS_EQUAL(n.out.result, STATUS_SOME_UNMAPPED)) {
|
|
torture_result(tctx, TORTURE_FAIL, "LookupNames[2] failed - %s\n", nt_errstr(n.out.result));
|
|
if (NT_STATUS_IS_OK(n.out.result)) {
|
|
return NT_STATUS_UNSUCCESSFUL;
|
|
}
|
|
return n.out.result;
|
|
}
|
|
|
|
n.in.num_names = 0;
|
|
status = dcerpc_samr_LookupNames_r(b, tctx, &n);
|
|
if (!NT_STATUS_IS_OK(status)) {
|
|
return status;
|
|
}
|
|
if (!NT_STATUS_IS_OK(n.out.result)) {
|
|
torture_result(tctx, TORTURE_FAIL, "LookupNames[0] failed - %s\n", nt_errstr(status));
|
|
return n.out.result;
|
|
}
|
|
|
|
init_lsa_String(&sname[0], "xxNONAMExx");
|
|
n.in.num_names = 1;
|
|
status = dcerpc_samr_LookupNames_r(b, tctx, &n);
|
|
if (!NT_STATUS_IS_OK(status)) {
|
|
return status;
|
|
}
|
|
if (!NT_STATUS_EQUAL(n.out.result, NT_STATUS_NONE_MAPPED)) {
|
|
torture_result(tctx, TORTURE_FAIL, "LookupNames[1 bad name] failed - %s\n", nt_errstr(n.out.result));
|
|
if (NT_STATUS_IS_OK(n.out.result)) {
|
|
return NT_STATUS_UNSUCCESSFUL;
|
|
}
|
|
return n.out.result;
|
|
}
|
|
|
|
init_lsa_String(&sname[0], "xxNONAMExx");
|
|
init_lsa_String(&sname[1], "xxNONAME2xx");
|
|
n.in.num_names = 2;
|
|
status = dcerpc_samr_LookupNames_r(b, tctx, &n);
|
|
if (!NT_STATUS_IS_OK(status)) {
|
|
return status;
|
|
}
|
|
if (!NT_STATUS_EQUAL(n.out.result, NT_STATUS_NONE_MAPPED)) {
|
|
torture_result(tctx, TORTURE_FAIL, "LookupNames[2 bad names] failed - %s\n", nt_errstr(n.out.result));
|
|
if (NT_STATUS_IS_OK(n.out.result)) {
|
|
return NT_STATUS_UNSUCCESSFUL;
|
|
}
|
|
return n.out.result;
|
|
}
|
|
|
|
return NT_STATUS_OK;
|
|
}
|
|
|
|
static NTSTATUS test_OpenUser_byname(struct dcerpc_binding_handle *b,
|
|
struct torture_context *tctx,
|
|
struct policy_handle *domain_handle,
|
|
const char *name, struct policy_handle *user_handle)
|
|
{
|
|
NTSTATUS status;
|
|
struct samr_OpenUser r;
|
|
uint32_t rid;
|
|
|
|
status = test_LookupName(b, tctx, domain_handle, name, &rid);
|
|
if (!NT_STATUS_IS_OK(status)) {
|
|
return status;
|
|
}
|
|
|
|
r.in.domain_handle = domain_handle;
|
|
r.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
|
|
r.in.rid = rid;
|
|
r.out.user_handle = user_handle;
|
|
status = dcerpc_samr_OpenUser_r(b, tctx, &r);
|
|
if (!NT_STATUS_IS_OK(status)) {
|
|
return status;
|
|
}
|
|
if (!NT_STATUS_IS_OK(r.out.result)) {
|
|
torture_result(tctx, TORTURE_FAIL, "OpenUser_byname(%s -> %d) failed - %s\n", name, rid, nt_errstr(r.out.result));
|
|
}
|
|
|
|
return r.out.result;
|
|
}
|
|
|
|
#if 0
|
|
static bool test_ChangePasswordNT3(struct dcerpc_pipe *p,
|
|
struct torture_context *tctx,
|
|
struct policy_handle *handle)
|
|
{
|
|
NTSTATUS status;
|
|
struct samr_ChangePasswordUser r;
|
|
bool ret = true;
|
|
struct samr_Password hash1, hash2, hash3, hash4, hash5, hash6;
|
|
struct policy_handle user_handle;
|
|
char *oldpass = "test";
|
|
char *newpass = "test2";
|
|
uint8_t old_nt_hash[16], new_nt_hash[16];
|
|
uint8_t old_lm_hash[16], new_lm_hash[16];
|
|
|
|
status = test_OpenUser_byname(p, tctx, handle, "testuser", &user_handle);
|
|
if (!NT_STATUS_IS_OK(status)) {
|
|
return false;
|
|
}
|
|
|
|
torture_comment(tctx, "Testing ChangePasswordUser for user 'testuser'\n");
|
|
|
|
torture_comment(tctx, "old password: %s\n", oldpass);
|
|
torture_comment(tctx, "new password: %s\n", newpass);
|
|
|
|
E_md4hash(oldpass, old_nt_hash);
|
|
E_md4hash(newpass, new_nt_hash);
|
|
E_deshash(oldpass, old_lm_hash);
|
|
E_deshash(newpass, new_lm_hash);
|
|
|
|
E_old_pw_hash(new_lm_hash, old_lm_hash, hash1.hash);
|
|
E_old_pw_hash(old_lm_hash, new_lm_hash, hash2.hash);
|
|
E_old_pw_hash(new_nt_hash, old_nt_hash, hash3.hash);
|
|
E_old_pw_hash(old_nt_hash, new_nt_hash, hash4.hash);
|
|
E_old_pw_hash(old_lm_hash, new_nt_hash, hash5.hash);
|
|
E_old_pw_hash(old_nt_hash, new_lm_hash, hash6.hash);
|
|
|
|
r.in.handle = &user_handle;
|
|
r.in.lm_present = 1;
|
|
r.in.old_lm_crypted = &hash1;
|
|
r.in.new_lm_crypted = &hash2;
|
|
r.in.nt_present = 1;
|
|
r.in.old_nt_crypted = &hash3;
|
|
r.in.new_nt_crypted = &hash4;
|
|
r.in.cross1_present = 1;
|
|
r.in.nt_cross = &hash5;
|
|
r.in.cross2_present = 1;
|
|
r.in.lm_cross = &hash6;
|
|
|
|
torture_assert_ntstatus_ok(tctx, dcerpc_samr_ChangePasswordUser_r(b, tctx, &r),
|
|
"ChangePasswordUser failed");
|
|
if (!NT_STATUS_IS_OK(r.out.result)) {
|
|
torture_result(tctx, TORTURE_FAIL, "ChangePasswordUser failed - %s\n", nt_errstr(r.out.result));
|
|
ret = false;
|
|
}
|
|
|
|
if (!test_samr_handle_Close(p, tctx, &user_handle)) {
|
|
ret = false;
|
|
}
|
|
|
|
return ret;
|
|
}
|
|
#endif
|
|
|
|
static bool test_ChangePasswordUser(struct dcerpc_binding_handle *b,
|
|
struct torture_context *tctx,
|
|
const char *acct_name,
|
|
struct policy_handle *handle, char **password)
|
|
{
|
|
NTSTATUS status;
|
|
struct samr_ChangePasswordUser r;
|
|
bool ret = true;
|
|
struct samr_Password hash1, hash2, hash3, hash4, hash5, hash6;
|
|
struct policy_handle user_handle;
|
|
char *oldpass;
|
|
uint8_t old_nt_hash[16], new_nt_hash[16];
|
|
uint8_t old_lm_hash[16], new_lm_hash[16];
|
|
bool changed = true;
|
|
|
|
char *newpass;
|
|
struct samr_GetUserPwInfo pwp;
|
|
struct samr_PwInfo info;
|
|
int policy_min_pw_len = 0;
|
|
|
|
status = test_OpenUser_byname(b, tctx, handle, acct_name, &user_handle);
|
|
if (!NT_STATUS_IS_OK(status)) {
|
|
return false;
|
|
}
|
|
pwp.in.user_handle = &user_handle;
|
|
pwp.out.info = &info;
|
|
|
|
torture_assert_ntstatus_ok(tctx, dcerpc_samr_GetUserPwInfo_r(b, tctx, &pwp),
|
|
"GetUserPwInfo failed");
|
|
if (NT_STATUS_IS_OK(pwp.out.result)) {
|
|
policy_min_pw_len = pwp.out.info->min_password_length;
|
|
}
|
|
newpass = samr_rand_pass(tctx, policy_min_pw_len);
|
|
|
|
torture_comment(tctx, "Testing ChangePasswordUser\n");
|
|
|
|
torture_assert(tctx, *password != NULL,
|
|
"Failing ChangePasswordUser as old password was NULL. Previous test failed?");
|
|
|
|
oldpass = *password;
|
|
|
|
E_md4hash(oldpass, old_nt_hash);
|
|
E_md4hash(newpass, new_nt_hash);
|
|
E_deshash(oldpass, old_lm_hash);
|
|
E_deshash(newpass, new_lm_hash);
|
|
|
|
E_old_pw_hash(new_lm_hash, old_lm_hash, hash1.hash);
|
|
E_old_pw_hash(old_lm_hash, new_lm_hash, hash2.hash);
|
|
E_old_pw_hash(new_nt_hash, old_nt_hash, hash3.hash);
|
|
E_old_pw_hash(old_nt_hash, new_nt_hash, hash4.hash);
|
|
E_old_pw_hash(old_lm_hash, new_nt_hash, hash5.hash);
|
|
E_old_pw_hash(old_nt_hash, new_lm_hash, hash6.hash);
|
|
|
|
r.in.user_handle = &user_handle;
|
|
r.in.lm_present = 1;
|
|
/* Break the NT hash */
|
|
hash3.hash[0]++;
|
|
r.in.old_lm_crypted = &hash1;
|
|
r.in.new_lm_crypted = &hash2;
|
|
r.in.nt_present = 1;
|
|
r.in.old_nt_crypted = &hash3;
|
|
r.in.new_nt_crypted = &hash4;
|
|
r.in.cross1_present = 1;
|
|
r.in.nt_cross = &hash5;
|
|
r.in.cross2_present = 1;
|
|
r.in.lm_cross = &hash6;
|
|
|
|
torture_assert_ntstatus_ok(tctx, dcerpc_samr_ChangePasswordUser_r(b, tctx, &r),
|
|
"ChangePasswordUser failed");
|
|
torture_comment(tctx, "(%s:%s) old_password[%s] new_password[%s] status[%s]\n",
|
|
__location__, __FUNCTION__,
|
|
oldpass, newpass, nt_errstr(r.out.result));
|
|
|
|
/* Do not proceed if this call has been removed */
|
|
if (NT_STATUS_EQUAL(r.out.result, NT_STATUS_NOT_IMPLEMENTED)) {
|
|
torture_skip(tctx, "ValidatePassword not supported by server\n");
|
|
}
|
|
|
|
if (!NT_STATUS_EQUAL(r.out.result, NT_STATUS_PASSWORD_RESTRICTION)) {
|
|
torture_assert_ntstatus_equal(tctx, r.out.result, NT_STATUS_WRONG_PASSWORD,
|
|
"ChangePasswordUser failed: expected NT_STATUS_WRONG_PASSWORD because we broke the LM hash");
|
|
}
|
|
|
|
/* Unbreak the NT hash */
|
|
hash3.hash[0]--;
|
|
|
|
r.in.user_handle = &user_handle;
|
|
r.in.lm_present = 1;
|
|
r.in.old_lm_crypted = &hash1;
|
|
r.in.new_lm_crypted = &hash2;
|
|
/* Break the LM hash */
|
|
hash1.hash[0]--;
|
|
r.in.nt_present = 1;
|
|
r.in.old_nt_crypted = &hash3;
|
|
r.in.new_nt_crypted = &hash4;
|
|
r.in.cross1_present = 1;
|
|
r.in.nt_cross = &hash5;
|
|
r.in.cross2_present = 1;
|
|
r.in.lm_cross = &hash6;
|
|
|
|
torture_assert_ntstatus_ok(tctx, dcerpc_samr_ChangePasswordUser_r(b, tctx, &r),
|
|
"ChangePasswordUser failed");
|
|
torture_comment(tctx, "(%s:%s) old_password[%s] new_password[%s] status[%s]\n",
|
|
__location__, __FUNCTION__,
|
|
oldpass, newpass, nt_errstr(r.out.result));
|
|
if (!NT_STATUS_EQUAL(r.out.result, NT_STATUS_PASSWORD_RESTRICTION)) {
|
|
torture_assert_ntstatus_equal(tctx, r.out.result, NT_STATUS_WRONG_PASSWORD,
|
|
"expected NT_STATUS_WRONG_PASSWORD because we broke the NT hash");
|
|
}
|
|
|
|
/* Unbreak the NT hash */
|
|
hash3.hash[0]--;
|
|
|
|
r.in.user_handle = &user_handle;
|
|
r.in.lm_present = 1;
|
|
r.in.old_lm_crypted = &hash1;
|
|
r.in.new_lm_crypted = &hash2;
|
|
r.in.nt_present = 1;
|
|
r.in.old_nt_crypted = &hash3;
|
|
r.in.new_nt_crypted = &hash4;
|
|
r.in.cross1_present = 1;
|
|
r.in.nt_cross = &hash5;
|
|
r.in.cross2_present = 1;
|
|
/* Break the LM cross */
|
|
hash6.hash[0]++;
|
|
r.in.lm_cross = &hash6;
|
|
|
|
torture_assert_ntstatus_ok(tctx, dcerpc_samr_ChangePasswordUser_r(b, tctx, &r),
|
|
"ChangePasswordUser failed");
|
|
torture_comment(tctx, "(%s:%s) old_password[%s] new_password[%s] status[%s]\n",
|
|
__location__, __FUNCTION__,
|
|
oldpass, newpass, nt_errstr(r.out.result));
|
|
if (!NT_STATUS_EQUAL(r.out.result, NT_STATUS_WRONG_PASSWORD) &&
|
|
!NT_STATUS_EQUAL(r.out.result, NT_STATUS_PASSWORD_RESTRICTION))
|
|
{
|
|
torture_result(tctx, TORTURE_FAIL, "ChangePasswordUser failed: expected NT_STATUS_WRONG_PASSWORD or NT_STATUS_PASSWORD_RESTRICTION because we broke the LM cross-hash, got %s\n", nt_errstr(r.out.result));
|
|
ret = false;
|
|
}
|
|
|
|
/* Unbreak the LM cross */
|
|
hash6.hash[0]--;
|
|
|
|
r.in.user_handle = &user_handle;
|
|
r.in.lm_present = 1;
|
|
r.in.old_lm_crypted = &hash1;
|
|
r.in.new_lm_crypted = &hash2;
|
|
r.in.nt_present = 1;
|
|
r.in.old_nt_crypted = &hash3;
|
|
r.in.new_nt_crypted = &hash4;
|
|
r.in.cross1_present = 1;
|
|
/* Break the NT cross */
|
|
hash5.hash[0]++;
|
|
r.in.nt_cross = &hash5;
|
|
r.in.cross2_present = 1;
|
|
r.in.lm_cross = &hash6;
|
|
|
|
torture_assert_ntstatus_ok(tctx, dcerpc_samr_ChangePasswordUser_r(b, tctx, &r),
|
|
"ChangePasswordUser failed");
|
|
torture_comment(tctx, "(%s:%s) old_password[%s] new_password[%s] status[%s]\n",
|
|
__location__, __FUNCTION__,
|
|
oldpass, newpass, nt_errstr(r.out.result));
|
|
if (!NT_STATUS_EQUAL(r.out.result, NT_STATUS_WRONG_PASSWORD) &&
|
|
!NT_STATUS_EQUAL(r.out.result, NT_STATUS_PASSWORD_RESTRICTION))
|
|
{
|
|
torture_result(tctx, TORTURE_FAIL, "ChangePasswordUser failed: expected NT_STATUS_WRONG_PASSWORD or NT_STATUS_PASSWORD_RESTRICTION because we broke the NT cross-hash, got %s\n", nt_errstr(r.out.result));
|
|
ret = false;
|
|
}
|
|
|
|
/* Unbreak the NT cross */
|
|
hash5.hash[0]--;
|
|
|
|
|
|
/* Reset the hashes to not broken values */
|
|
E_old_pw_hash(new_lm_hash, old_lm_hash, hash1.hash);
|
|
E_old_pw_hash(old_lm_hash, new_lm_hash, hash2.hash);
|
|
E_old_pw_hash(new_nt_hash, old_nt_hash, hash3.hash);
|
|
E_old_pw_hash(old_nt_hash, new_nt_hash, hash4.hash);
|
|
E_old_pw_hash(old_lm_hash, new_nt_hash, hash5.hash);
|
|
E_old_pw_hash(old_nt_hash, new_lm_hash, hash6.hash);
|
|
|
|
r.in.user_handle = &user_handle;
|
|
r.in.lm_present = 1;
|
|
r.in.old_lm_crypted = &hash1;
|
|
r.in.new_lm_crypted = &hash2;
|
|
r.in.nt_present = 1;
|
|
r.in.old_nt_crypted = &hash3;
|
|
r.in.new_nt_crypted = &hash4;
|
|
r.in.cross1_present = 1;
|
|
r.in.nt_cross = &hash5;
|
|
r.in.cross2_present = 0;
|
|
r.in.lm_cross = NULL;
|
|
|
|
torture_assert_ntstatus_ok(tctx, dcerpc_samr_ChangePasswordUser_r(b, tctx, &r),
|
|
"ChangePasswordUser failed");
|
|
torture_comment(tctx, "(%s:%s) old_password[%s] new_password[%s] status[%s]\n",
|
|
__location__, __FUNCTION__,
|
|
oldpass, newpass, nt_errstr(r.out.result));
|
|
if (NT_STATUS_IS_OK(r.out.result)) {
|
|
changed = true;
|
|
*password = newpass;
|
|
} else if (!NT_STATUS_EQUAL(NT_STATUS_PASSWORD_RESTRICTION, r.out.result)) {
|
|
torture_result(tctx, TORTURE_FAIL, "ChangePasswordUser failed: expected NT_STATUS_OK, or at least NT_STATUS_PASSWORD_RESTRICTION, got %s\n", nt_errstr(r.out.result));
|
|
ret = false;
|
|
}
|
|
|
|
oldpass = newpass;
|
|
newpass = samr_rand_pass(tctx, policy_min_pw_len);
|
|
|
|
E_md4hash(oldpass, old_nt_hash);
|
|
E_md4hash(newpass, new_nt_hash);
|
|
E_deshash(oldpass, old_lm_hash);
|
|
E_deshash(newpass, new_lm_hash);
|
|
|
|
|
|
/* Reset the hashes to not broken values */
|
|
E_old_pw_hash(new_lm_hash, old_lm_hash, hash1.hash);
|
|
E_old_pw_hash(old_lm_hash, new_lm_hash, hash2.hash);
|
|
E_old_pw_hash(new_nt_hash, old_nt_hash, hash3.hash);
|
|
E_old_pw_hash(old_nt_hash, new_nt_hash, hash4.hash);
|
|
E_old_pw_hash(old_lm_hash, new_nt_hash, hash5.hash);
|
|
E_old_pw_hash(old_nt_hash, new_lm_hash, hash6.hash);
|
|
|
|
r.in.user_handle = &user_handle;
|
|
r.in.lm_present = 1;
|
|
r.in.old_lm_crypted = &hash1;
|
|
r.in.new_lm_crypted = &hash2;
|
|
r.in.nt_present = 1;
|
|
r.in.old_nt_crypted = &hash3;
|
|
r.in.new_nt_crypted = &hash4;
|
|
r.in.cross1_present = 0;
|
|
r.in.nt_cross = NULL;
|
|
r.in.cross2_present = 1;
|
|
r.in.lm_cross = &hash6;
|
|
|
|
torture_assert_ntstatus_ok(tctx, dcerpc_samr_ChangePasswordUser_r(b, tctx, &r),
|
|
"ChangePasswordUser failed");
|
|
torture_comment(tctx, "(%s:%s) old_password[%s] new_password[%s] status[%s]\n",
|
|
__location__, __FUNCTION__,
|
|
oldpass, newpass, nt_errstr(r.out.result));
|
|
if (NT_STATUS_IS_OK(r.out.result)) {
|
|
changed = true;
|
|
*password = newpass;
|
|
} else if (!NT_STATUS_EQUAL(NT_STATUS_PASSWORD_RESTRICTION, r.out.result)) {
|
|
torture_result(tctx, TORTURE_FAIL, "ChangePasswordUser failed: expected NT_STATUS_OK, or at least NT_STATUS_PASSWORD_RESTRICTION, got %s\n", nt_errstr(r.out.result));
|
|
ret = false;
|
|
}
|
|
|
|
oldpass = newpass;
|
|
newpass = samr_rand_pass(tctx, policy_min_pw_len);
|
|
|
|
E_md4hash(oldpass, old_nt_hash);
|
|
E_md4hash(newpass, new_nt_hash);
|
|
E_deshash(oldpass, old_lm_hash);
|
|
E_deshash(newpass, new_lm_hash);
|
|
|
|
|
|
/* Reset the hashes to not broken values */
|
|
E_old_pw_hash(new_lm_hash, old_lm_hash, hash1.hash);
|
|
E_old_pw_hash(old_lm_hash, new_lm_hash, hash2.hash);
|
|
E_old_pw_hash(new_nt_hash, old_nt_hash, hash3.hash);
|
|
E_old_pw_hash(old_nt_hash, new_nt_hash, hash4.hash);
|
|
E_old_pw_hash(old_lm_hash, new_nt_hash, hash5.hash);
|
|
E_old_pw_hash(old_nt_hash, new_lm_hash, hash6.hash);
|
|
|
|
r.in.user_handle = &user_handle;
|
|
r.in.lm_present = 1;
|
|
r.in.old_lm_crypted = &hash1;
|
|
r.in.new_lm_crypted = &hash2;
|
|
r.in.nt_present = 1;
|
|
r.in.old_nt_crypted = &hash3;
|
|
r.in.new_nt_crypted = &hash4;
|
|
r.in.cross1_present = 1;
|
|
r.in.nt_cross = &hash5;
|
|
r.in.cross2_present = 1;
|
|
r.in.lm_cross = &hash6;
|
|
|
|
torture_assert_ntstatus_ok(tctx, dcerpc_samr_ChangePasswordUser_r(b, tctx, &r),
|
|
"ChangePasswordUser failed");
|
|
torture_comment(tctx, "(%s:%s) old_password[%s] new_password[%s] status[%s]\n",
|
|
__location__, __FUNCTION__,
|
|
oldpass, newpass, nt_errstr(r.out.result));
|
|
if (NT_STATUS_EQUAL(r.out.result, NT_STATUS_PASSWORD_RESTRICTION)) {
|
|
torture_comment(tctx, "ChangePasswordUser returned: %s perhaps min password age? (not fatal)\n", nt_errstr(r.out.result));
|
|
} else if (!NT_STATUS_IS_OK(r.out.result)) {
|
|
torture_result(tctx, TORTURE_FAIL, "ChangePasswordUser failed - %s\n", nt_errstr(r.out.result));
|
|
ret = false;
|
|
} else {
|
|
changed = true;
|
|
*password = newpass;
|
|
}
|
|
|
|
r.in.user_handle = &user_handle;
|
|
r.in.lm_present = 1;
|
|
r.in.old_lm_crypted = &hash1;
|
|
r.in.new_lm_crypted = &hash2;
|
|
r.in.nt_present = 1;
|
|
r.in.old_nt_crypted = &hash3;
|
|
r.in.new_nt_crypted = &hash4;
|
|
r.in.cross1_present = 1;
|
|
r.in.nt_cross = &hash5;
|
|
r.in.cross2_present = 1;
|
|
r.in.lm_cross = &hash6;
|
|
|
|
if (changed) {
|
|
torture_assert_ntstatus_ok(tctx, dcerpc_samr_ChangePasswordUser_r(b, tctx, &r),
|
|
"ChangePasswordUser failed");
|
|
torture_comment(tctx, "(%s:%s) old_password[%s] new_password[%s] status[%s]\n",
|
|
__location__, __FUNCTION__,
|
|
oldpass, newpass, nt_errstr(r.out.result));
|
|
if (NT_STATUS_EQUAL(r.out.result, NT_STATUS_PASSWORD_RESTRICTION)) {
|
|
torture_comment(tctx, "ChangePasswordUser returned: %s perhaps min password age? (not fatal)\n", nt_errstr(r.out.result));
|
|
} else if (!NT_STATUS_EQUAL(r.out.result, NT_STATUS_WRONG_PASSWORD)) {
|
|
torture_result(tctx, TORTURE_FAIL, "ChangePasswordUser failed: expected NT_STATUS_WRONG_PASSWORD because we already changed the password, got %s\n", nt_errstr(r.out.result));
|
|
ret = false;
|
|
}
|
|
}
|
|
|
|
|
|
if (!test_samr_handle_Close(b, tctx, &user_handle)) {
|
|
ret = false;
|
|
}
|
|
|
|
return ret;
|
|
}
|
|
|
|
|
|
static bool test_OemChangePasswordUser2(struct dcerpc_pipe *p,
|
|
struct torture_context *tctx,
|
|
const char *acct_name,
|
|
struct policy_handle *handle, char **password)
|
|
{
|
|
struct samr_OemChangePasswordUser2 r;
|
|
bool ret = true;
|
|
struct samr_Password lm_verifier;
|
|
struct samr_CryptPassword lm_pass;
|
|
struct lsa_AsciiString server, account, account_bad;
|
|
char *oldpass;
|
|
char *newpass;
|
|
struct dcerpc_binding_handle *b = p->binding_handle;
|
|
uint8_t old_lm_hash[16], new_lm_hash[16];
|
|
|
|
struct samr_GetDomPwInfo dom_pw_info;
|
|
struct samr_PwInfo info;
|
|
int policy_min_pw_len = 0;
|
|
|
|
struct lsa_String domain_name;
|
|
|
|
domain_name.string = "";
|
|
dom_pw_info.in.domain_name = &domain_name;
|
|
dom_pw_info.out.info = &info;
|
|
|
|
torture_comment(tctx, "Testing OemChangePasswordUser2\n");
|
|
|
|
torture_assert(tctx, *password != NULL,
|
|
"Failing OemChangePasswordUser2 as old password was NULL. Previous test failed?");
|
|
|
|
oldpass = *password;
|
|
|
|
torture_assert_ntstatus_ok(tctx, dcerpc_samr_GetDomPwInfo_r(b, tctx, &dom_pw_info),
|
|
"GetDomPwInfo failed");
|
|
if (NT_STATUS_IS_OK(dom_pw_info.out.result)) {
|
|
policy_min_pw_len = dom_pw_info.out.info->min_password_length;
|
|
}
|
|
|
|
newpass = samr_rand_pass(tctx, policy_min_pw_len);
|
|
|
|
server.string = talloc_asprintf(tctx, "\\\\%s", dcerpc_server_name(p));
|
|
account.string = acct_name;
|
|
|
|
E_deshash(oldpass, old_lm_hash);
|
|
E_deshash(newpass, new_lm_hash);
|
|
|
|
encode_pw_buffer(lm_pass.data, newpass, STR_ASCII);
|
|
arcfour_crypt(lm_pass.data, old_lm_hash, 516);
|
|
E_old_pw_hash(new_lm_hash, old_lm_hash, lm_verifier.hash);
|
|
|
|
r.in.server = &server;
|
|
r.in.account = &account;
|
|
r.in.password = &lm_pass;
|
|
r.in.hash = &lm_verifier;
|
|
|
|
/* Break the verification */
|
|
lm_verifier.hash[0]++;
|
|
|
|
torture_assert_ntstatus_ok(tctx, dcerpc_samr_OemChangePasswordUser2_r(b, tctx, &r),
|
|
"OemChangePasswordUser2 failed");
|
|
torture_comment(tctx, "(%s:%s) old_password[%s] new_password[%s] status[%s]\n",
|
|
__location__, __FUNCTION__,
|
|
oldpass, newpass, nt_errstr(r.out.result));
|
|
|
|
if (!NT_STATUS_EQUAL(r.out.result, NT_STATUS_PASSWORD_RESTRICTION)
|
|
&& !NT_STATUS_EQUAL(r.out.result, NT_STATUS_WRONG_PASSWORD)) {
|
|
torture_result(tctx, TORTURE_FAIL, "OemChangePasswordUser2 failed, should have returned WRONG_PASSWORD (or at least 'PASSWORD_RESTRICTON') for invalid password verifier - %s\n",
|
|
nt_errstr(r.out.result));
|
|
ret = false;
|
|
}
|
|
|
|
encode_pw_buffer(lm_pass.data, newpass, STR_ASCII);
|
|
/* Break the old password */
|
|
old_lm_hash[0]++;
|
|
arcfour_crypt(lm_pass.data, old_lm_hash, 516);
|
|
/* unbreak it for the next operation */
|
|
old_lm_hash[0]--;
|
|
E_old_pw_hash(new_lm_hash, old_lm_hash, lm_verifier.hash);
|
|
|
|
r.in.server = &server;
|
|
r.in.account = &account;
|
|
r.in.password = &lm_pass;
|
|
r.in.hash = &lm_verifier;
|
|
|
|
torture_assert_ntstatus_ok(tctx, dcerpc_samr_OemChangePasswordUser2_r(b, tctx, &r),
|
|
"OemChangePasswordUser2 failed");
|
|
torture_comment(tctx, "(%s:%s) old_password[%s] new_password[%s] status[%s]\n",
|
|
__location__, __FUNCTION__,
|
|
oldpass, newpass, nt_errstr(r.out.result));
|
|
|
|
if (!NT_STATUS_EQUAL(r.out.result, NT_STATUS_PASSWORD_RESTRICTION)
|
|
&& !NT_STATUS_EQUAL(r.out.result, NT_STATUS_WRONG_PASSWORD)) {
|
|
torture_result(tctx, TORTURE_FAIL, "OemChangePasswordUser2 failed, should have returned WRONG_PASSWORD (or at least 'PASSWORD_RESTRICTON') for invalidly encrpted password - %s\n",
|
|
nt_errstr(r.out.result));
|
|
ret = false;
|
|
}
|
|
|
|
encode_pw_buffer(lm_pass.data, newpass, STR_ASCII);
|
|
arcfour_crypt(lm_pass.data, old_lm_hash, 516);
|
|
|
|
r.in.server = &server;
|
|
r.in.account = &account;
|
|
r.in.password = &lm_pass;
|
|
r.in.hash = NULL;
|
|
|
|
torture_assert_ntstatus_ok(tctx, dcerpc_samr_OemChangePasswordUser2_r(b, tctx, &r),
|
|
"OemChangePasswordUser2 failed");
|
|
torture_comment(tctx, "(%s:%s) old_password[%s] new_password[%s] status[%s]\n",
|
|
__location__, __FUNCTION__,
|
|
oldpass, newpass, nt_errstr(r.out.result));
|
|
|
|
if (!NT_STATUS_EQUAL(r.out.result, NT_STATUS_PASSWORD_RESTRICTION)
|
|
&& !NT_STATUS_EQUAL(r.out.result, NT_STATUS_INVALID_PARAMETER)) {
|
|
torture_result(tctx, TORTURE_FAIL, "OemChangePasswordUser2 failed, should have returned INVALID_PARAMETER (or at least 'PASSWORD_RESTRICTON') for no supplied validation hash - %s\n",
|
|
nt_errstr(r.out.result));
|
|
ret = false;
|
|
}
|
|
|
|
/* This shouldn't be a valid name */
|
|
account_bad.string = TEST_ACCOUNT_NAME "XX";
|
|
r.in.account = &account_bad;
|
|
|
|
torture_assert_ntstatus_ok(tctx, dcerpc_samr_OemChangePasswordUser2_r(b, tctx, &r),
|
|
"OemChangePasswordUser2 failed");
|
|
torture_comment(tctx, "(%s:%s) old_password[%s] new_password[%s] status[%s]\n",
|
|
__location__, __FUNCTION__,
|
|
oldpass, newpass, nt_errstr(r.out.result));
|
|
|
|
if (!NT_STATUS_EQUAL(r.out.result, NT_STATUS_INVALID_PARAMETER)) {
|
|
torture_result(tctx, TORTURE_FAIL, "OemChangePasswordUser2 failed, should have returned INVALID_PARAMETER for no supplied validation hash and invalid user - %s\n",
|
|
nt_errstr(r.out.result));
|
|
ret = false;
|
|
}
|
|
|
|
/* This shouldn't be a valid name */
|
|
account_bad.string = TEST_ACCOUNT_NAME "XX";
|
|
r.in.account = &account_bad;
|
|
r.in.password = &lm_pass;
|
|
r.in.hash = &lm_verifier;
|
|
|
|
torture_assert_ntstatus_ok(tctx, dcerpc_samr_OemChangePasswordUser2_r(b, tctx, &r),
|
|
"OemChangePasswordUser2 failed");
|
|
torture_comment(tctx, "(%s:%s) old_password[%s] new_password[%s] status[%s]\n",
|
|
__location__, __FUNCTION__,
|
|
oldpass, newpass, nt_errstr(r.out.result));
|
|
|
|
if (!NT_STATUS_EQUAL(r.out.result, NT_STATUS_WRONG_PASSWORD)) {
|
|
torture_result(tctx, TORTURE_FAIL, "OemChangePasswordUser2 failed, should have returned WRONG_PASSWORD for invalid user - %s\n",
|
|
nt_errstr(r.out.result));
|
|
ret = false;
|
|
}
|
|
|
|
/* This shouldn't be a valid name */
|
|
account_bad.string = TEST_ACCOUNT_NAME "XX";
|
|
r.in.account = &account_bad;
|
|
r.in.password = NULL;
|
|
r.in.hash = &lm_verifier;
|
|
|
|
torture_assert_ntstatus_ok(tctx, dcerpc_samr_OemChangePasswordUser2_r(b, tctx, &r),
|
|
"OemChangePasswordUser2 failed");
|
|
torture_comment(tctx, "(%s:%s) old_password[%s] new_password[%s] status[%s]\n",
|
|
__location__, __FUNCTION__,
|
|
oldpass, newpass, nt_errstr(r.out.result));
|
|
|
|
if (!NT_STATUS_EQUAL(r.out.result, NT_STATUS_INVALID_PARAMETER)) {
|
|
torture_result(tctx, TORTURE_FAIL, "OemChangePasswordUser2 failed, should have returned INVALID_PARAMETER for no supplied password and invalid user - %s\n",
|
|
nt_errstr(r.out.result));
|
|
ret = false;
|
|
}
|
|
|
|
E_deshash(oldpass, old_lm_hash);
|
|
E_deshash(newpass, new_lm_hash);
|
|
|
|
encode_pw_buffer(lm_pass.data, newpass, STR_ASCII);
|
|
arcfour_crypt(lm_pass.data, old_lm_hash, 516);
|
|
E_old_pw_hash(new_lm_hash, old_lm_hash, lm_verifier.hash);
|
|
|
|
r.in.server = &server;
|
|
r.in.account = &account;
|
|
r.in.password = &lm_pass;
|
|
r.in.hash = &lm_verifier;
|
|
|
|
torture_assert_ntstatus_ok(tctx, dcerpc_samr_OemChangePasswordUser2_r(b, tctx, &r),
|
|
"OemChangePasswordUser2 failed");
|
|
torture_comment(tctx, "(%s:%s) old_password[%s] new_password[%s] status[%s]\n",
|
|
__location__, __FUNCTION__,
|
|
oldpass, newpass, nt_errstr(r.out.result));
|
|
|
|
if (NT_STATUS_EQUAL(r.out.result, NT_STATUS_PASSWORD_RESTRICTION)) {
|
|
torture_comment(tctx, "OemChangePasswordUser2 returned: %s perhaps min password age? (not fatal)\n", nt_errstr(r.out.result));
|
|
} else if (!NT_STATUS_IS_OK(r.out.result)) {
|
|
torture_result(tctx, TORTURE_FAIL, "OemChangePasswordUser2 failed - %s\n", nt_errstr(r.out.result));
|
|
ret = false;
|
|
} else {
|
|
*password = newpass;
|
|
}
|
|
|
|
return ret;
|
|
}
|
|
|
|
|
|
static bool test_ChangePasswordUser2(struct dcerpc_pipe *p, struct torture_context *tctx,
|
|
const char *acct_name,
|
|
char **password,
|
|
char *newpass, bool allow_password_restriction)
|
|
{
|
|
struct samr_ChangePasswordUser2 r;
|
|
bool ret = true;
|
|
struct lsa_String server, account;
|
|
struct samr_CryptPassword nt_pass, lm_pass;
|
|
struct samr_Password nt_verifier, lm_verifier;
|
|
char *oldpass;
|
|
struct dcerpc_binding_handle *b = p->binding_handle;
|
|
uint8_t old_nt_hash[16], new_nt_hash[16];
|
|
uint8_t old_lm_hash[16], new_lm_hash[16];
|
|
|
|
struct samr_GetDomPwInfo dom_pw_info;
|
|
struct samr_PwInfo info;
|
|
|
|
struct lsa_String domain_name;
|
|
|
|
domain_name.string = "";
|
|
dom_pw_info.in.domain_name = &domain_name;
|
|
dom_pw_info.out.info = &info;
|
|
|
|
torture_comment(tctx, "Testing ChangePasswordUser2 on %s\n", acct_name);
|
|
|
|
torture_assert(tctx, *password != NULL,
|
|
"Failing ChangePasswordUser2 as old password was NULL. Previous test failed?");
|
|
oldpass = *password;
|
|
|
|
if (!newpass) {
|
|
int policy_min_pw_len = 0;
|
|
torture_assert_ntstatus_ok(tctx, dcerpc_samr_GetDomPwInfo_r(b, tctx, &dom_pw_info),
|
|
"GetDomPwInfo failed");
|
|
if (NT_STATUS_IS_OK(dom_pw_info.out.result)) {
|
|
policy_min_pw_len = dom_pw_info.out.info->min_password_length;
|
|
}
|
|
|
|
newpass = samr_rand_pass(tctx, policy_min_pw_len);
|
|
}
|
|
|
|
server.string = talloc_asprintf(tctx, "\\\\%s", dcerpc_server_name(p));
|
|
init_lsa_String(&account, acct_name);
|
|
|
|
E_md4hash(oldpass, old_nt_hash);
|
|
E_md4hash(newpass, new_nt_hash);
|
|
|
|
E_deshash(oldpass, old_lm_hash);
|
|
E_deshash(newpass, new_lm_hash);
|
|
|
|
encode_pw_buffer(lm_pass.data, newpass, STR_ASCII|STR_TERMINATE);
|
|
arcfour_crypt(lm_pass.data, old_lm_hash, 516);
|
|
E_old_pw_hash(new_nt_hash, old_lm_hash, lm_verifier.hash);
|
|
|
|
encode_pw_buffer(nt_pass.data, newpass, STR_UNICODE);
|
|
arcfour_crypt(nt_pass.data, old_nt_hash, 516);
|
|
E_old_pw_hash(new_nt_hash, old_nt_hash, nt_verifier.hash);
|
|
|
|
r.in.server = &server;
|
|
r.in.account = &account;
|
|
r.in.nt_password = &nt_pass;
|
|
r.in.nt_verifier = &nt_verifier;
|
|
r.in.lm_change = 1;
|
|
r.in.lm_password = &lm_pass;
|
|
r.in.lm_verifier = &lm_verifier;
|
|
|
|
torture_assert_ntstatus_ok(tctx, dcerpc_samr_ChangePasswordUser2_r(b, tctx, &r),
|
|
"ChangePasswordUser2 failed");
|
|
torture_comment(tctx, "(%s:%s) old_password[%s] new_password[%s] status[%s]\n",
|
|
__location__, __FUNCTION__,
|
|
oldpass, newpass, nt_errstr(r.out.result));
|
|
|
|
if (allow_password_restriction && NT_STATUS_EQUAL(r.out.result, NT_STATUS_PASSWORD_RESTRICTION)) {
|
|
torture_comment(tctx, "ChangePasswordUser2 returned: %s perhaps min password age? (not fatal)\n", nt_errstr(r.out.result));
|
|
} else if (!NT_STATUS_IS_OK(r.out.result)) {
|
|
torture_result(tctx, TORTURE_FAIL, "ChangePasswordUser2 failed - %s\n", nt_errstr(r.out.result));
|
|
ret = false;
|
|
} else {
|
|
*password = newpass;
|
|
}
|
|
|
|
return ret;
|
|
}
|
|
|
|
|
|
static bool test_ChangePasswordUser2_ntstatus(struct dcerpc_pipe *p, struct torture_context *tctx,
|
|
const char *acct_name,
|
|
const char *password, NTSTATUS status)
|
|
{
|
|
struct samr_ChangePasswordUser2 r;
|
|
struct lsa_String server, account;
|
|
struct samr_CryptPassword nt_pass, lm_pass;
|
|
struct samr_Password nt_verifier, lm_verifier;
|
|
const char *oldpass;
|
|
struct dcerpc_binding_handle *b = p->binding_handle;
|
|
uint8_t old_nt_hash[16], new_nt_hash[16];
|
|
uint8_t old_lm_hash[16], new_lm_hash[16];
|
|
|
|
struct samr_GetDomPwInfo dom_pw_info;
|
|
struct samr_PwInfo info;
|
|
|
|
struct lsa_String domain_name;
|
|
char *newpass;
|
|
int policy_min_pw_len = 0;
|
|
|
|
domain_name.string = "";
|
|
dom_pw_info.in.domain_name = &domain_name;
|
|
dom_pw_info.out.info = &info;
|
|
|
|
torture_comment(tctx, "Testing ChangePasswordUser2 on %s\n", acct_name);
|
|
|
|
oldpass = password;
|
|
|
|
torture_assert_ntstatus_ok(tctx, dcerpc_samr_GetDomPwInfo_r(b, tctx, &dom_pw_info),
|
|
"GetDomPwInfo failed");
|
|
if (NT_STATUS_IS_OK(dom_pw_info.out.result)) {
|
|
policy_min_pw_len = dom_pw_info.out.info->min_password_length;
|
|
}
|
|
|
|
newpass = samr_rand_pass(tctx, policy_min_pw_len);
|
|
|
|
server.string = talloc_asprintf(tctx, "\\\\%s", dcerpc_server_name(p));
|
|
init_lsa_String(&account, acct_name);
|
|
|
|
E_md4hash(oldpass, old_nt_hash);
|
|
E_md4hash(newpass, new_nt_hash);
|
|
|
|
E_deshash(oldpass, old_lm_hash);
|
|
E_deshash(newpass, new_lm_hash);
|
|
|
|
encode_pw_buffer(lm_pass.data, newpass, STR_ASCII|STR_TERMINATE);
|
|
arcfour_crypt(lm_pass.data, old_lm_hash, 516);
|
|
E_old_pw_hash(new_nt_hash, old_lm_hash, lm_verifier.hash);
|
|
|
|
encode_pw_buffer(nt_pass.data, newpass, STR_UNICODE);
|
|
arcfour_crypt(nt_pass.data, old_nt_hash, 516);
|
|
E_old_pw_hash(new_nt_hash, old_nt_hash, nt_verifier.hash);
|
|
|
|
r.in.server = &server;
|
|
r.in.account = &account;
|
|
r.in.nt_password = &nt_pass;
|
|
r.in.nt_verifier = &nt_verifier;
|
|
r.in.lm_change = 1;
|
|
r.in.lm_password = &lm_pass;
|
|
r.in.lm_verifier = &lm_verifier;
|
|
|
|
torture_assert_ntstatus_ok(tctx, dcerpc_samr_ChangePasswordUser2_r(b, tctx, &r),
|
|
"ChangePasswordUser2 failed");
|
|
torture_comment(tctx, "(%s:%s) old_password[%s] new_password[%s] status[%s]\n",
|
|
__location__, __FUNCTION__,
|
|
oldpass, newpass, nt_errstr(r.out.result));
|
|
|
|
if (NT_STATUS_EQUAL(r.out.result, NT_STATUS_PASSWORD_RESTRICTION)) {
|
|
torture_comment(tctx, "ChangePasswordUser2 returned: %s perhaps min password age? (not fatal)\n", nt_errstr(r.out.result));
|
|
} else {
|
|
torture_assert_ntstatus_equal(tctx, r.out.result, status, "ChangePasswordUser2 returned unexpected value");
|
|
}
|
|
|
|
return true;
|
|
}
|
|
|
|
|
|
bool test_ChangePasswordUser3(struct dcerpc_pipe *p, struct torture_context *tctx,
|
|
const char *account_string,
|
|
int policy_min_pw_len,
|
|
char **password,
|
|
const char *newpass,
|
|
NTTIME last_password_change,
|
|
bool handle_reject_reason)
|
|
{
|
|
struct samr_ChangePasswordUser3 r;
|
|
bool ret = true;
|
|
struct lsa_String server, account, account_bad;
|
|
struct samr_CryptPassword nt_pass, lm_pass;
|
|
struct samr_Password nt_verifier, lm_verifier;
|
|
char *oldpass;
|
|
struct dcerpc_binding_handle *b = p->binding_handle;
|
|
uint8_t old_nt_hash[16], new_nt_hash[16];
|
|
uint8_t old_lm_hash[16], new_lm_hash[16];
|
|
NTTIME t;
|
|
struct samr_DomInfo1 *dominfo = NULL;
|
|
struct userPwdChangeFailureInformation *reject = NULL;
|
|
|
|
torture_comment(tctx, "Testing ChangePasswordUser3\n");
|
|
|
|
if (newpass == NULL) {
|
|
do {
|
|
if (policy_min_pw_len == 0) {
|
|
newpass = samr_rand_pass(tctx, policy_min_pw_len);
|
|
} else {
|
|
newpass = samr_rand_pass_fixed_len(tctx, policy_min_pw_len);
|
|
}
|
|
} while (check_password_quality(newpass) == false);
|
|
} else {
|
|
torture_comment(tctx, "Using password '%s'\n", newpass);
|
|
}
|
|
|
|
torture_assert(tctx, *password != NULL,
|
|
"Failing ChangePasswordUser3 as old password was NULL. Previous test failed?");
|
|
|
|
oldpass = *password;
|
|
server.string = talloc_asprintf(tctx, "\\\\%s", dcerpc_server_name(p));
|
|
init_lsa_String(&account, account_string);
|
|
|
|
E_md4hash(oldpass, old_nt_hash);
|
|
E_md4hash(newpass, new_nt_hash);
|
|
|
|
E_deshash(oldpass, old_lm_hash);
|
|
E_deshash(newpass, new_lm_hash);
|
|
|
|
encode_pw_buffer(lm_pass.data, newpass, STR_UNICODE);
|
|
arcfour_crypt(lm_pass.data, old_nt_hash, 516);
|
|
E_old_pw_hash(new_nt_hash, old_lm_hash, lm_verifier.hash);
|
|
|
|
encode_pw_buffer(nt_pass.data, newpass, STR_UNICODE);
|
|
arcfour_crypt(nt_pass.data, old_nt_hash, 516);
|
|
E_old_pw_hash(new_nt_hash, old_nt_hash, nt_verifier.hash);
|
|
|
|
/* Break the verification */
|
|
nt_verifier.hash[0]++;
|
|
|
|
r.in.server = &server;
|
|
r.in.account = &account;
|
|
r.in.nt_password = &nt_pass;
|
|
r.in.nt_verifier = &nt_verifier;
|
|
r.in.lm_change = 1;
|
|
r.in.lm_password = &lm_pass;
|
|
r.in.lm_verifier = &lm_verifier;
|
|
r.in.password3 = NULL;
|
|
r.out.dominfo = &dominfo;
|
|
r.out.reject = &reject;
|
|
|
|
torture_assert_ntstatus_ok(tctx, dcerpc_samr_ChangePasswordUser3_r(b, tctx, &r),
|
|
"ChangePasswordUser3 failed");
|
|
torture_comment(tctx, "(%s:%s) old_password[%s] new_password[%s] status[%s]\n",
|
|
__location__, __FUNCTION__,
|
|
oldpass, newpass, nt_errstr(r.out.result));
|
|
if (!NT_STATUS_EQUAL(r.out.result, NT_STATUS_PASSWORD_RESTRICTION) &&
|
|
(!NT_STATUS_EQUAL(r.out.result, NT_STATUS_WRONG_PASSWORD))) {
|
|
torture_result(tctx, TORTURE_FAIL, "ChangePasswordUser3 failed, should have returned WRONG_PASSWORD (or at least 'PASSWORD_RESTRICTON') for invalid password verifier - %s\n",
|
|
nt_errstr(r.out.result));
|
|
ret = false;
|
|
}
|
|
|
|
encode_pw_buffer(lm_pass.data, newpass, STR_UNICODE);
|
|
arcfour_crypt(lm_pass.data, old_nt_hash, 516);
|
|
E_old_pw_hash(new_nt_hash, old_lm_hash, lm_verifier.hash);
|
|
|
|
encode_pw_buffer(nt_pass.data, newpass, STR_UNICODE);
|
|
/* Break the NT hash */
|
|
old_nt_hash[0]++;
|
|
arcfour_crypt(nt_pass.data, old_nt_hash, 516);
|
|
/* Unbreak it again */
|
|
old_nt_hash[0]--;
|
|
E_old_pw_hash(new_nt_hash, old_nt_hash, nt_verifier.hash);
|
|
|
|
r.in.server = &server;
|
|
r.in.account = &account;
|
|
r.in.nt_password = &nt_pass;
|
|
r.in.nt_verifier = &nt_verifier;
|
|
r.in.lm_change = 1;
|
|
r.in.lm_password = &lm_pass;
|
|
r.in.lm_verifier = &lm_verifier;
|
|
r.in.password3 = NULL;
|
|
r.out.dominfo = &dominfo;
|
|
r.out.reject = &reject;
|
|
|
|
torture_assert_ntstatus_ok(tctx, dcerpc_samr_ChangePasswordUser3_r(b, tctx, &r),
|
|
"ChangePasswordUser3 failed");
|
|
torture_comment(tctx, "(%s:%s) old_password[%s] new_password[%s] status[%s]\n",
|
|
__location__, __FUNCTION__,
|
|
oldpass, newpass, nt_errstr(r.out.result));
|
|
if (!NT_STATUS_EQUAL(r.out.result, NT_STATUS_PASSWORD_RESTRICTION) &&
|
|
(!NT_STATUS_EQUAL(r.out.result, NT_STATUS_WRONG_PASSWORD))) {
|
|
torture_result(tctx, TORTURE_FAIL, "ChangePasswordUser3 failed, should have returned WRONG_PASSWORD (or at least 'PASSWORD_RESTRICTON') for invalidly encrpted password - %s\n",
|
|
nt_errstr(r.out.result));
|
|
ret = false;
|
|
}
|
|
|
|
/* This shouldn't be a valid name */
|
|
init_lsa_String(&account_bad, talloc_asprintf(tctx, "%sXX", account_string));
|
|
|
|
r.in.account = &account_bad;
|
|
torture_assert_ntstatus_ok(tctx, dcerpc_samr_ChangePasswordUser3_r(b, tctx, &r),
|
|
"ChangePasswordUser3 failed");
|
|
torture_comment(tctx, "(%s:%s) old_password[%s] new_password[%s] status[%s]\n",
|
|
__location__, __FUNCTION__,
|
|
oldpass, newpass, nt_errstr(r.out.result));
|
|
if (!NT_STATUS_EQUAL(r.out.result, NT_STATUS_WRONG_PASSWORD)) {
|
|
torture_result(tctx, TORTURE_FAIL, "ChangePasswordUser3 failed, should have returned WRONG_PASSWORD for invalid username - %s\n",
|
|
nt_errstr(r.out.result));
|
|
ret = false;
|
|
}
|
|
|
|
E_md4hash(oldpass, old_nt_hash);
|
|
E_md4hash(newpass, new_nt_hash);
|
|
|
|
E_deshash(oldpass, old_lm_hash);
|
|
E_deshash(newpass, new_lm_hash);
|
|
|
|
encode_pw_buffer(lm_pass.data, newpass, STR_UNICODE);
|
|
arcfour_crypt(lm_pass.data, old_nt_hash, 516);
|
|
E_old_pw_hash(new_nt_hash, old_lm_hash, lm_verifier.hash);
|
|
|
|
encode_pw_buffer(nt_pass.data, newpass, STR_UNICODE);
|
|
arcfour_crypt(nt_pass.data, old_nt_hash, 516);
|
|
E_old_pw_hash(new_nt_hash, old_nt_hash, nt_verifier.hash);
|
|
|
|
r.in.server = &server;
|
|
r.in.account = &account;
|
|
r.in.nt_password = &nt_pass;
|
|
r.in.nt_verifier = &nt_verifier;
|
|
r.in.lm_change = 1;
|
|
r.in.lm_password = &lm_pass;
|
|
r.in.lm_verifier = &lm_verifier;
|
|
r.in.password3 = NULL;
|
|
r.out.dominfo = &dominfo;
|
|
r.out.reject = &reject;
|
|
|
|
unix_to_nt_time(&t, time(NULL));
|
|
|
|
torture_assert_ntstatus_ok(tctx, dcerpc_samr_ChangePasswordUser3_r(b, tctx, &r),
|
|
"ChangePasswordUser3 failed");
|
|
torture_comment(tctx, "(%s:%s) old_password[%s] new_password[%s] status[%s]\n",
|
|
__location__, __FUNCTION__,
|
|
oldpass, newpass, nt_errstr(r.out.result));
|
|
|
|
torture_comment(tctx, "(%s): dominfo[%s], reject[%s], handle_reject_reason[%s], "
|
|
"last_password_change[%s], dominfo->min_password_age[%lld]\n",
|
|
__location__,
|
|
(dominfo == NULL)? "NULL" : "present",
|
|
reject ? "true" : "false",
|
|
handle_reject_reason ? "true" : "false",
|
|
null_nttime(last_password_change) ? "null" : "not null",
|
|
dominfo ? (long long)dominfo->min_password_age : (long long)0);
|
|
|
|
if (NT_STATUS_EQUAL(r.out.result, NT_STATUS_PASSWORD_RESTRICTION)
|
|
&& dominfo
|
|
&& reject
|
|
&& handle_reject_reason
|
|
&& (!null_nttime(last_password_change) || !dominfo->min_password_age)) {
|
|
if (dominfo->password_properties & DOMAIN_REFUSE_PASSWORD_CHANGE ) {
|
|
|
|
if (reject && (reject->extendedFailureReason != SAM_PWD_CHANGE_NO_ERROR)) {
|
|
torture_result(tctx, TORTURE_FAIL, "expected SAM_PWD_CHANGE_NO_ERROR (%d), got %d\n",
|
|
SAM_PWD_CHANGE_NO_ERROR, reject->extendedFailureReason);
|
|
return false;
|
|
}
|
|
}
|
|
|
|
/* We tested the order of precendence which is as follows:
|
|
|
|
* pwd min_age
|
|
* pwd length
|
|
* pwd complexity
|
|
* pwd history
|
|
|
|
Guenther */
|
|
|
|
if ((dominfo->min_password_age < 0) && !null_nttime(last_password_change) &&
|
|
(last_password_change - dominfo->min_password_age > t)) {
|
|
|
|
if (reject->extendedFailureReason != SAM_PWD_CHANGE_NO_ERROR) {
|
|
torture_result(tctx, TORTURE_FAIL, "expected SAM_PWD_CHANGE_NO_ERROR (%d), got %d\n",
|
|
SAM_PWD_CHANGE_NO_ERROR, reject->extendedFailureReason);
|
|
return false;
|
|
}
|
|
|
|
} else if ((dominfo->min_password_length > 0) &&
|
|
(strlen(newpass) < dominfo->min_password_length)) {
|
|
|
|
if (reject->extendedFailureReason != SAM_PWD_CHANGE_PASSWORD_TOO_SHORT) {
|
|
torture_result(tctx, TORTURE_FAIL, "expected SAM_PWD_CHANGE_PASSWORD_TOO_SHORT (%d), got %d\n",
|
|
SAM_PWD_CHANGE_PASSWORD_TOO_SHORT, reject->extendedFailureReason);
|
|
return false;
|
|
}
|
|
|
|
} else if ((dominfo->password_history_length > 0) &&
|
|
strequal(oldpass, newpass)) {
|
|
|
|
if (reject->extendedFailureReason != SAM_PWD_CHANGE_PWD_IN_HISTORY) {
|
|
torture_result(tctx, TORTURE_FAIL, "expected SAM_PWD_CHANGE_PWD_IN_HISTORY (%d), got %d\n",
|
|
SAM_PWD_CHANGE_PWD_IN_HISTORY, reject->extendedFailureReason);
|
|
return false;
|
|
}
|
|
} else if (dominfo->password_properties & DOMAIN_PASSWORD_COMPLEX) {
|
|
|
|
if (reject->extendedFailureReason != SAM_PWD_CHANGE_NOT_COMPLEX) {
|
|
torture_result(tctx, TORTURE_FAIL, "expected SAM_PWD_CHANGE_NOT_COMPLEX (%d), got %d\n",
|
|
SAM_PWD_CHANGE_NOT_COMPLEX, reject->extendedFailureReason);
|
|
return false;
|
|
}
|
|
|
|
}
|
|
|
|
if (reject->extendedFailureReason == SAM_PWD_CHANGE_PASSWORD_TOO_SHORT) {
|
|
/* retry with adjusted size */
|
|
return test_ChangePasswordUser3(p, tctx, account_string,
|
|
dominfo->min_password_length,
|
|
password, NULL, 0, false);
|
|
|
|
}
|
|
|
|
} else if (NT_STATUS_EQUAL(r.out.result, NT_STATUS_PASSWORD_RESTRICTION)) {
|
|
if (reject && reject->extendedFailureReason != SAM_PWD_CHANGE_NO_ERROR) {
|
|
torture_result(tctx, TORTURE_FAIL, "expected SAM_PWD_CHANGE_NO_ERROR (%d), got %d\n",
|
|
SAM_PWD_CHANGE_NO_ERROR, reject->extendedFailureReason);
|
|
return false;
|
|
}
|
|
/* Perhaps the server has a 'min password age' set? */
|
|
|
|
} else {
|
|
torture_assert_ntstatus_ok(tctx, r.out.result, "ChangePasswordUser3");
|
|
|
|
*password = talloc_strdup(tctx, newpass);
|
|
}
|
|
|
|
return ret;
|
|
}
|
|
|
|
bool test_ChangePasswordRandomBytes(struct dcerpc_pipe *p, struct torture_context *tctx,
|
|
const char *account_string,
|
|
struct policy_handle *handle,
|
|
char **password)
|
|
{
|
|
NTSTATUS status;
|
|
struct samr_ChangePasswordUser3 r;
|
|
struct samr_SetUserInfo s;
|
|
union samr_UserInfo u;
|
|
DATA_BLOB session_key;
|
|
DATA_BLOB confounded_session_key = data_blob_talloc(tctx, NULL, 16);
|
|
uint8_t confounder[16];
|
|
MD5_CTX ctx;
|
|
|
|
bool ret = true;
|
|
struct lsa_String server, account;
|
|
struct samr_CryptPassword nt_pass;
|
|
struct samr_Password nt_verifier;
|
|
DATA_BLOB new_random_pass;
|
|
char *newpass;
|
|
char *oldpass;
|
|
struct dcerpc_binding_handle *b = p->binding_handle;
|
|
uint8_t old_nt_hash[16], new_nt_hash[16];
|
|
NTTIME t;
|
|
struct samr_DomInfo1 *dominfo = NULL;
|
|
struct userPwdChangeFailureInformation *reject = NULL;
|
|
|
|
new_random_pass = samr_very_rand_pass(tctx, 128);
|
|
|
|
torture_assert(tctx, *password != NULL,
|
|
"Failing ChangePasswordUser3 as old password was NULL. Previous test failed?");
|
|
|
|
oldpass = *password;
|
|
server.string = talloc_asprintf(tctx, "\\\\%s", dcerpc_server_name(p));
|
|
init_lsa_String(&account, account_string);
|
|
|
|
s.in.user_handle = handle;
|
|
s.in.info = &u;
|
|
s.in.level = 25;
|
|
|
|
ZERO_STRUCT(u);
|
|
|
|
u.info25.info.fields_present = SAMR_FIELD_NT_PASSWORD_PRESENT;
|
|
|
|
set_pw_in_buffer(u.info25.password.data, &new_random_pass);
|
|
|
|
status = dcerpc_fetch_session_key(p, &session_key);
|
|
if (!NT_STATUS_IS_OK(status)) {
|
|
torture_result(tctx, TORTURE_FAIL, "SetUserInfo level %u - no session key - %s\n",
|
|
s.in.level, nt_errstr(status));
|
|
return false;
|
|
}
|
|
|
|
generate_random_buffer((uint8_t *)confounder, 16);
|
|
|
|
MD5Init(&ctx);
|
|
MD5Update(&ctx, confounder, 16);
|
|
MD5Update(&ctx, session_key.data, session_key.length);
|
|
MD5Final(confounded_session_key.data, &ctx);
|
|
|
|
arcfour_crypt_blob(u.info25.password.data, 516, &confounded_session_key);
|
|
memcpy(&u.info25.password.data[516], confounder, 16);
|
|
|
|
torture_comment(tctx, "Testing SetUserInfo level 25 (set password ex) with a password made up of only random bytes\n");
|
|
|
|
torture_assert_ntstatus_ok(tctx, dcerpc_samr_SetUserInfo_r(b, tctx, &s),
|
|
"SetUserInfo failed");
|
|
torture_comment(tctx, "(%s:%s) old_password[%s] new_password[%s] status[%s]\n",
|
|
__location__, __FUNCTION__,
|
|
oldpass, "RANDOM", nt_errstr(s.out.result));
|
|
if (!NT_STATUS_IS_OK(s.out.result)) {
|
|
torture_result(tctx, TORTURE_FAIL, "SetUserInfo level %u failed - %s\n",
|
|
s.in.level, nt_errstr(s.out.result));
|
|
ret = false;
|
|
}
|
|
|
|
torture_comment(tctx, "Testing ChangePasswordUser3 with a password made up of only random bytes\n");
|
|
|
|
mdfour(old_nt_hash, new_random_pass.data, new_random_pass.length);
|
|
|
|
new_random_pass = samr_very_rand_pass(tctx, 128);
|
|
|
|
mdfour(new_nt_hash, new_random_pass.data, new_random_pass.length);
|
|
|
|
set_pw_in_buffer(nt_pass.data, &new_random_pass);
|
|
arcfour_crypt(nt_pass.data, old_nt_hash, 516);
|
|
E_old_pw_hash(new_nt_hash, old_nt_hash, nt_verifier.hash);
|
|
|
|
r.in.server = &server;
|
|
r.in.account = &account;
|
|
r.in.nt_password = &nt_pass;
|
|
r.in.nt_verifier = &nt_verifier;
|
|
r.in.lm_change = 0;
|
|
r.in.lm_password = NULL;
|
|
r.in.lm_verifier = NULL;
|
|
r.in.password3 = NULL;
|
|
r.out.dominfo = &dominfo;
|
|
r.out.reject = &reject;
|
|
|
|
unix_to_nt_time(&t, time(NULL));
|
|
|
|
torture_assert_ntstatus_ok(tctx, dcerpc_samr_ChangePasswordUser3_r(b, tctx, &r),
|
|
"ChangePasswordUser3 failed");
|
|
torture_comment(tctx, "(%s:%s) old_password[%s] new_password[%s] status[%s]\n",
|
|
__location__, __FUNCTION__,
|
|
oldpass, "RANDOM", nt_errstr(r.out.result));
|
|
|
|
if (NT_STATUS_EQUAL(r.out.result, NT_STATUS_PASSWORD_RESTRICTION)) {
|
|
if (reject && reject->extendedFailureReason != SAM_PWD_CHANGE_NO_ERROR) {
|
|
torture_result(tctx, TORTURE_FAIL, "expected SAM_PWD_CHANGE_NO_ERROR (%d), got %d\n",
|
|
SAM_PWD_CHANGE_NO_ERROR, reject->extendedFailureReason);
|
|
return false;
|
|
}
|
|
/* Perhaps the server has a 'min password age' set? */
|
|
|
|
} else if (!NT_STATUS_IS_OK(r.out.result)) {
|
|
torture_result(tctx, TORTURE_FAIL, "ChangePasswordUser3 failed - %s\n", nt_errstr(r.out.result));
|
|
ret = false;
|
|
}
|
|
|
|
newpass = samr_rand_pass(tctx, 128);
|
|
|
|
mdfour(old_nt_hash, new_random_pass.data, new_random_pass.length);
|
|
|
|
E_md4hash(newpass, new_nt_hash);
|
|
|
|
encode_pw_buffer(nt_pass.data, newpass, STR_UNICODE);
|
|
arcfour_crypt(nt_pass.data, old_nt_hash, 516);
|
|
E_old_pw_hash(new_nt_hash, old_nt_hash, nt_verifier.hash);
|
|
|
|
r.in.server = &server;
|
|
r.in.account = &account;
|
|
r.in.nt_password = &nt_pass;
|
|
r.in.nt_verifier = &nt_verifier;
|
|
r.in.lm_change = 0;
|
|
r.in.lm_password = NULL;
|
|
r.in.lm_verifier = NULL;
|
|
r.in.password3 = NULL;
|
|
r.out.dominfo = &dominfo;
|
|
r.out.reject = &reject;
|
|
|
|
unix_to_nt_time(&t, time(NULL));
|
|
|
|
torture_assert_ntstatus_ok(tctx, dcerpc_samr_ChangePasswordUser3_r(b, tctx, &r),
|
|
"ChangePasswordUser3 failed");
|
|
torture_comment(tctx, "(%s:%s) old_password[%s] new_password[%s] status[%s]\n",
|
|
__location__, __FUNCTION__,
|
|
oldpass, newpass, nt_errstr(r.out.result));
|
|
|
|
if (NT_STATUS_EQUAL(r.out.result, NT_STATUS_PASSWORD_RESTRICTION)) {
|
|
if (reject && reject->extendedFailureReason != SAM_PWD_CHANGE_NO_ERROR) {
|
|
torture_result(tctx, TORTURE_FAIL, "expected SAM_PWD_CHANGE_NO_ERROR (%d), got %d\n",
|
|
SAM_PWD_CHANGE_NO_ERROR, reject->extendedFailureReason);
|
|
return false;
|
|
}
|
|
/* Perhaps the server has a 'min password age' set? */
|
|
|
|
} else {
|
|
torture_assert_ntstatus_ok(tctx, r.out.result, "ChangePasswordUser3 (on second random password)");
|
|
*password = talloc_strdup(tctx, newpass);
|
|
}
|
|
|
|
return ret;
|
|
}
|
|
|
|
|
|
static bool test_GetMembersInAlias(struct dcerpc_binding_handle *b,
|
|
struct torture_context *tctx,
|
|
struct policy_handle *alias_handle)
|
|
{
|
|
struct samr_GetMembersInAlias r;
|
|
struct lsa_SidArray sids;
|
|
|
|
torture_comment(tctx, "Testing GetMembersInAlias\n");
|
|
|
|
r.in.alias_handle = alias_handle;
|
|
r.out.sids = &sids;
|
|
|
|
torture_assert_ntstatus_ok(tctx, dcerpc_samr_GetMembersInAlias_r(b, tctx, &r),
|
|
"GetMembersInAlias failed");
|
|
torture_assert_ntstatus_ok(tctx, r.out.result, "GetMembersInAlias failed");
|
|
|
|
return true;
|
|
}
|
|
|
|
static bool test_AddMemberToAlias(struct dcerpc_binding_handle *b,
|
|
struct torture_context *tctx,
|
|
struct policy_handle *alias_handle,
|
|
const struct dom_sid *domain_sid)
|
|
{
|
|
struct samr_AddAliasMember r;
|
|
struct samr_DeleteAliasMember d;
|
|
struct dom_sid *sid;
|
|
|
|
sid = dom_sid_add_rid(tctx, domain_sid, 512);
|
|
|
|
torture_comment(tctx, "Testing AddAliasMember\n");
|
|
r.in.alias_handle = alias_handle;
|
|
r.in.sid = sid;
|
|
|
|
torture_assert_ntstatus_ok(tctx, dcerpc_samr_AddAliasMember_r(b, tctx, &r),
|
|
"AddAliasMember failed");
|
|
torture_assert_ntstatus_ok(tctx, r.out.result, "AddAliasMember failed");
|
|
|
|
d.in.alias_handle = alias_handle;
|
|
d.in.sid = sid;
|
|
|
|
torture_assert_ntstatus_ok(tctx, dcerpc_samr_DeleteAliasMember_r(b, tctx, &d),
|
|
"DeleteAliasMember failed");
|
|
torture_assert_ntstatus_ok(tctx, d.out.result, "DelAliasMember failed");
|
|
|
|
return true;
|
|
}
|
|
|
|
static bool test_AddMultipleMembersToAlias(struct dcerpc_binding_handle *b,
|
|
struct torture_context *tctx,
|
|
struct policy_handle *alias_handle)
|
|
{
|
|
struct samr_AddMultipleMembersToAlias a;
|
|
struct samr_RemoveMultipleMembersFromAlias r;
|
|
struct lsa_SidArray sids;
|
|
|
|
torture_comment(tctx, "Testing AddMultipleMembersToAlias\n");
|
|
a.in.alias_handle = alias_handle;
|
|
a.in.sids = &sids;
|
|
|
|
sids.num_sids = 3;
|
|
sids.sids = talloc_array(tctx, struct lsa_SidPtr, 3);
|
|
|
|
sids.sids[0].sid = dom_sid_parse_talloc(tctx, "S-1-5-32-1-2-3-1");
|
|
sids.sids[1].sid = dom_sid_parse_talloc(tctx, "S-1-5-32-1-2-3-2");
|
|
sids.sids[2].sid = dom_sid_parse_talloc(tctx, "S-1-5-32-1-2-3-3");
|
|
|
|
torture_assert_ntstatus_ok(tctx, dcerpc_samr_AddMultipleMembersToAlias_r(b, tctx, &a),
|
|
"AddMultipleMembersToAlias failed");
|
|
torture_assert_ntstatus_ok(tctx, a.out.result, "AddMultipleMembersToAlias");
|
|
|
|
|
|
torture_comment(tctx, "Testing RemoveMultipleMembersFromAlias\n");
|
|
r.in.alias_handle = alias_handle;
|
|
r.in.sids = &sids;
|
|
|
|
torture_assert_ntstatus_ok(tctx, dcerpc_samr_RemoveMultipleMembersFromAlias_r(b, tctx, &r),
|
|
"RemoveMultipleMembersFromAlias failed");
|
|
torture_assert_ntstatus_ok(tctx, r.out.result, "RemoveMultipleMembersFromAlias failed");
|
|
|
|
/* strange! removing twice doesn't give any error */
|
|
torture_assert_ntstatus_ok(tctx, dcerpc_samr_RemoveMultipleMembersFromAlias_r(b, tctx, &r),
|
|
"RemoveMultipleMembersFromAlias failed");
|
|
torture_assert_ntstatus_ok(tctx, r.out.result, "RemoveMultipleMembersFromAlias failed");
|
|
|
|
/* but removing an alias that isn't there does */
|
|
sids.sids[2].sid = dom_sid_parse_talloc(tctx, "S-1-5-32-1-2-3-4");
|
|
|
|
torture_assert_ntstatus_ok(tctx, dcerpc_samr_RemoveMultipleMembersFromAlias_r(b, tctx, &r),
|
|
"RemoveMultipleMembersFromAlias failed");
|
|
torture_assert_ntstatus_equal(tctx, r.out.result, NT_STATUS_OBJECT_NAME_NOT_FOUND, "RemoveMultipleMembersFromAlias");
|
|
|
|
return true;
|
|
}
|
|
|
|
static bool test_GetAliasMembership(struct dcerpc_binding_handle *b,
|
|
struct torture_context *tctx,
|
|
struct policy_handle *domain_handle)
|
|
{
|
|
struct samr_GetAliasMembership r;
|
|
struct lsa_SidArray sids;
|
|
struct samr_Ids rids;
|
|
|
|
torture_comment(tctx, "Testing GetAliasMembership\n");
|
|
|
|
r.in.domain_handle = domain_handle;
|
|
r.in.sids = &sids;
|
|
r.out.rids = &rids;
|
|
|
|
sids.num_sids = 0;
|
|
sids.sids = talloc_zero_array(tctx, struct lsa_SidPtr, sids.num_sids);
|
|
|
|
torture_assert_ntstatus_ok(tctx, dcerpc_samr_GetAliasMembership_r(b, tctx, &r),
|
|
"GetAliasMembership failed");
|
|
torture_assert_ntstatus_ok(tctx, r.out.result,
|
|
"samr_GetAliasMembership failed");
|
|
|
|
torture_assert_int_equal(tctx, sids.num_sids, rids.count,
|
|
"protocol misbehaviour");
|
|
|
|
sids.num_sids = 1;
|
|
sids.sids = talloc_zero_array(tctx, struct lsa_SidPtr, sids.num_sids);
|
|
sids.sids[0].sid = dom_sid_parse_talloc(tctx, "S-1-5-32-1-2-3-1");
|
|
|
|
torture_assert_ntstatus_ok(tctx, dcerpc_samr_GetAliasMembership_r(b, tctx, &r),
|
|
"samr_GetAliasMembership failed");
|
|
torture_assert_ntstatus_ok(tctx, r.out.result,
|
|
"samr_GetAliasMembership failed");
|
|
|
|
#if 0
|
|
/* only true for w2k8 it seems
|
|
* win7, xp, w2k3 will return a 0 length array pointer */
|
|
|
|
if (rids.ids && (rids.count == 0)) {
|
|
torture_fail(tctx, "samr_GetAliasMembership returned 0 count and a rids array");
|
|
}
|
|
#endif
|
|
if (!rids.ids && rids.count) {
|
|
torture_fail(tctx, "samr_GetAliasMembership returned non-0 count but no rids");
|
|
}
|
|
|
|
return true;
|
|
}
|
|
|
|
static bool test_TestPrivateFunctionsUser(struct dcerpc_binding_handle *b,
|
|
struct torture_context *tctx,
|
|
struct policy_handle *user_handle)
|
|
{
|
|
struct samr_TestPrivateFunctionsUser r;
|
|
|
|
torture_comment(tctx, "Testing TestPrivateFunctionsUser\n");
|
|
|
|
r.in.user_handle = user_handle;
|
|
|
|
torture_assert_ntstatus_ok(tctx, dcerpc_samr_TestPrivateFunctionsUser_r(b, tctx, &r),
|
|
"TestPrivateFunctionsUser failed");
|
|
torture_assert_ntstatus_equal(tctx, r.out.result, NT_STATUS_NOT_IMPLEMENTED, "TestPrivateFunctionsUser");
|
|
|
|
return true;
|
|
}
|
|
|
|
static bool test_QueryUserInfo_pwdlastset(struct dcerpc_binding_handle *b,
|
|
struct torture_context *tctx,
|
|
struct policy_handle *handle,
|
|
bool use_info2,
|
|
NTTIME *pwdlastset)
|
|
{
|
|
NTSTATUS status;
|
|
uint16_t levels[] = { /* 3, */ 5, 21 };
|
|
int i;
|
|
/* NTTIME pwdlastset3 = 0; */
|
|
NTTIME pwdlastset5 = 0;
|
|
NTTIME pwdlastset21 = 0;
|
|
|
|
torture_comment(tctx, "Testing QueryUserInfo%s level 5 and 21 call ",
|
|
use_info2 ? "2":"");
|
|
|
|
for (i=0; i<ARRAY_SIZE(levels); i++) {
|
|
|
|
struct samr_QueryUserInfo r;
|
|
struct samr_QueryUserInfo2 r2;
|
|
union samr_UserInfo *info;
|
|
|
|
if (use_info2) {
|
|
r2.in.user_handle = handle;
|
|
r2.in.level = levels[i];
|
|
r2.out.info = &info;
|
|
torture_assert_ntstatus_ok(tctx, dcerpc_samr_QueryUserInfo2_r(b, tctx, &r2),
|
|
"QueryUserInfo2 failed");
|
|
status = r2.out.result;
|
|
|
|
} else {
|
|
r.in.user_handle = handle;
|
|
r.in.level = levels[i];
|
|
r.out.info = &info;
|
|
torture_assert_ntstatus_ok(tctx, dcerpc_samr_QueryUserInfo_r(b, tctx, &r),
|
|
"QueryUserInfo failed");
|
|
status = r.out.result;
|
|
}
|
|
|
|
if (!NT_STATUS_IS_OK(status) &&
|
|
!NT_STATUS_EQUAL(status, NT_STATUS_INVALID_INFO_CLASS)) {
|
|
torture_result(tctx, TORTURE_FAIL, "QueryUserInfo%s level %u failed - %s\n",
|
|
use_info2 ? "2":"", levels[i], nt_errstr(status));
|
|
return false;
|
|
}
|
|
|
|
switch (levels[i]) {
|
|
case 3:
|
|
/* pwdlastset3 = info->info3.last_password_change; */
|
|
break;
|
|
case 5:
|
|
pwdlastset5 = info->info5.last_password_change;
|
|
break;
|
|
case 21:
|
|
pwdlastset21 = info->info21.last_password_change;
|
|
break;
|
|
default:
|
|
return false;
|
|
}
|
|
}
|
|
/* torture_assert_int_equal(tctx, pwdlastset3, pwdlastset5,
|
|
"pwdlastset mixup"); */
|
|
torture_assert_int_equal(tctx, pwdlastset5, pwdlastset21,
|
|
"pwdlastset mixup");
|
|
|
|
*pwdlastset = pwdlastset21;
|
|
|
|
torture_comment(tctx, "(pwdlastset: %llu)\n",
|
|
(unsigned long long) *pwdlastset);
|
|
|
|
return true;
|
|
}
|
|
|
|
static bool test_SamLogon(struct torture_context *tctx,
|
|
struct dcerpc_pipe *p,
|
|
struct cli_credentials *machine_credentials,
|
|
struct cli_credentials *test_credentials,
|
|
NTSTATUS expected_result,
|
|
bool interactive)
|
|
{
|
|
NTSTATUS status;
|
|
struct netr_LogonSamLogonEx r;
|
|
union netr_LogonLevel logon;
|
|
union netr_Validation validation;
|
|
uint8_t authoritative;
|
|
struct netr_IdentityInfo identity;
|
|
struct netr_NetworkInfo ninfo;
|
|
struct netr_PasswordInfo pinfo;
|
|
DATA_BLOB names_blob, chal, lm_resp, nt_resp;
|
|
int flags = CLI_CRED_NTLM_AUTH;
|
|
uint32_t samlogon_flags = 0;
|
|
struct netlogon_creds_CredentialState *creds;
|
|
struct netr_Authenticator a;
|
|
struct dcerpc_binding_handle *b = p->binding_handle;
|
|
|
|
torture_assert(tctx, (creds = cli_credentials_get_netlogon_creds(machine_credentials)), "");
|
|
|
|
if (lpcfg_client_lanman_auth(tctx->lp_ctx)) {
|
|
flags |= CLI_CRED_LANMAN_AUTH;
|
|
}
|
|
|
|
if (lpcfg_client_ntlmv2_auth(tctx->lp_ctx)) {
|
|
flags |= CLI_CRED_NTLMv2_AUTH;
|
|
}
|
|
|
|
cli_credentials_get_ntlm_username_domain(test_credentials, tctx,
|
|
&identity.account_name.string,
|
|
&identity.domain_name.string);
|
|
|
|
identity.parameter_control =
|
|
MSV1_0_ALLOW_SERVER_TRUST_ACCOUNT |
|
|
MSV1_0_ALLOW_WORKSTATION_TRUST_ACCOUNT;
|
|
identity.logon_id_low = 0;
|
|
identity.logon_id_high = 0;
|
|
identity.workstation.string = cli_credentials_get_workstation(test_credentials);
|
|
|
|
if (interactive) {
|
|
netlogon_creds_client_authenticator(creds, &a);
|
|
|
|
if (!E_deshash(cli_credentials_get_password(test_credentials), pinfo.lmpassword.hash)) {
|
|
ZERO_STRUCT(pinfo.lmpassword.hash);
|
|
}
|
|
E_md4hash(cli_credentials_get_password(test_credentials), pinfo.ntpassword.hash);
|
|
|
|
if (creds->negotiate_flags & NETLOGON_NEG_SUPPORTS_AES) {
|
|
netlogon_creds_aes_encrypt(creds, pinfo.lmpassword.hash, 16);
|
|
netlogon_creds_aes_encrypt(creds, pinfo.ntpassword.hash, 16);
|
|
} else if (creds->negotiate_flags & NETLOGON_NEG_ARCFOUR) {
|
|
netlogon_creds_arcfour_crypt(creds, pinfo.lmpassword.hash, 16);
|
|
netlogon_creds_arcfour_crypt(creds, pinfo.ntpassword.hash, 16);
|
|
} else {
|
|
netlogon_creds_des_encrypt(creds, &pinfo.lmpassword);
|
|
netlogon_creds_des_encrypt(creds, &pinfo.ntpassword);
|
|
}
|
|
|
|
pinfo.identity_info = identity;
|
|
logon.password = &pinfo;
|
|
|
|
r.in.logon_level = NetlogonInteractiveInformation;
|
|
} else {
|
|
generate_random_buffer(ninfo.challenge,
|
|
sizeof(ninfo.challenge));
|
|
chal = data_blob_const(ninfo.challenge,
|
|
sizeof(ninfo.challenge));
|
|
|
|
names_blob = NTLMv2_generate_names_blob(tctx, cli_credentials_get_workstation(test_credentials),
|
|
cli_credentials_get_domain(test_credentials));
|
|
|
|
status = cli_credentials_get_ntlm_response(test_credentials, tctx,
|
|
&flags,
|
|
chal,
|
|
NULL, /* server_timestamp */
|
|
names_blob,
|
|
&lm_resp, &nt_resp,
|
|
NULL, NULL);
|
|
torture_assert_ntstatus_ok(tctx, status, "cli_credentials_get_ntlm_response failed");
|
|
|
|
ninfo.lm.data = lm_resp.data;
|
|
ninfo.lm.length = lm_resp.length;
|
|
|
|
ninfo.nt.data = nt_resp.data;
|
|
ninfo.nt.length = nt_resp.length;
|
|
|
|
ninfo.identity_info = identity;
|
|
logon.network = &ninfo;
|
|
|
|
r.in.logon_level = NetlogonNetworkInformation;
|
|
}
|
|
|
|
r.in.server_name = talloc_asprintf(tctx, "\\\\%s", dcerpc_server_name(p));
|
|
r.in.computer_name = cli_credentials_get_workstation(test_credentials);
|
|
r.in.logon = &logon;
|
|
r.in.flags = &samlogon_flags;
|
|
r.out.flags = &samlogon_flags;
|
|
r.out.validation = &validation;
|
|
r.out.authoritative = &authoritative;
|
|
|
|
torture_comment(tctx, "Testing LogonSamLogon with name %s\n", identity.account_name.string);
|
|
|
|
r.in.validation_level = 6;
|
|
|
|
torture_assert_ntstatus_ok(tctx, dcerpc_netr_LogonSamLogonEx_r(b, tctx, &r),
|
|
"netr_LogonSamLogonEx failed");
|
|
if (NT_STATUS_EQUAL(r.out.result, NT_STATUS_INVALID_INFO_CLASS)) {
|
|
r.in.validation_level = 3;
|
|
torture_assert_ntstatus_ok(tctx, dcerpc_netr_LogonSamLogonEx_r(b, tctx, &r),
|
|
"netr_LogonSamLogonEx failed");
|
|
}
|
|
if (!NT_STATUS_IS_OK(r.out.result)) {
|
|
torture_assert_ntstatus_equal(tctx, r.out.result, expected_result, "LogonSamLogonEx failed");
|
|
return true;
|
|
} else {
|
|
torture_assert_ntstatus_ok(tctx, r.out.result, "LogonSamLogonEx failed");
|
|
}
|
|
|
|
return true;
|
|
}
|
|
|
|
static bool test_SamLogon_with_creds(struct torture_context *tctx,
|
|
struct dcerpc_pipe *p,
|
|
struct cli_credentials *machine_creds,
|
|
const char *acct_name,
|
|
const char *password,
|
|
NTSTATUS expected_samlogon_result,
|
|
bool interactive)
|
|
{
|
|
bool ret = true;
|
|
struct cli_credentials *test_credentials;
|
|
|
|
test_credentials = cli_credentials_init(tctx);
|
|
|
|
cli_credentials_set_workstation(test_credentials,
|
|
cli_credentials_get_workstation(machine_creds), CRED_SPECIFIED);
|
|
cli_credentials_set_domain(test_credentials,
|
|
cli_credentials_get_domain(machine_creds), CRED_SPECIFIED);
|
|
cli_credentials_set_username(test_credentials,
|
|
acct_name, CRED_SPECIFIED);
|
|
cli_credentials_set_password(test_credentials,
|
|
password, CRED_SPECIFIED);
|
|
|
|
torture_comment(tctx, "Testing samlogon (%s) as %s password: %s\n",
|
|
interactive ? "interactive" : "network", acct_name, password);
|
|
|
|
if (!test_SamLogon(tctx, p, machine_creds, test_credentials,
|
|
expected_samlogon_result, interactive)) {
|
|
torture_result(tctx, TORTURE_FAIL, "new password did not work\n");
|
|
ret = false;
|
|
}
|
|
|
|
return ret;
|
|
}
|
|
|
|
static bool test_SetPassword_level(struct dcerpc_pipe *p,
|
|
struct dcerpc_pipe *np,
|
|
struct torture_context *tctx,
|
|
struct policy_handle *handle,
|
|
uint16_t level,
|
|
uint32_t fields_present,
|
|
uint8_t password_expired,
|
|
bool *matched_expected_error,
|
|
bool use_setinfo2,
|
|
const char *acct_name,
|
|
char **password,
|
|
struct cli_credentials *machine_creds,
|
|
bool use_queryinfo2,
|
|
NTTIME *pwdlastset,
|
|
NTSTATUS expected_samlogon_result)
|
|
{
|
|
const char *fields = NULL;
|
|
bool ret = true;
|
|
struct dcerpc_binding_handle *b = p->binding_handle;
|
|
|
|
switch (level) {
|
|
case 21:
|
|
case 23:
|
|
case 25:
|
|
fields = talloc_asprintf(tctx, "(fields_present: 0x%08x)",
|
|
fields_present);
|
|
break;
|
|
default:
|
|
break;
|
|
}
|
|
|
|
torture_comment(tctx, "Testing SetUserInfo%s level %d call "
|
|
"(password_expired: %d) %s\n",
|
|
use_setinfo2 ? "2":"", level, password_expired,
|
|
fields ? fields : "");
|
|
|
|
if (!test_SetUserPass_level_ex(p, tctx, handle, level,
|
|
fields_present,
|
|
password,
|
|
password_expired,
|
|
use_setinfo2,
|
|
matched_expected_error)) {
|
|
ret = false;
|
|
}
|
|
|
|
if (!test_QueryUserInfo_pwdlastset(b, tctx, handle,
|
|
use_queryinfo2,
|
|
pwdlastset)) {
|
|
ret = false;
|
|
}
|
|
|
|
if (*matched_expected_error == true) {
|
|
return ret;
|
|
}
|
|
|
|
if (!test_SamLogon_with_creds(tctx, np,
|
|
machine_creds,
|
|
acct_name,
|
|
*password,
|
|
expected_samlogon_result,
|
|
false)) {
|
|
ret = false;
|
|
}
|
|
|
|
return ret;
|
|
}
|
|
|
|
static bool setup_schannel_netlogon_pipe(struct torture_context *tctx,
|
|
struct cli_credentials *credentials,
|
|
struct dcerpc_pipe **p)
|
|
{
|
|
struct dcerpc_binding *b;
|
|
NTSTATUS status;
|
|
|
|
torture_assert_ntstatus_ok(tctx, torture_rpc_binding(tctx, &b),
|
|
"failed to get rpc binding");
|
|
|
|
/* We have to use schannel, otherwise the SamLogonEx fails
|
|
* with INTERNAL_ERROR */
|
|
|
|
status = dcerpc_binding_set_flags(b,
|
|
DCERPC_SCHANNEL |
|
|
DCERPC_SIGN | DCERPC_SEAL |
|
|
DCERPC_SCHANNEL_AUTO,
|
|
DCERPC_AUTH_OPTIONS);
|
|
torture_assert_ntstatus_ok(tctx, status, "set flags");
|
|
|
|
torture_assert_ntstatus_ok(tctx,
|
|
dcerpc_pipe_connect_b(tctx, p, b, &ndr_table_netlogon,
|
|
credentials, tctx->ev, tctx->lp_ctx),
|
|
"failed to bind to netlogon");
|
|
|
|
return true;
|
|
}
|
|
|
|
static bool test_SetPassword_pwdlastset(struct dcerpc_pipe *p,
|
|
struct torture_context *tctx,
|
|
uint32_t acct_flags,
|
|
const char *acct_name,
|
|
struct policy_handle *handle,
|
|
char **password,
|
|
struct cli_credentials *machine_credentials)
|
|
{
|
|
int s = 0, q = 0, f = 0, l = 0, z = 0;
|
|
bool ret = true;
|
|
int delay = 50000;
|
|
bool set_levels[] = { false, true };
|
|
bool query_levels[] = { false, true };
|
|
uint32_t levels[] = { 18, 21, 26, 23, 24, 25 }; /* Second half only used when TEST_ALL_LEVELS defined */
|
|
uint32_t nonzeros[] = { 1, 24 };
|
|
uint32_t fields_present[] = {
|
|
0,
|
|
SAMR_FIELD_EXPIRED_FLAG,
|
|
SAMR_FIELD_LAST_PWD_CHANGE,
|
|
SAMR_FIELD_EXPIRED_FLAG | SAMR_FIELD_LAST_PWD_CHANGE,
|
|
SAMR_FIELD_COMMENT,
|
|
SAMR_FIELD_NT_PASSWORD_PRESENT,
|
|
SAMR_FIELD_NT_PASSWORD_PRESENT | SAMR_FIELD_LAST_PWD_CHANGE,
|
|
SAMR_FIELD_NT_PASSWORD_PRESENT | SAMR_FIELD_LM_PASSWORD_PRESENT,
|
|
SAMR_FIELD_NT_PASSWORD_PRESENT | SAMR_FIELD_LM_PASSWORD_PRESENT | SAMR_FIELD_LAST_PWD_CHANGE,
|
|
SAMR_FIELD_NT_PASSWORD_PRESENT | SAMR_FIELD_EXPIRED_FLAG,
|
|
SAMR_FIELD_NT_PASSWORD_PRESENT | SAMR_FIELD_LM_PASSWORD_PRESENT | SAMR_FIELD_EXPIRED_FLAG,
|
|
SAMR_FIELD_NT_PASSWORD_PRESENT | SAMR_FIELD_LM_PASSWORD_PRESENT | SAMR_FIELD_LAST_PWD_CHANGE | SAMR_FIELD_EXPIRED_FLAG
|
|
};
|
|
struct dcerpc_pipe *np = NULL;
|
|
|
|
if (torture_setting_bool(tctx, "samba3", false) ||
|
|
torture_setting_bool(tctx, "samba4", false)) {
|
|
delay = 999999;
|
|
torture_comment(tctx, "Samba3 has second granularity, setting delay to: %d\n",
|
|
delay);
|
|
}
|
|
|
|
torture_assert(tctx, setup_schannel_netlogon_pipe(tctx, machine_credentials, &np), "");
|
|
|
|
/* set to 1 to enable testing for all possible opcode
|
|
(SetUserInfo, SetUserInfo2, QueryUserInfo, QueryUserInfo2)
|
|
combinations */
|
|
#if 0
|
|
#define TEST_ALL_LEVELS 1
|
|
#define TEST_SET_LEVELS 1
|
|
#define TEST_QUERY_LEVELS 1
|
|
#endif
|
|
#ifdef TEST_ALL_LEVELS
|
|
for (l=0; l<ARRAY_SIZE(levels); l++) {
|
|
#else
|
|
for (l=0; l<(ARRAY_SIZE(levels))/2; l++) {
|
|
#endif
|
|
for (z=0; z<ARRAY_SIZE(nonzeros); z++) {
|
|
for (f=0; f<ARRAY_SIZE(fields_present); f++) {
|
|
#ifdef TEST_SET_LEVELS
|
|
for (s=0; s<ARRAY_SIZE(set_levels); s++) {
|
|
#endif
|
|
#ifdef TEST_QUERY_LEVELS
|
|
for (q=0; q<ARRAY_SIZE(query_levels); q++) {
|
|
#endif
|
|
NTTIME pwdlastset_old = 0;
|
|
NTTIME pwdlastset_new = 0;
|
|
bool matched_expected_error = false;
|
|
NTSTATUS expected_samlogon_result = NT_STATUS_ACCOUNT_DISABLED;
|
|
|
|
torture_comment(tctx, "------------------------------\n"
|
|
"Testing pwdLastSet attribute for flags: 0x%08x "
|
|
"(s: %d (l: %d), q: %d)\n",
|
|
acct_flags, s, levels[l], q);
|
|
|
|
switch (levels[l]) {
|
|
case 21:
|
|
case 23:
|
|
case 25:
|
|
if (!((fields_present[f] & SAMR_FIELD_NT_PASSWORD_PRESENT) ||
|
|
(fields_present[f] & SAMR_FIELD_LM_PASSWORD_PRESENT))) {
|
|
expected_samlogon_result = NT_STATUS_WRONG_PASSWORD;
|
|
}
|
|
break;
|
|
}
|
|
|
|
|
|
/* set #1 */
|
|
|
|
/* set a password and force password change (pwdlastset 0) by
|
|
* setting the password expired flag to a non-0 value */
|
|
|
|
if (!test_SetPassword_level(p, np, tctx, handle,
|
|
levels[l],
|
|
fields_present[f],
|
|
nonzeros[z],
|
|
&matched_expected_error,
|
|
set_levels[s],
|
|
acct_name,
|
|
password,
|
|
machine_credentials,
|
|
query_levels[q],
|
|
&pwdlastset_new,
|
|
expected_samlogon_result)) {
|
|
ret = false;
|
|
}
|
|
|
|
if (matched_expected_error == true) {
|
|
/* skipping on expected failure */
|
|
continue;
|
|
}
|
|
|
|
/* pwdlastset must be 0 afterwards, except for a level 21, 23 and 25
|
|
* set without the SAMR_FIELD_EXPIRED_FLAG */
|
|
|
|
switch (levels[l]) {
|
|
case 21:
|
|
case 23:
|
|
case 25:
|
|
if ((pwdlastset_new != 0) &&
|
|
!(fields_present[f] & SAMR_FIELD_EXPIRED_FLAG)) {
|
|
torture_comment(tctx, "not considering a non-0 "
|
|
"pwdLastSet as a an error as the "
|
|
"SAMR_FIELD_EXPIRED_FLAG has not "
|
|
"been set\n");
|
|
break;
|
|
}
|
|
break;
|
|
default:
|
|
if (pwdlastset_new != 0) {
|
|
torture_result(tctx, TORTURE_FAIL, "pwdLastSet test failed: "
|
|
"expected pwdLastSet 0 but got %llu\n",
|
|
(unsigned long long) pwdlastset_old);
|
|
ret = false;
|
|
}
|
|
break;
|
|
}
|
|
|
|
switch (levels[l]) {
|
|
case 21:
|
|
case 23:
|
|
case 25:
|
|
if (((fields_present[f] & SAMR_FIELD_NT_PASSWORD_PRESENT) ||
|
|
(fields_present[f] & SAMR_FIELD_LM_PASSWORD_PRESENT)) &&
|
|
(pwdlastset_old > 0) && (pwdlastset_new > 0) &&
|
|
(pwdlastset_old >= pwdlastset_new)) {
|
|
torture_result(tctx, TORTURE_FAIL, "pwdlastset not increasing\n");
|
|
ret = false;
|
|
}
|
|
break;
|
|
}
|
|
|
|
pwdlastset_old = pwdlastset_new;
|
|
|
|
usleep(delay);
|
|
|
|
/* set #2 */
|
|
|
|
/* set a password, pwdlastset needs to get updated (increased
|
|
* value), password_expired value used here is 0 */
|
|
|
|
if (!test_SetPassword_level(p, np, tctx, handle,
|
|
levels[l],
|
|
fields_present[f],
|
|
0,
|
|
&matched_expected_error,
|
|
set_levels[s],
|
|
acct_name,
|
|
password,
|
|
machine_credentials,
|
|
query_levels[q],
|
|
&pwdlastset_new,
|
|
expected_samlogon_result)) {
|
|
ret = false;
|
|
}
|
|
|
|
/* when a password has been changed, pwdlastset must not be 0 afterwards
|
|
* and must be larger then the old value */
|
|
|
|
switch (levels[l]) {
|
|
case 21:
|
|
case 23:
|
|
case 25:
|
|
/* SAMR_FIELD_EXPIRED_FLAG has not been set and no
|
|
* password has been changed, old and new pwdlastset
|
|
* need to be the same value */
|
|
|
|
if (!(fields_present[f] & SAMR_FIELD_EXPIRED_FLAG) &&
|
|
!((fields_present[f] & SAMR_FIELD_NT_PASSWORD_PRESENT) ||
|
|
(fields_present[f] & SAMR_FIELD_LM_PASSWORD_PRESENT)))
|
|
{
|
|
torture_assert_int_equal(tctx, pwdlastset_old,
|
|
pwdlastset_new, "pwdlastset must be equal");
|
|
break;
|
|
}
|
|
break;
|
|
default:
|
|
if (pwdlastset_old >= pwdlastset_new) {
|
|
torture_result(tctx, TORTURE_FAIL, "pwdLastSet test failed: "
|
|
"expected last pwdlastset (%llu) < new pwdlastset (%llu)\n",
|
|
(unsigned long long) pwdlastset_old,
|
|
(unsigned long long) pwdlastset_new);
|
|
ret = false;
|
|
}
|
|
if (pwdlastset_new == 0) {
|
|
torture_result(tctx, TORTURE_FAIL, "pwdLastSet test failed: "
|
|
"expected non-0 pwdlastset, got: %llu\n",
|
|
(unsigned long long) pwdlastset_new);
|
|
ret = false;
|
|
}
|
|
break;
|
|
}
|
|
|
|
switch (levels[l]) {
|
|
case 21:
|
|
case 23:
|
|
case 25:
|
|
if (((fields_present[f] & SAMR_FIELD_NT_PASSWORD_PRESENT) ||
|
|
(fields_present[f] & SAMR_FIELD_LM_PASSWORD_PRESENT)) &&
|
|
(pwdlastset_old > 0) && (pwdlastset_new > 0) &&
|
|
(pwdlastset_old >= pwdlastset_new)) {
|
|
torture_result(tctx, TORTURE_FAIL, "pwdlastset not increasing\n");
|
|
ret = false;
|
|
}
|
|
break;
|
|
}
|
|
|
|
pwdlastset_old = pwdlastset_new;
|
|
|
|
usleep(delay);
|
|
|
|
/* set #2b */
|
|
|
|
/* set a password, pwdlastset needs to get updated (increased
|
|
* value), password_expired value used here is 0 */
|
|
|
|
if (!test_SetPassword_level(p, np, tctx, handle,
|
|
levels[l],
|
|
fields_present[f],
|
|
0,
|
|
&matched_expected_error,
|
|
set_levels[s],
|
|
acct_name,
|
|
password,
|
|
machine_credentials,
|
|
query_levels[q],
|
|
&pwdlastset_new,
|
|
expected_samlogon_result)) {
|
|
ret = false;
|
|
}
|
|
|
|
/* when a password has been changed, pwdlastset must not be 0 afterwards
|
|
* and must be larger then the old value */
|
|
|
|
switch (levels[l]) {
|
|
case 21:
|
|
case 23:
|
|
case 25:
|
|
|
|
/* SAMR_FIELD_EXPIRED_FLAG has not been set and no
|
|
* password has been changed, old and new pwdlastset
|
|
* need to be the same value */
|
|
|
|
if (!(fields_present[f] & SAMR_FIELD_EXPIRED_FLAG) &&
|
|
!((fields_present[f] & SAMR_FIELD_NT_PASSWORD_PRESENT) ||
|
|
(fields_present[f] & SAMR_FIELD_LM_PASSWORD_PRESENT)))
|
|
{
|
|
torture_assert_int_equal(tctx, pwdlastset_old,
|
|
pwdlastset_new, "pwdlastset must be equal");
|
|
break;
|
|
}
|
|
break;
|
|
default:
|
|
if (pwdlastset_old >= pwdlastset_new) {
|
|
torture_result(tctx, TORTURE_FAIL, "pwdLastSet test failed: "
|
|
"expected last pwdlastset (%llu) < new pwdlastset (%llu)\n",
|
|
(unsigned long long) pwdlastset_old,
|
|
(unsigned long long) pwdlastset_new);
|
|
ret = false;
|
|
}
|
|
if (pwdlastset_new == 0) {
|
|
torture_result(tctx, TORTURE_FAIL, "pwdLastSet test failed: "
|
|
"expected non-0 pwdlastset, got: %llu\n",
|
|
(unsigned long long) pwdlastset_new);
|
|
ret = false;
|
|
}
|
|
break;
|
|
}
|
|
|
|
switch (levels[l]) {
|
|
case 21:
|
|
case 23:
|
|
case 25:
|
|
if (((fields_present[f] & SAMR_FIELD_NT_PASSWORD_PRESENT) ||
|
|
(fields_present[f] & SAMR_FIELD_LM_PASSWORD_PRESENT)) &&
|
|
(pwdlastset_old > 0) && (pwdlastset_new > 0) &&
|
|
(pwdlastset_old >= pwdlastset_new)) {
|
|
torture_result(tctx, TORTURE_FAIL, "pwdlastset not increasing\n");
|
|
ret = false;
|
|
}
|
|
break;
|
|
}
|
|
|
|
pwdlastset_old = pwdlastset_new;
|
|
|
|
usleep(delay);
|
|
|
|
/* set #3 */
|
|
|
|
/* set a password and force password change (pwdlastset 0) by
|
|
* setting the password expired flag to a non-0 value */
|
|
|
|
if (!test_SetPassword_level(p, np, tctx, handle,
|
|
levels[l],
|
|
fields_present[f],
|
|
nonzeros[z],
|
|
&matched_expected_error,
|
|
set_levels[s],
|
|
acct_name,
|
|
password,
|
|
machine_credentials,
|
|
query_levels[q],
|
|
&pwdlastset_new,
|
|
expected_samlogon_result)) {
|
|
ret = false;
|
|
}
|
|
|
|
/* pwdlastset must be 0 afterwards, except for a level 21, 23 and 25
|
|
* set without the SAMR_FIELD_EXPIRED_FLAG */
|
|
|
|
switch (levels[l]) {
|
|
case 21:
|
|
case 23:
|
|
case 25:
|
|
if ((pwdlastset_new != 0) &&
|
|
!(fields_present[f] & SAMR_FIELD_EXPIRED_FLAG)) {
|
|
torture_comment(tctx, "not considering a non-0 "
|
|
"pwdLastSet as a an error as the "
|
|
"SAMR_FIELD_EXPIRED_FLAG has not "
|
|
"been set\n");
|
|
break;
|
|
}
|
|
|
|
/* SAMR_FIELD_EXPIRED_FLAG has not been set and no
|
|
* password has been changed, old and new pwdlastset
|
|
* need to be the same value */
|
|
|
|
if (!(fields_present[f] & SAMR_FIELD_EXPIRED_FLAG) &&
|
|
!((fields_present[f] & SAMR_FIELD_NT_PASSWORD_PRESENT) ||
|
|
(fields_present[f] & SAMR_FIELD_LM_PASSWORD_PRESENT)))
|
|
{
|
|
torture_assert_int_equal(tctx, pwdlastset_old,
|
|
pwdlastset_new, "pwdlastset must be equal");
|
|
break;
|
|
}
|
|
break;
|
|
default:
|
|
if (pwdlastset_new != 0) {
|
|
torture_result(tctx, TORTURE_FAIL, "pwdLastSet test failed: "
|
|
"expected pwdLastSet 0, got %llu\n",
|
|
(unsigned long long) pwdlastset_old);
|
|
ret = false;
|
|
}
|
|
break;
|
|
}
|
|
|
|
switch (levels[l]) {
|
|
case 21:
|
|
case 23:
|
|
case 25:
|
|
if (((fields_present[f] & SAMR_FIELD_NT_PASSWORD_PRESENT) ||
|
|
(fields_present[f] & SAMR_FIELD_LM_PASSWORD_PRESENT)) &&
|
|
(pwdlastset_old > 0) && (pwdlastset_new > 0) &&
|
|
(pwdlastset_old >= pwdlastset_new)) {
|
|
torture_result(tctx, TORTURE_FAIL, "pwdlastset not increasing\n");
|
|
ret = false;
|
|
}
|
|
break;
|
|
}
|
|
|
|
/* if the level we are testing does not have a fields_present
|
|
* field, skip all fields present tests by setting f to to
|
|
* arraysize */
|
|
switch (levels[l]) {
|
|
case 18:
|
|
case 24:
|
|
case 26:
|
|
f = ARRAY_SIZE(fields_present);
|
|
break;
|
|
}
|
|
|
|
#ifdef TEST_QUERY_LEVELS
|
|
}
|
|
#endif
|
|
#ifdef TEST_SET_LEVELS
|
|
}
|
|
#endif
|
|
} /* fields present */
|
|
} /* nonzeros */
|
|
} /* levels */
|
|
|
|
#undef TEST_SET_LEVELS
|
|
#undef TEST_QUERY_LEVELS
|
|
|
|
talloc_free(np);
|
|
|
|
return ret;
|
|
}
|
|
|
|
static bool test_QueryUserInfo_badpwdcount(struct dcerpc_binding_handle *b,
|
|
struct torture_context *tctx,
|
|
struct policy_handle *handle,
|
|
uint32_t *badpwdcount)
|
|
{
|
|
union samr_UserInfo *info;
|
|
struct samr_QueryUserInfo r;
|
|
|
|
r.in.user_handle = handle;
|
|
r.in.level = 3;
|
|
r.out.info = &info;
|
|
|
|
torture_comment(tctx, "Testing QueryUserInfo level %d", r.in.level);
|
|
|
|
torture_assert_ntstatus_ok(tctx, dcerpc_samr_QueryUserInfo_r(b, tctx, &r),
|
|
"failed to query userinfo");
|
|
torture_assert_ntstatus_ok(tctx, r.out.result,
|
|
"failed to query userinfo");
|
|
|
|
*badpwdcount = info->info3.bad_password_count;
|
|
|
|
torture_comment(tctx, " (bad password count: %d)\n", *badpwdcount);
|
|
|
|
return true;
|
|
}
|
|
|
|
static bool test_SetUserInfo_acct_flags(struct dcerpc_binding_handle *b,
|
|
struct torture_context *tctx,
|
|
struct policy_handle *user_handle,
|
|
uint32_t acct_flags)
|
|
{
|
|
struct samr_SetUserInfo r;
|
|
union samr_UserInfo user_info;
|
|
|
|
torture_comment(tctx, "Testing SetUserInfo level 16\n");
|
|
|
|
user_info.info16.acct_flags = acct_flags;
|
|
|
|
r.in.user_handle = user_handle;
|
|
r.in.level = 16;
|
|
r.in.info = &user_info;
|
|
|
|
torture_assert_ntstatus_ok(tctx, dcerpc_samr_SetUserInfo_r(b, tctx, &r),
|
|
"failed to set account flags");
|
|
torture_assert_ntstatus_ok(tctx, r.out.result,
|
|
"failed to set account flags");
|
|
|
|
return true;
|
|
}
|
|
|
|
static bool test_reset_badpwdcount(struct dcerpc_pipe *p,
|
|
struct torture_context *tctx,
|
|
struct policy_handle *user_handle,
|
|
uint32_t acct_flags,
|
|
char **password)
|
|
{
|
|
struct dcerpc_binding_handle *b = p->binding_handle;
|
|
|
|
torture_assert(tctx, test_SetUserPass(p, tctx, user_handle, password),
|
|
"failed to set password");
|
|
|
|
torture_comment(tctx, "Testing SetUserInfo level 16 (enable account)\n");
|
|
|
|
torture_assert(tctx,
|
|
test_SetUserInfo_acct_flags(b, tctx, user_handle,
|
|
acct_flags & ~ACB_DISABLED),
|
|
"failed to enable user");
|
|
|
|
torture_assert(tctx, test_SetUserPass(p, tctx, user_handle, password),
|
|
"failed to set password");
|
|
|
|
return true;
|
|
}
|
|
|
|
static bool test_SetDomainInfo(struct dcerpc_binding_handle *b,
|
|
struct torture_context *tctx,
|
|
struct policy_handle *domain_handle,
|
|
enum samr_DomainInfoClass level,
|
|
union samr_DomainInfo *info)
|
|
{
|
|
struct samr_SetDomainInfo r;
|
|
|
|
r.in.domain_handle = domain_handle;
|
|
r.in.level = level;
|
|
r.in.info = info;
|
|
|
|
torture_assert_ntstatus_ok(tctx,
|
|
dcerpc_samr_SetDomainInfo_r(b, tctx, &r),
|
|
"failed to set domain info");
|
|
torture_assert_ntstatus_ok(tctx, r.out.result,
|
|
"failed to set domain info");
|
|
|
|
return true;
|
|
}
|
|
|
|
static bool test_SetDomainInfo_ntstatus(struct dcerpc_binding_handle *b,
|
|
struct torture_context *tctx,
|
|
struct policy_handle *domain_handle,
|
|
enum samr_DomainInfoClass level,
|
|
union samr_DomainInfo *info,
|
|
NTSTATUS expected)
|
|
{
|
|
struct samr_SetDomainInfo r;
|
|
|
|
r.in.domain_handle = domain_handle;
|
|
r.in.level = level;
|
|
r.in.info = info;
|
|
|
|
torture_assert_ntstatus_ok(tctx, dcerpc_samr_SetDomainInfo_r(b, tctx, &r),
|
|
"SetDomainInfo failed");
|
|
torture_assert_ntstatus_equal(tctx, r.out.result, expected, "");
|
|
|
|
return true;
|
|
}
|
|
|
|
static bool test_QueryDomainInfo2_level(struct dcerpc_binding_handle *b,
|
|
struct torture_context *tctx,
|
|
struct policy_handle *domain_handle,
|
|
enum samr_DomainInfoClass level,
|
|
union samr_DomainInfo **q_info)
|
|
{
|
|
struct samr_QueryDomainInfo2 r;
|
|
|
|
r.in.domain_handle = domain_handle;
|
|
r.in.level = level;
|
|
r.out.info = q_info;
|
|
|
|
torture_assert_ntstatus_ok(tctx, dcerpc_samr_QueryDomainInfo2_r(b, tctx, &r),
|
|
"failed to query domain info");
|
|
torture_assert_ntstatus_ok(tctx, r.out.result,
|
|
"failed to query domain info");
|
|
|
|
return true;
|
|
}
|
|
|
|
static bool test_Password_badpwdcount(struct dcerpc_pipe *p,
|
|
struct dcerpc_pipe *np,
|
|
struct torture_context *tctx,
|
|
uint32_t acct_flags,
|
|
const char *acct_name,
|
|
struct policy_handle *domain_handle,
|
|
struct policy_handle *user_handle,
|
|
char **password,
|
|
struct cli_credentials *machine_credentials,
|
|
const char *comment,
|
|
bool disable,
|
|
bool interactive,
|
|
NTSTATUS expected_success_status,
|
|
struct samr_DomInfo1 *info1,
|
|
struct samr_DomInfo12 *info12)
|
|
{
|
|
union samr_DomainInfo info;
|
|
char **passwords;
|
|
int i;
|
|
uint32_t badpwdcount, tmp;
|
|
uint32_t password_history_length = 12;
|
|
uint32_t lockout_threshold = 15;
|
|
uint32_t lockout_seconds = 5;
|
|
uint64_t delta_time_factor = 10 * 1000 * 1000;
|
|
struct dcerpc_binding_handle *b = p->binding_handle;
|
|
|
|
if (torture_setting_bool(tctx, "samba3", false)) {
|
|
lockout_seconds = 60;
|
|
}
|
|
|
|
torture_comment(tctx, "\nTesting bad pwd count with: %s\n", comment);
|
|
|
|
torture_assert(tctx, password_history_length < lockout_threshold,
|
|
"password history length needs to be smaller than account lockout threshold for this test");
|
|
|
|
|
|
/* set policies */
|
|
|
|
info.info1 = *info1;
|
|
info.info1.password_history_length = password_history_length;
|
|
info.info1.min_password_age = 0;
|
|
|
|
torture_assert(tctx,
|
|
test_SetDomainInfo(b, tctx, domain_handle,
|
|
DomainPasswordInformation, &info),
|
|
"failed to set password history length and min passwd age");
|
|
|
|
info.info12 = *info12;
|
|
info.info12.lockout_threshold = lockout_threshold;
|
|
|
|
/* set lockout duration of 5 seconds */
|
|
info.info12.lockout_duration = ~(lockout_seconds * delta_time_factor);
|
|
info.info12.lockout_window = ~(lockout_seconds * delta_time_factor);
|
|
|
|
torture_assert(tctx,
|
|
test_SetDomainInfo(b, tctx, domain_handle,
|
|
DomainLockoutInformation, &info),
|
|
"failed to set lockout threshold");
|
|
|
|
/* reset bad pwd count */
|
|
|
|
torture_assert(tctx,
|
|
test_reset_badpwdcount(p, tctx, user_handle, acct_flags, password), "");
|
|
|
|
|
|
/* enable or disable account */
|
|
if (disable) {
|
|
torture_assert(tctx,
|
|
test_SetUserInfo_acct_flags(b, tctx, user_handle,
|
|
acct_flags | ACB_DISABLED),
|
|
"failed to disable user");
|
|
} else {
|
|
torture_assert(tctx,
|
|
test_SetUserInfo_acct_flags(b, tctx, user_handle,
|
|
acct_flags & ~ACB_DISABLED),
|
|
"failed to enable user");
|
|
}
|
|
|
|
|
|
/* setup password history */
|
|
|
|
passwords = talloc_array(tctx, char *, password_history_length);
|
|
|
|
for (i=0; i < password_history_length; i++) {
|
|
|
|
torture_assert(tctx, test_SetUserPass(p, tctx, user_handle, password),
|
|
"failed to set password");
|
|
passwords[i] = talloc_strdup(tctx, *password);
|
|
|
|
if (!test_SamLogon_with_creds(tctx, np, machine_credentials,
|
|
acct_name, passwords[i],
|
|
expected_success_status, interactive)) {
|
|
torture_fail(tctx, "failed to auth with latest password");
|
|
}
|
|
|
|
torture_assert(tctx,
|
|
test_QueryUserInfo_badpwdcount(b, tctx, user_handle, &badpwdcount), "");
|
|
|
|
torture_assert_int_equal(tctx, badpwdcount, 0, "expected badpwdcount to be 0");
|
|
}
|
|
|
|
|
|
/* test with wrong password */
|
|
|
|
if (!test_SamLogon_with_creds(tctx, np, machine_credentials,
|
|
acct_name, "random_crap",
|
|
NT_STATUS_WRONG_PASSWORD, interactive)) {
|
|
torture_fail(tctx, "succeeded to authenticate with wrong password");
|
|
}
|
|
|
|
torture_assert(tctx,
|
|
test_QueryUserInfo_badpwdcount(b, tctx, user_handle, &badpwdcount), "");
|
|
|
|
torture_assert_int_equal(tctx, badpwdcount, 1, "expected badpwdcount to be 1");
|
|
|
|
|
|
/* test with latest good password */
|
|
|
|
if (!test_SamLogon_with_creds(tctx, np, machine_credentials, acct_name,
|
|
passwords[password_history_length-1],
|
|
expected_success_status, interactive)) {
|
|
torture_fail(tctx, "succeeded to authenticate with wrong password");
|
|
}
|
|
|
|
torture_assert(tctx,
|
|
test_QueryUserInfo_badpwdcount(b, tctx, user_handle, &badpwdcount), "");
|
|
|
|
if (disable) {
|
|
torture_assert_int_equal(tctx, badpwdcount, 1, "expected badpwdcount to be 1");
|
|
} else {
|
|
/* only enabled accounts get the bad pwd count reset upon
|
|
* successful logon */
|
|
torture_assert_int_equal(tctx, badpwdcount, 0, "expected badpwdcount to be 0");
|
|
}
|
|
|
|
tmp = badpwdcount;
|
|
|
|
|
|
/* test password history */
|
|
|
|
for (i=0; i < password_history_length; i++) {
|
|
|
|
torture_comment(tctx, "Testing bad password count behavior with "
|
|
"password #%d of #%d\n", i, password_history_length);
|
|
|
|
/* - network samlogon will succeed auth and not
|
|
* increase badpwdcount for 2 last entries
|
|
* - interactive samlogon only for the last one */
|
|
|
|
if (i == password_history_length - 1 ||
|
|
(i == password_history_length - 2 && !interactive)) {
|
|
|
|
if (!test_SamLogon_with_creds(tctx, np, machine_credentials,
|
|
acct_name, passwords[i],
|
|
expected_success_status, interactive)) {
|
|
torture_fail(tctx, talloc_asprintf(tctx, "did not successfully to obtain %s for %s login with old password (#%d of #%d in history)",
|
|
nt_errstr(expected_success_status),
|
|
interactive ? "interactive" : "network", i, password_history_length));
|
|
}
|
|
|
|
torture_assert(tctx,
|
|
test_QueryUserInfo_badpwdcount(b, tctx, user_handle, &badpwdcount), "");
|
|
|
|
if (disable) {
|
|
/* torture_comment(tctx, "expecting bad pwd count to *NOT INCREASE* for pwd history entry %d\n", i); */
|
|
torture_assert_int_equal(tctx, badpwdcount, tmp, "unexpected badpwdcount");
|
|
} else {
|
|
/* torture_comment(tctx, "expecting bad pwd count to be 0 for pwd history entry %d\n", i); */
|
|
torture_assert_int_equal(tctx, badpwdcount, 0, "expected badpwdcount to be 0");
|
|
}
|
|
|
|
tmp = badpwdcount;
|
|
|
|
continue;
|
|
}
|
|
|
|
if (!test_SamLogon_with_creds(tctx, np, machine_credentials,
|
|
acct_name, passwords[i],
|
|
NT_STATUS_WRONG_PASSWORD, interactive)) {
|
|
torture_fail(tctx, talloc_asprintf(tctx, "succeeded to authenticate with old password (#%d of #%d in history)", i, password_history_length));
|
|
}
|
|
|
|
torture_assert(tctx,
|
|
test_QueryUserInfo_badpwdcount(b, tctx, user_handle, &badpwdcount), "");
|
|
|
|
/* - network samlogon will fail auth but not increase
|
|
* badpwdcount for 3rd last entry
|
|
* - interactive samlogon for 3rd and 2nd last entry */
|
|
|
|
if (i == password_history_length - 3 ||
|
|
(i == password_history_length - 2 && interactive)) {
|
|
/* torture_comment(tctx, "expecting bad pwd count to *NOT INCREASE * by one for pwd history entry %d\n", i); */
|
|
torture_assert_int_equal(tctx, badpwdcount, tmp, "unexpected badpwdcount");
|
|
} else {
|
|
/* torture_comment(tctx, "expecting bad pwd count to increase by one for pwd history entry %d\n", i); */
|
|
torture_assert_int_equal(tctx, badpwdcount, tmp + 1, "unexpected badpwdcount");
|
|
}
|
|
|
|
tmp = badpwdcount;
|
|
}
|
|
|
|
return true;
|
|
}
|
|
|
|
static bool test_Password_badpwdcount_wrap(struct dcerpc_pipe *p,
|
|
struct torture_context *tctx,
|
|
uint32_t acct_flags,
|
|
const char *acct_name,
|
|
struct policy_handle *domain_handle,
|
|
struct policy_handle *user_handle,
|
|
char **password,
|
|
struct cli_credentials *machine_credentials)
|
|
{
|
|
union samr_DomainInfo *q_info, s_info;
|
|
struct samr_DomInfo1 info1, _info1;
|
|
struct samr_DomInfo12 info12, _info12;
|
|
bool ret = true;
|
|
struct dcerpc_binding_handle *b = p->binding_handle;
|
|
struct dcerpc_pipe *np;
|
|
int i;
|
|
|
|
struct {
|
|
const char *comment;
|
|
bool disabled;
|
|
bool interactive;
|
|
NTSTATUS expected_success_status;
|
|
} creds[] = {
|
|
{
|
|
.comment = "network logon (disabled account)",
|
|
.disabled = true,
|
|
.interactive = false,
|
|
.expected_success_status= NT_STATUS_ACCOUNT_DISABLED
|
|
},
|
|
{
|
|
.comment = "network logon (enabled account)",
|
|
.disabled = false,
|
|
.interactive = false,
|
|
.expected_success_status= NT_STATUS_OK
|
|
},
|
|
{
|
|
.comment = "interactive logon (disabled account)",
|
|
.disabled = true,
|
|
.interactive = true,
|
|
.expected_success_status= NT_STATUS_ACCOUNT_DISABLED
|
|
},
|
|
{
|
|
.comment = "interactive logon (enabled account)",
|
|
.disabled = false,
|
|
.interactive = true,
|
|
.expected_success_status= NT_STATUS_OK
|
|
},
|
|
};
|
|
|
|
torture_assert(tctx, setup_schannel_netlogon_pipe(tctx, machine_credentials, &np), "");
|
|
|
|
/* backup old policies */
|
|
|
|
torture_assert(tctx,
|
|
test_QueryDomainInfo2_level(b, tctx, domain_handle,
|
|
DomainPasswordInformation, &q_info),
|
|
"failed to query domain info level 1");
|
|
|
|
info1 = q_info->info1;
|
|
_info1 = info1;
|
|
|
|
torture_assert(tctx,
|
|
test_QueryDomainInfo2_level(b, tctx, domain_handle,
|
|
DomainLockoutInformation, &q_info),
|
|
"failed to query domain info level 12");
|
|
|
|
info12 = q_info->info12;
|
|
_info12 = info12;
|
|
|
|
/* run tests */
|
|
|
|
for (i=0; i < ARRAY_SIZE(creds); i++) {
|
|
|
|
/* skip trust tests for now */
|
|
if (acct_flags & ACB_WSTRUST ||
|
|
acct_flags & ACB_SVRTRUST ||
|
|
acct_flags & ACB_DOMTRUST) {
|
|
continue;
|
|
}
|
|
|
|
if (!test_Password_badpwdcount(p, np, tctx, acct_flags, acct_name,
|
|
domain_handle, user_handle, password,
|
|
machine_credentials,
|
|
creds[i].comment,
|
|
creds[i].disabled,
|
|
creds[i].interactive,
|
|
creds[i].expected_success_status,
|
|
&_info1, &_info12)) {
|
|
torture_result(tctx, TORTURE_FAIL, "TEST #%d (%s) failed\n", i, creds[i].comment);
|
|
ret = false;
|
|
} else {
|
|
torture_comment(tctx, "TEST #%d (%s) succeeded\n", i, creds[i].comment);
|
|
}
|
|
}
|
|
|
|
/* restore policies */
|
|
|
|
s_info.info1 = info1;
|
|
|
|
torture_assert(tctx,
|
|
test_SetDomainInfo(b, tctx, domain_handle,
|
|
DomainPasswordInformation, &s_info),
|
|
"failed to set password information");
|
|
|
|
s_info.info12 = info12;
|
|
|
|
torture_assert(tctx,
|
|
test_SetDomainInfo(b, tctx, domain_handle,
|
|
DomainLockoutInformation, &s_info),
|
|
"failed to set lockout information");
|
|
|
|
return ret;
|
|
}
|
|
|
|
static bool test_QueryUserInfo_lockout(struct dcerpc_binding_handle *b,
|
|
struct torture_context *tctx,
|
|
struct policy_handle *domain_handle,
|
|
const char *acct_name,
|
|
uint16_t raw_bad_password_count,
|
|
uint16_t effective_bad_password_count,
|
|
uint32_t effective_acb_lockout)
|
|
{
|
|
struct policy_handle user_handle;
|
|
union samr_UserInfo *i;
|
|
struct samr_QueryUserInfo r;
|
|
|
|
NTSTATUS status = test_OpenUser_byname(b, tctx, domain_handle, acct_name, &user_handle);
|
|
if (!NT_STATUS_IS_OK(status)) {
|
|
return false;
|
|
}
|
|
|
|
r.in.user_handle = &user_handle;
|
|
r.in.level = 3;
|
|
r.out.info = &i;
|
|
torture_comment(tctx, "Testing QueryUserInfo level %d", r.in.level);
|
|
torture_assert_ntstatus_ok(tctx, dcerpc_samr_QueryUserInfo_r(b, tctx, &r),
|
|
"failed to query userinfo");
|
|
torture_assert_ntstatus_ok(tctx, r.out.result,
|
|
"failed to query userinfo");
|
|
torture_comment(tctx, " (acct_flags: 0x%08x) (raw_bad_pwd_count: %u)\n",
|
|
i->info3.acct_flags, i->info3.bad_password_count);
|
|
torture_assert_int_equal(tctx, i->info3.bad_password_count,
|
|
raw_bad_password_count,
|
|
"raw badpwdcount");
|
|
torture_assert_int_equal(tctx, i->info3.acct_flags & ACB_AUTOLOCK,
|
|
effective_acb_lockout,
|
|
"effective acb_lockout");
|
|
TALLOC_FREE(i);
|
|
|
|
r.in.user_handle = &user_handle;
|
|
r.in.level = 5;
|
|
r.out.info = &i;
|
|
torture_comment(tctx, "Testing QueryUserInfo level %d", r.in.level);
|
|
torture_assert_ntstatus_ok(tctx, dcerpc_samr_QueryUserInfo_r(b, tctx, &r),
|
|
"failed to query userinfo");
|
|
torture_assert_ntstatus_ok(tctx, r.out.result,
|
|
"failed to query userinfo");
|
|
torture_comment(tctx, " (acct_flags: 0x%08x) (effective_bad_pwd_count: %u)\n",
|
|
i->info5.acct_flags, i->info5.bad_password_count);
|
|
torture_assert_int_equal(tctx, i->info5.bad_password_count,
|
|
effective_bad_password_count,
|
|
"effective badpwdcount");
|
|
torture_assert_int_equal(tctx, i->info5.acct_flags & ACB_AUTOLOCK,
|
|
effective_acb_lockout,
|
|
"effective acb_lockout");
|
|
TALLOC_FREE(i);
|
|
|
|
r.in.user_handle = &user_handle;
|
|
r.in.level = 16;
|
|
r.out.info = &i;
|
|
torture_comment(tctx, "Testing QueryUserInfo level %d", r.in.level);
|
|
torture_assert_ntstatus_ok(tctx, dcerpc_samr_QueryUserInfo_r(b, tctx, &r),
|
|
"failed to query userinfo");
|
|
torture_assert_ntstatus_ok(tctx, r.out.result,
|
|
"failed to query userinfo");
|
|
torture_comment(tctx, " (acct_flags: 0x%08x)\n",
|
|
i->info16.acct_flags);
|
|
torture_assert_int_equal(tctx, i->info16.acct_flags & ACB_AUTOLOCK,
|
|
effective_acb_lockout,
|
|
"effective acb_lockout");
|
|
TALLOC_FREE(i);
|
|
|
|
r.in.user_handle = &user_handle;
|
|
r.in.level = 21;
|
|
r.out.info = &i;
|
|
torture_comment(tctx, "Testing QueryUserInfo level %d", r.in.level);
|
|
torture_assert_ntstatus_ok(tctx, dcerpc_samr_QueryUserInfo_r(b, tctx, &r),
|
|
"failed to query userinfo");
|
|
torture_assert_ntstatus_ok(tctx, r.out.result,
|
|
"failed to query userinfo");
|
|
torture_comment(tctx, " (acct_flags: 0x%08x) (effective_bad_pwd_count: %u)\n",
|
|
i->info21.acct_flags, i->info21.bad_password_count);
|
|
torture_assert_int_equal(tctx, i->info21.bad_password_count,
|
|
effective_bad_password_count,
|
|
"effective badpwdcount");
|
|
torture_assert_int_equal(tctx, i->info21.acct_flags & ACB_AUTOLOCK,
|
|
effective_acb_lockout,
|
|
"effective acb_lockout");
|
|
TALLOC_FREE(i);
|
|
|
|
if (!test_samr_handle_Close(b, tctx, &user_handle)) {
|
|
return false;
|
|
}
|
|
|
|
return true;
|
|
}
|
|
|
|
static bool test_Password_lockout(struct dcerpc_pipe *p,
|
|
struct dcerpc_pipe *np,
|
|
struct torture_context *tctx,
|
|
uint32_t acct_flags,
|
|
const char *acct_name,
|
|
struct policy_handle *domain_handle,
|
|
struct policy_handle *user_handle,
|
|
char **password,
|
|
struct cli_credentials *machine_credentials,
|
|
const char *comment,
|
|
bool disable,
|
|
bool interactive,
|
|
uint32_t password_history_length,
|
|
NTSTATUS expected_success_status,
|
|
struct samr_DomInfo1 *info1,
|
|
struct samr_DomInfo12 *info12)
|
|
{
|
|
union samr_DomainInfo info;
|
|
uint64_t lockout_threshold = 1;
|
|
uint32_t lockout_seconds = 5;
|
|
uint64_t delta_time_factor = 10 * 1000 * 1000;
|
|
struct dcerpc_binding_handle *b = p->binding_handle;
|
|
|
|
if (torture_setting_bool(tctx, "samba3", false)) {
|
|
lockout_seconds = 60;
|
|
}
|
|
|
|
torture_comment(tctx, "\nTesting account lockout: %s\n", comment);
|
|
|
|
/* set policies */
|
|
|
|
info.info1 = *info1;
|
|
|
|
torture_comment(tctx, "setting password history length to %d.\n", password_history_length);
|
|
info.info1.password_history_length = password_history_length;
|
|
|
|
torture_comment(tctx, "setting min password again.\n");
|
|
info.info1.min_password_age = 0;
|
|
|
|
torture_assert(tctx,
|
|
test_SetDomainInfo(b, tctx, domain_handle,
|
|
DomainPasswordInformation, &info),
|
|
"failed to set password history length");
|
|
|
|
info.info12 = *info12;
|
|
info.info12.lockout_threshold = lockout_threshold;
|
|
|
|
/* set lockout duration < lockout window: should fail */
|
|
info.info12.lockout_duration = ~(lockout_seconds * delta_time_factor);
|
|
info.info12.lockout_window = ~((lockout_seconds + 1) * delta_time_factor);
|
|
|
|
torture_assert(tctx,
|
|
test_SetDomainInfo_ntstatus(b, tctx, domain_handle,
|
|
DomainLockoutInformation, &info,
|
|
NT_STATUS_INVALID_PARAMETER),
|
|
"setting lockout duration < lockout window gave unexpected result");
|
|
|
|
info.info12.lockout_duration = 0;
|
|
info.info12.lockout_window = 0;
|
|
|
|
torture_assert(tctx,
|
|
test_SetDomainInfo(b, tctx, domain_handle,
|
|
DomainLockoutInformation, &info),
|
|
"failed to set lockout window and duration to 0");
|
|
|
|
|
|
/* set lockout duration of 5 seconds */
|
|
info.info12.lockout_duration = ~(lockout_seconds * delta_time_factor);
|
|
info.info12.lockout_window = ~(lockout_seconds * delta_time_factor);
|
|
|
|
torture_assert(tctx,
|
|
test_SetDomainInfo(b, tctx, domain_handle,
|
|
DomainLockoutInformation, &info),
|
|
"failed to set lockout window and duration to 5 seconds");
|
|
|
|
/* reset bad pwd count */
|
|
|
|
torture_assert(tctx,
|
|
test_reset_badpwdcount(p, tctx, user_handle, acct_flags, password), "");
|
|
|
|
|
|
/* enable or disable account */
|
|
|
|
if (disable) {
|
|
torture_assert(tctx,
|
|
test_SetUserInfo_acct_flags(b, tctx, user_handle,
|
|
acct_flags | ACB_DISABLED),
|
|
"failed to disable user");
|
|
} else {
|
|
torture_assert(tctx,
|
|
test_SetUserInfo_acct_flags(b, tctx, user_handle,
|
|
acct_flags & ~ACB_DISABLED),
|
|
"failed to enable user");
|
|
}
|
|
|
|
|
|
/* test logon with right password */
|
|
|
|
if (!test_SamLogon_with_creds(tctx, np, machine_credentials,
|
|
acct_name, *password,
|
|
expected_success_status, interactive)) {
|
|
torture_fail(tctx, "failed to auth with latest password");
|
|
}
|
|
|
|
torture_assert(tctx,
|
|
test_QueryUserInfo_lockout(b, tctx, domain_handle, acct_name,
|
|
0, 0, 0),
|
|
"expected account to not be locked");
|
|
|
|
/* test with wrong password ==> lockout */
|
|
|
|
if (!test_SamLogon_with_creds(tctx, np, machine_credentials,
|
|
acct_name, "random_crap",
|
|
NT_STATUS_WRONG_PASSWORD, interactive)) {
|
|
torture_fail(tctx, "succeeded to authenticate with wrong password");
|
|
}
|
|
|
|
/*
|
|
* curiously, windows does _not_ return fresh values of
|
|
* effective bad_password_count and ACB_AUTOLOCK.
|
|
*/
|
|
torture_assert(tctx,
|
|
test_QueryUserInfo_lockout(b, tctx, domain_handle, acct_name,
|
|
1, 1, ACB_AUTOLOCK),
|
|
"expected account to not be locked");
|
|
|
|
/* test with good password */
|
|
|
|
if (!test_SamLogon_with_creds(tctx, np, machine_credentials, acct_name,
|
|
*password,
|
|
NT_STATUS_ACCOUNT_LOCKED_OUT, interactive))
|
|
{
|
|
torture_fail(tctx, "authenticate did not return NT_STATUS_ACCOUNT_LOCKED_OUT");
|
|
}
|
|
|
|
/* bad pwd count should not get updated */
|
|
torture_assert(tctx,
|
|
test_QueryUserInfo_lockout(b, tctx, domain_handle, acct_name,
|
|
1, 1, ACB_AUTOLOCK),
|
|
"expected account to be locked");
|
|
|
|
torture_assert(tctx,
|
|
test_ChangePasswordUser2_ntstatus(p, tctx, acct_name, *password,
|
|
NT_STATUS_ACCOUNT_LOCKED_OUT),
|
|
"got wrong status from ChangePasswordUser2");
|
|
|
|
/* bad pwd count should not get updated */
|
|
torture_assert(tctx,
|
|
test_QueryUserInfo_lockout(b, tctx, domain_handle, acct_name,
|
|
1, 1, ACB_AUTOLOCK),
|
|
"expected account to be locked");
|
|
|
|
torture_assert(tctx,
|
|
test_ChangePasswordUser2_ntstatus(p, tctx, acct_name, "random_crap", NT_STATUS_ACCOUNT_LOCKED_OUT),
|
|
"got wrong status from ChangePasswordUser2");
|
|
|
|
/* bad pwd count should not get updated */
|
|
torture_assert(tctx,
|
|
test_QueryUserInfo_lockout(b, tctx, domain_handle, acct_name,
|
|
1, 1, ACB_AUTOLOCK),
|
|
"expected account to be locked");
|
|
|
|
/* with bad password */
|
|
|
|
if (!test_SamLogon_with_creds(tctx, np, machine_credentials,
|
|
acct_name, "random_crap2",
|
|
NT_STATUS_ACCOUNT_LOCKED_OUT, interactive))
|
|
{
|
|
torture_fail(tctx, "authenticate did not return NT_STATUS_ACCOUNT_LOCKED_OUT");
|
|
}
|
|
|
|
/* bad pwd count should not get updated */
|
|
torture_assert(tctx,
|
|
test_QueryUserInfo_lockout(b, tctx, domain_handle, acct_name,
|
|
1, 1, ACB_AUTOLOCK),
|
|
"expected account to be locked");
|
|
|
|
/* let lockout duration expire ==> unlock */
|
|
|
|
torture_comment(tctx, "let lockout duration expire...\n");
|
|
sleep(lockout_seconds + 1);
|
|
|
|
torture_assert(tctx,
|
|
test_QueryUserInfo_lockout(b, tctx, domain_handle, acct_name,
|
|
1, 0, 0),
|
|
"expected account to not be locked");
|
|
|
|
if (!test_SamLogon_with_creds(tctx, np, machine_credentials, acct_name,
|
|
*password,
|
|
expected_success_status, interactive))
|
|
{
|
|
torture_fail(tctx, "failed to authenticate after lockout expired");
|
|
}
|
|
|
|
if (NT_STATUS_IS_OK(expected_success_status)) {
|
|
torture_assert(tctx,
|
|
test_QueryUserInfo_lockout(b, tctx, domain_handle, acct_name,
|
|
0, 0, 0),
|
|
"expected account to not be locked");
|
|
} else {
|
|
torture_assert(tctx,
|
|
test_QueryUserInfo_lockout(b, tctx, domain_handle, acct_name,
|
|
1, 0, 0),
|
|
"expected account to not be locked");
|
|
}
|
|
|
|
torture_assert(tctx,
|
|
test_ChangePasswordUser2_ntstatus(p, tctx, acct_name, "random_crap", NT_STATUS_WRONG_PASSWORD),
|
|
"got wrong status from ChangePasswordUser2");
|
|
|
|
torture_assert(tctx,
|
|
test_QueryUserInfo_lockout(b, tctx, domain_handle, acct_name,
|
|
1, 1, ACB_AUTOLOCK),
|
|
"expected account to be locked");
|
|
|
|
torture_assert(tctx,
|
|
test_ChangePasswordUser2_ntstatus(p, tctx, acct_name, *password, NT_STATUS_ACCOUNT_LOCKED_OUT),
|
|
"got wrong status from ChangePasswordUser2");
|
|
|
|
torture_assert(tctx,
|
|
test_QueryUserInfo_lockout(b, tctx, domain_handle, acct_name,
|
|
1, 1, ACB_AUTOLOCK),
|
|
"expected account to be locked");
|
|
|
|
torture_assert(tctx,
|
|
test_ChangePasswordUser2_ntstatus(p, tctx, acct_name, "random_crap", NT_STATUS_ACCOUNT_LOCKED_OUT),
|
|
"got wrong status from ChangePasswordUser2");
|
|
|
|
torture_assert(tctx,
|
|
test_QueryUserInfo_lockout(b, tctx, domain_handle, acct_name,
|
|
1, 1, ACB_AUTOLOCK),
|
|
"expected account to be locked");
|
|
|
|
/* let lockout duration expire ==> unlock */
|
|
|
|
torture_comment(tctx, "let lockout duration expire...\n");
|
|
sleep(lockout_seconds + 1);
|
|
|
|
torture_assert(tctx,
|
|
test_QueryUserInfo_lockout(b, tctx, domain_handle, acct_name,
|
|
1, 0, 0),
|
|
"expected account to not be locked");
|
|
|
|
if (!test_SamLogon_with_creds(tctx, np, machine_credentials, acct_name,
|
|
*password,
|
|
expected_success_status, interactive))
|
|
{
|
|
torture_fail(tctx, "failed to authenticate after lockout expired");
|
|
}
|
|
|
|
if (NT_STATUS_IS_OK(expected_success_status)) {
|
|
torture_assert(tctx,
|
|
test_QueryUserInfo_lockout(b, tctx, domain_handle, acct_name,
|
|
0, 0, 0),
|
|
"expected account to not be locked");
|
|
} else {
|
|
torture_assert(tctx,
|
|
test_QueryUserInfo_lockout(b, tctx, domain_handle, acct_name,
|
|
1, 0, 0),
|
|
"expected account to not be locked");
|
|
}
|
|
|
|
/* Testing ChangePasswordUser behaviour with 3 attempts */
|
|
info.info12.lockout_threshold = 3;
|
|
|
|
torture_assert(tctx,
|
|
test_SetDomainInfo(b, tctx, domain_handle,
|
|
DomainLockoutInformation, &info),
|
|
"failed to set lockout threshold to 3");
|
|
|
|
if (NT_STATUS_IS_OK(expected_success_status)) {
|
|
torture_assert(tctx,
|
|
test_QueryUserInfo_lockout(b, tctx, domain_handle, acct_name,
|
|
0, 0, 0),
|
|
"expected account to not be locked");
|
|
} else {
|
|
torture_assert(tctx,
|
|
test_QueryUserInfo_lockout(b, tctx, domain_handle, acct_name,
|
|
1, 0, 0),
|
|
"expected account to not be locked");
|
|
}
|
|
|
|
torture_assert(tctx,
|
|
test_ChangePasswordUser2_ntstatus(p, tctx, acct_name, "random_crap", NT_STATUS_WRONG_PASSWORD),
|
|
"got wrong status from ChangePasswordUser2");
|
|
|
|
/* bad pwd count will get updated */
|
|
torture_assert(tctx,
|
|
test_QueryUserInfo_lockout(b, tctx, domain_handle, acct_name,
|
|
1, 1, 0),
|
|
"expected account to not be locked");
|
|
|
|
torture_assert(tctx,
|
|
test_ChangePasswordUser2_ntstatus(p, tctx, acct_name, "random_crap", NT_STATUS_WRONG_PASSWORD),
|
|
"got wrong status from ChangePasswordUser2");
|
|
|
|
/* bad pwd count will get updated */
|
|
torture_assert(tctx,
|
|
test_QueryUserInfo_lockout(b, tctx, domain_handle, acct_name,
|
|
2, 2, 0),
|
|
"expected account to not be locked");
|
|
|
|
torture_assert(tctx,
|
|
test_ChangePasswordUser2_ntstatus(p, tctx, acct_name, "random_crap", NT_STATUS_WRONG_PASSWORD),
|
|
"got wrong status from ChangePasswordUser2");
|
|
|
|
/* bad pwd count should get updated */
|
|
torture_assert(tctx,
|
|
test_QueryUserInfo_lockout(b, tctx, domain_handle, acct_name,
|
|
3, 3, ACB_AUTOLOCK),
|
|
"expected account to be locked");
|
|
|
|
torture_assert(tctx,
|
|
test_ChangePasswordUser2_ntstatus(p, tctx, acct_name, *password, NT_STATUS_ACCOUNT_LOCKED_OUT),
|
|
"got wrong status from ChangePasswordUser2");
|
|
|
|
/* bad pwd count should not get updated */
|
|
torture_assert(tctx,
|
|
test_QueryUserInfo_lockout(b, tctx, domain_handle, acct_name,
|
|
3, 3, ACB_AUTOLOCK),
|
|
"expected account to be locked");
|
|
|
|
/* let lockout duration expire ==> unlock */
|
|
|
|
torture_comment(tctx, "let lockout duration expire...\n");
|
|
sleep(lockout_seconds + 1);
|
|
|
|
torture_assert(tctx,
|
|
test_QueryUserInfo_lockout(b, tctx, domain_handle, acct_name,
|
|
3, 0, 0),
|
|
"expected account to not be locked");
|
|
|
|
torture_assert(tctx,
|
|
test_ChangePasswordUser2(p, tctx, acct_name, password, NULL, false),
|
|
"got wrong status from ChangePasswordUser2");
|
|
|
|
torture_assert(tctx,
|
|
test_QueryUserInfo_lockout(b, tctx, domain_handle, acct_name,
|
|
3, 0, 0),
|
|
"expected account to not be locked");
|
|
|
|
/* Used to reset the badPwdCount for the other tests */
|
|
if (!test_SamLogon_with_creds(tctx, np, machine_credentials, acct_name,
|
|
*password,
|
|
expected_success_status, interactive))
|
|
{
|
|
torture_fail(tctx, "failed to authenticate after lockout expired");
|
|
}
|
|
|
|
if (NT_STATUS_IS_OK(expected_success_status)) {
|
|
torture_assert(tctx,
|
|
test_QueryUserInfo_lockout(b, tctx, domain_handle, acct_name,
|
|
0, 0, 0),
|
|
"expected account to not be locked");
|
|
} else {
|
|
torture_assert(tctx,
|
|
test_QueryUserInfo_lockout(b, tctx, domain_handle, acct_name,
|
|
3, 0, 0),
|
|
"expected account to not be locked");
|
|
}
|
|
|
|
return true;
|
|
}
|
|
|
|
static bool test_Password_lockout_wrap(struct dcerpc_pipe *p,
|
|
struct torture_context *tctx,
|
|
uint32_t acct_flags,
|
|
const char *acct_name,
|
|
struct policy_handle *domain_handle,
|
|
struct policy_handle *user_handle,
|
|
char **password,
|
|
struct cli_credentials *machine_credentials)
|
|
{
|
|
union samr_DomainInfo *q_info, s_info;
|
|
struct samr_DomInfo1 info1, _info1;
|
|
struct samr_DomInfo12 info12, _info12;
|
|
bool ret = true;
|
|
struct dcerpc_binding_handle *b = p->binding_handle;
|
|
struct dcerpc_pipe *np;
|
|
int i;
|
|
|
|
struct {
|
|
const char *comment;
|
|
bool disabled;
|
|
bool interactive;
|
|
uint32_t password_history_length;
|
|
NTSTATUS expected_success_status;
|
|
} creds[] = {
|
|
{
|
|
.comment = "network logon (disabled account)",
|
|
.disabled = true,
|
|
.interactive = false,
|
|
.expected_success_status= NT_STATUS_ACCOUNT_DISABLED
|
|
},
|
|
{
|
|
.comment = "network logon (enabled account)",
|
|
.disabled = false,
|
|
.interactive = false,
|
|
.expected_success_status= NT_STATUS_OK
|
|
},
|
|
{
|
|
.comment = "network logon (enabled account, history len = 1)",
|
|
.disabled = false,
|
|
.interactive = false,
|
|
.expected_success_status= NT_STATUS_OK,
|
|
.password_history_length = 1
|
|
},
|
|
{
|
|
.comment = "interactive logon (disabled account)",
|
|
.disabled = true,
|
|
.interactive = true,
|
|
.expected_success_status= NT_STATUS_ACCOUNT_DISABLED
|
|
},
|
|
{
|
|
.comment = "interactive logon (enabled account)",
|
|
.disabled = false,
|
|
.interactive = true,
|
|
.expected_success_status= NT_STATUS_OK
|
|
},
|
|
{
|
|
.comment = "interactive logon (enabled account, history len = 1)",
|
|
.disabled = false,
|
|
.interactive = true,
|
|
.expected_success_status= NT_STATUS_OK,
|
|
.password_history_length = 1
|
|
},
|
|
};
|
|
|
|
torture_assert(tctx, setup_schannel_netlogon_pipe(tctx, machine_credentials, &np), "");
|
|
|
|
/* backup old policies */
|
|
|
|
torture_assert(tctx,
|
|
test_QueryDomainInfo2_level(b, tctx, domain_handle,
|
|
DomainPasswordInformation, &q_info),
|
|
"failed to query domain info level 1");
|
|
|
|
info1 = q_info->info1;
|
|
_info1 = info1;
|
|
|
|
torture_assert(tctx,
|
|
test_QueryDomainInfo2_level(b, tctx, domain_handle,
|
|
DomainLockoutInformation, &q_info),
|
|
"failed to query domain info level 12");
|
|
|
|
info12 = q_info->info12;
|
|
_info12 = info12;
|
|
|
|
/* run tests */
|
|
|
|
for (i=0; i < ARRAY_SIZE(creds); i++) {
|
|
bool test_passed;
|
|
/* skip trust tests for now */
|
|
if (acct_flags & ACB_WSTRUST ||
|
|
acct_flags & ACB_SVRTRUST ||
|
|
acct_flags & ACB_DOMTRUST) {
|
|
continue;
|
|
}
|
|
|
|
test_passed = test_Password_lockout(p, np, tctx, acct_flags, acct_name,
|
|
domain_handle, user_handle, password,
|
|
machine_credentials,
|
|
creds[i].comment,
|
|
creds[i].disabled,
|
|
creds[i].interactive,
|
|
creds[i].password_history_length,
|
|
creds[i].expected_success_status,
|
|
&_info1, &_info12);
|
|
ret &= test_passed;
|
|
if (!test_passed) {
|
|
torture_result(tctx, TORTURE_FAIL, "TEST #%d (%s) failed\n", i, creds[i].comment);
|
|
break;
|
|
} else {
|
|
torture_comment(tctx, "TEST #%d (%s) succeeded\n", i, creds[i].comment);
|
|
}
|
|
}
|
|
|
|
/* restore policies */
|
|
|
|
s_info.info1 = info1;
|
|
|
|
torture_assert(tctx,
|
|
test_SetDomainInfo(b, tctx, domain_handle,
|
|
DomainPasswordInformation, &s_info),
|
|
"failed to set password information");
|
|
|
|
s_info.info12 = info12;
|
|
|
|
torture_assert(tctx,
|
|
test_SetDomainInfo(b, tctx, domain_handle,
|
|
DomainLockoutInformation, &s_info),
|
|
"failed to set lockout information");
|
|
|
|
return ret;
|
|
}
|
|
|
|
static bool test_DeleteUser_with_privs(struct dcerpc_pipe *p,
|
|
struct dcerpc_pipe *lp,
|
|
struct torture_context *tctx,
|
|
struct policy_handle *domain_handle,
|
|
struct policy_handle *lsa_handle,
|
|
struct policy_handle *user_handle,
|
|
const struct dom_sid *domain_sid,
|
|
uint32_t rid,
|
|
struct cli_credentials *machine_credentials)
|
|
{
|
|
bool ret = true;
|
|
struct dcerpc_binding_handle *b = p->binding_handle;
|
|
struct dcerpc_binding_handle *lb = lp->binding_handle;
|
|
|
|
struct policy_handle lsa_acct_handle;
|
|
struct dom_sid *user_sid;
|
|
|
|
user_sid = dom_sid_add_rid(tctx, domain_sid, rid);
|
|
|
|
{
|
|
struct lsa_EnumAccountRights r;
|
|
struct lsa_RightSet rights;
|
|
|
|
torture_comment(tctx, "Testing LSA EnumAccountRights\n");
|
|
|
|
r.in.handle = lsa_handle;
|
|
r.in.sid = user_sid;
|
|
r.out.rights = &rights;
|
|
|
|
torture_assert_ntstatus_ok(tctx, dcerpc_lsa_EnumAccountRights_r(lb, tctx, &r),
|
|
"lsa_EnumAccountRights failed");
|
|
torture_assert_ntstatus_equal(tctx, r.out.result, NT_STATUS_OBJECT_NAME_NOT_FOUND,
|
|
"Expected enum rights for account to fail");
|
|
}
|
|
|
|
{
|
|
struct lsa_RightSet rights;
|
|
struct lsa_StringLarge names[2];
|
|
struct lsa_AddAccountRights r;
|
|
|
|
torture_comment(tctx, "Testing LSA AddAccountRights\n");
|
|
|
|
init_lsa_StringLarge(&names[0], "SeMachineAccountPrivilege");
|
|
init_lsa_StringLarge(&names[1], NULL);
|
|
|
|
rights.count = 1;
|
|
rights.names = names;
|
|
|
|
r.in.handle = lsa_handle;
|
|
r.in.sid = user_sid;
|
|
r.in.rights = &rights;
|
|
|
|
torture_assert_ntstatus_ok(tctx, dcerpc_lsa_AddAccountRights_r(lb, tctx, &r),
|
|
"lsa_AddAccountRights failed");
|
|
torture_assert_ntstatus_ok(tctx, r.out.result,
|
|
"Failed to add privileges");
|
|
}
|
|
|
|
{
|
|
struct lsa_RightSet rights;
|
|
struct lsa_StringLarge names[2];
|
|
struct lsa_AddAccountRights r;
|
|
|
|
torture_comment(tctx, "Testing LSA AddAccountRights 1\n");
|
|
|
|
init_lsa_StringLarge(&names[0], "SeInteractiveLogonRight");
|
|
init_lsa_StringLarge(&names[1], NULL);
|
|
|
|
rights.count = 1;
|
|
rights.names = names;
|
|
|
|
r.in.handle = lsa_handle;
|
|
r.in.sid = user_sid;
|
|
r.in.rights = &rights;
|
|
|
|
torture_assert_ntstatus_ok(tctx, dcerpc_lsa_AddAccountRights_r(lb, tctx, &r),
|
|
"lsa_AddAccountRights 1 failed");
|
|
|
|
if (torture_setting_bool(tctx, "nt4_dc", false)) {
|
|
/*
|
|
* The NT4 DC doesn't implement Rights.
|
|
*/
|
|
torture_assert_ntstatus_equal(tctx, r.out.result,
|
|
NT_STATUS_NO_SUCH_PRIVILEGE,
|
|
"Add rights failed with incorrect error");
|
|
} else {
|
|
torture_assert_ntstatus_ok(tctx, r.out.result,
|
|
"Failed to add rights");
|
|
|
|
}
|
|
}
|
|
|
|
|
|
{
|
|
struct lsa_EnumAccounts r;
|
|
uint32_t resume_handle = 0;
|
|
struct lsa_SidArray lsa_sid_array;
|
|
int i;
|
|
bool found_sid = false;
|
|
|
|
torture_comment(tctx, "Testing LSA EnumAccounts\n");
|
|
|
|
r.in.handle = lsa_handle;
|
|
r.in.num_entries = 0x1000;
|
|
r.in.resume_handle = &resume_handle;
|
|
r.out.sids = &lsa_sid_array;
|
|
r.out.resume_handle = &resume_handle;
|
|
|
|
torture_assert_ntstatus_ok(tctx, dcerpc_lsa_EnumAccounts_r(lb, tctx, &r),
|
|
"lsa_EnumAccounts failed");
|
|
torture_assert_ntstatus_ok(tctx, r.out.result,
|
|
"Failed to enum accounts");
|
|
|
|
for (i=0; i < lsa_sid_array.num_sids; i++) {
|
|
if (dom_sid_equal(user_sid, lsa_sid_array.sids[i].sid)) {
|
|
found_sid = true;
|
|
}
|
|
}
|
|
|
|
torture_assert(tctx, found_sid,
|
|
"failed to list privileged account");
|
|
}
|
|
|
|
{
|
|
struct lsa_EnumAccountRights r;
|
|
struct lsa_RightSet user_rights;
|
|
uint32_t expected_count = 2;
|
|
|
|
if (torture_setting_bool(tctx, "nt4_dc", false)) {
|
|
/*
|
|
* NT4 DC doesn't store rights.
|
|
*/
|
|
expected_count = 1;
|
|
}
|
|
|
|
torture_comment(tctx, "Testing LSA EnumAccountRights\n");
|
|
|
|
r.in.handle = lsa_handle;
|
|
r.in.sid = user_sid;
|
|
r.out.rights = &user_rights;
|
|
|
|
torture_assert_ntstatus_ok(tctx, dcerpc_lsa_EnumAccountRights_r(lb, tctx, &r),
|
|
"lsa_EnumAccountRights failed");
|
|
torture_assert_ntstatus_ok(tctx, r.out.result,
|
|
"Failed to enum rights for account");
|
|
|
|
if (user_rights.count < expected_count) {
|
|
torture_result(tctx, TORTURE_FAIL, "failed to find newly added rights");
|
|
return false;
|
|
}
|
|
}
|
|
|
|
{
|
|
struct lsa_OpenAccount r;
|
|
|
|
torture_comment(tctx, "Testing LSA OpenAccount\n");
|
|
|
|
r.in.handle = lsa_handle;
|
|
r.in.sid = user_sid;
|
|
r.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
|
|
r.out.acct_handle = &lsa_acct_handle;
|
|
|
|
torture_assert_ntstatus_ok(tctx, dcerpc_lsa_OpenAccount_r(lb, tctx, &r),
|
|
"lsa_OpenAccount failed");
|
|
torture_assert_ntstatus_ok(tctx, r.out.result,
|
|
"Failed to open lsa account");
|
|
}
|
|
|
|
{
|
|
struct lsa_GetSystemAccessAccount r;
|
|
uint32_t access_mask;
|
|
|
|
torture_comment(tctx, "Testing LSA GetSystemAccessAccount\n");
|
|
|
|
r.in.handle = &lsa_acct_handle;
|
|
r.out.access_mask = &access_mask;
|
|
|
|
torture_assert_ntstatus_ok(tctx, dcerpc_lsa_GetSystemAccessAccount_r(lb, tctx, &r),
|
|
"lsa_GetSystemAccessAccount failed");
|
|
torture_assert_ntstatus_ok(tctx, r.out.result,
|
|
"Failed to get lsa system access account");
|
|
}
|
|
|
|
{
|
|
struct lsa_Close r;
|
|
|
|
torture_comment(tctx, "Testing LSA Close\n");
|
|
|
|
r.in.handle = &lsa_acct_handle;
|
|
r.out.handle = &lsa_acct_handle;
|
|
|
|
torture_assert_ntstatus_ok(tctx, dcerpc_lsa_Close_r(lb, tctx, &r),
|
|
"lsa_Close failed");
|
|
torture_assert_ntstatus_ok(tctx, r.out.result,
|
|
"Failed to close lsa");
|
|
}
|
|
|
|
{
|
|
struct samr_DeleteUser r;
|
|
|
|
torture_comment(tctx, "Testing SAMR DeleteUser\n");
|
|
|
|
r.in.user_handle = user_handle;
|
|
r.out.user_handle = user_handle;
|
|
|
|
torture_assert_ntstatus_ok(tctx, dcerpc_samr_DeleteUser_r(b, tctx, &r),
|
|
"DeleteUser failed");
|
|
torture_assert_ntstatus_ok(tctx, r.out.result,
|
|
"DeleteUser failed");
|
|
}
|
|
|
|
{
|
|
struct lsa_EnumAccounts r;
|
|
uint32_t resume_handle = 0;
|
|
struct lsa_SidArray lsa_sid_array;
|
|
int i;
|
|
bool found_sid = false;
|
|
|
|
torture_comment(tctx, "Testing LSA EnumAccounts\n");
|
|
|
|
r.in.handle = lsa_handle;
|
|
r.in.num_entries = 0x1000;
|
|
r.in.resume_handle = &resume_handle;
|
|
r.out.sids = &lsa_sid_array;
|
|
r.out.resume_handle = &resume_handle;
|
|
|
|
torture_assert_ntstatus_ok(tctx, dcerpc_lsa_EnumAccounts_r(lb, tctx, &r),
|
|
"lsa_EnumAccounts failed");
|
|
torture_assert_ntstatus_ok(tctx, r.out.result,
|
|
"Failed to enum accounts");
|
|
|
|
for (i=0; i < lsa_sid_array.num_sids; i++) {
|
|
if (dom_sid_equal(user_sid, lsa_sid_array.sids[i].sid)) {
|
|
found_sid = true;
|
|
}
|
|
}
|
|
|
|
torture_assert(tctx, found_sid,
|
|
"failed to list privileged account");
|
|
}
|
|
|
|
{
|
|
struct lsa_EnumAccountRights r;
|
|
struct lsa_RightSet user_rights;
|
|
|
|
torture_comment(tctx, "Testing LSA EnumAccountRights\n");
|
|
|
|
r.in.handle = lsa_handle;
|
|
r.in.sid = user_sid;
|
|
r.out.rights = &user_rights;
|
|
|
|
torture_assert_ntstatus_ok(tctx, dcerpc_lsa_EnumAccountRights_r(lb, tctx, &r),
|
|
"lsa_EnumAccountRights failed");
|
|
torture_assert_ntstatus_ok(tctx, r.out.result,
|
|
"Failed to enum rights for account");
|
|
|
|
if (user_rights.count < 1) {
|
|
torture_result(tctx, TORTURE_FAIL, "failed to find newly added rights");
|
|
return false;
|
|
}
|
|
}
|
|
|
|
{
|
|
struct lsa_OpenAccount r;
|
|
|
|
torture_comment(tctx, "Testing LSA OpenAccount\n");
|
|
|
|
r.in.handle = lsa_handle;
|
|
r.in.sid = user_sid;
|
|
r.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
|
|
r.out.acct_handle = &lsa_acct_handle;
|
|
|
|
torture_assert_ntstatus_ok(tctx, dcerpc_lsa_OpenAccount_r(lb, tctx, &r),
|
|
"lsa_OpenAccount failed");
|
|
torture_assert_ntstatus_ok(tctx, r.out.result,
|
|
"Failed to open lsa account");
|
|
}
|
|
|
|
{
|
|
struct lsa_GetSystemAccessAccount r;
|
|
uint32_t access_mask;
|
|
|
|
torture_comment(tctx, "Testing LSA GetSystemAccessAccount\n");
|
|
|
|
r.in.handle = &lsa_acct_handle;
|
|
r.out.access_mask = &access_mask;
|
|
|
|
torture_assert_ntstatus_ok(tctx, dcerpc_lsa_GetSystemAccessAccount_r(lb, tctx, &r),
|
|
"lsa_GetSystemAccessAccount failed");
|
|
torture_assert_ntstatus_ok(tctx, r.out.result,
|
|
"Failed to get lsa system access account");
|
|
}
|
|
|
|
{
|
|
struct lsa_DeleteObject r;
|
|
|
|
torture_comment(tctx, "Testing LSA DeleteObject\n");
|
|
|
|
r.in.handle = &lsa_acct_handle;
|
|
r.out.handle = &lsa_acct_handle;
|
|
|
|
torture_assert_ntstatus_ok(tctx, dcerpc_lsa_DeleteObject_r(lb, tctx, &r),
|
|
"lsa_DeleteObject failed");
|
|
torture_assert_ntstatus_ok(tctx, r.out.result,
|
|
"Failed to delete object");
|
|
}
|
|
|
|
{
|
|
struct lsa_EnumAccounts r;
|
|
uint32_t resume_handle = 0;
|
|
struct lsa_SidArray lsa_sid_array;
|
|
int i;
|
|
bool found_sid = false;
|
|
|
|
torture_comment(tctx, "Testing LSA EnumAccounts\n");
|
|
|
|
r.in.handle = lsa_handle;
|
|
r.in.num_entries = 0x1000;
|
|
r.in.resume_handle = &resume_handle;
|
|
r.out.sids = &lsa_sid_array;
|
|
r.out.resume_handle = &resume_handle;
|
|
|
|
torture_assert_ntstatus_ok(tctx, dcerpc_lsa_EnumAccounts_r(lb, tctx, &r),
|
|
"lsa_EnumAccounts failed");
|
|
torture_assert_ntstatus_ok(tctx, r.out.result,
|
|
"Failed to enum accounts");
|
|
|
|
for (i=0; i < lsa_sid_array.num_sids; i++) {
|
|
if (dom_sid_equal(user_sid, lsa_sid_array.sids[i].sid)) {
|
|
found_sid = true;
|
|
}
|
|
}
|
|
|
|
torture_assert(tctx, !found_sid,
|
|
"should not have listed privileged account");
|
|
}
|
|
|
|
{
|
|
struct lsa_EnumAccountRights r;
|
|
struct lsa_RightSet user_rights;
|
|
|
|
torture_comment(tctx, "Testing LSA EnumAccountRights\n");
|
|
|
|
r.in.handle = lsa_handle;
|
|
r.in.sid = user_sid;
|
|
r.out.rights = &user_rights;
|
|
|
|
torture_assert_ntstatus_ok(tctx, dcerpc_lsa_EnumAccountRights_r(lb, tctx, &r),
|
|
"lsa_EnumAccountRights failed");
|
|
torture_assert_ntstatus_equal(tctx, r.out.result, NT_STATUS_OBJECT_NAME_NOT_FOUND,
|
|
"Failed to enum rights for account");
|
|
}
|
|
|
|
return ret;
|
|
}
|
|
|
|
static bool test_user_ops(struct dcerpc_pipe *p,
|
|
struct torture_context *tctx,
|
|
struct policy_handle *user_handle,
|
|
struct policy_handle *domain_handle,
|
|
const struct dom_sid *domain_sid,
|
|
uint32_t base_acct_flags,
|
|
const char *base_acct_name, enum torture_samr_choice which_ops,
|
|
struct cli_credentials *machine_credentials)
|
|
{
|
|
char *password = NULL;
|
|
struct samr_QueryUserInfo q;
|
|
union samr_UserInfo *info;
|
|
NTSTATUS status;
|
|
struct dcerpc_binding_handle *b = p->binding_handle;
|
|
|
|
bool ret = true;
|
|
int i;
|
|
uint32_t rid;
|
|
const uint32_t password_fields[] = {
|
|
SAMR_FIELD_NT_PASSWORD_PRESENT,
|
|
SAMR_FIELD_LM_PASSWORD_PRESENT,
|
|
SAMR_FIELD_NT_PASSWORD_PRESENT | SAMR_FIELD_LM_PASSWORD_PRESENT,
|
|
0
|
|
};
|
|
|
|
status = test_LookupName(b, tctx, domain_handle, base_acct_name, &rid);
|
|
if (!NT_STATUS_IS_OK(status)) {
|
|
ret = false;
|
|
}
|
|
|
|
switch (which_ops) {
|
|
case TORTURE_SAMR_USER_ATTRIBUTES:
|
|
if (!test_QuerySecurity(b, tctx, user_handle)) {
|
|
ret = false;
|
|
}
|
|
|
|
if (!test_QueryUserInfo(b, tctx, user_handle)) {
|
|
ret = false;
|
|
}
|
|
|
|
if (!test_QueryUserInfo2(b, tctx, user_handle)) {
|
|
ret = false;
|
|
}
|
|
|
|
if (!test_SetUserInfo(b, tctx, user_handle, base_acct_flags,
|
|
base_acct_name)) {
|
|
ret = false;
|
|
}
|
|
|
|
if (!test_GetUserPwInfo(b, tctx, user_handle)) {
|
|
ret = false;
|
|
}
|
|
|
|
if (!test_TestPrivateFunctionsUser(b, tctx, user_handle)) {
|
|
ret = false;
|
|
}
|
|
|
|
if (!test_SetUserPass(p, tctx, user_handle, &password)) {
|
|
ret = false;
|
|
}
|
|
break;
|
|
case TORTURE_SAMR_PASSWORDS:
|
|
if (base_acct_flags & (ACB_WSTRUST|ACB_DOMTRUST|ACB_SVRTRUST)) {
|
|
char simple_pass[9];
|
|
char *v = generate_random_str(tctx, 1);
|
|
|
|
ZERO_STRUCT(simple_pass);
|
|
memset(simple_pass, *v, sizeof(simple_pass) - 1);
|
|
|
|
torture_comment(tctx, "Testing machine account password policy rules\n");
|
|
|
|
/* Workstation trust accounts don't seem to need to honour password quality policy */
|
|
if (!test_SetUserPassEx(p, tctx, user_handle, true, &password)) {
|
|
ret = false;
|
|
}
|
|
|
|
if (!test_ChangePasswordUser2(p, tctx, base_acct_name, &password, simple_pass, false)) {
|
|
ret = false;
|
|
}
|
|
|
|
/* reset again, to allow another 'user' password change */
|
|
if (!test_SetUserPassEx(p, tctx, user_handle, true, &password)) {
|
|
ret = false;
|
|
}
|
|
|
|
/* Try a 'short' password */
|
|
if (!test_ChangePasswordUser2(p, tctx, base_acct_name, &password, samr_rand_pass(tctx, 4), false)) {
|
|
ret = false;
|
|
}
|
|
|
|
/* Try a compleatly random password */
|
|
if (!test_ChangePasswordRandomBytes(p, tctx, base_acct_name, user_handle, &password)) {
|
|
ret = false;
|
|
}
|
|
}
|
|
|
|
for (i = 0; password_fields[i]; i++) {
|
|
if (!test_SetUserPass_23(p, tctx, user_handle, password_fields[i], &password)) {
|
|
ret = false;
|
|
}
|
|
|
|
/* check it was set right */
|
|
if (!test_ChangePasswordUser3(p, tctx, base_acct_name, 0, &password, NULL, 0, false)) {
|
|
ret = false;
|
|
}
|
|
}
|
|
|
|
for (i = 0; password_fields[i]; i++) {
|
|
if (!test_SetUserPass_25(p, tctx, user_handle, password_fields[i], &password)) {
|
|
ret = false;
|
|
}
|
|
|
|
/* check it was set right */
|
|
if (!test_ChangePasswordUser3(p, tctx, base_acct_name, 0, &password, NULL, 0, false)) {
|
|
ret = false;
|
|
}
|
|
}
|
|
|
|
if (!test_SetUserPassEx(p, tctx, user_handle, false, &password)) {
|
|
ret = false;
|
|
}
|
|
|
|
if (!test_ChangePassword(p, tctx, base_acct_name, domain_handle, &password)) {
|
|
ret = false;
|
|
}
|
|
|
|
if (!test_SetUserPass_18(p, tctx, user_handle, &password)) {
|
|
ret = false;
|
|
}
|
|
|
|
if (!test_ChangePasswordUser3(p, tctx, base_acct_name, 0, &password, NULL, 0, false)) {
|
|
ret = false;
|
|
}
|
|
|
|
for (i = 0; password_fields[i]; i++) {
|
|
|
|
if (password_fields[i] == SAMR_FIELD_LM_PASSWORD_PRESENT) {
|
|
/* we need to skip as that would break
|
|
* the ChangePasswordUser3 verify */
|
|
continue;
|
|
}
|
|
|
|
if (!test_SetUserPass_21(p, tctx, user_handle, password_fields[i], &password)) {
|
|
ret = false;
|
|
}
|
|
|
|
/* check it was set right */
|
|
if (!test_ChangePasswordUser3(p, tctx, base_acct_name, 0, &password, NULL, 0, false)) {
|
|
ret = false;
|
|
}
|
|
}
|
|
|
|
q.in.user_handle = user_handle;
|
|
q.in.level = 5;
|
|
q.out.info = &info;
|
|
|
|
torture_assert_ntstatus_ok(tctx, dcerpc_samr_QueryUserInfo_r(b, tctx, &q),
|
|
"QueryUserInfo failed");
|
|
if (!NT_STATUS_IS_OK(q.out.result)) {
|
|
torture_result(tctx, TORTURE_FAIL, "QueryUserInfo level %u failed - %s\n",
|
|
q.in.level, nt_errstr(q.out.result));
|
|
ret = false;
|
|
} else {
|
|
uint32_t expected_flags = (base_acct_flags | ACB_PWNOTREQ | ACB_DISABLED);
|
|
if ((info->info5.acct_flags) != expected_flags) {
|
|
/* FIXME: GD */
|
|
if (!torture_setting_bool(tctx, "samba3", false)) {
|
|
torture_result(tctx, TORTURE_FAIL, "QueryUserInfo level 5 failed, it returned 0x%08x when we expected flags of 0x%08x\n",
|
|
info->info5.acct_flags,
|
|
expected_flags);
|
|
ret = false;
|
|
}
|
|
}
|
|
if (info->info5.rid != rid) {
|
|
torture_result(tctx, TORTURE_FAIL, "QueryUserInfo level 5 failed, it returned %u when we expected rid of %u\n",
|
|
info->info5.rid, rid);
|
|
|
|
}
|
|
}
|
|
|
|
break;
|
|
|
|
case TORTURE_SAMR_PASSWORDS_PWDLASTSET:
|
|
|
|
/* test last password change timestamp behaviour */
|
|
torture_assert(tctx, test_SetPassword_pwdlastset(p, tctx, base_acct_flags,
|
|
base_acct_name,
|
|
user_handle, &password,
|
|
machine_credentials),
|
|
"pwdLastSet test failed\n");
|
|
break;
|
|
|
|
case TORTURE_SAMR_PASSWORDS_BADPWDCOUNT:
|
|
|
|
/* test bad pwd count change behaviour */
|
|
torture_assert(tctx, test_Password_badpwdcount_wrap(p, tctx, base_acct_flags,
|
|
base_acct_name,
|
|
domain_handle,
|
|
user_handle, &password,
|
|
machine_credentials),
|
|
"badPwdCount test failed\n");
|
|
break;
|
|
|
|
case TORTURE_SAMR_PASSWORDS_LOCKOUT:
|
|
|
|
torture_assert(tctx, test_Password_lockout_wrap(p, tctx, base_acct_flags,
|
|
base_acct_name,
|
|
domain_handle,
|
|
user_handle, &password,
|
|
machine_credentials),
|
|
"Lockout test failed");
|
|
break;
|
|
|
|
|
|
case TORTURE_SAMR_USER_PRIVILEGES: {
|
|
|
|
struct dcerpc_pipe *lp;
|
|
struct policy_handle *lsa_handle;
|
|
struct dcerpc_binding_handle *lb;
|
|
|
|
status = torture_rpc_connection(tctx, &lp, &ndr_table_lsarpc);
|
|
torture_assert_ntstatus_ok(tctx, status, "Failed to open LSA pipe");
|
|
lb = lp->binding_handle;
|
|
|
|
if (!test_lsa_OpenPolicy2(lb, tctx, &lsa_handle)) {
|
|
ret = false;
|
|
}
|
|
|
|
if (!test_DeleteUser_with_privs(p, lp, tctx,
|
|
domain_handle, lsa_handle, user_handle,
|
|
domain_sid, rid,
|
|
machine_credentials)) {
|
|
ret = false;
|
|
}
|
|
|
|
if (!test_lsa_Close(lb, tctx, lsa_handle)) {
|
|
ret = false;
|
|
}
|
|
|
|
if (!ret) {
|
|
torture_result(tctx, TORTURE_FAIL, "privileged user delete test failed\n");
|
|
}
|
|
|
|
break;
|
|
}
|
|
case TORTURE_SAMR_OTHER:
|
|
case TORTURE_SAMR_MANY_ACCOUNTS:
|
|
case TORTURE_SAMR_MANY_GROUPS:
|
|
case TORTURE_SAMR_MANY_ALIASES:
|
|
/* We just need the account to exist */
|
|
break;
|
|
}
|
|
return ret;
|
|
}
|
|
|
|
static bool test_alias_ops(struct dcerpc_binding_handle *b,
|
|
struct torture_context *tctx,
|
|
struct policy_handle *alias_handle,
|
|
const struct dom_sid *domain_sid)
|
|
{
|
|
bool ret = true;
|
|
|
|
if (!torture_setting_bool(tctx, "samba3", false)) {
|
|
if (!test_QuerySecurity(b, tctx, alias_handle)) {
|
|
ret = false;
|
|
}
|
|
}
|
|
|
|
if (!test_QueryAliasInfo(b, tctx, alias_handle)) {
|
|
ret = false;
|
|
}
|
|
|
|
if (!test_SetAliasInfo(b, tctx, alias_handle)) {
|
|
ret = false;
|
|
}
|
|
|
|
if (!test_AddMemberToAlias(b, tctx, alias_handle, domain_sid)) {
|
|
ret = false;
|
|
}
|
|
|
|
if (torture_setting_bool(tctx, "samba3", false) ||
|
|
torture_setting_bool(tctx, "samba4", false)) {
|
|
torture_comment(tctx, "skipping MultipleMembers Alias tests against Samba\n");
|
|
return ret;
|
|
}
|
|
|
|
if (!test_AddMultipleMembersToAlias(b, tctx, alias_handle)) {
|
|
ret = false;
|
|
}
|
|
|
|
return ret;
|
|
}
|
|
|
|
|
|
static bool test_DeleteUser(struct dcerpc_binding_handle *b,
|
|
struct torture_context *tctx,
|
|
struct policy_handle *user_handle)
|
|
{
|
|
struct samr_DeleteUser d;
|
|
torture_comment(tctx, "Testing DeleteUser\n");
|
|
|
|
d.in.user_handle = user_handle;
|
|
d.out.user_handle = user_handle;
|
|
|
|
torture_assert_ntstatus_ok(tctx, dcerpc_samr_DeleteUser_r(b, tctx, &d),
|
|
"DeleteUser failed");
|
|
torture_assert_ntstatus_ok(tctx, d.out.result, "DeleteUser");
|
|
|
|
return true;
|
|
}
|
|
|
|
bool test_DeleteUser_byname(struct dcerpc_binding_handle *b,
|
|
struct torture_context *tctx,
|
|
struct policy_handle *handle, const char *name)
|
|
{
|
|
NTSTATUS status;
|
|
struct samr_DeleteUser d;
|
|
struct policy_handle user_handle;
|
|
uint32_t rid;
|
|
|
|
status = test_LookupName(b, tctx, handle, name, &rid);
|
|
if (!NT_STATUS_IS_OK(status)) {
|
|
goto failed;
|
|
}
|
|
|
|
status = test_OpenUser_byname(b, tctx, handle, name, &user_handle);
|
|
if (!NT_STATUS_IS_OK(status)) {
|
|
goto failed;
|
|
}
|
|
|
|
d.in.user_handle = &user_handle;
|
|
d.out.user_handle = &user_handle;
|
|
torture_assert_ntstatus_ok(tctx, dcerpc_samr_DeleteUser_r(b, tctx, &d),
|
|
"DeleteUser failed");
|
|
if (!NT_STATUS_IS_OK(d.out.result)) {
|
|
status = d.out.result;
|
|
goto failed;
|
|
}
|
|
|
|
return true;
|
|
|
|
failed:
|
|
torture_result(tctx, TORTURE_FAIL, "DeleteUser_byname(%s) failed - %s\n", name, nt_errstr(status));
|
|
return false;
|
|
}
|
|
|
|
|
|
static bool test_DeleteGroup_byname(struct dcerpc_binding_handle *b,
|
|
struct torture_context *tctx,
|
|
struct policy_handle *handle, const char *name)
|
|
{
|
|
NTSTATUS status;
|
|
struct samr_OpenGroup r;
|
|
struct samr_DeleteDomainGroup d;
|
|
struct policy_handle group_handle;
|
|
uint32_t rid;
|
|
|
|
status = test_LookupName(b, tctx, handle, name, &rid);
|
|
if (!NT_STATUS_IS_OK(status)) {
|
|
goto failed;
|
|
}
|
|
|
|
r.in.domain_handle = handle;
|
|
r.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
|
|
r.in.rid = rid;
|
|
r.out.group_handle = &group_handle;
|
|
torture_assert_ntstatus_ok(tctx, dcerpc_samr_OpenGroup_r(b, tctx, &r),
|
|
"OpenGroup failed");
|
|
if (!NT_STATUS_IS_OK(r.out.result)) {
|
|
status = r.out.result;
|
|
goto failed;
|
|
}
|
|
|
|
d.in.group_handle = &group_handle;
|
|
d.out.group_handle = &group_handle;
|
|
torture_assert_ntstatus_ok(tctx, dcerpc_samr_DeleteDomainGroup_r(b, tctx, &d),
|
|
"DeleteDomainGroup failed");
|
|
if (!NT_STATUS_IS_OK(d.out.result)) {
|
|
status = d.out.result;
|
|
goto failed;
|
|
}
|
|
|
|
return true;
|
|
|
|
failed:
|
|
torture_result(tctx, TORTURE_FAIL, "DeleteGroup_byname(%s) failed - %s\n", name, nt_errstr(status));
|
|
return false;
|
|
}
|
|
|
|
|
|
static bool test_DeleteAlias_byname(struct dcerpc_binding_handle *b,
|
|
struct torture_context *tctx,
|
|
struct policy_handle *domain_handle,
|
|
const char *name)
|
|
{
|
|
NTSTATUS status;
|
|
struct samr_OpenAlias r;
|
|
struct samr_DeleteDomAlias d;
|
|
struct policy_handle alias_handle;
|
|
uint32_t rid;
|
|
|
|
torture_comment(tctx, "Testing DeleteAlias_byname\n");
|
|
|
|
status = test_LookupName(b, tctx, domain_handle, name, &rid);
|
|
if (!NT_STATUS_IS_OK(status)) {
|
|
goto failed;
|
|
}
|
|
|
|
r.in.domain_handle = domain_handle;
|
|
r.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
|
|
r.in.rid = rid;
|
|
r.out.alias_handle = &alias_handle;
|
|
torture_assert_ntstatus_ok(tctx, dcerpc_samr_OpenAlias_r(b, tctx, &r),
|
|
"OpenAlias failed");
|
|
if (!NT_STATUS_IS_OK(r.out.result)) {
|
|
status = r.out.result;
|
|
goto failed;
|
|
}
|
|
|
|
d.in.alias_handle = &alias_handle;
|
|
d.out.alias_handle = &alias_handle;
|
|
torture_assert_ntstatus_ok(tctx, dcerpc_samr_DeleteDomAlias_r(b, tctx, &d),
|
|
"DeleteDomAlias failed");
|
|
if (!NT_STATUS_IS_OK(d.out.result)) {
|
|
status = d.out.result;
|
|
goto failed;
|
|
}
|
|
|
|
return true;
|
|
|
|
failed:
|
|
torture_result(tctx, TORTURE_FAIL, "DeleteAlias_byname(%s) failed - %s\n", name, nt_errstr(status));
|
|
return false;
|
|
}
|
|
|
|
static bool test_DeleteAlias(struct dcerpc_binding_handle *b,
|
|
struct torture_context *tctx,
|
|
struct policy_handle *alias_handle)
|
|
{
|
|
struct samr_DeleteDomAlias d;
|
|
bool ret = true;
|
|
|
|
torture_comment(tctx, "Testing DeleteAlias\n");
|
|
|
|
d.in.alias_handle = alias_handle;
|
|
d.out.alias_handle = alias_handle;
|
|
|
|
torture_assert_ntstatus_ok(tctx, dcerpc_samr_DeleteDomAlias_r(b, tctx, &d),
|
|
"DeleteDomAlias failed");
|
|
if (!NT_STATUS_IS_OK(d.out.result)) {
|
|
torture_result(tctx, TORTURE_FAIL, "DeleteAlias failed - %s\n", nt_errstr(d.out.result));
|
|
ret = false;
|
|
}
|
|
|
|
return ret;
|
|
}
|
|
|
|
static bool test_CreateAlias(struct dcerpc_binding_handle *b,
|
|
struct torture_context *tctx,
|
|
struct policy_handle *domain_handle,
|
|
const char *alias_name,
|
|
struct policy_handle *alias_handle,
|
|
const struct dom_sid *domain_sid,
|
|
bool test_alias)
|
|
{
|
|
struct samr_CreateDomAlias r;
|
|
struct lsa_String name;
|
|
uint32_t rid;
|
|
bool ret = true;
|
|
|
|
init_lsa_String(&name, alias_name);
|
|
r.in.domain_handle = domain_handle;
|
|
r.in.alias_name = &name;
|
|
r.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
|
|
r.out.alias_handle = alias_handle;
|
|
r.out.rid = &rid;
|
|
|
|
torture_comment(tctx, "Testing CreateAlias (%s)\n", r.in.alias_name->string);
|
|
|
|
torture_assert_ntstatus_ok(tctx, dcerpc_samr_CreateDomAlias_r(b, tctx, &r),
|
|
"CreateDomAlias failed");
|
|
|
|
if (dom_sid_equal(domain_sid, dom_sid_parse_talloc(tctx, SID_BUILTIN))) {
|
|
if (NT_STATUS_EQUAL(r.out.result, NT_STATUS_ACCESS_DENIED)) {
|
|
torture_comment(tctx, "Server correctly refused create of '%s'\n", r.in.alias_name->string);
|
|
return true;
|
|
} else {
|
|
torture_result(tctx, TORTURE_FAIL, "Server should have refused create of '%s', got %s instead\n", r.in.alias_name->string,
|
|
nt_errstr(r.out.result));
|
|
return false;
|
|
}
|
|
}
|
|
|
|
if (NT_STATUS_EQUAL(r.out.result, NT_STATUS_ALIAS_EXISTS)) {
|
|
if (!test_DeleteAlias_byname(b, tctx, domain_handle, r.in.alias_name->string)) {
|
|
return false;
|
|
}
|
|
torture_assert_ntstatus_ok(tctx, dcerpc_samr_CreateDomAlias_r(b, tctx, &r),
|
|
"CreateDomAlias failed");
|
|
}
|
|
|
|
if (!NT_STATUS_IS_OK(r.out.result)) {
|
|
torture_result(tctx, TORTURE_FAIL, "CreateAlias failed - %s\n", nt_errstr(r.out.result));
|
|
return false;
|
|
}
|
|
|
|
if (!test_alias) {
|
|
return ret;
|
|
}
|
|
|
|
if (!test_alias_ops(b, tctx, alias_handle, domain_sid)) {
|
|
ret = false;
|
|
}
|
|
|
|
return ret;
|
|
}
|
|
|
|
static bool test_ChangePassword(struct dcerpc_pipe *p,
|
|
struct torture_context *tctx,
|
|
const char *acct_name,
|
|
struct policy_handle *domain_handle, char **password)
|
|
{
|
|
bool ret = true;
|
|
struct dcerpc_binding_handle *b = p->binding_handle;
|
|
|
|
if (!*password) {
|
|
return false;
|
|
}
|
|
|
|
if (!test_ChangePasswordUser(b, tctx, acct_name, domain_handle, password)) {
|
|
ret = false;
|
|
}
|
|
|
|
if (!test_ChangePasswordUser2(p, tctx, acct_name, password, 0, true)) {
|
|
ret = false;
|
|
}
|
|
|
|
if (!test_OemChangePasswordUser2(p, tctx, acct_name, domain_handle, password)) {
|
|
ret = false;
|
|
}
|
|
|
|
/* test what happens when setting the old password again */
|
|
if (!test_ChangePasswordUser3(p, tctx, acct_name, 0, password, *password, 0, true)) {
|
|
ret = false;
|
|
}
|
|
|
|
{
|
|
char simple_pass[9];
|
|
char *v = generate_random_str(tctx, 1);
|
|
|
|
ZERO_STRUCT(simple_pass);
|
|
memset(simple_pass, *v, sizeof(simple_pass) - 1);
|
|
|
|
/* test what happens when picking a simple password */
|
|
if (!test_ChangePasswordUser3(p, tctx, acct_name, 0, password, simple_pass, 0, true)) {
|
|
ret = false;
|
|
}
|
|
}
|
|
|
|
/* set samr_SetDomainInfo level 1 with min_length 5 */
|
|
{
|
|
struct samr_QueryDomainInfo r;
|
|
union samr_DomainInfo *info = NULL;
|
|
struct samr_SetDomainInfo s;
|
|
uint16_t len_old, len;
|
|
uint32_t pwd_prop_old;
|
|
int64_t min_pwd_age_old;
|
|
|
|
len = 5;
|
|
|
|
r.in.domain_handle = domain_handle;
|
|
r.in.level = 1;
|
|
r.out.info = &info;
|
|
|
|
torture_comment(tctx, "Testing samr_QueryDomainInfo level 1\n");
|
|
torture_assert_ntstatus_ok(tctx, dcerpc_samr_QueryDomainInfo_r(b, tctx, &r),
|
|
"QueryDomainInfo failed");
|
|
if (!NT_STATUS_IS_OK(r.out.result)) {
|
|
return false;
|
|
}
|
|
|
|
s.in.domain_handle = domain_handle;
|
|
s.in.level = 1;
|
|
s.in.info = info;
|
|
|
|
/* remember the old min length, so we can reset it */
|
|
len_old = s.in.info->info1.min_password_length;
|
|
s.in.info->info1.min_password_length = len;
|
|
pwd_prop_old = s.in.info->info1.password_properties;
|
|
/* turn off password complexity checks for this test */
|
|
s.in.info->info1.password_properties &= ~DOMAIN_PASSWORD_COMPLEX;
|
|
|
|
min_pwd_age_old = s.in.info->info1.min_password_age;
|
|
s.in.info->info1.min_password_age = 0;
|
|
|
|
torture_comment(tctx, "Testing samr_SetDomainInfo level 1\n");
|
|
torture_assert_ntstatus_ok(tctx, dcerpc_samr_SetDomainInfo_r(b, tctx, &s),
|
|
"SetDomainInfo failed");
|
|
if (!NT_STATUS_IS_OK(s.out.result)) {
|
|
return false;
|
|
}
|
|
|
|
torture_comment(tctx, "calling test_ChangePasswordUser3 with too short password\n");
|
|
|
|
if (!test_ChangePasswordUser3(p, tctx, acct_name, len - 1, password, NULL, 0, true)) {
|
|
ret = false;
|
|
}
|
|
|
|
s.in.info->info1.min_password_length = len_old;
|
|
s.in.info->info1.password_properties = pwd_prop_old;
|
|
s.in.info->info1.min_password_age = min_pwd_age_old;
|
|
|
|
torture_comment(tctx, "Testing samr_SetDomainInfo level 1\n");
|
|
torture_assert_ntstatus_ok(tctx, dcerpc_samr_SetDomainInfo_r(b, tctx, &s),
|
|
"SetDomainInfo failed");
|
|
if (!NT_STATUS_IS_OK(s.out.result)) {
|
|
return false;
|
|
}
|
|
|
|
}
|
|
|
|
{
|
|
struct samr_OpenUser r;
|
|
struct samr_QueryUserInfo q;
|
|
union samr_UserInfo *info;
|
|
struct samr_LookupNames n;
|
|
struct policy_handle user_handle;
|
|
struct samr_Ids rids, types;
|
|
|
|
n.in.domain_handle = domain_handle;
|
|
n.in.num_names = 1;
|
|
n.in.names = talloc_array(tctx, struct lsa_String, 1);
|
|
n.in.names[0].string = acct_name;
|
|
n.out.rids = &rids;
|
|
n.out.types = &types;
|
|
|
|
torture_assert_ntstatus_ok(tctx, dcerpc_samr_LookupNames_r(b, tctx, &n),
|
|
"LookupNames failed");
|
|
if (!NT_STATUS_IS_OK(n.out.result)) {
|
|
torture_result(tctx, TORTURE_FAIL, "LookupNames failed - %s\n", nt_errstr(n.out.result));
|
|
return false;
|
|
}
|
|
|
|
r.in.domain_handle = domain_handle;
|
|
r.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
|
|
r.in.rid = n.out.rids->ids[0];
|
|
r.out.user_handle = &user_handle;
|
|
|
|
torture_assert_ntstatus_ok(tctx, dcerpc_samr_OpenUser_r(b, tctx, &r),
|
|
"OpenUser failed");
|
|
if (!NT_STATUS_IS_OK(r.out.result)) {
|
|
torture_result(tctx, TORTURE_FAIL, "OpenUser(%u) failed - %s\n", n.out.rids->ids[0], nt_errstr(r.out.result));
|
|
return false;
|
|
}
|
|
|
|
q.in.user_handle = &user_handle;
|
|
q.in.level = 5;
|
|
q.out.info = &info;
|
|
|
|
torture_assert_ntstatus_ok(tctx, dcerpc_samr_QueryUserInfo_r(b, tctx, &q),
|
|
"QueryUserInfo failed");
|
|
if (!NT_STATUS_IS_OK(q.out.result)) {
|
|
torture_result(tctx, TORTURE_FAIL, "QueryUserInfo failed - %s\n", nt_errstr(q.out.result));
|
|
return false;
|
|
}
|
|
|
|
torture_comment(tctx, "calling test_ChangePasswordUser3 with too early password change\n");
|
|
|
|
if (!test_ChangePasswordUser3(p, tctx, acct_name, 0, password, NULL,
|
|
info->info5.last_password_change, true)) {
|
|
ret = false;
|
|
}
|
|
}
|
|
|
|
/* we change passwords twice - this has the effect of verifying
|
|
they were changed correctly for the final call */
|
|
if (!test_ChangePasswordUser3(p, tctx, acct_name, 0, password, NULL, 0, true)) {
|
|
ret = false;
|
|
}
|
|
|
|
if (!test_ChangePasswordUser3(p, tctx, acct_name, 0, password, NULL, 0, true)) {
|
|
ret = false;
|
|
}
|
|
|
|
return ret;
|
|
}
|
|
|
|
static bool test_CreateUser(struct dcerpc_pipe *p, struct torture_context *tctx,
|
|
struct policy_handle *domain_handle,
|
|
const char *user_name,
|
|
struct policy_handle *user_handle_out,
|
|
struct dom_sid *domain_sid,
|
|
enum torture_samr_choice which_ops,
|
|
struct cli_credentials *machine_credentials,
|
|
bool test_user)
|
|
{
|
|
|
|
TALLOC_CTX *user_ctx;
|
|
|
|
struct samr_CreateUser r;
|
|
struct samr_QueryUserInfo q;
|
|
union samr_UserInfo *info;
|
|
struct samr_DeleteUser d;
|
|
uint32_t rid;
|
|
|
|
/* This call creates a 'normal' account - check that it really does */
|
|
const uint32_t acct_flags = ACB_NORMAL;
|
|
struct lsa_String name;
|
|
bool ret = true;
|
|
struct dcerpc_binding_handle *b = p->binding_handle;
|
|
|
|
struct policy_handle user_handle;
|
|
user_ctx = talloc_named(tctx, 0, "test_CreateUser2 per-user context");
|
|
init_lsa_String(&name, user_name);
|
|
|
|
r.in.domain_handle = domain_handle;
|
|
r.in.account_name = &name;
|
|
r.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
|
|
r.out.user_handle = &user_handle;
|
|
r.out.rid = &rid;
|
|
|
|
torture_comment(tctx, "Testing CreateUser(%s)\n", r.in.account_name->string);
|
|
|
|
torture_assert_ntstatus_ok(tctx, dcerpc_samr_CreateUser_r(b, user_ctx, &r),
|
|
"CreateUser failed");
|
|
|
|
if (dom_sid_equal(domain_sid, dom_sid_parse_talloc(tctx, SID_BUILTIN))) {
|
|
if (NT_STATUS_EQUAL(r.out.result, NT_STATUS_ACCESS_DENIED) || NT_STATUS_EQUAL(r.out.result, NT_STATUS_INVALID_PARAMETER)) {
|
|
torture_comment(tctx, "Server correctly refused create of '%s'\n", r.in.account_name->string);
|
|
return true;
|
|
} else {
|
|
torture_result(tctx, TORTURE_FAIL, "Server should have refused create of '%s', got %s instead\n", r.in.account_name->string,
|
|
nt_errstr(r.out.result));
|
|
return false;
|
|
}
|
|
}
|
|
|
|
if (NT_STATUS_EQUAL(r.out.result, NT_STATUS_USER_EXISTS)) {
|
|
if (!test_DeleteUser_byname(b, tctx, domain_handle, r.in.account_name->string)) {
|
|
talloc_free(user_ctx);
|
|
return false;
|
|
}
|
|
torture_assert_ntstatus_ok(tctx, dcerpc_samr_CreateUser_r(b, user_ctx, &r),
|
|
"CreateUser failed");
|
|
}
|
|
|
|
if (!NT_STATUS_IS_OK(r.out.result)) {
|
|
talloc_free(user_ctx);
|
|
torture_result(tctx, TORTURE_FAIL, "CreateUser failed - %s\n", nt_errstr(r.out.result));
|
|
return false;
|
|
}
|
|
|
|
if (!test_user) {
|
|
if (user_handle_out) {
|
|
*user_handle_out = user_handle;
|
|
}
|
|
return ret;
|
|
}
|
|
|
|
{
|
|
q.in.user_handle = &user_handle;
|
|
q.in.level = 16;
|
|
q.out.info = &info;
|
|
|
|
torture_assert_ntstatus_ok(tctx, dcerpc_samr_QueryUserInfo_r(b, user_ctx, &q),
|
|
"QueryUserInfo failed");
|
|
if (!NT_STATUS_IS_OK(q.out.result)) {
|
|
torture_result(tctx, TORTURE_FAIL, "QueryUserInfo level %u failed - %s\n",
|
|
q.in.level, nt_errstr(q.out.result));
|
|
ret = false;
|
|
} else {
|
|
if ((info->info16.acct_flags & acct_flags) != acct_flags) {
|
|
torture_result(tctx, TORTURE_FAIL, "QueryUserInfo level 16 failed, it returned 0x%08x when we expected flags of 0x%08x\n",
|
|
info->info16.acct_flags,
|
|
acct_flags);
|
|
ret = false;
|
|
}
|
|
}
|
|
|
|
if (!test_user_ops(p, tctx, &user_handle, domain_handle,
|
|
domain_sid, acct_flags, name.string, which_ops,
|
|
machine_credentials)) {
|
|
ret = false;
|
|
}
|
|
|
|
if (user_handle_out) {
|
|
*user_handle_out = user_handle;
|
|
} else {
|
|
torture_comment(tctx, "Testing DeleteUser (createuser test)\n");
|
|
|
|
d.in.user_handle = &user_handle;
|
|
d.out.user_handle = &user_handle;
|
|
|
|
torture_assert_ntstatus_ok(tctx, dcerpc_samr_DeleteUser_r(b, user_ctx, &d),
|
|
"DeleteUser failed");
|
|
if (!NT_STATUS_IS_OK(d.out.result)) {
|
|
torture_result(tctx, TORTURE_FAIL, "DeleteUser failed - %s\n", nt_errstr(d.out.result));
|
|
ret = false;
|
|
}
|
|
}
|
|
|
|
}
|
|
|
|
talloc_free(user_ctx);
|
|
|
|
return ret;
|
|
}
|
|
|
|
|
|
static bool test_CreateUser2(struct dcerpc_pipe *p, struct torture_context *tctx,
|
|
struct policy_handle *domain_handle,
|
|
struct dom_sid *domain_sid,
|
|
enum torture_samr_choice which_ops,
|
|
struct cli_credentials *machine_credentials)
|
|
{
|
|
struct samr_CreateUser2 r;
|
|
struct samr_QueryUserInfo q;
|
|
union samr_UserInfo *info;
|
|
struct samr_DeleteUser d;
|
|
struct policy_handle user_handle;
|
|
uint32_t rid;
|
|
struct lsa_String name;
|
|
bool ret = true;
|
|
int i;
|
|
struct dcerpc_binding_handle *b = p->binding_handle;
|
|
|
|
struct {
|
|
uint32_t acct_flags;
|
|
const char *account_name;
|
|
NTSTATUS nt_status;
|
|
} account_types[] = {
|
|
{ ACB_NORMAL, TEST_ACCOUNT_NAME, NT_STATUS_OK },
|
|
{ ACB_NORMAL | ACB_DISABLED, TEST_ACCOUNT_NAME, NT_STATUS_INVALID_PARAMETER },
|
|
{ ACB_NORMAL | ACB_PWNOEXP, TEST_ACCOUNT_NAME, NT_STATUS_INVALID_PARAMETER },
|
|
{ ACB_WSTRUST, TEST_MACHINENAME, NT_STATUS_OK },
|
|
{ ACB_WSTRUST | ACB_DISABLED, TEST_MACHINENAME, NT_STATUS_INVALID_PARAMETER },
|
|
{ ACB_WSTRUST | ACB_PWNOEXP, TEST_MACHINENAME, NT_STATUS_INVALID_PARAMETER },
|
|
{ ACB_SVRTRUST, TEST_MACHINENAME, NT_STATUS_OK },
|
|
{ ACB_SVRTRUST | ACB_DISABLED, TEST_MACHINENAME, NT_STATUS_INVALID_PARAMETER },
|
|
{ ACB_SVRTRUST | ACB_PWNOEXP, TEST_MACHINENAME, NT_STATUS_INVALID_PARAMETER },
|
|
{ ACB_DOMTRUST, TEST_DOMAINNAME, NT_STATUS_ACCESS_DENIED },
|
|
{ ACB_DOMTRUST | ACB_DISABLED, TEST_DOMAINNAME, NT_STATUS_INVALID_PARAMETER },
|
|
{ ACB_DOMTRUST | ACB_PWNOEXP, TEST_DOMAINNAME, NT_STATUS_INVALID_PARAMETER },
|
|
{ 0, TEST_ACCOUNT_NAME, NT_STATUS_INVALID_PARAMETER },
|
|
{ ACB_DISABLED, TEST_ACCOUNT_NAME, NT_STATUS_INVALID_PARAMETER },
|
|
{ 0, NULL, NT_STATUS_INVALID_PARAMETER }
|
|
};
|
|
|
|
for (i = 0; account_types[i].account_name; i++) {
|
|
TALLOC_CTX *user_ctx;
|
|
uint32_t acct_flags = account_types[i].acct_flags;
|
|
uint32_t access_granted;
|
|
user_ctx = talloc_named(tctx, 0, "test_CreateUser2 per-user context");
|
|
init_lsa_String(&name, account_types[i].account_name);
|
|
|
|
r.in.domain_handle = domain_handle;
|
|
r.in.account_name = &name;
|
|
r.in.acct_flags = acct_flags;
|
|
r.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
|
|
r.out.user_handle = &user_handle;
|
|
r.out.access_granted = &access_granted;
|
|
r.out.rid = &rid;
|
|
|
|
torture_comment(tctx, "Testing CreateUser2(%s, 0x%x)\n", r.in.account_name->string, acct_flags);
|
|
|
|
torture_assert_ntstatus_ok(tctx, dcerpc_samr_CreateUser2_r(b, user_ctx, &r),
|
|
"CreateUser2 failed");
|
|
|
|
if (dom_sid_equal(domain_sid, dom_sid_parse_talloc(tctx, SID_BUILTIN))) {
|
|
if (NT_STATUS_EQUAL(r.out.result, NT_STATUS_ACCESS_DENIED) || NT_STATUS_EQUAL(r.out.result, NT_STATUS_INVALID_PARAMETER)) {
|
|
torture_comment(tctx, "Server correctly refused create of '%s'\n", r.in.account_name->string);
|
|
continue;
|
|
} else {
|
|
torture_result(tctx, TORTURE_FAIL, "Server should have refused create of '%s', got %s instead\n", r.in.account_name->string,
|
|
nt_errstr(r.out.result));
|
|
ret = false;
|
|
continue;
|
|
}
|
|
}
|
|
|
|
if (NT_STATUS_EQUAL(r.out.result, NT_STATUS_USER_EXISTS)) {
|
|
if (!test_DeleteUser_byname(b, tctx, domain_handle, r.in.account_name->string)) {
|
|
talloc_free(user_ctx);
|
|
ret = false;
|
|
continue;
|
|
}
|
|
torture_assert_ntstatus_ok(tctx, dcerpc_samr_CreateUser2_r(b, user_ctx, &r),
|
|
"CreateUser2 failed");
|
|
|
|
}
|
|
if (!NT_STATUS_EQUAL(r.out.result, account_types[i].nt_status)) {
|
|
torture_result(tctx, TORTURE_FAIL, "CreateUser2 failed gave incorrect error return - %s (should be %s)\n",
|
|
nt_errstr(r.out.result), nt_errstr(account_types[i].nt_status));
|
|
ret = false;
|
|
}
|
|
|
|
if (NT_STATUS_IS_OK(r.out.result)) {
|
|
q.in.user_handle = &user_handle;
|
|
q.in.level = 5;
|
|
q.out.info = &info;
|
|
|
|
torture_assert_ntstatus_ok(tctx, dcerpc_samr_QueryUserInfo_r(b, user_ctx, &q),
|
|
"QueryUserInfo failed");
|
|
if (!NT_STATUS_IS_OK(q.out.result)) {
|
|
torture_result(tctx, TORTURE_FAIL, "QueryUserInfo level %u failed - %s\n",
|
|
q.in.level, nt_errstr(q.out.result));
|
|
ret = false;
|
|
} else {
|
|
uint32_t expected_flags = (acct_flags | ACB_PWNOTREQ | ACB_DISABLED);
|
|
if (acct_flags == ACB_NORMAL) {
|
|
expected_flags |= ACB_PW_EXPIRED;
|
|
}
|
|
if ((info->info5.acct_flags) != expected_flags) {
|
|
torture_result(tctx, TORTURE_FAIL, "QueryUserInfo level 5 failed, it returned 0x%08x when we expected flags of 0x%08x\n",
|
|
info->info5.acct_flags,
|
|
expected_flags);
|
|
ret = false;
|
|
}
|
|
switch (acct_flags) {
|
|
case ACB_SVRTRUST:
|
|
if (info->info5.primary_gid != DOMAIN_RID_DCS) {
|
|
torture_result(tctx, TORTURE_FAIL, "QueryUserInfo level 5: DC should have had Primary Group %d, got %d\n",
|
|
DOMAIN_RID_DCS, info->info5.primary_gid);
|
|
ret = false;
|
|
}
|
|
break;
|
|
case ACB_WSTRUST:
|
|
if (info->info5.primary_gid != DOMAIN_RID_DOMAIN_MEMBERS) {
|
|
torture_result(tctx, TORTURE_FAIL, "QueryUserInfo level 5: Domain Member should have had Primary Group %d, got %d\n",
|
|
DOMAIN_RID_DOMAIN_MEMBERS, info->info5.primary_gid);
|
|
ret = false;
|
|
}
|
|
break;
|
|
case ACB_NORMAL:
|
|
if (info->info5.primary_gid != DOMAIN_RID_USERS) {
|
|
torture_result(tctx, TORTURE_FAIL, "QueryUserInfo level 5: Users should have had Primary Group %d, got %d\n",
|
|
DOMAIN_RID_USERS, info->info5.primary_gid);
|
|
ret = false;
|
|
}
|
|
break;
|
|
}
|
|
}
|
|
|
|
if (!test_user_ops(p, tctx, &user_handle, domain_handle,
|
|
domain_sid, acct_flags, name.string, which_ops,
|
|
machine_credentials)) {
|
|
ret = false;
|
|
}
|
|
|
|
if (!ndr_policy_handle_empty(&user_handle)) {
|
|
torture_comment(tctx, "Testing DeleteUser (createuser2 test)\n");
|
|
|
|
d.in.user_handle = &user_handle;
|
|
d.out.user_handle = &user_handle;
|
|
|
|
torture_assert_ntstatus_ok(tctx, dcerpc_samr_DeleteUser_r(b, user_ctx, &d),
|
|
"DeleteUser failed");
|
|
if (!NT_STATUS_IS_OK(d.out.result)) {
|
|
torture_result(tctx, TORTURE_FAIL, "DeleteUser failed - %s\n", nt_errstr(d.out.result));
|
|
ret = false;
|
|
}
|
|
}
|
|
}
|
|
talloc_free(user_ctx);
|
|
}
|
|
|
|
return ret;
|
|
}
|
|
|
|
static bool test_QueryAliasInfo(struct dcerpc_binding_handle *b,
|
|
struct torture_context *tctx,
|
|
struct policy_handle *handle)
|
|
{
|
|
struct samr_QueryAliasInfo r;
|
|
union samr_AliasInfo *info;
|
|
uint16_t levels[] = {1, 2, 3};
|
|
int i;
|
|
bool ret = true;
|
|
|
|
for (i=0;i<ARRAY_SIZE(levels);i++) {
|
|
torture_comment(tctx, "Testing QueryAliasInfo level %u\n", levels[i]);
|
|
|
|
r.in.alias_handle = handle;
|
|
r.in.level = levels[i];
|
|
r.out.info = &info;
|
|
|
|
torture_assert_ntstatus_ok(tctx, dcerpc_samr_QueryAliasInfo_r(b, tctx, &r),
|
|
"QueryAliasInfo failed");
|
|
if (!NT_STATUS_IS_OK(r.out.result)) {
|
|
torture_result(tctx, TORTURE_FAIL, "QueryAliasInfo level %u failed - %s\n",
|
|
levels[i], nt_errstr(r.out.result));
|
|
ret = false;
|
|
}
|
|
}
|
|
|
|
return ret;
|
|
}
|
|
|
|
static bool test_QueryGroupInfo(struct dcerpc_binding_handle *b,
|
|
struct torture_context *tctx,
|
|
struct policy_handle *handle)
|
|
{
|
|
struct samr_QueryGroupInfo r;
|
|
union samr_GroupInfo *info;
|
|
uint16_t levels[] = {1, 2, 3, 4, 5};
|
|
int i;
|
|
bool ret = true;
|
|
|
|
for (i=0;i<ARRAY_SIZE(levels);i++) {
|
|
torture_comment(tctx, "Testing QueryGroupInfo level %u\n", levels[i]);
|
|
|
|
r.in.group_handle = handle;
|
|
r.in.level = levels[i];
|
|
r.out.info = &info;
|
|
|
|
torture_assert_ntstatus_ok(tctx, dcerpc_samr_QueryGroupInfo_r(b, tctx, &r),
|
|
"QueryGroupInfo failed");
|
|
if (!NT_STATUS_IS_OK(r.out.result)) {
|
|
torture_result(tctx, TORTURE_FAIL, "QueryGroupInfo level %u failed - %s\n",
|
|
levels[i], nt_errstr(r.out.result));
|
|
ret = false;
|
|
}
|
|
}
|
|
|
|
return ret;
|
|
}
|
|
|
|
static bool test_QueryGroupMember(struct dcerpc_binding_handle *b,
|
|
struct torture_context *tctx,
|
|
struct policy_handle *handle)
|
|
{
|
|
struct samr_QueryGroupMember r;
|
|
struct samr_RidAttrArray *rids = NULL;
|
|
bool ret = true;
|
|
|
|
torture_comment(tctx, "Testing QueryGroupMember\n");
|
|
|
|
r.in.group_handle = handle;
|
|
r.out.rids = &rids;
|
|
|
|
torture_assert_ntstatus_ok(tctx, dcerpc_samr_QueryGroupMember_r(b, tctx, &r),
|
|
"QueryGroupMember failed");
|
|
if (!NT_STATUS_IS_OK(r.out.result)) {
|
|
torture_result(tctx, TORTURE_FAIL, "QueryGroupMember failed - %s\n", nt_errstr(r.out.result));
|
|
ret = false;
|
|
}
|
|
|
|
return ret;
|
|
}
|
|
|
|
|
|
static bool test_SetGroupInfo(struct dcerpc_binding_handle *b,
|
|
struct torture_context *tctx,
|
|
struct policy_handle *handle)
|
|
{
|
|
struct samr_QueryGroupInfo r;
|
|
union samr_GroupInfo *info;
|
|
struct samr_SetGroupInfo s;
|
|
uint16_t levels[] = {1, 2, 3, 4};
|
|
uint16_t set_ok[] = {0, 1, 1, 1};
|
|
int i;
|
|
bool ret = true;
|
|
|
|
for (i=0;i<ARRAY_SIZE(levels);i++) {
|
|
torture_comment(tctx, "Testing QueryGroupInfo level %u\n", levels[i]);
|
|
|
|
r.in.group_handle = handle;
|
|
r.in.level = levels[i];
|
|
r.out.info = &info;
|
|
|
|
torture_assert_ntstatus_ok(tctx, dcerpc_samr_QueryGroupInfo_r(b, tctx, &r),
|
|
"QueryGroupInfo failed");
|
|
if (!NT_STATUS_IS_OK(r.out.result)) {
|
|
torture_result(tctx, TORTURE_FAIL, "QueryGroupInfo level %u failed - %s\n",
|
|
levels[i], nt_errstr(r.out.result));
|
|
ret = false;
|
|
}
|
|
|
|
torture_comment(tctx, "Testing SetGroupInfo level %u\n", levels[i]);
|
|
|
|
s.in.group_handle = handle;
|
|
s.in.level = levels[i];
|
|
s.in.info = *r.out.info;
|
|
|
|
#if 0
|
|
/* disabled this, as it changes the name only from the point of view of samr,
|
|
but leaves the name from the point of view of w2k3 internals (and ldap). This means
|
|
the name is still reserved, so creating the old name fails, but deleting by the old name
|
|
also fails */
|
|
if (s.in.level == 2) {
|
|
init_lsa_String(&s.in.info->string, "NewName");
|
|
}
|
|
#endif
|
|
|
|
if (s.in.level == 4) {
|
|
init_lsa_String(&s.in.info->description, "test description");
|
|
}
|
|
|
|
torture_assert_ntstatus_ok(tctx, dcerpc_samr_SetGroupInfo_r(b, tctx, &s),
|
|
"SetGroupInfo failed");
|
|
if (set_ok[i]) {
|
|
if (!NT_STATUS_IS_OK(s.out.result)) {
|
|
torture_result(tctx, TORTURE_FAIL, "SetGroupInfo level %u failed - %s\n",
|
|
r.in.level, nt_errstr(s.out.result));
|
|
ret = false;
|
|
continue;
|
|
}
|
|
} else {
|
|
if (!NT_STATUS_EQUAL(NT_STATUS_INVALID_INFO_CLASS, s.out.result)) {
|
|
torture_result(tctx, TORTURE_FAIL, "SetGroupInfo level %u gave %s - should have been NT_STATUS_INVALID_INFO_CLASS\n",
|
|
r.in.level, nt_errstr(s.out.result));
|
|
ret = false;
|
|
continue;
|
|
}
|
|
}
|
|
}
|
|
|
|
return ret;
|
|
}
|
|
|
|
static bool test_QueryUserInfo(struct dcerpc_binding_handle *b,
|
|
struct torture_context *tctx,
|
|
struct policy_handle *handle)
|
|
{
|
|
struct samr_QueryUserInfo r;
|
|
union samr_UserInfo *info;
|
|
uint16_t levels[] = {1, 2, 3, 4, 5, 6, 7, 8, 9, 10,
|
|
11, 12, 13, 14, 16, 17, 20, 21};
|
|
int i;
|
|
bool ret = true;
|
|
|
|
for (i=0;i<ARRAY_SIZE(levels);i++) {
|
|
torture_comment(tctx, "Testing QueryUserInfo level %u\n", levels[i]);
|
|
|
|
r.in.user_handle = handle;
|
|
r.in.level = levels[i];
|
|
r.out.info = &info;
|
|
|
|
torture_assert_ntstatus_ok(tctx, dcerpc_samr_QueryUserInfo_r(b, tctx, &r),
|
|
"QueryUserInfo failed");
|
|
if (!NT_STATUS_IS_OK(r.out.result)) {
|
|
torture_result(tctx, TORTURE_FAIL, "QueryUserInfo level %u failed - %s\n",
|
|
levels[i], nt_errstr(r.out.result));
|
|
ret = false;
|
|
}
|
|
}
|
|
|
|
return ret;
|
|
}
|
|
|
|
static bool test_QueryUserInfo2(struct dcerpc_binding_handle *b,
|
|
struct torture_context *tctx,
|
|
struct policy_handle *handle)
|
|
{
|
|
struct samr_QueryUserInfo2 r;
|
|
union samr_UserInfo *info;
|
|
uint16_t levels[] = {1, 2, 3, 4, 5, 6, 7, 8, 9, 10,
|
|
11, 12, 13, 14, 16, 17, 20, 21};
|
|
int i;
|
|
bool ret = true;
|
|
|
|
for (i=0;i<ARRAY_SIZE(levels);i++) {
|
|
torture_comment(tctx, "Testing QueryUserInfo2 level %u\n", levels[i]);
|
|
|
|
r.in.user_handle = handle;
|
|
r.in.level = levels[i];
|
|
r.out.info = &info;
|
|
|
|
torture_assert_ntstatus_ok(tctx, dcerpc_samr_QueryUserInfo2_r(b, tctx, &r),
|
|
"QueryUserInfo2 failed");
|
|
if (!NT_STATUS_IS_OK(r.out.result)) {
|
|
torture_result(tctx, TORTURE_FAIL, "QueryUserInfo2 level %u failed - %s\n",
|
|
levels[i], nt_errstr(r.out.result));
|
|
ret = false;
|
|
}
|
|
}
|
|
|
|
return ret;
|
|
}
|
|
|
|
static bool test_OpenUser(struct dcerpc_binding_handle *b,
|
|
struct torture_context *tctx,
|
|
struct policy_handle *handle, uint32_t rid)
|
|
{
|
|
struct samr_OpenUser r;
|
|
struct policy_handle user_handle;
|
|
bool ret = true;
|
|
|
|
torture_comment(tctx, "Testing OpenUser(%u)\n", rid);
|
|
|
|
r.in.domain_handle = handle;
|
|
r.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
|
|
r.in.rid = rid;
|
|
r.out.user_handle = &user_handle;
|
|
|
|
torture_assert_ntstatus_ok(tctx, dcerpc_samr_OpenUser_r(b, tctx, &r),
|
|
"OpenUser failed");
|
|
if (!NT_STATUS_IS_OK(r.out.result)) {
|
|
torture_result(tctx, TORTURE_FAIL, "OpenUser(%u) failed - %s\n", rid, nt_errstr(r.out.result));
|
|
return false;
|
|
}
|
|
|
|
if (!test_QuerySecurity(b, tctx, &user_handle)) {
|
|
ret = false;
|
|
}
|
|
|
|
if (!test_QueryUserInfo(b, tctx, &user_handle)) {
|
|
ret = false;
|
|
}
|
|
|
|
if (!test_QueryUserInfo2(b, tctx, &user_handle)) {
|
|
ret = false;
|
|
}
|
|
|
|
if (!test_GetUserPwInfo(b, tctx, &user_handle)) {
|
|
ret = false;
|
|
}
|
|
|
|
if (!test_GetGroupsForUser(b, tctx, &user_handle)) {
|
|
ret = false;
|
|
}
|
|
|
|
if (!test_samr_handle_Close(b, tctx, &user_handle)) {
|
|
ret = false;
|
|
}
|
|
|
|
return ret;
|
|
}
|
|
|
|
static bool test_OpenGroup(struct dcerpc_binding_handle *b,
|
|
struct torture_context *tctx,
|
|
struct policy_handle *handle, uint32_t rid)
|
|
{
|
|
struct samr_OpenGroup r;
|
|
struct policy_handle group_handle;
|
|
bool ret = true;
|
|
|
|
torture_comment(tctx, "Testing OpenGroup(%u)\n", rid);
|
|
|
|
r.in.domain_handle = handle;
|
|
r.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
|
|
r.in.rid = rid;
|
|
r.out.group_handle = &group_handle;
|
|
|
|
torture_assert_ntstatus_ok(tctx, dcerpc_samr_OpenGroup_r(b, tctx, &r),
|
|
"OpenGroup failed");
|
|
if (!NT_STATUS_IS_OK(r.out.result)) {
|
|
torture_result(tctx, TORTURE_FAIL, "OpenGroup(%u) failed - %s\n", rid, nt_errstr(r.out.result));
|
|
return false;
|
|
}
|
|
|
|
if (!torture_setting_bool(tctx, "samba3", false)) {
|
|
if (!test_QuerySecurity(b, tctx, &group_handle)) {
|
|
ret = false;
|
|
}
|
|
}
|
|
|
|
if (!test_QueryGroupInfo(b, tctx, &group_handle)) {
|
|
ret = false;
|
|
}
|
|
|
|
if (!test_QueryGroupMember(b, tctx, &group_handle)) {
|
|
ret = false;
|
|
}
|
|
|
|
if (!test_samr_handle_Close(b, tctx, &group_handle)) {
|
|
ret = false;
|
|
}
|
|
|
|
return ret;
|
|
}
|
|
|
|
static bool test_OpenAlias(struct dcerpc_binding_handle *b,
|
|
struct torture_context *tctx,
|
|
struct policy_handle *handle, uint32_t rid)
|
|
{
|
|
struct samr_OpenAlias r;
|
|
struct policy_handle alias_handle;
|
|
bool ret = true;
|
|
|
|
torture_comment(tctx, "Testing OpenAlias(%u)\n", rid);
|
|
|
|
r.in.domain_handle = handle;
|
|
r.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
|
|
r.in.rid = rid;
|
|
r.out.alias_handle = &alias_handle;
|
|
|
|
torture_assert_ntstatus_ok(tctx, dcerpc_samr_OpenAlias_r(b, tctx, &r),
|
|
"OpenAlias failed");
|
|
if (!NT_STATUS_IS_OK(r.out.result)) {
|
|
torture_result(tctx, TORTURE_FAIL, "OpenAlias(%u) failed - %s\n", rid, nt_errstr(r.out.result));
|
|
return false;
|
|
}
|
|
|
|
if (!torture_setting_bool(tctx, "samba3", false)) {
|
|
if (!test_QuerySecurity(b, tctx, &alias_handle)) {
|
|
ret = false;
|
|
}
|
|
}
|
|
|
|
if (!test_QueryAliasInfo(b, tctx, &alias_handle)) {
|
|
ret = false;
|
|
}
|
|
|
|
if (!test_GetMembersInAlias(b, tctx, &alias_handle)) {
|
|
ret = false;
|
|
}
|
|
|
|
if (!test_samr_handle_Close(b, tctx, &alias_handle)) {
|
|
ret = false;
|
|
}
|
|
|
|
return ret;
|
|
}
|
|
|
|
static bool check_mask(struct dcerpc_binding_handle *b,
|
|
struct torture_context *tctx,
|
|
struct policy_handle *handle, uint32_t rid,
|
|
uint32_t acct_flag_mask)
|
|
{
|
|
struct samr_OpenUser r;
|
|
struct samr_QueryUserInfo q;
|
|
union samr_UserInfo *info;
|
|
struct policy_handle user_handle;
|
|
bool ret = true;
|
|
|
|
torture_comment(tctx, "Testing OpenUser(%u)\n", rid);
|
|
|
|
r.in.domain_handle = handle;
|
|
r.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
|
|
r.in.rid = rid;
|
|
r.out.user_handle = &user_handle;
|
|
|
|
torture_assert_ntstatus_ok(tctx, dcerpc_samr_OpenUser_r(b, tctx, &r),
|
|
"OpenUser failed");
|
|
if (!NT_STATUS_IS_OK(r.out.result)) {
|
|
torture_result(tctx, TORTURE_FAIL, "OpenUser(%u) failed - %s\n", rid, nt_errstr(r.out.result));
|
|
return false;
|
|
}
|
|
|
|
q.in.user_handle = &user_handle;
|
|
q.in.level = 16;
|
|
q.out.info = &info;
|
|
|
|
torture_assert_ntstatus_ok(tctx, dcerpc_samr_QueryUserInfo_r(b, tctx, &q),
|
|
"QueryUserInfo failed");
|
|
if (!NT_STATUS_IS_OK(q.out.result)) {
|
|
torture_result(tctx, TORTURE_FAIL, "QueryUserInfo level 16 failed - %s\n",
|
|
nt_errstr(q.out.result));
|
|
ret = false;
|
|
} else {
|
|
if ((acct_flag_mask & info->info16.acct_flags) == 0) {
|
|
torture_result(tctx, TORTURE_FAIL, "Server failed to filter for 0x%x, allowed 0x%x (%d) on EnumDomainUsers\n",
|
|
acct_flag_mask, info->info16.acct_flags, rid);
|
|
ret = false;
|
|
}
|
|
}
|
|
|
|
if (!test_samr_handle_Close(b, tctx, &user_handle)) {
|
|
ret = false;
|
|
}
|
|
|
|
return ret;
|
|
}
|
|
|
|
static bool test_EnumDomainUsers_all(struct dcerpc_binding_handle *b,
|
|
struct torture_context *tctx,
|
|
struct policy_handle *handle)
|
|
{
|
|
struct samr_EnumDomainUsers r;
|
|
uint32_t mask, resume_handle=0;
|
|
int i, mask_idx;
|
|
bool ret = true;
|
|
struct samr_LookupNames n;
|
|
struct samr_LookupRids lr ;
|
|
struct lsa_Strings names;
|
|
struct samr_Ids rids, types;
|
|
struct samr_SamArray *sam = NULL;
|
|
uint32_t num_entries = 0;
|
|
|
|
uint32_t masks[] = {ACB_NORMAL, ACB_DOMTRUST, ACB_WSTRUST,
|
|
ACB_DISABLED, ACB_NORMAL | ACB_DISABLED,
|
|
ACB_SVRTRUST | ACB_DOMTRUST | ACB_WSTRUST,
|
|
ACB_PWNOEXP, 0};
|
|
|
|
torture_comment(tctx, "Testing EnumDomainUsers\n");
|
|
|
|
for (mask_idx=0;mask_idx<ARRAY_SIZE(masks);mask_idx++) {
|
|
r.in.domain_handle = handle;
|
|
r.in.resume_handle = &resume_handle;
|
|
r.in.acct_flags = mask = masks[mask_idx];
|
|
r.in.max_size = (uint32_t)-1;
|
|
r.out.resume_handle = &resume_handle;
|
|
r.out.num_entries = &num_entries;
|
|
r.out.sam = &sam;
|
|
|
|
torture_assert_ntstatus_ok(tctx, dcerpc_samr_EnumDomainUsers_r(b, tctx, &r),
|
|
"EnumDomainUsers failed");
|
|
if (!NT_STATUS_EQUAL(r.out.result, STATUS_MORE_ENTRIES) &&
|
|
!NT_STATUS_IS_OK(r.out.result)) {
|
|
torture_result(tctx, TORTURE_FAIL, "EnumDomainUsers failed - %s\n", nt_errstr(r.out.result));
|
|
return false;
|
|
}
|
|
|
|
torture_assert(tctx, sam, "EnumDomainUsers failed: r.out.sam unexpectedly NULL");
|
|
|
|
if (sam->count == 0) {
|
|
continue;
|
|
}
|
|
|
|
for (i=0;i<sam->count;i++) {
|
|
if (mask) {
|
|
if (!check_mask(b, tctx, handle, sam->entries[i].idx, mask)) {
|
|
ret = false;
|
|
}
|
|
} else if (!test_OpenUser(b, tctx, handle, sam->entries[i].idx)) {
|
|
ret = false;
|
|
}
|
|
}
|
|
}
|
|
|
|
torture_comment(tctx, "Testing LookupNames\n");
|
|
n.in.domain_handle = handle;
|
|
n.in.num_names = sam->count;
|
|
n.in.names = talloc_array(tctx, struct lsa_String, sam->count);
|
|
n.out.rids = &rids;
|
|
n.out.types = &types;
|
|
for (i=0;i<sam->count;i++) {
|
|
n.in.names[i].string = sam->entries[i].name.string;
|
|
}
|
|
torture_assert_ntstatus_ok(tctx, dcerpc_samr_LookupNames_r(b, tctx, &n),
|
|
"LookupNames failed");
|
|
if (!NT_STATUS_IS_OK(n.out.result)) {
|
|
torture_result(tctx, TORTURE_FAIL, "LookupNames failed - %s\n", nt_errstr(n.out.result));
|
|
ret = false;
|
|
}
|
|
|
|
|
|
torture_comment(tctx, "Testing LookupRids\n");
|
|
lr.in.domain_handle = handle;
|
|
lr.in.num_rids = sam->count;
|
|
lr.in.rids = talloc_array(tctx, uint32_t, sam->count);
|
|
lr.out.names = &names;
|
|
lr.out.types = &types;
|
|
for (i=0;i<sam->count;i++) {
|
|
lr.in.rids[i] = sam->entries[i].idx;
|
|
}
|
|
torture_assert_ntstatus_ok(tctx, dcerpc_samr_LookupRids_r(b, tctx, &lr),
|
|
"LookupRids failed");
|
|
torture_assert_ntstatus_ok(tctx, lr.out.result, "LookupRids");
|
|
|
|
return ret;
|
|
}
|
|
|
|
/*
|
|
try blasting the server with a bunch of sync requests
|
|
*/
|
|
static bool test_EnumDomainUsers_async(struct dcerpc_pipe *p, struct torture_context *tctx,
|
|
struct policy_handle *handle)
|
|
{
|
|
struct samr_EnumDomainUsers r;
|
|
uint32_t resume_handle=0;
|
|
int i;
|
|
#define ASYNC_COUNT 100
|
|
struct tevent_req *req[ASYNC_COUNT];
|
|
|
|
if (!torture_setting_bool(tctx, "dangerous", false)) {
|
|
torture_skip(tctx, "samr async test disabled - enable dangerous tests to use\n");
|
|
}
|
|
|
|
torture_comment(tctx, "Testing EnumDomainUsers_async\n");
|
|
|
|
r.in.domain_handle = handle;
|
|
r.in.resume_handle = &resume_handle;
|
|
r.in.acct_flags = 0;
|
|
r.in.max_size = (uint32_t)-1;
|
|
r.out.resume_handle = &resume_handle;
|
|
|
|
for (i=0;i<ASYNC_COUNT;i++) {
|
|
req[i] = dcerpc_samr_EnumDomainUsers_r_send(tctx, tctx->ev, p->binding_handle, &r);
|
|
}
|
|
|
|
for (i=0;i<ASYNC_COUNT;i++) {
|
|
tevent_req_poll(req[i], tctx->ev);
|
|
torture_assert_ntstatus_ok(tctx, dcerpc_samr_EnumDomainUsers_r_recv(req[i], tctx),
|
|
talloc_asprintf(tctx, "EnumDomainUsers[%d] failed - %s\n",
|
|
i, nt_errstr(r.out.result)));
|
|
}
|
|
|
|
torture_comment(tctx, "%d async requests OK\n", i);
|
|
|
|
return true;
|
|
}
|
|
|
|
static bool test_EnumDomainGroups_all(struct dcerpc_binding_handle *b,
|
|
struct torture_context *tctx,
|
|
struct policy_handle *handle)
|
|
{
|
|
struct samr_EnumDomainGroups r;
|
|
uint32_t resume_handle=0;
|
|
struct samr_SamArray *sam = NULL;
|
|
uint32_t num_entries = 0;
|
|
int i;
|
|
bool ret = true;
|
|
bool universal_group_found = false;
|
|
|
|
torture_comment(tctx, "Testing EnumDomainGroups\n");
|
|
|
|
r.in.domain_handle = handle;
|
|
r.in.resume_handle = &resume_handle;
|
|
r.in.max_size = (uint32_t)-1;
|
|
r.out.resume_handle = &resume_handle;
|
|
r.out.num_entries = &num_entries;
|
|
r.out.sam = &sam;
|
|
|
|
torture_assert_ntstatus_ok(tctx, dcerpc_samr_EnumDomainGroups_r(b, tctx, &r),
|
|
"EnumDomainGroups failed");
|
|
if (!NT_STATUS_IS_OK(r.out.result)) {
|
|
torture_result(tctx, TORTURE_FAIL, "EnumDomainGroups failed - %s\n", nt_errstr(r.out.result));
|
|
return false;
|
|
}
|
|
|
|
if (!sam) {
|
|
return false;
|
|
}
|
|
|
|
for (i=0;i<sam->count;i++) {
|
|
if (!test_OpenGroup(b, tctx, handle, sam->entries[i].idx)) {
|
|
ret = false;
|
|
}
|
|
if ((ret == true) && (strcasecmp(sam->entries[i].name.string,
|
|
"Enterprise Admins") == 0)) {
|
|
universal_group_found = true;
|
|
}
|
|
}
|
|
|
|
/* when we are running this on s4 we should get back at least the
|
|
* "Enterprise Admins" universal group. If we don't get a group entry
|
|
* at all we probably are performing the test on the builtin domain.
|
|
* So ignore this case. */
|
|
if (torture_setting_bool(tctx, "samba4", false)) {
|
|
if ((sam->count > 0) && (!universal_group_found)) {
|
|
ret = false;
|
|
}
|
|
}
|
|
|
|
return ret;
|
|
}
|
|
|
|
static bool test_EnumDomainAliases_all(struct dcerpc_binding_handle *b,
|
|
struct torture_context *tctx,
|
|
struct policy_handle *handle)
|
|
{
|
|
struct samr_EnumDomainAliases r;
|
|
uint32_t resume_handle=0;
|
|
struct samr_SamArray *sam = NULL;
|
|
uint32_t num_entries = 0;
|
|
int i;
|
|
bool ret = true;
|
|
|
|
torture_comment(tctx, "Testing EnumDomainAliases\n");
|
|
|
|
r.in.domain_handle = handle;
|
|
r.in.resume_handle = &resume_handle;
|
|
r.in.max_size = (uint32_t)-1;
|
|
r.out.sam = &sam;
|
|
r.out.num_entries = &num_entries;
|
|
r.out.resume_handle = &resume_handle;
|
|
|
|
torture_assert_ntstatus_ok(tctx, dcerpc_samr_EnumDomainAliases_r(b, tctx, &r),
|
|
"EnumDomainAliases failed");
|
|
if (!NT_STATUS_IS_OK(r.out.result)) {
|
|
torture_result(tctx, TORTURE_FAIL, "EnumDomainAliases failed - %s\n", nt_errstr(r.out.result));
|
|
return false;
|
|
}
|
|
|
|
if (!sam) {
|
|
return false;
|
|
}
|
|
|
|
for (i=0;i<sam->count;i++) {
|
|
if (!test_OpenAlias(b, tctx, handle, sam->entries[i].idx)) {
|
|
ret = false;
|
|
}
|
|
}
|
|
|
|
return ret;
|
|
}
|
|
|
|
static bool test_GetDisplayEnumerationIndex(struct dcerpc_binding_handle *b,
|
|
struct torture_context *tctx,
|
|
struct policy_handle *handle)
|
|
{
|
|
struct samr_GetDisplayEnumerationIndex r;
|
|
bool ret = true;
|
|
uint16_t levels[] = {1, 2, 3, 4, 5};
|
|
uint16_t ok_lvl[] = {1, 1, 1, 0, 0};
|
|
struct lsa_String name;
|
|
uint32_t idx = 0;
|
|
int i;
|
|
|
|
for (i=0;i<ARRAY_SIZE(levels);i++) {
|
|
torture_comment(tctx, "Testing GetDisplayEnumerationIndex level %u\n", levels[i]);
|
|
|
|
init_lsa_String(&name, TEST_ACCOUNT_NAME);
|
|
|
|
r.in.domain_handle = handle;
|
|
r.in.level = levels[i];
|
|
r.in.name = &name;
|
|
r.out.idx = &idx;
|
|
|
|
torture_assert_ntstatus_ok(tctx, dcerpc_samr_GetDisplayEnumerationIndex_r(b, tctx, &r),
|
|
"GetDisplayEnumerationIndex failed");
|
|
|
|
if (ok_lvl[i] &&
|
|
!NT_STATUS_IS_OK(r.out.result) &&
|
|
!NT_STATUS_EQUAL(NT_STATUS_NO_MORE_ENTRIES, r.out.result)) {
|
|
torture_result(tctx, TORTURE_FAIL, "GetDisplayEnumerationIndex level %u failed - %s\n",
|
|
levels[i], nt_errstr(r.out.result));
|
|
ret = false;
|
|
}
|
|
|
|
init_lsa_String(&name, "zzzzzzzz");
|
|
|
|
torture_assert_ntstatus_ok(tctx, dcerpc_samr_GetDisplayEnumerationIndex_r(b, tctx, &r),
|
|
"GetDisplayEnumerationIndex failed");
|
|
|
|
if (ok_lvl[i] && !NT_STATUS_EQUAL(NT_STATUS_NO_MORE_ENTRIES, r.out.result)) {
|
|
torture_result(tctx, TORTURE_FAIL, "GetDisplayEnumerationIndex level %u failed - %s\n",
|
|
levels[i], nt_errstr(r.out.result));
|
|
ret = false;
|
|
}
|
|
}
|
|
|
|
return ret;
|
|
}
|
|
|
|
static bool test_GetDisplayEnumerationIndex2(struct dcerpc_binding_handle *b,
|
|
struct torture_context *tctx,
|
|
struct policy_handle *handle)
|
|
{
|
|
struct samr_GetDisplayEnumerationIndex2 r;
|
|
bool ret = true;
|
|
uint16_t levels[] = {1, 2, 3, 4, 5};
|
|
uint16_t ok_lvl[] = {1, 1, 1, 0, 0};
|
|
struct lsa_String name;
|
|
uint32_t idx = 0;
|
|
int i;
|
|
|
|
for (i=0;i<ARRAY_SIZE(levels);i++) {
|
|
torture_comment(tctx, "Testing GetDisplayEnumerationIndex2 level %u\n", levels[i]);
|
|
|
|
init_lsa_String(&name, TEST_ACCOUNT_NAME);
|
|
|
|
r.in.domain_handle = handle;
|
|
r.in.level = levels[i];
|
|
r.in.name = &name;
|
|
r.out.idx = &idx;
|
|
|
|
torture_assert_ntstatus_ok(tctx, dcerpc_samr_GetDisplayEnumerationIndex2_r(b, tctx, &r),
|
|
"GetDisplayEnumerationIndex2 failed");
|
|
if (ok_lvl[i] &&
|
|
!NT_STATUS_IS_OK(r.out.result) &&
|
|
!NT_STATUS_EQUAL(NT_STATUS_NO_MORE_ENTRIES, r.out.result)) {
|
|
torture_result(tctx, TORTURE_FAIL, "GetDisplayEnumerationIndex2 level %u failed - %s\n",
|
|
levels[i], nt_errstr(r.out.result));
|
|
ret = false;
|
|
}
|
|
|
|
init_lsa_String(&name, "zzzzzzzz");
|
|
|
|
torture_assert_ntstatus_ok(tctx, dcerpc_samr_GetDisplayEnumerationIndex2_r(b, tctx, &r),
|
|
"GetDisplayEnumerationIndex2 failed");
|
|
if (ok_lvl[i] && !NT_STATUS_EQUAL(NT_STATUS_NO_MORE_ENTRIES, r.out.result)) {
|
|
torture_result(tctx, TORTURE_FAIL, "GetDisplayEnumerationIndex2 level %u failed - %s\n",
|
|
levels[i], nt_errstr(r.out.result));
|
|
ret = false;
|
|
}
|
|
}
|
|
|
|
return ret;
|
|
}
|
|
|
|
#define STRING_EQUAL_QUERY(s1, s2, user) \
|
|
if (s1.string == NULL && s2.string != NULL && s2.string[0] == '\0') { \
|
|
/* odd, but valid */ \
|
|
} else if ((s1.string && !s2.string) || (s2.string && !s1.string) || strcmp(s1.string, s2.string)) { \
|
|
torture_result(tctx, TORTURE_FAIL, "%s mismatch for %s: %s != %s (%s)\n", \
|
|
#s1, user.string, s1.string, s2.string, __location__); \
|
|
ret = false; \
|
|
}
|
|
#define INT_EQUAL_QUERY(s1, s2, user) \
|
|
if (s1 != s2) { \
|
|
torture_result(tctx, TORTURE_FAIL, "%s mismatch for %s: 0x%llx != 0x%llx (%s)\n", \
|
|
#s1, user.string, (unsigned long long)s1, (unsigned long long)s2, __location__); \
|
|
ret = false; \
|
|
}
|
|
|
|
static bool test_each_DisplayInfo_user(struct dcerpc_binding_handle *b,
|
|
struct torture_context *tctx,
|
|
struct samr_QueryDisplayInfo *querydisplayinfo,
|
|
bool *seen_testuser)
|
|
{
|
|
struct samr_OpenUser r;
|
|
struct samr_QueryUserInfo q;
|
|
union samr_UserInfo *info;
|
|
struct policy_handle user_handle;
|
|
int i, ret = true;
|
|
r.in.domain_handle = querydisplayinfo->in.domain_handle;
|
|
r.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
|
|
for (i = 0; ; i++) {
|
|
switch (querydisplayinfo->in.level) {
|
|
case 1:
|
|
if (i >= querydisplayinfo->out.info->info1.count) {
|
|
return ret;
|
|
}
|
|
r.in.rid = querydisplayinfo->out.info->info1.entries[i].rid;
|
|
break;
|
|
case 2:
|
|
if (i >= querydisplayinfo->out.info->info2.count) {
|
|
return ret;
|
|
}
|
|
r.in.rid = querydisplayinfo->out.info->info2.entries[i].rid;
|
|
break;
|
|
case 3:
|
|
/* Groups */
|
|
case 4:
|
|
case 5:
|
|
/* Not interested in validating just the account name */
|
|
return true;
|
|
}
|
|
|
|
r.out.user_handle = &user_handle;
|
|
|
|
switch (querydisplayinfo->in.level) {
|
|
case 1:
|
|
case 2:
|
|
torture_assert_ntstatus_ok(tctx, dcerpc_samr_OpenUser_r(b, tctx, &r),
|
|
"OpenUser failed");
|
|
if (!NT_STATUS_IS_OK(r.out.result)) {
|
|
torture_result(tctx, TORTURE_FAIL, "OpenUser(%u) failed - %s\n", r.in.rid, nt_errstr(r.out.result));
|
|
return false;
|
|
}
|
|
}
|
|
|
|
q.in.user_handle = &user_handle;
|
|
q.in.level = 21;
|
|
q.out.info = &info;
|
|
torture_assert_ntstatus_ok(tctx, dcerpc_samr_QueryUserInfo_r(b, tctx, &q),
|
|
"QueryUserInfo failed");
|
|
if (!NT_STATUS_IS_OK(r.out.result)) {
|
|
torture_result(tctx, TORTURE_FAIL, "QueryUserInfo(%u) failed - %s\n", r.in.rid, nt_errstr(r.out.result));
|
|
return false;
|
|
}
|
|
|
|
switch (querydisplayinfo->in.level) {
|
|
case 1:
|
|
if (seen_testuser && strcmp(info->info21.account_name.string, TEST_ACCOUNT_NAME) == 0) {
|
|
*seen_testuser = true;
|
|
}
|
|
STRING_EQUAL_QUERY(querydisplayinfo->out.info->info1.entries[i].full_name,
|
|
info->info21.full_name, info->info21.account_name);
|
|
STRING_EQUAL_QUERY(querydisplayinfo->out.info->info1.entries[i].account_name,
|
|
info->info21.account_name, info->info21.account_name);
|
|
STRING_EQUAL_QUERY(querydisplayinfo->out.info->info1.entries[i].description,
|
|
info->info21.description, info->info21.account_name);
|
|
INT_EQUAL_QUERY(querydisplayinfo->out.info->info1.entries[i].rid,
|
|
info->info21.rid, info->info21.account_name);
|
|
INT_EQUAL_QUERY(querydisplayinfo->out.info->info1.entries[i].acct_flags,
|
|
info->info21.acct_flags, info->info21.account_name);
|
|
|
|
break;
|
|
case 2:
|
|
STRING_EQUAL_QUERY(querydisplayinfo->out.info->info2.entries[i].account_name,
|
|
info->info21.account_name, info->info21.account_name);
|
|
STRING_EQUAL_QUERY(querydisplayinfo->out.info->info2.entries[i].description,
|
|
info->info21.description, info->info21.account_name);
|
|
INT_EQUAL_QUERY(querydisplayinfo->out.info->info2.entries[i].rid,
|
|
info->info21.rid, info->info21.account_name);
|
|
INT_EQUAL_QUERY((querydisplayinfo->out.info->info2.entries[i].acct_flags & ~ACB_NORMAL),
|
|
info->info21.acct_flags, info->info21.account_name);
|
|
|
|
if (!(querydisplayinfo->out.info->info2.entries[i].acct_flags & ACB_NORMAL)) {
|
|
torture_result(tctx, TORTURE_FAIL, "Missing ACB_NORMAL in querydisplayinfo->out.info.info2.entries[i].acct_flags on %s\n",
|
|
info->info21.account_name.string);
|
|
}
|
|
|
|
if (!(info->info21.acct_flags & (ACB_WSTRUST | ACB_SVRTRUST))) {
|
|
torture_result(tctx, TORTURE_FAIL, "Found non-trust account %s in trust account listing: 0x%x 0x%x\n",
|
|
info->info21.account_name.string,
|
|
querydisplayinfo->out.info->info2.entries[i].acct_flags,
|
|
info->info21.acct_flags);
|
|
return false;
|
|
}
|
|
|
|
break;
|
|
}
|
|
|
|
if (!test_samr_handle_Close(b, tctx, &user_handle)) {
|
|
return false;
|
|
}
|
|
}
|
|
return ret;
|
|
}
|
|
|
|
static bool test_QueryDisplayInfo(struct dcerpc_binding_handle *b,
|
|
struct torture_context *tctx,
|
|
struct policy_handle *handle)
|
|
{
|
|
struct samr_QueryDisplayInfo r;
|
|
struct samr_QueryDomainInfo dom_info;
|
|
union samr_DomainInfo *info = NULL;
|
|
bool ret = true;
|
|
uint16_t levels[] = {1, 2, 3, 4, 5};
|
|
int i;
|
|
bool seen_testuser = false;
|
|
uint32_t total_size;
|
|
uint32_t returned_size;
|
|
union samr_DispInfo disp_info;
|
|
|
|
|
|
for (i=0;i<ARRAY_SIZE(levels);i++) {
|
|
torture_comment(tctx, "Testing QueryDisplayInfo level %u\n", levels[i]);
|
|
|
|
r.in.start_idx = 0;
|
|
r.out.result = STATUS_MORE_ENTRIES;
|
|
while (NT_STATUS_EQUAL(r.out.result, STATUS_MORE_ENTRIES)) {
|
|
r.in.domain_handle = handle;
|
|
r.in.level = levels[i];
|
|
r.in.max_entries = 2;
|
|
r.in.buf_size = (uint32_t)-1;
|
|
r.out.total_size = &total_size;
|
|
r.out.returned_size = &returned_size;
|
|
r.out.info = &disp_info;
|
|
|
|
torture_assert_ntstatus_ok(tctx, dcerpc_samr_QueryDisplayInfo_r(b, tctx, &r),
|
|
"QueryDisplayInfo failed");
|
|
if (!NT_STATUS_EQUAL(r.out.result, STATUS_MORE_ENTRIES) && !NT_STATUS_IS_OK(r.out.result)) {
|
|
torture_result(tctx, TORTURE_FAIL, "QueryDisplayInfo level %u failed - %s\n",
|
|
levels[i], nt_errstr(r.out.result));
|
|
ret = false;
|
|
}
|
|
switch (r.in.level) {
|
|
case 1:
|
|
if (!test_each_DisplayInfo_user(b, tctx, &r, &seen_testuser)) {
|
|
ret = false;
|
|
}
|
|
r.in.start_idx += r.out.info->info1.count;
|
|
break;
|
|
case 2:
|
|
if (!test_each_DisplayInfo_user(b, tctx, &r, NULL)) {
|
|
ret = false;
|
|
}
|
|
r.in.start_idx += r.out.info->info2.count;
|
|
break;
|
|
case 3:
|
|
r.in.start_idx += r.out.info->info3.count;
|
|
break;
|
|
case 4:
|
|
r.in.start_idx += r.out.info->info4.count;
|
|
break;
|
|
case 5:
|
|
r.in.start_idx += r.out.info->info5.count;
|
|
break;
|
|
}
|
|
}
|
|
dom_info.in.domain_handle = handle;
|
|
dom_info.in.level = 2;
|
|
dom_info.out.info = &info;
|
|
|
|
/* Check number of users returned is correct */
|
|
torture_assert_ntstatus_ok(tctx, dcerpc_samr_QueryDomainInfo_r(b, tctx, &dom_info),
|
|
"QueryDomainInfo failed");
|
|
if (!NT_STATUS_IS_OK(dom_info.out.result)) {
|
|
torture_result(tctx, TORTURE_FAIL, "QueryDomainInfo level %u failed - %s\n",
|
|
r.in.level, nt_errstr(dom_info.out.result));
|
|
ret = false;
|
|
break;
|
|
}
|
|
switch (r.in.level) {
|
|
case 1:
|
|
case 4:
|
|
if (info->general.num_users < r.in.start_idx) {
|
|
/* On AD deployments this numbers don't match
|
|
* since QueryDisplayInfo returns universal and
|
|
* global groups, QueryDomainInfo only global
|
|
* ones. */
|
|
if (torture_setting_bool(tctx, "samba3", false)) {
|
|
torture_result(tctx, TORTURE_FAIL, "QueryDomainInfo indicates that QueryDisplayInfo returned more users (%d/%d) than the domain %s is said to contain!\n",
|
|
r.in.start_idx, info->general.num_groups,
|
|
info->general.domain_name.string);
|
|
ret = false;
|
|
}
|
|
}
|
|
if (!seen_testuser) {
|
|
struct policy_handle user_handle;
|
|
if (NT_STATUS_IS_OK(test_OpenUser_byname(b, tctx, handle, TEST_ACCOUNT_NAME, &user_handle))) {
|
|
torture_result(tctx, TORTURE_FAIL, "Didn't find test user " TEST_ACCOUNT_NAME " in enumeration of %s\n",
|
|
info->general.domain_name.string);
|
|
ret = false;
|
|
test_samr_handle_Close(b, tctx, &user_handle);
|
|
}
|
|
}
|
|
break;
|
|
case 3:
|
|
case 5:
|
|
if (info->general.num_groups != r.in.start_idx) {
|
|
/* On AD deployments this numbers don't match
|
|
* since QueryDisplayInfo returns universal and
|
|
* global groups, QueryDomainInfo only global
|
|
* ones. */
|
|
if (torture_setting_bool(tctx, "samba3", false)) {
|
|
torture_result(tctx, TORTURE_FAIL, "QueryDomainInfo indicates that QueryDisplayInfo didn't return all (%d/%d) the groups in %s\n",
|
|
r.in.start_idx, info->general.num_groups,
|
|
info->general.domain_name.string);
|
|
ret = false;
|
|
}
|
|
}
|
|
|
|
break;
|
|
}
|
|
|
|
}
|
|
|
|
return ret;
|
|
}
|
|
|
|
static bool test_QueryDisplayInfo2(struct dcerpc_binding_handle *b,
|
|
struct torture_context *tctx,
|
|
struct policy_handle *handle)
|
|
{
|
|
struct samr_QueryDisplayInfo2 r;
|
|
bool ret = true;
|
|
uint16_t levels[] = {1, 2, 3, 4, 5};
|
|
int i;
|
|
uint32_t total_size;
|
|
uint32_t returned_size;
|
|
union samr_DispInfo info;
|
|
|
|
for (i=0;i<ARRAY_SIZE(levels);i++) {
|
|
torture_comment(tctx, "Testing QueryDisplayInfo2 level %u\n", levels[i]);
|
|
|
|
r.in.domain_handle = handle;
|
|
r.in.level = levels[i];
|
|
r.in.start_idx = 0;
|
|
r.in.max_entries = 1000;
|
|
r.in.buf_size = (uint32_t)-1;
|
|
r.out.total_size = &total_size;
|
|
r.out.returned_size = &returned_size;
|
|
r.out.info = &info;
|
|
|
|
torture_assert_ntstatus_ok(tctx, dcerpc_samr_QueryDisplayInfo2_r(b, tctx, &r),
|
|
"QueryDisplayInfo2 failed");
|
|
if (!NT_STATUS_IS_OK(r.out.result)) {
|
|
torture_result(tctx, TORTURE_FAIL, "QueryDisplayInfo2 level %u failed - %s\n",
|
|
levels[i], nt_errstr(r.out.result));
|
|
ret = false;
|
|
}
|
|
}
|
|
|
|
return ret;
|
|
}
|
|
|
|
static bool test_QueryDisplayInfo3(struct dcerpc_binding_handle *b,
|
|
struct torture_context *tctx,
|
|
struct policy_handle *handle)
|
|
{
|
|
struct samr_QueryDisplayInfo3 r;
|
|
bool ret = true;
|
|
uint16_t levels[] = {1, 2, 3, 4, 5};
|
|
int i;
|
|
uint32_t total_size;
|
|
uint32_t returned_size;
|
|
union samr_DispInfo info;
|
|
|
|
for (i=0;i<ARRAY_SIZE(levels);i++) {
|
|
torture_comment(tctx, "Testing QueryDisplayInfo3 level %u\n", levels[i]);
|
|
|
|
r.in.domain_handle = handle;
|
|
r.in.level = levels[i];
|
|
r.in.start_idx = 0;
|
|
r.in.max_entries = 1000;
|
|
r.in.buf_size = (uint32_t)-1;
|
|
r.out.total_size = &total_size;
|
|
r.out.returned_size = &returned_size;
|
|
r.out.info = &info;
|
|
|
|
torture_assert_ntstatus_ok(tctx, dcerpc_samr_QueryDisplayInfo3_r(b, tctx, &r),
|
|
"QueryDisplayInfo3 failed");
|
|
if (!NT_STATUS_IS_OK(r.out.result)) {
|
|
torture_result(tctx, TORTURE_FAIL, "QueryDisplayInfo3 level %u failed - %s\n",
|
|
levels[i], nt_errstr(r.out.result));
|
|
ret = false;
|
|
}
|
|
}
|
|
|
|
return ret;
|
|
}
|
|
|
|
|
|
static bool test_QueryDisplayInfo_continue(struct dcerpc_binding_handle *b,
|
|
struct torture_context *tctx,
|
|
struct policy_handle *handle)
|
|
{
|
|
struct samr_QueryDisplayInfo r;
|
|
bool ret = true;
|
|
uint32_t total_size;
|
|
uint32_t returned_size;
|
|
union samr_DispInfo info;
|
|
|
|
torture_comment(tctx, "Testing QueryDisplayInfo continuation\n");
|
|
|
|
r.in.domain_handle = handle;
|
|
r.in.level = 1;
|
|
r.in.start_idx = 0;
|
|
r.in.max_entries = 1;
|
|
r.in.buf_size = (uint32_t)-1;
|
|
r.out.total_size = &total_size;
|
|
r.out.returned_size = &returned_size;
|
|
r.out.info = &info;
|
|
|
|
do {
|
|
torture_assert_ntstatus_ok(tctx, dcerpc_samr_QueryDisplayInfo_r(b, tctx, &r),
|
|
"QueryDisplayInfo failed");
|
|
if (NT_STATUS_IS_OK(r.out.result) && *r.out.returned_size != 0) {
|
|
if (r.out.info->info1.entries[0].idx != r.in.start_idx + 1) {
|
|
torture_result(tctx, TORTURE_FAIL, "expected idx %d but got %d\n",
|
|
r.in.start_idx + 1,
|
|
r.out.info->info1.entries[0].idx);
|
|
break;
|
|
}
|
|
}
|
|
if (!NT_STATUS_EQUAL(r.out.result, STATUS_MORE_ENTRIES) &&
|
|
!NT_STATUS_IS_OK(r.out.result)) {
|
|
torture_result(tctx, TORTURE_FAIL, "QueryDisplayInfo level %u failed - %s\n",
|
|
r.in.level, nt_errstr(r.out.result));
|
|
ret = false;
|
|
break;
|
|
}
|
|
r.in.start_idx++;
|
|
} while ((NT_STATUS_EQUAL(r.out.result, STATUS_MORE_ENTRIES) ||
|
|
NT_STATUS_IS_OK(r.out.result)) &&
|
|
*r.out.returned_size != 0);
|
|
|
|
return ret;
|
|
}
|
|
|
|
static bool test_QueryDomainInfo(struct dcerpc_pipe *p,
|
|
struct torture_context *tctx,
|
|
struct policy_handle *handle)
|
|
{
|
|
struct samr_QueryDomainInfo r;
|
|
union samr_DomainInfo *info = NULL;
|
|
struct samr_SetDomainInfo s;
|
|
uint16_t levels[] = {1, 2, 3, 4, 5, 6, 7, 8, 9, 11, 12, 13};
|
|
uint16_t set_ok[] = {1, 0, 1, 1, 0, 1, 1, 0, 1, 0, 1, 0};
|
|
int i;
|
|
bool ret = true;
|
|
struct dcerpc_binding_handle *b = p->binding_handle;
|
|
const char *domain_comment = talloc_asprintf(tctx,
|
|
"Tortured by Samba4 RPC-SAMR: %s",
|
|
timestring(tctx, time(NULL)));
|
|
|
|
s.in.domain_handle = handle;
|
|
s.in.level = 4;
|
|
s.in.info = talloc(tctx, union samr_DomainInfo);
|
|
|
|
s.in.info->oem.oem_information.string = domain_comment;
|
|
torture_assert_ntstatus_ok(tctx, dcerpc_samr_SetDomainInfo_r(b, tctx, &s),
|
|
"SetDomainInfo failed");
|
|
if (!NT_STATUS_IS_OK(s.out.result)) {
|
|
torture_result(tctx, TORTURE_FAIL, "SetDomainInfo level %u (set comment) failed - %s\n",
|
|
s.in.level, nt_errstr(s.out.result));
|
|
return false;
|
|
}
|
|
|
|
for (i=0;i<ARRAY_SIZE(levels);i++) {
|
|
torture_comment(tctx, "Testing QueryDomainInfo level %u\n", levels[i]);
|
|
|
|
r.in.domain_handle = handle;
|
|
r.in.level = levels[i];
|
|
r.out.info = &info;
|
|
|
|
torture_assert_ntstatus_ok(tctx, dcerpc_samr_QueryDomainInfo_r(b, tctx, &r),
|
|
"QueryDomainInfo failed");
|
|
if (!NT_STATUS_IS_OK(r.out.result)) {
|
|
torture_result(tctx, TORTURE_FAIL, "QueryDomainInfo level %u failed - %s\n",
|
|
r.in.level, nt_errstr(r.out.result));
|
|
ret = false;
|
|
continue;
|
|
}
|
|
|
|
switch (levels[i]) {
|
|
case 2:
|
|
if (strcmp(info->general.oem_information.string, domain_comment) != 0) {
|
|
torture_result(tctx, TORTURE_FAIL, "QueryDomainInfo level %u returned different oem_information (comment) (%s, expected %s)\n",
|
|
levels[i], info->general.oem_information.string, domain_comment);
|
|
if (!torture_setting_bool(tctx, "samba3", false)) {
|
|
ret = false;
|
|
}
|
|
}
|
|
if (!info->general.primary.string) {
|
|
torture_result(tctx, TORTURE_FAIL, "QueryDomainInfo level %u returned no PDC name\n",
|
|
levels[i]);
|
|
ret = false;
|
|
} else if (info->general.role == SAMR_ROLE_DOMAIN_PDC) {
|
|
if (dcerpc_server_name(p) && strcasecmp_m(dcerpc_server_name(p), info->general.primary.string) != 0) {
|
|
if (torture_setting_bool(tctx, "samba3", false)) {
|
|
torture_result(tctx, TORTURE_FAIL, "QueryDomainInfo level %u returned different PDC name (%s) compared to server name (%s), despite claiming to be the PDC\n",
|
|
levels[i], info->general.primary.string, dcerpc_server_name(p));
|
|
}
|
|
}
|
|
}
|
|
break;
|
|
case 4:
|
|
if (strcmp(info->oem.oem_information.string, domain_comment) != 0) {
|
|
torture_result(tctx, TORTURE_FAIL, "QueryDomainInfo level %u returned different oem_information (comment) (%s, expected %s)\n",
|
|
levels[i], info->oem.oem_information.string, domain_comment);
|
|
if (!torture_setting_bool(tctx, "samba3", false)) {
|
|
ret = false;
|
|
}
|
|
}
|
|
break;
|
|
case 6:
|
|
if (!info->info6.primary.string) {
|
|
torture_result(tctx, TORTURE_FAIL, "QueryDomainInfo level %u returned no PDC name\n",
|
|
levels[i]);
|
|
ret = false;
|
|
}
|
|
break;
|
|
case 11:
|
|
if (strcmp(info->general2.general.oem_information.string, domain_comment) != 0) {
|
|
torture_result(tctx, TORTURE_FAIL, "QueryDomainInfo level %u returned different comment (%s, expected %s)\n",
|
|
levels[i], info->general2.general.oem_information.string, domain_comment);
|
|
if (!torture_setting_bool(tctx, "samba3", false)) {
|
|
ret = false;
|
|
}
|
|
}
|
|
break;
|
|
}
|
|
|
|
torture_comment(tctx, "Testing SetDomainInfo level %u\n", levels[i]);
|
|
|
|
s.in.domain_handle = handle;
|
|
s.in.level = levels[i];
|
|
s.in.info = info;
|
|
|
|
torture_assert_ntstatus_ok(tctx, dcerpc_samr_SetDomainInfo_r(b, tctx, &s),
|
|
"SetDomainInfo failed");
|
|
if (set_ok[i]) {
|
|
if (!NT_STATUS_IS_OK(s.out.result)) {
|
|
torture_result(tctx, TORTURE_FAIL, "SetDomainInfo level %u failed - %s\n",
|
|
r.in.level, nt_errstr(s.out.result));
|
|
ret = false;
|
|
continue;
|
|
}
|
|
} else {
|
|
if (!NT_STATUS_EQUAL(NT_STATUS_INVALID_INFO_CLASS, s.out.result)) {
|
|
torture_result(tctx, TORTURE_FAIL, "SetDomainInfo level %u gave %s - should have been NT_STATUS_INVALID_INFO_CLASS\n",
|
|
r.in.level, nt_errstr(s.out.result));
|
|
ret = false;
|
|
continue;
|
|
}
|
|
}
|
|
|
|
torture_assert_ntstatus_ok(tctx, dcerpc_samr_QueryDomainInfo_r(b, tctx, &r),
|
|
"QueryDomainInfo failed");
|
|
if (!NT_STATUS_IS_OK(r.out.result)) {
|
|
torture_result(tctx, TORTURE_FAIL, "QueryDomainInfo level %u failed - %s\n",
|
|
r.in.level, nt_errstr(r.out.result));
|
|
ret = false;
|
|
continue;
|
|
}
|
|
}
|
|
|
|
return ret;
|
|
}
|
|
|
|
|
|
static bool test_QueryDomainInfo2(struct dcerpc_binding_handle *b,
|
|
struct torture_context *tctx,
|
|
struct policy_handle *handle)
|
|
{
|
|
struct samr_QueryDomainInfo2 r;
|
|
union samr_DomainInfo *info = NULL;
|
|
uint16_t levels[] = {1, 2, 3, 4, 5, 6, 7, 8, 9, 11, 12, 13};
|
|
int i;
|
|
bool ret = true;
|
|
|
|
for (i=0;i<ARRAY_SIZE(levels);i++) {
|
|
torture_comment(tctx, "Testing QueryDomainInfo2 level %u\n", levels[i]);
|
|
|
|
r.in.domain_handle = handle;
|
|
r.in.level = levels[i];
|
|
r.out.info = &info;
|
|
|
|
torture_assert_ntstatus_ok(tctx, dcerpc_samr_QueryDomainInfo2_r(b, tctx, &r),
|
|
"QueryDomainInfo2 failed");
|
|
if (!NT_STATUS_IS_OK(r.out.result)) {
|
|
torture_result(tctx, TORTURE_FAIL, "QueryDomainInfo2 level %u failed - %s\n",
|
|
r.in.level, nt_errstr(r.out.result));
|
|
ret = false;
|
|
continue;
|
|
}
|
|
}
|
|
|
|
return ret;
|
|
}
|
|
|
|
/* Test whether querydispinfo level 5 and enumdomgroups return the same
|
|
set of group names. */
|
|
static bool test_GroupList(struct dcerpc_binding_handle *b,
|
|
struct torture_context *tctx,
|
|
struct dom_sid *domain_sid,
|
|
struct policy_handle *handle)
|
|
{
|
|
struct samr_EnumDomainGroups q1;
|
|
struct samr_QueryDisplayInfo q2;
|
|
NTSTATUS status;
|
|
uint32_t resume_handle=0;
|
|
struct samr_SamArray *sam = NULL;
|
|
uint32_t num_entries = 0;
|
|
int i;
|
|
bool ret = true;
|
|
uint32_t total_size;
|
|
uint32_t returned_size;
|
|
union samr_DispInfo info;
|
|
|
|
size_t num_names = 0;
|
|
const char **names = NULL;
|
|
|
|
bool builtin_domain = dom_sid_compare(domain_sid,
|
|
&global_sid_Builtin) == 0;
|
|
|
|
torture_comment(tctx, "Testing coherency of querydispinfo vs enumdomgroups\n");
|
|
|
|
q1.in.domain_handle = handle;
|
|
q1.in.resume_handle = &resume_handle;
|
|
q1.in.max_size = 5;
|
|
q1.out.resume_handle = &resume_handle;
|
|
q1.out.num_entries = &num_entries;
|
|
q1.out.sam = &sam;
|
|
|
|
status = STATUS_MORE_ENTRIES;
|
|
while (NT_STATUS_EQUAL(status, STATUS_MORE_ENTRIES)) {
|
|
torture_assert_ntstatus_ok(tctx, dcerpc_samr_EnumDomainGroups_r(b, tctx, &q1),
|
|
"EnumDomainGroups failed");
|
|
status = q1.out.result;
|
|
|
|
if (!NT_STATUS_IS_OK(status) &&
|
|
!NT_STATUS_EQUAL(status, STATUS_MORE_ENTRIES))
|
|
break;
|
|
|
|
for (i=0; i<*q1.out.num_entries; i++) {
|
|
add_string_to_array(tctx,
|
|
sam->entries[i].name.string,
|
|
&names, &num_names);
|
|
}
|
|
}
|
|
|
|
torture_assert_ntstatus_ok(tctx, status, "EnumDomainGroups");
|
|
|
|
torture_assert(tctx, sam, "EnumDomainGroups failed to return sam");
|
|
|
|
if (builtin_domain) {
|
|
torture_assert(tctx, num_names == 0,
|
|
"EnumDomainGroups shouldn't return any group in the builtin domain!");
|
|
}
|
|
|
|
q2.in.domain_handle = handle;
|
|
q2.in.level = 5;
|
|
q2.in.start_idx = 0;
|
|
q2.in.max_entries = 5;
|
|
q2.in.buf_size = (uint32_t)-1;
|
|
q2.out.total_size = &total_size;
|
|
q2.out.returned_size = &returned_size;
|
|
q2.out.info = &info;
|
|
|
|
status = STATUS_MORE_ENTRIES;
|
|
while (NT_STATUS_EQUAL(status, STATUS_MORE_ENTRIES)) {
|
|
torture_assert_ntstatus_ok(tctx, dcerpc_samr_QueryDisplayInfo_r(b, tctx, &q2),
|
|
"QueryDisplayInfo failed");
|
|
status = q2.out.result;
|
|
if (!NT_STATUS_IS_OK(status) &&
|
|
!NT_STATUS_EQUAL(status, STATUS_MORE_ENTRIES))
|
|
break;
|
|
|
|
for (i=0; i<q2.out.info->info5.count; i++) {
|
|
int j;
|
|
const char *name = q2.out.info->info5.entries[i].account_name.string;
|
|
bool found = false;
|
|
for (j=0; j<num_names; j++) {
|
|
if (names[j] == NULL)
|
|
continue;
|
|
if (strequal(names[j], name)) {
|
|
names[j] = NULL;
|
|
found = true;
|
|
break;
|
|
}
|
|
}
|
|
|
|
if ((!found) && (!builtin_domain)) {
|
|
torture_result(tctx, TORTURE_FAIL, "QueryDisplayInfo gave name [%s] that EnumDomainGroups did not\n",
|
|
name);
|
|
ret = false;
|
|
}
|
|
}
|
|
q2.in.start_idx += q2.out.info->info5.count;
|
|
}
|
|
|
|
if (!NT_STATUS_IS_OK(status)) {
|
|
torture_result(tctx, TORTURE_FAIL, "QueryDisplayInfo level 5 failed - %s\n",
|
|
nt_errstr(status));
|
|
ret = false;
|
|
}
|
|
|
|
if (builtin_domain) {
|
|
torture_assert(tctx, q2.in.start_idx != 0,
|
|
"QueryDisplayInfo should return all domain groups also on the builtin domain handle!");
|
|
}
|
|
|
|
for (i=0; i<num_names; i++) {
|
|
if (names[i] != NULL) {
|
|
torture_result(tctx, TORTURE_FAIL, "EnumDomainGroups gave name [%s] that QueryDisplayInfo did not\n",
|
|
names[i]);
|
|
ret = false;
|
|
}
|
|
}
|
|
|
|
return ret;
|
|
}
|
|
|
|
static bool test_DeleteDomainGroup(struct dcerpc_binding_handle *b,
|
|
struct torture_context *tctx,
|
|
struct policy_handle *group_handle)
|
|
{
|
|
struct samr_DeleteDomainGroup d;
|
|
|
|
torture_comment(tctx, "Testing DeleteDomainGroup\n");
|
|
|
|
d.in.group_handle = group_handle;
|
|
d.out.group_handle = group_handle;
|
|
|
|
torture_assert_ntstatus_ok(tctx, dcerpc_samr_DeleteDomainGroup_r(b, tctx, &d),
|
|
"DeleteDomainGroup failed");
|
|
torture_assert_ntstatus_ok(tctx, d.out.result, "DeleteDomainGroup");
|
|
|
|
return true;
|
|
}
|
|
|
|
static bool test_TestPrivateFunctionsDomain(struct dcerpc_binding_handle *b,
|
|
struct torture_context *tctx,
|
|
struct policy_handle *domain_handle)
|
|
{
|
|
struct samr_TestPrivateFunctionsDomain r;
|
|
bool ret = true;
|
|
|
|
torture_comment(tctx, "Testing TestPrivateFunctionsDomain\n");
|
|
|
|
r.in.domain_handle = domain_handle;
|
|
|
|
torture_assert_ntstatus_ok(tctx, dcerpc_samr_TestPrivateFunctionsDomain_r(b, tctx, &r),
|
|
"TestPrivateFunctionsDomain failed");
|
|
torture_assert_ntstatus_equal(tctx, r.out.result, NT_STATUS_NOT_IMPLEMENTED, "TestPrivateFunctionsDomain");
|
|
|
|
return ret;
|
|
}
|
|
|
|
static bool test_RidToSid(struct dcerpc_binding_handle *b,
|
|
struct torture_context *tctx,
|
|
struct dom_sid *domain_sid,
|
|
struct policy_handle *domain_handle)
|
|
{
|
|
struct samr_RidToSid r;
|
|
bool ret = true;
|
|
struct dom_sid *calc_sid, *out_sid;
|
|
int rids[] = { 0, 42, 512, 10200 };
|
|
int i;
|
|
|
|
for (i=0;i<ARRAY_SIZE(rids);i++) {
|
|
torture_comment(tctx, "Testing RidToSid\n");
|
|
|
|
calc_sid = dom_sid_dup(tctx, domain_sid);
|
|
r.in.domain_handle = domain_handle;
|
|
r.in.rid = rids[i];
|
|
r.out.sid = &out_sid;
|
|
|
|
torture_assert_ntstatus_ok(tctx, dcerpc_samr_RidToSid_r(b, tctx, &r),
|
|
"RidToSid failed");
|
|
if (!NT_STATUS_IS_OK(r.out.result)) {
|
|
torture_result(tctx, TORTURE_FAIL, "RidToSid for %d failed - %s\n", rids[i], nt_errstr(r.out.result));
|
|
ret = false;
|
|
} else {
|
|
calc_sid = dom_sid_add_rid(calc_sid, calc_sid, rids[i]);
|
|
|
|
if (!dom_sid_equal(calc_sid, out_sid)) {
|
|
torture_result(tctx, TORTURE_FAIL, "RidToSid for %d failed - got %s, expected %s\n", rids[i],
|
|
dom_sid_string(tctx, out_sid),
|
|
dom_sid_string(tctx, calc_sid));
|
|
ret = false;
|
|
}
|
|
}
|
|
}
|
|
|
|
return ret;
|
|
}
|
|
|
|
static bool test_GetBootKeyInformation(struct dcerpc_binding_handle *b,
|
|
struct torture_context *tctx,
|
|
struct policy_handle *domain_handle)
|
|
{
|
|
struct samr_GetBootKeyInformation r;
|
|
bool ret = true;
|
|
uint32_t unknown = 0;
|
|
NTSTATUS status;
|
|
|
|
torture_comment(tctx, "Testing GetBootKeyInformation\n");
|
|
|
|
r.in.domain_handle = domain_handle;
|
|
r.out.unknown = &unknown;
|
|
|
|
status = dcerpc_samr_GetBootKeyInformation_r(b, tctx, &r);
|
|
if (NT_STATUS_IS_OK(status) && !NT_STATUS_IS_OK(r.out.result)) {
|
|
status = r.out.result;
|
|
}
|
|
if (!NT_STATUS_IS_OK(status)) {
|
|
/* w2k3 seems to fail this sometimes and pass it sometimes */
|
|
torture_comment(tctx, "GetBootKeyInformation (ignored) - %s\n", nt_errstr(status));
|
|
}
|
|
|
|
return ret;
|
|
}
|
|
|
|
static bool test_AddGroupMember(struct dcerpc_binding_handle *b,
|
|
struct torture_context *tctx,
|
|
struct policy_handle *domain_handle,
|
|
struct policy_handle *group_handle)
|
|
{
|
|
NTSTATUS status;
|
|
struct samr_AddGroupMember r;
|
|
struct samr_DeleteGroupMember d;
|
|
struct samr_QueryGroupMember q;
|
|
struct samr_RidAttrArray *rids = NULL;
|
|
struct samr_SetMemberAttributesOfGroup s;
|
|
uint32_t rid;
|
|
bool found_member = false;
|
|
int i;
|
|
|
|
status = test_LookupName(b, tctx, domain_handle, TEST_ACCOUNT_NAME, &rid);
|
|
torture_assert_ntstatus_ok(tctx, status, "test_AddGroupMember looking up name " TEST_ACCOUNT_NAME);
|
|
|
|
r.in.group_handle = group_handle;
|
|
r.in.rid = rid;
|
|
r.in.flags = 0; /* ??? */
|
|
|
|
torture_comment(tctx, "Testing AddGroupMember, QueryGroupMember and DeleteGroupMember\n");
|
|
|
|
d.in.group_handle = group_handle;
|
|
d.in.rid = rid;
|
|
|
|
torture_assert_ntstatus_ok(tctx, dcerpc_samr_DeleteGroupMember_r(b, tctx, &d),
|
|
"DeleteGroupMember failed");
|
|
torture_assert_ntstatus_equal(tctx, NT_STATUS_MEMBER_NOT_IN_GROUP, d.out.result, "DeleteGroupMember");
|
|
|
|
torture_assert_ntstatus_ok(tctx, dcerpc_samr_AddGroupMember_r(b, tctx, &r),
|
|
"AddGroupMember failed");
|
|
torture_assert_ntstatus_ok(tctx, r.out.result, "AddGroupMember");
|
|
|
|
torture_assert_ntstatus_ok(tctx, dcerpc_samr_AddGroupMember_r(b, tctx, &r),
|
|
"AddGroupMember failed");
|
|
torture_assert_ntstatus_equal(tctx, NT_STATUS_MEMBER_IN_GROUP, r.out.result, "AddGroupMember");
|
|
|
|
if (torture_setting_bool(tctx, "samba4", false) ||
|
|
torture_setting_bool(tctx, "samba3", false)) {
|
|
torture_comment(tctx, "skipping SetMemberAttributesOfGroup test against Samba\n");
|
|
} else {
|
|
/* this one is quite strange. I am using random inputs in the
|
|
hope of triggering an error that might give us a clue */
|
|
|
|
s.in.group_handle = group_handle;
|
|
s.in.unknown1 = random();
|
|
s.in.unknown2 = random();
|
|
|
|
torture_assert_ntstatus_ok(tctx, dcerpc_samr_SetMemberAttributesOfGroup_r(b, tctx, &s),
|
|
"SetMemberAttributesOfGroup failed");
|
|
torture_assert_ntstatus_ok(tctx, s.out.result, "SetMemberAttributesOfGroup");
|
|
}
|
|
|
|
q.in.group_handle = group_handle;
|
|
q.out.rids = &rids;
|
|
|
|
torture_assert_ntstatus_ok(tctx, dcerpc_samr_QueryGroupMember_r(b, tctx, &q),
|
|
"QueryGroupMember failed");
|
|
torture_assert_ntstatus_ok(tctx, q.out.result, "QueryGroupMember");
|
|
torture_assert(tctx, rids, "QueryGroupMember did not fill in rids structure");
|
|
|
|
for (i=0; i < rids->count; i++) {
|
|
if (rids->rids[i] == rid) {
|
|
found_member = true;
|
|
}
|
|
}
|
|
|
|
torture_assert(tctx, found_member, "QueryGroupMember did not list newly added member");
|
|
|
|
torture_assert_ntstatus_ok(tctx, dcerpc_samr_DeleteGroupMember_r(b, tctx, &d),
|
|
"DeleteGroupMember failed");
|
|
torture_assert_ntstatus_ok(tctx, d.out.result, "DeleteGroupMember");
|
|
|
|
rids = NULL;
|
|
found_member = false;
|
|
|
|
torture_assert_ntstatus_ok(tctx, dcerpc_samr_QueryGroupMember_r(b, tctx, &q),
|
|
"QueryGroupMember failed");
|
|
torture_assert_ntstatus_ok(tctx, q.out.result, "QueryGroupMember");
|
|
torture_assert(tctx, rids, "QueryGroupMember did not fill in rids structure");
|
|
|
|
for (i=0; i < rids->count; i++) {
|
|
if (rids->rids[i] == rid) {
|
|
found_member = true;
|
|
}
|
|
}
|
|
|
|
torture_assert(tctx, !found_member, "QueryGroupMember does still list removed member");
|
|
|
|
torture_assert_ntstatus_ok(tctx, dcerpc_samr_AddGroupMember_r(b, tctx, &r),
|
|
"AddGroupMember failed");
|
|
torture_assert_ntstatus_ok(tctx, r.out.result, "AddGroupMember");
|
|
|
|
return true;
|
|
}
|
|
|
|
|
|
static bool test_CreateDomainGroup(struct dcerpc_binding_handle *b,
|
|
struct torture_context *tctx,
|
|
struct policy_handle *domain_handle,
|
|
const char *group_name,
|
|
struct policy_handle *group_handle,
|
|
struct dom_sid *domain_sid,
|
|
bool test_group)
|
|
{
|
|
struct samr_CreateDomainGroup r;
|
|
uint32_t rid;
|
|
struct lsa_String name;
|
|
bool ret = true;
|
|
|
|
init_lsa_String(&name, group_name);
|
|
|
|
r.in.domain_handle = domain_handle;
|
|
r.in.name = &name;
|
|
r.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
|
|
r.out.group_handle = group_handle;
|
|
r.out.rid = &rid;
|
|
|
|
torture_comment(tctx, "Testing CreateDomainGroup(%s)\n", r.in.name->string);
|
|
|
|
torture_assert_ntstatus_ok(tctx, dcerpc_samr_CreateDomainGroup_r(b, tctx, &r),
|
|
"CreateDomainGroup failed");
|
|
|
|
if (dom_sid_equal(domain_sid, dom_sid_parse_talloc(tctx, SID_BUILTIN))) {
|
|
if (NT_STATUS_EQUAL(r.out.result, NT_STATUS_ACCESS_DENIED)) {
|
|
torture_comment(tctx, "Server correctly refused create of '%s'\n", r.in.name->string);
|
|
return true;
|
|
} else {
|
|
torture_result(tctx, TORTURE_FAIL, "Server should have refused create of '%s', got %s instead\n", r.in.name->string,
|
|
nt_errstr(r.out.result));
|
|
return false;
|
|
}
|
|
}
|
|
|
|
if (NT_STATUS_EQUAL(r.out.result, NT_STATUS_GROUP_EXISTS)) {
|
|
if (!test_DeleteGroup_byname(b, tctx, domain_handle, r.in.name->string)) {
|
|
torture_result(tctx, TORTURE_FAIL, "CreateDomainGroup failed: Could not delete domain group %s - %s\n", r.in.name->string,
|
|
nt_errstr(r.out.result));
|
|
return false;
|
|
}
|
|
torture_assert_ntstatus_ok(tctx, dcerpc_samr_CreateDomainGroup_r(b, tctx, &r),
|
|
"CreateDomainGroup failed");
|
|
}
|
|
if (NT_STATUS_EQUAL(r.out.result, NT_STATUS_USER_EXISTS)) {
|
|
if (!test_DeleteUser_byname(b, tctx, domain_handle, r.in.name->string)) {
|
|
|
|
torture_result(tctx, TORTURE_FAIL, "CreateDomainGroup failed: Could not delete user %s - %s\n", r.in.name->string,
|
|
nt_errstr(r.out.result));
|
|
return false;
|
|
}
|
|
torture_assert_ntstatus_ok(tctx, dcerpc_samr_CreateDomainGroup_r(b, tctx, &r),
|
|
"CreateDomainGroup failed");
|
|
}
|
|
torture_assert_ntstatus_ok(tctx, r.out.result, "CreateDomainGroup");
|
|
|
|
if (!test_group) {
|
|
return ret;
|
|
}
|
|
|
|
if (!test_AddGroupMember(b, tctx, domain_handle, group_handle)) {
|
|
torture_result(tctx, TORTURE_FAIL, "CreateDomainGroup failed - %s\n", nt_errstr(r.out.result));
|
|
ret = false;
|
|
}
|
|
|
|
if (!test_SetGroupInfo(b, tctx, group_handle)) {
|
|
ret = false;
|
|
}
|
|
|
|
return ret;
|
|
}
|
|
|
|
|
|
/*
|
|
its not totally clear what this does. It seems to accept any sid you like.
|
|
*/
|
|
static bool test_RemoveMemberFromForeignDomain(struct dcerpc_binding_handle *b,
|
|
struct torture_context *tctx,
|
|
struct policy_handle *domain_handle)
|
|
{
|
|
struct samr_RemoveMemberFromForeignDomain r;
|
|
|
|
r.in.domain_handle = domain_handle;
|
|
r.in.sid = dom_sid_parse_talloc(tctx, "S-1-5-32-12-34-56-78");
|
|
|
|
torture_assert_ntstatus_ok(tctx, dcerpc_samr_RemoveMemberFromForeignDomain_r(b, tctx, &r),
|
|
"RemoveMemberFromForeignDomain failed");
|
|
torture_assert_ntstatus_ok(tctx, r.out.result, "RemoveMemberFromForeignDomain");
|
|
|
|
return true;
|
|
}
|
|
|
|
static bool test_EnumDomainUsers(struct dcerpc_binding_handle *b,
|
|
struct torture_context *tctx,
|
|
struct policy_handle *domain_handle,
|
|
uint32_t *total_num_entries_p)
|
|
{
|
|
NTSTATUS status;
|
|
struct samr_EnumDomainUsers r;
|
|
uint32_t resume_handle = 0;
|
|
uint32_t num_entries = 0;
|
|
uint32_t total_num_entries = 0;
|
|
struct samr_SamArray *sam;
|
|
|
|
r.in.domain_handle = domain_handle;
|
|
r.in.acct_flags = 0;
|
|
r.in.max_size = (uint32_t)-1;
|
|
r.in.resume_handle = &resume_handle;
|
|
|
|
r.out.sam = &sam;
|
|
r.out.num_entries = &num_entries;
|
|
r.out.resume_handle = &resume_handle;
|
|
|
|
torture_comment(tctx, "Testing EnumDomainUsers\n");
|
|
|
|
do {
|
|
torture_assert_ntstatus_ok(tctx, dcerpc_samr_EnumDomainUsers_r(b, tctx, &r),
|
|
"EnumDomainUsers failed");
|
|
if (NT_STATUS_IS_ERR(r.out.result)) {
|
|
torture_assert_ntstatus_ok(tctx, r.out.result,
|
|
"failed to enumerate users");
|
|
}
|
|
status = r.out.result;
|
|
|
|
total_num_entries += num_entries;
|
|
} while (NT_STATUS_EQUAL(status, STATUS_MORE_ENTRIES));
|
|
|
|
if (total_num_entries_p) {
|
|
*total_num_entries_p = total_num_entries;
|
|
}
|
|
|
|
return true;
|
|
}
|
|
|
|
static bool test_EnumDomainGroups(struct dcerpc_binding_handle *b,
|
|
struct torture_context *tctx,
|
|
struct policy_handle *domain_handle,
|
|
uint32_t *total_num_entries_p)
|
|
{
|
|
NTSTATUS status;
|
|
struct samr_EnumDomainGroups r;
|
|
uint32_t resume_handle = 0;
|
|
uint32_t num_entries = 0;
|
|
uint32_t total_num_entries = 0;
|
|
struct samr_SamArray *sam;
|
|
|
|
r.in.domain_handle = domain_handle;
|
|
r.in.max_size = (uint32_t)-1;
|
|
r.in.resume_handle = &resume_handle;
|
|
|
|
r.out.sam = &sam;
|
|
r.out.num_entries = &num_entries;
|
|
r.out.resume_handle = &resume_handle;
|
|
|
|
torture_comment(tctx, "Testing EnumDomainGroups\n");
|
|
|
|
do {
|
|
torture_assert_ntstatus_ok(tctx, dcerpc_samr_EnumDomainGroups_r(b, tctx, &r),
|
|
"EnumDomainGroups failed");
|
|
if (NT_STATUS_IS_ERR(r.out.result)) {
|
|
torture_assert_ntstatus_ok(tctx, r.out.result,
|
|
"failed to enumerate groups");
|
|
}
|
|
status = r.out.result;
|
|
|
|
total_num_entries += num_entries;
|
|
} while (NT_STATUS_EQUAL(status, STATUS_MORE_ENTRIES));
|
|
|
|
if (total_num_entries_p) {
|
|
*total_num_entries_p = total_num_entries;
|
|
}
|
|
|
|
return true;
|
|
}
|
|
|
|
static bool test_EnumDomainAliases(struct dcerpc_binding_handle *b,
|
|
struct torture_context *tctx,
|
|
struct policy_handle *domain_handle,
|
|
uint32_t *total_num_entries_p)
|
|
{
|
|
NTSTATUS status;
|
|
struct samr_EnumDomainAliases r;
|
|
uint32_t resume_handle = 0;
|
|
uint32_t num_entries = 0;
|
|
uint32_t total_num_entries = 0;
|
|
struct samr_SamArray *sam;
|
|
|
|
r.in.domain_handle = domain_handle;
|
|
r.in.max_size = (uint32_t)-1;
|
|
r.in.resume_handle = &resume_handle;
|
|
|
|
r.out.sam = &sam;
|
|
r.out.num_entries = &num_entries;
|
|
r.out.resume_handle = &resume_handle;
|
|
|
|
torture_comment(tctx, "Testing EnumDomainAliases\n");
|
|
|
|
do {
|
|
torture_assert_ntstatus_ok(tctx, dcerpc_samr_EnumDomainAliases_r(b, tctx, &r),
|
|
"EnumDomainAliases failed");
|
|
if (NT_STATUS_IS_ERR(r.out.result)) {
|
|
torture_assert_ntstatus_ok(tctx, r.out.result,
|
|
"failed to enumerate aliases");
|
|
}
|
|
status = r.out.result;
|
|
|
|
total_num_entries += num_entries;
|
|
} while (NT_STATUS_EQUAL(status, STATUS_MORE_ENTRIES));
|
|
|
|
if (total_num_entries_p) {
|
|
*total_num_entries_p = total_num_entries;
|
|
}
|
|
|
|
return true;
|
|
}
|
|
|
|
static bool test_QueryDisplayInfo_level(struct dcerpc_binding_handle *b,
|
|
struct torture_context *tctx,
|
|
struct policy_handle *handle,
|
|
uint16_t level,
|
|
uint32_t *total_num_entries_p)
|
|
{
|
|
NTSTATUS status;
|
|
struct samr_QueryDisplayInfo r;
|
|
uint32_t total_num_entries = 0;
|
|
|
|
r.in.domain_handle = handle;
|
|
r.in.level = level;
|
|
r.in.start_idx = 0;
|
|
r.in.max_entries = (uint32_t)-1;
|
|
r.in.buf_size = (uint32_t)-1;
|
|
|
|
torture_comment(tctx, "Testing QueryDisplayInfo\n");
|
|
|
|
do {
|
|
uint32_t total_size;
|
|
uint32_t returned_size;
|
|
union samr_DispInfo info;
|
|
|
|
r.out.total_size = &total_size;
|
|
r.out.returned_size = &returned_size;
|
|
r.out.info = &info;
|
|
|
|
torture_assert_ntstatus_ok(tctx, dcerpc_samr_QueryDisplayInfo_r(b, tctx, &r),
|
|
"failed to query displayinfo");
|
|
if (NT_STATUS_IS_ERR(r.out.result)) {
|
|
torture_assert_ntstatus_ok(tctx, r.out.result,
|
|
"failed to query displayinfo");
|
|
}
|
|
status = r.out.result;
|
|
|
|
if (*r.out.returned_size == 0) {
|
|
break;
|
|
}
|
|
|
|
switch (r.in.level) {
|
|
case 1:
|
|
total_num_entries += info.info1.count;
|
|
r.in.start_idx += info.info1.entries[info.info1.count - 1].idx + 1;
|
|
break;
|
|
case 2:
|
|
total_num_entries += info.info2.count;
|
|
r.in.start_idx += info.info2.entries[info.info2.count - 1].idx + 1;
|
|
break;
|
|
case 3:
|
|
total_num_entries += info.info3.count;
|
|
r.in.start_idx += info.info3.entries[info.info3.count - 1].idx + 1;
|
|
break;
|
|
case 4:
|
|
total_num_entries += info.info4.count;
|
|
r.in.start_idx += info.info4.entries[info.info4.count - 1].idx + 1;
|
|
break;
|
|
case 5:
|
|
total_num_entries += info.info5.count;
|
|
r.in.start_idx += info.info5.entries[info.info5.count - 1].idx + 1;
|
|
break;
|
|
default:
|
|
return false;
|
|
}
|
|
|
|
} while (NT_STATUS_EQUAL(status, STATUS_MORE_ENTRIES));
|
|
|
|
if (total_num_entries_p) {
|
|
*total_num_entries_p = total_num_entries;
|
|
}
|
|
|
|
return true;
|
|
}
|
|
|
|
static bool test_ManyObjects(struct dcerpc_pipe *p,
|
|
struct torture_context *tctx,
|
|
struct policy_handle *domain_handle,
|
|
struct dom_sid *domain_sid,
|
|
struct torture_samr_context *ctx)
|
|
{
|
|
uint32_t num_total = ctx->num_objects_large_dc;
|
|
uint32_t num_enum = 0;
|
|
uint32_t num_disp = 0;
|
|
uint32_t num_created = 0;
|
|
uint32_t num_anounced = 0;
|
|
uint32_t i;
|
|
struct dcerpc_binding_handle *b = p->binding_handle;
|
|
|
|
struct policy_handle *handles = talloc_zero_array(tctx, struct policy_handle, num_total);
|
|
|
|
/* query */
|
|
|
|
{
|
|
struct samr_QueryDomainInfo2 r;
|
|
union samr_DomainInfo *info;
|
|
r.in.domain_handle = domain_handle;
|
|
r.in.level = 2;
|
|
r.out.info = &info;
|
|
|
|
torture_assert_ntstatus_ok(tctx, dcerpc_samr_QueryDomainInfo2_r(b, tctx, &r),
|
|
"QueryDomainInfo2 failed");
|
|
torture_assert_ntstatus_ok(tctx, r.out.result,
|
|
"failed to query domain info");
|
|
|
|
switch (ctx->choice) {
|
|
case TORTURE_SAMR_MANY_ACCOUNTS:
|
|
num_anounced = info->general.num_users;
|
|
break;
|
|
case TORTURE_SAMR_MANY_GROUPS:
|
|
num_anounced = info->general.num_groups;
|
|
break;
|
|
case TORTURE_SAMR_MANY_ALIASES:
|
|
num_anounced = info->general.num_aliases;
|
|
break;
|
|
default:
|
|
return false;
|
|
}
|
|
}
|
|
|
|
/* create */
|
|
|
|
for (i=0; i < num_total; i++) {
|
|
|
|
const char *name = NULL;
|
|
|
|
switch (ctx->choice) {
|
|
case TORTURE_SAMR_MANY_ACCOUNTS:
|
|
name = talloc_asprintf(tctx, "%s%04d", TEST_ACCOUNT_NAME, i);
|
|
torture_assert(tctx,
|
|
test_CreateUser(p, tctx, domain_handle, name, &handles[i], domain_sid, 0, NULL, false),
|
|
"failed to create user");
|
|
break;
|
|
case TORTURE_SAMR_MANY_GROUPS:
|
|
name = talloc_asprintf(tctx, "%s%04d", TEST_GROUPNAME, i);
|
|
torture_assert(tctx,
|
|
test_CreateDomainGroup(b, tctx, domain_handle, name, &handles[i], domain_sid, false),
|
|
"failed to create group");
|
|
break;
|
|
case TORTURE_SAMR_MANY_ALIASES:
|
|
name = talloc_asprintf(tctx, "%s%04d", TEST_ALIASNAME, i);
|
|
torture_assert(tctx,
|
|
test_CreateAlias(b, tctx, domain_handle, name, &handles[i], domain_sid, false),
|
|
"failed to create alias");
|
|
break;
|
|
default:
|
|
return false;
|
|
}
|
|
if (!ndr_policy_handle_empty(&handles[i])) {
|
|
num_created++;
|
|
}
|
|
}
|
|
|
|
/* enum */
|
|
|
|
switch (ctx->choice) {
|
|
case TORTURE_SAMR_MANY_ACCOUNTS:
|
|
torture_assert(tctx,
|
|
test_EnumDomainUsers(b, tctx, domain_handle, &num_enum),
|
|
"failed to enum users");
|
|
break;
|
|
case TORTURE_SAMR_MANY_GROUPS:
|
|
torture_assert(tctx,
|
|
test_EnumDomainGroups(b, tctx, domain_handle, &num_enum),
|
|
"failed to enum groups");
|
|
break;
|
|
case TORTURE_SAMR_MANY_ALIASES:
|
|
torture_assert(tctx,
|
|
test_EnumDomainAliases(b, tctx, domain_handle, &num_enum),
|
|
"failed to enum aliases");
|
|
break;
|
|
default:
|
|
return false;
|
|
}
|
|
|
|
/* dispinfo */
|
|
|
|
switch (ctx->choice) {
|
|
case TORTURE_SAMR_MANY_ACCOUNTS:
|
|
torture_assert(tctx,
|
|
test_QueryDisplayInfo_level(b, tctx, domain_handle, 1, &num_disp),
|
|
"failed to query display info");
|
|
break;
|
|
case TORTURE_SAMR_MANY_GROUPS:
|
|
torture_assert(tctx,
|
|
test_QueryDisplayInfo_level(b, tctx, domain_handle, 3, &num_disp),
|
|
"failed to query display info");
|
|
break;
|
|
case TORTURE_SAMR_MANY_ALIASES:
|
|
/* no aliases in dispinfo */
|
|
break;
|
|
default:
|
|
return false;
|
|
}
|
|
|
|
/* close or delete */
|
|
|
|
for (i=0; i < num_total; i++) {
|
|
|
|
if (ndr_policy_handle_empty(&handles[i])) {
|
|
continue;
|
|
}
|
|
|
|
if (torture_setting_bool(tctx, "samba3", false)) {
|
|
torture_assert(tctx,
|
|
test_samr_handle_Close(b, tctx, &handles[i]),
|
|
"failed to close handle");
|
|
} else {
|
|
switch (ctx->choice) {
|
|
case TORTURE_SAMR_MANY_ACCOUNTS:
|
|
torture_assert(tctx,
|
|
test_DeleteUser(b, tctx, &handles[i]),
|
|
"failed to delete user");
|
|
break;
|
|
case TORTURE_SAMR_MANY_GROUPS:
|
|
torture_assert(tctx,
|
|
test_DeleteDomainGroup(b, tctx, &handles[i]),
|
|
"failed to delete group");
|
|
break;
|
|
case TORTURE_SAMR_MANY_ALIASES:
|
|
torture_assert(tctx,
|
|
test_DeleteAlias(b, tctx, &handles[i]),
|
|
"failed to delete alias");
|
|
break;
|
|
default:
|
|
return false;
|
|
}
|
|
}
|
|
}
|
|
|
|
talloc_free(handles);
|
|
|
|
if (ctx->choice == TORTURE_SAMR_MANY_ACCOUNTS && num_enum != num_anounced + num_created) {
|
|
torture_comment(tctx,
|
|
"unexpected number of results (%u) returned in enum call, expected %u\n",
|
|
num_enum, num_anounced + num_created);
|
|
|
|
torture_comment(tctx,
|
|
"unexpected number of results (%u) returned in dispinfo, call, expected %u\n",
|
|
num_disp, num_anounced + num_created);
|
|
}
|
|
|
|
return true;
|
|
}
|
|
|
|
static bool test_Connect(struct dcerpc_binding_handle *b,
|
|
struct torture_context *tctx,
|
|
struct policy_handle *handle);
|
|
|
|
static bool test_OpenDomain(struct dcerpc_pipe *p, struct torture_context *tctx,
|
|
struct torture_samr_context *ctx, struct dom_sid *sid)
|
|
{
|
|
struct samr_OpenDomain r;
|
|
struct policy_handle domain_handle;
|
|
struct policy_handle alias_handle;
|
|
struct policy_handle user_handle;
|
|
struct policy_handle group_handle;
|
|
bool ret = true;
|
|
struct dcerpc_binding_handle *b = p->binding_handle;
|
|
|
|
ZERO_STRUCT(alias_handle);
|
|
ZERO_STRUCT(user_handle);
|
|
ZERO_STRUCT(group_handle);
|
|
ZERO_STRUCT(domain_handle);
|
|
|
|
torture_comment(tctx, "Testing OpenDomain of %s\n", dom_sid_string(tctx, sid));
|
|
|
|
r.in.connect_handle = &ctx->handle;
|
|
r.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
|
|
r.in.sid = sid;
|
|
r.out.domain_handle = &domain_handle;
|
|
|
|
torture_assert_ntstatus_ok(tctx, dcerpc_samr_OpenDomain_r(b, tctx, &r),
|
|
"OpenDomain failed");
|
|
torture_assert_ntstatus_ok(tctx, r.out.result, "OpenDomain failed");
|
|
|
|
/* run the domain tests with the main handle closed - this tests
|
|
the servers reference counting */
|
|
torture_assert(tctx, test_samr_handle_Close(b, tctx, &ctx->handle), "Failed to close SAMR handle");
|
|
|
|
switch (ctx->choice) {
|
|
case TORTURE_SAMR_PASSWORDS:
|
|
case TORTURE_SAMR_USER_PRIVILEGES:
|
|
if (!torture_setting_bool(tctx, "samba3", false)) {
|
|
ret &= test_CreateUser2(p, tctx, &domain_handle, sid, ctx->choice, NULL);
|
|
}
|
|
ret &= test_CreateUser(p, tctx, &domain_handle, TEST_ACCOUNT_NAME, &user_handle, sid, ctx->choice, NULL, true);
|
|
if (!ret) {
|
|
torture_result(tctx, TORTURE_FAIL, "Testing PASSWORDS or PRIVILEGES on domain %s failed!\n", dom_sid_string(tctx, sid));
|
|
}
|
|
break;
|
|
case TORTURE_SAMR_USER_ATTRIBUTES:
|
|
if (!torture_setting_bool(tctx, "samba3", false)) {
|
|
ret &= test_CreateUser2(p, tctx, &domain_handle, sid, ctx->choice, NULL);
|
|
}
|
|
ret &= test_CreateUser(p, tctx, &domain_handle, TEST_ACCOUNT_NAME, &user_handle, sid, ctx->choice, NULL, true);
|
|
/* This test needs 'complex' users to validate */
|
|
ret &= test_QueryDisplayInfo(b, tctx, &domain_handle);
|
|
if (!ret) {
|
|
torture_result(tctx, TORTURE_FAIL, "Testing ATTRIBUTES on domain %s failed!\n", dom_sid_string(tctx, sid));
|
|
}
|
|
break;
|
|
case TORTURE_SAMR_PASSWORDS_PWDLASTSET:
|
|
case TORTURE_SAMR_PASSWORDS_BADPWDCOUNT:
|
|
case TORTURE_SAMR_PASSWORDS_LOCKOUT:
|
|
if (!torture_setting_bool(tctx, "samba3", false)) {
|
|
ret &= test_CreateUser2(p, tctx, &domain_handle, sid, ctx->choice, ctx->machine_credentials);
|
|
}
|
|
ret &= test_CreateUser(p, tctx, &domain_handle, TEST_ACCOUNT_NAME, &user_handle, sid, ctx->choice, ctx->machine_credentials, true);
|
|
if (!ret) {
|
|
torture_result(tctx, TORTURE_FAIL, "Testing PASSWORDS PWDLASTSET or BADPWDCOUNT on domain %s failed!\n", dom_sid_string(tctx, sid));
|
|
}
|
|
break;
|
|
case TORTURE_SAMR_MANY_ACCOUNTS:
|
|
case TORTURE_SAMR_MANY_GROUPS:
|
|
case TORTURE_SAMR_MANY_ALIASES:
|
|
ret &= test_ManyObjects(p, tctx, &domain_handle, sid, ctx);
|
|
if (!ret) {
|
|
torture_result(tctx, TORTURE_FAIL, "Testing MANY-{ACCOUNTS,GROUPS,ALIASES} on domain %s failed!\n", dom_sid_string(tctx, sid));
|
|
}
|
|
break;
|
|
case TORTURE_SAMR_OTHER:
|
|
ret &= test_CreateUser(p, tctx, &domain_handle, TEST_ACCOUNT_NAME, &user_handle, sid, ctx->choice, NULL, true);
|
|
if (!ret) {
|
|
torture_result(tctx, TORTURE_FAIL, "Failed to CreateUser in SAMR-OTHER on domain %s!\n", dom_sid_string(tctx, sid));
|
|
}
|
|
if (!torture_setting_bool(tctx, "samba3", false)) {
|
|
ret &= test_QuerySecurity(b, tctx, &domain_handle);
|
|
}
|
|
ret &= test_RemoveMemberFromForeignDomain(b, tctx, &domain_handle);
|
|
ret &= test_CreateAlias(b, tctx, &domain_handle, TEST_ALIASNAME, &alias_handle, sid, true);
|
|
ret &= test_CreateDomainGroup(b, tctx, &domain_handle, TEST_GROUPNAME, &group_handle, sid, true);
|
|
ret &= test_GetAliasMembership(b, tctx, &domain_handle);
|
|
ret &= test_QueryDomainInfo(p, tctx, &domain_handle);
|
|
ret &= test_QueryDomainInfo2(b, tctx, &domain_handle);
|
|
ret &= test_EnumDomainUsers_all(b, tctx, &domain_handle);
|
|
ret &= test_EnumDomainUsers_async(p, tctx, &domain_handle);
|
|
ret &= test_EnumDomainGroups_all(b, tctx, &domain_handle);
|
|
ret &= test_EnumDomainAliases_all(b, tctx, &domain_handle);
|
|
ret &= test_QueryDisplayInfo2(b, tctx, &domain_handle);
|
|
ret &= test_QueryDisplayInfo3(b, tctx, &domain_handle);
|
|
ret &= test_QueryDisplayInfo_continue(b, tctx, &domain_handle);
|
|
|
|
if (torture_setting_bool(tctx, "samba4", false)) {
|
|
torture_comment(tctx, "skipping GetDisplayEnumerationIndex test against Samba4\n");
|
|
} else {
|
|
ret &= test_GetDisplayEnumerationIndex(b, tctx, &domain_handle);
|
|
ret &= test_GetDisplayEnumerationIndex2(b, tctx, &domain_handle);
|
|
}
|
|
ret &= test_GroupList(b, tctx, sid, &domain_handle);
|
|
ret &= test_TestPrivateFunctionsDomain(b, tctx, &domain_handle);
|
|
ret &= test_RidToSid(b, tctx, sid, &domain_handle);
|
|
ret &= test_GetBootKeyInformation(b, tctx, &domain_handle);
|
|
if (!ret) {
|
|
torture_comment(tctx, "Testing SAMR-OTHER on domain %s failed!\n", dom_sid_string(tctx, sid));
|
|
}
|
|
break;
|
|
}
|
|
|
|
if (!ndr_policy_handle_empty(&user_handle) &&
|
|
!test_DeleteUser(b, tctx, &user_handle)) {
|
|
ret = false;
|
|
}
|
|
|
|
if (!ndr_policy_handle_empty(&alias_handle) &&
|
|
!test_DeleteAlias(b, tctx, &alias_handle)) {
|
|
ret = false;
|
|
}
|
|
|
|
if (!ndr_policy_handle_empty(&group_handle) &&
|
|
!test_DeleteDomainGroup(b, tctx, &group_handle)) {
|
|
ret = false;
|
|
}
|
|
|
|
torture_assert(tctx, test_samr_handle_Close(b, tctx, &domain_handle), "Failed to close SAMR domain handle");
|
|
|
|
torture_assert(tctx, test_Connect(b, tctx, &ctx->handle), "Faile to re-connect SAMR handle");
|
|
/* reconnect the main handle */
|
|
|
|
if (!ret) {
|
|
torture_result(tctx, TORTURE_FAIL, "Testing domain %s failed!\n", dom_sid_string(tctx, sid));
|
|
}
|
|
|
|
return ret;
|
|
}
|
|
|
|
static bool test_LookupDomain(struct dcerpc_pipe *p, struct torture_context *tctx,
|
|
struct torture_samr_context *ctx, const char *domain)
|
|
{
|
|
struct samr_LookupDomain r;
|
|
struct dom_sid2 *sid = NULL;
|
|
struct lsa_String n1;
|
|
struct lsa_String n2;
|
|
bool ret = true;
|
|
struct dcerpc_binding_handle *b = p->binding_handle;
|
|
|
|
torture_comment(tctx, "Testing LookupDomain(%s)\n", domain);
|
|
|
|
/* check for correct error codes */
|
|
r.in.connect_handle = &ctx->handle;
|
|
r.in.domain_name = &n2;
|
|
r.out.sid = &sid;
|
|
n2.string = NULL;
|
|
|
|
torture_assert_ntstatus_ok(tctx, dcerpc_samr_LookupDomain_r(b, tctx, &r),
|
|
"LookupDomain failed");
|
|
torture_assert_ntstatus_equal(tctx, NT_STATUS_INVALID_PARAMETER, r.out.result, "LookupDomain expected NT_STATUS_INVALID_PARAMETER");
|
|
|
|
init_lsa_String(&n2, "xxNODOMAINxx");
|
|
|
|
torture_assert_ntstatus_ok(tctx, dcerpc_samr_LookupDomain_r(b, tctx, &r),
|
|
"LookupDomain failed");
|
|
torture_assert_ntstatus_equal(tctx, NT_STATUS_NO_SUCH_DOMAIN, r.out.result, "LookupDomain expected NT_STATUS_NO_SUCH_DOMAIN");
|
|
|
|
r.in.connect_handle = &ctx->handle;
|
|
|
|
init_lsa_String(&n1, domain);
|
|
r.in.domain_name = &n1;
|
|
|
|
torture_assert_ntstatus_ok(tctx, dcerpc_samr_LookupDomain_r(b, tctx, &r),
|
|
"LookupDomain failed");
|
|
torture_assert_ntstatus_ok(tctx, r.out.result, "LookupDomain");
|
|
|
|
if (!test_GetDomPwInfo(p, tctx, &n1)) {
|
|
ret = false;
|
|
}
|
|
|
|
if (!test_OpenDomain(p, tctx, ctx, *r.out.sid)) {
|
|
ret = false;
|
|
}
|
|
|
|
return ret;
|
|
}
|
|
|
|
|
|
static bool test_EnumDomains(struct dcerpc_pipe *p, struct torture_context *tctx,
|
|
struct torture_samr_context *ctx)
|
|
{
|
|
struct samr_EnumDomains r;
|
|
uint32_t resume_handle = 0;
|
|
uint32_t num_entries = 0;
|
|
struct samr_SamArray *sam = NULL;
|
|
int i;
|
|
bool ret = true;
|
|
struct dcerpc_binding_handle *b = p->binding_handle;
|
|
|
|
r.in.connect_handle = &ctx->handle;
|
|
r.in.resume_handle = &resume_handle;
|
|
r.in.buf_size = (uint32_t)-1;
|
|
r.out.resume_handle = &resume_handle;
|
|
r.out.num_entries = &num_entries;
|
|
r.out.sam = &sam;
|
|
|
|
torture_assert_ntstatus_ok(tctx, dcerpc_samr_EnumDomains_r(b, tctx, &r),
|
|
"EnumDomains failed");
|
|
torture_assert_ntstatus_ok(tctx, r.out.result, "EnumDomains failed");
|
|
|
|
if (!*r.out.sam) {
|
|
return false;
|
|
}
|
|
|
|
for (i=0;i<sam->count;i++) {
|
|
if (!test_LookupDomain(p, tctx, ctx,
|
|
sam->entries[i].name.string)) {
|
|
ret = false;
|
|
}
|
|
}
|
|
|
|
torture_assert_ntstatus_ok(tctx, dcerpc_samr_EnumDomains_r(b, tctx, &r),
|
|
"EnumDomains failed");
|
|
torture_assert_ntstatus_ok(tctx, r.out.result, "EnumDomains failed");
|
|
|
|
return ret;
|
|
}
|
|
|
|
|
|
static bool test_Connect(struct dcerpc_binding_handle *b,
|
|
struct torture_context *tctx,
|
|
struct policy_handle *handle)
|
|
{
|
|
struct samr_Connect r;
|
|
struct samr_Connect2 r2;
|
|
struct samr_Connect3 r3;
|
|
struct samr_Connect4 r4;
|
|
struct samr_Connect5 r5;
|
|
union samr_ConnectInfo info;
|
|
struct policy_handle h;
|
|
uint32_t level_out = 0;
|
|
bool ret = true, got_handle = false;
|
|
|
|
torture_comment(tctx, "Testing samr_Connect\n");
|
|
|
|
r.in.system_name = NULL;
|
|
r.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
|
|
r.out.connect_handle = &h;
|
|
|
|
torture_assert_ntstatus_ok(tctx, dcerpc_samr_Connect_r(b, tctx, &r),
|
|
"Connect failed");
|
|
if (!NT_STATUS_IS_OK(r.out.result)) {
|
|
torture_comment(tctx, "Connect failed - %s\n", nt_errstr(r.out.result));
|
|
ret = false;
|
|
} else {
|
|
got_handle = true;
|
|
*handle = h;
|
|
}
|
|
|
|
torture_comment(tctx, "Testing samr_Connect2\n");
|
|
|
|
r2.in.system_name = NULL;
|
|
r2.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
|
|
r2.out.connect_handle = &h;
|
|
|
|
torture_assert_ntstatus_ok(tctx, dcerpc_samr_Connect2_r(b, tctx, &r2),
|
|
"Connect2 failed");
|
|
if (!NT_STATUS_IS_OK(r2.out.result)) {
|
|
torture_comment(tctx, "Connect2 failed - %s\n", nt_errstr(r2.out.result));
|
|
ret = false;
|
|
} else {
|
|
if (got_handle) {
|
|
test_samr_handle_Close(b, tctx, handle);
|
|
}
|
|
got_handle = true;
|
|
*handle = h;
|
|
}
|
|
|
|
torture_comment(tctx, "Testing samr_Connect3\n");
|
|
|
|
r3.in.system_name = NULL;
|
|
r3.in.unknown = 0;
|
|
r3.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
|
|
r3.out.connect_handle = &h;
|
|
|
|
torture_assert_ntstatus_ok(tctx, dcerpc_samr_Connect3_r(b, tctx, &r3),
|
|
"Connect3 failed");
|
|
if (!NT_STATUS_IS_OK(r3.out.result)) {
|
|
torture_result(tctx, TORTURE_FAIL, "Connect3 failed - %s\n", nt_errstr(r3.out.result));
|
|
ret = false;
|
|
} else {
|
|
if (got_handle) {
|
|
test_samr_handle_Close(b, tctx, handle);
|
|
}
|
|
got_handle = true;
|
|
*handle = h;
|
|
}
|
|
|
|
torture_comment(tctx, "Testing samr_Connect4\n");
|
|
|
|
r4.in.system_name = "";
|
|
r4.in.client_version = 0;
|
|
r4.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
|
|
r4.out.connect_handle = &h;
|
|
|
|
torture_assert_ntstatus_ok(tctx, dcerpc_samr_Connect4_r(b, tctx, &r4),
|
|
"Connect4 failed");
|
|
if (!NT_STATUS_IS_OK(r4.out.result)) {
|
|
torture_result(tctx, TORTURE_FAIL, "Connect4 failed - %s\n", nt_errstr(r4.out.result));
|
|
ret = false;
|
|
} else {
|
|
if (got_handle) {
|
|
test_samr_handle_Close(b, tctx, handle);
|
|
}
|
|
got_handle = true;
|
|
*handle = h;
|
|
}
|
|
|
|
torture_comment(tctx, "Testing samr_Connect5\n");
|
|
|
|
info.info1.client_version = 0;
|
|
info.info1.unknown2 = 0;
|
|
|
|
r5.in.system_name = "";
|
|
r5.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
|
|
r5.in.level_in = 1;
|
|
r5.out.level_out = &level_out;
|
|
r5.in.info_in = &info;
|
|
r5.out.info_out = &info;
|
|
r5.out.connect_handle = &h;
|
|
|
|
torture_assert_ntstatus_ok(tctx, dcerpc_samr_Connect5_r(b, tctx, &r5),
|
|
"Connect5 failed");
|
|
if (!NT_STATUS_IS_OK(r5.out.result)) {
|
|
torture_result(tctx, TORTURE_FAIL, "Connect5 failed - %s\n", nt_errstr(r5.out.result));
|
|
ret = false;
|
|
} else {
|
|
if (got_handle) {
|
|
test_samr_handle_Close(b, tctx, handle);
|
|
}
|
|
got_handle = true;
|
|
*handle = h;
|
|
}
|
|
|
|
return ret;
|
|
}
|
|
|
|
|
|
static bool test_samr_ValidatePassword(struct torture_context *tctx,
|
|
struct dcerpc_pipe *p)
|
|
{
|
|
struct samr_ValidatePassword r;
|
|
union samr_ValidatePasswordReq req;
|
|
union samr_ValidatePasswordRep *repp = NULL;
|
|
NTSTATUS status;
|
|
const char *passwords[] = { "penguin", "p@ssw0rd", "p@ssw0rd123$", NULL };
|
|
int i;
|
|
struct dcerpc_binding_handle *b = p->binding_handle;
|
|
|
|
torture_comment(tctx, "Testing samr_ValidatePassword\n");
|
|
|
|
if (p->conn->transport.transport != NCACN_IP_TCP) {
|
|
torture_comment(tctx, "samr_ValidatePassword only should succeed over NCACN_IP_TCP!\n");
|
|
}
|
|
|
|
ZERO_STRUCT(r);
|
|
r.in.level = NetValidatePasswordReset;
|
|
r.in.req = &req;
|
|
r.out.rep = &repp;
|
|
|
|
ZERO_STRUCT(req);
|
|
req.req3.account.string = "non-existent-account-aklsdji";
|
|
|
|
for (i=0; passwords[i]; i++) {
|
|
req.req3.password.string = passwords[i];
|
|
|
|
status = dcerpc_samr_ValidatePassword_r(b, tctx, &r);
|
|
if (NT_STATUS_EQUAL(status, NT_STATUS_RPC_PROCNUM_OUT_OF_RANGE)) {
|
|
torture_skip(tctx, "ValidatePassword not supported by server\n");
|
|
}
|
|
torture_assert_ntstatus_ok(tctx, status,
|
|
"samr_ValidatePassword failed");
|
|
torture_assert_ntstatus_ok(tctx, r.out.result,
|
|
"samr_ValidatePassword failed");
|
|
torture_comment(tctx, "Server %s password '%s' with code %i\n",
|
|
repp->ctr3.status==SAMR_VALIDATION_STATUS_SUCCESS?"allowed":"refused",
|
|
req.req3.password.string, repp->ctr3.status);
|
|
}
|
|
|
|
return true;
|
|
}
|
|
|
|
bool torture_rpc_samr(struct torture_context *torture)
|
|
{
|
|
NTSTATUS status;
|
|
struct dcerpc_pipe *p;
|
|
bool ret = true;
|
|
struct torture_samr_context *ctx;
|
|
struct dcerpc_binding_handle *b;
|
|
|
|
status = torture_rpc_connection(torture, &p, &ndr_table_samr);
|
|
if (!NT_STATUS_IS_OK(status)) {
|
|
return false;
|
|
}
|
|
b = p->binding_handle;
|
|
|
|
ctx = talloc_zero(torture, struct torture_samr_context);
|
|
|
|
ctx->choice = TORTURE_SAMR_OTHER;
|
|
|
|
ret &= test_Connect(b, torture, &ctx->handle);
|
|
|
|
if (!torture_setting_bool(torture, "samba3", false)) {
|
|
ret &= test_QuerySecurity(b, torture, &ctx->handle);
|
|
}
|
|
|
|
ret &= test_EnumDomains(p, torture, ctx);
|
|
|
|
ret &= test_SetDsrmPassword(b, torture, &ctx->handle);
|
|
|
|
ret &= test_Shutdown(b, torture, &ctx->handle);
|
|
|
|
ret &= test_samr_handle_Close(b, torture, &ctx->handle);
|
|
|
|
return ret;
|
|
}
|
|
|
|
|
|
bool torture_rpc_samr_users(struct torture_context *torture)
|
|
{
|
|
NTSTATUS status;
|
|
struct dcerpc_pipe *p;
|
|
bool ret = true;
|
|
struct torture_samr_context *ctx;
|
|
struct dcerpc_binding_handle *b;
|
|
|
|
status = torture_rpc_connection(torture, &p, &ndr_table_samr);
|
|
if (!NT_STATUS_IS_OK(status)) {
|
|
return false;
|
|
}
|
|
b = p->binding_handle;
|
|
|
|
ctx = talloc_zero(torture, struct torture_samr_context);
|
|
|
|
ctx->choice = TORTURE_SAMR_USER_ATTRIBUTES;
|
|
|
|
ret &= test_Connect(b, torture, &ctx->handle);
|
|
|
|
if (!torture_setting_bool(torture, "samba3", false)) {
|
|
ret &= test_QuerySecurity(b, torture, &ctx->handle);
|
|
}
|
|
|
|
ret &= test_EnumDomains(p, torture, ctx);
|
|
|
|
ret &= test_SetDsrmPassword(b, torture, &ctx->handle);
|
|
|
|
ret &= test_Shutdown(b, torture, &ctx->handle);
|
|
|
|
ret &= test_samr_handle_Close(b, torture, &ctx->handle);
|
|
|
|
return ret;
|
|
}
|
|
|
|
|
|
bool torture_rpc_samr_passwords(struct torture_context *torture)
|
|
{
|
|
NTSTATUS status;
|
|
struct dcerpc_pipe *p;
|
|
bool ret = true;
|
|
struct torture_samr_context *ctx;
|
|
struct dcerpc_binding_handle *b;
|
|
|
|
status = torture_rpc_connection(torture, &p, &ndr_table_samr);
|
|
if (!NT_STATUS_IS_OK(status)) {
|
|
return false;
|
|
}
|
|
b = p->binding_handle;
|
|
|
|
ctx = talloc_zero(torture, struct torture_samr_context);
|
|
|
|
ctx->choice = TORTURE_SAMR_PASSWORDS;
|
|
|
|
ret &= test_Connect(b, torture, &ctx->handle);
|
|
|
|
ret &= test_EnumDomains(p, torture, ctx);
|
|
|
|
ret &= test_samr_handle_Close(b, torture, &ctx->handle);
|
|
|
|
return ret;
|
|
}
|
|
|
|
static bool torture_rpc_samr_pwdlastset(struct torture_context *torture,
|
|
struct dcerpc_pipe *p2,
|
|
struct cli_credentials *machine_credentials)
|
|
{
|
|
NTSTATUS status;
|
|
struct dcerpc_pipe *p;
|
|
bool ret = true;
|
|
struct torture_samr_context *ctx;
|
|
struct dcerpc_binding_handle *b;
|
|
|
|
status = torture_rpc_connection(torture, &p, &ndr_table_samr);
|
|
if (!NT_STATUS_IS_OK(status)) {
|
|
return false;
|
|
}
|
|
b = p->binding_handle;
|
|
|
|
ctx = talloc_zero(torture, struct torture_samr_context);
|
|
|
|
ctx->choice = TORTURE_SAMR_PASSWORDS_PWDLASTSET;
|
|
ctx->machine_credentials = machine_credentials;
|
|
|
|
ret &= test_Connect(b, torture, &ctx->handle);
|
|
|
|
ret &= test_EnumDomains(p, torture, ctx);
|
|
|
|
ret &= test_samr_handle_Close(b, torture, &ctx->handle);
|
|
|
|
return ret;
|
|
}
|
|
|
|
struct torture_suite *torture_rpc_samr_passwords_pwdlastset(TALLOC_CTX *mem_ctx)
|
|
{
|
|
struct torture_suite *suite = torture_suite_create(mem_ctx, "samr.passwords.pwdlastset");
|
|
struct torture_rpc_tcase *tcase;
|
|
|
|
tcase = torture_suite_add_machine_bdc_rpc_iface_tcase(suite, "samr",
|
|
&ndr_table_samr,
|
|
TEST_ACCOUNT_NAME_PWD);
|
|
|
|
torture_rpc_tcase_add_test_creds(tcase, "pwdLastSet",
|
|
torture_rpc_samr_pwdlastset);
|
|
|
|
return suite;
|
|
}
|
|
|
|
static bool torture_rpc_samr_users_privileges_delete_user(struct torture_context *torture,
|
|
struct dcerpc_pipe *p2,
|
|
struct cli_credentials *machine_credentials)
|
|
{
|
|
NTSTATUS status;
|
|
struct dcerpc_pipe *p;
|
|
bool ret = true;
|
|
struct torture_samr_context *ctx;
|
|
struct dcerpc_binding_handle *b;
|
|
|
|
status = torture_rpc_connection(torture, &p, &ndr_table_samr);
|
|
if (!NT_STATUS_IS_OK(status)) {
|
|
return false;
|
|
}
|
|
b = p->binding_handle;
|
|
|
|
ctx = talloc_zero(torture, struct torture_samr_context);
|
|
|
|
ctx->choice = TORTURE_SAMR_USER_PRIVILEGES;
|
|
ctx->machine_credentials = machine_credentials;
|
|
|
|
ret &= test_Connect(b, torture, &ctx->handle);
|
|
|
|
ret &= test_EnumDomains(p, torture, ctx);
|
|
|
|
ret &= test_samr_handle_Close(b, torture, &ctx->handle);
|
|
|
|
return ret;
|
|
}
|
|
|
|
struct torture_suite *torture_rpc_samr_user_privileges(TALLOC_CTX *mem_ctx)
|
|
{
|
|
struct torture_suite *suite = torture_suite_create(mem_ctx, "samr.users.privileges");
|
|
struct torture_rpc_tcase *tcase;
|
|
|
|
tcase = torture_suite_add_machine_bdc_rpc_iface_tcase(suite, "samr",
|
|
&ndr_table_samr,
|
|
TEST_ACCOUNT_NAME_PWD);
|
|
|
|
torture_rpc_tcase_add_test_creds(tcase, "delete_privileged_user",
|
|
torture_rpc_samr_users_privileges_delete_user);
|
|
|
|
return suite;
|
|
}
|
|
|
|
static bool torture_rpc_samr_many_accounts(struct torture_context *torture,
|
|
struct dcerpc_pipe *p2,
|
|
void *data)
|
|
{
|
|
NTSTATUS status;
|
|
struct dcerpc_pipe *p;
|
|
bool ret = true;
|
|
struct torture_samr_context *ctx =
|
|
talloc_get_type_abort(data, struct torture_samr_context);
|
|
struct dcerpc_binding_handle *b;
|
|
|
|
status = torture_rpc_connection(torture, &p, &ndr_table_samr);
|
|
if (!NT_STATUS_IS_OK(status)) {
|
|
return false;
|
|
}
|
|
b = p->binding_handle;
|
|
|
|
ctx->choice = TORTURE_SAMR_MANY_ACCOUNTS;
|
|
ctx->num_objects_large_dc = torture_setting_int(torture, "large_dc",
|
|
ctx->num_objects_large_dc);
|
|
|
|
ret &= test_Connect(b, torture, &ctx->handle);
|
|
|
|
ret &= test_EnumDomains(p, torture, ctx);
|
|
|
|
ret &= test_samr_handle_Close(b, torture, &ctx->handle);
|
|
|
|
return ret;
|
|
}
|
|
|
|
static bool torture_rpc_samr_many_groups(struct torture_context *torture,
|
|
struct dcerpc_pipe *p2,
|
|
void *data)
|
|
{
|
|
NTSTATUS status;
|
|
struct dcerpc_pipe *p;
|
|
bool ret = true;
|
|
struct torture_samr_context *ctx =
|
|
talloc_get_type_abort(data, struct torture_samr_context);
|
|
struct dcerpc_binding_handle *b;
|
|
|
|
status = torture_rpc_connection(torture, &p, &ndr_table_samr);
|
|
if (!NT_STATUS_IS_OK(status)) {
|
|
return false;
|
|
}
|
|
b = p->binding_handle;
|
|
|
|
ctx->choice = TORTURE_SAMR_MANY_GROUPS;
|
|
ctx->num_objects_large_dc = torture_setting_int(torture, "large_dc",
|
|
ctx->num_objects_large_dc);
|
|
|
|
ret &= test_Connect(b, torture, &ctx->handle);
|
|
|
|
ret &= test_EnumDomains(p, torture, ctx);
|
|
|
|
ret &= test_samr_handle_Close(b, torture, &ctx->handle);
|
|
|
|
return ret;
|
|
}
|
|
|
|
static bool torture_rpc_samr_many_aliases(struct torture_context *torture,
|
|
struct dcerpc_pipe *p2,
|
|
void *data)
|
|
{
|
|
NTSTATUS status;
|
|
struct dcerpc_pipe *p;
|
|
bool ret = true;
|
|
struct torture_samr_context *ctx =
|
|
talloc_get_type_abort(data, struct torture_samr_context);
|
|
struct dcerpc_binding_handle *b;
|
|
|
|
status = torture_rpc_connection(torture, &p, &ndr_table_samr);
|
|
if (!NT_STATUS_IS_OK(status)) {
|
|
return false;
|
|
}
|
|
b = p->binding_handle;
|
|
|
|
ctx->choice = TORTURE_SAMR_MANY_ALIASES;
|
|
ctx->num_objects_large_dc = torture_setting_int(torture, "large_dc",
|
|
ctx->num_objects_large_dc);
|
|
|
|
ret &= test_Connect(b, torture, &ctx->handle);
|
|
|
|
ret &= test_EnumDomains(p, torture, ctx);
|
|
|
|
ret &= test_samr_handle_Close(b, torture, &ctx->handle);
|
|
|
|
return ret;
|
|
}
|
|
|
|
struct torture_suite *torture_rpc_samr_large_dc(TALLOC_CTX *mem_ctx)
|
|
{
|
|
struct torture_suite *suite = torture_suite_create(mem_ctx, "samr.large-dc");
|
|
struct torture_rpc_tcase *tcase;
|
|
struct torture_samr_context *ctx;
|
|
|
|
tcase = torture_suite_add_rpc_iface_tcase(suite, "samr", &ndr_table_samr);
|
|
|
|
ctx = talloc_zero(suite, struct torture_samr_context);
|
|
ctx->num_objects_large_dc = 150;
|
|
|
|
torture_rpc_tcase_add_test_ex(tcase, "many_aliases",
|
|
torture_rpc_samr_many_aliases, ctx);
|
|
torture_rpc_tcase_add_test_ex(tcase, "many_groups",
|
|
torture_rpc_samr_many_groups, ctx);
|
|
torture_rpc_tcase_add_test_ex(tcase, "many_accounts",
|
|
torture_rpc_samr_many_accounts, ctx);
|
|
|
|
return suite;
|
|
}
|
|
|
|
static bool torture_rpc_samr_badpwdcount(struct torture_context *torture,
|
|
struct dcerpc_pipe *p2,
|
|
struct cli_credentials *machine_credentials)
|
|
{
|
|
NTSTATUS status;
|
|
struct dcerpc_pipe *p;
|
|
bool ret = true;
|
|
struct torture_samr_context *ctx;
|
|
struct dcerpc_binding_handle *b;
|
|
|
|
status = torture_rpc_connection(torture, &p, &ndr_table_samr);
|
|
if (!NT_STATUS_IS_OK(status)) {
|
|
return false;
|
|
}
|
|
b = p->binding_handle;
|
|
|
|
ctx = talloc_zero(torture, struct torture_samr_context);
|
|
|
|
ctx->choice = TORTURE_SAMR_PASSWORDS_BADPWDCOUNT;
|
|
ctx->machine_credentials = machine_credentials;
|
|
|
|
ret &= test_Connect(b, torture, &ctx->handle);
|
|
|
|
ret &= test_EnumDomains(p, torture, ctx);
|
|
|
|
ret &= test_samr_handle_Close(b, torture, &ctx->handle);
|
|
|
|
return ret;
|
|
}
|
|
|
|
struct torture_suite *torture_rpc_samr_passwords_badpwdcount(TALLOC_CTX *mem_ctx)
|
|
{
|
|
struct torture_suite *suite = torture_suite_create(mem_ctx, "samr.passwords.badpwdcount");
|
|
struct torture_rpc_tcase *tcase;
|
|
|
|
tcase = torture_suite_add_machine_bdc_rpc_iface_tcase(suite, "samr",
|
|
&ndr_table_samr,
|
|
TEST_ACCOUNT_NAME_PWD);
|
|
|
|
torture_rpc_tcase_add_test_creds(tcase, "badPwdCount",
|
|
torture_rpc_samr_badpwdcount);
|
|
|
|
return suite;
|
|
}
|
|
|
|
static bool torture_rpc_samr_lockout(struct torture_context *torture,
|
|
struct dcerpc_pipe *p2,
|
|
struct cli_credentials *machine_credentials)
|
|
{
|
|
NTSTATUS status;
|
|
struct dcerpc_pipe *p;
|
|
bool ret = true;
|
|
struct torture_samr_context *ctx;
|
|
struct dcerpc_binding_handle *b;
|
|
|
|
status = torture_rpc_connection(torture, &p, &ndr_table_samr);
|
|
if (!NT_STATUS_IS_OK(status)) {
|
|
return false;
|
|
}
|
|
b = p->binding_handle;
|
|
|
|
ctx = talloc_zero(torture, struct torture_samr_context);
|
|
|
|
ctx->choice = TORTURE_SAMR_PASSWORDS_LOCKOUT;
|
|
ctx->machine_credentials = machine_credentials;
|
|
|
|
ret &= test_Connect(b, torture, &ctx->handle);
|
|
|
|
ret &= test_EnumDomains(p, torture, ctx);
|
|
|
|
ret &= test_samr_handle_Close(b, torture, &ctx->handle);
|
|
|
|
return ret;
|
|
}
|
|
|
|
struct torture_suite *torture_rpc_samr_passwords_lockout(TALLOC_CTX *mem_ctx)
|
|
{
|
|
struct torture_suite *suite = torture_suite_create(mem_ctx, "samr.passwords.lockout");
|
|
struct torture_rpc_tcase *tcase;
|
|
|
|
tcase = torture_suite_add_machine_bdc_rpc_iface_tcase(suite, "samr",
|
|
&ndr_table_samr,
|
|
TEST_ACCOUNT_NAME_PWD);
|
|
|
|
torture_rpc_tcase_add_test_creds(tcase, "lockout",
|
|
torture_rpc_samr_lockout);
|
|
|
|
return suite;
|
|
}
|
|
|
|
struct torture_suite *torture_rpc_samr_passwords_validate(TALLOC_CTX *mem_ctx)
|
|
{
|
|
struct torture_suite *suite = torture_suite_create(mem_ctx, "samr.passwords.validate");
|
|
struct torture_rpc_tcase *tcase;
|
|
|
|
tcase = torture_suite_add_rpc_iface_tcase(suite, "samr",
|
|
&ndr_table_samr);
|
|
torture_rpc_tcase_add_test(tcase, "validate",
|
|
test_samr_ValidatePassword);
|
|
|
|
return suite;
|
|
}
|