diff options
| -rwxr-xr-x | source4/selftest/test_session_key.sh | 16 | ||||
| -rw-r--r-- | source4/torture/rpc/rpc.c | 2 | ||||
| -rw-r--r-- | source4/torture/rpc/session_key.c | 72 |
3 files changed, 58 insertions, 32 deletions
diff --git a/source4/selftest/test_session_key.sh b/source4/selftest/test_session_key.sh index 26b9c0cf0e..46f6a4ee3a 100755 --- a/source4/selftest/test_session_key.sh +++ b/source4/selftest/test_session_key.sh @@ -4,8 +4,7 @@ incdir=`dirname $0` . $incdir/test_functions.sh transport="ncacn_np" -for bindoptions in bigendian seal; do - for keyexchange in "yes" "no"; do +for keyexchange in "yes" "no"; do for ntlm2 in "yes" "no"; do for lm_key in "yes" "no"; do for ntlmoptions in \ @@ -27,12 +26,11 @@ for bindoptions in bigendian seal; do done done done - name="RPC-SECRETS on $transport with $bindoptions with Kerberos" - plantest "$name" dc $samba4bindir/smbtorture $TORTURE_OPTIONS $transport:"\$SERVER[$bindoptions]" -k yes -U"\$USERNAME"%"\$PASSWORD" -W \$DOMAIN "--option=gensec:target_hostname=\$NETBIOSNAME" RPC-SECRETS "$*" - name="RPC-SECRETS on $transport with $bindoptions with Kerberos - use target principal" - plantest "$name" dc $samba4bindir/smbtorture $TORTURE_OPTIONS $transport:"\$SERVER[$bindoptions]" -k yes -U"\$USERNAME"%"\$PASSWORD" -W \$DOMAIN "--option=clientusespnegoprincipal=yes" "--option=gensec:target_hostname=\$NETBIOSNAME" RPC-SECRETS "$*" -done +name="RPC-SECRETS on $transport with $bindoptions with Kerberos" +plantest "$name" dc $samba4bindir/smbtorture $TORTURE_OPTIONS $transport:"\$SERVER[$bindoptions]" -k yes -U"\$USERNAME"%"\$PASSWORD" -W \$DOMAIN "--option=gensec:target_hostname=\$NETBIOSNAME" RPC-SECRETS "$*" +name="RPC-SECRETS on $transport with $bindoptions with Kerberos - use target principal" +plantest "$name" dc $samba4bindir/smbtorture $TORTURE_OPTIONS $transport:"\$SERVER[$bindoptions]" -k yes -U"\$USERNAME"%"\$PASSWORD" -W \$DOMAIN "--option=clientusespnegoprincipal=yes" "--option=gensec:target_hostname=\$NETBIOSNAME" RPC-SECRETS "$*" name="RPC-SECRETS on $transport with Kerberos - use Samba3 style login" - plantest "$name" dc $samba4bindir/smbtorture $TORTURE_OPTIONS $transport:"\$SERVER" -k yes -U"\$USERNAME"%"\$PASSWORD" -W "\$DOMAIN" "--option=gensec:fake_gssapi_krb5=yes" "--option=gensec:gssapi_krb5=no" "--option=gensec:target_hostname=\$NETBIOSNAME" RPC-SECRETS "$*" + plantest "$name" dc $samba4bindir/smbtorture $TORTURE_OPTIONS $transport:"\$SERVER" -k yes -U"\$USERNAME"%"\$PASSWORD" -W "\$DOMAIN" "--option=gensec:fake_gssapi_krb5=yes" "--option=gensec:gssapi_krb5=no" "--option=gensec:target_hostname=\$NETBIOSNAME" RPC-SECRETS-none "$*" name="RPC-SECRETS on $transport with Kerberos - use Samba3 style login, use target principal" - plantest "$name" dc $samba4bindir/smbtorture $TORTURE_OPTIONS $transport:"\$SERVER" -k yes -U"\$USERNAME"%"\$PASSWORD" -W "\$DOMAIN" "--option=clientusespnegoprincipal=yes" "--option=gensec:fake_gssapi_krb5=yes" "--option=gensec:gssapi_krb5=no" "--option=gensec:target_hostname=\$NETBIOSNAME" RPC-SECRETS "$*" + plantest "$name" dc $samba4bindir/smbtorture $TORTURE_OPTIONS $transport:"\$SERVER" -k yes -U"\$USERNAME"%"\$PASSWORD" -W "\$DOMAIN" "--option=clientusespnegoprincipal=yes" "--option=gensec:fake_gssapi_krb5=yes" "--option=gensec:gssapi_krb5=no" "--option=gensec:target_hostname=\$NETBIOSNAME" RPC-SECRETS-none "$*" diff --git a/source4/torture/rpc/rpc.c b/source4/torture/rpc/rpc.c index 9505b732b8..c6d22ba5c3 100644 --- a/source4/torture/rpc/rpc.c +++ b/source4/torture/rpc/rpc.c @@ -378,7 +378,7 @@ NTSTATUS torture_rpc_init(void) torture_suite_add_simple_test(suite, "LSA", torture_rpc_lsa); torture_suite_add_simple_test(suite, "LSALOOKUP", torture_rpc_lsa_lookup); torture_suite_add_simple_test(suite, "LSA-GETUSER", torture_rpc_lsa_get_user); - torture_suite_add_simple_test(suite, "SECRETS", torture_rpc_lsa_secrets); + torture_suite_add_suite(suite, torture_rpc_lsa_secrets(suite)); torture_suite_add_suite(suite, torture_rpc_echo(suite)); torture_suite_add_simple_test(suite, "DFS", torture_rpc_dfs); torture_suite_add_suite(suite, torture_rpc_unixinfo(suite)); diff --git a/source4/torture/rpc/session_key.c b/source4/torture/rpc/session_key.c index 141a2dfd72..29dfdcc1c5 100644 --- a/source4/torture/rpc/session_key.c +++ b/source4/torture/rpc/session_key.c @@ -25,6 +25,7 @@ #include "libcli/auth/libcli_auth.h" #include "torture/rpc/rpc.h" +#include "lib/cmdline/popt_common.h" static void init_lsa_String(struct lsa_String *name, const char *s) { @@ -114,18 +115,16 @@ static bool test_CreateSecret_basic(struct dcerpc_pipe *p, torture_comment(tctx, "Testing QuerySecret\n"); status = dcerpc_lsa_QuerySecret(p, tctx, &r4); torture_assert_ntstatus_ok(tctx, status, "QuerySecret failed"); - if (r4.out.new_val == NULL || r4.out.new_val->buf == NULL) { + if (r4.out.new_val == NULL || r4.out.new_val->buf == NULL) torture_fail(tctx, "No secret buffer returned"); - } else { - blob1.data = r4.out.new_val->buf->data; - blob1.length = r4.out.new_val->buf->size; - - blob2 = data_blob_talloc(tctx, NULL, blob1.length); - - secret2 = sess_decrypt_string(tctx, &blob1, &session_key); - - torture_assert_str_equal(tctx, secret1, secret2, "Returned secret invalid"); - } + blob1.data = r4.out.new_val->buf->data; + blob1.length = r4.out.new_val->buf->size; + + blob2 = data_blob_talloc(tctx, NULL, blob1.length); + + secret2 = sess_decrypt_string(tctx, &blob1, &session_key); + + torture_assert_str_equal(tctx, secret1, secret2, "Returned secret invalid"); d.in.handle = &sec_handle; status = dcerpc_lsa_Delete(p, tctx, &d); @@ -133,27 +132,31 @@ static bool test_CreateSecret_basic(struct dcerpc_pipe *p, return true; } +struct secret_settings { + uint32_t bindoptions; +}; -/* TEST session key correctness by pushing and pulling secrets */ - -bool torture_rpc_lsa_secrets(struct torture_context *torture) +static bool test_secrets(struct torture_context *torture, const void *_data) { - NTSTATUS status; struct dcerpc_pipe *p; struct policy_handle *handle; + struct dcerpc_binding *binding; + const struct secret_settings *settings = _data; - status = torture_rpc_connection(torture, - &p, - &ndr_table_lsarpc); - torture_assert_ntstatus_ok(torture, status, "Creating connection"); + torture_assert_ntstatus_ok(torture, torture_rpc_binding(torture, &binding), + "Getting bindoptions"); + + binding->flags |= settings->bindoptions; + + torture_assert_ntstatus_ok(torture, + dcerpc_pipe_connect_b(torture, &p, binding, &ndr_table_lsarpc, cmdline_credentials, NULL), + "connect"); if (!test_lsa_OpenPolicy2(p, torture, &handle)) { return false; } - if (!handle) { - torture_fail(torture, "OpenPolicy2 failed. This test cannot run against this server"); - } + torture_assert(torture, handle, "OpenPolicy2 failed. This test cannot run against this server"); if (!test_CreateSecret_basic(p, torture, handle)) { return false; @@ -161,3 +164,28 @@ bool torture_rpc_lsa_secrets(struct torture_context *torture) return true; } + +/* TEST session key correctness by pushing and pulling secrets */ + +struct torture_suite *torture_rpc_lsa_secrets(TALLOC_CTX *mem_ctx) +{ + struct torture_suite *suite = torture_suite_create(mem_ctx, "SECRETS"); + struct secret_settings *settings; + + settings = talloc_zero(suite, struct secret_settings); + settings->bindoptions = DCERPC_PUSH_BIGENDIAN; + + torture_suite_add_simple_tcase(suite, "bigendian", test_secrets, settings); + + settings = talloc_zero(suite, struct secret_settings); + settings->bindoptions = DCERPC_SEAL; + + torture_suite_add_simple_tcase(suite, "seal", test_secrets, settings); + + settings = talloc_zero(suite, struct secret_settings); + settings->bindoptions = 0; + + torture_suite_add_simple_tcase(suite, "none", test_secrets, settings); + + return suite; +} |