summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
-rwxr-xr-xsource4/selftest/test_session_key.sh16
-rw-r--r--source4/torture/rpc/rpc.c2
-rw-r--r--source4/torture/rpc/session_key.c72
3 files changed, 58 insertions, 32 deletions
diff --git a/source4/selftest/test_session_key.sh b/source4/selftest/test_session_key.sh
index 26b9c0cf0e..46f6a4ee3a 100755
--- a/source4/selftest/test_session_key.sh
+++ b/source4/selftest/test_session_key.sh
@@ -4,8 +4,7 @@ incdir=`dirname $0`
. $incdir/test_functions.sh
transport="ncacn_np"
-for bindoptions in bigendian seal; do
- for keyexchange in "yes" "no"; do
+for keyexchange in "yes" "no"; do
for ntlm2 in "yes" "no"; do
for lm_key in "yes" "no"; do
for ntlmoptions in \
@@ -27,12 +26,11 @@ for bindoptions in bigendian seal; do
done
done
done
- name="RPC-SECRETS on $transport with $bindoptions with Kerberos"
- plantest "$name" dc $samba4bindir/smbtorture $TORTURE_OPTIONS $transport:"\$SERVER[$bindoptions]" -k yes -U"\$USERNAME"%"\$PASSWORD" -W \$DOMAIN "--option=gensec:target_hostname=\$NETBIOSNAME" RPC-SECRETS "$*"
- name="RPC-SECRETS on $transport with $bindoptions with Kerberos - use target principal"
- plantest "$name" dc $samba4bindir/smbtorture $TORTURE_OPTIONS $transport:"\$SERVER[$bindoptions]" -k yes -U"\$USERNAME"%"\$PASSWORD" -W \$DOMAIN "--option=clientusespnegoprincipal=yes" "--option=gensec:target_hostname=\$NETBIOSNAME" RPC-SECRETS "$*"
-done
+name="RPC-SECRETS on $transport with $bindoptions with Kerberos"
+plantest "$name" dc $samba4bindir/smbtorture $TORTURE_OPTIONS $transport:"\$SERVER[$bindoptions]" -k yes -U"\$USERNAME"%"\$PASSWORD" -W \$DOMAIN "--option=gensec:target_hostname=\$NETBIOSNAME" RPC-SECRETS "$*"
+name="RPC-SECRETS on $transport with $bindoptions with Kerberos - use target principal"
+plantest "$name" dc $samba4bindir/smbtorture $TORTURE_OPTIONS $transport:"\$SERVER[$bindoptions]" -k yes -U"\$USERNAME"%"\$PASSWORD" -W \$DOMAIN "--option=clientusespnegoprincipal=yes" "--option=gensec:target_hostname=\$NETBIOSNAME" RPC-SECRETS "$*"
name="RPC-SECRETS on $transport with Kerberos - use Samba3 style login"
- plantest "$name" dc $samba4bindir/smbtorture $TORTURE_OPTIONS $transport:"\$SERVER" -k yes -U"\$USERNAME"%"\$PASSWORD" -W "\$DOMAIN" "--option=gensec:fake_gssapi_krb5=yes" "--option=gensec:gssapi_krb5=no" "--option=gensec:target_hostname=\$NETBIOSNAME" RPC-SECRETS "$*"
+ plantest "$name" dc $samba4bindir/smbtorture $TORTURE_OPTIONS $transport:"\$SERVER" -k yes -U"\$USERNAME"%"\$PASSWORD" -W "\$DOMAIN" "--option=gensec:fake_gssapi_krb5=yes" "--option=gensec:gssapi_krb5=no" "--option=gensec:target_hostname=\$NETBIOSNAME" RPC-SECRETS-none "$*"
name="RPC-SECRETS on $transport with Kerberos - use Samba3 style login, use target principal"
- plantest "$name" dc $samba4bindir/smbtorture $TORTURE_OPTIONS $transport:"\$SERVER" -k yes -U"\$USERNAME"%"\$PASSWORD" -W "\$DOMAIN" "--option=clientusespnegoprincipal=yes" "--option=gensec:fake_gssapi_krb5=yes" "--option=gensec:gssapi_krb5=no" "--option=gensec:target_hostname=\$NETBIOSNAME" RPC-SECRETS "$*"
+ plantest "$name" dc $samba4bindir/smbtorture $TORTURE_OPTIONS $transport:"\$SERVER" -k yes -U"\$USERNAME"%"\$PASSWORD" -W "\$DOMAIN" "--option=clientusespnegoprincipal=yes" "--option=gensec:fake_gssapi_krb5=yes" "--option=gensec:gssapi_krb5=no" "--option=gensec:target_hostname=\$NETBIOSNAME" RPC-SECRETS-none "$*"
diff --git a/source4/torture/rpc/rpc.c b/source4/torture/rpc/rpc.c
index 9505b732b8..c6d22ba5c3 100644
--- a/source4/torture/rpc/rpc.c
+++ b/source4/torture/rpc/rpc.c
@@ -378,7 +378,7 @@ NTSTATUS torture_rpc_init(void)
torture_suite_add_simple_test(suite, "LSA", torture_rpc_lsa);
torture_suite_add_simple_test(suite, "LSALOOKUP", torture_rpc_lsa_lookup);
torture_suite_add_simple_test(suite, "LSA-GETUSER", torture_rpc_lsa_get_user);
- torture_suite_add_simple_test(suite, "SECRETS", torture_rpc_lsa_secrets);
+ torture_suite_add_suite(suite, torture_rpc_lsa_secrets(suite));
torture_suite_add_suite(suite, torture_rpc_echo(suite));
torture_suite_add_simple_test(suite, "DFS", torture_rpc_dfs);
torture_suite_add_suite(suite, torture_rpc_unixinfo(suite));
diff --git a/source4/torture/rpc/session_key.c b/source4/torture/rpc/session_key.c
index 141a2dfd72..29dfdcc1c5 100644
--- a/source4/torture/rpc/session_key.c
+++ b/source4/torture/rpc/session_key.c
@@ -25,6 +25,7 @@
#include "libcli/auth/libcli_auth.h"
#include "torture/rpc/rpc.h"
+#include "lib/cmdline/popt_common.h"
static void init_lsa_String(struct lsa_String *name, const char *s)
{
@@ -114,18 +115,16 @@ static bool test_CreateSecret_basic(struct dcerpc_pipe *p,
torture_comment(tctx, "Testing QuerySecret\n");
status = dcerpc_lsa_QuerySecret(p, tctx, &r4);
torture_assert_ntstatus_ok(tctx, status, "QuerySecret failed");
- if (r4.out.new_val == NULL || r4.out.new_val->buf == NULL) {
+ if (r4.out.new_val == NULL || r4.out.new_val->buf == NULL)
torture_fail(tctx, "No secret buffer returned");
- } else {
- blob1.data = r4.out.new_val->buf->data;
- blob1.length = r4.out.new_val->buf->size;
-
- blob2 = data_blob_talloc(tctx, NULL, blob1.length);
-
- secret2 = sess_decrypt_string(tctx, &blob1, &session_key);
-
- torture_assert_str_equal(tctx, secret1, secret2, "Returned secret invalid");
- }
+ blob1.data = r4.out.new_val->buf->data;
+ blob1.length = r4.out.new_val->buf->size;
+
+ blob2 = data_blob_talloc(tctx, NULL, blob1.length);
+
+ secret2 = sess_decrypt_string(tctx, &blob1, &session_key);
+
+ torture_assert_str_equal(tctx, secret1, secret2, "Returned secret invalid");
d.in.handle = &sec_handle;
status = dcerpc_lsa_Delete(p, tctx, &d);
@@ -133,27 +132,31 @@ static bool test_CreateSecret_basic(struct dcerpc_pipe *p,
return true;
}
+struct secret_settings {
+ uint32_t bindoptions;
+};
-/* TEST session key correctness by pushing and pulling secrets */
-
-bool torture_rpc_lsa_secrets(struct torture_context *torture)
+static bool test_secrets(struct torture_context *torture, const void *_data)
{
- NTSTATUS status;
struct dcerpc_pipe *p;
struct policy_handle *handle;
+ struct dcerpc_binding *binding;
+ const struct secret_settings *settings = _data;
- status = torture_rpc_connection(torture,
- &p,
- &ndr_table_lsarpc);
- torture_assert_ntstatus_ok(torture, status, "Creating connection");
+ torture_assert_ntstatus_ok(torture, torture_rpc_binding(torture, &binding),
+ "Getting bindoptions");
+
+ binding->flags |= settings->bindoptions;
+
+ torture_assert_ntstatus_ok(torture,
+ dcerpc_pipe_connect_b(torture, &p, binding, &ndr_table_lsarpc, cmdline_credentials, NULL),
+ "connect");
if (!test_lsa_OpenPolicy2(p, torture, &handle)) {
return false;
}
- if (!handle) {
- torture_fail(torture, "OpenPolicy2 failed. This test cannot run against this server");
- }
+ torture_assert(torture, handle, "OpenPolicy2 failed. This test cannot run against this server");
if (!test_CreateSecret_basic(p, torture, handle)) {
return false;
@@ -161,3 +164,28 @@ bool torture_rpc_lsa_secrets(struct torture_context *torture)
return true;
}
+
+/* TEST session key correctness by pushing and pulling secrets */
+
+struct torture_suite *torture_rpc_lsa_secrets(TALLOC_CTX *mem_ctx)
+{
+ struct torture_suite *suite = torture_suite_create(mem_ctx, "SECRETS");
+ struct secret_settings *settings;
+
+ settings = talloc_zero(suite, struct secret_settings);
+ settings->bindoptions = DCERPC_PUSH_BIGENDIAN;
+
+ torture_suite_add_simple_tcase(suite, "bigendian", test_secrets, settings);
+
+ settings = talloc_zero(suite, struct secret_settings);
+ settings->bindoptions = DCERPC_SEAL;
+
+ torture_suite_add_simple_tcase(suite, "seal", test_secrets, settings);
+
+ settings = talloc_zero(suite, struct secret_settings);
+ settings->bindoptions = 0;
+
+ torture_suite_add_simple_tcase(suite, "none", test_secrets, settings);
+
+ return suite;
+}