2 files changed, 128 insertions, 0 deletions

diff --git a/source4/torture/rpc/bind.c b/source4/torture/rpc/bind.c
index 17580737f8..4c0ceb29c4 100644
--- a/source4/torture/rpc/bind.c
+++ b/source4/torture/rpc/bind.c
@@ -24,9 +24,13 @@
 #include "includes.h"
 #include "torture/torture.h"
 #include "librpc/gen_ndr/ndr_lsa.h"
+#include "librpc/gen_ndr/ndr_lsa_c.h"
 #include "lib/cmdline/popt_common.h"
 #include "librpc/rpc/dcerpc.h"
 #include "torture/rpc/rpc.h"
+#include "libcli/libcli.h"
+#include "libcli/composite/composite.h"
+#include "libcli/smb_composite/smb_composite.h"
 
 /*
   This test is 'bogus' in that it doesn't actually perform to the
@@ -78,3 +82,126 @@ BOOL torture_multi_bind(struct torture_context *torture)
 
 	return ret;
 }
+
+BOOL torture_bind_authcontext(struct torture_context *torture) 
+{
+	TALLOC_CTX *mem_ctx;
+	NTSTATUS status;
+	BOOL ret = False;
+	struct lsa_ObjectAttribute objectattr;
+	struct lsa_OpenPolicy2 openpolicy;
+	struct policy_handle handle;
+	struct lsa_Close close;
+	struct smbcli_session *tmp;
+	struct smbcli_session *session2;
+	struct smbcli_state *cli;
+	struct dcerpc_pipe *lsa_pipe;
+	struct cli_credentials *anon_creds;
+	struct smb_composite_sesssetup setup;
+
+	mem_ctx = talloc_init("torture_bind_auth");
+
+	if (mem_ctx == NULL) {
+		d_printf("talloc_init failed\n");
+		return False;
+	}
+
+	status = smbcli_full_connection(mem_ctx, &cli,
+					lp_parm_string(-1, "torture", "host"),
+					"IPC$", NULL, cmdline_credentials,
+					NULL);
+	if (!NT_STATUS_IS_OK(status)) {
+		d_printf("smbcli_full_connection failed: %s\n",
+			 nt_errstr(status));
+		goto done;
+	}
+
+	lsa_pipe = dcerpc_pipe_init(mem_ctx, cli->transport->socket->event.ctx);
+	if (lsa_pipe == NULL) {
+		d_printf("dcerpc_pipe_init failed\n");
+		goto done;
+	}
+
+	status = dcerpc_pipe_open_smb(lsa_pipe->conn, cli->tree, "\\lsarpc");
+	if (!NT_STATUS_IS_OK(status)) {
+		d_printf("dcerpc_pipe_open_smb failed: %s\n",
+			 nt_errstr(status));
+		goto done;
+	}
+
+	status = dcerpc_bind_auth_none(lsa_pipe, &dcerpc_table_lsarpc);
+	if (!NT_STATUS_IS_OK(status)) {
+		d_printf("dcerpc_bind_auth_none failed: %s\n",
+			 nt_errstr(status));
+		goto done;
+	}
+
+	openpolicy.in.system_name =talloc_asprintf(
+		mem_ctx, "\\\\%s", dcerpc_server_name(lsa_pipe));
+	ZERO_STRUCT(objectattr);
+	openpolicy.in.attr = &objectattr;
+	openpolicy.in.access_mask = SEC_GENERIC_WRITE;
+	openpolicy.out.handle = &handle;
+
+	status = dcerpc_lsa_OpenPolicy2(lsa_pipe, mem_ctx, &openpolicy);
+
+	if (!NT_STATUS_IS_OK(status)) {
+		d_printf("dcerpc_lsa_OpenPolicy2 failed: %s\n",
+			 nt_errstr(status));
+		goto done;
+	}
+
+	close.in.handle = &handle;
+	close.out.handle = &handle;
+
+	status = dcerpc_lsa_Close(lsa_pipe, mem_ctx, &close);
+	if (!NT_STATUS_IS_OK(status)) {
+		d_printf("dcerpc_lsa_Close failed: %s\n",
+			 nt_errstr(status));
+		goto done;
+	}
+
+	session2 = smbcli_session_init(cli->transport, mem_ctx, False);
+	if (session2 == NULL) {
+		d_printf("smbcli_session_init failed\n");
+		goto done;
+	}
+
+	anon_creds = cli_credentials_init(mem_ctx);
+	if (anon_creds == NULL) {
+		d_printf("cli_credentials_init failed\n");
+		goto done;
+	}
+
+	cli_credentials_set_conf(anon_creds);
+	cli_credentials_set_anonymous(anon_creds);
+
+	setup.in.sesskey = cli->transport->negotiate.sesskey;
+	setup.in.capabilities = cli->transport->negotiate.capabilities;
+	setup.in.workgroup = "";
+	setup.in.credentials = anon_creds;
+
+	status = smb_composite_sesssetup(session2, &setup);
+	if (!NT_STATUS_IS_OK(status)) {
+		d_printf("anon session setup failed: %s\n",
+			 nt_errstr(status));
+		goto done;
+	}
+
+	tmp = cli->tree->session;
+	cli->tree->session = session2;
+
+	status = dcerpc_lsa_OpenPolicy2(lsa_pipe, mem_ctx, &openpolicy);
+
+	if (!NT_STATUS_EQUAL(status, NT_STATUS_INVALID_HANDLE)) {
+		d_printf("dcerpc_lsa_OpenPolicy2 with wrong vuid gave %s, "
+			 "expected NT_STATUS_INVALID_HANDLE\n",
+			 nt_errstr(status));
+		goto done;
+	}
+
+	ret = True;
+ done:
+	talloc_free(mem_ctx);
+	return ret;
+}
diff --git a/source4/torture/rpc/rpc.c b/source4/torture/rpc/rpc.c
index f5b2629e81..75634f90ff 100644
--- a/source4/torture/rpc/rpc.c
+++ b/source4/torture/rpc/rpc.c
@@ -122,6 +122,7 @@ NTSTATUS torture_rpc_init(void)
 	register_torture_op("RPC-AUTOIDL", torture_rpc_autoidl, 0);
 	register_torture_op("RPC-COUNTCALLS", torture_rpc_countcalls, 0);
 	register_torture_op("RPC-MULTIBIND", torture_multi_bind, 0);
+	register_torture_op("RPC-AUTHCONTEXT", torture_bind_authcontext, 0);
 	register_torture_op("RPC-DRSUAPI", torture_rpc_drsuapi, 0);
 	register_torture_op("RPC-CRACKNAMES", torture_rpc_drsuapi_cracknames, 0);
 	register_torture_op("RPC-ROT", torture_rpc_rot, 0);