From 08c97435d3dd055329d41b3814af687c7404533f Mon Sep 17 00:00:00 2001 From: Andrew Bartlett Date: Mon, 17 Sep 2007 05:31:49 +0000 Subject: r25194: A major rework of the Samba4 LSA LookupNames and LookupSids code, with a new torture suite to match. MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit This should fix bug #4954 by Matthias Wallnöfer Previously we had no knowlege of BUILTIN or well-known names. This code needs expansion to check with winbind for trusted domains. Andrew Bartlett (This used to be commit e6fc0e1f54ad64bdddc88e9ebd0d8d181b6ce26a) --- source4/torture/rpc/lsa.c | 218 ++++++++++++++++++++++++++++++++++++++-------- 1 file changed, 183 insertions(+), 35 deletions(-) (limited to 'source4/torture/rpc/lsa.c') diff --git a/source4/torture/rpc/lsa.c b/source4/torture/rpc/lsa.c index 2cc2b78a78..00fc30414d 100644 --- a/source4/torture/rpc/lsa.c +++ b/source4/torture/rpc/lsa.c @@ -128,7 +128,7 @@ BOOL test_lsa_OpenPolicy2(struct dcerpc_pipe *p, TALLOC_CTX *mem_ctx, static BOOL test_LookupNames(struct dcerpc_pipe *p, TALLOC_CTX *mem_ctx, struct policy_handle *handle, - struct lsa_TransNameArray *tnames) + struct lsa_TransNameArray *tnames) { struct lsa_LookupNames r; struct lsa_TransSidArray sids; @@ -157,7 +157,55 @@ static BOOL test_LookupNames(struct dcerpc_pipe *p, r.out.sids = &sids; status = dcerpc_lsa_LookupNames(p, mem_ctx, &r); - if (!NT_STATUS_IS_OK(status) && !NT_STATUS_EQUAL(status, STATUS_SOME_UNMAPPED)) { + if (!NT_STATUS_IS_OK(status)) { + printf("LookupNames failed - %s\n", nt_errstr(status)); + return False; + } + + printf("\n"); + + return True; +} + +static BOOL test_LookupNames_bogus(struct dcerpc_pipe *p, + TALLOC_CTX *mem_ctx, + struct policy_handle *handle) +{ + struct lsa_LookupNames r; + struct lsa_TransSidArray sids; + struct lsa_String *names; + uint32_t count = 0; + NTSTATUS status; + int i; + + struct lsa_TranslatedName name; + struct lsa_TransNameArray tnames; + + tnames.names = &name; + tnames.count = 1; + name.name.string = "NT AUTHORITY\\BOGUS"; + + printf("\nTesting LookupNames with bogus names\n"); + + sids.count = 0; + sids.sids = NULL; + + names = talloc_array(mem_ctx, struct lsa_String, tnames.count); + for (i=0;idns.name.string; + tnames.names[1].name.string = r.out.info->dns.dns_domain.string; + tnames.names[2].name.string = talloc_asprintf(mem_ctx, "%s\\", r.out.info->dns.name.string); + tnames.names[3].name.string = talloc_asprintf(mem_ctx, "%s\\", r.out.info->dns.dns_domain.string); + tnames.names[4].name.string = talloc_asprintf(mem_ctx, "%s\\guest", r.out.info->dns.name.string); + tnames.names[5].name.string = talloc_asprintf(mem_ctx, "%s\\krbtgt", r.out.info->dns.name.string); + tnames.names[6].name.string = talloc_asprintf(mem_ctx, "%s\\guest", r.out.info->dns.dns_domain.string); + tnames.names[7].name.string = talloc_asprintf(mem_ctx, "%s\\krbtgt", r.out.info->dns.dns_domain.string); + tnames.names[8].name.string = talloc_asprintf(mem_ctx, "krbtgt@%s", r.out.info->dns.name.string); + tnames.names[9].name.string = talloc_asprintf(mem_ctx, "krbtgt@%s", r.out.info->dns.dns_domain.string); + ret &= test_LookupNames(p, mem_ctx, handle, &tnames); } } @@ -1904,11 +2030,6 @@ static BOOL test_QueryInfoPolicy2(struct dcerpc_pipe *p, int i; BOOL ret = True; printf("\nTesting QueryInfoPolicy2\n"); - if (lp_parm_bool(NULL, "torture", "samba4", false)) { - printf("skipping QueryInfoPolicy2 against Samba4\n"); - return True; - } - for (i=1;i<13;i++) { r.in.handle = handle; r.in.level = i; @@ -1916,17 +2037,36 @@ static BOOL test_QueryInfoPolicy2(struct dcerpc_pipe *p, printf("\ntrying QueryInfoPolicy2 level %d\n", i); status = dcerpc_lsa_QueryInfoPolicy2(p, mem_ctx, &r); - - if ((i == 9 || i == 10 || i == 11) && - NT_STATUS_EQUAL(status, NT_STATUS_INVALID_PARAMETER)) { - printf("server failed level %u (OK)\n", i); - continue; - } - - if (!NT_STATUS_IS_OK(status)) { - printf("QueryInfoPolicy2 failed - %s\n", nt_errstr(status)); - ret = False; - continue; + + switch (i) { + case LSA_POLICY_INFO_DB: + case LSA_POLICY_INFO_AUDIT_FULL_SET: + case LSA_POLICY_INFO_AUDIT_FULL_QUERY: + if (!NT_STATUS_EQUAL(status, NT_STATUS_INVALID_PARAMETER)) { + printf("server should have failed level %u: %s\n", i, nt_errstr(status)); + ret = False; + } + break; + case LSA_POLICY_INFO_DOMAIN: + case LSA_POLICY_INFO_ACCOUNT_DOMAIN: + case LSA_POLICY_INFO_DNS: + if (!NT_STATUS_IS_OK(status)) { + printf("QueryInfoPolicy2 failed - %s\n", nt_errstr(status)); + ret = False; + } + break; + default: + if (lp_parm_bool(NULL, "torture", "samba4", false)) { + /* Other levels not implemented yet */ + if (!NT_STATUS_EQUAL(status, NT_STATUS_INVALID_INFO_CLASS)) { + printf("QueryInfoPolicy2 failed - %s\n", nt_errstr(status)); + ret = False; + } + } else if (!NT_STATUS_IS_OK(status)) { + printf("QueryInfoPolicy2 failed - %s\n", nt_errstr(status)); + ret = False; + } + break; } } @@ -2013,6 +2153,14 @@ BOOL torture_rpc_lsa(struct torture_context *torture) } if (handle) { + if (!test_LookupNames_wellknown(p, mem_ctx, handle)) { + ret = False; + } + + if (!test_LookupNames_bogus(p, mem_ctx, handle)) { + ret = False; + } + if (!test_LookupSids_async(p, mem_ctx, handle)) { ret = False; } -- cgit