LCOV - code coverage report
Current view: top level - source4/torture/rpc - handles.c (source / functions) Hit Total Coverage
Test: coverage report for master 2b515b7d Lines: 283 331 85.5 %
Date: 2024-02-28 12:06:22 Functions: 7 7 100.0 %

          Line data    Source code
       1             : /* 
       2             :    Unix SMB/CIFS implementation.
       3             : 
       4             :    test suite for behaviour of rpc policy handles
       5             : 
       6             :    Copyright (C) Andrew Tridgell 2007
       7             :    
       8             :    This program is free software; you can redistribute it and/or modify
       9             :    it under the terms of the GNU General Public License as published by
      10             :    the Free Software Foundation; either version 3 of the License, or
      11             :    (at your option) any later version.
      12             :    
      13             :    This program is distributed in the hope that it will be useful,
      14             :    but WITHOUT ANY WARRANTY; without even the implied warranty of
      15             :    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
      16             :    GNU General Public License for more details.
      17             :    
      18             :    You should have received a copy of the GNU General Public License
      19             :    along with this program.  If not, see <http://www.gnu.org/licenses/>.
      20             : */
      21             : 
      22             : #include "includes.h"
      23             : #include "librpc/gen_ndr/ndr_samr_c.h"
      24             : #include "librpc/gen_ndr/ndr_lsa_c.h"
      25             : #include "librpc/gen_ndr/ndr_drsuapi_c.h"
      26             : #include "torture/rpc/torture_rpc.h"
      27             : 
      28             : /*
      29             :   this tests the use of policy handles between connections
      30             : */
      31             : 
      32          12 : static bool test_handles_lsa(struct torture_context *torture)
      33             : {
      34           3 :         NTSTATUS status;
      35           3 :         struct dcerpc_pipe *p1, *p2;
      36           3 :         struct dcerpc_binding_handle *b1, *b2;
      37           3 :         struct policy_handle handle;
      38           3 :         struct policy_handle handle2;
      39           3 :         struct lsa_ObjectAttribute attr;
      40           3 :         struct lsa_QosInfo qos;
      41           3 :         struct lsa_OpenPolicy r;
      42           3 :         struct lsa_Close c;
      43          12 :         uint16_t system_name = '\\';
      44          12 :         TALLOC_CTX *mem_ctx = talloc_new(torture);
      45             : 
      46          12 :         torture_comment(torture, "RPC-HANDLE-LSARPC\n");
      47             : 
      48          12 :         status = torture_rpc_connection(torture, &p1, &ndr_table_lsarpc);
      49          12 :         torture_assert_ntstatus_ok(torture, status, "opening lsa pipe1");
      50          12 :         b1 = p1->binding_handle;
      51             : 
      52          12 :         status = torture_rpc_connection(torture, &p2, &ndr_table_lsarpc);
      53          12 :         torture_assert_ntstatus_ok(torture, status, "opening lsa pipe1");
      54          12 :         b2 = p2->binding_handle;
      55             : 
      56          12 :         qos.len = 0;
      57          12 :         qos.impersonation_level = 2;
      58          12 :         qos.context_mode = 1;
      59          12 :         qos.effective_only = 0;
      60             : 
      61          12 :         attr.len = 0;
      62          12 :         attr.root_dir = NULL;
      63          12 :         attr.object_name = NULL;
      64          12 :         attr.attributes = 0;
      65          12 :         attr.sec_desc = NULL;
      66          12 :         attr.sec_qos = &qos;
      67             : 
      68          12 :         r.in.system_name = &system_name;
      69          12 :         r.in.attr = &attr;
      70          12 :         r.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
      71          12 :         r.out.handle = &handle;
      72             : 
      73          12 :         torture_assert_ntstatus_ok(torture, dcerpc_lsa_OpenPolicy_r(b1, mem_ctx, &r),
      74             :                 "OpenPolicy failed");
      75          12 :         if (!NT_STATUS_IS_OK(r.out.result)) {
      76           0 :                 torture_comment(torture, "lsa_OpenPolicy not supported - skipping\n");
      77           0 :                 talloc_free(mem_ctx);
      78           0 :                 return true;
      79             :         }
      80             : 
      81          12 :         c.in.handle = &handle;
      82          12 :         c.out.handle = &handle2;
      83             : 
      84          12 :         status = dcerpc_lsa_Close_r(b2, mem_ctx, &c);
      85          12 :         torture_assert_ntstatus_equal(torture, status, NT_STATUS_RPC_SS_CONTEXT_MISMATCH,
      86             :                                       "closing policy handle on p2");
      87             : 
      88          12 :         torture_assert_ntstatus_ok(torture, dcerpc_lsa_Close_r(b1, mem_ctx, &c),
      89             :                 "Close failed");
      90          12 :         torture_assert_ntstatus_ok(torture, c.out.result, "closing policy handle on p1");
      91             : 
      92          12 :         status = dcerpc_lsa_Close_r(b1, mem_ctx, &c);
      93          12 :         torture_assert_ntstatus_equal(torture, status, NT_STATUS_RPC_SS_CONTEXT_MISMATCH,
      94             :                                       "closing policy handle on p1 again");
      95             : 
      96          12 :         talloc_free(mem_ctx);
      97             : 
      98          12 :         return true;
      99             : }
     100             : 
     101          12 : static bool test_handles_lsa_shared(struct torture_context *torture)
     102             : {
     103           3 :         NTSTATUS status;
     104           3 :         struct dcerpc_pipe *p1, *p2, *p3, *p4, *p5;
     105           3 :         struct dcerpc_binding_handle *b1, *b2, *b3, *b4;
     106           3 :         struct policy_handle handle;
     107           3 :         struct policy_handle handle2;
     108           3 :         struct lsa_ObjectAttribute attr;
     109           3 :         struct lsa_QosInfo qos;
     110           3 :         struct lsa_OpenPolicy r;
     111           3 :         struct lsa_Close c;
     112           3 :         struct lsa_QuerySecurity qsec;
     113          12 :         struct sec_desc_buf *sdbuf = NULL;
     114          12 :         uint16_t system_name = '\\';
     115          12 :         TALLOC_CTX *mem_ctx = talloc_new(torture);
     116           3 :         enum dcerpc_transport_t transport;
     117           3 :         uint32_t assoc_group_id;
     118             : 
     119          12 :         torture_comment(torture, "RPC-HANDLE-LSARPC-SHARED\n");
     120             : 
     121          12 :         torture_comment(torture, "connect lsa pipe1\n");
     122          12 :         status = torture_rpc_connection(torture, &p1, &ndr_table_lsarpc);
     123          12 :         torture_assert_ntstatus_ok(torture, status, "opening lsa pipe1");
     124          12 :         b1 = p1->binding_handle;
     125             : 
     126          12 :         transport       = p1->conn->transport.transport;
     127          12 :         assoc_group_id  = dcerpc_binding_get_assoc_group_id(p1->binding);
     128             : 
     129          12 :         torture_comment(torture, "use assoc_group_id[0x%08X] for new connections\n", assoc_group_id);
     130             : 
     131          12 :         torture_comment(torture, "connect lsa pipe2\n");
     132          12 :         status = torture_rpc_connection_transport(torture, &p2, &ndr_table_lsarpc,
     133             :                                                   transport,
     134             :                                                   assoc_group_id,
     135             :                                                   0);
     136          12 :         torture_assert_ntstatus_ok(torture, status, "opening lsa pipe2");
     137          12 :         b2 = p2->binding_handle;
     138             : 
     139          12 :         torture_comment(torture, "got assoc_group_id[0x%08X] for p2\n", 
     140           9 :                         dcerpc_binding_get_assoc_group_id(p2->binding));
     141             : 
     142          12 :         qos.len = 0;
     143          12 :         qos.impersonation_level = 2;
     144          12 :         qos.context_mode = 1;
     145          12 :         qos.effective_only = 0;
     146             : 
     147          12 :         attr.len = 0;
     148          12 :         attr.root_dir = NULL;
     149          12 :         attr.object_name = NULL;
     150          12 :         attr.attributes = 0;
     151          12 :         attr.sec_desc = NULL;
     152          12 :         attr.sec_qos = &qos;
     153             : 
     154          12 :         r.in.system_name = &system_name;
     155          12 :         r.in.attr = &attr;
     156          12 :         r.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
     157          12 :         r.out.handle = &handle;
     158             : 
     159          12 :         torture_comment(torture, "open lsa policy handle\n");
     160          12 :         torture_assert_ntstatus_ok(torture, dcerpc_lsa_OpenPolicy_r(b1, mem_ctx, &r),
     161             :                 "OpenPolicy failed");
     162          12 :         if (!NT_STATUS_IS_OK(r.out.result)) {
     163           0 :                 torture_comment(torture, "lsa_OpenPolicy not supported - skipping\n");
     164           0 :                 talloc_free(mem_ctx);
     165           0 :                 return true;
     166             :         }
     167             : 
     168             :         /*
     169             :          * connect p3 after the policy handle is opened
     170             :          */
     171          12 :         torture_comment(torture, "connect lsa pipe3 after the policy handle is opened\n");
     172          12 :         status = torture_rpc_connection_transport(torture, &p3, &ndr_table_lsarpc,
     173             :                                                   transport,
     174             :                                                   assoc_group_id,
     175             :                                                   0);
     176          12 :         torture_assert_ntstatus_ok(torture, status, "opening lsa pipe3");
     177          12 :         b3 = p3->binding_handle;
     178             : 
     179          12 :         qsec.in.handle          = &handle;
     180          12 :         qsec.in.sec_info        = 0;
     181          12 :         qsec.out.sdbuf          = &sdbuf;
     182          12 :         c.in.handle = &handle;
     183          12 :         c.out.handle = &handle2;
     184             : 
     185             :         /*
     186             :          * use policy handle on all 3 connections
     187             :          */
     188          12 :         torture_comment(torture, "use the policy handle on p1,p2,p3\n");
     189          12 :         torture_assert_ntstatus_ok(torture, dcerpc_lsa_QuerySecurity_r(b1, mem_ctx, &qsec),
     190             :                 "QuerySecurity failed");
     191          12 :         torture_assert_ntstatus_equal(torture, qsec.out.result, NT_STATUS_OK,
     192             :                                       "use policy handle on p1");
     193             : 
     194          12 :         torture_assert_ntstatus_ok(torture, dcerpc_lsa_QuerySecurity_r(b2, mem_ctx, &qsec),
     195             :                 "QuerySecurity failed");
     196          12 :         torture_assert_ntstatus_equal(torture, qsec.out.result, NT_STATUS_OK,
     197             :                                       "use policy handle on p2");
     198             : 
     199          12 :         torture_assert_ntstatus_ok(torture, dcerpc_lsa_QuerySecurity_r(b3, mem_ctx, &qsec),
     200             :                 "QuerySecurity failed");
     201          12 :         torture_assert_ntstatus_equal(torture, qsec.out.result, NT_STATUS_OK,
     202             :                                       "use policy handle on p3");
     203             : 
     204             :         /*
     205             :          * close policy handle on connection 2 and the others get a fault
     206             :          */
     207          12 :         torture_comment(torture, "close the policy handle on p2 others get a fault\n");
     208          12 :         torture_assert_ntstatus_ok(torture, dcerpc_lsa_Close_r(b2, mem_ctx, &c),
     209             :                 "Close failed");
     210          12 :         torture_assert_ntstatus_equal(torture, c.out.result, NT_STATUS_OK,
     211             :                                       "closing policy handle on p2");
     212             : 
     213          12 :         status = dcerpc_lsa_Close_r(b1, mem_ctx, &c);
     214             : 
     215          12 :         torture_assert_ntstatus_equal(torture, status, NT_STATUS_RPC_SS_CONTEXT_MISMATCH,
     216             :                                       "closing policy handle on p1 again");
     217             : 
     218          12 :         status = dcerpc_lsa_Close_r(b3, mem_ctx, &c);
     219          12 :         torture_assert_ntstatus_equal(torture, status, NT_STATUS_RPC_SS_CONTEXT_MISMATCH,
     220             :                                       "closing policy handle on p3");
     221             : 
     222          12 :         status = dcerpc_lsa_Close_r(b2, mem_ctx, &c);
     223          12 :         torture_assert_ntstatus_equal(torture, status, NT_STATUS_RPC_SS_CONTEXT_MISMATCH,
     224             :                                       "closing policy handle on p2 again");
     225             : 
     226             :         /*
     227             :          * open a new policy handle on p3
     228             :          */
     229          12 :         torture_comment(torture, "open a new policy handle on p3\n");
     230          12 :         torture_assert_ntstatus_ok(torture, dcerpc_lsa_OpenPolicy_r(b3, mem_ctx, &r),
     231             :                 "OpenPolicy failed");
     232          12 :         torture_assert_ntstatus_equal(torture, r.out.result, NT_STATUS_OK,
     233             :                                       "open policy handle on p3");
     234             : 
     235             :         /*
     236             :          * use policy handle on all 3 connections
     237             :          */
     238          12 :         torture_comment(torture, "use the policy handle on p1,p2,p3\n");
     239          12 :         torture_assert_ntstatus_ok(torture, dcerpc_lsa_QuerySecurity_r(b1, mem_ctx, &qsec),
     240             :                 "Query Security failed");
     241          12 :         torture_assert_ntstatus_equal(torture, status, NT_STATUS_OK, 
     242             :                                       "use policy handle on p1");
     243             : 
     244           0 :         torture_assert_ntstatus_ok(torture, dcerpc_lsa_QuerySecurity_r(b2, mem_ctx, &qsec),
     245             :                 "Query Security failed");
     246           0 :         torture_assert_ntstatus_equal(torture, status, NT_STATUS_OK, 
     247             :                                       "use policy handle on p2");
     248             : 
     249           0 :         torture_assert_ntstatus_ok(torture, dcerpc_lsa_QuerySecurity_r(b3, mem_ctx, &qsec),
     250             :                 "Query Security failed");
     251           0 :         torture_assert_ntstatus_equal(torture, status, NT_STATUS_OK, 
     252             :                                       "use policy handle on p3");
     253             : 
     254             :         /*
     255             :          * close policy handle on connection 2 and the others get a fault
     256             :          */
     257           0 :         torture_comment(torture, "close the policy handle on p2 others get a fault\n");
     258           0 :         torture_assert_ntstatus_ok(torture, dcerpc_lsa_Close_r(b2, mem_ctx, &c),
     259             :                 "Close failed");
     260           0 :         torture_assert_ntstatus_equal(torture, c.out.result, NT_STATUS_OK,
     261             :                                       "closing policy handle on p2");
     262             : 
     263           0 :         status = dcerpc_lsa_Close_r(b1, mem_ctx, &c);
     264           0 :         torture_assert_ntstatus_equal(torture, status, NT_STATUS_RPC_SS_CONTEXT_MISMATCH,
     265             :                                       "closing policy handle on p1 again");
     266             : 
     267           0 :         status = dcerpc_lsa_Close_r(b3, mem_ctx, &c);
     268           0 :         torture_assert_ntstatus_equal(torture, status, NT_STATUS_RPC_SS_CONTEXT_MISMATCH,
     269             :                                       "closing policy handle on p3");
     270             : 
     271           0 :         status = dcerpc_lsa_Close_r(b2, mem_ctx, &c);
     272           0 :         torture_assert_ntstatus_equal(torture, status, NT_STATUS_RPC_SS_CONTEXT_MISMATCH,
     273             :                                       "closing policy handle on p2 again");
     274             : 
     275             :         /*
     276             :          * open a new policy handle
     277             :          */
     278           0 :         torture_comment(torture, "open a new policy handle on p1 and use it\n");
     279           0 :         torture_assert_ntstatus_ok(torture, dcerpc_lsa_OpenPolicy_r(b1, mem_ctx, &r),
     280             :                 "OpenPolicy failed");
     281           0 :         torture_assert_ntstatus_equal(torture, r.out.result, NT_STATUS_OK,
     282             :                                       "open 2nd policy handle on p1");
     283             : 
     284           0 :         torture_assert_ntstatus_ok(torture, dcerpc_lsa_QuerySecurity_r(b1, mem_ctx, &qsec),
     285             :                 "QuerySecurity failed");
     286           0 :         torture_assert_ntstatus_equal(torture, qsec.out.result, NT_STATUS_OK,
     287             :                                       "QuerySecurity handle on p1");
     288             : 
     289             :         /* close first connection */
     290           0 :         torture_comment(torture, "disconnect p1\n");
     291           0 :         talloc_free(p1);
     292           0 :         smb_msleep(5);
     293             : 
     294             :         /*
     295             :          * and it's still available on p2,p3
     296             :          */
     297           0 :         torture_comment(torture, "use policy handle on p2,p3\n");
     298           0 :         torture_assert_ntstatus_ok(torture, dcerpc_lsa_QuerySecurity_r(b2, mem_ctx, &qsec),
     299             :                 "QuerySecurity failed");
     300           0 :         torture_assert_ntstatus_equal(torture, qsec.out.result, NT_STATUS_OK,
     301             :                                       "QuerySecurity handle on p2 after p1 was disconnected");
     302             : 
     303           0 :         torture_assert_ntstatus_ok(torture, dcerpc_lsa_QuerySecurity_r(b3, mem_ctx, &qsec),
     304             :                 "QuerySecurity failed");
     305           0 :         torture_assert_ntstatus_equal(torture, qsec.out.result, NT_STATUS_OK,
     306             :                                       "QuerySecurity handle on p3 after p1 was disconnected");
     307             : 
     308             :         /*
     309             :          * now open p4
     310             :          * and use the handle on it
     311             :          */
     312           0 :         torture_comment(torture, "connect lsa pipe4 and use policy handle\n");
     313           0 :         status = torture_rpc_connection_transport(torture, &p4, &ndr_table_lsarpc,
     314             :                                                   transport,
     315             :                                                   assoc_group_id,
     316             :                                                   0);
     317           0 :         torture_assert_ntstatus_ok(torture, status, "opening lsa pipe4");
     318           0 :         b4 = p4->binding_handle;
     319             : 
     320           0 :         torture_assert_ntstatus_ok(torture, dcerpc_lsa_QuerySecurity_r(b4, mem_ctx, &qsec),
     321             :                 "QuerySecurity failed");
     322           0 :         torture_assert_ntstatus_equal(torture, qsec.out.result, NT_STATUS_OK,
     323             :                                       "using policy handle on p4");
     324             : 
     325             :         /*
     326             :          * now close p2,p3,p4
     327             :          * without closing the policy handle
     328             :          */
     329           0 :         torture_comment(torture, "disconnect p2,p3,p4\n");
     330           0 :         talloc_free(p2);
     331           0 :         talloc_free(p3);
     332           0 :         talloc_free(p4);
     333           0 :         smb_msleep(10);
     334             : 
     335             :         /*
     336             :          * now open p5
     337             :          */
     338           0 :         torture_comment(torture, "connect lsa pipe5 - should fail\n");
     339           0 :         status = torture_rpc_connection_transport(torture, &p5, &ndr_table_lsarpc,
     340             :                                                   transport,
     341             :                                                   assoc_group_id,
     342             :                                                   0);
     343           0 :         torture_assert_ntstatus_equal(torture, status, NT_STATUS_UNSUCCESSFUL,
     344             :                                       "opening lsa pipe5");
     345             : 
     346           0 :         talloc_free(mem_ctx);
     347             : 
     348           0 :         return true;
     349             : }
     350             : 
     351             : 
     352          12 : static bool test_handles_samr(struct torture_context *torture)
     353             : {
     354           3 :         NTSTATUS status;
     355           3 :         struct dcerpc_pipe *p1, *p2;
     356           3 :         struct dcerpc_binding_handle *b1, *b2;
     357           3 :         struct policy_handle handle;
     358           3 :         struct policy_handle handle2;
     359           3 :         struct samr_Connect r;
     360           3 :         struct samr_Close c;
     361          12 :         TALLOC_CTX *mem_ctx = talloc_new(torture);
     362             : 
     363          12 :         torture_comment(torture, "RPC-HANDLE-SAMR\n");
     364             : 
     365          12 :         status = torture_rpc_connection(torture, &p1, &ndr_table_samr);
     366          12 :         torture_assert_ntstatus_ok(torture, status, "opening samr pipe1");
     367          12 :         b1 = p1->binding_handle;
     368             : 
     369          12 :         status = torture_rpc_connection(torture, &p2, &ndr_table_samr);
     370          12 :         torture_assert_ntstatus_ok(torture, status, "opening samr pipe2");
     371          12 :         b2 = p2->binding_handle;
     372             : 
     373          12 :         r.in.system_name = 0;
     374          12 :         r.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
     375          12 :         r.out.connect_handle = &handle;
     376             : 
     377          12 :         torture_assert_ntstatus_ok(torture, dcerpc_samr_Connect_r(b1, mem_ctx, &r),
     378             :                 "Connect failed");
     379          12 :         torture_assert_ntstatus_ok(torture, r.out.result, "opening policy handle on p1");
     380             : 
     381          12 :         c.in.handle = &handle;
     382          12 :         c.out.handle = &handle2;
     383             : 
     384          12 :         status = dcerpc_samr_Close_r(b2, mem_ctx, &c);
     385          12 :         torture_assert_ntstatus_equal(torture, status, NT_STATUS_RPC_SS_CONTEXT_MISMATCH,
     386             :                                       "closing policy handle on p2");
     387             : 
     388          12 :         torture_assert_ntstatus_ok(torture, dcerpc_samr_Close_r(b1, mem_ctx, &c),
     389             :                 "Close failed");
     390          12 :         torture_assert_ntstatus_ok(torture, c.out.result, "closing policy handle on p1");
     391             : 
     392          12 :         status = dcerpc_samr_Close_r(b1, mem_ctx, &c);
     393          12 :         torture_assert_ntstatus_equal(torture, status, NT_STATUS_RPC_SS_CONTEXT_MISMATCH,
     394             :                                       "closing policy handle on p1 again");
     395             :         
     396          12 :         talloc_free(mem_ctx);
     397             : 
     398          12 :         return true;
     399             : }
     400             : 
     401          12 : static bool test_handles_mixed_shared(struct torture_context *torture)
     402             : {
     403           3 :         NTSTATUS status;
     404           3 :         struct dcerpc_pipe *p1, *p2, *p3, *p4, *p5, *p6;
     405           3 :         struct dcerpc_binding_handle *b1, *b2;
     406           3 :         struct policy_handle handle;
     407           3 :         struct policy_handle handle2;
     408           3 :         struct samr_Connect r;
     409           3 :         struct lsa_Close lc;
     410           3 :         struct samr_Close sc;
     411          12 :         TALLOC_CTX *mem_ctx = talloc_new(torture);
     412           3 :         enum dcerpc_transport_t transport;
     413           3 :         uint32_t assoc_group_id;
     414             : 
     415          12 :         torture_comment(torture, "RPC-HANDLE-MIXED-SHARED\n");
     416             : 
     417          12 :         torture_comment(torture, "connect samr pipe1\n");
     418          12 :         status = torture_rpc_connection(torture, &p1, &ndr_table_samr);
     419          12 :         torture_assert_ntstatus_ok(torture, status, "opening samr pipe1");
     420          12 :         b1 = p1->binding_handle;
     421             : 
     422          12 :         transport       = p1->conn->transport.transport;
     423          12 :         assoc_group_id  = dcerpc_binding_get_assoc_group_id(p1->binding);
     424             : 
     425          12 :         torture_comment(torture, "use assoc_group_id[0x%08X] for new connections\n", assoc_group_id);
     426             : 
     427          12 :         torture_comment(torture, "connect lsa pipe2\n");
     428          12 :         status = torture_rpc_connection_transport(torture, &p2, &ndr_table_lsarpc,
     429             :                                                   transport,
     430             :                                                   assoc_group_id,
     431             :                                                   0);
     432          12 :         torture_assert_ntstatus_ok(torture, status, "opening lsa pipe2");
     433          12 :         b2 = p2->binding_handle;
     434             : 
     435          12 :         torture_comment(torture, "got assoc_group_id[0x%08X] for p2\n", 
     436           9 :                         dcerpc_binding_get_assoc_group_id(p2->binding));
     437          12 :         r.in.system_name = 0;
     438          12 :         r.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
     439          12 :         r.out.connect_handle = &handle;
     440             : 
     441          12 :         torture_comment(torture, "samr_Connect to open a policy handle on samr p1\n");
     442          12 :         torture_assert_ntstatus_ok(torture, dcerpc_samr_Connect_r(b1, mem_ctx, &r),
     443             :                 "Connect failed");
     444          12 :         torture_assert_ntstatus_ok(torture, r.out.result, "opening policy handle on p1");
     445             : 
     446          12 :         lc.in.handle            = &handle;
     447          12 :         lc.out.handle           = &handle2;
     448          12 :         sc.in.handle            = &handle;
     449          12 :         sc.out.handle           = &handle2;
     450             : 
     451          12 :         torture_comment(torture, "use policy handle on lsa p2 - should fail\n");
     452          12 :         status = dcerpc_lsa_Close_r(b2, mem_ctx, &lc);
     453          12 :         torture_assert_ntstatus_equal(torture, status, NT_STATUS_RPC_SS_CONTEXT_MISMATCH,
     454             :                                       "closing handle on lsa p2");
     455             : 
     456          12 :         torture_comment(torture, "closing policy handle on samr p1\n");
     457          12 :         torture_assert_ntstatus_ok(torture, dcerpc_samr_Close_r(b1, mem_ctx, &sc),
     458             :                 "Close failed");
     459          12 :         torture_assert_ntstatus_ok(torture, sc.out.result, "closing policy handle on p1");
     460             : 
     461          12 :         talloc_free(p1);
     462          12 :         talloc_free(p2);
     463          12 :         smb_msleep(10);
     464             : 
     465          12 :         torture_comment(torture, "connect samr pipe3 - should fail\n");
     466          12 :         status = torture_rpc_connection_transport(torture, &p3, &ndr_table_samr,
     467             :                                                   transport,
     468             :                                                   assoc_group_id,
     469             :                                                   0);
     470          12 :         torture_assert_ntstatus_equal(torture, status, NT_STATUS_UNSUCCESSFUL,
     471             :                                       "opening samr pipe3");
     472             : 
     473          12 :         torture_comment(torture, "connect lsa pipe4 - should fail\n");
     474          12 :         status = torture_rpc_connection_transport(torture, &p4, &ndr_table_lsarpc,
     475             :                                                   transport,
     476             :                                                   assoc_group_id,
     477             :                                                   0);
     478          12 :         torture_assert_ntstatus_equal(torture, status, NT_STATUS_UNSUCCESSFUL,
     479             :                                       "opening lsa pipe4");
     480             : 
     481             :         /*
     482             :          * We use ~assoc_group_id instead of p1->assoc_group_id, because
     483             :          * this way we are less likely to use an id which is already in use.
     484             :          */
     485          12 :         assoc_group_id = ~assoc_group_id;
     486          12 :         torture_comment(torture, "connect samr pipe5 with assoc_group_id[0x%08X]- should fail\n", ++assoc_group_id);
     487          12 :         status = torture_rpc_connection_transport(torture, &p5, &ndr_table_samr,
     488             :                                                   transport,
     489             :                                                   assoc_group_id,
     490             :                                                   0);
     491          12 :         torture_assert_ntstatus_equal(torture, status, NT_STATUS_UNSUCCESSFUL,
     492             :                                       "opening samr pipe5");
     493             : 
     494          12 :         torture_comment(torture, "connect lsa pipe6 with assoc_group_id[0x%08X]- should fail\n", ++assoc_group_id);
     495          12 :         status = torture_rpc_connection_transport(torture, &p6, &ndr_table_lsarpc,
     496             :                                                   transport,
     497             :                                                   assoc_group_id,
     498             :                                                   0);
     499          12 :         torture_assert_ntstatus_equal(torture, status, NT_STATUS_UNSUCCESSFUL,
     500             :                                       "opening lsa pipe6");
     501             : 
     502          12 :         talloc_free(mem_ctx);
     503             : 
     504          12 :         return true;
     505             : }
     506             : 
     507          12 : static bool test_handles_random_assoc(struct torture_context *torture)
     508             : {
     509           3 :         NTSTATUS status;
     510           3 :         struct dcerpc_pipe *p1, *p2, *p3;
     511          12 :         TALLOC_CTX *mem_ctx = talloc_new(torture);
     512           3 :         enum dcerpc_transport_t transport;
     513           3 :         uint32_t assoc_group_id;
     514             : 
     515          12 :         torture_comment(torture, "RPC-HANDLE-RANDOM-ASSOC\n");
     516             : 
     517          12 :         torture_comment(torture, "connect samr pipe1\n");
     518          12 :         status = torture_rpc_connection(torture, &p1, &ndr_table_samr);
     519          12 :         torture_assert_ntstatus_ok(torture, status, "opening samr pipe1");
     520             : 
     521          12 :         torture_comment(torture, "pipe1 uses assoc_group_id[0x%08X]\n",
     522          12 :                         dcerpc_binding_get_assoc_group_id(p1->binding));
     523             : 
     524          12 :         transport       = p1->conn->transport.transport;
     525             :         /*
     526             :          * We use ~p1->assoc_group_id instead of p1->assoc_group_id, because
     527             :          * this way we are less likely to use an id which is already in use.
     528             :          *
     529             :          * And make sure it doesn't wrap.
     530             :          */
     531          12 :         assoc_group_id = dcerpc_binding_get_assoc_group_id(p1->binding);
     532          12 :         assoc_group_id = ~MIN(assoc_group_id, UINT32_MAX - 3);
     533             : 
     534          12 :         torture_comment(torture, "connect samr pipe2 with assoc_group_id[0x%08X]- should fail\n", ++assoc_group_id);
     535          12 :         status = torture_rpc_connection_transport(torture, &p2, &ndr_table_samr,
     536             :                                                   transport,
     537             :                                                   assoc_group_id,
     538             :                                                   0);
     539          12 :         torture_assert_ntstatus_equal(torture, status, NT_STATUS_UNSUCCESSFUL,
     540             :                                       "opening samr pipe2");
     541             : 
     542          12 :         torture_comment(torture, "connect samr pipe3 with assoc_group_id[0x%08X]- should fail\n", ++assoc_group_id);
     543          12 :         status = torture_rpc_connection_transport(torture, &p3, &ndr_table_samr,
     544             :                                                   transport,
     545             :                                                   assoc_group_id,
     546             :                                                   0);
     547          12 :         torture_assert_ntstatus_equal(torture, status, NT_STATUS_UNSUCCESSFUL,
     548             :                                       "opening samr pipe3");
     549             : 
     550          12 :         talloc_free(mem_ctx);
     551             : 
     552          12 :         return true;
     553             : }
     554             : 
     555             : 
     556          12 : static bool test_handles_drsuapi(struct torture_context *torture)
     557             : {
     558           3 :         NTSTATUS status;
     559           3 :         struct dcerpc_pipe *p1, *p2;
     560           3 :         struct dcerpc_binding_handle *b1, *b2;
     561           3 :         struct policy_handle handle;
     562           3 :         struct policy_handle handle2;
     563           3 :         struct GUID bind_guid;
     564           3 :         struct drsuapi_DsBind r;
     565           3 :         struct drsuapi_DsUnbind c;
     566          12 :         TALLOC_CTX *mem_ctx = talloc_new(torture);
     567             : 
     568          12 :         torture_comment(torture, "RPC-HANDLE-DRSUAPI\n");
     569             : 
     570          12 :         status = torture_rpc_connection(torture, &p1, &ndr_table_drsuapi);
     571          12 :         torture_assert_ntstatus_ok(torture, status, "opening drsuapi pipe1");
     572          12 :         b1 = p1->binding_handle;
     573             : 
     574          12 :         status = torture_rpc_connection(torture, &p2, &ndr_table_drsuapi);
     575          12 :         torture_assert_ntstatus_ok(torture, status, "opening drsuapi pipe1");
     576          12 :         b2 = p2->binding_handle;
     577             : 
     578          12 :         GUID_from_string(DRSUAPI_DS_BIND_GUID, &bind_guid);
     579             : 
     580          12 :         r.in.bind_guid = &bind_guid;
     581          12 :         r.in.bind_info = NULL;
     582          12 :         r.out.bind_handle = &handle;
     583             : 
     584          12 :         status = dcerpc_drsuapi_DsBind_r(b1, mem_ctx, &r);
     585          12 :         if (!NT_STATUS_IS_OK(status)) {
     586           8 :                 torture_comment(torture, "drsuapi_DsBind not supported - skipping\n");
     587           8 :                 talloc_free(mem_ctx);
     588           8 :                 return true;
     589             :         }
     590             : 
     591           4 :         c.in.bind_handle = &handle;
     592           4 :         c.out.bind_handle = &handle2;
     593             : 
     594           4 :         status = dcerpc_drsuapi_DsUnbind_r(b2, mem_ctx, &c);
     595           4 :         torture_assert_ntstatus_equal(torture, status, NT_STATUS_RPC_SS_CONTEXT_MISMATCH,
     596             :                                       "closing policy handle on p2");
     597             : 
     598           4 :         status = dcerpc_drsuapi_DsUnbind_r(b1, mem_ctx, &c);
     599           4 :         torture_assert_ntstatus_ok(torture, status, "closing policy handle on p1");
     600             : 
     601           4 :         status = dcerpc_drsuapi_DsUnbind_r(b1, mem_ctx, &c);
     602           4 :         torture_assert_ntstatus_equal(torture, status, NT_STATUS_RPC_SS_CONTEXT_MISMATCH,
     603             :                                       "closing policy handle on p1 again");
     604             :         
     605           4 :         talloc_free(mem_ctx);
     606             : 
     607           4 :         return true;
     608             : }
     609             : 
     610        2379 : struct torture_suite *torture_rpc_handles(TALLOC_CTX *mem_ctx)
     611             : {
     612         125 :         struct torture_suite *suite;
     613             : 
     614        2379 :         suite = torture_suite_create(mem_ctx, "handles");
     615        2379 :         torture_suite_add_simple_test(suite, "lsarpc", test_handles_lsa);
     616        2379 :         torture_suite_add_simple_test(suite, "lsarpc-shared", test_handles_lsa_shared);
     617        2379 :         torture_suite_add_simple_test(suite, "samr", test_handles_samr);
     618        2379 :         torture_suite_add_simple_test(suite, "mixed-shared", test_handles_mixed_shared);
     619        2379 :         torture_suite_add_simple_test(suite, "random-assoc", test_handles_random_assoc);
     620        2379 :         torture_suite_add_simple_test(suite, "drsuapi", test_handles_drsuapi);
     621        2379 :         return suite;
     622             : }

Generated by: LCOV version 1.14