source4/torture/rpc/handles.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3
   4    test suite for behaviour of rpc policy handles
   5
   6    Copyright (C) Andrew Tridgell 2007
   7
   8    This program is free software; you can redistribute it and/or modify
   9    it under the terms of the GNU General Public License as published by
  10    the Free Software Foundation; either version 3 of the License, or
  11    (at your option) any later version.
  12
  13    This program is distributed in the hope that it will be useful,
  14    but WITHOUT ANY WARRANTY; without even the implied warranty of
  15    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  16    GNU General Public License for more details.
  17
  18    You should have received a copy of the GNU General Public License
  19    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  20 */
  21
  22 #include "includes.h"
  23 #include "librpc/gen_ndr/ndr_samr_c.h"
  24 #include "librpc/gen_ndr/ndr_lsa_c.h"
  25 #include "librpc/gen_ndr/ndr_drsuapi_c.h"
  26 #include "torture/rpc/torture_rpc.h"
  27
  28 /*
  29   this tests the use of policy handles between connections
  30 */
  31
  32 static bool test_handles_lsa(struct torture_context *torture)
  33 {
  34         NTSTATUS status;
  35         struct dcerpc_pipe *p1, *p2;
  36         struct dcerpc_binding_handle *b1, *b2;
  37         struct policy_handle handle;
  38         struct policy_handle handle2;
  39         struct lsa_ObjectAttribute attr;
  40         struct lsa_QosInfo qos;
  41         struct lsa_OpenPolicy r;
  42         struct lsa_Close c;
  43         uint16_t system_name = '\\';
  44         TALLOC_CTX *mem_ctx = talloc_new(torture);
  45
  46         torture_comment(torture, "RPC-HANDLE-LSARPC\n");
  47
  48         status = torture_rpc_connection(torture, &p1, &ndr_table_lsarpc);
  49         torture_assert_ntstatus_ok(torture, status, "opening lsa pipe1");
  50         b1 = p1->binding_handle;
  51
  52         status = torture_rpc_connection(torture, &p2, &ndr_table_lsarpc);
  53         torture_assert_ntstatus_ok(torture, status, "opening lsa pipe1");
  54         b2 = p2->binding_handle;
  55
  56         qos.len = 0;
  57         qos.impersonation_level = 2;
  58         qos.context_mode = 1;
  59         qos.effective_only = 0;
  60
  61         attr.len = 0;
  62         attr.root_dir = NULL;
  63         attr.object_name = NULL;
  64         attr.attributes = 0;
  65         attr.sec_desc = NULL;
  66         attr.sec_qos = &qos;
  67
  68         r.in.system_name = &system_name;
  69         r.in.attr = &attr;
  70         r.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
  71         r.out.handle = &handle;
  72
  73         torture_assert_ntstatus_ok(torture, dcerpc_lsa_OpenPolicy_r(b1, mem_ctx, &r),
  74                 "OpenPolicy failed");
  75         if (!NT_STATUS_IS_OK(r.out.result)) {
  76                 torture_comment(torture, "lsa_OpenPolicy not supported - skipping\n");
  77                 talloc_free(mem_ctx);
  78                 return true;
  79         }
  80
  81         c.in.handle = &handle;
  82         c.out.handle = &handle2;
  83
  84         status = dcerpc_lsa_Close_r(b2, mem_ctx, &c);
  85         torture_assert_ntstatus_equal(torture, status, NT_STATUS_RPC_SS_CONTEXT_MISMATCH,
  86                                       "closing policy handle on p2");
  87
  88         torture_assert_ntstatus_ok(torture, dcerpc_lsa_Close_r(b1, mem_ctx, &c),
  89                 "Close failed");
  90         torture_assert_ntstatus_ok(torture, c.out.result, "closing policy handle on p1");
  91
  92         status = dcerpc_lsa_Close_r(b1, mem_ctx, &c);
  93         torture_assert_ntstatus_equal(torture, status, NT_STATUS_RPC_SS_CONTEXT_MISMATCH,
  94                                       "closing policy handle on p1 again");
  95
  96         talloc_free(mem_ctx);
  97
  98         return true;
  99 }
 100
 101 static bool test_handles_lsa_shared(struct torture_context *torture)
 102 {
 103         NTSTATUS status;
 104         struct dcerpc_pipe *p1, *p2, *p3, *p4, *p5;
 105         struct dcerpc_binding_handle *b1, *b2, *b3, *b4;
 106         const struct dcerpc_binding *bd1 = NULL, *bd2 = NULL;
 107         struct policy_handle handle;
 108         struct policy_handle handle2;
 109         struct lsa_ObjectAttribute attr;
 110         struct lsa_QosInfo qos;
 111         struct lsa_OpenPolicy r;
 112         struct lsa_Close c;
 113         struct lsa_QuerySecurity qsec;
 114         struct sec_desc_buf *sdbuf = NULL;
 115         uint16_t system_name = '\\';
 116         TALLOC_CTX *mem_ctx = talloc_new(torture);
 117         enum dcerpc_transport_t transport;
 118         uint32_t assoc_group_id;
 119
 120         torture_comment(torture, "RPC-HANDLE-LSARPC-SHARED\n");
 121
 122         torture_comment(torture, "connect lsa pipe1\n");
 123         status = torture_rpc_connection(torture, &p1, &ndr_table_lsarpc);
 124         torture_assert_ntstatus_ok(torture, status, "opening lsa pipe1");
 125         b1 = p1->binding_handle;
 126         bd1 = dcerpc_binding_handle_get_binding(b1);
 127
 128         transport       = dcerpc_binding_get_transport(bd1);
 129         assoc_group_id  = dcerpc_binding_get_assoc_group_id(bd1);
 130
 131         torture_comment(torture, "use assoc_group_id[0x%08X] for new connections\n", assoc_group_id);
 132
 133         torture_comment(torture, "connect lsa pipe2\n");
 134         status = torture_rpc_connection_transport(torture, &p2, &ndr_table_lsarpc,
 135                                                   transport,
 136                                                   assoc_group_id,
 137                                                   0);
 138         torture_assert_ntstatus_ok(torture, status, "opening lsa pipe2");
 139         b2 = p2->binding_handle;
 140         bd2 = dcerpc_binding_handle_get_binding(b2);
 141
 142         torture_comment(torture, "got assoc_group_id[0x%08X] for p2\n",
 143                         dcerpc_binding_get_assoc_group_id(bd2));
 144
 145         qos.len = 0;
 146         qos.impersonation_level = 2;
 147         qos.context_mode = 1;
 148         qos.effective_only = 0;
 149
 150         attr.len = 0;
 151         attr.root_dir = NULL;
 152         attr.object_name = NULL;
 153         attr.attributes = 0;
 154         attr.sec_desc = NULL;
 155         attr.sec_qos = &qos;
 156
 157         r.in.system_name = &system_name;
 158         r.in.attr = &attr;
 159         r.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
 160         r.out.handle = &handle;
 161
 162         torture_comment(torture, "open lsa policy handle\n");
 163         torture_assert_ntstatus_ok(torture, dcerpc_lsa_OpenPolicy_r(b1, mem_ctx, &r),
 164                 "OpenPolicy failed");
 165         if (!NT_STATUS_IS_OK(r.out.result)) {
 166                 torture_comment(torture, "lsa_OpenPolicy not supported - skipping\n");
 167                 talloc_free(mem_ctx);
 168                 return true;
 169         }
 170
 171         /*
 172          * connect p3 after the policy handle is opened
 173          */
 174         torture_comment(torture, "connect lsa pipe3 after the policy handle is opened\n");
 175         status = torture_rpc_connection_transport(torture, &p3, &ndr_table_lsarpc,
 176                                                   transport,
 177                                                   assoc_group_id,
 178                                                   0);
 179         torture_assert_ntstatus_ok(torture, status, "opening lsa pipe3");
 180         b3 = p3->binding_handle;
 181
 182         qsec.in.handle          = &handle;
 183         qsec.in.sec_info        = 0;
 184         qsec.out.sdbuf          = &sdbuf;
 185         c.in.handle = &handle;
 186         c.out.handle = &handle2;
 187
 188         /*
 189          * use policy handle on all 3 connections
 190          */
 191         torture_comment(torture, "use the policy handle on p1,p2,p3\n");
 192         torture_assert_ntstatus_ok(torture, dcerpc_lsa_QuerySecurity_r(b1, mem_ctx, &qsec),
 193                 "QuerySecurity failed");
 194         torture_assert_ntstatus_equal(torture, qsec.out.result, NT_STATUS_OK,
 195                                       "use policy handle on p1");
 196
 197         torture_assert_ntstatus_ok(torture, dcerpc_lsa_QuerySecurity_r(b2, mem_ctx, &qsec),
 198                 "QuerySecurity failed");
 199         torture_assert_ntstatus_equal(torture, qsec.out.result, NT_STATUS_OK,
 200                                       "use policy handle on p2");
 201
 202         torture_assert_ntstatus_ok(torture, dcerpc_lsa_QuerySecurity_r(b3, mem_ctx, &qsec),
 203                 "QuerySecurity failed");
 204         torture_assert_ntstatus_equal(torture, qsec.out.result, NT_STATUS_OK,
 205                                       "use policy handle on p3");
 206
 207         /*
 208          * close policy handle on connection 2 and the others get a fault
 209          */
 210         torture_comment(torture, "close the policy handle on p2 others get a fault\n");
 211         torture_assert_ntstatus_ok(torture, dcerpc_lsa_Close_r(b2, mem_ctx, &c),
 212                 "Close failed");
 213         torture_assert_ntstatus_equal(torture, c.out.result, NT_STATUS_OK,
 214                                       "closing policy handle on p2");
 215
 216         status = dcerpc_lsa_Close_r(b1, mem_ctx, &c);
 217
 218         torture_assert_ntstatus_equal(torture, status, NT_STATUS_RPC_SS_CONTEXT_MISMATCH,
 219                                       "closing policy handle on p1 again");
 220
 221         status = dcerpc_lsa_Close_r(b3, mem_ctx, &c);
 222         torture_assert_ntstatus_equal(torture, status, NT_STATUS_RPC_SS_CONTEXT_MISMATCH,
 223                                       "closing policy handle on p3");
 224
 225         status = dcerpc_lsa_Close_r(b2, mem_ctx, &c);
 226         torture_assert_ntstatus_equal(torture, status, NT_STATUS_RPC_SS_CONTEXT_MISMATCH,
 227                                       "closing policy handle on p2 again");
 228
 229         /*
 230          * open a new policy handle on p3
 231          */
 232         torture_comment(torture, "open a new policy handle on p3\n");
 233         torture_assert_ntstatus_ok(torture, dcerpc_lsa_OpenPolicy_r(b3, mem_ctx, &r),
 234                 "OpenPolicy failed");
 235         torture_assert_ntstatus_equal(torture, r.out.result, NT_STATUS_OK,
 236                                       "open policy handle on p3");
 237
 238         /*
 239          * use policy handle on all 3 connections
 240          */
 241         torture_comment(torture, "use the policy handle on p1,p2,p3\n");
 242         torture_assert_ntstatus_ok(torture, dcerpc_lsa_QuerySecurity_r(b1, mem_ctx, &qsec),
 243                 "Query Security failed");
 244         torture_assert_ntstatus_equal(torture, status, NT_STATUS_OK,
 245                                       "use policy handle on p1");
 246
 247         torture_assert_ntstatus_ok(torture, dcerpc_lsa_QuerySecurity_r(b2, mem_ctx, &qsec),
 248                 "Query Security failed");
 249         torture_assert_ntstatus_equal(torture, status, NT_STATUS_OK,
 250                                       "use policy handle on p2");
 251
 252         torture_assert_ntstatus_ok(torture, dcerpc_lsa_QuerySecurity_r(b3, mem_ctx, &qsec),
 253                 "Query Security failed");
 254         torture_assert_ntstatus_equal(torture, status, NT_STATUS_OK,
 255                                       "use policy handle on p3");
 256
 257         /*
 258          * close policy handle on connection 2 and the others get a fault
 259          */
 260         torture_comment(torture, "close the policy handle on p2 others get a fault\n");
 261         torture_assert_ntstatus_ok(torture, dcerpc_lsa_Close_r(b2, mem_ctx, &c),
 262                 "Close failed");
 263         torture_assert_ntstatus_equal(torture, c.out.result, NT_STATUS_OK,
 264                                       "closing policy handle on p2");
 265
 266         status = dcerpc_lsa_Close_r(b1, mem_ctx, &c);
 267         torture_assert_ntstatus_equal(torture, status, NT_STATUS_RPC_SS_CONTEXT_MISMATCH,
 268                                       "closing policy handle on p1 again");
 269
 270         status = dcerpc_lsa_Close_r(b3, mem_ctx, &c);
 271         torture_assert_ntstatus_equal(torture, status, NT_STATUS_RPC_SS_CONTEXT_MISMATCH,
 272                                       "closing policy handle on p3");
 273
 274         status = dcerpc_lsa_Close_r(b2, mem_ctx, &c);
 275         torture_assert_ntstatus_equal(torture, status, NT_STATUS_RPC_SS_CONTEXT_MISMATCH,
 276                                       "closing policy handle on p2 again");
 277
 278         /*
 279          * open a new policy handle
 280          */
 281         torture_comment(torture, "open a new policy handle on p1 and use it\n");
 282         torture_assert_ntstatus_ok(torture, dcerpc_lsa_OpenPolicy_r(b1, mem_ctx, &r),
 283                 "OpenPolicy failed");
 284         torture_assert_ntstatus_equal(torture, r.out.result, NT_STATUS_OK,
 285                                       "open 2nd policy handle on p1");
 286
 287         torture_assert_ntstatus_ok(torture, dcerpc_lsa_QuerySecurity_r(b1, mem_ctx, &qsec),
 288                 "QuerySecurity failed");
 289         torture_assert_ntstatus_equal(torture, qsec.out.result, NT_STATUS_OK,
 290                                       "QuerySecurity handle on p1");
 291
 292         /* close first connection */
 293         torture_comment(torture, "disconnect p1\n");
 294         talloc_free(p1);
 295         smb_msleep(5);
 296
 297         /*
 298          * and it's still available on p2,p3
 299          */
 300         torture_comment(torture, "use policy handle on p2,p3\n");
 301         torture_assert_ntstatus_ok(torture, dcerpc_lsa_QuerySecurity_r(b2, mem_ctx, &qsec),
 302                 "QuerySecurity failed");
 303         torture_assert_ntstatus_equal(torture, qsec.out.result, NT_STATUS_OK,
 304                                       "QuerySecurity handle on p2 after p1 was disconnected");
 305
 306         torture_assert_ntstatus_ok(torture, dcerpc_lsa_QuerySecurity_r(b3, mem_ctx, &qsec),
 307                 "QuerySecurity failed");
 308         torture_assert_ntstatus_equal(torture, qsec.out.result, NT_STATUS_OK,
 309                                       "QuerySecurity handle on p3 after p1 was disconnected");
 310
 311         /*
 312          * now open p4
 313          * and use the handle on it
 314          */
 315         torture_comment(torture, "connect lsa pipe4 and use policy handle\n");
 316         status = torture_rpc_connection_transport(torture, &p4, &ndr_table_lsarpc,
 317                                                   transport,
 318                                                   assoc_group_id,
 319                                                   0);
 320         torture_assert_ntstatus_ok(torture, status, "opening lsa pipe4");
 321         b4 = p4->binding_handle;
 322
 323         torture_assert_ntstatus_ok(torture, dcerpc_lsa_QuerySecurity_r(b4, mem_ctx, &qsec),
 324                 "QuerySecurity failed");
 325         torture_assert_ntstatus_equal(torture, qsec.out.result, NT_STATUS_OK,
 326                                       "using policy handle on p4");
 327
 328         /*
 329          * now close p2,p3,p4
 330          * without closing the policy handle
 331          */
 332         torture_comment(torture, "disconnect p2,p3,p4\n");
 333         talloc_free(p2);
 334         talloc_free(p3);
 335         talloc_free(p4);
 336         smb_msleep(10);
 337
 338         /*
 339          * now open p5
 340          */
 341         torture_comment(torture, "connect lsa pipe5 - should fail\n");
 342         status = torture_rpc_connection_transport(torture, &p5, &ndr_table_lsarpc,
 343                                                   transport,
 344                                                   assoc_group_id,
 345                                                   0);
 346         torture_assert_ntstatus_equal(torture, status, NT_STATUS_UNSUCCESSFUL,
 347                                       "opening lsa pipe5");
 348
 349         talloc_free(mem_ctx);
 350
 351         return true;
 352 }
 353
 354
 355 static bool test_handles_samr(struct torture_context *torture)
 356 {
 357         NTSTATUS status;
 358         struct dcerpc_pipe *p1, *p2;
 359         struct dcerpc_binding_handle *b1, *b2;
 360         struct policy_handle handle;
 361         struct policy_handle handle2;
 362         struct samr_Connect r;
 363         struct samr_Close c;
 364         TALLOC_CTX *mem_ctx = talloc_new(torture);
 365
 366         torture_comment(torture, "RPC-HANDLE-SAMR\n");
 367
 368         status = torture_rpc_connection(torture, &p1, &ndr_table_samr);
 369         torture_assert_ntstatus_ok(torture, status, "opening samr pipe1");
 370         b1 = p1->binding_handle;
 371
 372         status = torture_rpc_connection(torture, &p2, &ndr_table_samr);
 373         torture_assert_ntstatus_ok(torture, status, "opening samr pipe2");
 374         b2 = p2->binding_handle;
 375
 376         r.in.system_name = 0;
 377         r.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
 378         r.out.connect_handle = &handle;
 379
 380         torture_assert_ntstatus_ok(torture, dcerpc_samr_Connect_r(b1, mem_ctx, &r),
 381                 "Connect failed");
 382         torture_assert_ntstatus_ok(torture, r.out.result, "opening policy handle on p1");
 383
 384         c.in.handle = &handle;
 385         c.out.handle = &handle2;
 386
 387         status = dcerpc_samr_Close_r(b2, mem_ctx, &c);
 388         torture_assert_ntstatus_equal(torture, status, NT_STATUS_RPC_SS_CONTEXT_MISMATCH,
 389                                       "closing policy handle on p2");
 390
 391         torture_assert_ntstatus_ok(torture, dcerpc_samr_Close_r(b1, mem_ctx, &c),
 392                 "Close failed");
 393         torture_assert_ntstatus_ok(torture, c.out.result, "closing policy handle on p1");
 394
 395         status = dcerpc_samr_Close_r(b1, mem_ctx, &c);
 396         torture_assert_ntstatus_equal(torture, status, NT_STATUS_RPC_SS_CONTEXT_MISMATCH,
 397                                       "closing policy handle on p1 again");
 398
 399         talloc_free(mem_ctx);
 400
 401         return true;
 402 }
 403
 404 static bool test_handles_mixed_shared(struct torture_context *torture)
 405 {
 406         NTSTATUS status;
 407         struct dcerpc_pipe *p1, *p2, *p3, *p4, *p5, *p6;
 408         struct dcerpc_binding_handle *b1, *b2;
 409         const struct dcerpc_binding *bd1 = NULL, *bd2 = NULL;
 410         struct policy_handle handle;
 411         struct policy_handle handle2;
 412         struct samr_Connect r;
 413         struct lsa_Close lc;
 414         struct samr_Close sc;
 415         TALLOC_CTX *mem_ctx = talloc_new(torture);
 416         enum dcerpc_transport_t transport;
 417         uint32_t assoc_group_id;
 418
 419         torture_comment(torture, "RPC-HANDLE-MIXED-SHARED\n");
 420
 421         torture_comment(torture, "connect samr pipe1\n");
 422         status = torture_rpc_connection(torture, &p1, &ndr_table_samr);
 423         torture_assert_ntstatus_ok(torture, status, "opening samr pipe1");
 424         b1 = p1->binding_handle;
 425         bd1 = dcerpc_binding_handle_get_binding(b1);
 426
 427         transport       = dcerpc_binding_get_transport(bd1);
 428         assoc_group_id  = dcerpc_binding_get_assoc_group_id(bd1);
 429
 430         torture_comment(torture, "use assoc_group_id[0x%08X] for new connections\n", assoc_group_id);
 431
 432         torture_comment(torture, "connect lsa pipe2\n");
 433         status = torture_rpc_connection_transport(torture, &p2, &ndr_table_lsarpc,
 434                                                   transport,
 435                                                   assoc_group_id,
 436                                                   0);
 437         torture_assert_ntstatus_ok(torture, status, "opening lsa pipe2");
 438         b2 = p2->binding_handle;
 439         bd2 = dcerpc_binding_handle_get_binding(b2);
 440
 441         torture_comment(torture, "got assoc_group_id[0x%08X] for p2\n",
 442                         dcerpc_binding_get_assoc_group_id(bd2));
 443         r.in.system_name = 0;
 444         r.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
 445         r.out.connect_handle = &handle;
 446
 447         torture_comment(torture, "samr_Connect to open a policy handle on samr p1\n");
 448         torture_assert_ntstatus_ok(torture, dcerpc_samr_Connect_r(b1, mem_ctx, &r),
 449                 "Connect failed");
 450         torture_assert_ntstatus_ok(torture, r.out.result, "opening policy handle on p1");
 451
 452         lc.in.handle            = &handle;
 453         lc.out.handle           = &handle2;
 454         sc.in.handle            = &handle;
 455         sc.out.handle           = &handle2;
 456
 457         torture_comment(torture, "use policy handle on lsa p2 - should fail\n");
 458         status = dcerpc_lsa_Close_r(b2, mem_ctx, &lc);
 459         torture_assert_ntstatus_equal(torture, status, NT_STATUS_RPC_SS_CONTEXT_MISMATCH,
 460                                       "closing handle on lsa p2");
 461
 462         torture_comment(torture, "closing policy handle on samr p1\n");
 463         torture_assert_ntstatus_ok(torture, dcerpc_samr_Close_r(b1, mem_ctx, &sc),
 464                 "Close failed");
 465         torture_assert_ntstatus_ok(torture, sc.out.result, "closing policy handle on p1");
 466
 467         talloc_free(p1);
 468         talloc_free(p2);
 469         smb_msleep(10);
 470
 471         torture_comment(torture, "connect samr pipe3 - should fail\n");
 472         status = torture_rpc_connection_transport(torture, &p3, &ndr_table_samr,
 473                                                   transport,
 474                                                   assoc_group_id,
 475                                                   0);
 476         torture_assert_ntstatus_equal(torture, status, NT_STATUS_UNSUCCESSFUL,
 477                                       "opening samr pipe3");
 478
 479         torture_comment(torture, "connect lsa pipe4 - should fail\n");
 480         status = torture_rpc_connection_transport(torture, &p4, &ndr_table_lsarpc,
 481                                                   transport,
 482                                                   assoc_group_id,
 483                                                   0);
 484         torture_assert_ntstatus_equal(torture, status, NT_STATUS_UNSUCCESSFUL,
 485                                       "opening lsa pipe4");
 486
 487         /*
 488          * We use ~assoc_group_id instead of p1->assoc_group_id, because
 489          * this way we are less likely to use an id which is already in use.
 490          */
 491         assoc_group_id = ~assoc_group_id;
 492         torture_comment(torture, "connect samr pipe5 with assoc_group_id[0x%08X]- should fail\n", ++assoc_group_id);
 493         status = torture_rpc_connection_transport(torture, &p5, &ndr_table_samr,
 494                                                   transport,
 495                                                   assoc_group_id,
 496                                                   0);
 497         torture_assert_ntstatus_equal(torture, status, NT_STATUS_UNSUCCESSFUL,
 498                                       "opening samr pipe5");
 499
 500         torture_comment(torture, "connect lsa pipe6 with assoc_group_id[0x%08X]- should fail\n", ++assoc_group_id);
 501         status = torture_rpc_connection_transport(torture, &p6, &ndr_table_lsarpc,
 502                                                   transport,
 503                                                   assoc_group_id,
 504                                                   0);
 505         torture_assert_ntstatus_equal(torture, status, NT_STATUS_UNSUCCESSFUL,
 506                                       "opening lsa pipe6");
 507
 508         talloc_free(mem_ctx);
 509
 510         return true;
 511 }
 512
 513 static bool test_handles_random_assoc(struct torture_context *torture)
 514 {
 515         NTSTATUS status;
 516         struct dcerpc_pipe *p1, *p2, *p3;
 517         TALLOC_CTX *mem_ctx = talloc_new(torture);
 518         const struct dcerpc_binding *bd1 = NULL;
 519         enum dcerpc_transport_t transport;
 520         uint32_t assoc_group_id;
 521
 522         torture_comment(torture, "RPC-HANDLE-RANDOM-ASSOC\n");
 523
 524         torture_comment(torture, "connect samr pipe1\n");
 525         status = torture_rpc_connection(torture, &p1, &ndr_table_samr);
 526         torture_assert_ntstatus_ok(torture, status, "opening samr pipe1");
 527
 528         bd1 = dcerpc_binding_handle_get_binding(p1->binding_handle);
 529         assoc_group_id = dcerpc_binding_get_assoc_group_id(bd1);
 530
 531         torture_comment(torture, "pipe1 uses assoc_group_id[0x%08X]\n",
 532                         assoc_group_id);
 533
 534         transport       = dcerpc_binding_get_transport(bd1);
 535
 536         /*
 537          * We use ~p1->assoc_group_id instead of p1->assoc_group_id, because
 538          * this way we are less likely to use an id which is already in use.
 539          *
 540          * And make sure it doesn't wrap.
 541          */
 542         assoc_group_id = ~MIN(assoc_group_id, UINT32_MAX - 3);
 543
 544         torture_comment(torture, "connect samr pipe2 with assoc_group_id[0x%08X]- should fail\n", ++assoc_group_id);
 545         status = torture_rpc_connection_transport(torture, &p2, &ndr_table_samr,
 546                                                   transport,
 547                                                   assoc_group_id,
 548                                                   0);
 549         torture_assert_ntstatus_equal(torture, status, NT_STATUS_UNSUCCESSFUL,
 550                                       "opening samr pipe2");
 551
 552         torture_comment(torture, "connect samr pipe3 with assoc_group_id[0x%08X]- should fail\n", ++assoc_group_id);
 553         status = torture_rpc_connection_transport(torture, &p3, &ndr_table_samr,
 554                                                   transport,
 555                                                   assoc_group_id,
 556                                                   0);
 557         torture_assert_ntstatus_equal(torture, status, NT_STATUS_UNSUCCESSFUL,
 558                                       "opening samr pipe3");
 559
 560         talloc_free(mem_ctx);
 561
 562         return true;
 563 }
 564
 565
 566 static bool test_handles_drsuapi(struct torture_context *torture)
 567 {
 568         NTSTATUS status;
 569         struct dcerpc_pipe *p1, *p2;
 570         struct dcerpc_binding_handle *b1, *b2;
 571         struct policy_handle handle;
 572         struct policy_handle handle2;
 573         struct GUID bind_guid;
 574         struct drsuapi_DsBind r;
 575         struct drsuapi_DsUnbind c;
 576         TALLOC_CTX *mem_ctx = talloc_new(torture);
 577
 578         torture_comment(torture, "RPC-HANDLE-DRSUAPI\n");
 579
 580         status = torture_rpc_connection(torture, &p1, &ndr_table_drsuapi);
 581         torture_assert_ntstatus_ok(torture, status, "opening drsuapi pipe1");
 582         b1 = p1->binding_handle;
 583
 584         status = torture_rpc_connection(torture, &p2, &ndr_table_drsuapi);
 585         torture_assert_ntstatus_ok(torture, status, "opening drsuapi pipe1");
 586         b2 = p2->binding_handle;
 587
 588         GUID_from_string(DRSUAPI_DS_BIND_GUID, &bind_guid);
 589
 590         r.in.bind_guid = &bind_guid;
 591         r.in.bind_info = NULL;
 592         r.out.bind_handle = &handle;
 593
 594         status = dcerpc_drsuapi_DsBind_r(b1, mem_ctx, &r);
 595         if (!NT_STATUS_IS_OK(status)) {
 596                 torture_comment(torture, "drsuapi_DsBind not supported - skipping\n");
 597                 talloc_free(mem_ctx);
 598                 return true;
 599         }
 600
 601         c.in.bind_handle = &handle;
 602         c.out.bind_handle = &handle2;
 603
 604         status = dcerpc_drsuapi_DsUnbind_r(b2, mem_ctx, &c);
 605         torture_assert_ntstatus_equal(torture, status, NT_STATUS_RPC_SS_CONTEXT_MISMATCH,
 606                                       "closing policy handle on p2");
 607
 608         status = dcerpc_drsuapi_DsUnbind_r(b1, mem_ctx, &c);
 609         torture_assert_ntstatus_ok(torture, status, "closing policy handle on p1");
 610
 611         status = dcerpc_drsuapi_DsUnbind_r(b1, mem_ctx, &c);
 612         torture_assert_ntstatus_equal(torture, status, NT_STATUS_RPC_SS_CONTEXT_MISMATCH,
 613                                       "closing policy handle on p1 again");
 614
 615         talloc_free(mem_ctx);
 616
 617         return true;
 618 }
 619
 620 struct torture_suite *torture_rpc_handles(TALLOC_CTX *mem_ctx)
 621 {
 622         struct torture_suite *suite;
 623
 624         suite = torture_suite_create(mem_ctx, "handles");
 625         torture_suite_add_simple_test(suite, "lsarpc", test_handles_lsa);
 626         torture_suite_add_simple_test(suite, "lsarpc-shared", test_handles_lsa_shared);
 627         torture_suite_add_simple_test(suite, "samr", test_handles_samr);
 628         torture_suite_add_simple_test(suite, "mixed-shared", test_handles_mixed_shared);
 629         torture_suite_add_simple_test(suite, "random-assoc", test_handles_random_assoc);
 630         torture_suite_add_simple_test(suite, "drsuapi", test_handles_drsuapi);
 631         return suite;
 632 }