The branch, master has been updated
via 9de0462 s4:torture: Fix cleanup of the secrets object in
session_key test
via 31d21de s4:torture: Normalizes names in session_key test
via 80f7f56 s4:torture: Strip trailing whitespaces in session_key.c
from 6c26c5e lib: Avoid includes.h in access.c
https://git.samba.org/?p=samba.git;a=shortlog;h=master
- Log -----------------------------------------------------------------
commit 9de04626c058563a6cf4c13e4f5399039e345ef5
Author: Andreas Schneider <[email protected]>
Date: Thu Nov 17 16:15:54 2016 +0100
s4:torture: Fix cleanup of the secrets object in session_key test
BUG: https://bugzilla.samba.org/show_bug.cgi?id=12433
The test is known to be failing if sealing is turned on in some
circumstances. In this case a secret is created and then the function
dcerpc_fetch_session_key() fails. The secret is not removed!
We use torturesecret-%08x with random() to fill in the number. Sometimes
it happens that random() returns a number we already used. So we end up
trying to create a secret for an entry which already exists and run
into a collision
This change makes sure we always cleanup behind us and do not leave
secret objects we created.
Pair-Programmed-With: Guenther Deschner <[email protected]>
Signed-off-by: Andreas Schneider <[email protected]>
Signed-off-by: Guenther Deschner <[email protected]>
Reviewed-by: Jeremy Allison <[email protected]>
Autobuild-User(master): Jeremy Allison <[email protected]>
Autobuild-Date(master): Thu Nov 17 22:30:36 CET 2016 on sn-devel-144
commit 31d21de548d899f82fa7944767ad94e8aca8d96d
Author: Andreas Schneider <[email protected]>
Date: Thu Nov 17 15:44:13 2016 +0100
s4:torture: Normalizes names in session_key test
BUG: https://bugzilla.samba.org/show_bug.cgi?id=12433
Signed-off-by: Andreas Schneider <[email protected]>
Reviewed-by: Guenther Deschner <[email protected]>
Reviewed-by: Jeremy Allison <[email protected]>
commit 80f7f568f8960c809756d5233c8f875db4ea07d6
Author: Andreas Schneider <[email protected]>
Date: Thu Nov 17 15:35:47 2016 +0100
s4:torture: Strip trailing whitespaces in session_key.c
BUG: https://bugzilla.samba.org/show_bug.cgi?id=12433
Signed-off-by: Andreas Schneider <[email protected]>
Reviewed-by: Guenther Deschner <[email protected]>
Reviewed-by: Jeremy Allison <[email protected]>
-----------------------------------------------------------------------
Summary of changes:
source4/torture/rpc/session_key.c | 100 ++++++++++++++++++++------------------
1 file changed, 53 insertions(+), 47 deletions(-)
Changeset truncated at 500 lines:
diff --git a/source4/torture/rpc/session_key.c
b/source4/torture/rpc/session_key.c
index 11f6a0b..3b7ba1f 100644
--- a/source4/torture/rpc/session_key.c
+++ b/source4/torture/rpc/session_key.c
@@ -1,20 +1,20 @@
-/*
+/*
Unix SMB/CIFS implementation.
test suite for lsa rpc operations
Copyright (C) Andrew Tridgell 2003
Copyright (C) Andrew Bartlett <[email protected]> 2004-2005
-
+
This program is free software; you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation; either version 3 of the License, or
(at your option) any later version.
-
+
This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
GNU General Public License for more details.
-
+
You should have received a copy of the GNU General Public License
along with this program. If not, see <http://www.gnu.org/licenses/>.
*/
@@ -32,16 +32,15 @@ static void init_lsa_String(struct lsa_String *name, const
char *s)
name->string = s;
}
-static bool test_CreateSecret_basic(struct dcerpc_pipe *p,
+static bool test_CreateSecret_basic(struct dcerpc_pipe *p,
struct torture_context *tctx,
- struct policy_handle *handle)
+ struct policy_handle *handle,
+ struct policy_handle *sec_handle)
{
NTSTATUS status;
struct lsa_CreateSecret r;
struct lsa_SetSecret r3;
struct lsa_QuerySecret r4;
- struct policy_handle sec_handle;
- struct lsa_DeleteObject d;
struct lsa_DATA_BUF buf1;
struct lsa_DATA_BUF_PTR bufp1;
DATA_BLOB enc_key;
@@ -53,69 +52,69 @@ static bool test_CreateSecret_basic(struct dcerpc_pipe *p,
char *secname;
struct dcerpc_binding_handle *b = p->binding_handle;
- secname = talloc_asprintf(tctx, "torturesecret-%u", (unsigned
int)random());
+ secname = talloc_asprintf(tctx, "torturesecret-%08x", (unsigned
int)random());
torture_comment(tctx, "Testing CreateSecret of %s\n", secname);
-
+
init_lsa_String(&r.in.name, secname);
-
+
r.in.handle = handle;
r.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
- r.out.sec_handle = &sec_handle;
-
+ r.out.sec_handle = sec_handle;
+
torture_assert_ntstatus_ok(tctx, dcerpc_lsa_CreateSecret_r(b, tctx, &r),
"CreateSecret failed");
torture_assert_ntstatus_ok(tctx, r.out.result, "CreateSecret failed");
-
+
status = dcerpc_fetch_session_key(p, &session_key);
torture_assert_ntstatus_ok(tctx, status, "dcerpc_fetch_session_key
failed");
-
+
enc_key = sess_encrypt_string(secret1, &session_key);
-
- r3.in.sec_handle = &sec_handle;
+
+ r3.in.sec_handle = sec_handle;
r3.in.new_val = &buf1;
r3.in.old_val = NULL;
r3.in.new_val->data = enc_key.data;
r3.in.new_val->length = enc_key.length;
r3.in.new_val->size = enc_key.length;
-
+
torture_comment(tctx, "Testing SetSecret\n");
-
+
torture_assert_ntstatus_ok(tctx, dcerpc_lsa_SetSecret_r(b, tctx, &r3),
"SetSecret failed");
torture_assert_ntstatus_ok(tctx, r3.out.result, "SetSecret failed");
-
- r3.in.sec_handle = &sec_handle;
+
+ r3.in.sec_handle = sec_handle;
r3.in.new_val = &buf1;
r3.in.old_val = NULL;
r3.in.new_val->data = enc_key.data;
r3.in.new_val->length = enc_key.length;
r3.in.new_val->size = enc_key.length;
-
+
/* break the encrypted data */
enc_key.data[0]++;
-
+
torture_comment(tctx, "Testing SetSecret with broken key\n");
-
+
torture_assert_ntstatus_ok(tctx, dcerpc_lsa_SetSecret_r(b, tctx, &r3),
"SetSecret failed");
torture_assert_ntstatus_equal(tctx, r3.out.result,
NT_STATUS_UNKNOWN_REVISION,
"SetSecret should have failed UNKNOWN_REVISION");
-
+
data_blob_free(&enc_key);
-
+
ZERO_STRUCT(new_mtime);
ZERO_STRUCT(old_mtime);
-
+
/* fetch the secret back again */
- r4.in.sec_handle = &sec_handle;
+ r4.in.sec_handle = sec_handle;
r4.in.new_val = &bufp1;
r4.in.new_mtime = &new_mtime;
r4.in.old_val = NULL;
r4.in.old_mtime = NULL;
-
+
bufp1.buf = NULL;
-
+
torture_comment(tctx, "Testing QuerySecret\n");
torture_assert_ntstatus_ok(tctx, dcerpc_lsa_QuerySecret_r(b, tctx, &r4),
"QuerySecret failed");
@@ -126,14 +125,9 @@ static bool test_CreateSecret_basic(struct dcerpc_pipe *p,
blob1.length = r4.out.new_val->buf->size;
secret2 = sess_decrypt_string(tctx, &blob1, &session_key);
-
+
torture_assert_str_equal(tctx, secret1, secret2, "Returned secret
invalid");
- d.in.handle = &sec_handle;
- d.out.handle = &sec_handle;
- torture_assert_ntstatus_ok(tctx, dcerpc_lsa_DeleteObject_r(b, tctx, &d),
- "DeleteObject failed");
- torture_assert_ntstatus_ok(tctx, d.out.result, "delete should have
returned OKINVALID_HANDLE");
return true;
}
@@ -149,16 +143,18 @@ static bool test_secrets(struct torture_context *torture,
const void *_data)
struct dcerpc_pipe *p;
struct policy_handle *handle;
struct dcerpc_binding *binding;
- const struct secret_settings *settings =
+ const struct secret_settings *settings =
(const struct secret_settings *)_data;
NTSTATUS status;
struct dcerpc_binding_handle *b;
+ struct policy_handle sec_handle = {0};
+ bool ok;
lpcfg_set_cmdline(torture->lp_ctx, "ntlmssp client:keyexchange",
settings->keyexchange?"True":"False");
lpcfg_set_cmdline(torture->lp_ctx, "ntlmssp_client:ntlm2",
settings->ntlm2?"True":"False");
lpcfg_set_cmdline(torture->lp_ctx, "ntlmssp_client:lm_key",
settings->lm_key?"True":"False");
- torture_assert_ntstatus_ok(torture, torture_rpc_binding(torture,
&binding),
+ torture_assert_ntstatus_ok(torture, torture_rpc_binding(torture,
&binding),
"Getting bindoptions");
status = dcerpc_binding_set_flags(binding, settings->bindoptions, 0);
@@ -179,18 +175,28 @@ static bool test_secrets(struct torture_context *torture,
const void *_data)
}
torture_assert(torture, handle, "OpenPolicy2 failed. This test cannot
run against this server");
-
- if (!test_CreateSecret_basic(p, torture, handle)) {
- talloc_free(p);
- return false;
+
+ ok = test_CreateSecret_basic(p, torture, handle, &sec_handle);
+
+ if (is_valid_policy_hnd(&sec_handle)) {
+ struct lsa_DeleteObject d;
+
+ d.in.handle = &sec_handle;
+ d.out.handle = &sec_handle;
+
+ status = dcerpc_lsa_DeleteObject_r(b, torture, &d);
+ if (!NT_STATUS_IS_OK(status) ||
+ !NT_STATUS_IS_OK(d.out.result)) {
+ torture_warning(torture,
+ "Failed to delete secrets object");
+ }
}
talloc_free(p);
-
- return true;
+ return ok;
}
-static struct torture_tcase *add_test(struct torture_suite *suite, uint32_t
bindoptions,
+static struct torture_tcase *add_test(struct torture_suite *suite, uint32_t
bindoptions,
bool keyexchange, bool ntlm2, bool lm_key)
{
char *name = NULL;
@@ -203,7 +209,7 @@ static struct torture_tcase *add_test(struct torture_suite
*suite, uint32_t bind
name = talloc_strdup(suite, "bigendian");
else if (bindoptions == DCERPC_SEAL)
name = talloc_strdup(suite, "seal");
- else if (bindoptions == 0)
+ else if (bindoptions == 0)
name = talloc_strdup(suite, "none");
else
name = talloc_strdup(suite, "unknown");
@@ -232,7 +238,7 @@ struct torture_suite *torture_rpc_lsa_secrets(TALLOC_CTX
*mem_ctx)
for (keyexchange = 0; keyexchange < ARRAY_SIZE(bool_vals);
keyexchange++) {
for (ntlm2 = 0; ntlm2 < ARRAY_SIZE(bool_vals); ntlm2++) {
for (lm_key = 0; lm_key < ARRAY_SIZE(bool_vals);
lm_key++) {
- add_test(suite, DCERPC_PUSH_BIGENDIAN,
bool_vals[keyexchange], bool_vals[ntlm2],
+ add_test(suite, DCERPC_PUSH_BIGENDIAN,
bool_vals[keyexchange], bool_vals[ntlm2],
bool_vals[lm_key]);
add_test(suite, DCERPC_SEAL,
bool_vals[keyexchange], bool_vals[ntlm2], bool_vals[lm_key]);
add_test(suite, 0, bool_vals[keyexchange],
bool_vals[ntlm2], bool_vals[lm_key]);
--
Samba Shared Repository
