static bool test_ControlService(struct torture_context *tctx,
struct dcerpc_pipe *p)
{
struct svcctl_ControlService r;
struct policy_handle h, s;
struct SERVICE_STATUS service_status;
struct dcerpc_binding_handle *b = p->binding_handle;
if (!test_OpenSCManager(b, tctx, &h))
return false;
if (!test_OpenService(b, tctx, &h, TORTURE_DEFAULT_SERVICE, &s))
return false;
r.in.handle = &s;
r.in.control = 0;
r.out.service_status = &service_status;
torture_assert_ntstatus_ok(tctx,
dcerpc_svcctl_ControlService_r(b, tctx, &r),
"ControlService failed!");
torture_assert_werr_equal(tctx, r.out.result, WERR_INVALID_PARAM,
"ControlService failed!");
if (!test_CloseServiceHandle(b, tctx, &s))
return false;
if (!test_CloseServiceHandle(b, tctx, &h))
return false;
return true;
}
static bool test_QueryServiceStatus(struct torture_context *tctx,
struct dcerpc_pipe *p)
{
struct svcctl_QueryServiceStatus r;
struct policy_handle h, s;
struct SERVICE_STATUS service_status;
NTSTATUS status;
if (!test_OpenSCManager(p, tctx, &h))
return false;
if (!test_OpenService(p, tctx, &h, TORTURE_DEFAULT_SERVICE, &s))
return false;
r.in.handle = &s;
r.out.service_status = &service_status;
status = dcerpc_svcctl_QueryServiceStatus(p, tctx, &r);
torture_assert_ntstatus_ok(tctx, status, "QueryServiceStatus failed!");
torture_assert_werr_ok(tctx, r.out.result, "QueryServiceStatus failed!");
if (!test_CloseServiceHandle(p, tctx, &s))
return false;
if (!test_CloseServiceHandle(p, tctx, &h))
return false;
return true;
}
static bool test_StartServiceW(struct torture_context *tctx,
struct dcerpc_pipe *p)
{
struct svcctl_StartServiceW r;
struct policy_handle h, s;
struct dcerpc_binding_handle *b = p->binding_handle;
if (!test_OpenSCManager(b, tctx, &h))
return false;
if (!test_OpenService(b, tctx, &h, TORTURE_DEFAULT_SERVICE, &s))
return false;
r.in.handle = &s;
r.in.NumArgs = 0;
r.in.Arguments = NULL;
torture_assert_ntstatus_ok(tctx,
dcerpc_svcctl_StartServiceW_r(b, tctx, &r),
"StartServiceW failed!");
torture_assert_werr_equal(tctx, r.out.result,
WERR_SERVICE_ALREADY_RUNNING,
"StartServiceW failed!");
if (!test_CloseServiceHandle(b, tctx, &s))
return false;
if (!test_CloseServiceHandle(b, tctx, &h))
return false;
return true;
}
static bool test_SetServiceObjectSecurity(struct torture_context *tctx,
struct dcerpc_pipe *p)
{
struct svcctl_QueryServiceObjectSecurity q;
struct svcctl_SetServiceObjectSecurity r;
struct policy_handle h, s;
struct dcerpc_binding_handle *b = p->binding_handle;
uint8_t *buffer;
uint32_t needed;
if (!test_OpenSCManager(b, tctx, &h))
return false;
if (!test_OpenService(b, tctx, &h, TORTURE_DEFAULT_SERVICE, &s))
return false;
q.in.handle = &s;
q.in.security_flags = SECINFO_DACL;
q.in.offered = 0;
q.out.buffer = NULL;
q.out.needed = &needed;
torture_assert_ntstatus_ok(tctx,
dcerpc_svcctl_QueryServiceObjectSecurity_r(b, tctx, &q),
"QueryServiceObjectSecurity failed!");
if (W_ERROR_EQUAL(q.out.result, WERR_INSUFFICIENT_BUFFER)) {
q.in.offered = needed;
buffer = talloc_array(tctx, uint8_t, needed);
q.out.buffer = buffer;
torture_assert_ntstatus_ok(tctx,
dcerpc_svcctl_QueryServiceObjectSecurity_r(b, tctx, &q),
"QueryServiceObjectSecurity failed!");
}
torture_assert_werr_ok(tctx, q.out.result,
"QueryServiceObjectSecurity failed!");
r.in.handle = &s;
r.in.security_flags = SECINFO_DACL;
r.in.buffer = q.out.buffer;
r.in.offered = *q.out.needed;
torture_assert_ntstatus_ok(tctx,
dcerpc_svcctl_SetServiceObjectSecurity_r(b, tctx, &r),
"SetServiceObjectSecurity failed!");
torture_assert_werr_ok(tctx, r.out.result,
"SetServiceObjectSecurity failed!");
if (!test_CloseServiceHandle(b, tctx, &s))
return false;
if (!test_CloseServiceHandle(b, tctx, &h))
return false;
return true;
}
BOOL torture_rpc_svcctl(struct torture_context *torture)
{
NTSTATUS status;
struct dcerpc_pipe *p;
struct policy_handle h;
TALLOC_CTX *mem_ctx;
BOOL ret = True;
mem_ctx = talloc_init("torture_rpc_svcctl");
status = torture_rpc_connection(mem_ctx, &p, &dcerpc_table_svcctl);
if (!NT_STATUS_IS_OK(status)) {
talloc_free(mem_ctx);
return False;
}
if (!test_OpenSCManager(p, mem_ctx, &h)) {
ret = False;
}
if (!test_EnumServicesStatus(p, mem_ctx, &h)) {
ret = False;
}
if (!test_CloseServiceHandle(p, mem_ctx, &h)) {
ret = False;
}
talloc_free(mem_ctx);
return ret;
}
static bool test_QueryServiceStatusEx(struct torture_context *tctx, struct dcerpc_pipe *p)
{
struct svcctl_QueryServiceStatusEx r;
struct policy_handle h, s;
NTSTATUS status;
struct dcerpc_binding_handle *b = p->binding_handle;
uint32_t info_level = SVC_STATUS_PROCESS_INFO;
uint8_t *buffer;
uint32_t offered = 0;
uint32_t needed = 0;
if (!test_OpenSCManager(b, tctx, &h))
return false;
if (!test_OpenService(b, tctx, &h, TORTURE_DEFAULT_SERVICE, &s))
return false;
buffer = talloc(tctx, uint8_t);
r.in.handle = &s;
r.in.info_level = info_level;
r.in.offered = offered;
r.out.buffer = buffer;
r.out.needed = &needed;
status = dcerpc_svcctl_QueryServiceStatusEx_r(b, tctx, &r);
torture_assert_ntstatus_ok(tctx, status, "QueryServiceStatusEx failed!");
if (W_ERROR_EQUAL(r.out.result, WERR_INSUFFICIENT_BUFFER)) {
r.in.offered = needed;
buffer = talloc_array(tctx, uint8_t, needed);
r.out.buffer = buffer;
status = dcerpc_svcctl_QueryServiceStatusEx_r(b, tctx, &r);
torture_assert_ntstatus_ok(tctx, status, "QueryServiceStatusEx failed!");
torture_assert_werr_ok(tctx, r.out.result, "QueryServiceStatusEx failed!");
}
if (!test_CloseServiceHandle(b, tctx, &s))
return false;
if (!test_CloseServiceHandle(b, tctx, &h))
return false;
return true;
}
static bool test_QueryServiceConfigW(struct torture_context *tctx,
struct dcerpc_pipe *p)
{
struct svcctl_QueryServiceConfigW r;
struct QUERY_SERVICE_CONFIG query;
struct policy_handle h, s;
NTSTATUS status;
struct dcerpc_binding_handle *b = p->binding_handle;
uint32_t offered = 0;
uint32_t needed = 0;
if (!test_OpenSCManager(b, tctx, &h))
return false;
if (!test_OpenService(b, tctx, &h, TORTURE_DEFAULT_SERVICE, &s))
return false;
r.in.handle = &s;
r.in.offered = offered;
r.out.query = &query;
r.out.needed = &needed;
status = dcerpc_svcctl_QueryServiceConfigW_r(b, tctx, &r);
torture_assert_ntstatus_ok(tctx, status, "QueryServiceConfigW failed!");
if (W_ERROR_EQUAL(r.out.result, WERR_INSUFFICIENT_BUFFER)) {
r.in.offered = needed;
status = dcerpc_svcctl_QueryServiceConfigW_r(b, tctx, &r);
torture_assert_ntstatus_ok(tctx, status, "QueryServiceConfigW failed!");
}
torture_assert_werr_ok(tctx, r.out.result, "QueryServiceConfigW failed!");
if (!test_CloseServiceHandle(b, tctx, &s))
return false;
if (!test_CloseServiceHandle(b, tctx, &h))
return false;
return true;
}
static bool test_SCManager(struct torture_context *tctx,
struct dcerpc_pipe *p)
{
struct policy_handle h;
if (!test_OpenSCManager(p, tctx, &h))
return false;
if (!test_CloseServiceHandle(p, tctx, &h))
return false;
return true;
}
static bool test_EnumDependentServicesW(struct torture_context *tctx,
struct dcerpc_pipe *p)
{
struct svcctl_EnumDependentServicesW r;
struct policy_handle h, s;
uint32_t needed;
uint32_t services_returned;
uint32_t i;
uint32_t states[] = { SERVICE_STATE_ACTIVE,
SERVICE_STATE_INACTIVE,
SERVICE_STATE_ALL };
if (!test_OpenSCManager(p, tctx, &h))
return false;
if (!test_OpenService(p, tctx, &h, TORTURE_DEFAULT_SERVICE, &s))
return false;
r.in.service = &s;
r.in.offered = 0;
r.in.state = 0;
r.out.service_status = NULL;
r.out.services_returned = &services_returned;
r.out.needed = &needed;
torture_assert_ntstatus_ok(tctx,
dcerpc_svcctl_EnumDependentServicesW(p, tctx, &r),
"EnumDependentServicesW failed!");
torture_assert_werr_equal(tctx, r.out.result, WERR_INVALID_PARAM,
"EnumDependentServicesW failed!");
for (i=0; i<ARRAY_SIZE(states); i++) {
r.in.state = states[i];
torture_assert_ntstatus_ok(tctx,
dcerpc_svcctl_EnumDependentServicesW(p, tctx, &r),
"EnumDependentServicesW failed!");
if (W_ERROR_EQUAL(r.out.result, WERR_MORE_DATA)) {
r.in.offered = needed;
r.out.service_status = talloc_array(tctx, uint8_t, needed);
torture_assert_ntstatus_ok(tctx,
dcerpc_svcctl_EnumDependentServicesW(p, tctx, &r),
"EnumDependentServicesW failed!");
}
torture_assert_werr_ok(tctx, r.out.result,
"EnumDependentServicesW failed");
}
if (!test_CloseServiceHandle(p, tctx, &s))
return false;
if (!test_CloseServiceHandle(p, tctx, &h))
return false;
return true;
}
static bool test_EnumServicesStatus(struct torture_context *tctx, struct dcerpc_pipe *p)
{
struct svcctl_EnumServicesStatusW r;
struct policy_handle h;
int i;
NTSTATUS status;
uint32_t resume_handle = 0;
struct ENUM_SERVICE_STATUSW *service = NULL;
uint32_t needed = 0;
uint32_t services_returned = 0;
if (!test_OpenSCManager(p, tctx, &h))
return false;
r.in.handle = &h;
r.in.type = SERVICE_TYPE_WIN32;
r.in.state = SERVICE_STATE_ALL;
r.in.offered = 0;
r.in.resume_handle = &resume_handle;
r.out.service = NULL;
r.out.resume_handle = &resume_handle;
r.out.services_returned = &services_returned;
r.out.needed = &needed;
status = dcerpc_svcctl_EnumServicesStatusW(p, tctx, &r);
torture_assert_ntstatus_ok(tctx, status, "EnumServicesStatus failed!");
if (W_ERROR_EQUAL(r.out.result, WERR_MORE_DATA)) {
r.in.offered = needed;
r.out.service = talloc_array(tctx, uint8_t, needed);
status = dcerpc_svcctl_EnumServicesStatusW(p, tctx, &r);
torture_assert_ntstatus_ok(tctx, status, "EnumServicesStatus failed!");
torture_assert_werr_ok(tctx, r.out.result, "EnumServicesStatus failed");
}
if (services_returned > 0) {
enum ndr_err_code ndr_err;
DATA_BLOB blob;
struct ndr_pull *ndr;
blob.length = r.in.offered;
blob.data = talloc_steal(tctx, r.out.service);
ndr = ndr_pull_init_blob(&blob, tctx, lp_iconv_convenience(tctx->lp_ctx));
service = talloc_array(tctx, struct ENUM_SERVICE_STATUSW, services_returned);
if (!service) {
return false;
}
ndr_err = ndr_pull_ENUM_SERVICE_STATUSW_array(
ndr, services_returned, service);
if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
return false;
}
}
for(i = 0; i < services_returned; i++) {
torture_assert(tctx, service[i].service_name,
"Service without name returned!");
printf("%-20s \"%s\", Type: %d, State: %d\n",
service[i].service_name, service[i].display_name,
service[i].status.type, service[i].status.state);
}
if (!test_CloseServiceHandle(p, tctx, &h))
return false;
return true;
}
static bool test_QueryServiceConfig2W(struct torture_context *tctx, struct dcerpc_pipe *p)
{
struct svcctl_QueryServiceConfig2W r;
struct policy_handle h, s;
NTSTATUS status;
uint32_t info_level = SERVICE_CONFIG_DESCRIPTION;
uint8_t *buffer;
uint32_t offered = 0;
uint32_t needed = 0;
if (!test_OpenSCManager(p, tctx, &h))
return false;
if (!test_OpenService(p, tctx, &h, TORTURE_DEFAULT_SERVICE, &s))
return false;
buffer = talloc(tctx, uint8_t);
r.in.handle = &s;
r.in.info_level = info_level;
r.in.offered = offered;
r.out.buffer = buffer;
r.out.needed = &needed;
status = dcerpc_svcctl_QueryServiceConfig2W(p, tctx, &r);
torture_assert_ntstatus_ok(tctx, status, "QueryServiceConfig2W failed!");
if (W_ERROR_EQUAL(r.out.result, WERR_INSUFFICIENT_BUFFER)) {
r.in.offered = needed;
buffer = talloc_array(tctx, uint8_t, needed);
r.out.buffer = buffer;
status = dcerpc_svcctl_QueryServiceConfig2W(p, tctx, &r);
torture_assert_ntstatus_ok(tctx, status, "QueryServiceConfig2W failed!");
torture_assert_werr_ok(tctx, r.out.result, "QueryServiceConfig2W failed!");
}
r.in.info_level = SERVICE_CONFIG_FAILURE_ACTIONS;
r.in.offered = offered;
r.out.buffer = buffer;
r.out.needed = &needed;
status = dcerpc_svcctl_QueryServiceConfig2W(p, tctx, &r);
torture_assert_ntstatus_ok(tctx, status, "QueryServiceConfig2W failed!");
if (W_ERROR_EQUAL(r.out.result, WERR_INSUFFICIENT_BUFFER)) {
r.in.offered = needed;
buffer = talloc_array(tctx, uint8_t, needed);
r.out.buffer = buffer;
status = dcerpc_svcctl_QueryServiceConfig2W(p, tctx, &r);
torture_assert_ntstatus_ok(tctx, status, "QueryServiceConfig2W failed!");
torture_assert_werr_ok(tctx, r.out.result, "QueryServiceConfig2W failed!");
}
if (!test_CloseServiceHandle(p, tctx, &s))
return false;
if (!test_CloseServiceHandle(p, tctx, &h))
return false;
return true;
}
static bool test_QueryServiceObjectSecurity(struct torture_context *tctx,
struct dcerpc_pipe *p)
{
struct svcctl_QueryServiceObjectSecurity r;
struct policy_handle h, s;
struct dcerpc_binding_handle *b = p->binding_handle;
uint8_t *buffer = NULL;
uint32_t needed;
enum ndr_err_code ndr_err;
struct security_descriptor sd;
DATA_BLOB blob;
if (!test_OpenSCManager(b, tctx, &h))
return false;
if (!test_OpenService(b, tctx, &h, TORTURE_DEFAULT_SERVICE, &s))
return false;
r.in.handle = &s;
r.in.security_flags = 0;
r.in.offered = 0;
r.out.buffer = NULL;
r.out.needed = &needed;
torture_assert_ntstatus_ok(tctx,
dcerpc_svcctl_QueryServiceObjectSecurity_r(b, tctx, &r),
"QueryServiceObjectSecurity failed!");
torture_assert_werr_equal(tctx, r.out.result, WERR_INVALID_PARAM,
"QueryServiceObjectSecurity failed!");
r.in.security_flags = SECINFO_DACL;
torture_assert_ntstatus_ok(tctx,
dcerpc_svcctl_QueryServiceObjectSecurity_r(b, tctx, &r),
"QueryServiceObjectSecurity failed!");
if (W_ERROR_EQUAL(r.out.result, WERR_INSUFFICIENT_BUFFER)) {
r.in.offered = needed;
buffer = talloc_array(tctx, uint8_t, needed);
r.out.buffer = buffer;
torture_assert_ntstatus_ok(tctx,
dcerpc_svcctl_QueryServiceObjectSecurity_r(b, tctx, &r),
"QueryServiceObjectSecurity failed!");
}
torture_assert_werr_ok(tctx, r.out.result, "QueryServiceObjectSecurity failed!");
blob = data_blob_const(buffer, needed);
ndr_err = ndr_pull_struct_blob(&blob, tctx, &sd,
(ndr_pull_flags_fn_t)ndr_pull_security_descriptor);
if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
return false;
}
if (DEBUGLEVEL >= 1) {
NDR_PRINT_DEBUG(security_descriptor, &sd);
}
if (!test_CloseServiceHandle(b, tctx, &s))
return false;
if (!test_CloseServiceHandle(b, tctx, &h))
return false;
return true;
}
