[PATCH 3/3] advapi32/tests: Test GetTokenInformation with TokenIntegrityLevel

[Nikolay Sivov]

On 7/29/2012 02:24, Detlef Riekenberg wrote:
> --
> By by ... Detlef
> ---
>   dlls/advapi32/tests/security.c |   99 ++++++++++++++++++++++++++++++++++++++--
>   1 files changed, 94 insertions(+), 5 deletions(-)
>
> diff --git a/dlls/advapi32/tests/security.c b/dlls/advapi32/tests/security.c
> index 28e43ec..93bbc62 100644
> --- a/dlls/advapi32/tests/security.c
> +++ b/dlls/advapi32/tests/security.c
> @@ -167,6 +167,8 @@ static void init(void)
>       pSetSecurityDescriptorControl = (void *)GetProcAddress(hmod, "SetSecurityDescriptorControl");
>       pGetSecurityInfo = (void *)GetProcAddress(hmod, "GetSecurityInfo");
>       pCreateRestrictedToken = (void *)GetProcAddress(hmod, "CreateRestrictedToken");
> +    pConvertSidToStringSidA = (void *)GetProcAddress( hmod, "ConvertSidToStringSidA" );
> +    pConvertStringSidToSidA = (void *)GetProcAddress( hmod, "ConvertStringSidToSidA" );
>   
>       myARGC = winetest_get_mainargs( &myARGV );
>   }
> @@ -211,12 +213,11 @@ static void test_sid(void)
>       BOOL r;
>       LPSTR str = NULL;
>   
> -    pConvertSidToStringSidA = (void *)GetProcAddress( hmod, "ConvertSidToStringSidA" );
> -    if( !pConvertSidToStringSidA )
> -        return;
> -    pConvertStringSidToSidA = (void *)GetProcAddress( hmod, "ConvertStringSidToSidA" );
> -    if( !pConvertStringSidToSidA )
> +    if( !pConvertSidToStringSidA || !pConvertStringSidToSidA )
> +    {
> +        skip("ConvertSidToStringSidA or ConvertStringSidToSidA not available\n");
>           return;
> +    }
>   
>       r = pConvertStringSidToSidA( NULL, NULL );
>       ok( !r, "expected failure with NULL parameters\n" );
> @@ -4274,6 +4275,93 @@ static void test_kernel_objects_security(void)
>       CloseHandle(token);
>   }
>   
> +static void test_TokenIntegrityLevel(void)
> +{
> +    TOKEN_MANDATORY_LABEL *tml;
> +    UCHAR expected_authority[] = SECURITY_MANDATORY_LABEL_AUTHORITY;
> +    HANDLE token;
> +    DWORD size;
> +    DWORD res;
> +    LPVOID buffer = NULL;
> +    char *sidname = NULL;
> +    ULONG level;
> +    SID *psid;
> +
> +    if(!pConvertSidToStringSidA)
> +    {
> +        skip("ConvertSidToStringSidA not available\n");
> +        return;
> +    }
> +
> +    SetLastError(0xdeadbeef);
> +    res = OpenProcessToken(GetCurrentProcess(), TOKEN_QUERY, &token);
> +    ok(res, "got %d with %d (expected TRUE)\n", res, GetLastError());
> +    if (!res)
> +        return;
> +
> +    SetLastError(0xdeadbeef);
> +    res = GetTokenInformation(token, TokenIntegrityLevel, NULL, 0, &size);
> +
> +    /* not supported before Vista */
> +    if (!res && (GetLastError() == ERROR_INVALID_PARAMETER))
> +    {
> +        skip("TokenIntegrityLevel not supported\n");
> +        CloseHandle(token);
> +        return;
> +    }
> +
> +    if (!res && (GetLastError() == ERROR_INSUFFICIENT_BUFFER))
> +    {
> +        buffer = HeapAlloc(GetProcessHeap(), 0, size * 2);
> +        SetLastError(0xdeadbeef);
> +        res = GetTokenInformation(token, TokenIntegrityLevel, buffer, size, &size);
> +    }
You don't need that, buffer size is fixed for this case.
> +
> +    ok(res, "got %d with %d (expected TRUE)\n", res, GetLastError());
> +
> +    if (!res || !buffer)
> +        goto cleanup;
> +
> +    tml = buffer;
> +
> +    psid = tml->Label.Sid;
> +    ok(psid != NULL, "Label.Sid: NULL\n");
> +    if (!psid)
> +        goto cleanup;
> +
> +    ok(tml->Label.Attributes == (SE_GROUP_INTEGRITY | SE_GROUP_INTEGRITY_ENABLED),
> +        "got 0x%x (expected 0x%x)\n", tml->Label.Attributes, (SE_GROUP_INTEGRITY | SE_GROUP_INTEGRITY_ENABLED));
Attributes value probably depends on system setup, I believe you can 
disable all that intergity level stuff. If it doesn't currently fail on 
testbot let's keep it that way for now.
> +
> +    res = pConvertSidToStringSidA(psid, &sidname);
> +    trace("sid: %s\n", sidname);
> +    LocalFree(sidname);
> +
> +    ok(psid->Revision == 1, "got Revision %d (expected 1)\n", psid->Revision);
> +    ok(psid->SubAuthorityCount == 1, "got SubAuthorityCount %d (expected 1)\n", psid->SubAuthorityCount);
> +    ok(!memcmp(psid->IdentifierAuthority.Value, expected_authority, sizeof(expected_authority)),
> +            "got IdentifierAuthority %d, %d, %d, %d, %d, %d (expected 0,0,0,0,0,16)\n",
> +            psid->IdentifierAuthority.Value[0], psid->IdentifierAuthority.Value[1],
> +            psid->IdentifierAuthority.Value[2], psid->IdentifierAuthority.Value[3],
> +            psid->IdentifierAuthority.Value[4], psid->IdentifierAuthority.Value[5]);
> +
> +    level = psid->SubAuthority[0];
> +    ok((level == SECURITY_MANDATORY_MEDIUM_RID) || (level == SECURITY_MANDATORY_HIGH_RID),
> +        "got level 0x%x (expected 0x%x or 0x%x)\n", level, SECURITY_MANDATORY_MEDIUM_RID, SECURITY_MANDATORY_HIGH_RID);
All this mess should be replaced with EqualSid()
> +
> +    SetLastError(0xdeadbeef);
> +    res = GetTokenInformation(token, TokenIntegrityLevel, buffer, size - 1, &size);
> +    ok(!res && (GetLastError() == ERROR_INSUFFICIENT_BUFFER),
> +        "got %d and %u (expected FALSE and ERROR_INSUFFICIENT_BUFFER)\n", res, GetLastError());
Doesn't make much sense, behaviour is not specific to TokenIntegrityLevel.
> +
> +    SetLastError(0xdeadbeef);
> +    res = GetTokenInformation(token, TokenIntegrityLevel, buffer, size + 1, &size);
> +    ok(res, "got %d and %u (expected TRUE)\n", res, GetLastError());
Same here.
> +
> +cleanup:
> +    HeapFree(GetProcessHeap(), 0, buffer);
> +    CloseHandle(token);
> +}
> +
>   START_TEST(security)
>   {
>       init();
> @@ -4311,4 +4399,5 @@ START_TEST(security)
>       test_GetUserNameA();
>       test_GetUserNameW();
>       test_CreateRestrictedToken();
> +    test_TokenIntegrityLevel();
>   }