python/samba/tests/getdcname.py

   1 # Unix SMB/CIFS implementation.
   2 # Copyright (C) Andrew Bartlett <abartlet@samba.org> 2018
   3 #
   4 # This program is free software; you can redistribute it and/or modify
   5 # it under the terms of the GNU General Public License as published by
   6 # the Free Software Foundation; either version 3 of the License, or
   7 # (at your option) any later version.
   8 #
   9 # This program is distributed in the hope that it will be useful,
  10 # but WITHOUT ANY WARRANTY; without even the implied warranty of
  11 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  12 # GNU General Public License for more details.
  13 #
  14 # You should have received a copy of the GNU General Public License
  15 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
  16 #
  17
  18 """
  19     Tests GetDCNameEx calls in NETLOGON
  20 """
  21
  22 from samba import auth
  23 from samba import WERRORError, werror
  24 import samba.tests
  25 import os
  26 from samba.credentials import Credentials
  27 from samba.dcerpc import netlogon
  28 from samba.dcerpc.misc import GUID
  29
  30
  31 class GetDCNameEx(samba.tests.TestCase):
  32
  33     def setUp(self):
  34         self.lp = samba.tests.env_loadparm()
  35         self.creds = Credentials()
  36
  37         self.netlogon_conn = None
  38         self.server = os.environ.get('SERVER')
  39         self.realm = os.environ.get('REALM')
  40         self.domain = os.environ.get('DOMAIN')
  41         self.trust_realm = os.environ.get('TRUST_REALM')
  42         self.trust_domain = os.environ.get('TRUST_DOMAIN')
  43
  44     def _call_get_dc_name(self, domain=None, domain_guid=None,
  45                           site_name=None, ex2=False, flags=0):
  46         if self.netlogon_conn is None:
  47             self.netlogon_conn = netlogon.netlogon("ncalrpc:[schannel]",
  48                                                    self.get_loadparm())
  49
  50         if ex2:
  51             return self.netlogon_conn.netr_DsRGetDCNameEx2(self.server,
  52                                                            None, 0,
  53                                                            domain,
  54                                                            domain_guid,
  55                                                            site_name,
  56                                                            flags)
  57         else:
  58             return self.netlogon_conn.netr_DsRGetDCNameEx(self.server,
  59                                                           domain,
  60                                                           domain_guid,
  61                                                           site_name,
  62                                                           flags)
  63
  64     def test_get_dc_ex2(self):
  65         """Check the most trivial requirements of Ex2 (no domain or site)
  66
  67         a) The paths are prefixed with two backslashes
  68         b) The returned domains conform to the format requested
  69         c) The domain matches our own domain
  70         """
  71         response = self._call_get_dc_name(ex2=True)
  72
  73         self.assertTrue(response.dc_unc is not None)
  74         self.assertTrue(response.dc_unc.startswith('\\\\'))
  75         self.assertTrue(response.dc_address is not None)
  76         self.assertTrue(response.dc_address.startswith('\\\\'))
  77
  78         self.assertTrue(response.domain_name.lower() ==
  79                         self.realm.lower() or
  80                         response.domain_name.lower() ==
  81                         self.domain.lower())
  82
  83         response = self._call_get_dc_name(ex2=True,
  84                                           flags=netlogon.DS_RETURN_DNS_NAME)
  85         self.assertEqual(response.domain_name.lower(),
  86                          self.realm.lower())
  87
  88         response = self._call_get_dc_name(ex2=True,
  89                                           flags=netlogon.DS_RETURN_FLAT_NAME)
  90         self.assertEqual(response.domain_name.lower(),
  91                          self.domain.lower())
  92
  93     def test_get_dc_over_winbind_ex2(self):
  94         """Check what happens to Ex2 requests after being forwarded to winbind
  95
  96         a) The paths must still have the same backslash prefixes
  97         b) The returned domain does not match our own domain
  98         c) The domain matches the format requested
  99         """
 100         if self.trust_realm is None:
 101             return
 102
 103         response_trust = self._call_get_dc_name(domain=self.trust_realm,
 104                                                 ex2=True)
 105         response = self._call_get_dc_name(domain=self.realm,
 106                                           ex2=True)
 107
 108         self.assertTrue(response_trust.dc_unc is not None)
 109         self.assertTrue(response_trust.dc_unc.startswith('\\\\'))
 110         self.assertTrue(response_trust.dc_address is not None)
 111         self.assertTrue(response_trust.dc_address.startswith('\\\\'))
 112
 113         self.assertNotEqual(response_trust.dc_unc,
 114                             response.dc_unc)
 115         self.assertNotEqual(response_trust.dc_address,
 116                             response.dc_address)
 117
 118         self.assertTrue(response_trust.domain_name.lower() ==
 119                         self.trust_realm.lower() or
 120                         response_trust.domain_name.lower() ==
 121                         self.trust_domain.lower())
 122
 123         response_trust = self._call_get_dc_name(domain=self.trust_realm,
 124                                                 flags=netlogon.DS_RETURN_DNS_NAME,
 125                                                 ex2=True)
 126         self.assertEqual(response_trust.domain_name.lower(),
 127                          self.trust_realm.lower())
 128
 129         response_trust = self._call_get_dc_name(domain=self.trust_realm,
 130                                                 flags=netlogon.DS_RETURN_FLAT_NAME,
 131                                                 ex2=True)
 132         self.assertEqual(response_trust.domain_name.lower(),
 133                          self.trust_domain.lower())
 134
 135     def test_get_dc_over_winbind(self):
 136         """Test the standard Ex version (not Ex2)
 137
 138         Ex calls Ex2 anyways, from now on, just test Ex.
 139         """
 140         if self.trust_realm is None:
 141             return
 142
 143         response_trust = self._call_get_dc_name(domain=self.trust_realm,
 144                                                 flags=netlogon.DS_RETURN_DNS_NAME)
 145
 146         self.assertTrue(response_trust.dc_unc is not None)
 147         self.assertTrue(response_trust.dc_unc.startswith('\\\\'))
 148         self.assertTrue(response_trust.dc_address is not None)
 149         self.assertTrue(response_trust.dc_address.startswith('\\\\'))
 150
 151         self.assertEqual(response_trust.domain_name.lower(),
 152                          self.trust_realm.lower())
 153
 154     def test_get_dc_over_winbind_with_site(self):
 155         """Test the standard Ex version (not Ex2)
 156
 157         We assume that there is a Default-First-Site-Name site.
 158         """
 159         if self.trust_realm is None:
 160             return
 161
 162         site = 'Default-First-Site-Name'
 163         response_trust = self._call_get_dc_name(domain=self.trust_realm,
 164                                                 site_name=site,
 165                                                 flags=netlogon.DS_RETURN_DNS_NAME)
 166
 167         self.assertTrue(response_trust.dc_unc is not None)
 168         self.assertTrue(response_trust.dc_unc.startswith('\\\\'))
 169         self.assertTrue(response_trust.dc_address is not None)
 170         self.assertTrue(response_trust.dc_address.startswith('\\\\'))
 171
 172         self.assertEqual(response_trust.domain_name.lower(),
 173                          self.trust_realm.lower())
 174
 175         self.assertEqual(site.lower(), response_trust.dc_site_name.lower())
 176
 177     def test_get_dc_over_winbind_invalid_site(self):
 178         """Test the standard Ex version (not Ex2)
 179
 180         We assume that there is no Invalid-First-Site-Name site.
 181         """
 182         if self.trust_realm is None:
 183             return
 184
 185         site = 'Invalid-First-Site-Name'
 186         try:
 187             response_trust = self._call_get_dc_name(domain=self.trust_realm,
 188                                                     site_name=site,
 189                                                     flags=netlogon.DS_RETURN_DNS_NAME,
 190                                                     ex2=False)
 191             self.fail("Failed to give the correct error for incorrect site")
 192         except WERRORError as e:
 193             enum, estr = e.args
 194             if enum != werror.WERR_NO_SUCH_DOMAIN:
 195                 self.fail("Failed to detect an invalid site name")
 196
 197     def test_get_dc_over_winbind_invalid_site_ex2(self):
 198         """Test the Ex2 version.
 199
 200         We assume that there is no Invalid-First-Site-Name site.
 201         """
 202         if self.trust_realm is None:
 203             return
 204
 205         site = 'Invalid-First-Site-Name'
 206         try:
 207             response_trust = self._call_get_dc_name(domain=self.trust_realm,
 208                                                     site_name=site,
 209                                                     flags=netlogon.DS_RETURN_DNS_NAME,
 210                                                     ex2=True)
 211             self.fail("Failed to give the correct error for incorrect site")
 212         except WERRORError as e:
 213             enum, estr = e.args
 214             if enum != werror.WERR_NO_SUCH_DOMAIN:
 215                 self.fail("Failed to detect an invalid site name")
 216
 217     def test_get_dc_over_winbind_empty_string_site(self):
 218         """Test the standard Ex version (not Ex2)
 219
 220         We assume that there is a Default-First-Site-Name site.
 221         """
 222         if self.trust_realm is None:
 223             return
 224
 225         site = ''
 226         try:
 227             response_trust = self._call_get_dc_name(domain=self.trust_realm,
 228                                                     site_name=site,
 229                                                     flags=netlogon.DS_RETURN_DNS_NAME)
 230         except WERRORError as e:
 231             self.fail("Unable to get empty string site result: " + str(e))
 232
 233         self.assertTrue(response_trust.dc_unc is not None)
 234         self.assertTrue(response_trust.dc_unc.startswith('\\\\'))
 235         self.assertTrue(response_trust.dc_address is not None)
 236         self.assertTrue(response_trust.dc_address.startswith('\\\\'))
 237
 238         self.assertEqual(response_trust.domain_name.lower(),
 239                          self.trust_realm.lower())
 240
 241         self.assertTrue(response_trust.dc_site_name is not None)
 242         self.assertNotEqual('', response_trust.dc_site_name)
 243
 244     def test_get_dc_over_winbind_netbios(self):
 245         """Supply a NETBIOS trust domain name."""
 246         if self.trust_realm is None:
 247             return
 248
 249         try:
 250             response_trust = self._call_get_dc_name(domain=self.trust_domain,
 251                                                     flags=netlogon.DS_RETURN_DNS_NAME,
 252                                                     ex2=False)
 253         except WERRORError as e:
 254             self.fail("Failed to succeed over winbind: " + str(e))
 255
 256         self.assertTrue(response_trust is not None)
 257         self.assertEqual(response_trust.domain_name.lower(),
 258                          self.trust_realm.lower())
 259
 260     def test_get_dc_over_winbind_with_site_netbios(self):
 261         """Supply a NETBIOS trust domain name.
 262
 263         Sporadically fails because NETBIOS queries do not return site name in
 264         winbind. The site check in NETLOGON will trigger and fail the request.
 265
 266         Currently marked in flapping...
 267         """
 268         if self.trust_realm is None:
 269             return
 270
 271         site = 'Default-First-Site-Name'
 272         try:
 273             response_trust = self._call_get_dc_name(domain=self.trust_domain,
 274                                                     site_name=site,
 275                                                     flags=netlogon.DS_RETURN_DNS_NAME,
 276                                                     ex2=False)
 277         except WERRORError as e:
 278             self.fail("get_dc_name (domain=%s,site=%s) over winbind failed: %s"
 279                       % (self.trust_domain, site, e))
 280
 281         self.assertTrue(response_trust is not None)
 282         self.assertEqual(response_trust.domain_name.lower(),
 283                          self.trust_realm.lower())
 284
 285         self.assertEqual(site.lower(), response_trust.dc_site_name.lower())
 286
 287     def test_get_dc_over_winbind_domain_guid(self):
 288         """Ensure that we do not reject requests supplied with a NULL GUID"""
 289
 290         if self.trust_realm is None:
 291             return
 292
 293         null_guid = GUID()
 294         try:
 295             response_trust = self._call_get_dc_name(domain=self.trust_realm,
 296                                                     domain_guid=null_guid,
 297                                                     flags=netlogon.DS_RETURN_DNS_NAME)
 298         except WERRORError as e:
 299             self.fail("Unable to get NULL domain GUID result: " + str(e))
 300
 301         self.assertTrue(response_trust.dc_unc is not None)
 302         self.assertTrue(response_trust.dc_unc.startswith('\\\\'))
 303         self.assertTrue(response_trust.dc_address is not None)
 304         self.assertTrue(response_trust.dc_address.startswith('\\\\'))
 305
 306         self.assertEqual(response_trust.domain_name.lower(),
 307                          self.trust_realm.lower())
 308
 309     def test_get_dc_with_site(self):
 310         """Test the standard Ex version (not Ex2)
 311
 312         We assume that there is a Default-First-Site-Name site.
 313         """
 314
 315         site = 'Default-First-Site-Name'
 316         response = self._call_get_dc_name(domain=self.realm,
 317                                           site_name=site,
 318                                           flags=netlogon.DS_RETURN_DNS_NAME)
 319
 320         self.assertTrue(response.dc_unc is not None)
 321         self.assertTrue(response.dc_unc.startswith('\\\\'))
 322         self.assertTrue(response.dc_address is not None)
 323         self.assertTrue(response.dc_address.startswith('\\\\'))
 324
 325         self.assertEqual(response.domain_name.lower(),
 326                          self.realm.lower())
 327
 328         self.assertEqual(site.lower(), response.dc_site_name.lower())
 329
 330     def test_get_dc_invalid_site(self):
 331         """Test the standard Ex version (not Ex2)
 332
 333         We assume that there is no Invalid-First-Site-Name site.
 334         """
 335         if self.realm is None:
 336             return
 337
 338         site = 'Invalid-First-Site-Name'
 339         try:
 340             response = self._call_get_dc_name(domain=self.realm,
 341                                               site_name=site,
 342                                               flags=netlogon.DS_RETURN_DNS_NAME,
 343                                               ex2=False)
 344             self.fail("Failed to give the correct error for incorrect site")
 345         except WERRORError as e:
 346             enum, estr = e.args
 347             if enum != werror.WERR_NO_SUCH_DOMAIN:
 348                 self.fail("Failed to detect an invalid site name")
 349
 350     def test_get_dc_invalid_site_ex2(self):
 351         """Test the Ex2 version
 352
 353         We assume that there is no Invalid-First-Site-Name site.
 354         """
 355
 356         site = 'Invalid-First-Site-Name'
 357         try:
 358             response = self._call_get_dc_name(domain=self.realm,
 359                                               site_name=site,
 360                                               flags=netlogon.DS_RETURN_DNS_NAME,
 361                                               ex2=True)
 362             self.fail("Failed to give the correct error for incorrect site")
 363         except WERRORError as e:
 364             enum, estr = e.args
 365             if enum != werror.WERR_NO_SUCH_DOMAIN:
 366                 self.fail("Failed to detect an invalid site name")
 367
 368     def test_get_dc_empty_string_site(self):
 369         """Test the standard Ex version (not Ex2)
 370
 371         We assume that there is a Default-First-Site-Name site.
 372         """
 373
 374         site = ''
 375         try:
 376             response = self._call_get_dc_name(domain=self.realm,
 377                                               site_name=site,
 378                                               flags=netlogon.DS_RETURN_DNS_NAME)
 379         except WERRORError as e:
 380             self.fail("Unable to get empty string site result: " + str(e))
 381
 382         self.assertTrue(response.dc_unc is not None)
 383         self.assertTrue(response.dc_unc.startswith('\\\\'))
 384         self.assertTrue(response.dc_address is not None)
 385         self.assertTrue(response.dc_address.startswith('\\\\'))
 386
 387         self.assertEqual(response.domain_name.lower(),
 388                          self.realm.lower())
 389
 390         self.assertTrue(response.dc_site_name is not None)
 391         self.assertNotEqual('', response.dc_site_name)
 392
 393     def test_get_dc_netbios(self):
 394         """Supply a NETBIOS domain name."""
 395
 396         try:
 397             response = self._call_get_dc_name(domain=self.domain,
 398                                               flags=netlogon.DS_RETURN_DNS_NAME,
 399                                               ex2=False)
 400         except WERRORError as e:
 401             self.fail("Failed to succeed over winbind: " + str(e))
 402
 403         self.assertTrue(response is not None)
 404         self.assertEqual(response.domain_name.lower(),
 405                          self.realm.lower())
 406
 407     def test_get_dc_with_site_netbios(self):
 408         """Supply a NETBIOS domain name."""
 409
 410         site = 'Default-First-Site-Name'
 411         try:
 412             response = self._call_get_dc_name(domain=self.domain,
 413                                               site_name=site,
 414                                               flags=netlogon.DS_RETURN_DNS_NAME,
 415                                               ex2=False)
 416         except WERRORError as e:
 417             self.fail("Failed to succeed over winbind: " + str(e))
 418
 419         self.assertTrue(response is not None)
 420         self.assertEqual(response.domain_name.lower(),
 421                          self.realm.lower())
 422
 423         self.assertEqual(site.lower(), response.dc_site_name.lower())
 424
 425     def test_get_dc_with_domain_guid(self):
 426         """Ensure that we do not reject requests supplied with a NULL GUID"""
 427
 428         null_guid = GUID()
 429         response = self._call_get_dc_name(domain=self.realm,
 430                                           domain_guid=null_guid,
 431                                           flags=netlogon.DS_RETURN_DNS_NAME)
 432
 433         self.assertTrue(response.dc_unc is not None)
 434         self.assertTrue(response.dc_unc.startswith('\\\\'))
 435         self.assertTrue(response.dc_address is not None)
 436         self.assertTrue(response.dc_address.startswith('\\\\'))
 437
 438         self.assertEqual(response.domain_name.lower(),
 439                          self.realm.lower())
 440
 441     def test_get_dc_with_empty_string_domain(self):
 442         """Ensure that empty domain resolve to the DC domain"""
 443         response = self._call_get_dc_name(domain='',
 444                                           flags=netlogon.DS_RETURN_DNS_NAME)
 445
 446         self.assertTrue(response.dc_unc is not None)
 447         self.assertTrue(response.dc_unc.startswith('\\\\'))
 448         self.assertTrue(response.dc_address is not None)
 449         self.assertTrue(response.dc_address.startswith('\\\\'))
 450
 451         self.assertEqual(response.domain_name.lower(),
 452                          self.realm.lower())
 453
 454     # TODO Thorough tests of domain GUID
 455     #
 456     # The domain GUID does not seem to be authoritative, and seems to be a
 457     # fallback case for renamed domains.