2 Unix SMB/CIFS implementation.
4 DsGetNCChanges replication test
6 Copyright (C) Stefan (metze) Metzmacher 2005
7 Copyright (C) Brad Henry 2005
9 This program is free software; you can redistribute it and/or modify
10 it under the terms of the GNU General Public License as published by
11 the Free Software Foundation; either version 3 of the License, or
12 (at your option) any later version.
14 This program is distributed in the hope that it will be useful,
15 but WITHOUT ANY WARRANTY; without even the implied warranty of
16 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
17 GNU General Public License for more details.
19 You should have received a copy of the GNU General Public License
20 along with this program. If not, see <http://www.gnu.org/licenses/>.
24 #include "lib/cmdline/popt_common.h"
25 #include "librpc/gen_ndr/ndr_drsuapi_c.h"
26 #include "librpc/gen_ndr/ndr_drsblobs.h"
27 #include "libcli/cldap/cldap.h"
28 #include "torture/torture.h"
29 #include "../libcli/drsuapi/drsuapi.h"
30 #include "auth/gensec/gensec.h"
31 #include "param/param.h"
32 #include "dsdb/samdb/samdb.h"
33 #include "torture/rpc/torture_rpc.h"
34 #include "torture/drs/proto.h"
35 #include "lib/tsocket/tsocket.h"
36 #include "libcli/resolve/resolve.h"
38 struct DsSyncBindInfo
{
39 struct dcerpc_pipe
*drs_pipe
;
40 struct dcerpc_binding_handle
*drs_handle
;
41 struct drsuapi_DsBind req
;
42 struct GUID bind_guid
;
43 struct drsuapi_DsBindInfoCtr our_bind_info_ctr
;
44 struct drsuapi_DsBindInfo28 our_bind_info28
;
45 struct drsuapi_DsBindInfo28 peer_bind_info28
;
46 struct policy_handle bind_handle
;
49 struct DsSyncLDAPInfo
{
50 struct ldb_context
*ldb
;
54 struct dcerpc_binding
*drsuapi_binding
;
57 const char *dest_address
;
58 const char *domain_dn
;
59 const char *config_dn
;
60 const char *schema_dn
;
62 /* what we need to do as 'Administrator' */
64 struct cli_credentials
*credentials
;
65 struct DsSyncBindInfo drsuapi
;
66 struct DsSyncLDAPInfo ldap
;
69 /* what we need to do as the new dc machine account */
71 struct cli_credentials
*credentials
;
72 struct DsSyncBindInfo drsuapi
;
73 struct drsuapi_DsGetDCInfo2 dc_info2
;
74 struct GUID invocation_id
;
75 struct GUID object_guid
;
78 /* info about the old dc */
80 struct drsuapi_DsGetDomainControllerInfo dc_info
;
84 static struct DsSyncTest
*test_create_context(struct torture_context
*tctx
)
87 struct DsSyncTest
*ctx
;
88 struct drsuapi_DsBindInfo28
*our_bind_info28
;
89 struct drsuapi_DsBindInfoCtr
*our_bind_info_ctr
;
90 const char *binding
= torture_setting_string(tctx
, "binding", NULL
);
94 ctx
= talloc_zero(tctx
, struct DsSyncTest
);
95 if (!ctx
) return NULL
;
97 status
= dcerpc_parse_binding(ctx
, binding
, &ctx
->drsuapi_binding
);
98 if (!NT_STATUS_IS_OK(status
)) {
99 printf("Bad binding string %s\n", binding
);
102 status
= dcerpc_binding_set_flags(ctx
->drsuapi_binding
,
103 DCERPC_SIGN
| DCERPC_SEAL
, 0);
104 if (!NT_STATUS_IS_OK(status
)) {
105 printf("dcerpc_binding_set_flags - %s\n", nt_errstr(status
));
109 host
= dcerpc_binding_get_string_option(ctx
->drsuapi_binding
, "host");
111 ctx
->ldap_url
= talloc_asprintf(ctx
, "ldap://%s", host
);
113 make_nbt_name_server(&name
, host
);
115 /* do an initial name resolution to find its IP */
116 status
= resolve_name_ex(lpcfg_resolve_context(tctx
->lp_ctx
),
118 &ctx
->dest_address
, tctx
->ev
);
119 if (!NT_STATUS_IS_OK(status
)) {
120 printf("Failed to resolve %s - %s\n",
121 name
.name
, nt_errstr(status
));
126 ctx
->admin
.credentials
= cmdline_credentials
;
128 our_bind_info28
= &ctx
->admin
.drsuapi
.our_bind_info28
;
129 our_bind_info28
->supported_extensions
= 0xFFFFFFFF;
130 our_bind_info28
->supported_extensions
|= DRSUAPI_SUPPORTED_EXTENSION_ADDENTRYREPLY_V3
;
131 our_bind_info28
->site_guid
= GUID_zero();
132 our_bind_info28
->pid
= 0;
133 our_bind_info28
->repl_epoch
= 1;
135 our_bind_info_ctr
= &ctx
->admin
.drsuapi
.our_bind_info_ctr
;
136 our_bind_info_ctr
->length
= 28;
137 our_bind_info_ctr
->info
.info28
= *our_bind_info28
;
139 GUID_from_string(DRSUAPI_DS_BIND_GUID
, &ctx
->admin
.drsuapi
.bind_guid
);
141 ctx
->admin
.drsuapi
.req
.in
.bind_guid
= &ctx
->admin
.drsuapi
.bind_guid
;
142 ctx
->admin
.drsuapi
.req
.in
.bind_info
= our_bind_info_ctr
;
143 ctx
->admin
.drsuapi
.req
.out
.bind_handle
= &ctx
->admin
.drsuapi
.bind_handle
;
146 ctx
->new_dc
.credentials
= cmdline_credentials
;
148 our_bind_info28
= &ctx
->new_dc
.drsuapi
.our_bind_info28
;
149 our_bind_info28
->supported_extensions
|= DRSUAPI_SUPPORTED_EXTENSION_BASE
;
150 our_bind_info28
->supported_extensions
|= DRSUAPI_SUPPORTED_EXTENSION_ASYNC_REPLICATION
;
151 our_bind_info28
->supported_extensions
|= DRSUAPI_SUPPORTED_EXTENSION_REMOVEAPI
;
152 our_bind_info28
->supported_extensions
|= DRSUAPI_SUPPORTED_EXTENSION_MOVEREQ_V2
;
153 our_bind_info28
->supported_extensions
|= DRSUAPI_SUPPORTED_EXTENSION_GETCHG_COMPRESS
;
154 our_bind_info28
->supported_extensions
|= DRSUAPI_SUPPORTED_EXTENSION_DCINFO_V1
;
155 our_bind_info28
->supported_extensions
|= DRSUAPI_SUPPORTED_EXTENSION_RESTORE_USN_OPTIMIZATION
;
156 our_bind_info28
->supported_extensions
|= DRSUAPI_SUPPORTED_EXTENSION_KCC_EXECUTE
;
157 our_bind_info28
->supported_extensions
|= DRSUAPI_SUPPORTED_EXTENSION_ADDENTRY_V2
;
158 our_bind_info28
->supported_extensions
|= DRSUAPI_SUPPORTED_EXTENSION_LINKED_VALUE_REPLICATION
;
159 our_bind_info28
->supported_extensions
|= DRSUAPI_SUPPORTED_EXTENSION_DCINFO_V2
;
160 our_bind_info28
->supported_extensions
|= DRSUAPI_SUPPORTED_EXTENSION_INSTANCE_TYPE_NOT_REQ_ON_MOD
;
161 our_bind_info28
->supported_extensions
|= DRSUAPI_SUPPORTED_EXTENSION_CRYPTO_BIND
;
162 our_bind_info28
->supported_extensions
|= DRSUAPI_SUPPORTED_EXTENSION_GET_REPL_INFO
;
163 our_bind_info28
->supported_extensions
|= DRSUAPI_SUPPORTED_EXTENSION_STRONG_ENCRYPTION
;
164 our_bind_info28
->supported_extensions
|= DRSUAPI_SUPPORTED_EXTENSION_DCINFO_V01
;
165 our_bind_info28
->supported_extensions
|= DRSUAPI_SUPPORTED_EXTENSION_TRANSITIVE_MEMBERSHIP
;
166 our_bind_info28
->supported_extensions
|= DRSUAPI_SUPPORTED_EXTENSION_ADD_SID_HISTORY
;
167 our_bind_info28
->supported_extensions
|= DRSUAPI_SUPPORTED_EXTENSION_POST_BETA3
;
168 our_bind_info28
->supported_extensions
|= DRSUAPI_SUPPORTED_EXTENSION_GET_MEMBERSHIPS2
;
169 our_bind_info28
->supported_extensions
|= DRSUAPI_SUPPORTED_EXTENSION_GETCHGREQ_V6
;
170 our_bind_info28
->supported_extensions
|= DRSUAPI_SUPPORTED_EXTENSION_NONDOMAIN_NCS
;
171 our_bind_info28
->supported_extensions
|= DRSUAPI_SUPPORTED_EXTENSION_GETCHGREQ_V8
;
172 our_bind_info28
->supported_extensions
|= DRSUAPI_SUPPORTED_EXTENSION_GETCHGREPLY_V5
;
173 our_bind_info28
->supported_extensions
|= DRSUAPI_SUPPORTED_EXTENSION_GETCHGREPLY_V6
;
174 our_bind_info28
->supported_extensions
|= DRSUAPI_SUPPORTED_EXTENSION_ADDENTRYREPLY_V3
;
175 our_bind_info28
->supported_extensions
|= DRSUAPI_SUPPORTED_EXTENSION_GETCHGREPLY_V7
;
176 our_bind_info28
->supported_extensions
|= DRSUAPI_SUPPORTED_EXTENSION_VERIFY_OBJECT
;
177 if (lpcfg_parm_bool(tctx
->lp_ctx
, NULL
, "dssync", "xpress", false)) {
178 our_bind_info28
->supported_extensions
|= DRSUAPI_SUPPORTED_EXTENSION_XPRESS_COMPRESS
;
180 our_bind_info28
->site_guid
= GUID_zero();
181 our_bind_info28
->pid
= 0;
182 our_bind_info28
->repl_epoch
= 0;
184 our_bind_info_ctr
= &ctx
->new_dc
.drsuapi
.our_bind_info_ctr
;
185 our_bind_info_ctr
->length
= 28;
186 our_bind_info_ctr
->info
.info28
= *our_bind_info28
;
188 GUID_from_string(DRSUAPI_DS_BIND_GUID_W2K3
, &ctx
->new_dc
.drsuapi
.bind_guid
);
190 ctx
->new_dc
.drsuapi
.req
.in
.bind_guid
= &ctx
->new_dc
.drsuapi
.bind_guid
;
191 ctx
->new_dc
.drsuapi
.req
.in
.bind_info
= our_bind_info_ctr
;
192 ctx
->new_dc
.drsuapi
.req
.out
.bind_handle
= &ctx
->new_dc
.drsuapi
.bind_handle
;
194 ctx
->new_dc
.invocation_id
= ctx
->new_dc
.drsuapi
.bind_guid
;
201 static bool _test_DsBind(struct torture_context
*tctx
,
202 struct DsSyncTest
*ctx
, struct cli_credentials
*credentials
, struct DsSyncBindInfo
*b
)
207 status
= dcerpc_pipe_connect_b(ctx
,
208 &b
->drs_pipe
, ctx
->drsuapi_binding
,
210 credentials
, tctx
->ev
, tctx
->lp_ctx
);
212 if (!NT_STATUS_IS_OK(status
)) {
213 printf("Failed to connect to server as a BDC: %s\n", nt_errstr(status
));
216 b
->drs_handle
= b
->drs_pipe
->binding_handle
;
218 status
= dcerpc_drsuapi_DsBind_r(b
->drs_handle
, ctx
, &b
->req
);
219 if (!NT_STATUS_IS_OK(status
)) {
220 const char *errstr
= nt_errstr(status
);
221 printf("dcerpc_drsuapi_DsBind failed - %s\n", errstr
);
223 } else if (!W_ERROR_IS_OK(b
->req
.out
.result
)) {
224 printf("DsBind failed - %s\n", win_errstr(b
->req
.out
.result
));
228 ZERO_STRUCT(b
->peer_bind_info28
);
229 if (b
->req
.out
.bind_info
) {
230 switch (b
->req
.out
.bind_info
->length
) {
232 struct drsuapi_DsBindInfo24
*info24
;
233 info24
= &b
->req
.out
.bind_info
->info
.info24
;
234 b
->peer_bind_info28
.supported_extensions
= info24
->supported_extensions
;
235 b
->peer_bind_info28
.site_guid
= info24
->site_guid
;
236 b
->peer_bind_info28
.pid
= info24
->pid
;
237 b
->peer_bind_info28
.repl_epoch
= 0;
241 struct drsuapi_DsBindInfo48
*info48
;
242 info48
= &b
->req
.out
.bind_info
->info
.info48
;
243 b
->peer_bind_info28
.supported_extensions
= info48
->supported_extensions
;
244 b
->peer_bind_info28
.site_guid
= info48
->site_guid
;
245 b
->peer_bind_info28
.pid
= info48
->pid
;
246 b
->peer_bind_info28
.repl_epoch
= info48
->repl_epoch
;
250 b
->peer_bind_info28
= b
->req
.out
.bind_info
->info
.info28
;
253 printf("DsBind - warning: unknown BindInfo length: %u\n",
254 b
->req
.out
.bind_info
->length
);
261 static bool test_LDAPBind(struct torture_context
*tctx
, struct DsSyncTest
*ctx
,
262 struct cli_credentials
*credentials
, struct DsSyncLDAPInfo
*l
)
266 struct ldb_context
*ldb
;
268 const char *modules_option
[] = { "modules:paged_searches", NULL
};
269 ctx
->admin
.ldap
.ldb
= ldb
= ldb_init(ctx
, tctx
->ev
);
274 /* Despite us loading the schema from the AD server, we need
275 * the samba handlers to get the extended DN syntax stuff */
276 ret
= ldb_register_samba_handlers(ldb
);
277 if (ret
!= LDB_SUCCESS
) {
282 ldb_set_modules_dir(ldb
, modules_path(ldb
, "ldb"));
284 if (ldb_set_opaque(ldb
, "credentials", credentials
)) {
289 if (ldb_set_opaque(ldb
, "loadparm", tctx
->lp_ctx
)) {
294 ret
= ldb_connect(ldb
, ctx
->ldap_url
, 0, modules_option
);
295 if (ret
!= LDB_SUCCESS
) {
297 torture_assert_int_equal(tctx
, ret
, LDB_SUCCESS
, "Failed to make LDB connection to target");
300 printf("connected to LDAP: %s\n", ctx
->ldap_url
);
305 static bool test_GetInfo(struct torture_context
*tctx
, struct DsSyncTest
*ctx
)
307 struct ldb_context
*ldb
= ctx
->admin
.ldap
.ldb
;
309 /* We must have LDB connection ready by this time */
310 SMB_ASSERT(ldb
!= NULL
);
312 ctx
->domain_dn
= ldb_dn_get_linearized(ldb_get_default_basedn(ldb
));
313 torture_assert(tctx
, ctx
->domain_dn
!= NULL
, "Failed to get Domain DN");
315 ctx
->config_dn
= ldb_dn_get_linearized(ldb_get_config_basedn(ldb
));
316 torture_assert(tctx
, ctx
->config_dn
!= NULL
, "Failed to get Domain DN");
318 ctx
->schema_dn
= ldb_dn_get_linearized(ldb_get_schema_basedn(ldb
));
319 torture_assert(tctx
, ctx
->schema_dn
!= NULL
, "Failed to get Domain DN");
324 static bool test_analyse_objects(struct torture_context
*tctx
,
325 struct DsSyncTest
*ctx
,
326 const char *partition
,
327 const struct drsuapi_DsReplicaOIDMapping_Ctr
*mapping_ctr
,
328 uint32_t object_count
,
329 const struct drsuapi_DsReplicaObjectListItemEx
*first_object
,
330 const DATA_BLOB
*gensec_skey
)
332 static uint32_t object_id
;
333 const char *save_values_dir
;
334 const struct drsuapi_DsReplicaObjectListItemEx
*cur
;
335 struct ldb_context
*ldb
= ctx
->admin
.ldap
.ldb
;
336 struct ldb_dn
*deleted_dn
;
339 struct dsdb_extended_replicated_objects
*objs
;
340 struct ldb_extended_dn_control
*extended_dn_ctrl
;
341 struct dsdb_schema
*ldap_schema
;
343 /* load dsdb_schema using remote prefixMap */
345 drs_util_dsdb_schema_load_ldb(tctx
, ldb
, mapping_ctr
, false),
346 "drs_util_dsdb_schema_load_ldb() failed");
347 ldap_schema
= dsdb_get_schema(ldb
, NULL
);
349 status
= dsdb_replicated_objects_convert(ldb
,
360 torture_assert_werr_ok(tctx
, status
, "dsdb_extended_replicated_objects_convert() failed!");
362 extended_dn_ctrl
= talloc(objs
, struct ldb_extended_dn_control
);
363 extended_dn_ctrl
->type
= 1;
365 deleted_dn
= ldb_dn_new(objs
, ldb
, partition
);
366 ldb_dn_add_child_fmt(deleted_dn
, "CN=Deleted Objects");
368 for (i
=0; i
< object_count
; i
++) {
369 struct ldb_request
*search_req
;
370 struct ldb_result
*res
;
371 struct ldb_message
*new_msg
, *drs_msg
, *ldap_msg
;
372 const char **attrs
= talloc_array(objs
, const char *, objs
->objects
[i
].msg
->num_elements
+1);
373 for (j
=0; j
< objs
->objects
[i
].msg
->num_elements
; j
++) {
374 attrs
[j
] = objs
->objects
[i
].msg
->elements
[j
].name
;
377 res
= talloc_zero(objs
, struct ldb_result
);
379 return LDB_ERR_OPERATIONS_ERROR
;
381 ret
= ldb_build_search_req(&search_req
, ldb
, objs
,
382 objs
->objects
[i
].msg
->dn
,
388 ldb_search_default_callback
,
390 if (ret
!= LDB_SUCCESS
) {
393 talloc_steal(search_req
, res
);
394 ret
= ldb_request_add_control(search_req
, LDB_CONTROL_SHOW_DELETED_OID
, true, NULL
);
395 if (ret
!= LDB_SUCCESS
) {
399 ret
= ldb_request_add_control(search_req
, LDB_CONTROL_EXTENDED_DN_OID
, true, extended_dn_ctrl
);
400 if (ret
!= LDB_SUCCESS
) {
404 ret
= ldb_request(ldb
, search_req
);
405 if (ret
== LDB_SUCCESS
) {
406 ret
= ldb_wait(search_req
->handle
, LDB_WAIT_ALL
);
409 torture_assert_int_equal(tctx
, ret
, LDB_SUCCESS
,
410 talloc_asprintf(tctx
,
411 "Could not re-fetch object just delivered over DRS: %s",
412 ldb_errstring(ldb
)));
413 torture_assert_int_equal(tctx
, res
->count
, 1, "Could not re-fetch object just delivered over DRS");
414 ldap_msg
= res
->msgs
[0];
415 for (j
=0; j
< ldap_msg
->num_elements
; j
++) {
416 ldap_msg
->elements
[j
].flags
= LDB_FLAG_MOD_ADD
;
417 /* For unknown reasons, there is no nTSecurityDescriptor on cn=deleted objects over LDAP, but there is over DRS! Skip it on both transports for now here so */
418 if ((ldb_attr_cmp(ldap_msg
->elements
[j
].name
, "nTSecurityDescriptor") == 0) &&
419 (ldb_dn_compare(ldap_msg
->dn
, deleted_dn
) == 0)) {
420 ldb_msg_remove_element(ldap_msg
, &ldap_msg
->elements
[j
]);
426 ret
= ldb_msg_normalize(ldb
, search_req
,
427 objs
->objects
[i
].msg
, &drs_msg
);
428 torture_assert(tctx
, ret
== LDB_SUCCESS
,
429 "ldb_msg_normalize() has failed");
431 for (j
=0; j
< drs_msg
->num_elements
; j
++) {
432 if (drs_msg
->elements
[j
].num_values
== 0) {
433 ldb_msg_remove_element(drs_msg
, &drs_msg
->elements
[j
]);
437 /* For unknown reasons, there is no nTSecurityDescriptor on cn=deleted objects over LDAP, but there is over DRS! */
438 } else if ((ldb_attr_cmp(drs_msg
->elements
[j
].name
, "nTSecurityDescriptor") == 0) &&
439 (ldb_dn_compare(drs_msg
->dn
, deleted_dn
) == 0)) {
440 ldb_msg_remove_element(drs_msg
, &drs_msg
->elements
[j
]);
443 } else if (ldb_attr_cmp(drs_msg
->elements
[j
].name
, "unicodePwd") == 0 ||
444 ldb_attr_cmp(drs_msg
->elements
[j
].name
, "dBCSPwd") == 0 ||
445 ldb_attr_cmp(drs_msg
->elements
[j
].name
, "ntPwdHistory") == 0 ||
446 ldb_attr_cmp(drs_msg
->elements
[j
].name
, "lmPwdHistory") == 0 ||
447 ldb_attr_cmp(drs_msg
->elements
[j
].name
, "supplementalCredentials") == 0 ||
448 ldb_attr_cmp(drs_msg
->elements
[j
].name
, "priorValue") == 0 ||
449 ldb_attr_cmp(drs_msg
->elements
[j
].name
, "currentValue") == 0 ||
450 ldb_attr_cmp(drs_msg
->elements
[j
].name
, "trustAuthOutgoing") == 0 ||
451 ldb_attr_cmp(drs_msg
->elements
[j
].name
, "trustAuthIncoming") == 0 ||
452 ldb_attr_cmp(drs_msg
->elements
[j
].name
, "initialAuthOutgoing") == 0 ||
453 ldb_attr_cmp(drs_msg
->elements
[j
].name
, "initialAuthIncoming") == 0) {
455 /* These are not shown over LDAP, so we need to skip them for the comparison */
456 ldb_msg_remove_element(drs_msg
, &drs_msg
->elements
[j
]);
460 drs_msg
->elements
[j
].flags
= LDB_FLAG_MOD_ADD
;
465 ret
= ldb_msg_difference(ldb
, search_req
,
466 drs_msg
, ldap_msg
, &new_msg
);
467 torture_assert(tctx
, ret
== LDB_SUCCESS
, "ldb_msg_difference() has failed");
468 if (new_msg
->num_elements
!= 0) {
470 bool is_warning
= true;
472 struct ldb_message_element
*el
;
473 const struct dsdb_attribute
* a
;
474 struct ldb_ldif ldif
;
475 ldif
.changetype
= LDB_CHANGETYPE_MODIFY
;
477 s
= ldb_ldif_write_string(ldb
, new_msg
, &ldif
);
478 s
= talloc_asprintf(tctx
, "\n# Difference in between DRS and LDAP objects: \n%s", s
);
480 ret
= ldb_msg_difference(ldb
, search_req
,
481 ldap_msg
, drs_msg
, &ldif
.msg
);
482 torture_assert(tctx
, ret
== LDB_SUCCESS
, "ldb_msg_difference() has failed");
483 s
= talloc_asprintf_append(s
,
484 "\n# Difference in between LDAP and DRS objects: \n%s",
485 ldb_ldif_write_string(ldb
, new_msg
, &ldif
));
487 s
= talloc_asprintf_append(s
,
488 "# Should have no objects in 'difference' message. Diff elements: %d",
489 new_msg
->num_elements
);
492 * In case differences in messages are:
493 * 1. Attributes with different values, i.e. 'replace'
494 * 2. Those attributes are forward-link attributes
495 * then we just warn about those differences.
496 * It turns out windows doesn't send all of those values
497 * in replicated_object but in linked_attributes.
499 for (idx
= 0; idx
< new_msg
->num_elements
&& is_warning
; idx
++) {
500 el
= &new_msg
->elements
[idx
];
501 a
= dsdb_attribute_by_lDAPDisplayName(ldap_schema
,
503 if (!(el
->flags
& (LDB_FLAG_MOD_ADD
|LDB_FLAG_MOD_REPLACE
))) {
506 } else if (a
->linkID
& 1) {
511 torture_warning(tctx
, "%s", s
);
513 torture_fail(tctx
, s
);
517 /* search_req is used as a tmp talloc context in the above */
518 talloc_free(search_req
);
521 if (!lpcfg_parm_bool(tctx
->lp_ctx
, NULL
, "dssync", "print_pwd_blobs", false)) {
526 save_values_dir
= lpcfg_parm_string(tctx
->lp_ctx
, NULL
, "dssync", "save_pwd_blobs_dir");
528 for (cur
= first_object
; cur
; cur
= cur
->next_object
) {
530 bool dn_printed
= false;
532 if (!cur
->object
.identifier
) continue;
534 dn
= cur
->object
.identifier
->dn
;
536 for (i
=0; i
< cur
->object
.attribute_ctr
.num_attributes
; i
++) {
537 const char *name
= NULL
;
538 DATA_BLOB plain_data
;
539 struct drsuapi_DsReplicaAttribute
*attr
;
540 ndr_pull_flags_fn_t pull_fn
= NULL
;
541 ndr_print_fn_t print_fn
= NULL
;
543 attr
= &cur
->object
.attribute_ctr
.attributes
[i
];
545 switch (attr
->attid
) {
546 case DRSUAPI_ATTID_dBCSPwd
:
549 case DRSUAPI_ATTID_unicodePwd
:
552 case DRSUAPI_ATTID_ntPwdHistory
:
553 name
= "ntPwdHistory";
555 case DRSUAPI_ATTID_lmPwdHistory
:
556 name
= "lmPwdHistory";
558 case DRSUAPI_ATTID_supplementalCredentials
:
559 name
= "supplementalCredentials";
560 pull_fn
= (ndr_pull_flags_fn_t
)ndr_pull_supplementalCredentialsBlob
;
561 print_fn
= (ndr_print_fn_t
)ndr_print_supplementalCredentialsBlob
;
562 ptr
= talloc(ctx
, struct supplementalCredentialsBlob
);
564 case DRSUAPI_ATTID_priorValue
:
567 case DRSUAPI_ATTID_currentValue
:
568 name
= "currentValue";
570 case DRSUAPI_ATTID_trustAuthOutgoing
:
571 name
= "trustAuthOutgoing";
572 pull_fn
= (ndr_pull_flags_fn_t
)ndr_pull_trustAuthInOutBlob
;
573 print_fn
= (ndr_print_fn_t
)ndr_print_trustAuthInOutBlob
;
574 ptr
= talloc(ctx
, struct trustAuthInOutBlob
);
576 case DRSUAPI_ATTID_trustAuthIncoming
:
577 name
= "trustAuthIncoming";
578 pull_fn
= (ndr_pull_flags_fn_t
)ndr_pull_trustAuthInOutBlob
;
579 print_fn
= (ndr_print_fn_t
)ndr_print_trustAuthInOutBlob
;
580 ptr
= talloc(ctx
, struct trustAuthInOutBlob
);
582 case DRSUAPI_ATTID_initialAuthOutgoing
:
583 name
= "initialAuthOutgoing";
585 case DRSUAPI_ATTID_initialAuthIncoming
:
586 name
= "initialAuthIncoming";
592 if (attr
->value_ctr
.num_values
!= 1) continue;
594 if (!attr
->value_ctr
.values
[0].blob
) continue;
596 plain_data
= *attr
->value_ctr
.values
[0].blob
;
600 DEBUG(0,("DN[%u] %s\n", object_id
, dn
));
603 DEBUGADD(0,("ATTR: %s plain.length=%lu\n",
604 name
, (long)plain_data
.length
));
605 if (plain_data
.length
) {
606 enum ndr_err_code ndr_err
;
607 dump_data(0, plain_data
.data
, plain_data
.length
);
608 if (save_values_dir
) {
610 fname
= talloc_asprintf(ctx
, "%s/%s%02d",
615 ok
= file_save(fname
, plain_data
.data
, plain_data
.length
);
617 DEBUGADD(0,("Failed to save '%s'\n", fname
));
624 /* Can't use '_all' because of PIDL bugs with relative pointers */
625 ndr_err
= ndr_pull_struct_blob(&plain_data
, ptr
,
627 if (NDR_ERR_CODE_IS_SUCCESS(ndr_err
)) {
628 ndr_print_debug(print_fn
, name
, ptr
);
630 DEBUG(0, ("Failed to decode %s\n", name
));
641 static bool test_GetNCChanges(struct torture_context
*tctx
,
642 struct DsSyncTest
*ctx
,
643 const char *nc_dn_str
)
648 uint64_t highest_usn
= 0;
649 struct drsuapi_DsGetNCChanges r
;
650 union drsuapi_DsGetNCChangesRequest req
;
651 struct drsuapi_DsReplicaObjectIdentifier nc
;
652 struct drsuapi_DsGetNCChangesCtr1
*ctr1
= NULL
;
653 struct drsuapi_DsGetNCChangesCtr6
*ctr6
= NULL
;
654 uint32_t out_level
= 0;
655 struct GUID null_guid
;
656 struct dom_sid null_sid
;
657 DATA_BLOB gensec_skey
;
669 ZERO_STRUCT(null_guid
);
670 ZERO_STRUCT(null_sid
);
672 highest_usn
= lpcfg_parm_int(tctx
->lp_ctx
, NULL
, "dssync", "highest_usn", 0);
674 array
[0].level
= lpcfg_parm_int(tctx
->lp_ctx
, NULL
, "dssync", "get_nc_changes_level", array
[0].level
);
676 if (lpcfg_parm_bool(tctx
->lp_ctx
, NULL
, "dssync", "print_pwd_blobs", false)) {
677 const struct samr_Password
*nthash
;
678 nthash
= cli_credentials_get_nt_hash(ctx
->new_dc
.credentials
, ctx
);
680 dump_data_pw("CREDENTIALS nthash:", nthash
->hash
, sizeof(nthash
->hash
));
683 status
= gensec_session_key(ctx
->new_dc
.drsuapi
.drs_pipe
->conn
->security_state
.generic_state
,
685 if (!NT_STATUS_IS_OK(status
)) {
686 printf("failed to get gensec session key: %s\n", nt_errstr(status
));
690 for (i
=0; i
< ARRAY_SIZE(array
); i
++) {
691 printf("Testing DsGetNCChanges level %d\n",
694 r
.in
.bind_handle
= &ctx
->new_dc
.drsuapi
.bind_handle
;
695 r
.in
.level
= array
[i
].level
;
697 switch (r
.in
.level
) {
704 r
.in
.req
->req5
.destination_dsa_guid
= ctx
->new_dc
.invocation_id
;
705 r
.in
.req
->req5
.source_dsa_invocation_id
= null_guid
;
706 r
.in
.req
->req5
.naming_context
= &nc
;
707 r
.in
.req
->req5
.highwatermark
.tmp_highest_usn
= highest_usn
;
708 r
.in
.req
->req5
.highwatermark
.reserved_usn
= 0;
709 r
.in
.req
->req5
.highwatermark
.highest_usn
= highest_usn
;
710 r
.in
.req
->req5
.uptodateness_vector
= NULL
;
711 r
.in
.req
->req5
.replica_flags
= 0;
712 if (lpcfg_parm_bool(tctx
->lp_ctx
, NULL
, "dssync", "compression", false)) {
713 r
.in
.req
->req5
.replica_flags
|= DRSUAPI_DRS_USE_COMPRESSION
;
715 if (lpcfg_parm_bool(tctx
->lp_ctx
, NULL
, "dssync", "neighbour_writeable", true)) {
716 r
.in
.req
->req5
.replica_flags
|= DRSUAPI_DRS_WRIT_REP
;
718 r
.in
.req
->req5
.replica_flags
|= DRSUAPI_DRS_INIT_SYNC
719 | DRSUAPI_DRS_PER_SYNC
720 | DRSUAPI_DRS_GET_ANC
721 | DRSUAPI_DRS_NEVER_SYNCED
723 r
.in
.req
->req5
.max_object_count
= 133;
724 r
.in
.req
->req5
.max_ndr_size
= 1336770;
725 r
.in
.req
->req5
.extended_op
= DRSUAPI_EXOP_NONE
;
726 r
.in
.req
->req5
.fsmo_info
= 0;
733 /* nc.dn can be set to any other ad partition */
736 r
.in
.req
->req8
.destination_dsa_guid
= ctx
->new_dc
.invocation_id
;
737 r
.in
.req
->req8
.source_dsa_invocation_id
= null_guid
;
738 r
.in
.req
->req8
.naming_context
= &nc
;
739 r
.in
.req
->req8
.highwatermark
.tmp_highest_usn
= highest_usn
;
740 r
.in
.req
->req8
.highwatermark
.reserved_usn
= 0;
741 r
.in
.req
->req8
.highwatermark
.highest_usn
= highest_usn
;
742 r
.in
.req
->req8
.uptodateness_vector
= NULL
;
743 r
.in
.req
->req8
.replica_flags
= 0;
744 if (lpcfg_parm_bool(tctx
->lp_ctx
, NULL
, "dssync", "compression", false)) {
745 r
.in
.req
->req8
.replica_flags
|= DRSUAPI_DRS_USE_COMPRESSION
;
747 if (lpcfg_parm_bool(tctx
->lp_ctx
, NULL
, "dssync", "neighbour_writeable", true)) {
748 r
.in
.req
->req8
.replica_flags
|= DRSUAPI_DRS_WRIT_REP
;
750 r
.in
.req
->req8
.replica_flags
|= DRSUAPI_DRS_INIT_SYNC
751 | DRSUAPI_DRS_PER_SYNC
752 | DRSUAPI_DRS_GET_ANC
753 | DRSUAPI_DRS_NEVER_SYNCED
755 r
.in
.req
->req8
.max_object_count
= 402;
756 r
.in
.req
->req8
.max_ndr_size
= 402116;
758 r
.in
.req
->req8
.extended_op
= DRSUAPI_EXOP_NONE
;
759 r
.in
.req
->req8
.fsmo_info
= 0;
760 r
.in
.req
->req8
.partial_attribute_set
= NULL
;
761 r
.in
.req
->req8
.partial_attribute_set_ex
= NULL
;
762 r
.in
.req
->req8
.mapping_ctr
.num_mappings
= 0;
763 r
.in
.req
->req8
.mapping_ctr
.mappings
= NULL
;
770 union drsuapi_DsGetNCChangesCtr ctr
;
774 r
.out
.level_out
= &_level
;
777 if (r
.in
.level
== 5) {
778 torture_comment(tctx
,
779 "start[%d] tmp_higest_usn: %llu , highest_usn: %llu\n",
781 (unsigned long long) r
.in
.req
->req5
.highwatermark
.tmp_highest_usn
,
782 (unsigned long long) r
.in
.req
->req5
.highwatermark
.highest_usn
);
785 if (r
.in
.level
== 8) {
786 torture_comment(tctx
,
787 "start[%d] tmp_higest_usn: %llu , highest_usn: %llu\n",
789 (unsigned long long) r
.in
.req
->req8
.highwatermark
.tmp_highest_usn
,
790 (unsigned long long) r
.in
.req
->req8
.highwatermark
.highest_usn
);
793 status
= dcerpc_drsuapi_DsGetNCChanges_r(ctx
->new_dc
.drsuapi
.drs_handle
, ctx
, &r
);
794 torture_drsuapi_assert_call(tctx
, ctx
->new_dc
.drsuapi
.drs_pipe
, status
,
795 &r
, "dcerpc_drsuapi_DsGetNCChanges");
797 if (ret
== true && *r
.out
.level_out
== 1) {
799 ctr1
= &r
.out
.ctr
->ctr1
;
800 } else if (ret
== true && *r
.out
.level_out
== 2 &&
801 r
.out
.ctr
->ctr2
.mszip1
.ts
) {
803 ctr1
= &r
.out
.ctr
->ctr2
.mszip1
.ts
->ctr1
;
806 if (out_level
== 1) {
807 torture_comment(tctx
,
808 "end[%d] tmp_highest_usn: %llu , highest_usn: %llu\n",
810 (unsigned long long) ctr1
->new_highwatermark
.tmp_highest_usn
,
811 (unsigned long long) ctr1
->new_highwatermark
.highest_usn
);
813 if (!test_analyse_objects(tctx
, ctx
, nc_dn_str
, &ctr1
->mapping_ctr
, ctr1
->object_count
,
814 ctr1
->first_object
, &gensec_skey
)) {
818 if (ctr1
->more_data
) {
819 r
.in
.req
->req5
.highwatermark
= ctr1
->new_highwatermark
;
824 if (ret
== true && *r
.out
.level_out
== 6) {
826 ctr6
= &r
.out
.ctr
->ctr6
;
827 } else if (ret
== true && *r
.out
.level_out
== 7
828 && r
.out
.ctr
->ctr7
.level
== 6
829 && r
.out
.ctr
->ctr7
.type
== DRSUAPI_COMPRESSION_TYPE_MSZIP
830 && r
.out
.ctr
->ctr7
.ctr
.mszip6
.ts
) {
832 ctr6
= &r
.out
.ctr
->ctr7
.ctr
.mszip6
.ts
->ctr6
;
833 } else if (ret
== true && *r
.out
.level_out
== 7
834 && r
.out
.ctr
->ctr7
.level
== 6
835 && r
.out
.ctr
->ctr7
.type
== DRSUAPI_COMPRESSION_TYPE_XPRESS
836 && r
.out
.ctr
->ctr7
.ctr
.xpress6
.ts
) {
838 ctr6
= &r
.out
.ctr
->ctr7
.ctr
.xpress6
.ts
->ctr6
;
841 if (out_level
== 6) {
842 torture_comment(tctx
,
843 "end[%d] tmp_highest_usn: %llu , highest_usn: %llu\n",
845 (unsigned long long) ctr6
->new_highwatermark
.tmp_highest_usn
,
846 (unsigned long long) ctr6
->new_highwatermark
.highest_usn
);
848 if (!test_analyse_objects(tctx
, ctx
, nc_dn_str
, &ctr6
->mapping_ctr
, ctr6
->object_count
,
849 ctr6
->first_object
, &gensec_skey
)) {
853 if (ctr6
->more_data
) {
854 r
.in
.req
->req8
.highwatermark
= ctr6
->new_highwatermark
;
867 * Test DsGetNCChanges() DRSUAPI call against one
868 * or more Naming Contexts.
869 * Specific NC to test with may be supplied
870 * in lp_ctx configuration. If no NC is specified,
871 * it will test DsGetNCChanges() on all NCs on remote DC
873 static bool test_FetchData(struct torture_context
*tctx
, struct DsSyncTest
*ctx
)
877 const char *nc_dn_str
;
878 const char **nc_list
;
880 nc_list
= const_str_list(str_list_make_empty(ctx
));
881 torture_assert(tctx
, nc_list
, "Not enough memory!");
883 /* make a list of partitions to test with */
884 nc_dn_str
= lpcfg_parm_string(tctx
->lp_ctx
, NULL
, "dssync", "partition");
885 if (nc_dn_str
== NULL
) {
886 nc_list
= str_list_add_const(nc_list
, ctx
->domain_dn
);
887 nc_list
= str_list_add_const(nc_list
, ctx
->config_dn
);
888 nc_list
= str_list_add_const(nc_list
, ctx
->schema_dn
);
890 nc_list
= str_list_add_const(nc_list
, nc_dn_str
);
893 count
= str_list_length(nc_list
);
894 for (i
= 0; i
< count
&& ret
; i
++) {
895 torture_comment(tctx
, "\nNaming Context: %s\n", nc_list
[i
]);
896 ret
= test_GetNCChanges(tctx
, ctx
, nc_list
[i
]);
899 talloc_free(nc_list
);
904 static bool test_FetchNT4Data(struct torture_context
*tctx
,
905 struct DsSyncTest
*ctx
)
908 struct drsuapi_DsGetNT4ChangeLog r
;
909 union drsuapi_DsGetNT4ChangeLogRequest req
;
910 union drsuapi_DsGetNT4ChangeLogInfo info
;
911 uint32_t level_out
= 0;
912 struct GUID null_guid
;
913 struct dom_sid null_sid
;
916 ZERO_STRUCT(null_guid
);
917 ZERO_STRUCT(null_sid
);
921 r
.in
.bind_handle
= &ctx
->new_dc
.drsuapi
.bind_handle
;
924 r
.out
.level_out
= &level_out
;
926 req
.req1
.flags
= lpcfg_parm_int(tctx
->lp_ctx
, NULL
,
927 "dssync", "nt4changelog_flags",
928 DRSUAPI_NT4_CHANGELOG_GET_CHANGELOG
|
929 DRSUAPI_NT4_CHANGELOG_GET_SERIAL_NUMBERS
);
930 req
.req1
.preferred_maximum_length
= lpcfg_parm_int(tctx
->lp_ctx
, NULL
,
931 "dssync", "nt4changelog_preferred_len",
935 req
.req1
.restart_length
= cookie
.length
;
936 req
.req1
.restart_data
= cookie
.data
;
940 status
= dcerpc_drsuapi_DsGetNT4ChangeLog_r(ctx
->new_dc
.drsuapi
.drs_handle
, ctx
, &r
);
941 if (NT_STATUS_EQUAL(status
, NT_STATUS_NOT_IMPLEMENTED
)) {
943 "DsGetNT4ChangeLog not supported: NT_STATUS_NOT_IMPLEMENTED");
944 } else if (!NT_STATUS_IS_OK(status
)) {
945 const char *errstr
= nt_errstr(status
);
946 if (NT_STATUS_EQUAL(status
, NT_STATUS_RPC_PROCNUM_OUT_OF_RANGE
)) {
948 "DsGetNT4ChangeLog not supported: NT_STATUS_RPC_PROCNUM_OUT_OF_RANGE");
951 talloc_asprintf(tctx
, "dcerpc_drsuapi_DsGetNT4ChangeLog failed - %s\n",
953 } else if (W_ERROR_EQUAL(r
.out
.result
, WERR_INVALID_DOMAIN_ROLE
)) {
955 "DsGetNT4ChangeLog not supported: WERR_INVALID_DOMAIN_ROLE");
956 } else if (!W_ERROR_IS_OK(r
.out
.result
)) {
958 talloc_asprintf(tctx
, "DsGetNT4ChangeLog failed - %s\n",
959 win_errstr(r
.out
.result
)));
960 } else if (*r
.out
.level_out
!= 1) {
962 talloc_asprintf(tctx
, "DsGetNT4ChangeLog unknown level - %u\n",
964 } else if (NT_STATUS_IS_OK(r
.out
.info
->info1
.status
)) {
965 } else if (NT_STATUS_EQUAL(r
.out
.info
->info1
.status
, STATUS_MORE_ENTRIES
)) {
966 cookie
.length
= r
.out
.info
->info1
.restart_length
;
967 cookie
.data
= r
.out
.info
->info1
.restart_data
;
971 talloc_asprintf(tctx
, "DsGetNT4ChangeLog failed - %s\n",
972 nt_errstr(r
.out
.info
->info1
.status
)));
982 * DSSYNC test case setup
984 static bool torture_dssync_tcase_setup(struct torture_context
*tctx
, void **data
)
987 struct DsSyncTest
*ctx
;
989 *data
= ctx
= test_create_context(tctx
);
990 torture_assert(tctx
, ctx
, "test_create_context() failed");
992 bret
= _test_DsBind(tctx
, ctx
, ctx
->admin
.credentials
, &ctx
->admin
.drsuapi
);
993 torture_assert(tctx
, bret
, "_test_DsBind() failed");
995 bret
= test_LDAPBind(tctx
, ctx
, ctx
->admin
.credentials
, &ctx
->admin
.ldap
);
996 torture_assert(tctx
, bret
, "test_LDAPBind() failed");
998 bret
= test_GetInfo(tctx
, ctx
);
999 torture_assert(tctx
, bret
, "test_GetInfo() failed");
1001 bret
= _test_DsBind(tctx
, ctx
, ctx
->new_dc
.credentials
, &ctx
->new_dc
.drsuapi
);
1002 torture_assert(tctx
, bret
, "_test_DsBind() failed");
1008 * DSSYNC test case cleanup
1010 static bool torture_dssync_tcase_teardown(struct torture_context
*tctx
, void *data
)
1012 struct DsSyncTest
*ctx
;
1013 struct drsuapi_DsUnbind r
;
1014 struct policy_handle bind_handle
;
1016 ctx
= talloc_get_type(data
, struct DsSyncTest
);
1019 r
.out
.bind_handle
= &bind_handle
;
1021 /* Unbing admin handle */
1022 r
.in
.bind_handle
= &ctx
->admin
.drsuapi
.bind_handle
;
1023 dcerpc_drsuapi_DsUnbind_r(ctx
->admin
.drsuapi
.drs_handle
, ctx
, &r
);
1025 /* Unbing new_dc handle */
1026 r
.in
.bind_handle
= &ctx
->new_dc
.drsuapi
.bind_handle
;
1027 dcerpc_drsuapi_DsUnbind_r(ctx
->new_dc
.drsuapi
.drs_handle
, ctx
, &r
);
1035 * DSSYNC test case implementation
1037 void torture_drs_rpc_dssync_tcase(struct torture_suite
*suite
)
1039 typedef bool (*run_func
) (struct torture_context
*test
, void *tcase_data
);
1040 struct torture_tcase
*tcase
= torture_suite_add_tcase(suite
, "dssync");
1042 torture_tcase_set_fixture(tcase
,
1043 torture_dssync_tcase_setup
,
1044 torture_dssync_tcase_teardown
);
1046 torture_tcase_add_simple_test(tcase
, "DC_FetchData", (run_func
)test_FetchData
);
1047 torture_tcase_add_simple_test(tcase
, "FetchNT4Data", (run_func
)test_FetchNT4Data
);