2 Unix SMB/CIFS implementation.
4 DsGetNCChanges replication test
6 Copyright (C) Stefan (metze) Metzmacher 2005
7 Copyright (C) Brad Henry 2005
9 This program is free software; you can redistribute it and/or modify
10 it under the terms of the GNU General Public License as published by
11 the Free Software Foundation; either version 3 of the License, or
12 (at your option) any later version.
14 This program is distributed in the hope that it will be useful,
15 but WITHOUT ANY WARRANTY; without even the implied warranty of
16 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
17 GNU General Public License for more details.
19 You should have received a copy of the GNU General Public License
20 along with this program. If not, see <http://www.gnu.org/licenses/>.
24 #include "lib/cmdline/popt_common.h"
25 #include "librpc/gen_ndr/ndr_drsuapi_c.h"
26 #include "librpc/gen_ndr/ndr_drsblobs.h"
27 #include "libcli/cldap/cldap.h"
28 #include "torture/torture.h"
29 #include "../libcli/drsuapi/drsuapi.h"
30 #include "auth/gensec/gensec.h"
31 #include "param/param.h"
32 #include "dsdb/samdb/samdb.h"
33 #include "torture/rpc/torture_rpc.h"
34 #include "torture/drs/proto.h"
35 #include "lib/tsocket/tsocket.h"
36 #include "libcli/resolve/resolve.h"
38 struct DsSyncBindInfo
{
39 struct dcerpc_pipe
*drs_pipe
;
40 struct dcerpc_binding_handle
*drs_handle
;
41 struct drsuapi_DsBind req
;
42 struct GUID bind_guid
;
43 struct drsuapi_DsBindInfoCtr our_bind_info_ctr
;
44 struct drsuapi_DsBindInfo28 our_bind_info28
;
45 struct drsuapi_DsBindInfo28 peer_bind_info28
;
46 struct policy_handle bind_handle
;
49 struct DsSyncLDAPInfo
{
50 struct ldb_context
*ldb
;
54 struct dcerpc_binding
*drsuapi_binding
;
57 const char *dest_address
;
58 const char *domain_dn
;
59 const char *config_dn
;
60 const char *schema_dn
;
62 /* what we need to do as 'Administrator' */
64 struct cli_credentials
*credentials
;
65 struct DsSyncBindInfo drsuapi
;
66 struct DsSyncLDAPInfo ldap
;
69 /* what we need to do as the new dc machine account */
71 struct cli_credentials
*credentials
;
72 struct DsSyncBindInfo drsuapi
;
73 struct drsuapi_DsGetDCInfo2 dc_info2
;
74 struct GUID invocation_id
;
75 struct GUID object_guid
;
78 /* info about the old dc */
80 struct drsuapi_DsGetDomainControllerInfo dc_info
;
84 static struct DsSyncTest
*test_create_context(struct torture_context
*tctx
)
87 struct DsSyncTest
*ctx
;
88 struct drsuapi_DsBindInfo28
*our_bind_info28
;
89 struct drsuapi_DsBindInfoCtr
*our_bind_info_ctr
;
90 const char *binding
= torture_setting_string(tctx
, "binding", NULL
);
93 ctx
= talloc_zero(tctx
, struct DsSyncTest
);
94 if (!ctx
) return NULL
;
96 status
= dcerpc_parse_binding(ctx
, binding
, &ctx
->drsuapi_binding
);
97 if (!NT_STATUS_IS_OK(status
)) {
98 printf("Bad binding string %s\n", binding
);
101 ctx
->drsuapi_binding
->flags
|= DCERPC_SIGN
| DCERPC_SEAL
;
103 ctx
->ldap_url
= talloc_asprintf(ctx
, "ldap://%s", ctx
->drsuapi_binding
->host
);
105 make_nbt_name_server(&name
, ctx
->drsuapi_binding
->host
);
107 /* do an initial name resolution to find its IP */
108 status
= resolve_name(lpcfg_resolve_context(tctx
->lp_ctx
), &name
, tctx
,
109 &ctx
->dest_address
, tctx
->ev
);
110 if (!NT_STATUS_IS_OK(status
)) {
111 printf("Failed to resolve %s - %s\n",
112 name
.name
, nt_errstr(status
));
117 ctx
->admin
.credentials
= cmdline_credentials
;
119 our_bind_info28
= &ctx
->admin
.drsuapi
.our_bind_info28
;
120 our_bind_info28
->supported_extensions
= 0xFFFFFFFF;
121 our_bind_info28
->supported_extensions
|= DRSUAPI_SUPPORTED_EXTENSION_ADDENTRYREPLY_V3
;
122 our_bind_info28
->site_guid
= GUID_zero();
123 our_bind_info28
->pid
= 0;
124 our_bind_info28
->repl_epoch
= 1;
126 our_bind_info_ctr
= &ctx
->admin
.drsuapi
.our_bind_info_ctr
;
127 our_bind_info_ctr
->length
= 28;
128 our_bind_info_ctr
->info
.info28
= *our_bind_info28
;
130 GUID_from_string(DRSUAPI_DS_BIND_GUID
, &ctx
->admin
.drsuapi
.bind_guid
);
132 ctx
->admin
.drsuapi
.req
.in
.bind_guid
= &ctx
->admin
.drsuapi
.bind_guid
;
133 ctx
->admin
.drsuapi
.req
.in
.bind_info
= our_bind_info_ctr
;
134 ctx
->admin
.drsuapi
.req
.out
.bind_handle
= &ctx
->admin
.drsuapi
.bind_handle
;
137 ctx
->new_dc
.credentials
= cmdline_credentials
;
139 our_bind_info28
= &ctx
->new_dc
.drsuapi
.our_bind_info28
;
140 our_bind_info28
->supported_extensions
|= DRSUAPI_SUPPORTED_EXTENSION_BASE
;
141 our_bind_info28
->supported_extensions
|= DRSUAPI_SUPPORTED_EXTENSION_ASYNC_REPLICATION
;
142 our_bind_info28
->supported_extensions
|= DRSUAPI_SUPPORTED_EXTENSION_REMOVEAPI
;
143 our_bind_info28
->supported_extensions
|= DRSUAPI_SUPPORTED_EXTENSION_MOVEREQ_V2
;
144 our_bind_info28
->supported_extensions
|= DRSUAPI_SUPPORTED_EXTENSION_GETCHG_COMPRESS
;
145 our_bind_info28
->supported_extensions
|= DRSUAPI_SUPPORTED_EXTENSION_DCINFO_V1
;
146 our_bind_info28
->supported_extensions
|= DRSUAPI_SUPPORTED_EXTENSION_RESTORE_USN_OPTIMIZATION
;
147 our_bind_info28
->supported_extensions
|= DRSUAPI_SUPPORTED_EXTENSION_KCC_EXECUTE
;
148 our_bind_info28
->supported_extensions
|= DRSUAPI_SUPPORTED_EXTENSION_ADDENTRY_V2
;
149 our_bind_info28
->supported_extensions
|= DRSUAPI_SUPPORTED_EXTENSION_LINKED_VALUE_REPLICATION
;
150 our_bind_info28
->supported_extensions
|= DRSUAPI_SUPPORTED_EXTENSION_DCINFO_V2
;
151 our_bind_info28
->supported_extensions
|= DRSUAPI_SUPPORTED_EXTENSION_INSTANCE_TYPE_NOT_REQ_ON_MOD
;
152 our_bind_info28
->supported_extensions
|= DRSUAPI_SUPPORTED_EXTENSION_CRYPTO_BIND
;
153 our_bind_info28
->supported_extensions
|= DRSUAPI_SUPPORTED_EXTENSION_GET_REPL_INFO
;
154 our_bind_info28
->supported_extensions
|= DRSUAPI_SUPPORTED_EXTENSION_STRONG_ENCRYPTION
;
155 our_bind_info28
->supported_extensions
|= DRSUAPI_SUPPORTED_EXTENSION_DCINFO_V01
;
156 our_bind_info28
->supported_extensions
|= DRSUAPI_SUPPORTED_EXTENSION_TRANSITIVE_MEMBERSHIP
;
157 our_bind_info28
->supported_extensions
|= DRSUAPI_SUPPORTED_EXTENSION_ADD_SID_HISTORY
;
158 our_bind_info28
->supported_extensions
|= DRSUAPI_SUPPORTED_EXTENSION_POST_BETA3
;
159 our_bind_info28
->supported_extensions
|= DRSUAPI_SUPPORTED_EXTENSION_GET_MEMBERSHIPS2
;
160 our_bind_info28
->supported_extensions
|= DRSUAPI_SUPPORTED_EXTENSION_GETCHGREQ_V6
;
161 our_bind_info28
->supported_extensions
|= DRSUAPI_SUPPORTED_EXTENSION_NONDOMAIN_NCS
;
162 our_bind_info28
->supported_extensions
|= DRSUAPI_SUPPORTED_EXTENSION_GETCHGREQ_V8
;
163 our_bind_info28
->supported_extensions
|= DRSUAPI_SUPPORTED_EXTENSION_GETCHGREPLY_V5
;
164 our_bind_info28
->supported_extensions
|= DRSUAPI_SUPPORTED_EXTENSION_GETCHGREPLY_V6
;
165 our_bind_info28
->supported_extensions
|= DRSUAPI_SUPPORTED_EXTENSION_ADDENTRYREPLY_V3
;
166 our_bind_info28
->supported_extensions
|= DRSUAPI_SUPPORTED_EXTENSION_GETCHGREPLY_V7
;
167 our_bind_info28
->supported_extensions
|= DRSUAPI_SUPPORTED_EXTENSION_VERIFY_OBJECT
;
168 if (lpcfg_parm_bool(tctx
->lp_ctx
, NULL
, "dssync", "xpress", false)) {
169 our_bind_info28
->supported_extensions
|= DRSUAPI_SUPPORTED_EXTENSION_XPRESS_COMPRESS
;
171 our_bind_info28
->site_guid
= GUID_zero();
172 our_bind_info28
->pid
= 0;
173 our_bind_info28
->repl_epoch
= 0;
175 our_bind_info_ctr
= &ctx
->new_dc
.drsuapi
.our_bind_info_ctr
;
176 our_bind_info_ctr
->length
= 28;
177 our_bind_info_ctr
->info
.info28
= *our_bind_info28
;
179 GUID_from_string(DRSUAPI_DS_BIND_GUID_W2K3
, &ctx
->new_dc
.drsuapi
.bind_guid
);
181 ctx
->new_dc
.drsuapi
.req
.in
.bind_guid
= &ctx
->new_dc
.drsuapi
.bind_guid
;
182 ctx
->new_dc
.drsuapi
.req
.in
.bind_info
= our_bind_info_ctr
;
183 ctx
->new_dc
.drsuapi
.req
.out
.bind_handle
= &ctx
->new_dc
.drsuapi
.bind_handle
;
185 ctx
->new_dc
.invocation_id
= ctx
->new_dc
.drsuapi
.bind_guid
;
192 static bool _test_DsBind(struct torture_context
*tctx
,
193 struct DsSyncTest
*ctx
, struct cli_credentials
*credentials
, struct DsSyncBindInfo
*b
)
198 status
= dcerpc_pipe_connect_b(ctx
,
199 &b
->drs_pipe
, ctx
->drsuapi_binding
,
201 credentials
, tctx
->ev
, tctx
->lp_ctx
);
203 if (!NT_STATUS_IS_OK(status
)) {
204 printf("Failed to connect to server as a BDC: %s\n", nt_errstr(status
));
207 b
->drs_handle
= b
->drs_pipe
->binding_handle
;
209 status
= dcerpc_drsuapi_DsBind_r(b
->drs_handle
, ctx
, &b
->req
);
210 if (!NT_STATUS_IS_OK(status
)) {
211 const char *errstr
= nt_errstr(status
);
212 printf("dcerpc_drsuapi_DsBind failed - %s\n", errstr
);
214 } else if (!W_ERROR_IS_OK(b
->req
.out
.result
)) {
215 printf("DsBind failed - %s\n", win_errstr(b
->req
.out
.result
));
219 ZERO_STRUCT(b
->peer_bind_info28
);
220 if (b
->req
.out
.bind_info
) {
221 switch (b
->req
.out
.bind_info
->length
) {
223 struct drsuapi_DsBindInfo24
*info24
;
224 info24
= &b
->req
.out
.bind_info
->info
.info24
;
225 b
->peer_bind_info28
.supported_extensions
= info24
->supported_extensions
;
226 b
->peer_bind_info28
.site_guid
= info24
->site_guid
;
227 b
->peer_bind_info28
.pid
= info24
->pid
;
228 b
->peer_bind_info28
.repl_epoch
= 0;
232 struct drsuapi_DsBindInfo48
*info48
;
233 info48
= &b
->req
.out
.bind_info
->info
.info48
;
234 b
->peer_bind_info28
.supported_extensions
= info48
->supported_extensions
;
235 b
->peer_bind_info28
.site_guid
= info48
->site_guid
;
236 b
->peer_bind_info28
.pid
= info48
->pid
;
237 b
->peer_bind_info28
.repl_epoch
= info48
->repl_epoch
;
241 b
->peer_bind_info28
= b
->req
.out
.bind_info
->info
.info28
;
244 printf("DsBind - warning: unknown BindInfo length: %u\n",
245 b
->req
.out
.bind_info
->length
);
252 static bool test_LDAPBind(struct torture_context
*tctx
, struct DsSyncTest
*ctx
,
253 struct cli_credentials
*credentials
, struct DsSyncLDAPInfo
*l
)
257 struct ldb_context
*ldb
;
259 const char *modules_option
[] = { "modules:paged_searches", NULL
};
260 ctx
->admin
.ldap
.ldb
= ldb
= ldb_init(ctx
, tctx
->ev
);
265 /* Despite us loading the schema from the AD server, we need
266 * the samba handlers to get the extended DN syntax stuff */
267 ret
= ldb_register_samba_handlers(ldb
);
268 if (ret
!= LDB_SUCCESS
) {
273 ldb_set_modules_dir(ldb
,
276 lpcfg_modulesdir(tctx
->lp_ctx
)));
278 if (ldb_set_opaque(ldb
, "credentials", credentials
)) {
283 if (ldb_set_opaque(ldb
, "loadparm", tctx
->lp_ctx
)) {
288 ret
= ldb_connect(ldb
, ctx
->ldap_url
, 0, modules_option
);
289 if (ret
!= LDB_SUCCESS
) {
291 torture_assert_int_equal(tctx
, ret
, LDB_SUCCESS
, "Failed to make LDB connection to target");
294 printf("connected to LDAP: %s\n", ctx
->ldap_url
);
299 static bool test_GetInfo(struct torture_context
*tctx
, struct DsSyncTest
*ctx
)
301 struct ldb_context
*ldb
= ctx
->admin
.ldap
.ldb
;
303 /* We must have LDB connection ready by this time */
304 SMB_ASSERT(ldb
!= NULL
);
306 ctx
->domain_dn
= ldb_dn_get_linearized(ldb_get_default_basedn(ldb
));
307 torture_assert(tctx
, ctx
->domain_dn
!= NULL
, "Failed to get Domain DN");
309 ctx
->config_dn
= ldb_dn_get_linearized(ldb_get_config_basedn(ldb
));
310 torture_assert(tctx
, ctx
->config_dn
!= NULL
, "Failed to get Domain DN");
312 ctx
->schema_dn
= ldb_dn_get_linearized(ldb_get_schema_basedn(ldb
));
313 torture_assert(tctx
, ctx
->schema_dn
!= NULL
, "Failed to get Domain DN");
318 static bool test_analyse_objects(struct torture_context
*tctx
,
319 struct DsSyncTest
*ctx
,
320 const char *partition
,
321 const struct drsuapi_DsReplicaOIDMapping_Ctr
*mapping_ctr
,
322 uint32_t object_count
,
323 const struct drsuapi_DsReplicaObjectListItemEx
*first_object
,
324 const DATA_BLOB
*gensec_skey
)
326 static uint32_t object_id
;
327 const char *save_values_dir
;
328 const struct drsuapi_DsReplicaObjectListItemEx
*cur
;
329 struct ldb_context
*ldb
= ctx
->admin
.ldap
.ldb
;
330 struct ldb_dn
*deleted_dn
;
333 struct dsdb_extended_replicated_objects
*objs
;
334 struct ldb_extended_dn_control
*extended_dn_ctrl
;
335 struct dsdb_schema
*ldap_schema
;
337 /* load dsdb_schema using remote prefixMap */
339 drs_util_dsdb_schema_load_ldb(tctx
, ldb
, mapping_ctr
, false),
340 "drs_util_dsdb_schema_load_ldb() failed");
341 ldap_schema
= dsdb_get_schema(ldb
, NULL
);
343 status
= dsdb_extended_replicated_objects_convert(ldb
,
352 torture_assert_werr_ok(tctx
, status
, "dsdb_extended_replicated_objects_convert() failed!");
354 extended_dn_ctrl
= talloc(objs
, struct ldb_extended_dn_control
);
355 extended_dn_ctrl
->type
= 1;
357 deleted_dn
= ldb_dn_new(objs
, ldb
, partition
);
358 ldb_dn_add_child_fmt(deleted_dn
, "CN=Deleted Objects");
360 for (i
=0; i
< object_count
; i
++) {
361 struct ldb_request
*search_req
;
362 struct ldb_result
*res
;
363 struct ldb_message
*new_msg
, *drs_msg
, *ldap_msg
;
364 const char **attrs
= talloc_array(objs
, const char *, objs
->objects
[i
].msg
->num_elements
+1);
365 for (j
=0; j
< objs
->objects
[i
].msg
->num_elements
; j
++) {
366 attrs
[j
] = objs
->objects
[i
].msg
->elements
[j
].name
;
369 res
= talloc_zero(objs
, struct ldb_result
);
371 return LDB_ERR_OPERATIONS_ERROR
;
373 ret
= ldb_build_search_req(&search_req
, ldb
, objs
,
374 objs
->objects
[i
].msg
->dn
,
380 ldb_search_default_callback
,
382 if (ret
!= LDB_SUCCESS
) {
385 talloc_steal(search_req
, res
);
386 ret
= ldb_request_add_control(search_req
, LDB_CONTROL_SHOW_DELETED_OID
, true, NULL
);
387 if (ret
!= LDB_SUCCESS
) {
391 ret
= ldb_request_add_control(search_req
, LDB_CONTROL_EXTENDED_DN_OID
, true, extended_dn_ctrl
);
392 if (ret
!= LDB_SUCCESS
) {
396 ret
= ldb_request(ldb
, search_req
);
397 if (ret
== LDB_SUCCESS
) {
398 ret
= ldb_wait(search_req
->handle
, LDB_WAIT_ALL
);
401 torture_assert_int_equal(tctx
, ret
, LDB_SUCCESS
,
402 talloc_asprintf(tctx
,
403 "Could not re-fetch object just delivered over DRS: %s",
404 ldb_errstring(ldb
)));
405 torture_assert_int_equal(tctx
, res
->count
, 1, "Could not re-fetch object just delivered over DRS");
406 ldap_msg
= res
->msgs
[0];
407 for (j
=0; j
< ldap_msg
->num_elements
; j
++) {
408 ldap_msg
->elements
[j
].flags
= LDB_FLAG_MOD_ADD
;
409 /* For unknown reasons, there is no nTSecurityDescriptor on cn=deleted objects over LDAP, but there is over DRS! Skip it on both transports for now here so */
410 if ((ldb_attr_cmp(ldap_msg
->elements
[j
].name
, "nTSecurityDescriptor") == 0) &&
411 (ldb_dn_compare(ldap_msg
->dn
, deleted_dn
) == 0)) {
412 ldb_msg_remove_element(ldap_msg
, &ldap_msg
->elements
[j
]);
418 ret
= ldb_msg_normalize(ldb
, search_req
,
419 objs
->objects
[i
].msg
, &drs_msg
);
420 torture_assert(tctx
, ret
== LDB_SUCCESS
,
421 "ldb_msg_normalize() has failed");
423 for (j
=0; j
< drs_msg
->num_elements
; j
++) {
424 if (drs_msg
->elements
[j
].num_values
== 0) {
425 ldb_msg_remove_element(drs_msg
, &drs_msg
->elements
[j
]);
429 /* For unknown reasons, there is no nTSecurityDescriptor on cn=deleted objects over LDAP, but there is over DRS! */
430 } else if ((ldb_attr_cmp(drs_msg
->elements
[j
].name
, "nTSecurityDescriptor") == 0) &&
431 (ldb_dn_compare(drs_msg
->dn
, deleted_dn
) == 0)) {
432 ldb_msg_remove_element(drs_msg
, &drs_msg
->elements
[j
]);
435 } else if (ldb_attr_cmp(drs_msg
->elements
[j
].name
, "unicodePwd") == 0 ||
436 ldb_attr_cmp(drs_msg
->elements
[j
].name
, "dBCSPwd") == 0 ||
437 ldb_attr_cmp(drs_msg
->elements
[j
].name
, "ntPwdHistory") == 0 ||
438 ldb_attr_cmp(drs_msg
->elements
[j
].name
, "lmPwdHistory") == 0 ||
439 ldb_attr_cmp(drs_msg
->elements
[j
].name
, "supplementalCredentials") == 0 ||
440 ldb_attr_cmp(drs_msg
->elements
[j
].name
, "priorValue") == 0 ||
441 ldb_attr_cmp(drs_msg
->elements
[j
].name
, "currentValue") == 0 ||
442 ldb_attr_cmp(drs_msg
->elements
[j
].name
, "trustAuthOutgoing") == 0 ||
443 ldb_attr_cmp(drs_msg
->elements
[j
].name
, "trustAuthIncoming") == 0 ||
444 ldb_attr_cmp(drs_msg
->elements
[j
].name
, "initialAuthOutgoing") == 0 ||
445 ldb_attr_cmp(drs_msg
->elements
[j
].name
, "initialAuthIncoming") == 0) {
447 /* These are not shown over LDAP, so we need to skip them for the comparison */
448 ldb_msg_remove_element(drs_msg
, &drs_msg
->elements
[j
]);
452 drs_msg
->elements
[j
].flags
= LDB_FLAG_MOD_ADD
;
457 ret
= ldb_msg_difference(ldb
, search_req
,
458 drs_msg
, ldap_msg
, &new_msg
);
459 torture_assert(tctx
, ret
== LDB_SUCCESS
, "ldb_msg_difference() has failed");
460 if (new_msg
->num_elements
!= 0) {
462 bool is_warning
= true;
464 struct ldb_message_element
*el
;
465 const struct dsdb_attribute
* a
;
466 struct ldb_ldif ldif
;
467 ldif
.changetype
= LDB_CHANGETYPE_MODIFY
;
469 s
= ldb_ldif_write_string(ldb
, new_msg
, &ldif
);
470 s
= talloc_asprintf(tctx
, "\n# Difference in between DRS and LDAP objects: \n%s", s
);
472 ret
= ldb_msg_difference(ldb
, search_req
,
473 ldap_msg
, drs_msg
, &ldif
.msg
);
474 torture_assert(tctx
, ret
== LDB_SUCCESS
, "ldb_msg_difference() has failed");
475 s
= talloc_asprintf_append(s
,
476 "\n# Difference in between LDAP and DRS objects: \n%s",
477 ldb_ldif_write_string(ldb
, new_msg
, &ldif
));
479 s
= talloc_asprintf_append(s
,
480 "# Should have no objects in 'difference' message. Diff elements: %d",
481 new_msg
->num_elements
);
484 * In case differences in messages are:
485 * 1. Attributes with different values, i.e. 'replace'
486 * 2. Those attributes are forward-link attributes
487 * then we just warn about those differences.
488 * It turns out windows doesn't send all of those values
489 * in replicated_object but in linked_attributes.
491 for (idx
= 0; idx
< new_msg
->num_elements
&& is_warning
; idx
++) {
492 el
= &new_msg
->elements
[idx
];
493 a
= dsdb_attribute_by_lDAPDisplayName(ldap_schema
,
495 if (!(el
->flags
& (LDB_FLAG_MOD_ADD
|LDB_FLAG_MOD_REPLACE
))) {
498 } else if (a
->linkID
& 1) {
503 torture_warning(tctx
, "%s", s
);
505 torture_fail(tctx
, s
);
509 /* search_req is used as a tmp talloc context in the above */
510 talloc_free(search_req
);
513 if (!lpcfg_parm_bool(tctx
->lp_ctx
, NULL
, "dssync", "print_pwd_blobs", false)) {
518 save_values_dir
= lpcfg_parm_string(tctx
->lp_ctx
, NULL
, "dssync", "save_pwd_blobs_dir");
520 for (cur
= first_object
; cur
; cur
= cur
->next_object
) {
522 struct dom_sid
*sid
= NULL
;
524 bool dn_printed
= false;
526 if (!cur
->object
.identifier
) continue;
528 dn
= cur
->object
.identifier
->dn
;
529 if (cur
->object
.identifier
->sid
.num_auths
> 0) {
530 sid
= &cur
->object
.identifier
->sid
;
531 rid
= sid
->sub_auths
[sid
->num_auths
- 1];
534 for (i
=0; i
< cur
->object
.attribute_ctr
.num_attributes
; i
++) {
536 const char *name
= NULL
;
538 DATA_BLOB
*enc_data
= NULL
;
539 DATA_BLOB plain_data
;
540 struct drsuapi_DsReplicaAttribute
*attr
;
541 ndr_pull_flags_fn_t pull_fn
= NULL
;
542 ndr_print_fn_t print_fn
= NULL
;
544 attr
= &cur
->object
.attribute_ctr
.attributes
[i
];
546 switch (attr
->attid
) {
547 case DRSUAPI_ATTID_dBCSPwd
:
551 case DRSUAPI_ATTID_unicodePwd
:
555 case DRSUAPI_ATTID_ntPwdHistory
:
556 name
= "ntPwdHistory";
559 case DRSUAPI_ATTID_lmPwdHistory
:
560 name
= "lmPwdHistory";
563 case DRSUAPI_ATTID_supplementalCredentials
:
564 name
= "supplementalCredentials";
565 pull_fn
= (ndr_pull_flags_fn_t
)ndr_pull_supplementalCredentialsBlob
;
566 print_fn
= (ndr_print_fn_t
)ndr_print_supplementalCredentialsBlob
;
567 ptr
= talloc(ctx
, struct supplementalCredentialsBlob
);
569 case DRSUAPI_ATTID_priorValue
:
572 case DRSUAPI_ATTID_currentValue
:
573 name
= "currentValue";
575 case DRSUAPI_ATTID_trustAuthOutgoing
:
576 name
= "trustAuthOutgoing";
577 pull_fn
= (ndr_pull_flags_fn_t
)ndr_pull_trustAuthInOutBlob
;
578 print_fn
= (ndr_print_fn_t
)ndr_print_trustAuthInOutBlob
;
579 ptr
= talloc(ctx
, struct trustAuthInOutBlob
);
581 case DRSUAPI_ATTID_trustAuthIncoming
:
582 name
= "trustAuthIncoming";
583 pull_fn
= (ndr_pull_flags_fn_t
)ndr_pull_trustAuthInOutBlob
;
584 print_fn
= (ndr_print_fn_t
)ndr_print_trustAuthInOutBlob
;
585 ptr
= talloc(ctx
, struct trustAuthInOutBlob
);
587 case DRSUAPI_ATTID_initialAuthOutgoing
:
588 name
= "initialAuthOutgoing";
590 case DRSUAPI_ATTID_initialAuthIncoming
:
591 name
= "initialAuthIncoming";
597 if (attr
->value_ctr
.num_values
!= 1) continue;
599 if (!attr
->value_ctr
.values
[0].blob
) continue;
601 enc_data
= attr
->value_ctr
.values
[0].blob
;
602 ZERO_STRUCT(plain_data
);
604 werr
= drsuapi_decrypt_attribute_value(ctx
, gensec_skey
, rcrypt
,
606 enc_data
, &plain_data
);
607 if (!W_ERROR_IS_OK(werr
)) {
608 DEBUG(0, ("Failed to decrypt %s\n", name
));
613 DEBUG(0,("DN[%u] %s\n", object_id
, dn
));
616 DEBUGADD(0,("ATTR: %s enc.length=%lu plain.length=%lu\n",
617 name
, (long)enc_data
->length
, (long)plain_data
.length
));
618 if (plain_data
.length
) {
619 enum ndr_err_code ndr_err
;
620 dump_data(0, plain_data
.data
, plain_data
.length
);
621 if (save_values_dir
) {
623 fname
= talloc_asprintf(ctx
, "%s/%s%02d",
628 ok
= file_save(fname
, plain_data
.data
, plain_data
.length
);
630 DEBUGADD(0,("Failed to save '%s'\n", fname
));
637 /* Can't use '_all' because of PIDL bugs with relative pointers */
638 ndr_err
= ndr_pull_struct_blob(&plain_data
, ptr
,
640 if (NDR_ERR_CODE_IS_SUCCESS(ndr_err
)) {
641 ndr_print_debug(print_fn
, name
, ptr
);
643 DEBUG(0, ("Failed to decode %s\n", name
));
647 dump_data(0, enc_data
->data
, enc_data
->length
);
656 static bool test_GetNCChanges(struct torture_context
*tctx
,
657 struct DsSyncTest
*ctx
,
658 const char *nc_dn_str
)
663 uint64_t highest_usn
= 0;
664 struct drsuapi_DsGetNCChanges r
;
665 union drsuapi_DsGetNCChangesRequest req
;
666 struct drsuapi_DsReplicaObjectIdentifier nc
;
667 struct drsuapi_DsGetNCChangesCtr1
*ctr1
= NULL
;
668 struct drsuapi_DsGetNCChangesCtr6
*ctr6
= NULL
;
669 uint32_t out_level
= 0;
670 struct GUID null_guid
;
671 struct dom_sid null_sid
;
672 DATA_BLOB gensec_skey
;
684 ZERO_STRUCT(null_guid
);
685 ZERO_STRUCT(null_sid
);
687 highest_usn
= lpcfg_parm_int(tctx
->lp_ctx
, NULL
, "dssync", "highest_usn", 0);
689 array
[0].level
= lpcfg_parm_int(tctx
->lp_ctx
, NULL
, "dssync", "get_nc_changes_level", array
[0].level
);
691 if (lpcfg_parm_bool(tctx
->lp_ctx
, NULL
, "dssync", "print_pwd_blobs", false)) {
692 const struct samr_Password
*nthash
;
693 nthash
= cli_credentials_get_nt_hash(ctx
->new_dc
.credentials
, ctx
);
695 dump_data_pw("CREDENTIALS nthash:", nthash
->hash
, sizeof(nthash
->hash
));
698 status
= gensec_session_key(ctx
->new_dc
.drsuapi
.drs_pipe
->conn
->security_state
.generic_state
,
700 if (!NT_STATUS_IS_OK(status
)) {
701 printf("failed to get gensec session key: %s\n", nt_errstr(status
));
705 for (i
=0; i
< ARRAY_SIZE(array
); i
++) {
706 printf("Testing DsGetNCChanges level %d\n",
709 r
.in
.bind_handle
= &ctx
->new_dc
.drsuapi
.bind_handle
;
710 r
.in
.level
= array
[i
].level
;
712 switch (r
.in
.level
) {
719 r
.in
.req
->req5
.destination_dsa_guid
= ctx
->new_dc
.invocation_id
;
720 r
.in
.req
->req5
.source_dsa_invocation_id
= null_guid
;
721 r
.in
.req
->req5
.naming_context
= &nc
;
722 r
.in
.req
->req5
.highwatermark
.tmp_highest_usn
= highest_usn
;
723 r
.in
.req
->req5
.highwatermark
.reserved_usn
= 0;
724 r
.in
.req
->req5
.highwatermark
.highest_usn
= highest_usn
;
725 r
.in
.req
->req5
.uptodateness_vector
= NULL
;
726 r
.in
.req
->req5
.replica_flags
= 0;
727 if (lpcfg_parm_bool(tctx
->lp_ctx
, NULL
, "dssync", "compression", false)) {
728 r
.in
.req
->req5
.replica_flags
|= DRSUAPI_DRS_USE_COMPRESSION
;
730 if (lpcfg_parm_bool(tctx
->lp_ctx
, NULL
, "dssync", "neighbour_writeable", true)) {
731 r
.in
.req
->req5
.replica_flags
|= DRSUAPI_DRS_WRIT_REP
;
733 r
.in
.req
->req5
.replica_flags
|= DRSUAPI_DRS_INIT_SYNC
734 | DRSUAPI_DRS_PER_SYNC
735 | DRSUAPI_DRS_GET_ANC
736 | DRSUAPI_DRS_NEVER_SYNCED
738 r
.in
.req
->req5
.max_object_count
= 133;
739 r
.in
.req
->req5
.max_ndr_size
= 1336770;
740 r
.in
.req
->req5
.extended_op
= DRSUAPI_EXOP_NONE
;
741 r
.in
.req
->req5
.fsmo_info
= 0;
748 /* nc.dn can be set to any other ad partition */
751 r
.in
.req
->req8
.destination_dsa_guid
= ctx
->new_dc
.invocation_id
;
752 r
.in
.req
->req8
.source_dsa_invocation_id
= null_guid
;
753 r
.in
.req
->req8
.naming_context
= &nc
;
754 r
.in
.req
->req8
.highwatermark
.tmp_highest_usn
= highest_usn
;
755 r
.in
.req
->req8
.highwatermark
.reserved_usn
= 0;
756 r
.in
.req
->req8
.highwatermark
.highest_usn
= highest_usn
;
757 r
.in
.req
->req8
.uptodateness_vector
= NULL
;
758 r
.in
.req
->req8
.replica_flags
= 0;
759 if (lpcfg_parm_bool(tctx
->lp_ctx
, NULL
, "dssync", "compression", false)) {
760 r
.in
.req
->req8
.replica_flags
|= DRSUAPI_DRS_USE_COMPRESSION
;
762 if (lpcfg_parm_bool(tctx
->lp_ctx
, NULL
, "dssync", "neighbour_writeable", true)) {
763 r
.in
.req
->req8
.replica_flags
|= DRSUAPI_DRS_WRIT_REP
;
765 r
.in
.req
->req8
.replica_flags
|= DRSUAPI_DRS_INIT_SYNC
766 | DRSUAPI_DRS_PER_SYNC
767 | DRSUAPI_DRS_GET_ANC
768 | DRSUAPI_DRS_NEVER_SYNCED
770 r
.in
.req
->req8
.max_object_count
= 402;
771 r
.in
.req
->req8
.max_ndr_size
= 402116;
773 r
.in
.req
->req8
.extended_op
= DRSUAPI_EXOP_NONE
;
774 r
.in
.req
->req8
.fsmo_info
= 0;
775 r
.in
.req
->req8
.partial_attribute_set
= NULL
;
776 r
.in
.req
->req8
.partial_attribute_set_ex
= NULL
;
777 r
.in
.req
->req8
.mapping_ctr
.num_mappings
= 0;
778 r
.in
.req
->req8
.mapping_ctr
.mappings
= NULL
;
785 union drsuapi_DsGetNCChangesCtr ctr
;
789 r
.out
.level_out
= &_level
;
792 if (r
.in
.level
== 5) {
793 torture_comment(tctx
,
794 "start[%d] tmp_higest_usn: %llu , highest_usn: %llu\n",
796 (unsigned long long) r
.in
.req
->req5
.highwatermark
.tmp_highest_usn
,
797 (unsigned long long) r
.in
.req
->req5
.highwatermark
.highest_usn
);
800 if (r
.in
.level
== 8) {
801 torture_comment(tctx
,
802 "start[%d] tmp_higest_usn: %llu , highest_usn: %llu\n",
804 (unsigned long long) r
.in
.req
->req8
.highwatermark
.tmp_highest_usn
,
805 (unsigned long long) r
.in
.req
->req8
.highwatermark
.highest_usn
);
808 status
= dcerpc_drsuapi_DsGetNCChanges_r(ctx
->new_dc
.drsuapi
.drs_handle
, ctx
, &r
);
809 torture_drsuapi_assert_call(tctx
, ctx
->new_dc
.drsuapi
.drs_pipe
, status
,
810 &r
, "dcerpc_drsuapi_DsGetNCChanges");
812 if (ret
== true && *r
.out
.level_out
== 1) {
814 ctr1
= &r
.out
.ctr
->ctr1
;
815 } else if (ret
== true && *r
.out
.level_out
== 2 &&
816 r
.out
.ctr
->ctr2
.mszip1
.ts
) {
818 ctr1
= &r
.out
.ctr
->ctr2
.mszip1
.ts
->ctr1
;
821 if (out_level
== 1) {
822 torture_comment(tctx
,
823 "end[%d] tmp_highest_usn: %llu , highest_usn: %llu\n",
825 (unsigned long long) ctr1
->new_highwatermark
.tmp_highest_usn
,
826 (unsigned long long) ctr1
->new_highwatermark
.highest_usn
);
828 if (!test_analyse_objects(tctx
, ctx
, nc_dn_str
, &ctr1
->mapping_ctr
, ctr1
->object_count
,
829 ctr1
->first_object
, &gensec_skey
)) {
833 if (ctr1
->more_data
) {
834 r
.in
.req
->req5
.highwatermark
= ctr1
->new_highwatermark
;
839 if (ret
== true && *r
.out
.level_out
== 6) {
841 ctr6
= &r
.out
.ctr
->ctr6
;
842 } else if (ret
== true && *r
.out
.level_out
== 7
843 && r
.out
.ctr
->ctr7
.level
== 6
844 && r
.out
.ctr
->ctr7
.type
== DRSUAPI_COMPRESSION_TYPE_MSZIP
845 && r
.out
.ctr
->ctr7
.ctr
.mszip6
.ts
) {
847 ctr6
= &r
.out
.ctr
->ctr7
.ctr
.mszip6
.ts
->ctr6
;
848 } else if (ret
== true && *r
.out
.level_out
== 7
849 && r
.out
.ctr
->ctr7
.level
== 6
850 && r
.out
.ctr
->ctr7
.type
== DRSUAPI_COMPRESSION_TYPE_XPRESS
851 && r
.out
.ctr
->ctr7
.ctr
.xpress6
.ts
) {
853 ctr6
= &r
.out
.ctr
->ctr7
.ctr
.xpress6
.ts
->ctr6
;
856 if (out_level
== 6) {
857 torture_comment(tctx
,
858 "end[%d] tmp_highest_usn: %llu , highest_usn: %llu\n",
860 (unsigned long long) ctr6
->new_highwatermark
.tmp_highest_usn
,
861 (unsigned long long) ctr6
->new_highwatermark
.highest_usn
);
863 if (!test_analyse_objects(tctx
, ctx
, nc_dn_str
, &ctr6
->mapping_ctr
, ctr6
->object_count
,
864 ctr6
->first_object
, &gensec_skey
)) {
868 if (ctr6
->more_data
) {
869 r
.in
.req
->req8
.highwatermark
= ctr6
->new_highwatermark
;
882 * Test DsGetNCChanges() DRSUAPI call against one
883 * or more Naming Contexts.
884 * Specific NC to test with may be supplied
885 * in lp_ctx configuration. If no NC is specified,
886 * it will test DsGetNCChanges() on all NCs on remote DC
888 static bool test_FetchData(struct torture_context
*tctx
, struct DsSyncTest
*ctx
)
892 const char *nc_dn_str
;
893 const char **nc_list
;
895 nc_list
= const_str_list(str_list_make_empty(ctx
));
896 torture_assert(tctx
, nc_list
, "Not enough memory!");
898 /* make a list of partitions to test with */
899 nc_dn_str
= lpcfg_parm_string(tctx
->lp_ctx
, NULL
, "dssync", "partition");
900 if (nc_dn_str
== NULL
) {
901 nc_list
= str_list_add_const(nc_list
, ctx
->domain_dn
);
902 nc_list
= str_list_add_const(nc_list
, ctx
->config_dn
);
903 nc_list
= str_list_add_const(nc_list
, ctx
->schema_dn
);
905 nc_list
= str_list_add_const(nc_list
, nc_dn_str
);
908 count
= str_list_length(nc_list
);
909 for (i
= 0; i
< count
&& ret
; i
++) {
910 torture_comment(tctx
, "\nNaming Context: %s\n", nc_list
[i
]);
911 ret
= test_GetNCChanges(tctx
, ctx
, nc_list
[i
]);
914 talloc_free(nc_list
);
919 static bool test_FetchNT4Data(struct torture_context
*tctx
,
920 struct DsSyncTest
*ctx
)
923 struct drsuapi_DsGetNT4ChangeLog r
;
924 union drsuapi_DsGetNT4ChangeLogRequest req
;
925 union drsuapi_DsGetNT4ChangeLogInfo info
;
926 uint32_t level_out
= 0;
927 struct GUID null_guid
;
928 struct dom_sid null_sid
;
931 ZERO_STRUCT(null_guid
);
932 ZERO_STRUCT(null_sid
);
936 r
.in
.bind_handle
= &ctx
->new_dc
.drsuapi
.bind_handle
;
939 r
.out
.level_out
= &level_out
;
941 req
.req1
.flags
= lpcfg_parm_int(tctx
->lp_ctx
, NULL
,
942 "dssync", "nt4changelog_flags",
943 DRSUAPI_NT4_CHANGELOG_GET_CHANGELOG
|
944 DRSUAPI_NT4_CHANGELOG_GET_SERIAL_NUMBERS
);
945 req
.req1
.preferred_maximum_length
= lpcfg_parm_int(tctx
->lp_ctx
, NULL
,
946 "dssync", "nt4changelog_preferred_len",
950 req
.req1
.restart_length
= cookie
.length
;
951 req
.req1
.restart_data
= cookie
.data
;
955 status
= dcerpc_drsuapi_DsGetNT4ChangeLog_r(ctx
->new_dc
.drsuapi
.drs_handle
, ctx
, &r
);
956 if (NT_STATUS_EQUAL(status
, NT_STATUS_NOT_IMPLEMENTED
)) {
958 "DsGetNT4ChangeLog not supported: NT_STATUS_NOT_IMPLEMENTED");
959 } else if (!NT_STATUS_IS_OK(status
)) {
960 const char *errstr
= nt_errstr(status
);
961 if (NT_STATUS_EQUAL(status
, NT_STATUS_RPC_PROCNUM_OUT_OF_RANGE
)) {
963 "DsGetNT4ChangeLog not supported: NT_STATUS_RPC_PROCNUM_OUT_OF_RANGE");
966 talloc_asprintf(tctx
, "dcerpc_drsuapi_DsGetNT4ChangeLog failed - %s\n",
968 } else if (W_ERROR_EQUAL(r
.out
.result
, WERR_INVALID_DOMAIN_ROLE
)) {
970 "DsGetNT4ChangeLog not supported: WERR_INVALID_DOMAIN_ROLE");
971 } else if (!W_ERROR_IS_OK(r
.out
.result
)) {
973 talloc_asprintf(tctx
, "DsGetNT4ChangeLog failed - %s\n",
974 win_errstr(r
.out
.result
)));
975 } else if (*r
.out
.level_out
!= 1) {
977 talloc_asprintf(tctx
, "DsGetNT4ChangeLog unknown level - %u\n",
979 } else if (NT_STATUS_IS_OK(r
.out
.info
->info1
.status
)) {
980 } else if (NT_STATUS_EQUAL(r
.out
.info
->info1
.status
, STATUS_MORE_ENTRIES
)) {
981 cookie
.length
= r
.out
.info
->info1
.restart_length
;
982 cookie
.data
= r
.out
.info
->info1
.restart_data
;
986 talloc_asprintf(tctx
, "DsGetNT4ChangeLog failed - %s\n",
987 nt_errstr(r
.out
.info
->info1
.status
)));
997 * DSSYNC test case setup
999 static bool torture_dssync_tcase_setup(struct torture_context
*tctx
, void **data
)
1002 struct DsSyncTest
*ctx
;
1004 *data
= ctx
= test_create_context(tctx
);
1005 torture_assert(tctx
, ctx
, "test_create_context() failed");
1007 bret
= _test_DsBind(tctx
, ctx
, ctx
->admin
.credentials
, &ctx
->admin
.drsuapi
);
1008 torture_assert(tctx
, bret
, "_test_DsBind() failed");
1010 bret
= test_LDAPBind(tctx
, ctx
, ctx
->admin
.credentials
, &ctx
->admin
.ldap
);
1011 torture_assert(tctx
, bret
, "test_LDAPBind() failed");
1013 bret
= test_GetInfo(tctx
, ctx
);
1014 torture_assert(tctx
, bret
, "test_GetInfo() failed");
1016 bret
= _test_DsBind(tctx
, ctx
, ctx
->new_dc
.credentials
, &ctx
->new_dc
.drsuapi
);
1017 torture_assert(tctx
, bret
, "_test_DsBind() failed");
1023 * DSSYNC test case cleanup
1025 static bool torture_dssync_tcase_teardown(struct torture_context
*tctx
, void *data
)
1027 struct DsSyncTest
*ctx
;
1028 struct drsuapi_DsUnbind r
;
1029 struct policy_handle bind_handle
;
1031 ctx
= talloc_get_type(data
, struct DsSyncTest
);
1034 r
.out
.bind_handle
= &bind_handle
;
1036 /* Unbing admin handle */
1037 r
.in
.bind_handle
= &ctx
->admin
.drsuapi
.bind_handle
;
1038 dcerpc_drsuapi_DsUnbind_r(ctx
->admin
.drsuapi
.drs_handle
, ctx
, &r
);
1040 /* Unbing new_dc handle */
1041 r
.in
.bind_handle
= &ctx
->new_dc
.drsuapi
.bind_handle
;
1042 dcerpc_drsuapi_DsUnbind_r(ctx
->new_dc
.drsuapi
.drs_handle
, ctx
, &r
);
1050 * DSSYNC test case implementation
1052 void torture_drs_rpc_dssync_tcase(struct torture_suite
*suite
)
1054 typedef bool (*run_func
) (struct torture_context
*test
, void *tcase_data
);
1056 struct torture_test
*test
;
1057 struct torture_tcase
*tcase
= torture_suite_add_tcase(suite
, "DSSYNC");
1059 torture_tcase_set_fixture(tcase
,
1060 torture_dssync_tcase_setup
,
1061 torture_dssync_tcase_teardown
);
1063 test
= torture_tcase_add_simple_test(tcase
, "DC_FetchData", (run_func
)test_FetchData
);
1064 test
= torture_tcase_add_simple_test(tcase
, "FetchNT4Data", (run_func
)test_FetchNT4Data
);