2 Unix SMB/CIFS implementation.
4 DsGetNCChanges replication test
6 Copyright (C) Stefan (metze) Metzmacher 2005
7 Copyright (C) Brad Henry 2005
9 This program is free software; you can redistribute it and/or modify
10 it under the terms of the GNU General Public License as published by
11 the Free Software Foundation; either version 3 of the License, or
12 (at your option) any later version.
14 This program is distributed in the hope that it will be useful,
15 but WITHOUT ANY WARRANTY; without even the implied warranty of
16 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
17 GNU General Public License for more details.
19 You should have received a copy of the GNU General Public License
20 along with this program. If not, see <http://www.gnu.org/licenses/>.
24 #include "lib/cmdline/popt_common.h"
25 #include "librpc/gen_ndr/ndr_drsuapi_c.h"
26 #include "librpc/gen_ndr/ndr_drsblobs.h"
27 #include "libcli/cldap/cldap.h"
28 #include "torture/torture.h"
29 #include "../libcli/drsuapi/drsuapi.h"
30 #include "auth/gensec/gensec.h"
31 #include "param/param.h"
32 #include "dsdb/samdb/samdb.h"
33 #include "lib/ldb_wrap.h"
34 #include "torture/rpc/rpc.h"
35 #include "torture/drs/proto.h"
38 struct DsSyncBindInfo
{
39 struct dcerpc_pipe
*drs_pipe
;
40 struct drsuapi_DsBind req
;
41 struct GUID bind_guid
;
42 struct drsuapi_DsBindInfoCtr our_bind_info_ctr
;
43 struct drsuapi_DsBindInfo28 our_bind_info28
;
44 struct drsuapi_DsBindInfo28 peer_bind_info28
;
45 struct policy_handle bind_handle
;
48 struct DsSyncLDAPInfo
{
49 struct ldb_context
*ldb
;
53 struct dcerpc_binding
*drsuapi_binding
;
56 const char *site_name
;
58 const char *domain_dn
;
60 /* what we need to do as 'Administrator' */
62 struct cli_credentials
*credentials
;
63 struct DsSyncBindInfo drsuapi
;
64 struct DsSyncLDAPInfo ldap
;
67 /* what we need to do as the new dc machine account */
69 struct cli_credentials
*credentials
;
70 struct DsSyncBindInfo drsuapi
;
71 struct drsuapi_DsGetDCInfo2 dc_info2
;
72 struct GUID invocation_id
;
73 struct GUID object_guid
;
76 /* info about the old dc */
78 struct drsuapi_DsGetDomainControllerInfo dc_info
;
82 static struct DsSyncTest
*test_create_context(struct torture_context
*tctx
)
85 struct DsSyncTest
*ctx
;
86 struct drsuapi_DsBindInfo28
*our_bind_info28
;
87 struct drsuapi_DsBindInfoCtr
*our_bind_info_ctr
;
88 const char *binding
= torture_setting_string(tctx
, "binding", NULL
);
89 ctx
= talloc_zero(tctx
, struct DsSyncTest
);
90 if (!ctx
) return NULL
;
92 status
= dcerpc_parse_binding(ctx
, binding
, &ctx
->drsuapi_binding
);
93 if (!NT_STATUS_IS_OK(status
)) {
94 printf("Bad binding string %s\n", binding
);
97 ctx
->drsuapi_binding
->flags
|= DCERPC_SIGN
| DCERPC_SEAL
;
99 ctx
->ldap_url
= talloc_asprintf(ctx
, "ldap://%s", ctx
->drsuapi_binding
->host
);
102 ctx
->admin
.credentials
= cmdline_credentials
;
104 our_bind_info28
= &ctx
->admin
.drsuapi
.our_bind_info28
;
105 our_bind_info28
->supported_extensions
= 0xFFFFFFFF;
106 our_bind_info28
->supported_extensions
|= DRSUAPI_SUPPORTED_EXTENSION_ADDENTRYREPLY_V3
;
107 our_bind_info28
->site_guid
= GUID_zero();
108 our_bind_info28
->pid
= 0;
109 our_bind_info28
->repl_epoch
= 1;
111 our_bind_info_ctr
= &ctx
->admin
.drsuapi
.our_bind_info_ctr
;
112 our_bind_info_ctr
->length
= 28;
113 our_bind_info_ctr
->info
.info28
= *our_bind_info28
;
115 GUID_from_string(DRSUAPI_DS_BIND_GUID
, &ctx
->admin
.drsuapi
.bind_guid
);
117 ctx
->admin
.drsuapi
.req
.in
.bind_guid
= &ctx
->admin
.drsuapi
.bind_guid
;
118 ctx
->admin
.drsuapi
.req
.in
.bind_info
= our_bind_info_ctr
;
119 ctx
->admin
.drsuapi
.req
.out
.bind_handle
= &ctx
->admin
.drsuapi
.bind_handle
;
122 ctx
->new_dc
.credentials
= cmdline_credentials
;
124 our_bind_info28
= &ctx
->new_dc
.drsuapi
.our_bind_info28
;
125 our_bind_info28
->supported_extensions
|= DRSUAPI_SUPPORTED_EXTENSION_BASE
;
126 our_bind_info28
->supported_extensions
|= DRSUAPI_SUPPORTED_EXTENSION_ASYNC_REPLICATION
;
127 our_bind_info28
->supported_extensions
|= DRSUAPI_SUPPORTED_EXTENSION_REMOVEAPI
;
128 our_bind_info28
->supported_extensions
|= DRSUAPI_SUPPORTED_EXTENSION_MOVEREQ_V2
;
129 our_bind_info28
->supported_extensions
|= DRSUAPI_SUPPORTED_EXTENSION_GETCHG_COMPRESS
;
130 our_bind_info28
->supported_extensions
|= DRSUAPI_SUPPORTED_EXTENSION_DCINFO_V1
;
131 our_bind_info28
->supported_extensions
|= DRSUAPI_SUPPORTED_EXTENSION_RESTORE_USN_OPTIMIZATION
;
132 our_bind_info28
->supported_extensions
|= DRSUAPI_SUPPORTED_EXTENSION_KCC_EXECUTE
;
133 our_bind_info28
->supported_extensions
|= DRSUAPI_SUPPORTED_EXTENSION_ADDENTRY_V2
;
134 our_bind_info28
->supported_extensions
|= DRSUAPI_SUPPORTED_EXTENSION_LINKED_VALUE_REPLICATION
;
135 our_bind_info28
->supported_extensions
|= DRSUAPI_SUPPORTED_EXTENSION_DCINFO_V2
;
136 our_bind_info28
->supported_extensions
|= DRSUAPI_SUPPORTED_EXTENSION_INSTANCE_TYPE_NOT_REQ_ON_MOD
;
137 our_bind_info28
->supported_extensions
|= DRSUAPI_SUPPORTED_EXTENSION_CRYPTO_BIND
;
138 our_bind_info28
->supported_extensions
|= DRSUAPI_SUPPORTED_EXTENSION_GET_REPL_INFO
;
139 our_bind_info28
->supported_extensions
|= DRSUAPI_SUPPORTED_EXTENSION_STRONG_ENCRYPTION
;
140 our_bind_info28
->supported_extensions
|= DRSUAPI_SUPPORTED_EXTENSION_DCINFO_V01
;
141 our_bind_info28
->supported_extensions
|= DRSUAPI_SUPPORTED_EXTENSION_TRANSITIVE_MEMBERSHIP
;
142 our_bind_info28
->supported_extensions
|= DRSUAPI_SUPPORTED_EXTENSION_ADD_SID_HISTORY
;
143 our_bind_info28
->supported_extensions
|= DRSUAPI_SUPPORTED_EXTENSION_POST_BETA3
;
144 our_bind_info28
->supported_extensions
|= DRSUAPI_SUPPORTED_EXTENSION_GET_MEMBERSHIPS2
;
145 our_bind_info28
->supported_extensions
|= DRSUAPI_SUPPORTED_EXTENSION_GETCHGREQ_V6
;
146 our_bind_info28
->supported_extensions
|= DRSUAPI_SUPPORTED_EXTENSION_NONDOMAIN_NCS
;
147 our_bind_info28
->supported_extensions
|= DRSUAPI_SUPPORTED_EXTENSION_GETCHGREQ_V8
;
148 our_bind_info28
->supported_extensions
|= DRSUAPI_SUPPORTED_EXTENSION_GETCHGREPLY_V5
;
149 our_bind_info28
->supported_extensions
|= DRSUAPI_SUPPORTED_EXTENSION_GETCHGREPLY_V6
;
150 our_bind_info28
->supported_extensions
|= DRSUAPI_SUPPORTED_EXTENSION_ADDENTRYREPLY_V3
;
151 our_bind_info28
->supported_extensions
|= DRSUAPI_SUPPORTED_EXTENSION_GETCHGREPLY_V7
;
152 our_bind_info28
->supported_extensions
|= DRSUAPI_SUPPORTED_EXTENSION_VERIFY_OBJECT
;
153 if (lp_parm_bool(tctx
->lp_ctx
, NULL
, "dssync", "xpress", false)) {
154 our_bind_info28
->supported_extensions
|= DRSUAPI_SUPPORTED_EXTENSION_XPRESS_COMPRESS
;
156 our_bind_info28
->site_guid
= GUID_zero();
157 our_bind_info28
->pid
= 0;
158 our_bind_info28
->repl_epoch
= 0;
160 our_bind_info_ctr
= &ctx
->new_dc
.drsuapi
.our_bind_info_ctr
;
161 our_bind_info_ctr
->length
= 28;
162 our_bind_info_ctr
->info
.info28
= *our_bind_info28
;
164 GUID_from_string(DRSUAPI_DS_BIND_GUID_W2K3
, &ctx
->new_dc
.drsuapi
.bind_guid
);
166 ctx
->new_dc
.drsuapi
.req
.in
.bind_guid
= &ctx
->new_dc
.drsuapi
.bind_guid
;
167 ctx
->new_dc
.drsuapi
.req
.in
.bind_info
= our_bind_info_ctr
;
168 ctx
->new_dc
.drsuapi
.req
.out
.bind_handle
= &ctx
->new_dc
.drsuapi
.bind_handle
;
170 ctx
->new_dc
.invocation_id
= ctx
->new_dc
.drsuapi
.bind_guid
;
177 static bool _test_DsBind(struct torture_context
*tctx
,
178 struct DsSyncTest
*ctx
, struct cli_credentials
*credentials
, struct DsSyncBindInfo
*b
)
183 status
= dcerpc_pipe_connect_b(ctx
,
184 &b
->drs_pipe
, ctx
->drsuapi_binding
,
186 credentials
, tctx
->ev
, tctx
->lp_ctx
);
188 if (!NT_STATUS_IS_OK(status
)) {
189 printf("Failed to connect to server as a BDC: %s\n", nt_errstr(status
));
193 status
= dcerpc_drsuapi_DsBind(b
->drs_pipe
, ctx
, &b
->req
);
194 if (!NT_STATUS_IS_OK(status
)) {
195 const char *errstr
= nt_errstr(status
);
196 if (NT_STATUS_EQUAL(status
, NT_STATUS_NET_WRITE_FAULT
)) {
197 errstr
= dcerpc_errstr(ctx
, b
->drs_pipe
->last_fault_code
);
199 printf("dcerpc_drsuapi_DsBind failed - %s\n", errstr
);
201 } else if (!W_ERROR_IS_OK(b
->req
.out
.result
)) {
202 printf("DsBind failed - %s\n", win_errstr(b
->req
.out
.result
));
206 ZERO_STRUCT(b
->peer_bind_info28
);
207 if (b
->req
.out
.bind_info
) {
208 switch (b
->req
.out
.bind_info
->length
) {
210 struct drsuapi_DsBindInfo24
*info24
;
211 info24
= &b
->req
.out
.bind_info
->info
.info24
;
212 b
->peer_bind_info28
.supported_extensions
= info24
->supported_extensions
;
213 b
->peer_bind_info28
.site_guid
= info24
->site_guid
;
214 b
->peer_bind_info28
.pid
= info24
->pid
;
215 b
->peer_bind_info28
.repl_epoch
= 0;
219 struct drsuapi_DsBindInfo48
*info48
;
220 info48
= &b
->req
.out
.bind_info
->info
.info48
;
221 b
->peer_bind_info28
.supported_extensions
= info48
->supported_extensions
;
222 b
->peer_bind_info28
.site_guid
= info48
->site_guid
;
223 b
->peer_bind_info28
.pid
= info48
->pid
;
224 b
->peer_bind_info28
.repl_epoch
= info48
->repl_epoch
;
228 b
->peer_bind_info28
= b
->req
.out
.bind_info
->info
.info28
;
231 printf("DsBind - warning: unknown BindInfo length: %u\n",
232 b
->req
.out
.bind_info
->length
);
239 static bool test_LDAPBind(struct torture_context
*tctx
, struct DsSyncTest
*ctx
,
240 struct cli_credentials
*credentials
, struct DsSyncLDAPInfo
*l
)
244 struct ldb_context
*ldb
;
246 const char *modules_option
[] = { "modules:paged_searches", NULL
};
247 ctx
->admin
.ldap
.ldb
= ldb
= ldb_init(ctx
, tctx
->ev
);
252 /* Despite us loading the schema from the AD server, we need
253 * the samba handlers to get the extended DN syntax stuff */
254 ret
= ldb_register_samba_handlers(ldb
);
260 ldb_set_modules_dir(ldb
,
263 lp_modulesdir(tctx
->lp_ctx
)));
265 if (ldb_set_opaque(ldb
, "credentials", credentials
)) {
270 if (ldb_set_opaque(ldb
, "loadparm", tctx
->lp_ctx
)) {
275 ret
= ldb_connect(ldb
, ctx
->ldap_url
, 0, modules_option
);
276 if (ret
!= LDB_SUCCESS
) {
278 torture_assert_int_equal(tctx
, ret
, LDB_SUCCESS
, "Failed to make LDB connection to target");
281 printf("connected to LDAP: %s\n", ctx
->ldap_url
);
286 static bool test_GetInfo(struct torture_context
*tctx
, struct DsSyncTest
*ctx
)
289 struct drsuapi_DsCrackNames r
;
290 union drsuapi_DsNameRequest req
;
291 union drsuapi_DsNameCtr ctr
;
292 int32_t level_out
= 0;
293 struct drsuapi_DsNameString names
[1];
295 struct cldap_socket
*cldap
;
296 struct cldap_netlogon search
;
298 status
= cldap_socket_init(ctx
, NULL
, NULL
, NULL
, &cldap
);
299 if (!NT_STATUS_IS_OK(status
)) {
300 printf("failed to setup cldap socket - %s\n",
305 r
.in
.bind_handle
= &ctx
->admin
.drsuapi
.bind_handle
;
308 r
.in
.req
->req1
.codepage
= 1252; /* western european */
309 r
.in
.req
->req1
.language
= 0x00000407; /* german */
310 r
.in
.req
->req1
.count
= 1;
311 r
.in
.req
->req1
.names
= names
;
312 r
.in
.req
->req1
.format_flags
= DRSUAPI_DS_NAME_FLAG_NO_FLAGS
;
313 r
.in
.req
->req1
.format_offered
= DRSUAPI_DS_NAME_FORMAT_NT4_ACCOUNT
;
314 r
.in
.req
->req1
.format_desired
= DRSUAPI_DS_NAME_FORMAT_FQDN_1779
;
315 names
[0].str
= talloc_asprintf(ctx
, "%s\\", lp_workgroup(tctx
->lp_ctx
));
317 r
.out
.level_out
= &level_out
;
320 status
= dcerpc_drsuapi_DsCrackNames(ctx
->admin
.drsuapi
.drs_pipe
, ctx
, &r
);
321 if (!NT_STATUS_IS_OK(status
)) {
322 const char *errstr
= nt_errstr(status
);
323 if (NT_STATUS_EQUAL(status
, NT_STATUS_NET_WRITE_FAULT
)) {
324 errstr
= dcerpc_errstr(ctx
, ctx
->admin
.drsuapi
.drs_pipe
->last_fault_code
);
326 printf("dcerpc_drsuapi_DsCrackNames failed - %s\n", errstr
);
328 } else if (!W_ERROR_IS_OK(r
.out
.result
)) {
329 printf("DsCrackNames failed - %s\n", win_errstr(r
.out
.result
));
333 ctx
->domain_dn
= r
.out
.ctr
->ctr1
->array
[0].result_name
;
336 search
.in
.dest_address
= ctx
->drsuapi_binding
->host
;
337 search
.in
.dest_port
= lp_cldap_port(tctx
->lp_ctx
);
338 search
.in
.acct_control
= -1;
339 search
.in
.version
= NETLOGON_NT_VERSION_5
| NETLOGON_NT_VERSION_5EX
;
340 search
.in
.map_response
= true;
341 status
= cldap_netlogon(cldap
, lp_iconv_convenience(tctx
->lp_ctx
), ctx
, &search
);
342 if (!NT_STATUS_IS_OK(status
)) {
343 const char *errstr
= nt_errstr(status
);
344 ctx
->site_name
= talloc_asprintf(ctx
, "%s", "Default-First-Site-Name");
345 printf("cldap_netlogon() returned %s. Defaulting to Site-Name: %s\n", errstr
, ctx
->site_name
);
347 ctx
->site_name
= talloc_steal(ctx
, search
.out
.netlogon
.data
.nt5_ex
.client_site
);
348 printf("cldap_netlogon() returned Client Site-Name: %s.\n",ctx
->site_name
);
349 printf("cldap_netlogon() returned Server Site-Name: %s.\n",search
.out
.netlogon
.data
.nt5_ex
.server_site
);
352 if (!ctx
->domain_dn
) {
353 struct ldb_context
*ldb
= ldb_init(ctx
, tctx
->ev
);
354 struct ldb_dn
*dn
= samdb_dns_domain_to_dn(ldb
, ctx
, search
.out
.netlogon
.data
.nt5_ex
.dns_domain
);
355 ctx
->domain_dn
= ldb_dn_alloc_linearized(ctx
, dn
);
363 static bool test_analyse_objects(struct torture_context
*tctx
,
364 struct DsSyncTest
*ctx
,
365 const char *partition
,
366 const struct drsuapi_DsReplicaOIDMapping_Ctr
*mapping_ctr
,
367 uint32_t object_count
,
368 const struct drsuapi_DsReplicaObjectListItemEx
*first_object
,
369 const DATA_BLOB
*gensec_skey
)
371 static uint32_t object_id
;
372 const char *save_values_dir
;
373 const struct drsuapi_DsReplicaObjectListItemEx
*cur
;
374 struct ldb_context
*ldb
= ctx
->admin
.ldap
.ldb
;
375 struct ldb_dn
*deleted_dn
;
378 struct dsdb_extended_replicated_objects
*objs
;
379 struct ldb_extended_dn_control
*extended_dn_ctrl
;
381 if (!dsdb_get_schema(ldb
)) {
382 struct dsdb_schema
*ldap_schema
;
383 struct ldb_result
*a_res
;
384 struct ldb_result
*c_res
;
385 struct ldb_dn
*schema_dn
= ldb_get_schema_basedn(ldb
);
386 ldap_schema
= dsdb_new_schema(ctx
, lp_iconv_convenience(tctx
->lp_ctx
));
390 status
= dsdb_load_prefixmap_from_drsuapi(ldap_schema
, mapping_ctr
);
393 * load the attribute definitions
395 ret
= ldb_search(ldb
, ldap_schema
, &a_res
,
396 schema_dn
, LDB_SCOPE_ONELEVEL
, NULL
,
397 "(objectClass=attributeSchema)");
398 if (ret
!= LDB_SUCCESS
) {
399 DEBUG(0, ("load schema from LDAP for DSSYNC: failed to search attributeSchema objects: %s",
400 ldb_errstring(ldb
)));
405 * load the objectClass definitions
407 ret
= ldb_search(ldb
, ldap_schema
, &c_res
,
408 schema_dn
, LDB_SCOPE_ONELEVEL
, NULL
,
409 "(objectClass=classSchema)");
410 if (ret
!= LDB_SUCCESS
) {
411 DEBUG(0, ("load schema from LDAP for DSSYNC: failed to search classSchema objects: %s",
412 ldb_errstring(ldb
)));
417 for (i
=0; i
< a_res
->count
; i
++) {
418 status
= dsdb_attribute_from_ldb(ldb
, ldap_schema
, a_res
->msgs
[i
]);
419 if (!W_ERROR_IS_OK(status
)) {
420 DEBUG(0, ("load schema from LDAP for DSSYNC: failed to load attribute definition: %s:%s",
421 ldb_dn_get_linearized(a_res
->msgs
[i
]->dn
),
422 win_errstr(status
)));
427 for (i
=0; i
< c_res
->count
; i
++) {
428 status
= dsdb_class_from_ldb(ldap_schema
, c_res
->msgs
[i
]);
429 if (!W_ERROR_IS_OK(status
)) {
430 DEBUG(0, ("load scheam from LDAP for DSSYNC: failed to load class definition: %s:%s",
431 ldb_dn_get_linearized(c_res
->msgs
[i
]->dn
),
432 win_errstr(status
)));
438 ret
= dsdb_set_schema(ldb
, ldap_schema
);
439 if (ret
!= LDB_SUCCESS
) {
440 DEBUG(0, ("load schema from LDAP for DSSYNC: failed to set schema: %s\n", ldb_strerror(ret
)));
445 status
= dsdb_extended_replicated_objects_convert(ldb
,
454 if (!W_ERROR_IS_OK(status
)) {
455 DEBUG(0, ("load scheam from LDAP for DSSYNC: failed to parse objects: %s",
456 win_errstr(status
)));
460 extended_dn_ctrl
= talloc(objs
, struct ldb_extended_dn_control
);
461 extended_dn_ctrl
->type
= 1;
463 deleted_dn
= ldb_dn_new(objs
, ldb
, partition
);
464 ldb_dn_add_child_fmt(deleted_dn
, "CN=Deleted Objects");
466 for (i
=0; i
< object_count
; i
++) {
467 struct ldb_request
*search_req
;
468 struct ldb_result
*res
;
469 struct ldb_message
*new_msg
, *drs_msg
, *ldap_msg
;
470 const char **attrs
= talloc_array(objs
, const char *, objs
->objects
[i
].msg
->num_elements
+1);
471 for (j
=0; j
< objs
->objects
[i
].msg
->num_elements
; j
++) {
472 attrs
[j
] = objs
->objects
[i
].msg
->elements
[j
].name
;
475 res
= talloc_zero(objs
, struct ldb_result
);
477 return LDB_ERR_OPERATIONS_ERROR
;
479 ret
= ldb_build_search_req(&search_req
, ldb
, objs
,
480 objs
->objects
[i
].msg
->dn
,
486 ldb_search_default_callback
,
488 if (ret
!= LDB_SUCCESS
) {
491 talloc_steal(search_req
, res
);
492 ret
= ldb_request_add_control(search_req
, LDB_CONTROL_SHOW_DELETED_OID
, true, NULL
);
493 if (ret
!= LDB_SUCCESS
) {
497 ret
= ldb_request_add_control(search_req
, LDB_CONTROL_EXTENDED_DN_OID
, true, extended_dn_ctrl
);
498 if (ret
!= LDB_SUCCESS
) {
502 ret
= ldb_request(ldb
, search_req
);
503 if (ret
== LDB_SUCCESS
) {
504 ret
= ldb_wait(search_req
->handle
, LDB_WAIT_ALL
);
507 if (ret
!= LDB_SUCCESS
) {
508 DEBUG(0, ("Could not re-fetch object just delivered over DRS: %s", ldb_errstring(ldb
)));
509 torture_assert_int_equal(tctx
, ret
, LDB_SUCCESS
, "Could not re-fetch object just delivered over DRS");
511 torture_assert_int_equal(tctx
, res
->count
, 1, "Could not re-fetch object just delivered over DRS");
512 ldap_msg
= res
->msgs
[0];
513 for (j
=0; j
< ldap_msg
->num_elements
; j
++) {
514 ldap_msg
->elements
[j
].flags
= LDB_FLAG_MOD_ADD
;
515 /* For unknown reasons, there is no nTSecurityDescriptor on cn=deleted objects over LDAP, but there is over DRS! Skip it on both transports for now here so */
516 if ((ldb_attr_cmp(ldap_msg
->elements
[j
].name
, "nTSecurityDescriptor") == 0) &&
517 (ldb_dn_compare(ldap_msg
->dn
, deleted_dn
) == 0)) {
518 ldb_msg_remove_element(ldap_msg
, &ldap_msg
->elements
[j
]);
524 drs_msg
= ldb_msg_canonicalize(ldb
, objs
->objects
[i
].msg
);
525 talloc_steal(search_req
, drs_msg
);
527 for (j
=0; j
< drs_msg
->num_elements
; j
++) {
528 if (drs_msg
->elements
[j
].num_values
== 0) {
529 ldb_msg_remove_element(drs_msg
, &drs_msg
->elements
[j
]);
533 /* For unknown reasons, there is no nTSecurityDescriptor on cn=deleted objects over LDAP, but there is over DRS! */
534 } else if ((ldb_attr_cmp(drs_msg
->elements
[j
].name
, "nTSecurityDescriptor") == 0) &&
535 (ldb_dn_compare(drs_msg
->dn
, deleted_dn
) == 0)) {
536 ldb_msg_remove_element(drs_msg
, &drs_msg
->elements
[j
]);
539 } else if (ldb_attr_cmp(drs_msg
->elements
[j
].name
, "unicodePwd") == 0 ||
540 ldb_attr_cmp(drs_msg
->elements
[j
].name
, "dBCSPwd") == 0 ||
541 ldb_attr_cmp(drs_msg
->elements
[j
].name
, "ntPwdHistory") == 0 ||
542 ldb_attr_cmp(drs_msg
->elements
[j
].name
, "lmPwdHistory") == 0 ||
543 ldb_attr_cmp(drs_msg
->elements
[j
].name
, "supplementalCredentials") == 0 ||
544 ldb_attr_cmp(drs_msg
->elements
[j
].name
, "priorValue") == 0 ||
545 ldb_attr_cmp(drs_msg
->elements
[j
].name
, "currentValue") == 0 ||
546 ldb_attr_cmp(drs_msg
->elements
[j
].name
, "trustAuthOutgoing") == 0 ||
547 ldb_attr_cmp(drs_msg
->elements
[j
].name
, "trustAuthIncoming") == 0 ||
548 ldb_attr_cmp(drs_msg
->elements
[j
].name
, "initialAuthOutgoing") == 0 ||
549 ldb_attr_cmp(drs_msg
->elements
[j
].name
, "initialAuthIncoming") == 0) {
551 /* These are not shown over LDAP, so we need to skip them for the comparison */
552 ldb_msg_remove_element(drs_msg
, &drs_msg
->elements
[j
]);
556 drs_msg
->elements
[j
].flags
= LDB_FLAG_MOD_ADD
;
561 new_msg
= ldb_msg_diff(ldb
, drs_msg
, ldap_msg
);
562 talloc_steal(search_req
, new_msg
);
563 if (new_msg
->num_elements
!= 0) {
565 struct ldb_ldif ldif
;
566 fprintf(stdout
, "#\n");
567 ldif
.changetype
= LDB_CHANGETYPE_MODIFY
;
569 s
= ldb_ldif_write_string(ldb
, new_msg
, &ldif
);
570 DEBUG(0, ("Difference in between DRS and LDAP objects: %s\n", s
));
571 talloc_free(search_req
);
572 torture_assert_int_equal(tctx
, new_msg
->num_elements
, 0, "Should have no objects in 'difference' message");
575 /* search_req is used as a tmp talloc context in the above */
576 talloc_free(search_req
);
579 if (!lp_parm_bool(tctx
->lp_ctx
, NULL
, "dssync", "print_pwd_blobs", false)) {
584 save_values_dir
= lp_parm_string(tctx
->lp_ctx
, NULL
, "dssync", "save_pwd_blobs_dir");
586 for (cur
= first_object
; cur
; cur
= cur
->next_object
) {
588 struct dom_sid
*sid
= NULL
;
590 bool dn_printed
= false;
592 if (!cur
->object
.identifier
) continue;
594 dn
= cur
->object
.identifier
->dn
;
595 if (cur
->object
.identifier
->sid
.num_auths
> 0) {
596 sid
= &cur
->object
.identifier
->sid
;
597 rid
= sid
->sub_auths
[sid
->num_auths
- 1];
600 for (i
=0; i
< cur
->object
.attribute_ctr
.num_attributes
; i
++) {
602 const char *name
= NULL
;
604 DATA_BLOB
*enc_data
= NULL
;
605 DATA_BLOB plain_data
;
606 struct drsuapi_DsReplicaAttribute
*attr
;
607 ndr_pull_flags_fn_t pull_fn
= NULL
;
608 ndr_print_fn_t print_fn
= NULL
;
610 attr
= &cur
->object
.attribute_ctr
.attributes
[i
];
612 switch (attr
->attid
) {
613 case DRSUAPI_ATTRIBUTE_dBCSPwd
:
617 case DRSUAPI_ATTRIBUTE_unicodePwd
:
621 case DRSUAPI_ATTRIBUTE_ntPwdHistory
:
622 name
= "ntPwdHistory";
625 case DRSUAPI_ATTRIBUTE_lmPwdHistory
:
626 name
= "lmPwdHistory";
629 case DRSUAPI_ATTRIBUTE_supplementalCredentials
:
630 name
= "supplementalCredentials";
631 pull_fn
= (ndr_pull_flags_fn_t
)ndr_pull_supplementalCredentialsBlob
;
632 print_fn
= (ndr_print_fn_t
)ndr_print_supplementalCredentialsBlob
;
633 ptr
= talloc(ctx
, struct supplementalCredentialsBlob
);
635 case DRSUAPI_ATTRIBUTE_priorValue
:
638 case DRSUAPI_ATTRIBUTE_currentValue
:
639 name
= "currentValue";
641 case DRSUAPI_ATTRIBUTE_trustAuthOutgoing
:
642 name
= "trustAuthOutgoing";
643 pull_fn
= (ndr_pull_flags_fn_t
)ndr_pull_trustAuthInOutBlob
;
644 print_fn
= (ndr_print_fn_t
)ndr_print_trustAuthInOutBlob
;
645 ptr
= talloc(ctx
, struct trustAuthInOutBlob
);
647 case DRSUAPI_ATTRIBUTE_trustAuthIncoming
:
648 name
= "trustAuthIncoming";
649 pull_fn
= (ndr_pull_flags_fn_t
)ndr_pull_trustAuthInOutBlob
;
650 print_fn
= (ndr_print_fn_t
)ndr_print_trustAuthInOutBlob
;
651 ptr
= talloc(ctx
, struct trustAuthInOutBlob
);
653 case DRSUAPI_ATTRIBUTE_initialAuthOutgoing
:
654 name
= "initialAuthOutgoing";
656 case DRSUAPI_ATTRIBUTE_initialAuthIncoming
:
657 name
= "initialAuthIncoming";
663 if (attr
->value_ctr
.num_values
!= 1) continue;
665 if (!attr
->value_ctr
.values
[0].blob
) continue;
667 enc_data
= attr
->value_ctr
.values
[0].blob
;
668 ZERO_STRUCT(plain_data
);
670 werr
= drsuapi_decrypt_attribute_value(ctx
, gensec_skey
, rcrypt
,
672 enc_data
, &plain_data
);
673 if (!W_ERROR_IS_OK(werr
)) {
674 DEBUG(0, ("Failed to decrypt %s\n", name
));
679 DEBUG(0,("DN[%u] %s\n", object_id
, dn
));
682 DEBUGADD(0,("ATTR: %s enc.length=%lu plain.length=%lu\n",
683 name
, (long)enc_data
->length
, (long)plain_data
.length
));
684 if (plain_data
.length
) {
685 enum ndr_err_code ndr_err
;
686 dump_data(0, plain_data
.data
, plain_data
.length
);
687 if (save_values_dir
) {
689 fname
= talloc_asprintf(ctx
, "%s/%s%02d",
694 ok
= file_save(fname
, plain_data
.data
, plain_data
.length
);
696 DEBUGADD(0,("Failed to save '%s'\n", fname
));
703 /* Can't use '_all' because of PIDL bugs with relative pointers */
704 ndr_err
= ndr_pull_struct_blob(&plain_data
, ptr
,
705 lp_iconv_convenience(tctx
->lp_ctx
), ptr
,
707 if (NDR_ERR_CODE_IS_SUCCESS(ndr_err
)) {
708 ndr_print_debug(print_fn
, name
, ptr
);
710 DEBUG(0, ("Failed to decode %s\n", name
));
714 dump_data(0, enc_data
->data
, enc_data
->length
);
723 static bool test_FetchData(struct torture_context
*tctx
, struct DsSyncTest
*ctx
)
728 uint64_t highest_usn
= 0;
729 const char *partition
= NULL
;
730 struct drsuapi_DsGetNCChanges r
;
731 union drsuapi_DsGetNCChangesRequest req
;
732 struct drsuapi_DsReplicaObjectIdentifier nc
;
733 struct drsuapi_DsGetNCChangesCtr1
*ctr1
= NULL
;
734 struct drsuapi_DsGetNCChangesCtr6
*ctr6
= NULL
;
735 int32_t out_level
= 0;
736 struct GUID null_guid
;
737 struct dom_sid null_sid
;
738 DATA_BLOB gensec_skey
;
750 ZERO_STRUCT(null_guid
);
751 ZERO_STRUCT(null_sid
);
753 partition
= lp_parm_string(tctx
->lp_ctx
, NULL
, "dssync", "partition");
754 if (partition
== NULL
) {
755 partition
= ctx
->domain_dn
;
756 printf("dssync:partition not specified, defaulting to %s.\n", ctx
->domain_dn
);
759 highest_usn
= lp_parm_int(tctx
->lp_ctx
, NULL
, "dssync", "highest_usn", 0);
761 array
[0].level
= lp_parm_int(tctx
->lp_ctx
, NULL
, "dssync", "get_nc_changes_level", array
[0].level
);
763 if (lp_parm_bool(tctx
->lp_ctx
, NULL
, "dssync", "print_pwd_blobs", false)) {
764 const struct samr_Password
*nthash
;
765 nthash
= cli_credentials_get_nt_hash(ctx
->new_dc
.credentials
, ctx
);
767 dump_data_pw("CREDENTIALS nthash:", nthash
->hash
, sizeof(nthash
->hash
));
770 status
= gensec_session_key(ctx
->new_dc
.drsuapi
.drs_pipe
->conn
->security_state
.generic_state
,
772 if (!NT_STATUS_IS_OK(status
)) {
773 printf("failed to get gensec session key: %s\n", nt_errstr(status
));
777 for (i
=0; i
< ARRAY_SIZE(array
); i
++) {
778 printf("testing DsGetNCChanges level %d\n",
781 r
.in
.bind_handle
= &ctx
->new_dc
.drsuapi
.bind_handle
;
782 r
.in
.level
= array
[i
].level
;
784 switch (r
.in
.level
) {
791 r
.in
.req
->req5
.destination_dsa_guid
= ctx
->new_dc
.invocation_id
;
792 r
.in
.req
->req5
.source_dsa_invocation_id
= null_guid
;
793 r
.in
.req
->req5
.naming_context
= &nc
;
794 r
.in
.req
->req5
.highwatermark
.tmp_highest_usn
= highest_usn
;
795 r
.in
.req
->req5
.highwatermark
.reserved_usn
= 0;
796 r
.in
.req
->req5
.highwatermark
.highest_usn
= highest_usn
;
797 r
.in
.req
->req5
.uptodateness_vector
= NULL
;
798 r
.in
.req
->req5
.replica_flags
= 0;
799 if (lp_parm_bool(tctx
->lp_ctx
, NULL
, "dssync", "compression", false)) {
800 r
.in
.req
->req5
.replica_flags
|= DRSUAPI_DS_REPLICA_NEIGHBOUR_COMPRESS_CHANGES
;
802 if (lp_parm_bool(tctx
->lp_ctx
, NULL
, "dssync", "neighbour_writeable", true)) {
803 r
.in
.req
->req5
.replica_flags
|= DRSUAPI_DS_REPLICA_NEIGHBOUR_WRITEABLE
;
805 r
.in
.req
->req5
.replica_flags
|= DRSUAPI_DS_REPLICA_NEIGHBOUR_SYNC_ON_STARTUP
806 | DRSUAPI_DS_REPLICA_NEIGHBOUR_DO_SCHEDULED_SYNCS
807 | DRSUAPI_DS_REPLICA_NEIGHBOUR_RETURN_OBJECT_PARENTS
808 | DRSUAPI_DS_REPLICA_NEIGHBOUR_NEVER_SYNCED
810 r
.in
.req
->req5
.max_object_count
= 133;
811 r
.in
.req
->req5
.max_ndr_size
= 1336770;
812 r
.in
.req
->req5
.extended_op
= DRSUAPI_EXOP_NONE
;
813 r
.in
.req
->req5
.fsmo_info
= 0;
820 /* nc.dn can be set to any other ad partition */
823 r
.in
.req
->req8
.destination_dsa_guid
= ctx
->new_dc
.invocation_id
;
824 r
.in
.req
->req8
.source_dsa_invocation_id
= null_guid
;
825 r
.in
.req
->req8
.naming_context
= &nc
;
826 r
.in
.req
->req8
.highwatermark
.tmp_highest_usn
= highest_usn
;
827 r
.in
.req
->req8
.highwatermark
.reserved_usn
= 0;
828 r
.in
.req
->req8
.highwatermark
.highest_usn
= highest_usn
;
829 r
.in
.req
->req8
.uptodateness_vector
= NULL
;
830 r
.in
.req
->req8
.replica_flags
= 0;
831 if (lp_parm_bool(tctx
->lp_ctx
, NULL
, "dssync", "compression", false)) {
832 r
.in
.req
->req8
.replica_flags
|= DRSUAPI_DS_REPLICA_NEIGHBOUR_COMPRESS_CHANGES
;
834 if (lp_parm_bool(tctx
->lp_ctx
, NULL
, "dssync", "neighbour_writeable", true)) {
835 r
.in
.req
->req8
.replica_flags
|= DRSUAPI_DS_REPLICA_NEIGHBOUR_WRITEABLE
;
837 r
.in
.req
->req8
.replica_flags
|= DRSUAPI_DS_REPLICA_NEIGHBOUR_SYNC_ON_STARTUP
838 | DRSUAPI_DS_REPLICA_NEIGHBOUR_DO_SCHEDULED_SYNCS
839 | DRSUAPI_DS_REPLICA_NEIGHBOUR_RETURN_OBJECT_PARENTS
840 | DRSUAPI_DS_REPLICA_NEIGHBOUR_NEVER_SYNCED
842 r
.in
.req
->req8
.max_object_count
= 402;
843 r
.in
.req
->req8
.max_ndr_size
= 402116;
845 r
.in
.req
->req8
.extended_op
= DRSUAPI_EXOP_NONE
;
846 r
.in
.req
->req8
.fsmo_info
= 0;
847 r
.in
.req
->req8
.partial_attribute_set
= NULL
;
848 r
.in
.req
->req8
.partial_attribute_set_ex
= NULL
;
849 r
.in
.req
->req8
.mapping_ctr
.num_mappings
= 0;
850 r
.in
.req
->req8
.mapping_ctr
.mappings
= NULL
;
855 printf("Dumping AD partition: %s\n", nc
.dn
);
858 union drsuapi_DsGetNCChangesCtr ctr
;
862 r
.out
.level_out
= &_level
;
865 if (r
.in
.level
== 5) {
866 DEBUG(0,("start[%d] tmp_higest_usn: %llu , highest_usn: %llu\n",y
,
867 (long long)r
.in
.req
->req5
.highwatermark
.tmp_highest_usn
,
868 (long long)r
.in
.req
->req5
.highwatermark
.highest_usn
));
871 if (r
.in
.level
== 8) {
872 DEBUG(0,("start[%d] tmp_higest_usn: %llu , highest_usn: %llu\n",y
,
873 (long long)r
.in
.req
->req8
.highwatermark
.tmp_highest_usn
,
874 (long long)r
.in
.req
->req8
.highwatermark
.highest_usn
));
877 status
= dcerpc_drsuapi_DsGetNCChanges(ctx
->new_dc
.drsuapi
.drs_pipe
, ctx
, &r
);
878 torture_drsuapi_assert_call(tctx
, ctx
->new_dc
.drsuapi
.drs_pipe
, status
,
879 &r
, "dcerpc_drsuapi_DsGetNCChanges");
881 if (ret
== true && *r
.out
.level_out
== 1) {
883 ctr1
= &r
.out
.ctr
->ctr1
;
884 } else if (ret
== true && *r
.out
.level_out
== 2 &&
885 r
.out
.ctr
->ctr2
.mszip1
.ts
) {
887 ctr1
= &r
.out
.ctr
->ctr2
.mszip1
.ts
->ctr1
;
890 if (out_level
== 1) {
891 DEBUG(0,("end[%d] tmp_highest_usn: %llu , highest_usn: %llu\n",y
,
892 (long long)ctr1
->new_highwatermark
.tmp_highest_usn
,
893 (long long)ctr1
->new_highwatermark
.highest_usn
));
895 if (!test_analyse_objects(tctx
, ctx
, partition
, &ctr1
->mapping_ctr
, ctr1
->object_count
,
896 ctr1
->first_object
, &gensec_skey
)) {
900 if (ctr1
->more_data
) {
901 r
.in
.req
->req5
.highwatermark
= ctr1
->new_highwatermark
;
906 if (ret
== true && *r
.out
.level_out
== 6) {
908 ctr6
= &r
.out
.ctr
->ctr6
;
909 } else if (ret
== true && *r
.out
.level_out
== 7
910 && r
.out
.ctr
->ctr7
.level
== 6
911 && r
.out
.ctr
->ctr7
.type
== DRSUAPI_COMPRESSION_TYPE_MSZIP
912 && r
.out
.ctr
->ctr7
.ctr
.mszip6
.ts
) {
914 ctr6
= &r
.out
.ctr
->ctr7
.ctr
.mszip6
.ts
->ctr6
;
915 } else if (ret
== true && *r
.out
.level_out
== 7
916 && r
.out
.ctr
->ctr7
.level
== 6
917 && r
.out
.ctr
->ctr7
.type
== DRSUAPI_COMPRESSION_TYPE_XPRESS
918 && r
.out
.ctr
->ctr7
.ctr
.xpress6
.ts
) {
920 ctr6
= &r
.out
.ctr
->ctr7
.ctr
.xpress6
.ts
->ctr6
;
923 if (out_level
== 6) {
924 DEBUG(0,("end[%d] tmp_highest_usn: %llu , highest_usn: %llu\n",y
,
925 (long long)ctr6
->new_highwatermark
.tmp_highest_usn
,
926 (long long)ctr6
->new_highwatermark
.highest_usn
));
928 if (!test_analyse_objects(tctx
, ctx
, partition
, &ctr6
->mapping_ctr
, ctr6
->object_count
,
929 ctr6
->first_object
, &gensec_skey
)) {
933 if (ctr6
->more_data
) {
934 r
.in
.req
->req8
.highwatermark
= ctr6
->new_highwatermark
;
946 static bool test_FetchNT4Data(struct torture_context
*tctx
,
947 struct DsSyncTest
*ctx
)
950 struct drsuapi_DsGetNT4ChangeLog r
;
951 union drsuapi_DsGetNT4ChangeLogRequest req
;
952 union drsuapi_DsGetNT4ChangeLogInfo info
;
953 uint32_t level_out
= 0;
954 struct GUID null_guid
;
955 struct dom_sid null_sid
;
958 ZERO_STRUCT(null_guid
);
959 ZERO_STRUCT(null_sid
);
963 r
.in
.bind_handle
= &ctx
->new_dc
.drsuapi
.bind_handle
;
966 r
.out
.level_out
= &level_out
;
968 req
.req1
.unknown1
= lp_parm_int(tctx
->lp_ctx
, NULL
, "dssync", "nt4-1", 3);
969 req
.req1
.unknown2
= lp_parm_int(tctx
->lp_ctx
, NULL
, "dssync", "nt4-2", 0x00004000);
972 req
.req1
.length
= cookie
.length
;
973 req
.req1
.data
= cookie
.data
;
977 status
= dcerpc_drsuapi_DsGetNT4ChangeLog(ctx
->new_dc
.drsuapi
.drs_pipe
, ctx
, &r
);
978 if (NT_STATUS_EQUAL(status
, NT_STATUS_NOT_IMPLEMENTED
)) {
979 torture_skip(tctx
, "DsGetNT4ChangeLog not supported by target server");
980 } else if (!NT_STATUS_IS_OK(status
)) {
981 const char *errstr
= nt_errstr(status
);
982 if (NT_STATUS_EQUAL(status
, NT_STATUS_NET_WRITE_FAULT
)) {
983 errstr
= dcerpc_errstr(ctx
, ctx
->new_dc
.drsuapi
.drs_pipe
->last_fault_code
);
986 talloc_asprintf(tctx
, "dcerpc_drsuapi_DsGetNT4ChangeLog failed - %s\n",
988 } else if (W_ERROR_EQUAL(r
.out
.result
, WERR_INVALID_DOMAIN_ROLE
)) {
989 torture_skip(tctx
, "DsGetNT4ChangeLog not supported by target server");
990 } else if (!W_ERROR_IS_OK(r
.out
.result
)) {
992 talloc_asprintf(tctx
, "DsGetNT4ChangeLog failed - %s\n",
993 win_errstr(r
.out
.result
)));
994 } else if (*r
.out
.level_out
!= 1) {
996 talloc_asprintf(tctx
, "DsGetNT4ChangeLog unknown level - %u\n",
998 } else if (NT_STATUS_IS_OK(r
.out
.info
->info1
.status
)) {
999 } else if (NT_STATUS_EQUAL(r
.out
.info
->info1
.status
, STATUS_MORE_ENTRIES
)) {
1000 cookie
.length
= r
.out
.info
->info1
.length1
;
1001 cookie
.data
= r
.out
.info
->info1
.data1
;
1005 talloc_asprintf(tctx
, "DsGetNT4ChangeLog failed - %s\n",
1006 nt_errstr(r
.out
.info
->info1
.status
)));
1015 bool torture_rpc_dssync(struct torture_context
*torture
)
1018 TALLOC_CTX
*mem_ctx
;
1019 struct DsSyncTest
*ctx
;
1021 mem_ctx
= talloc_init("torture_rpc_dssync");
1022 ctx
= test_create_context(torture
);
1024 ret
&= _test_DsBind(torture
, ctx
, ctx
->admin
.credentials
, &ctx
->admin
.drsuapi
);
1028 ret
&= test_LDAPBind(torture
, ctx
, ctx
->admin
.credentials
, &ctx
->admin
.ldap
);
1032 ret
&= test_GetInfo(torture
, ctx
);
1033 ret
&= _test_DsBind(torture
, ctx
, ctx
->new_dc
.credentials
, &ctx
->new_dc
.drsuapi
);
1037 ret
&= test_FetchData(torture
, ctx
);
1038 ret
&= test_FetchNT4Data(torture
, ctx
);