2 Unix SMB/CIFS implementation.
4 DsGetNCChanges replication test
6 Copyright (C) Stefan (metze) Metzmacher 2005
7 Copyright (C) Brad Henry 2005
9 This program is free software; you can redistribute it and/or modify
10 it under the terms of the GNU General Public License as published by
11 the Free Software Foundation; either version 3 of the License, or
12 (at your option) any later version.
14 This program is distributed in the hope that it will be useful,
15 but WITHOUT ANY WARRANTY; without even the implied warranty of
16 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
17 GNU General Public License for more details.
19 You should have received a copy of the GNU General Public License
20 along with this program. If not, see <http://www.gnu.org/licenses/>.
24 #include "lib/cmdline/popt_common.h"
25 #include "librpc/gen_ndr/ndr_drsuapi_c.h"
26 #include "librpc/gen_ndr/ndr_drsblobs.h"
27 #include "libcli/cldap/cldap.h"
28 #include "torture/torture.h"
29 #include "../libcli/drsuapi/drsuapi.h"
30 #include "auth/gensec/gensec.h"
31 #include "param/param.h"
32 #include "dsdb/samdb/samdb.h"
33 #include "lib/ldb_wrap.h"
34 #include "torture/rpc/rpc.h"
35 #include "torture/drs/proto.h"
38 struct DsSyncBindInfo
{
39 struct dcerpc_pipe
*drs_pipe
;
40 struct drsuapi_DsBind req
;
41 struct GUID bind_guid
;
42 struct drsuapi_DsBindInfoCtr our_bind_info_ctr
;
43 struct drsuapi_DsBindInfo28 our_bind_info28
;
44 struct drsuapi_DsBindInfo28 peer_bind_info28
;
45 struct policy_handle bind_handle
;
48 struct DsSyncLDAPInfo
{
49 struct ldb_context
*ldb
;
53 struct dcerpc_binding
*drsuapi_binding
;
56 const char *site_name
;
58 const char *domain_dn
;
60 /* what we need to do as 'Administrator' */
62 struct cli_credentials
*credentials
;
63 struct DsSyncBindInfo drsuapi
;
64 struct DsSyncLDAPInfo ldap
;
67 /* what we need to do as the new dc machine account */
69 struct cli_credentials
*credentials
;
70 struct DsSyncBindInfo drsuapi
;
71 struct drsuapi_DsGetDCInfo2 dc_info2
;
72 struct GUID invocation_id
;
73 struct GUID object_guid
;
76 /* info about the old dc */
78 struct drsuapi_DsGetDomainControllerInfo dc_info
;
82 static struct DsSyncTest
*test_create_context(struct torture_context
*tctx
)
85 struct DsSyncTest
*ctx
;
86 struct drsuapi_DsBindInfo28
*our_bind_info28
;
87 struct drsuapi_DsBindInfoCtr
*our_bind_info_ctr
;
88 const char *binding
= torture_setting_string(tctx
, "binding", NULL
);
89 ctx
= talloc_zero(tctx
, struct DsSyncTest
);
90 if (!ctx
) return NULL
;
92 status
= dcerpc_parse_binding(ctx
, binding
, &ctx
->drsuapi_binding
);
93 if (!NT_STATUS_IS_OK(status
)) {
94 printf("Bad binding string %s\n", binding
);
97 ctx
->drsuapi_binding
->flags
|= DCERPC_SIGN
| DCERPC_SEAL
;
99 ctx
->ldap_url
= talloc_asprintf(ctx
, "ldap://%s", ctx
->drsuapi_binding
->host
);
102 ctx
->admin
.credentials
= cmdline_credentials
;
104 our_bind_info28
= &ctx
->admin
.drsuapi
.our_bind_info28
;
105 our_bind_info28
->supported_extensions
= 0xFFFFFFFF;
106 our_bind_info28
->supported_extensions
|= DRSUAPI_SUPPORTED_EXTENSION_ADDENTRYREPLY_V3
;
107 our_bind_info28
->site_guid
= GUID_zero();
108 our_bind_info28
->pid
= 0;
109 our_bind_info28
->repl_epoch
= 1;
111 our_bind_info_ctr
= &ctx
->admin
.drsuapi
.our_bind_info_ctr
;
112 our_bind_info_ctr
->length
= 28;
113 our_bind_info_ctr
->info
.info28
= *our_bind_info28
;
115 GUID_from_string(DRSUAPI_DS_BIND_GUID
, &ctx
->admin
.drsuapi
.bind_guid
);
117 ctx
->admin
.drsuapi
.req
.in
.bind_guid
= &ctx
->admin
.drsuapi
.bind_guid
;
118 ctx
->admin
.drsuapi
.req
.in
.bind_info
= our_bind_info_ctr
;
119 ctx
->admin
.drsuapi
.req
.out
.bind_handle
= &ctx
->admin
.drsuapi
.bind_handle
;
122 ctx
->new_dc
.credentials
= cmdline_credentials
;
124 our_bind_info28
= &ctx
->new_dc
.drsuapi
.our_bind_info28
;
125 our_bind_info28
->supported_extensions
|= DRSUAPI_SUPPORTED_EXTENSION_BASE
;
126 our_bind_info28
->supported_extensions
|= DRSUAPI_SUPPORTED_EXTENSION_ASYNC_REPLICATION
;
127 our_bind_info28
->supported_extensions
|= DRSUAPI_SUPPORTED_EXTENSION_REMOVEAPI
;
128 our_bind_info28
->supported_extensions
|= DRSUAPI_SUPPORTED_EXTENSION_MOVEREQ_V2
;
129 our_bind_info28
->supported_extensions
|= DRSUAPI_SUPPORTED_EXTENSION_GETCHG_COMPRESS
;
130 our_bind_info28
->supported_extensions
|= DRSUAPI_SUPPORTED_EXTENSION_DCINFO_V1
;
131 our_bind_info28
->supported_extensions
|= DRSUAPI_SUPPORTED_EXTENSION_RESTORE_USN_OPTIMIZATION
;
132 our_bind_info28
->supported_extensions
|= DRSUAPI_SUPPORTED_EXTENSION_KCC_EXECUTE
;
133 our_bind_info28
->supported_extensions
|= DRSUAPI_SUPPORTED_EXTENSION_ADDENTRY_V2
;
134 our_bind_info28
->supported_extensions
|= DRSUAPI_SUPPORTED_EXTENSION_LINKED_VALUE_REPLICATION
;
135 our_bind_info28
->supported_extensions
|= DRSUAPI_SUPPORTED_EXTENSION_DCINFO_V2
;
136 our_bind_info28
->supported_extensions
|= DRSUAPI_SUPPORTED_EXTENSION_INSTANCE_TYPE_NOT_REQ_ON_MOD
;
137 our_bind_info28
->supported_extensions
|= DRSUAPI_SUPPORTED_EXTENSION_CRYPTO_BIND
;
138 our_bind_info28
->supported_extensions
|= DRSUAPI_SUPPORTED_EXTENSION_GET_REPL_INFO
;
139 our_bind_info28
->supported_extensions
|= DRSUAPI_SUPPORTED_EXTENSION_STRONG_ENCRYPTION
;
140 our_bind_info28
->supported_extensions
|= DRSUAPI_SUPPORTED_EXTENSION_DCINFO_V01
;
141 our_bind_info28
->supported_extensions
|= DRSUAPI_SUPPORTED_EXTENSION_TRANSITIVE_MEMBERSHIP
;
142 our_bind_info28
->supported_extensions
|= DRSUAPI_SUPPORTED_EXTENSION_ADD_SID_HISTORY
;
143 our_bind_info28
->supported_extensions
|= DRSUAPI_SUPPORTED_EXTENSION_POST_BETA3
;
144 our_bind_info28
->supported_extensions
|= DRSUAPI_SUPPORTED_EXTENSION_GET_MEMBERSHIPS2
;
145 our_bind_info28
->supported_extensions
|= DRSUAPI_SUPPORTED_EXTENSION_GETCHGREQ_V6
;
146 our_bind_info28
->supported_extensions
|= DRSUAPI_SUPPORTED_EXTENSION_NONDOMAIN_NCS
;
147 our_bind_info28
->supported_extensions
|= DRSUAPI_SUPPORTED_EXTENSION_GETCHGREQ_V8
;
148 our_bind_info28
->supported_extensions
|= DRSUAPI_SUPPORTED_EXTENSION_GETCHGREPLY_V5
;
149 our_bind_info28
->supported_extensions
|= DRSUAPI_SUPPORTED_EXTENSION_GETCHGREPLY_V6
;
150 our_bind_info28
->supported_extensions
|= DRSUAPI_SUPPORTED_EXTENSION_ADDENTRYREPLY_V3
;
151 our_bind_info28
->supported_extensions
|= DRSUAPI_SUPPORTED_EXTENSION_GETCHGREPLY_V7
;
152 our_bind_info28
->supported_extensions
|= DRSUAPI_SUPPORTED_EXTENSION_VERIFY_OBJECT
;
153 if (lp_parm_bool(tctx
->lp_ctx
, NULL
, "dssync", "xpress", false)) {
154 our_bind_info28
->supported_extensions
|= DRSUAPI_SUPPORTED_EXTENSION_XPRESS_COMPRESS
;
156 our_bind_info28
->site_guid
= GUID_zero();
157 our_bind_info28
->pid
= 0;
158 our_bind_info28
->repl_epoch
= 0;
160 our_bind_info_ctr
= &ctx
->new_dc
.drsuapi
.our_bind_info_ctr
;
161 our_bind_info_ctr
->length
= 28;
162 our_bind_info_ctr
->info
.info28
= *our_bind_info28
;
164 GUID_from_string(DRSUAPI_DS_BIND_GUID_W2K3
, &ctx
->new_dc
.drsuapi
.bind_guid
);
166 ctx
->new_dc
.drsuapi
.req
.in
.bind_guid
= &ctx
->new_dc
.drsuapi
.bind_guid
;
167 ctx
->new_dc
.drsuapi
.req
.in
.bind_info
= our_bind_info_ctr
;
168 ctx
->new_dc
.drsuapi
.req
.out
.bind_handle
= &ctx
->new_dc
.drsuapi
.bind_handle
;
170 ctx
->new_dc
.invocation_id
= ctx
->new_dc
.drsuapi
.bind_guid
;
177 static bool _test_DsBind(struct torture_context
*tctx
,
178 struct DsSyncTest
*ctx
, struct cli_credentials
*credentials
, struct DsSyncBindInfo
*b
)
183 status
= dcerpc_pipe_connect_b(ctx
,
184 &b
->drs_pipe
, ctx
->drsuapi_binding
,
186 credentials
, tctx
->ev
, tctx
->lp_ctx
);
188 if (!NT_STATUS_IS_OK(status
)) {
189 printf("Failed to connect to server as a BDC: %s\n", nt_errstr(status
));
193 status
= dcerpc_drsuapi_DsBind(b
->drs_pipe
, ctx
, &b
->req
);
194 if (!NT_STATUS_IS_OK(status
)) {
195 const char *errstr
= nt_errstr(status
);
196 if (NT_STATUS_EQUAL(status
, NT_STATUS_NET_WRITE_FAULT
)) {
197 errstr
= dcerpc_errstr(ctx
, b
->drs_pipe
->last_fault_code
);
199 printf("dcerpc_drsuapi_DsBind failed - %s\n", errstr
);
201 } else if (!W_ERROR_IS_OK(b
->req
.out
.result
)) {
202 printf("DsBind failed - %s\n", win_errstr(b
->req
.out
.result
));
206 ZERO_STRUCT(b
->peer_bind_info28
);
207 if (b
->req
.out
.bind_info
) {
208 switch (b
->req
.out
.bind_info
->length
) {
210 struct drsuapi_DsBindInfo24
*info24
;
211 info24
= &b
->req
.out
.bind_info
->info
.info24
;
212 b
->peer_bind_info28
.supported_extensions
= info24
->supported_extensions
;
213 b
->peer_bind_info28
.site_guid
= info24
->site_guid
;
214 b
->peer_bind_info28
.pid
= info24
->pid
;
215 b
->peer_bind_info28
.repl_epoch
= 0;
219 struct drsuapi_DsBindInfo48
*info48
;
220 info48
= &b
->req
.out
.bind_info
->info
.info48
;
221 b
->peer_bind_info28
.supported_extensions
= info48
->supported_extensions
;
222 b
->peer_bind_info28
.site_guid
= info48
->site_guid
;
223 b
->peer_bind_info28
.pid
= info48
->pid
;
224 b
->peer_bind_info28
.repl_epoch
= info48
->repl_epoch
;
228 b
->peer_bind_info28
= b
->req
.out
.bind_info
->info
.info28
;
231 printf("DsBind - warning: unknown BindInfo length: %u\n",
232 b
->req
.out
.bind_info
->length
);
239 static bool test_LDAPBind(struct torture_context
*tctx
, struct DsSyncTest
*ctx
,
240 struct cli_credentials
*credentials
, struct DsSyncLDAPInfo
*l
)
244 struct ldb_context
*ldb
;
246 const char *modules_option
[] = { "modules:paged_searches", NULL
};
247 ctx
->admin
.ldap
.ldb
= ldb
= ldb_init(ctx
, tctx
->ev
);
252 /* Despite us loading the schema from the AD server, we need
253 * the samba handlers to get the extended DN syntax stuff */
254 ret
= ldb_register_samba_handlers(ldb
);
260 ldb_set_modules_dir(ldb
,
263 lp_modulesdir(tctx
->lp_ctx
)));
265 if (ldb_set_opaque(ldb
, "credentials", credentials
)) {
270 if (ldb_set_opaque(ldb
, "loadparm", tctx
->lp_ctx
)) {
275 ret
= ldb_connect(ldb
, ctx
->ldap_url
, 0, modules_option
);
276 if (ret
!= LDB_SUCCESS
) {
278 torture_assert_int_equal(tctx
, ret
, LDB_SUCCESS
, "Failed to make LDB connection to target");
281 printf("connected to LDAP: %s\n", ctx
->ldap_url
);
286 static bool test_GetInfo(struct torture_context
*tctx
, struct DsSyncTest
*ctx
)
289 struct drsuapi_DsCrackNames r
;
290 union drsuapi_DsNameRequest req
;
291 union drsuapi_DsNameCtr ctr
;
292 int32_t level_out
= 0;
293 struct drsuapi_DsNameString names
[1];
295 struct cldap_socket
*cldap
;
296 struct cldap_netlogon search
;
298 status
= cldap_socket_init(ctx
, NULL
, NULL
, NULL
, &cldap
);
299 if (!NT_STATUS_IS_OK(status
)) {
300 printf("failed to setup cldap socket - %s\n",
305 r
.in
.bind_handle
= &ctx
->admin
.drsuapi
.bind_handle
;
308 r
.in
.req
->req1
.codepage
= 1252; /* western european */
309 r
.in
.req
->req1
.language
= 0x00000407; /* german */
310 r
.in
.req
->req1
.count
= 1;
311 r
.in
.req
->req1
.names
= names
;
312 r
.in
.req
->req1
.format_flags
= DRSUAPI_DS_NAME_FLAG_NO_FLAGS
;
313 r
.in
.req
->req1
.format_offered
= DRSUAPI_DS_NAME_FORMAT_NT4_ACCOUNT
;
314 r
.in
.req
->req1
.format_desired
= DRSUAPI_DS_NAME_FORMAT_FQDN_1779
;
315 names
[0].str
= talloc_asprintf(ctx
, "%s\\", lp_workgroup(tctx
->lp_ctx
));
317 r
.out
.level_out
= &level_out
;
320 status
= dcerpc_drsuapi_DsCrackNames(ctx
->admin
.drsuapi
.drs_pipe
, ctx
, &r
);
321 if (!NT_STATUS_IS_OK(status
)) {
322 const char *errstr
= nt_errstr(status
);
323 if (NT_STATUS_EQUAL(status
, NT_STATUS_NET_WRITE_FAULT
)) {
324 errstr
= dcerpc_errstr(ctx
, ctx
->admin
.drsuapi
.drs_pipe
->last_fault_code
);
326 printf("dcerpc_drsuapi_DsCrackNames failed - %s\n", errstr
);
328 } else if (!W_ERROR_IS_OK(r
.out
.result
)) {
329 printf("DsCrackNames failed - %s\n", win_errstr(r
.out
.result
));
333 ctx
->domain_dn
= r
.out
.ctr
->ctr1
->array
[0].result_name
;
336 search
.in
.dest_address
= ctx
->drsuapi_binding
->host
;
337 search
.in
.dest_port
= lp_cldap_port(tctx
->lp_ctx
);
338 search
.in
.acct_control
= -1;
339 search
.in
.version
= NETLOGON_NT_VERSION_5
| NETLOGON_NT_VERSION_5EX
;
340 search
.in
.map_response
= true;
341 status
= cldap_netlogon(cldap
, lp_iconv_convenience(tctx
->lp_ctx
), ctx
, &search
);
342 if (!NT_STATUS_IS_OK(status
)) {
343 const char *errstr
= nt_errstr(status
);
344 ctx
->site_name
= talloc_asprintf(ctx
, "%s", "Default-First-Site-Name");
345 printf("cldap_netlogon() returned %s. Defaulting to Site-Name: %s\n", errstr
, ctx
->site_name
);
347 ctx
->site_name
= talloc_steal(ctx
, search
.out
.netlogon
.data
.nt5_ex
.client_site
);
348 printf("cldap_netlogon() returned Client Site-Name: %s.\n",ctx
->site_name
);
349 printf("cldap_netlogon() returned Server Site-Name: %s.\n",search
.out
.netlogon
.data
.nt5_ex
.server_site
);
352 if (!ctx
->domain_dn
) {
353 struct ldb_context
*ldb
= ldb_init(ctx
, tctx
->ev
);
354 struct ldb_dn
*dn
= samdb_dns_domain_to_dn(ldb
, ctx
, search
.out
.netlogon
.data
.nt5_ex
.dns_domain
);
355 ctx
->domain_dn
= ldb_dn_alloc_linearized(ctx
, dn
);
363 static bool test_analyse_objects(struct torture_context
*tctx
,
364 struct DsSyncTest
*ctx
,
365 const char *partition
,
366 const struct drsuapi_DsReplicaOIDMapping_Ctr
*mapping_ctr
,
367 uint32_t object_count
,
368 const struct drsuapi_DsReplicaObjectListItemEx
*first_object
,
369 const DATA_BLOB
*gensec_skey
)
371 static uint32_t object_id
;
372 const char *save_values_dir
;
373 const struct drsuapi_DsReplicaObjectListItemEx
*cur
;
374 struct ldb_context
*ldb
= ctx
->admin
.ldap
.ldb
;
375 struct ldb_dn
*deleted_dn
;
378 struct dsdb_extended_replicated_objects
*objs
;
379 struct ldb_extended_dn_control
*extended_dn_ctrl
;
382 if (!dsdb_get_schema(ldb
)) {
383 struct dsdb_schema
*ldap_schema
;
384 struct ldb_result
*a_res
;
385 struct ldb_result
*c_res
;
386 struct ldb_dn
*schema_dn
= ldb_get_schema_basedn(ldb
);
387 ldap_schema
= dsdb_new_schema(ctx
, lp_iconv_convenience(tctx
->lp_ctx
));
391 status
= dsdb_load_prefixmap_from_drsuapi(ldap_schema
, mapping_ctr
);
394 * load the attribute definitions
396 ret
= ldb_search(ldb
, ldap_schema
, &a_res
,
397 schema_dn
, LDB_SCOPE_ONELEVEL
, NULL
,
398 "(objectClass=attributeSchema)");
399 if (ret
!= LDB_SUCCESS
) {
400 err_msg
= talloc_asprintf(tctx
,
401 "failed to search attributeSchema objects: %s",
403 torture_fail(tctx
, err_msg
);
407 * load the objectClass definitions
409 ret
= ldb_search(ldb
, ldap_schema
, &c_res
,
410 schema_dn
, LDB_SCOPE_ONELEVEL
, NULL
,
411 "(objectClass=classSchema)");
412 if (ret
!= LDB_SUCCESS
) {
413 err_msg
= talloc_asprintf(tctx
,
414 "failed to search classSchema objects: %s",
416 torture_fail(tctx
, err_msg
);
420 for (i
=0; i
< a_res
->count
; i
++) {
421 status
= dsdb_attribute_from_ldb(ldb
, ldap_schema
, a_res
->msgs
[i
]);
422 torture_assert_werr_ok(tctx
, status
,
423 talloc_asprintf(tctx
,
424 "dsdb_attribute_from_ldb() failed for: %s",
425 ldb_dn_get_linearized(a_res
->msgs
[i
]->dn
)));
428 for (i
=0; i
< c_res
->count
; i
++) {
429 status
= dsdb_class_from_ldb(ldap_schema
, c_res
->msgs
[i
]);
430 torture_assert_werr_ok(tctx
, status
,
431 talloc_asprintf(tctx
,
432 "dsdb_class_from_ldb() failed for: %s",
433 ldb_dn_get_linearized(c_res
->msgs
[i
]->dn
)));
437 ret
= dsdb_set_schema(ldb
, ldap_schema
);
438 if (ret
!= LDB_SUCCESS
) {
440 talloc_asprintf(tctx
, "dsdb_set_schema() failed: %s", ldb_strerror(ret
)));
444 status
= dsdb_extended_replicated_objects_convert(ldb
,
453 torture_assert_werr_ok(tctx
, status
, "dsdb_extended_replicated_objects_convert() failed!");
455 extended_dn_ctrl
= talloc(objs
, struct ldb_extended_dn_control
);
456 extended_dn_ctrl
->type
= 1;
458 deleted_dn
= ldb_dn_new(objs
, ldb
, partition
);
459 ldb_dn_add_child_fmt(deleted_dn
, "CN=Deleted Objects");
461 for (i
=0; i
< object_count
; i
++) {
462 struct ldb_request
*search_req
;
463 struct ldb_result
*res
;
464 struct ldb_message
*new_msg
, *drs_msg
, *ldap_msg
;
465 const char **attrs
= talloc_array(objs
, const char *, objs
->objects
[i
].msg
->num_elements
+1);
466 for (j
=0; j
< objs
->objects
[i
].msg
->num_elements
; j
++) {
467 attrs
[j
] = objs
->objects
[i
].msg
->elements
[j
].name
;
470 res
= talloc_zero(objs
, struct ldb_result
);
472 return LDB_ERR_OPERATIONS_ERROR
;
474 ret
= ldb_build_search_req(&search_req
, ldb
, objs
,
475 objs
->objects
[i
].msg
->dn
,
481 ldb_search_default_callback
,
483 if (ret
!= LDB_SUCCESS
) {
486 talloc_steal(search_req
, res
);
487 ret
= ldb_request_add_control(search_req
, LDB_CONTROL_SHOW_DELETED_OID
, true, NULL
);
488 if (ret
!= LDB_SUCCESS
) {
492 ret
= ldb_request_add_control(search_req
, LDB_CONTROL_EXTENDED_DN_OID
, true, extended_dn_ctrl
);
493 if (ret
!= LDB_SUCCESS
) {
497 ret
= ldb_request(ldb
, search_req
);
498 if (ret
== LDB_SUCCESS
) {
499 ret
= ldb_wait(search_req
->handle
, LDB_WAIT_ALL
);
502 torture_assert_int_equal(tctx
, ret
, LDB_SUCCESS
,
503 talloc_asprintf(tctx
,
504 "Could not re-fetch object just delivered over DRS: %s",
505 ldb_errstring(ldb
)));
506 torture_assert_int_equal(tctx
, res
->count
, 1, "Could not re-fetch object just delivered over DRS");
507 ldap_msg
= res
->msgs
[0];
508 for (j
=0; j
< ldap_msg
->num_elements
; j
++) {
509 ldap_msg
->elements
[j
].flags
= LDB_FLAG_MOD_ADD
;
510 /* For unknown reasons, there is no nTSecurityDescriptor on cn=deleted objects over LDAP, but there is over DRS! Skip it on both transports for now here so */
511 if ((ldb_attr_cmp(ldap_msg
->elements
[j
].name
, "nTSecurityDescriptor") == 0) &&
512 (ldb_dn_compare(ldap_msg
->dn
, deleted_dn
) == 0)) {
513 ldb_msg_remove_element(ldap_msg
, &ldap_msg
->elements
[j
]);
519 drs_msg
= ldb_msg_canonicalize(ldb
, objs
->objects
[i
].msg
);
520 talloc_steal(search_req
, drs_msg
);
522 for (j
=0; j
< drs_msg
->num_elements
; j
++) {
523 if (drs_msg
->elements
[j
].num_values
== 0) {
524 ldb_msg_remove_element(drs_msg
, &drs_msg
->elements
[j
]);
528 /* For unknown reasons, there is no nTSecurityDescriptor on cn=deleted objects over LDAP, but there is over DRS! */
529 } else if ((ldb_attr_cmp(drs_msg
->elements
[j
].name
, "nTSecurityDescriptor") == 0) &&
530 (ldb_dn_compare(drs_msg
->dn
, deleted_dn
) == 0)) {
531 ldb_msg_remove_element(drs_msg
, &drs_msg
->elements
[j
]);
534 } else if (ldb_attr_cmp(drs_msg
->elements
[j
].name
, "unicodePwd") == 0 ||
535 ldb_attr_cmp(drs_msg
->elements
[j
].name
, "dBCSPwd") == 0 ||
536 ldb_attr_cmp(drs_msg
->elements
[j
].name
, "ntPwdHistory") == 0 ||
537 ldb_attr_cmp(drs_msg
->elements
[j
].name
, "lmPwdHistory") == 0 ||
538 ldb_attr_cmp(drs_msg
->elements
[j
].name
, "supplementalCredentials") == 0 ||
539 ldb_attr_cmp(drs_msg
->elements
[j
].name
, "priorValue") == 0 ||
540 ldb_attr_cmp(drs_msg
->elements
[j
].name
, "currentValue") == 0 ||
541 ldb_attr_cmp(drs_msg
->elements
[j
].name
, "trustAuthOutgoing") == 0 ||
542 ldb_attr_cmp(drs_msg
->elements
[j
].name
, "trustAuthIncoming") == 0 ||
543 ldb_attr_cmp(drs_msg
->elements
[j
].name
, "initialAuthOutgoing") == 0 ||
544 ldb_attr_cmp(drs_msg
->elements
[j
].name
, "initialAuthIncoming") == 0) {
546 /* These are not shown over LDAP, so we need to skip them for the comparison */
547 ldb_msg_remove_element(drs_msg
, &drs_msg
->elements
[j
]);
551 drs_msg
->elements
[j
].flags
= LDB_FLAG_MOD_ADD
;
556 new_msg
= ldb_msg_diff(ldb
, drs_msg
, ldap_msg
);
557 talloc_steal(search_req
, new_msg
);
558 if (new_msg
->num_elements
!= 0) {
560 struct ldb_ldif ldif
;
561 ldif
.changetype
= LDB_CHANGETYPE_MODIFY
;
563 s
= ldb_ldif_write_string(ldb
, new_msg
, &ldif
);
564 s
= talloc_asprintf(tctx
, "\n# Difference in between DRS and LDAP objects: \n%s\n", s
);
566 ldif
.msg
= ldb_msg_diff(ldb
, ldap_msg
, drs_msg
);
567 s
= talloc_asprintf_append(s
,
568 "\n# Difference in between LDAP and DRS objects: \n%s\n",
569 ldb_ldif_write_string(ldb
, new_msg
, &ldif
));
571 s
= talloc_asprintf_append(s
,
572 "# Should have no objects in 'difference' message. Diff elements: %d",
573 new_msg
->num_elements
);
574 torture_fail(tctx
, s
);
577 /* search_req is used as a tmp talloc context in the above */
578 talloc_free(search_req
);
581 if (!lp_parm_bool(tctx
->lp_ctx
, NULL
, "dssync", "print_pwd_blobs", false)) {
586 save_values_dir
= lp_parm_string(tctx
->lp_ctx
, NULL
, "dssync", "save_pwd_blobs_dir");
588 for (cur
= first_object
; cur
; cur
= cur
->next_object
) {
590 struct dom_sid
*sid
= NULL
;
592 bool dn_printed
= false;
594 if (!cur
->object
.identifier
) continue;
596 dn
= cur
->object
.identifier
->dn
;
597 if (cur
->object
.identifier
->sid
.num_auths
> 0) {
598 sid
= &cur
->object
.identifier
->sid
;
599 rid
= sid
->sub_auths
[sid
->num_auths
- 1];
602 for (i
=0; i
< cur
->object
.attribute_ctr
.num_attributes
; i
++) {
604 const char *name
= NULL
;
606 DATA_BLOB
*enc_data
= NULL
;
607 DATA_BLOB plain_data
;
608 struct drsuapi_DsReplicaAttribute
*attr
;
609 ndr_pull_flags_fn_t pull_fn
= NULL
;
610 ndr_print_fn_t print_fn
= NULL
;
612 attr
= &cur
->object
.attribute_ctr
.attributes
[i
];
614 switch (attr
->attid
) {
615 case DRSUAPI_ATTRIBUTE_dBCSPwd
:
619 case DRSUAPI_ATTRIBUTE_unicodePwd
:
623 case DRSUAPI_ATTRIBUTE_ntPwdHistory
:
624 name
= "ntPwdHistory";
627 case DRSUAPI_ATTRIBUTE_lmPwdHistory
:
628 name
= "lmPwdHistory";
631 case DRSUAPI_ATTRIBUTE_supplementalCredentials
:
632 name
= "supplementalCredentials";
633 pull_fn
= (ndr_pull_flags_fn_t
)ndr_pull_supplementalCredentialsBlob
;
634 print_fn
= (ndr_print_fn_t
)ndr_print_supplementalCredentialsBlob
;
635 ptr
= talloc(ctx
, struct supplementalCredentialsBlob
);
637 case DRSUAPI_ATTRIBUTE_priorValue
:
640 case DRSUAPI_ATTRIBUTE_currentValue
:
641 name
= "currentValue";
643 case DRSUAPI_ATTRIBUTE_trustAuthOutgoing
:
644 name
= "trustAuthOutgoing";
645 pull_fn
= (ndr_pull_flags_fn_t
)ndr_pull_trustAuthInOutBlob
;
646 print_fn
= (ndr_print_fn_t
)ndr_print_trustAuthInOutBlob
;
647 ptr
= talloc(ctx
, struct trustAuthInOutBlob
);
649 case DRSUAPI_ATTRIBUTE_trustAuthIncoming
:
650 name
= "trustAuthIncoming";
651 pull_fn
= (ndr_pull_flags_fn_t
)ndr_pull_trustAuthInOutBlob
;
652 print_fn
= (ndr_print_fn_t
)ndr_print_trustAuthInOutBlob
;
653 ptr
= talloc(ctx
, struct trustAuthInOutBlob
);
655 case DRSUAPI_ATTRIBUTE_initialAuthOutgoing
:
656 name
= "initialAuthOutgoing";
658 case DRSUAPI_ATTRIBUTE_initialAuthIncoming
:
659 name
= "initialAuthIncoming";
665 if (attr
->value_ctr
.num_values
!= 1) continue;
667 if (!attr
->value_ctr
.values
[0].blob
) continue;
669 enc_data
= attr
->value_ctr
.values
[0].blob
;
670 ZERO_STRUCT(plain_data
);
672 werr
= drsuapi_decrypt_attribute_value(ctx
, gensec_skey
, rcrypt
,
674 enc_data
, &plain_data
);
675 if (!W_ERROR_IS_OK(werr
)) {
676 DEBUG(0, ("Failed to decrypt %s\n", name
));
681 DEBUG(0,("DN[%u] %s\n", object_id
, dn
));
684 DEBUGADD(0,("ATTR: %s enc.length=%lu plain.length=%lu\n",
685 name
, (long)enc_data
->length
, (long)plain_data
.length
));
686 if (plain_data
.length
) {
687 enum ndr_err_code ndr_err
;
688 dump_data(0, plain_data
.data
, plain_data
.length
);
689 if (save_values_dir
) {
691 fname
= talloc_asprintf(ctx
, "%s/%s%02d",
696 ok
= file_save(fname
, plain_data
.data
, plain_data
.length
);
698 DEBUGADD(0,("Failed to save '%s'\n", fname
));
705 /* Can't use '_all' because of PIDL bugs with relative pointers */
706 ndr_err
= ndr_pull_struct_blob(&plain_data
, ptr
,
707 lp_iconv_convenience(tctx
->lp_ctx
), ptr
,
709 if (NDR_ERR_CODE_IS_SUCCESS(ndr_err
)) {
710 ndr_print_debug(print_fn
, name
, ptr
);
712 DEBUG(0, ("Failed to decode %s\n", name
));
716 dump_data(0, enc_data
->data
, enc_data
->length
);
725 static bool test_FetchData(struct torture_context
*tctx
, struct DsSyncTest
*ctx
)
730 uint64_t highest_usn
= 0;
731 const char *partition
= NULL
;
732 struct drsuapi_DsGetNCChanges r
;
733 union drsuapi_DsGetNCChangesRequest req
;
734 struct drsuapi_DsReplicaObjectIdentifier nc
;
735 struct drsuapi_DsGetNCChangesCtr1
*ctr1
= NULL
;
736 struct drsuapi_DsGetNCChangesCtr6
*ctr6
= NULL
;
737 int32_t out_level
= 0;
738 struct GUID null_guid
;
739 struct dom_sid null_sid
;
740 DATA_BLOB gensec_skey
;
752 ZERO_STRUCT(null_guid
);
753 ZERO_STRUCT(null_sid
);
755 partition
= lp_parm_string(tctx
->lp_ctx
, NULL
, "dssync", "partition");
756 if (partition
== NULL
) {
757 partition
= ctx
->domain_dn
;
758 printf("dssync:partition not specified, defaulting to %s.\n", ctx
->domain_dn
);
761 highest_usn
= lp_parm_int(tctx
->lp_ctx
, NULL
, "dssync", "highest_usn", 0);
763 array
[0].level
= lp_parm_int(tctx
->lp_ctx
, NULL
, "dssync", "get_nc_changes_level", array
[0].level
);
765 if (lp_parm_bool(tctx
->lp_ctx
, NULL
, "dssync", "print_pwd_blobs", false)) {
766 const struct samr_Password
*nthash
;
767 nthash
= cli_credentials_get_nt_hash(ctx
->new_dc
.credentials
, ctx
);
769 dump_data_pw("CREDENTIALS nthash:", nthash
->hash
, sizeof(nthash
->hash
));
772 status
= gensec_session_key(ctx
->new_dc
.drsuapi
.drs_pipe
->conn
->security_state
.generic_state
,
774 if (!NT_STATUS_IS_OK(status
)) {
775 printf("failed to get gensec session key: %s\n", nt_errstr(status
));
779 for (i
=0; i
< ARRAY_SIZE(array
); i
++) {
780 printf("testing DsGetNCChanges level %d\n",
783 r
.in
.bind_handle
= &ctx
->new_dc
.drsuapi
.bind_handle
;
784 r
.in
.level
= array
[i
].level
;
786 switch (r
.in
.level
) {
793 r
.in
.req
->req5
.destination_dsa_guid
= ctx
->new_dc
.invocation_id
;
794 r
.in
.req
->req5
.source_dsa_invocation_id
= null_guid
;
795 r
.in
.req
->req5
.naming_context
= &nc
;
796 r
.in
.req
->req5
.highwatermark
.tmp_highest_usn
= highest_usn
;
797 r
.in
.req
->req5
.highwatermark
.reserved_usn
= 0;
798 r
.in
.req
->req5
.highwatermark
.highest_usn
= highest_usn
;
799 r
.in
.req
->req5
.uptodateness_vector
= NULL
;
800 r
.in
.req
->req5
.replica_flags
= 0;
801 if (lp_parm_bool(tctx
->lp_ctx
, NULL
, "dssync", "compression", false)) {
802 r
.in
.req
->req5
.replica_flags
|= DRSUAPI_DS_REPLICA_NEIGHBOUR_COMPRESS_CHANGES
;
804 if (lp_parm_bool(tctx
->lp_ctx
, NULL
, "dssync", "neighbour_writeable", true)) {
805 r
.in
.req
->req5
.replica_flags
|= DRSUAPI_DS_REPLICA_NEIGHBOUR_WRITEABLE
;
807 r
.in
.req
->req5
.replica_flags
|= DRSUAPI_DS_REPLICA_NEIGHBOUR_SYNC_ON_STARTUP
808 | DRSUAPI_DS_REPLICA_NEIGHBOUR_DO_SCHEDULED_SYNCS
809 | DRSUAPI_DS_REPLICA_NEIGHBOUR_RETURN_OBJECT_PARENTS
810 | DRSUAPI_DS_REPLICA_NEIGHBOUR_NEVER_SYNCED
812 r
.in
.req
->req5
.max_object_count
= 133;
813 r
.in
.req
->req5
.max_ndr_size
= 1336770;
814 r
.in
.req
->req5
.extended_op
= DRSUAPI_EXOP_NONE
;
815 r
.in
.req
->req5
.fsmo_info
= 0;
822 /* nc.dn can be set to any other ad partition */
825 r
.in
.req
->req8
.destination_dsa_guid
= ctx
->new_dc
.invocation_id
;
826 r
.in
.req
->req8
.source_dsa_invocation_id
= null_guid
;
827 r
.in
.req
->req8
.naming_context
= &nc
;
828 r
.in
.req
->req8
.highwatermark
.tmp_highest_usn
= highest_usn
;
829 r
.in
.req
->req8
.highwatermark
.reserved_usn
= 0;
830 r
.in
.req
->req8
.highwatermark
.highest_usn
= highest_usn
;
831 r
.in
.req
->req8
.uptodateness_vector
= NULL
;
832 r
.in
.req
->req8
.replica_flags
= 0;
833 if (lp_parm_bool(tctx
->lp_ctx
, NULL
, "dssync", "compression", false)) {
834 r
.in
.req
->req8
.replica_flags
|= DRSUAPI_DS_REPLICA_NEIGHBOUR_COMPRESS_CHANGES
;
836 if (lp_parm_bool(tctx
->lp_ctx
, NULL
, "dssync", "neighbour_writeable", true)) {
837 r
.in
.req
->req8
.replica_flags
|= DRSUAPI_DS_REPLICA_NEIGHBOUR_WRITEABLE
;
839 r
.in
.req
->req8
.replica_flags
|= DRSUAPI_DS_REPLICA_NEIGHBOUR_SYNC_ON_STARTUP
840 | DRSUAPI_DS_REPLICA_NEIGHBOUR_DO_SCHEDULED_SYNCS
841 | DRSUAPI_DS_REPLICA_NEIGHBOUR_RETURN_OBJECT_PARENTS
842 | DRSUAPI_DS_REPLICA_NEIGHBOUR_NEVER_SYNCED
844 r
.in
.req
->req8
.max_object_count
= 402;
845 r
.in
.req
->req8
.max_ndr_size
= 402116;
847 r
.in
.req
->req8
.extended_op
= DRSUAPI_EXOP_NONE
;
848 r
.in
.req
->req8
.fsmo_info
= 0;
849 r
.in
.req
->req8
.partial_attribute_set
= NULL
;
850 r
.in
.req
->req8
.partial_attribute_set_ex
= NULL
;
851 r
.in
.req
->req8
.mapping_ctr
.num_mappings
= 0;
852 r
.in
.req
->req8
.mapping_ctr
.mappings
= NULL
;
857 printf("Dumping AD partition: %s\n", nc
.dn
);
860 union drsuapi_DsGetNCChangesCtr ctr
;
864 r
.out
.level_out
= &_level
;
867 if (r
.in
.level
== 5) {
868 torture_comment(tctx
,
869 "start[%d] tmp_higest_usn: %llu , highest_usn: %llu\n",
871 r
.in
.req
->req5
.highwatermark
.tmp_highest_usn
,
872 r
.in
.req
->req5
.highwatermark
.highest_usn
);
875 if (r
.in
.level
== 8) {
876 torture_comment(tctx
,
877 "start[%d] tmp_higest_usn: %llu , highest_usn: %llu\n",
879 r
.in
.req
->req8
.highwatermark
.tmp_highest_usn
,
880 r
.in
.req
->req8
.highwatermark
.highest_usn
);
883 status
= dcerpc_drsuapi_DsGetNCChanges(ctx
->new_dc
.drsuapi
.drs_pipe
, ctx
, &r
);
884 torture_drsuapi_assert_call(tctx
, ctx
->new_dc
.drsuapi
.drs_pipe
, status
,
885 &r
, "dcerpc_drsuapi_DsGetNCChanges");
887 if (ret
== true && *r
.out
.level_out
== 1) {
889 ctr1
= &r
.out
.ctr
->ctr1
;
890 } else if (ret
== true && *r
.out
.level_out
== 2 &&
891 r
.out
.ctr
->ctr2
.mszip1
.ts
) {
893 ctr1
= &r
.out
.ctr
->ctr2
.mszip1
.ts
->ctr1
;
896 if (out_level
== 1) {
897 torture_comment(tctx
,
898 "end[%d] tmp_highest_usn: %llu , highest_usn: %llu\n",
900 ctr1
->new_highwatermark
.tmp_highest_usn
,
901 ctr1
->new_highwatermark
.highest_usn
);
903 if (!test_analyse_objects(tctx
, ctx
, partition
, &ctr1
->mapping_ctr
, ctr1
->object_count
,
904 ctr1
->first_object
, &gensec_skey
)) {
908 if (ctr1
->more_data
) {
909 r
.in
.req
->req5
.highwatermark
= ctr1
->new_highwatermark
;
914 if (ret
== true && *r
.out
.level_out
== 6) {
916 ctr6
= &r
.out
.ctr
->ctr6
;
917 } else if (ret
== true && *r
.out
.level_out
== 7
918 && r
.out
.ctr
->ctr7
.level
== 6
919 && r
.out
.ctr
->ctr7
.type
== DRSUAPI_COMPRESSION_TYPE_MSZIP
920 && r
.out
.ctr
->ctr7
.ctr
.mszip6
.ts
) {
922 ctr6
= &r
.out
.ctr
->ctr7
.ctr
.mszip6
.ts
->ctr6
;
923 } else if (ret
== true && *r
.out
.level_out
== 7
924 && r
.out
.ctr
->ctr7
.level
== 6
925 && r
.out
.ctr
->ctr7
.type
== DRSUAPI_COMPRESSION_TYPE_XPRESS
926 && r
.out
.ctr
->ctr7
.ctr
.xpress6
.ts
) {
928 ctr6
= &r
.out
.ctr
->ctr7
.ctr
.xpress6
.ts
->ctr6
;
931 if (out_level
== 6) {
932 torture_comment(tctx
,
933 "end[%d] tmp_highest_usn: %llu , highest_usn: %llu\n",
935 ctr6
->new_highwatermark
.tmp_highest_usn
,
936 ctr6
->new_highwatermark
.highest_usn
);
938 if (!test_analyse_objects(tctx
, ctx
, partition
, &ctr6
->mapping_ctr
, ctr6
->object_count
,
939 ctr6
->first_object
, &gensec_skey
)) {
943 if (ctr6
->more_data
) {
944 r
.in
.req
->req8
.highwatermark
= ctr6
->new_highwatermark
;
956 static bool test_FetchNT4Data(struct torture_context
*tctx
,
957 struct DsSyncTest
*ctx
)
960 struct drsuapi_DsGetNT4ChangeLog r
;
961 union drsuapi_DsGetNT4ChangeLogRequest req
;
962 union drsuapi_DsGetNT4ChangeLogInfo info
;
963 uint32_t level_out
= 0;
964 struct GUID null_guid
;
965 struct dom_sid null_sid
;
968 ZERO_STRUCT(null_guid
);
969 ZERO_STRUCT(null_sid
);
973 r
.in
.bind_handle
= &ctx
->new_dc
.drsuapi
.bind_handle
;
976 r
.out
.level_out
= &level_out
;
978 req
.req1
.unknown1
= lp_parm_int(tctx
->lp_ctx
, NULL
, "dssync", "nt4-1", 3);
979 req
.req1
.unknown2
= lp_parm_int(tctx
->lp_ctx
, NULL
, "dssync", "nt4-2", 0x00004000);
982 req
.req1
.length
= cookie
.length
;
983 req
.req1
.data
= cookie
.data
;
987 status
= dcerpc_drsuapi_DsGetNT4ChangeLog(ctx
->new_dc
.drsuapi
.drs_pipe
, ctx
, &r
);
988 if (NT_STATUS_EQUAL(status
, NT_STATUS_NOT_IMPLEMENTED
)) {
989 torture_skip(tctx
, "DsGetNT4ChangeLog not supported by target server");
990 } else if (!NT_STATUS_IS_OK(status
)) {
991 const char *errstr
= nt_errstr(status
);
992 if (NT_STATUS_EQUAL(status
, NT_STATUS_NET_WRITE_FAULT
)) {
993 errstr
= dcerpc_errstr(ctx
, ctx
->new_dc
.drsuapi
.drs_pipe
->last_fault_code
);
996 talloc_asprintf(tctx
, "dcerpc_drsuapi_DsGetNT4ChangeLog failed - %s\n",
998 } else if (W_ERROR_EQUAL(r
.out
.result
, WERR_INVALID_DOMAIN_ROLE
)) {
999 torture_skip(tctx
, "DsGetNT4ChangeLog not supported by target server");
1000 } else if (!W_ERROR_IS_OK(r
.out
.result
)) {
1002 talloc_asprintf(tctx
, "DsGetNT4ChangeLog failed - %s\n",
1003 win_errstr(r
.out
.result
)));
1004 } else if (*r
.out
.level_out
!= 1) {
1006 talloc_asprintf(tctx
, "DsGetNT4ChangeLog unknown level - %u\n",
1008 } else if (NT_STATUS_IS_OK(r
.out
.info
->info1
.status
)) {
1009 } else if (NT_STATUS_EQUAL(r
.out
.info
->info1
.status
, STATUS_MORE_ENTRIES
)) {
1010 cookie
.length
= r
.out
.info
->info1
.length1
;
1011 cookie
.data
= r
.out
.info
->info1
.data1
;
1015 talloc_asprintf(tctx
, "DsGetNT4ChangeLog failed - %s\n",
1016 nt_errstr(r
.out
.info
->info1
.status
)));
1026 * DSSYNC test case setup
1028 static bool torture_dssync_tcase_setup(struct torture_context
*tctx
, void **data
)
1031 struct DsSyncTest
*ctx
;
1033 *data
= ctx
= test_create_context(tctx
);
1034 torture_assert(tctx
, ctx
, "test_create_context() failed");
1036 bret
= _test_DsBind(tctx
, ctx
, ctx
->admin
.credentials
, &ctx
->admin
.drsuapi
);
1037 torture_assert(tctx
, bret
, "_test_DsBind() failed");
1039 bret
= test_LDAPBind(tctx
, ctx
, ctx
->admin
.credentials
, &ctx
->admin
.ldap
);
1040 torture_assert(tctx
, bret
, "test_LDAPBind() failed");
1042 bret
= test_GetInfo(tctx
, ctx
);
1043 torture_assert(tctx
, bret
, "test_GetInfo() failed");
1045 bret
= _test_DsBind(tctx
, ctx
, ctx
->new_dc
.credentials
, &ctx
->new_dc
.drsuapi
);
1046 torture_assert(tctx
, bret
, "_test_DsBind() failed");
1052 * DSSYNC test case cleanup
1054 static bool torture_dssync_tcase_teardown(struct torture_context
*tctx
, void *data
)
1056 struct DsSyncTest
*ctx
;
1057 struct drsuapi_DsUnbind r
;
1058 struct policy_handle bind_handle
;
1060 ctx
= talloc_get_type(data
, struct DsSyncTest
);
1063 r
.out
.bind_handle
= &bind_handle
;
1065 /* Unbing admin handle */
1066 r
.in
.bind_handle
= &ctx
->admin
.drsuapi
.bind_handle
;
1067 dcerpc_drsuapi_DsUnbind(ctx
->admin
.drsuapi
.drs_pipe
, ctx
, &r
);
1069 /* Unbing new_dc handle */
1070 r
.in
.bind_handle
= &ctx
->new_dc
.drsuapi
.bind_handle
;
1071 dcerpc_drsuapi_DsUnbind(ctx
->new_dc
.drsuapi
.drs_pipe
, ctx
, &r
);
1079 * DSSYNC test case implementation
1081 void torture_drs_rpc_dssync_tcase(struct torture_suite
*suite
)
1083 typedef bool (*run_func
) (struct torture_context
*test
, void *tcase_data
);
1085 struct torture_test
*test
;
1086 struct torture_tcase
*tcase
= torture_suite_add_tcase(suite
, "DSSYNC");
1088 torture_tcase_set_fixture(tcase
,
1089 torture_dssync_tcase_setup
,
1090 torture_dssync_tcase_teardown
);
1092 test
= torture_tcase_add_simple_test(tcase
, "DC_FetchData", (run_func
)test_FetchData
);
1093 test
= torture_tcase_add_simple_test(tcase
, "FetchNT4Data", (run_func
)test_FetchNT4Data
);