source4/torture/rpc/dsgetinfo.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3
   4    DsGetReplInfo test. Based on code from dssync.c
   5
   6    Copyright (C) Erick Nogueira do Nascimento 2009
   7
   8    This program is free software; you can redistribute it and/or modify
   9    it under the terms of the GNU General Public License as published by
  10    the Free Software Foundation; either version 3 of the License, or
  11    (at your option) any later version.
  12
  13    This program is distributed in the hope that it will be useful,
  14    but WITHOUT ANY WARRANTY; without even the implied warranty of
  15    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  16    GNU General Public License for more details.
  17
  18    You should have received a copy of the GNU General Public License
  19    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  20 */
  21
  22 #include "includes.h"
  23 #include "lib/cmdline/popt_common.h"
  24 #include "librpc/gen_ndr/ndr_drsuapi_c.h"
  25 #include "librpc/gen_ndr/ndr_drsblobs.h"
  26 #include "libcli/cldap/cldap.h"
  27 #include "torture/torture.h"
  28 #include "../libcli/drsuapi/drsuapi.h"
  29 #include "auth/gensec/gensec.h"
  30 #include "param/param.h"
  31 #include "dsdb/samdb/samdb.h"
  32 #include "lib/ldb_wrap.h"
  33 #include "torture/rpc/rpc.h"
  34 #include "torture/drs/proto.h"
  35
  36
  37 struct DsGetinfoBindInfo {
  38         struct dcerpc_pipe *drs_pipe;
  39         struct drsuapi_DsBind req;
  40         struct GUID bind_guid;
  41         struct drsuapi_DsBindInfoCtr our_bind_info_ctr;
  42         struct drsuapi_DsBindInfo28 our_bind_info28;
  43         struct drsuapi_DsBindInfo28 peer_bind_info28;
  44         struct policy_handle bind_handle;
  45 };
  46
  47 struct DsGetinfoTest {
  48         struct dcerpc_binding *drsuapi_binding;
  49
  50         const char *ldap_url;
  51         const char *site_name;
  52
  53         const char *domain_dn;
  54
  55         /* what we need to do as 'Administrator' */
  56         struct {
  57                 struct cli_credentials *credentials;
  58                 struct DsGetinfoBindInfo drsuapi;
  59         } admin;
  60 };
  61
  62
  63
  64 /*
  65   return the default DN for a ldap server given a connected RPC pipe to the
  66   server
  67  */
  68 static const char *torture_get_ldap_base_dn(struct torture_context *tctx, struct dcerpc_pipe *p)
  69 {
  70         const char *hostname = p->binding->host;
  71         struct ldb_context *ldb;
  72         const char *ldap_url = talloc_asprintf(p, "ldap://%s", hostname);
  73         const char *attrs[] = { "defaultNamingContext", NULL };
  74         const char *dnstr;
  75         TALLOC_CTX *tmp_ctx = talloc_new(tctx);
  76         int ret;
  77         struct ldb_result *res;
  78
  79         ldb = ldb_init(tmp_ctx, tctx->ev);
  80         if (ldb == NULL) {
  81                 talloc_free(tmp_ctx);
  82                 return NULL;
  83         }
  84
  85         if (ldb_set_opaque(ldb, "loadparm", tctx->lp_ctx)) {
  86                 talloc_free(ldb);
  87                 return NULL;
  88         }
  89
  90         ret = ldb_connect(ldb, ldap_url, 0, NULL);
  91         if (ret != LDB_SUCCESS) {
  92                 torture_comment(tctx, "Failed to make LDB connection to target");
  93                 talloc_free(tmp_ctx);
  94                 return NULL;
  95         }
  96
  97         ret = dsdb_search_dn(ldb, tmp_ctx, &res, ldb_dn_new(tmp_ctx, ldb, ""),
  98                              attrs, 0);
  99         if (ret != LDB_SUCCESS) {
 100                 torture_comment(tctx, "Failed to get defaultNamingContext");
 101                 talloc_free(tmp_ctx);
 102                 return NULL;
 103         }
 104
 105         dnstr = ldb_msg_find_attr_as_string(res->msgs[0], "defaultNamingContext", NULL);
 106         dnstr = talloc_strdup(tctx, dnstr);
 107         talloc_free(tmp_ctx);
 108         return dnstr;
 109 }
 110
 111
 112 static struct DsGetinfoTest *test_create_context(struct torture_context *tctx)
 113 {
 114         NTSTATUS status;
 115         struct DsGetinfoTest *ctx;
 116         struct drsuapi_DsBindInfo28 *our_bind_info28;
 117         struct drsuapi_DsBindInfoCtr *our_bind_info_ctr;
 118         const char *binding = torture_setting_string(tctx, "binding", NULL);
 119         ctx = talloc_zero(tctx, struct DsGetinfoTest);
 120         if (!ctx) return NULL;
 121
 122         status = dcerpc_parse_binding(ctx, binding, &ctx->drsuapi_binding);
 123         if (!NT_STATUS_IS_OK(status)) {
 124                 printf("Bad binding string %s\n", binding);
 125                 return NULL;
 126         }
 127         ctx->drsuapi_binding->flags |= DCERPC_SIGN | DCERPC_SEAL;
 128
 129         /* ctx->admin ...*/
 130         ctx->admin.credentials                          = cmdline_credentials;
 131
 132         our_bind_info28                         = &ctx->admin.drsuapi.our_bind_info28;
 133         our_bind_info28->supported_extensions   = 0xFFFFFFFF;
 134         our_bind_info28->supported_extensions   |= DRSUAPI_SUPPORTED_EXTENSION_ADDENTRYREPLY_V3;
 135         our_bind_info28->site_guid              = GUID_zero();
 136         our_bind_info28->pid                    = 0;
 137         our_bind_info28->repl_epoch             = 1;
 138
 139         our_bind_info_ctr                       = &ctx->admin.drsuapi.our_bind_info_ctr;
 140         our_bind_info_ctr->length               = 28;
 141         our_bind_info_ctr->info.info28          = *our_bind_info28;
 142
 143         GUID_from_string(DRSUAPI_DS_BIND_GUID, &ctx->admin.drsuapi.bind_guid);
 144
 145         ctx->admin.drsuapi.req.in.bind_guid             = &ctx->admin.drsuapi.bind_guid;
 146         ctx->admin.drsuapi.req.in.bind_info             = our_bind_info_ctr;
 147         ctx->admin.drsuapi.req.out.bind_handle          = &ctx->admin.drsuapi.bind_handle;
 148
 149         return ctx;
 150 }
 151
 152 static bool _test_DsBind(struct torture_context *tctx,
 153                          struct DsGetinfoTest *ctx, struct cli_credentials *credentials, struct DsGetinfoBindInfo *b)
 154 {
 155         NTSTATUS status;
 156         bool ret = true;
 157
 158         status = dcerpc_pipe_connect_b(ctx,
 159                                        &b->drs_pipe, ctx->drsuapi_binding,
 160                                        &ndr_table_drsuapi,
 161                                        credentials, tctx->ev, tctx->lp_ctx);
 162
 163         if (!NT_STATUS_IS_OK(status)) {
 164                 printf("Failed to connect to server as a BDC: %s\n", nt_errstr(status));
 165                 return false;
 166         }
 167
 168         status = dcerpc_drsuapi_DsBind(b->drs_pipe, ctx, &b->req);
 169         if (!NT_STATUS_IS_OK(status)) {
 170                 const char *errstr = nt_errstr(status);
 171                 if (NT_STATUS_EQUAL(status, NT_STATUS_NET_WRITE_FAULT)) {
 172                         errstr = dcerpc_errstr(ctx, b->drs_pipe->last_fault_code);
 173                 }
 174                 printf("dcerpc_drsuapi_DsBind failed - %s\n", errstr);
 175                 ret = false;
 176         } else if (!W_ERROR_IS_OK(b->req.out.result)) {
 177                 printf("DsBind failed - %s\n", win_errstr(b->req.out.result));
 178                 ret = false;
 179         }
 180
 181         ZERO_STRUCT(b->peer_bind_info28);
 182         if (b->req.out.bind_info) {
 183                 switch (b->req.out.bind_info->length) {
 184                 case 24: {
 185                         struct drsuapi_DsBindInfo24 *info24;
 186                         info24 = &b->req.out.bind_info->info.info24;
 187                         b->peer_bind_info28.supported_extensions= info24->supported_extensions;
 188                         b->peer_bind_info28.site_guid           = info24->site_guid;
 189                         b->peer_bind_info28.pid                 = info24->pid;
 190                         b->peer_bind_info28.repl_epoch          = 0;
 191                         break;
 192                 }
 193                 case 48: {
 194                         struct drsuapi_DsBindInfo48 *info48;
 195                         info48 = &b->req.out.bind_info->info.info48;
 196                         b->peer_bind_info28.supported_extensions= info48->supported_extensions;
 197                         b->peer_bind_info28.site_guid           = info48->site_guid;
 198                         b->peer_bind_info28.pid                 = info48->pid;
 199                         b->peer_bind_info28.repl_epoch          = info48->repl_epoch;
 200                         break;
 201                 }
 202                 case 28:
 203                         b->peer_bind_info28 = b->req.out.bind_info->info.info28;
 204                         break;
 205                 default:
 206                         printf("DsBind - warning: unknown BindInfo length: %u\n",
 207                                b->req.out.bind_info->length);
 208                 }
 209         }
 210
 211         return ret;
 212 }
 213
 214
 215 static bool test_getinfo(struct torture_context *tctx,
 216                          struct DsGetinfoTest *ctx)
 217 {
 218         NTSTATUS status;
 219         struct dcerpc_pipe *p = ctx->admin.drsuapi.drs_pipe;
 220         struct drsuapi_DsReplicaGetInfo r;
 221         union drsuapi_DsReplicaGetInfoRequest req;
 222         union drsuapi_DsReplicaInfo info;
 223         enum drsuapi_DsReplicaInfoType info_type;
 224         int i;
 225         int invalid_levels = 0;
 226         struct {
 227                 int32_t level;
 228                 int32_t infotype;
 229                 const char *obj_dn;
 230                 const char *attribute_name;
 231                 uint32_t flags;
 232         } array[] = {
 233                 {
 234                         .level = DRSUAPI_DS_REPLICA_GET_INFO,
 235                         .infotype = DRSUAPI_DS_REPLICA_INFO_NEIGHBORS
 236                 },{
 237                         .level = DRSUAPI_DS_REPLICA_GET_INFO,
 238                         .infotype = DRSUAPI_DS_REPLICA_INFO_CURSORS
 239                 },{
 240                         .level = DRSUAPI_DS_REPLICA_GET_INFO,
 241                         .infotype = DRSUAPI_DS_REPLICA_INFO_OBJ_METADATA
 242                 },{
 243                         .level = DRSUAPI_DS_REPLICA_GET_INFO,
 244                         .infotype = DRSUAPI_DS_REPLICA_INFO_KCC_DSA_CONNECT_FAILURES
 245                 },{
 246                         .level = DRSUAPI_DS_REPLICA_GET_INFO,
 247                         .infotype = DRSUAPI_DS_REPLICA_INFO_KCC_DSA_LINK_FAILURES
 248                 },{
 249                         .level = DRSUAPI_DS_REPLICA_GET_INFO,
 250                         .infotype = DRSUAPI_DS_REPLICA_INFO_PENDING_OPS
 251                 },{
 252                         .level = DRSUAPI_DS_REPLICA_GET_INFO2,
 253                         .infotype = DRSUAPI_DS_REPLICA_INFO_ATTRIBUTE_VALUE_METADATA
 254                 },{
 255                         .level = DRSUAPI_DS_REPLICA_GET_INFO2,
 256                         .infotype = DRSUAPI_DS_REPLICA_INFO_CURSORS2
 257                 },{
 258                         .level = DRSUAPI_DS_REPLICA_GET_INFO2,
 259                         .infotype = DRSUAPI_DS_REPLICA_INFO_CURSORS3
 260                 },{
 261                         .level = DRSUAPI_DS_REPLICA_GET_INFO2,
 262                         .infotype = DRSUAPI_DS_REPLICA_INFO_OBJ_METADATA2,
 263                         .obj_dn = "CN=Domain Admins,CN=Users,",
 264                         .flags = 0
 265                 },{
 266                         .level = DRSUAPI_DS_REPLICA_GET_INFO2,
 267                         .infotype = DRSUAPI_DS_REPLICA_INFO_OBJ_METADATA2,
 268                         .obj_dn = "CN=Domain Admins,CN=Users,",
 269                         .flags = DRSUAPI_DS_LINKED_ATTRIBUTE_FLAG_ACTIVE
 270                 },{
 271                         .level = DRSUAPI_DS_REPLICA_GET_INFO2,
 272                         .infotype = DRSUAPI_DS_REPLICA_INFO_ATTRIBUTE_VALUE_METADATA2
 273                 },{
 274                         .level = DRSUAPI_DS_REPLICA_GET_INFO2,
 275                         .infotype = DRSUAPI_DS_REPLICA_INFO_REPSTO
 276                 },{
 277                         .level = DRSUAPI_DS_REPLICA_GET_INFO2,
 278                         .infotype = DRSUAPI_DS_REPLICA_INFO_CLIENT_CONTEXTS
 279                 },{
 280                         .level = DRSUAPI_DS_REPLICA_GET_INFO2,
 281                         .infotype = DRSUAPI_DS_REPLICA_INFO_UPTODATE_VECTOR_V1
 282                 },{
 283                         .level = DRSUAPI_DS_REPLICA_GET_INFO2,
 284                         .infotype = DRSUAPI_DS_REPLICA_INFO_SERVER_OUTGOING_CALLS
 285                 }
 286         };
 287
 288         ctx->domain_dn = torture_get_ldap_base_dn(tctx, p);
 289         torture_assert(tctx, ctx->domain_dn != NULL, "Cannot get domain_dn");
 290
 291         if (torture_setting_bool(tctx, "samba4", false)) {
 292                 torture_comment(tctx, "skipping DsReplicaGetInfo test against Samba4\n");
 293                 return true;
 294         }
 295
 296         r.in.bind_handle        = &ctx->admin.drsuapi.bind_handle;
 297         r.in.req                = &req;
 298
 299         for (i=0; i < ARRAY_SIZE(array); i++) {
 300                 const char *object_dn;
 301
 302                 torture_comment(tctx, "testing DsReplicaGetInfo level %d infotype %d\n",
 303                                 array[i].level, array[i].infotype);
 304
 305                 if (array[i].obj_dn) {
 306                         object_dn = array[i].obj_dn;
 307                         if (object_dn[strlen(object_dn)-1] == ',') {
 308                                 /* add the domain DN on the end */
 309                                 object_dn = talloc_asprintf(tctx, "%s%s", object_dn, ctx->domain_dn);
 310                         }
 311                 } else {
 312                         object_dn = ctx->domain_dn;
 313                 }
 314
 315                 r.in.level = array[i].level;
 316                 switch(r.in.level) {
 317                 case DRSUAPI_DS_REPLICA_GET_INFO:
 318                         r.in.req->req1.info_type        = array[i].infotype;
 319                         r.in.req->req1.object_dn        = object_dn;
 320                         ZERO_STRUCT(r.in.req->req1.source_dsa_guid);
 321                         break;
 322                 case DRSUAPI_DS_REPLICA_GET_INFO2:
 323                         r.in.req->req2.info_type        = array[i].infotype;
 324                         r.in.req->req2.object_dn        = object_dn;
 325                         ZERO_STRUCT(r.in.req->req2.source_dsa_guid);
 326                         r.in.req->req2.flags            = 0;
 327                         r.in.req->req2.attribute_name   = NULL;
 328                         r.in.req->req2.value_dn_str     = NULL;
 329                         r.in.req->req2.enumeration_context = 0;
 330                         break;
 331                 }
 332
 333                 /* Construct a different request for some of the infoTypes */
 334                 if (array[i].attribute_name != NULL) {
 335                         r.in.req->req2.attribute_name = array[i].attribute_name;
 336                 }
 337                 if (array[i].flags != 0) {
 338                         r.in.req->req2.flags |= array[i].flags;
 339                 }
 340
 341                 r.out.info              = &info;
 342                 r.out.info_type         = &info_type;
 343
 344                 status = dcerpc_drsuapi_DsReplicaGetInfo(p, tctx, &r);
 345
 346                 if (W_ERROR_EQUAL(r.out.result, WERR_INVALID_LEVEL)) {
 347                         /* this is a not yet supported level */
 348                         torture_comment(tctx,
 349                                         "DsReplicaGetInfo level %d and/or infotype %d not yet supported by server\n",
 350                                         array[i].level, array[i].infotype);
 351                         invalid_levels++;
 352                 } else if (!NT_STATUS_IS_OK(status) && p->last_fault_code == DCERPC_FAULT_INVALID_TAG) {
 353                         torture_comment(tctx,
 354                                         "DsReplicaGetInfo level %d and/or infotype %d not supported by server\n",
 355                                         array[i].level, array[i].infotype);
 356                 }/* else {
 357                         torture_drsuapi_assert_call(tctx, p, status, &r, "dcerpc_drsuapi_DsReplicaGetInfo");
 358                 }*/
 359         }
 360
 361         if (invalid_levels > 0) {
 362                 return false;
 363         }
 364
 365         return true;
 366 }
 367
 368 /**
 369  * DSGETINFO test case setup
 370  */
 371 static bool torture_dsgetinfo_tcase_setup(struct torture_context *tctx, void **data)
 372 {
 373         bool bret;
 374         struct DsGetinfoTest *ctx;
 375
 376         *data = ctx = test_create_context(tctx);
 377         torture_assert(tctx, ctx, "test_create_context() failed");
 378
 379         bret = _test_DsBind(tctx, ctx, ctx->admin.credentials, &ctx->admin.drsuapi);
 380         torture_assert(tctx, bret, "_test_DsBind() failed");
 381
 382         return true;
 383 }
 384
 385 /**
 386  * DSGETINFO test case cleanup
 387  */
 388 static bool torture_dsgetinfo_tcase_teardown(struct torture_context *tctx, void *data)
 389 {
 390         struct DsGetinfoTest *ctx;
 391         struct drsuapi_DsUnbind r;
 392         struct policy_handle bind_handle;
 393
 394         ctx = talloc_get_type(data, struct DsGetinfoTest);
 395
 396         ZERO_STRUCT(r);
 397         r.out.bind_handle = &bind_handle;
 398
 399         /* Unbing admin handle */
 400         r.in.bind_handle = &ctx->admin.drsuapi.bind_handle;
 401         dcerpc_drsuapi_DsUnbind(ctx->admin.drsuapi.drs_pipe, ctx, &r);
 402
 403         talloc_free(ctx);
 404
 405         return true;
 406 }
 407
 408 /**
 409  * DSGETINFO test case implementation
 410  */
 411 void torture_drs_rpc_dsgetinfo_tcase(struct torture_suite *suite)
 412 {
 413         typedef bool (*run_func) (struct torture_context *test, void *tcase_data);
 414
 415         struct torture_test *test;
 416         struct torture_tcase *tcase = torture_suite_add_tcase(suite, "DSGETINFO");
 417
 418         torture_tcase_set_fixture(tcase,
 419                                   torture_dsgetinfo_tcase_setup,
 420                                   torture_dsgetinfo_tcase_teardown);
 421
 422         test = torture_tcase_add_simple_test(tcase, "DsGetReplicaInfo", (run_func)test_getinfo);
 423 }
 424