source4/torture/rpc/drsuapi.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3
   4    DRSUapi tests
   5
   6    Copyright (C) Andrew Tridgell 2003
   7    Copyright (C) Stefan (metze) Metzmacher 2004
   8    Copyright (C) Andrew Bartlett <abartlet@samba.org> 2005-2006
   9
  10    This program is free software; you can redistribute it and/or modify
  11    it under the terms of the GNU General Public License as published by
  12    the Free Software Foundation; either version 3 of the License, or
  13    (at your option) any later version.
  14
  15    This program is distributed in the hope that it will be useful,
  16    but WITHOUT ANY WARRANTY; without even the implied warranty of
  17    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  18    GNU General Public License for more details.
  19
  20    You should have received a copy of the GNU General Public License
  21    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  22 */
  23
  24 #include "includes.h"
  25 #include "librpc/gen_ndr/ndr_drsuapi_c.h"
  26 #include "torture/rpc/rpc.h"
  27 #include "param/param.h"
  28
  29 #define TEST_MACHINE_NAME "torturetest"
  30
  31 bool test_DsBind(struct dcerpc_pipe *p,
  32                  struct torture_context *tctx,
  33                  struct DsPrivate *priv)
  34 {
  35         NTSTATUS status;
  36         struct drsuapi_DsBind r;
  37         struct drsuapi_DsBindInfo28 *bind_info28;
  38         struct drsuapi_DsBindInfoCtr bind_info_ctr;
  39
  40         ZERO_STRUCT(bind_info_ctr);
  41         bind_info_ctr.length = 28;
  42
  43         bind_info28 = &bind_info_ctr.info.info28;
  44         bind_info28->supported_extensions       |= DRSUAPI_SUPPORTED_EXTENSION_BASE;
  45         bind_info28->supported_extensions       |= DRSUAPI_SUPPORTED_EXTENSION_ASYNC_REPLICATION;
  46         bind_info28->supported_extensions       |= DRSUAPI_SUPPORTED_EXTENSION_REMOVEAPI;
  47         bind_info28->supported_extensions       |= DRSUAPI_SUPPORTED_EXTENSION_MOVEREQ_V2;
  48         bind_info28->supported_extensions       |= DRSUAPI_SUPPORTED_EXTENSION_GETCHG_COMPRESS;
  49         bind_info28->supported_extensions       |= DRSUAPI_SUPPORTED_EXTENSION_DCINFO_V1;
  50         bind_info28->supported_extensions       |= DRSUAPI_SUPPORTED_EXTENSION_RESTORE_USN_OPTIMIZATION;
  51         bind_info28->supported_extensions       |= DRSUAPI_SUPPORTED_EXTENSION_KCC_EXECUTE;
  52         bind_info28->supported_extensions       |= DRSUAPI_SUPPORTED_EXTENSION_ADDENTRY_V2;
  53         bind_info28->supported_extensions       |= DRSUAPI_SUPPORTED_EXTENSION_LINKED_VALUE_REPLICATION;
  54         bind_info28->supported_extensions       |= DRSUAPI_SUPPORTED_EXTENSION_DCINFO_V2;
  55         bind_info28->supported_extensions       |= DRSUAPI_SUPPORTED_EXTENSION_INSTANCE_TYPE_NOT_REQ_ON_MOD;
  56         bind_info28->supported_extensions       |= DRSUAPI_SUPPORTED_EXTENSION_CRYPTO_BIND;
  57         bind_info28->supported_extensions       |= DRSUAPI_SUPPORTED_EXTENSION_GET_REPL_INFO;
  58         bind_info28->supported_extensions       |= DRSUAPI_SUPPORTED_EXTENSION_STRONG_ENCRYPTION;
  59         bind_info28->supported_extensions       |= DRSUAPI_SUPPORTED_EXTENSION_DCINFO_V01;
  60         bind_info28->supported_extensions       |= DRSUAPI_SUPPORTED_EXTENSION_TRANSITIVE_MEMBERSHIP;
  61         bind_info28->supported_extensions       |= DRSUAPI_SUPPORTED_EXTENSION_ADD_SID_HISTORY;
  62         bind_info28->supported_extensions       |= DRSUAPI_SUPPORTED_EXTENSION_POST_BETA3;
  63         bind_info28->supported_extensions       |= DRSUAPI_SUPPORTED_EXTENSION_GET_MEMBERSHIPS2;
  64         bind_info28->supported_extensions       |= DRSUAPI_SUPPORTED_EXTENSION_GETCHGREQ_V6;
  65         bind_info28->supported_extensions       |= DRSUAPI_SUPPORTED_EXTENSION_NONDOMAIN_NCS;
  66         bind_info28->supported_extensions       |= DRSUAPI_SUPPORTED_EXTENSION_GETCHGREQ_V8;
  67         bind_info28->supported_extensions       |= DRSUAPI_SUPPORTED_EXTENSION_GETCHGREPLY_V5;
  68         bind_info28->supported_extensions       |= DRSUAPI_SUPPORTED_EXTENSION_GETCHGREPLY_V6;
  69         bind_info28->supported_extensions       |= DRSUAPI_SUPPORTED_EXTENSION_ADDENTRYREPLY_V3;
  70         bind_info28->supported_extensions       |= DRSUAPI_SUPPORTED_EXTENSION_GETCHGREPLY_V7;
  71         bind_info28->supported_extensions       |= DRSUAPI_SUPPORTED_EXTENSION_VERIFY_OBJECT;
  72
  73         GUID_from_string(DRSUAPI_DS_BIND_GUID, &priv->bind_guid);
  74
  75         r.in.bind_guid = &priv->bind_guid;
  76         r.in.bind_info = &bind_info_ctr;
  77         r.out.bind_handle = &priv->bind_handle;
  78
  79         torture_comment(tctx, "Testing DsBind\n");
  80
  81         status = dcerpc_drsuapi_DsBind_r(p->binding_handle, tctx, &r);
  82         torture_drsuapi_assert_call(tctx, p, status, &r, "dcerpc_drsuapi_DsBind");
  83
  84         /* cache server supported extensions, i.e. bind_info */
  85         priv->srv_bind_info = r.out.bind_info->info.info28;
  86
  87         return true;
  88 }
  89
  90 static bool test_DsGetDomainControllerInfo(struct torture_context *tctx,
  91                                            struct DsPrivate *priv)
  92 {
  93         NTSTATUS status;
  94         struct dcerpc_pipe *p = priv->drs_pipe;
  95         struct drsuapi_DsGetDomainControllerInfo r;
  96         union drsuapi_DsGetDCInfoCtr ctr;
  97         int32_t level_out = 0;
  98         bool found = false;
  99         int i, j, k;
 100
 101         struct {
 102                 const char *name;
 103                 WERROR expected;
 104         } names[] = {
 105                 {
 106                         .name = torture_join_dom_netbios_name(priv->join),
 107                         .expected = WERR_OK
 108                 },
 109                 {
 110                         .name = torture_join_dom_dns_name(priv->join),
 111                         .expected = WERR_OK
 112                 },
 113                 {
 114                         .name = "__UNKNOWN_DOMAIN__",
 115                         .expected = WERR_DS_OBJ_NOT_FOUND
 116                 },
 117                 {
 118                         .name = "unknown.domain.samba.example.com",
 119                         .expected = WERR_DS_OBJ_NOT_FOUND
 120                 },
 121         };
 122         int levels[] = {1, 2};
 123         int level;
 124
 125         for (i=0; i < ARRAY_SIZE(levels); i++) {
 126                 for (j=0; j < ARRAY_SIZE(names); j++) {
 127                         union drsuapi_DsGetDCInfoRequest req;
 128                         level = levels[i];
 129                         r.in.bind_handle = &priv->bind_handle;
 130                         r.in.level = 1;
 131                         r.in.req = &req;
 132
 133                         r.in.req->req1.domain_name = names[j].name;
 134                         r.in.req->req1.level = level;
 135
 136                         r.out.ctr = &ctr;
 137                         r.out.level_out = &level_out;
 138
 139                         torture_comment(tctx,
 140                                    "Testing DsGetDomainControllerInfo level %d on domainname '%s'\n",
 141                                r.in.req->req1.level, r.in.req->req1.domain_name);
 142
 143                         status = dcerpc_drsuapi_DsGetDomainControllerInfo_r(p->binding_handle, tctx, &r);
 144                         torture_assert_ntstatus_ok(tctx, status,
 145                                    "dcerpc_drsuapi_DsGetDomainControllerInfo with dns domain failed");
 146                         torture_assert_werr_equal(tctx,
 147                                                                           r.out.result, names[j].expected,
 148                                            "DsGetDomainControllerInfo level with dns domain failed");
 149
 150                         if (!W_ERROR_IS_OK(r.out.result)) {
 151                                 /* If this was an error, we can't read the result structure */
 152                                 continue;
 153                         }
 154
 155                         torture_assert_int_equal(tctx,
 156                                                  r.in.req->req1.level, *r.out.level_out,
 157                                                  "dcerpc_drsuapi_DsGetDomainControllerInfo in/out level differs");
 158
 159                         switch (level) {
 160                         case 1:
 161                                 for (k=0; k < r.out.ctr->ctr1.count; k++) {
 162                                         if (strcasecmp_m(r.out.ctr->ctr1.array[k].netbios_name,
 163                                                          torture_join_netbios_name(priv->join)) == 0) {
 164                                                 found = true;
 165                                                 break;
 166                                         }
 167                                 }
 168                                 break;
 169                         case 2:
 170                                 for (k=0; k < r.out.ctr->ctr2.count; k++) {
 171                                         if (strcasecmp_m(r.out.ctr->ctr2.array[k].netbios_name,
 172                                                          torture_join_netbios_name(priv->join)) == 0) {
 173                                                 found = true;
 174                                                 priv->dcinfo    = r.out.ctr->ctr2.array[k];
 175                                                 break;
 176                                         }
 177                                 }
 178                                 break;
 179                         }
 180                         torture_assert(tctx, found,
 181                                  "dcerpc_drsuapi_DsGetDomainControllerInfo: Failed to find the domain controller we just created during the join");
 182                 }
 183         }
 184
 185         r.in.bind_handle = &priv->bind_handle;
 186         r.in.level = 1;
 187
 188         r.out.ctr = &ctr;
 189         r.out.level_out = &level_out;
 190
 191         r.in.req->req1.domain_name = "__UNKNOWN_DOMAIN__"; /* This is clearly ignored for this level */
 192         r.in.req->req1.level = -1;
 193
 194         torture_comment(tctx, "Testing DsGetDomainControllerInfo level %d on domainname '%s'\n",
 195                         r.in.req->req1.level, r.in.req->req1.domain_name);
 196
 197         status = dcerpc_drsuapi_DsGetDomainControllerInfo_r(p->binding_handle, tctx, &r);
 198
 199         torture_assert_ntstatus_ok(tctx, status,
 200                                    "dcerpc_drsuapi_DsGetDomainControllerInfo with dns domain failed");
 201         torture_assert_werr_ok(tctx, r.out.result,
 202                                 "DsGetDomainControllerInfo with dns domain failed");
 203
 204         {
 205                 const char *dc_account = talloc_asprintf(tctx, "%s\\%s$",
 206                                                          torture_join_dom_netbios_name(priv->join),
 207                                                          priv->dcinfo.netbios_name);
 208                 torture_comment(tctx, "%s: Enum active LDAP sessions searching for %s\n", __func__, dc_account);
 209                 for (k=0; k < r.out.ctr->ctr01.count; k++) {
 210                         if (strcasecmp_m(r.out.ctr->ctr01.array[k].client_account,
 211                                          dc_account)) {
 212                                 found = true;
 213                                 break;
 214                         }
 215                 }
 216                 torture_assert(tctx, found,
 217                         "dcerpc_drsuapi_DsGetDomainControllerInfo level: Failed to find the domain controller in last logon records");
 218         }
 219
 220
 221         return true;
 222 }
 223
 224 static bool test_DsWriteAccountSpn(struct torture_context *tctx,
 225                                    struct DsPrivate *priv)
 226 {
 227         NTSTATUS status;
 228         struct dcerpc_pipe *p = priv->drs_pipe;
 229         struct drsuapi_DsWriteAccountSpn r;
 230         union drsuapi_DsWriteAccountSpnRequest req;
 231         struct drsuapi_DsNameString names[2];
 232         union drsuapi_DsWriteAccountSpnResult res;
 233         uint32_t level_out;
 234
 235         r.in.bind_handle                = &priv->bind_handle;
 236         r.in.level                      = 1;
 237         r.in.req                        = &req;
 238
 239         torture_comment(tctx, "Testing DsWriteAccountSpn\n");
 240
 241         r.in.req->req1.operation        = DRSUAPI_DS_SPN_OPERATION_ADD;
 242         r.in.req->req1.unknown1 = 0;
 243         r.in.req->req1.object_dn        = priv->dcinfo.computer_dn;
 244         r.in.req->req1.count            = 2;
 245         r.in.req->req1.spn_names        = names;
 246         names[0].str = talloc_asprintf(tctx, "smbtortureSPN/%s",priv->dcinfo.netbios_name);
 247         names[1].str = talloc_asprintf(tctx, "smbtortureSPN/%s",priv->dcinfo.dns_name);
 248
 249         r.out.res                       = &res;
 250         r.out.level_out                 = &level_out;
 251
 252         status = dcerpc_drsuapi_DsWriteAccountSpn_r(p->binding_handle, tctx, &r);
 253         torture_drsuapi_assert_call(tctx, p, status, &r, "dcerpc_drsuapi_DsWriteAccountSpn");
 254
 255         r.in.req->req1.operation        = DRSUAPI_DS_SPN_OPERATION_DELETE;
 256         r.in.req->req1.unknown1         = 0;
 257
 258         status = dcerpc_drsuapi_DsWriteAccountSpn_r(p->binding_handle, tctx, &r);
 259         torture_drsuapi_assert_call(tctx, p, status, &r, "dcerpc_drsuapi_DsWriteAccountSpn");
 260
 261         return true;
 262 }
 263
 264 static bool test_DsReplicaGetInfo(struct torture_context *tctx,
 265                                   struct DsPrivate *priv)
 266 {
 267         NTSTATUS status;
 268         struct dcerpc_pipe *p = priv->drs_pipe;
 269         struct drsuapi_DsReplicaGetInfo r;
 270         union drsuapi_DsReplicaGetInfoRequest req;
 271         union drsuapi_DsReplicaInfo info;
 272         enum drsuapi_DsReplicaInfoType info_type;
 273         int i;
 274         struct {
 275                 int32_t level;
 276                 int32_t infotype;
 277                 const char *obj_dn;
 278         } array[] = {
 279                 {
 280                         DRSUAPI_DS_REPLICA_GET_INFO,
 281                         DRSUAPI_DS_REPLICA_INFO_NEIGHBORS,
 282                         NULL
 283                 },{
 284                         DRSUAPI_DS_REPLICA_GET_INFO,
 285                         DRSUAPI_DS_REPLICA_INFO_CURSORS,
 286                         NULL
 287                 },{
 288                         DRSUAPI_DS_REPLICA_GET_INFO,
 289                         DRSUAPI_DS_REPLICA_INFO_OBJ_METADATA,
 290                         NULL
 291                 },{
 292                         DRSUAPI_DS_REPLICA_GET_INFO,
 293                         DRSUAPI_DS_REPLICA_INFO_KCC_DSA_CONNECT_FAILURES,
 294                         NULL
 295                 },{
 296                         DRSUAPI_DS_REPLICA_GET_INFO,
 297                         DRSUAPI_DS_REPLICA_INFO_KCC_DSA_LINK_FAILURES,
 298                         NULL
 299                 },{
 300                         DRSUAPI_DS_REPLICA_GET_INFO,
 301                         DRSUAPI_DS_REPLICA_INFO_PENDING_OPS,
 302                         NULL
 303                 },{
 304                         DRSUAPI_DS_REPLICA_GET_INFO2,
 305                         DRSUAPI_DS_REPLICA_INFO_ATTRIBUTE_VALUE_METADATA,
 306                         NULL
 307                 },{
 308                         DRSUAPI_DS_REPLICA_GET_INFO2,
 309                         DRSUAPI_DS_REPLICA_INFO_CURSORS2,
 310                         NULL
 311                 },{
 312                         DRSUAPI_DS_REPLICA_GET_INFO2,
 313                         DRSUAPI_DS_REPLICA_INFO_CURSORS3,
 314                         NULL
 315                 },{
 316                         DRSUAPI_DS_REPLICA_GET_INFO2,
 317                         DRSUAPI_DS_REPLICA_INFO_OBJ_METADATA2,
 318                         NULL
 319                 },{
 320                         DRSUAPI_DS_REPLICA_GET_INFO2,
 321                         DRSUAPI_DS_REPLICA_INFO_ATTRIBUTE_VALUE_METADATA2,
 322                         NULL
 323                 },{
 324                         DRSUAPI_DS_REPLICA_GET_INFO2,
 325                         DRSUAPI_DS_REPLICA_INFO_REPSTO,
 326                         NULL
 327                 },{
 328                         DRSUAPI_DS_REPLICA_GET_INFO2,
 329                         DRSUAPI_DS_REPLICA_INFO_CLIENT_CONTEXTS,
 330                         "__IGNORED__"
 331                 },{
 332                         DRSUAPI_DS_REPLICA_GET_INFO2,
 333                         DRSUAPI_DS_REPLICA_INFO_UPTODATE_VECTOR_V1,
 334                         NULL
 335                 },{
 336                         DRSUAPI_DS_REPLICA_GET_INFO2,
 337                         DRSUAPI_DS_REPLICA_INFO_SERVER_OUTGOING_CALLS,
 338                         NULL
 339                 }
 340         };
 341
 342         if (torture_setting_bool(tctx, "samba4", false)) {
 343                 torture_comment(tctx, "skipping DsReplicaGetInfo test against Samba4\n");
 344                 return true;
 345         }
 346
 347         r.in.bind_handle        = &priv->bind_handle;
 348         r.in.req                = &req;
 349
 350         for (i=0; i < ARRAY_SIZE(array); i++) {
 351                 const char *object_dn;
 352
 353                 torture_comment(tctx, "Testing DsReplicaGetInfo level %d infotype %d\n",
 354                                 array[i].level, array[i].infotype);
 355
 356                 object_dn = (array[i].obj_dn ? array[i].obj_dn : priv->domain_obj_dn);
 357
 358                 r.in.level = array[i].level;
 359                 switch(r.in.level) {
 360                 case DRSUAPI_DS_REPLICA_GET_INFO:
 361                         r.in.req->req1.info_type        = array[i].infotype;
 362                         r.in.req->req1.object_dn        = object_dn;
 363                         ZERO_STRUCT(r.in.req->req1.source_dsa_guid);
 364                         break;
 365                 case DRSUAPI_DS_REPLICA_GET_INFO2:
 366                         r.in.req->req2.info_type        = array[i].infotype;
 367                         r.in.req->req2.object_dn        = object_dn;
 368                         ZERO_STRUCT(r.in.req->req2.source_dsa_guid);
 369                         r.in.req->req2.flags            = 0;
 370                         r.in.req->req2.attribute_name   = NULL;
 371                         r.in.req->req2.value_dn_str     = NULL;
 372                         r.in.req->req2.enumeration_context = 0;
 373                         break;
 374                 }
 375
 376                 r.out.info              = &info;
 377                 r.out.info_type         = &info_type;
 378
 379                 status = dcerpc_drsuapi_DsReplicaGetInfo_r(p->binding_handle, tctx, &r);
 380                 torture_drsuapi_assert_call(tctx, p, status, &r, "dcerpc_drsuapi_DsReplicaGetInfo");
 381                 if (!NT_STATUS_IS_OK(status) && p->last_fault_code == DCERPC_FAULT_INVALID_TAG) {
 382                         torture_comment(tctx,
 383                                         "DsReplicaGetInfo level %d and/or infotype %d not supported by server\n",
 384                                         array[i].level, array[i].infotype);
 385                 } else {
 386                         torture_drsuapi_assert_call(tctx, p, status, &r, "dcerpc_drsuapi_DsReplicaGetInfo");
 387                 }
 388         }
 389
 390         return true;
 391 }
 392
 393 static bool test_DsReplicaSync(struct torture_context *tctx,
 394                                 struct DsPrivate *priv)
 395 {
 396         NTSTATUS status;
 397         struct dcerpc_pipe *p = priv->drs_pipe;
 398         int i;
 399         struct drsuapi_DsReplicaSync r;
 400         union drsuapi_DsReplicaSyncRequest sync_req;
 401         struct drsuapi_DsReplicaObjectIdentifier nc;
 402         struct GUID null_guid;
 403         struct dom_sid null_sid;
 404         struct {
 405                 int32_t level;
 406         } array[] = {
 407                 {
 408                         1
 409                 }
 410         };
 411
 412         if (!torture_setting_bool(tctx, "dangerous", false)) {
 413                 torture_comment(tctx, "DsReplicaSync disabled - enable dangerous tests to use\n");
 414                 return true;
 415         }
 416
 417         if (torture_setting_bool(tctx, "samba4", false)) {
 418                 torture_comment(tctx, "skipping DsReplicaSync test against Samba4\n");
 419                 return true;
 420         }
 421
 422         ZERO_STRUCT(null_guid);
 423         ZERO_STRUCT(null_sid);
 424
 425         r.in.bind_handle        = &priv->bind_handle;
 426
 427         for (i=0; i < ARRAY_SIZE(array); i++) {
 428                 torture_comment(tctx, "Testing DsReplicaSync level %d\n",
 429                                 array[i].level);
 430
 431                 r.in.level = array[i].level;
 432                 switch(r.in.level) {
 433                 case 1:
 434                         nc.guid                                 = null_guid;
 435                         nc.sid                                  = null_sid;
 436                         nc.dn                                   = priv->domain_obj_dn?priv->domain_obj_dn:"";
 437
 438                         sync_req.req1.naming_context            = &nc;
 439                         sync_req.req1.source_dsa_guid           = priv->dcinfo.ntds_guid;
 440                         sync_req.req1.source_dsa_dns            = NULL;
 441                         sync_req.req1.options                   = 16;
 442
 443                         r.in.req                                = &sync_req;
 444                         break;
 445                 }
 446
 447                 status = dcerpc_drsuapi_DsReplicaSync_r(p->binding_handle, tctx, &r);
 448                 torture_drsuapi_assert_call(tctx, p, status, &r, "dcerpc_drsuapi_DsReplicaSync");
 449         }
 450
 451         return true;
 452 }
 453
 454 static bool test_DsReplicaUpdateRefs(struct torture_context *tctx,
 455                                      struct DsPrivate *priv)
 456 {
 457         NTSTATUS status;
 458         struct dcerpc_pipe *p = priv->drs_pipe;
 459         struct drsuapi_DsReplicaUpdateRefs r;
 460         struct drsuapi_DsReplicaObjectIdentifier nc;
 461         struct GUID null_guid;
 462         struct GUID dest_dsa_guid;
 463         const char *dest_dsa_guid_str;
 464         struct dom_sid null_sid;
 465
 466         ZERO_STRUCT(null_guid);
 467         ZERO_STRUCT(null_sid);
 468         dest_dsa_guid = GUID_random();
 469         dest_dsa_guid_str = GUID_string(tctx, &dest_dsa_guid);
 470
 471         r.in.bind_handle = &priv->bind_handle;
 472         r.in.level       = 1; /* Only version 1 is defined presently */
 473
 474         /* setup NC */
 475         nc.guid         = priv->domain_obj_dn ? null_guid : priv->domain_guid;
 476         nc.sid          = null_sid;
 477         nc.dn           = priv->domain_obj_dn ? priv->domain_obj_dn : "";
 478
 479         /* default setup for request */
 480         r.in.req.req1.naming_context    = &nc;
 481         r.in.req.req1.dest_dsa_dns_name = talloc_asprintf(tctx, "%s._msdn.%s",
 482                                                                 dest_dsa_guid_str,
 483                                                                 priv->domain_dns_name);
 484         r.in.req.req1.dest_dsa_guid     = dest_dsa_guid;
 485
 486         /* 1. deleting replica dest should fail */
 487         torture_comment(tctx, "delete: %s\n", r.in.req.req1.dest_dsa_dns_name);
 488         r.in.req.req1.options           = DRSUAPI_DRS_DEL_REF;
 489         status = dcerpc_drsuapi_DsReplicaUpdateRefs_r(p->binding_handle, tctx, &r);
 490         torture_drsuapi_assert_call_werr(tctx, p,
 491                                          status, WERR_DS_DRA_REF_NOT_FOUND, &r,
 492                                          "dcerpc_drsuapi_DsReplicaUpdateRefs");
 493
 494         /* 2. hopefully adding random replica dest should succeed */
 495         torture_comment(tctx, "add   : %s\n", r.in.req.req1.dest_dsa_dns_name);
 496         r.in.req.req1.options           = DRSUAPI_DRS_ADD_REF;
 497         status = dcerpc_drsuapi_DsReplicaUpdateRefs_r(p->binding_handle, tctx, &r);
 498         torture_drsuapi_assert_call_werr(tctx, p,
 499                                          status, WERR_OK, &r,
 500                                          "dcerpc_drsuapi_DsReplicaUpdateRefs");
 501
 502         /* 3. try adding same replica dest - should fail */
 503         torture_comment(tctx, "add   : %s\n", r.in.req.req1.dest_dsa_dns_name);
 504         r.in.req.req1.options           = DRSUAPI_DRS_ADD_REF;
 505         status = dcerpc_drsuapi_DsReplicaUpdateRefs_r(p->binding_handle, tctx, &r);
 506         torture_drsuapi_assert_call_werr(tctx, p,
 507                                          status, WERR_DS_DRA_REF_ALREADY_EXISTS, &r,
 508                                          "dcerpc_drsuapi_DsReplicaUpdateRefs");
 509
 510         /* 4. delete random replicate added at step 2. */
 511         torture_comment(tctx, "delete: %s\n", r.in.req.req1.dest_dsa_dns_name);
 512         r.in.req.req1.options           = DRSUAPI_DRS_DEL_REF;
 513         status = dcerpc_drsuapi_DsReplicaUpdateRefs_r(p->binding_handle, tctx, &r);
 514         torture_drsuapi_assert_call_werr(tctx, p,
 515                                          status, WERR_OK, &r,
 516                                          "dcerpc_drsuapi_DsReplicaUpdateRefs");
 517
 518         return true;
 519 }
 520
 521 static bool test_DsGetNCChanges(struct torture_context *tctx,
 522                                 struct DsPrivate *priv)
 523 {
 524         NTSTATUS status;
 525         struct dcerpc_pipe *p = priv->drs_pipe;
 526         int i;
 527         struct drsuapi_DsGetNCChanges r;
 528         union drsuapi_DsGetNCChangesRequest req;
 529         union drsuapi_DsGetNCChangesCtr ctr;
 530         struct drsuapi_DsReplicaObjectIdentifier nc;
 531         struct GUID null_guid;
 532         struct dom_sid null_sid;
 533         uint32_t level_out;
 534         struct {
 535                 uint32_t level;
 536         } array[] = {
 537                 {
 538                         5
 539                 },
 540                 {
 541                         8
 542                 }
 543         };
 544
 545         if (torture_setting_bool(tctx, "samba4", false)) {
 546                 torture_comment(tctx, "skipping DsGetNCChanges test against Samba4\n");
 547                 return true;
 548         }
 549
 550         ZERO_STRUCT(null_guid);
 551         ZERO_STRUCT(null_sid);
 552
 553         for (i=0; i < ARRAY_SIZE(array); i++) {
 554                 torture_comment(tctx,
 555                                 "Testing DsGetNCChanges level %d\n",
 556                                 array[i].level);
 557
 558                 r.in.bind_handle        = &priv->bind_handle;
 559                 r.in.level              = array[i].level;
 560                 r.out.level_out         = &level_out;
 561                 r.out.ctr               = &ctr;
 562
 563                 switch (r.in.level) {
 564                 case 5:
 565                         nc.guid = null_guid;
 566                         nc.sid  = null_sid;
 567                         nc.dn   = priv->domain_obj_dn ? priv->domain_obj_dn : "";
 568
 569                         r.in.req                                        = &req;
 570                         r.in.req->req5.destination_dsa_guid             = GUID_random();
 571                         r.in.req->req5.source_dsa_invocation_id         = null_guid;
 572                         r.in.req->req5.naming_context                   = &nc;
 573                         r.in.req->req5.highwatermark.tmp_highest_usn    = 0;
 574                         r.in.req->req5.highwatermark.reserved_usn       = 0;
 575                         r.in.req->req5.highwatermark.highest_usn        = 0;
 576                         r.in.req->req5.uptodateness_vector              = NULL;
 577                         r.in.req->req5.replica_flags                    = 0;
 578                         if (lp_parm_bool(tctx->lp_ctx, NULL, "drsuapi", "compression", false)) {
 579                                 r.in.req->req5.replica_flags            |= DRSUAPI_DRS_USE_COMPRESSION;
 580                         }
 581                         r.in.req->req5.max_object_count                 = 0;
 582                         r.in.req->req5.max_ndr_size                     = 0;
 583                         r.in.req->req5.extended_op                      = DRSUAPI_EXOP_NONE;
 584                         r.in.req->req5.fsmo_info                        = 0;
 585
 586                         break;
 587                 case 8:
 588                         nc.guid = null_guid;
 589                         nc.sid  = null_sid;
 590                         nc.dn   = priv->domain_obj_dn ? priv->domain_obj_dn : "";
 591
 592                         r.in.req                                        = &req;
 593                         r.in.req->req8.destination_dsa_guid             = GUID_random();
 594                         r.in.req->req8.source_dsa_invocation_id         = null_guid;
 595                         r.in.req->req8.naming_context                   = &nc;
 596                         r.in.req->req8.highwatermark.tmp_highest_usn    = 0;
 597                         r.in.req->req8.highwatermark.reserved_usn       = 0;
 598                         r.in.req->req8.highwatermark.highest_usn        = 0;
 599                         r.in.req->req8.uptodateness_vector              = NULL;
 600                         r.in.req->req8.replica_flags                    = 0;
 601                         if (lp_parm_bool(tctx->lp_ctx, NULL, "drsuapi", "compression", false)) {
 602                                 r.in.req->req8.replica_flags            |= DRSUAPI_DRS_USE_COMPRESSION;
 603                         }
 604                         if (lp_parm_bool(tctx->lp_ctx, NULL, "drsuapi", "neighbour_writeable", true)) {
 605                                 r.in.req->req8.replica_flags            |= DRSUAPI_DRS_WRIT_REP;
 606                         }
 607                         r.in.req->req8.replica_flags                    |= DRSUAPI_DRS_INIT_SYNC
 608                                                                         | DRSUAPI_DRS_PER_SYNC
 609                                                                         | DRSUAPI_DRS_GET_ANC
 610                                                                         | DRSUAPI_DRS_NEVER_SYNCED
 611                                                                         ;
 612                         r.in.req->req8.max_object_count                 = 402;
 613                         r.in.req->req8.max_ndr_size                     = 402116;
 614                         r.in.req->req8.extended_op                      = DRSUAPI_EXOP_NONE;
 615                         r.in.req->req8.fsmo_info                        = 0;
 616                         r.in.req->req8.partial_attribute_set            = NULL;
 617                         r.in.req->req8.partial_attribute_set_ex         = NULL;
 618                         r.in.req->req8.mapping_ctr.num_mappings         = 0;
 619                         r.in.req->req8.mapping_ctr.mappings             = NULL;
 620
 621                         break;
 622                 }
 623
 624                 status = dcerpc_drsuapi_DsGetNCChanges_r(p->binding_handle, tctx, &r);
 625                 torture_drsuapi_assert_call(tctx, p, status, &r, "dcerpc_drsuapi_DsGetNCChanges");
 626         }
 627
 628         return true;
 629 }
 630
 631 bool test_QuerySitesByCost(struct torture_context *tctx,
 632                            struct DsPrivate *priv)
 633 {
 634         NTSTATUS status;
 635         struct dcerpc_pipe *p = priv->drs_pipe;
 636         struct drsuapi_QuerySitesByCost r;
 637         union drsuapi_QuerySitesByCostRequest req;
 638
 639         const char *my_site = "Default-First-Site-Name";
 640         const char *remote_site1 = "smbtorture-nonexisting-site1";
 641         const char *remote_site2 = "smbtorture-nonexisting-site2";
 642
 643         req.req1.site_from = talloc_strdup(tctx, my_site);
 644         req.req1.num_req = 2;
 645         req.req1.site_to = talloc_zero_array(tctx, const char *, 2);
 646         req.req1.site_to[0] = talloc_strdup(tctx, remote_site1);
 647         req.req1.site_to[1] = talloc_strdup(tctx, remote_site2);
 648         req.req1.flags = 0;
 649
 650         r.in.bind_handle = &priv->bind_handle;
 651         r.in.level = 1;
 652         r.in.req = &req;
 653
 654         status = dcerpc_drsuapi_QuerySitesByCost_r(p->binding_handle, tctx, &r);
 655         torture_drsuapi_assert_call(tctx, p, status, &r, "dcerpc_drsuapi_QuerySitesByCost");
 656
 657         if (W_ERROR_IS_OK(r.out.result)) {
 658                 torture_assert_werr_equal(tctx,
 659                                           r.out.ctr->ctr1.info[0].error_code, WERR_DS_OBJ_NOT_FOUND,
 660                                           "dcerpc_drsuapi_QuerySitesByCost");
 661                 torture_assert_werr_equal(tctx,
 662                                           r.out.ctr->ctr1.info[1].error_code, WERR_DS_OBJ_NOT_FOUND,
 663                                           "dcerpc_drsuapi_QuerySitesByCost expected error_code WERR_DS_OBJ_NOT_FOUND");
 664
 665                 torture_assert_int_equal(tctx,
 666                                          r.out.ctr->ctr1.info[0].site_cost, -1,
 667                                          "dcerpc_drsuapi_QuerySitesByCost");
 668                 torture_assert_int_equal(tctx,
 669                                          r.out.ctr->ctr1.info[1].site_cost, -1,
 670                                          "dcerpc_drsuapi_QuerySitesByCost exptected site cost");
 671         }
 672
 673         return true;
 674
 675
 676 }
 677
 678 bool test_DsUnbind(struct dcerpc_pipe *p,
 679                    struct torture_context *tctx,
 680                    struct DsPrivate *priv)
 681 {
 682         NTSTATUS status;
 683         struct drsuapi_DsUnbind r;
 684
 685         r.in.bind_handle = &priv->bind_handle;
 686         r.out.bind_handle = &priv->bind_handle;
 687
 688         torture_comment(tctx, "Testing DsUnbind\n");
 689
 690         status = dcerpc_drsuapi_DsUnbind_r(p->binding_handle, tctx, &r);
 691         torture_drsuapi_assert_call(tctx, p, status, &r, "dcerpc_drsuapi_DsUnbind");
 692
 693         return true;
 694 }
 695
 696
 697 /**
 698  * Helper func to collect DC information for testing purposes.
 699  * This function is almost identical to test_DsGetDomainControllerInfo
 700  */
 701 bool torture_rpc_drsuapi_get_dcinfo(struct torture_context *torture,
 702                                     struct DsPrivate *priv)
 703 {
 704         NTSTATUS status;
 705         int32_t level_out = 0;
 706         struct drsuapi_DsGetDomainControllerInfo r;
 707         union drsuapi_DsGetDCInfoCtr ctr;
 708         int j, k;
 709         const char *names[] = {
 710                                 torture_join_dom_netbios_name(priv->join),
 711                                 torture_join_dom_dns_name(priv->join)};
 712
 713         for (j=0; j < ARRAY_SIZE(names); j++) {
 714                 union drsuapi_DsGetDCInfoRequest req;
 715                 struct dcerpc_binding_handle *b = priv->drs_pipe->binding_handle;
 716                 r.in.bind_handle = &priv->bind_handle;
 717                 r.in.level = 1;
 718                 r.in.req = &req;
 719
 720                 r.in.req->req1.domain_name = names[j];
 721                 r.in.req->req1.level = 2;
 722
 723                 r.out.ctr = &ctr;
 724                 r.out.level_out = &level_out;
 725
 726                 status = dcerpc_drsuapi_DsGetDomainControllerInfo_r(b, torture, &r);
 727                 if (!NT_STATUS_IS_OK(status)) {
 728                         continue;
 729                 }
 730                 if (!W_ERROR_IS_OK(r.out.result)) {
 731                         /* If this was an error, we can't read the result structure */
 732                         continue;
 733                 }
 734
 735                 for (k=0; k < r.out.ctr->ctr2.count; k++) {
 736                         if (strcasecmp_m(r.out.ctr->ctr2.array[k].netbios_name,
 737                                          torture_join_netbios_name(priv->join)) == 0) {
 738                                 priv->dcinfo    = r.out.ctr->ctr2.array[k];
 739                                 return true;
 740                         }
 741                 }
 742         }
 743
 744         return false;
 745 }
 746
 747 /**
 748  * Common test case setup function to be used
 749  * in DRS suit of test when appropriate
 750  */
 751 bool torture_drsuapi_tcase_setup_common(struct torture_context *tctx, struct DsPrivate *priv)
 752 {
 753         NTSTATUS status;
 754         struct cli_credentials *machine_credentials;
 755
 756         torture_assert(tctx, priv, "Invalid argument");
 757
 758         torture_comment(tctx, "Create DRSUAPI pipe\n");
 759         status = torture_rpc_connection(tctx,
 760                                         &priv->drs_pipe,
 761                                         &ndr_table_drsuapi);
 762         torture_assert(tctx, NT_STATUS_IS_OK(status), "Unable to connect to DRSUAPI pipe");
 763
 764         torture_comment(tctx, "About to join domain\n");
 765         priv->join = torture_join_domain(tctx, TEST_MACHINE_NAME, ACB_SVRTRUST,
 766                                          &machine_credentials);
 767         torture_assert(tctx, priv->join, "Failed to join as BDC");
 768
 769         if (!test_DsBind(priv->drs_pipe, tctx, priv)) {
 770                 /* clean up */
 771                 torture_drsuapi_tcase_teardown_common(tctx, priv);
 772                 torture_fail(tctx, "Failed execute test_DsBind()");
 773         }
 774
 775         /* try collect some information for testing */
 776         torture_rpc_drsuapi_get_dcinfo(tctx, priv);
 777
 778         return true;
 779 }
 780
 781 /**
 782  * Common test case teardown function to be used
 783  * in DRS suit of test when appropriate
 784  */
 785 bool torture_drsuapi_tcase_teardown_common(struct torture_context *tctx, struct DsPrivate *priv)
 786 {
 787         if (priv->join) {
 788                 torture_leave_domain(tctx, priv->join);
 789         }
 790
 791         return true;
 792 }
 793
 794 /**
 795  * Test case setup for DRSUAPI test case
 796  */
 797 static bool torture_drsuapi_tcase_setup(struct torture_context *tctx, void **data)
 798 {
 799         struct DsPrivate *priv;
 800
 801         *data = priv = talloc_zero(tctx, struct DsPrivate);
 802
 803         return torture_drsuapi_tcase_setup_common(tctx, priv);
 804 }
 805
 806 /**
 807  * Test case tear-down for DRSUAPI test case
 808  */
 809 static bool torture_drsuapi_tcase_teardown(struct torture_context *tctx, void *data)
 810 {
 811         bool ret;
 812         struct DsPrivate *priv = talloc_get_type(data, struct DsPrivate);
 813
 814         ret = torture_drsuapi_tcase_teardown_common(tctx, priv);
 815
 816         talloc_free(priv);
 817         return ret;
 818 }
 819
 820 /**
 821  * DRSUAPI test case implementation
 822  */
 823 void torture_rpc_drsuapi_tcase(struct torture_suite *suite)
 824 {
 825         typedef bool (*run_func) (struct torture_context *test, void *tcase_data);
 826
 827         struct torture_test *test;
 828         struct torture_tcase *tcase = torture_suite_add_tcase(suite, "DRSUAPI");
 829
 830         torture_tcase_set_fixture(tcase,
 831                                   torture_drsuapi_tcase_setup,
 832                                   torture_drsuapi_tcase_teardown);
 833
 834 #if 0
 835         test = torture_tcase_add_simple_test(tcase, "QuerySitesByCost", (run_func)test_QuerySitesByCost);
 836 #endif
 837
 838         test = torture_tcase_add_simple_test(tcase, "DsGetDomainControllerInfo", (run_func)test_DsGetDomainControllerInfo);
 839
 840         test = torture_tcase_add_simple_test(tcase, "DsCrackNames", (run_func)test_DsCrackNames);
 841
 842         test = torture_tcase_add_simple_test(tcase, "DsWriteAccountSpn", (run_func)test_DsWriteAccountSpn);
 843
 844         test = torture_tcase_add_simple_test(tcase, "DsReplicaGetInfo", (run_func)test_DsReplicaGetInfo);
 845
 846         test = torture_tcase_add_simple_test(tcase, "DsReplicaSync", (run_func)test_DsReplicaSync);
 847
 848         test = torture_tcase_add_simple_test(tcase, "DsReplicaUpdateRefs", (run_func)test_DsReplicaUpdateRefs);
 849
 850         test = torture_tcase_add_simple_test(tcase, "DsGetNCChanges", (run_func)test_DsGetNCChanges);
 851 }