c8a38333d24ff704970c3263325889879c327074
[samba.git] / source4 / torture / drs / python / replica_sync.py
1 #!/usr/bin/env python
2 # -*- coding: utf-8 -*-
3 #
4 # Tests various schema replication scenarios
5 #
6 # Copyright (C) Kamen Mazdrashki <kamenim@samba.org> 2011
7 #
8 # This program is free software; you can redistribute it and/or modify
9 # it under the terms of the GNU General Public License as published by
10 # the Free Software Foundation; either version 3 of the License, or
11 # (at your option) any later version.
12 #
13 # This program is distributed in the hope that it will be useful,
14 # but WITHOUT ANY WARRANTY; without even the implied warranty of
15 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
16 # GNU General Public License for more details.
17 #
18 # You should have received a copy of the GNU General Public License
19 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
20 #
21
22 #
23 # Usage:
24 #  export DC1=dc1_dns_name
25 #  export DC2=dc2_dns_name
26 #  export SUBUNITRUN=$samba4srcdir/scripting/bin/subunitrun
27 #  PYTHONPATH="$PYTHONPATH:$samba4srcdir/torture/drs/python" $SUBUNITRUN replica_sync -U"$DOMAIN/$DC_USERNAME"%"$DC_PASSWORD"
28 #
29
30 from __future__ import print_function
31 import drs_base
32 import samba.tests
33 import time
34 import ldb
35
36 from ldb import (
37     SCOPE_BASE, LdbError, ERR_NO_SUCH_OBJECT)
38
39 class DrsReplicaSyncTestCase(drs_base.DrsBaseTestCase):
40     """Intended as a black box test case for DsReplicaSync
41        implementation. It should test the behavior of this
42        case in cases when inbound replication is disabled"""
43
44     def setUp(self):
45         super(DrsReplicaSyncTestCase, self).setUp()
46         self._net_drs_replicate(DC=self.dnsname_dc2, fromDC=self.dnsname_dc1, forced=True)
47         self._net_drs_replicate(DC=self.dnsname_dc1, fromDC=self.dnsname_dc2, forced=True)
48         self.ou1 = None
49         self.ou2 = None
50
51     def tearDown(self):
52         self._cleanup_object(self.ou1)
53         self._cleanup_object(self.ou2)
54
55         # re-enable replication
56         self._enable_inbound_repl(self.dnsname_dc1)
57         self._enable_inbound_repl(self.dnsname_dc2)
58
59         super(DrsReplicaSyncTestCase, self).tearDown()
60
61     def _cleanup_object(self, guid):
62         """Cleans up a test object, if it still exists"""
63         if guid is not None:
64             try:
65                 self.ldb_dc2.delete('<GUID=%s>' % guid, ["tree_delete:1"])
66             except LdbError as e:
67                 (num, _) = e.args
68                 self.assertEquals(num, ERR_NO_SUCH_OBJECT)
69             try:
70                 self.ldb_dc1.delete('<GUID=%s>' % guid, ["tree_delete:1"])
71             except LdbError as e1:
72                 (num, _) = e1.args
73                 self.assertEquals(num, ERR_NO_SUCH_OBJECT)
74
75     def test_ReplEnabled(self):
76         """Tests we can replicate when replication is enabled"""
77         self._enable_inbound_repl(self.dnsname_dc1)
78         self._net_drs_replicate(DC=self.dnsname_dc1, fromDC=self.dnsname_dc2, forced=False)
79
80     def test_ReplDisabled(self):
81         """Tests we cann't replicate when replication is disabled"""
82         self._disable_inbound_repl(self.dnsname_dc1)
83
84         ccache_name = self.get_creds_ccache_name()
85
86         # Tunnel the command line credentials down to the
87         # subcommand to avoid a new kinit
88         cmdline_auth = "--krb5-ccache=%s" % ccache_name
89
90         # bin/samba-tool drs <drs_command> <cmdline_auth>
91         cmd_list = ["drs", "replicate", cmdline_auth]
92
93         nc_dn = self.domain_dn
94         # bin/samba-tool drs replicate <Dest_DC_NAME> <Src_DC_NAME> <Naming Context>
95         cmd_list += [self.dnsname_dc1, self.dnsname_dc2, nc_dn]
96
97         (result, out, err) = self.runsubcmd(*cmd_list)
98         self.assertCmdFail(result)
99         self.assertTrue('WERR_DS_DRA_SINK_DISABLED' in err)
100
101     def test_ReplDisabledForced(self):
102         """Tests we can force replicate when replication is disabled"""
103         self._disable_inbound_repl(self.dnsname_dc1)
104         out = self._net_drs_replicate(DC=self.dnsname_dc1, fromDC=self.dnsname_dc2, forced=True)
105
106     def test_ReplLocal(self):
107         """Tests we can replicate direct to the local db"""
108         self._enable_inbound_repl(self.dnsname_dc1)
109         self._net_drs_replicate(DC=self.dnsname_dc1, fromDC=self.dnsname_dc2, forced=False, local=True, full_sync=True)
110
111     def _create_ou(self, samdb, name):
112         ldif = """
113 dn: %s,%s
114 objectClass: organizationalUnit
115 """ % (name, self.domain_dn)
116         samdb.add_ldif(ldif)
117         res = samdb.search(base="%s,%s" % (name, self.domain_dn),
118                            scope=SCOPE_BASE, attrs=["objectGUID"])
119         return self._GUID_string(res[0]["objectGUID"][0])
120
121     def _check_deleted(self, sam_ldb, guid):
122         # search the user by guid as it may be deleted
123         res = sam_ldb.search(base='<GUID=%s>' % guid,
124                              controls=["show_deleted:1"],
125                              attrs=["isDeleted", "objectCategory", "ou"])
126         self.assertEquals(len(res), 1)
127         ou_cur = res[0]
128         # Deleted Object base DN
129         dodn = self._deleted_objects_dn(sam_ldb)
130         # now check properties of the user
131         name_cur  = ou_cur["ou"][0]
132         self.assertEquals(ou_cur["isDeleted"][0],"TRUE")
133         self.assertTrue(not("objectCategory" in ou_cur))
134         self.assertTrue(dodn in str(ou_cur["dn"]),
135                         "OU %s is deleted but it is not located under %s!" % (name_cur, dodn))
136
137     def test_ReplConflictsFullSync(self):
138         """Tests that objects created in conflict become conflict DNs (honour full sync override)"""
139
140         # First confirm local replication (so when we test against windows, this fails fast without creating objects)
141         self._net_drs_replicate(DC=self.dnsname_dc2, fromDC=self.dnsname_dc1, local=True, forced=True, full_sync=True)
142
143         self._disable_inbound_repl(self.dnsname_dc1)
144         self._disable_inbound_repl(self.dnsname_dc2)
145
146         # Create conflicting objects on DC1 and DC2, with DC1 object created first
147         self.ou1 = self._create_ou(self.ldb_dc1, "OU=Test Full Sync")
148         # We have to sleep to ensure that the two objects have different timestamps
149         time.sleep(1)
150         self.ou2 = self._create_ou(self.ldb_dc2, "OU=Test Full Sync")
151
152         self._net_drs_replicate(DC=self.dnsname_dc2, fromDC=self.dnsname_dc1, local=True, forced=True, full_sync=True)
153
154         # Check that DC2 got the DC1 object, and OU1 was make into conflict
155         res1 = self.ldb_dc2.search(base="<GUID=%s>" % self.ou1,
156                                   scope=SCOPE_BASE, attrs=["name"])
157         res2 = self.ldb_dc2.search(base="<GUID=%s>" % self.ou2,
158                                   scope=SCOPE_BASE, attrs=["name"])
159         print(res1[0]["name"][0])
160         print(res2[0]["name"][0])
161         self.assertFalse('CNF:%s' % self.ou2 in str(res2[0]["name"][0]))
162         self.assertTrue('CNF:%s' % self.ou1 in str(res1[0]["name"][0]))
163         self.assertTrue(self._lost_and_found_dn(self.ldb_dc2, self.domain_dn) not in str(res1[0].dn))
164         self.assertTrue(self._lost_and_found_dn(self.ldb_dc2, self.domain_dn) not in str(res2[0].dn))
165         self.assertEqual(str(res1[0]["name"][0]), res1[0].dn.get_rdn_value())
166         self.assertEqual(str(res2[0]["name"][0]), res2[0].dn.get_rdn_value())
167
168         # Delete both objects by GUID on DC2
169
170         self.ldb_dc2.delete('<GUID=%s>' % self.ou1)
171         self.ldb_dc2.delete('<GUID=%s>' % self.ou2)
172
173         self._net_drs_replicate(DC=self.dnsname_dc1, fromDC=self.dnsname_dc2, forced=True, full_sync=True)
174
175         self._check_deleted(self.ldb_dc1, self.ou1)
176         self._check_deleted(self.ldb_dc1, self.ou2)
177         # Check deleted on DC2
178         self._check_deleted(self.ldb_dc2, self.ou1)
179         self._check_deleted(self.ldb_dc2, self.ou2)
180
181     def test_ReplConflictsRemoteWin(self):
182         """Tests that objects created in conflict become conflict DNs"""
183         self._disable_inbound_repl(self.dnsname_dc1)
184         self._disable_inbound_repl(self.dnsname_dc2)
185
186         # Create conflicting objects on DC1 and DC2, with DC1 object created first
187         self.ou1 = self._create_ou(self.ldb_dc1, "OU=Test Remote Conflict")
188         # We have to sleep to ensure that the two objects have different timestamps
189         time.sleep(1)
190         self.ou2 = self._create_ou(self.ldb_dc2, "OU=Test Remote Conflict")
191
192         self._net_drs_replicate(DC=self.dnsname_dc1, fromDC=self.dnsname_dc2, forced=True, full_sync=False)
193
194         # Check that DC2 got the DC1 object, and OU1 was make into conflict
195         res1 = self.ldb_dc1.search(base="<GUID=%s>" % self.ou1,
196                                   scope=SCOPE_BASE, attrs=["name"])
197         res2 = self.ldb_dc1.search(base="<GUID=%s>" % self.ou2,
198                                   scope=SCOPE_BASE, attrs=["name"])
199         print(res1[0]["name"][0])
200         print(res2[0]["name"][0])
201         self.assertTrue('CNF:%s' % self.ou1 in str(res1[0]["name"][0]))
202         self.assertTrue(self._lost_and_found_dn(self.ldb_dc1, self.domain_dn) not in str(res1[0].dn))
203         self.assertTrue(self._lost_and_found_dn(self.ldb_dc1, self.domain_dn) not in str(res2[0].dn))
204         self.assertEqual(str(res1[0]["name"][0]), res1[0].dn.get_rdn_value())
205         self.assertEqual(str(res2[0]["name"][0]), res2[0].dn.get_rdn_value())
206
207         # Delete both objects by GUID on DC1
208
209         self.ldb_dc1.delete('<GUID=%s>' % self.ou1)
210         self.ldb_dc1.delete('<GUID=%s>' % self.ou2)
211
212         self._net_drs_replicate(DC=self.dnsname_dc2, fromDC=self.dnsname_dc1, forced=True, full_sync=False)
213
214         self._check_deleted(self.ldb_dc1, self.ou1)
215         self._check_deleted(self.ldb_dc1, self.ou2)
216         # Check deleted on DC2
217         self._check_deleted(self.ldb_dc2, self.ou1)
218         self._check_deleted(self.ldb_dc2, self.ou2)
219
220     def test_ReplConflictsLocalWin(self):
221         """Tests that objects created in conflict become conflict DNs"""
222         self._disable_inbound_repl(self.dnsname_dc1)
223         self._disable_inbound_repl(self.dnsname_dc2)
224
225         # Create conflicting objects on DC1 and DC2, with DC2 object created first
226         self.ou2 = self._create_ou(self.ldb_dc2, "OU=Test Local Conflict")
227         # We have to sleep to ensure that the two objects have different timestamps
228         time.sleep(1)
229         self.ou1 = self._create_ou(self.ldb_dc1, "OU=Test Local Conflict")
230
231         self._net_drs_replicate(DC=self.dnsname_dc1, fromDC=self.dnsname_dc2, forced=True, full_sync=False)
232
233         # Check that DC2 got the DC1 object, and OU2 was make into conflict
234         res1 = self.ldb_dc1.search(base="<GUID=%s>" % self.ou1,
235                                   scope=SCOPE_BASE, attrs=["name"])
236         res2 = self.ldb_dc1.search(base="<GUID=%s>" % self.ou2,
237                                   scope=SCOPE_BASE, attrs=["name"])
238         print(res1[0]["name"][0])
239         print(res2[0]["name"][0])
240         self.assertTrue('CNF:%s' % self.ou2 in str(res2[0]["name"][0]), "Got %s for %s" % (str(res2[0]["name"][0]), self.ou2))
241         self.assertTrue(self._lost_and_found_dn(self.ldb_dc1, self.domain_dn) not in str(res1[0].dn))
242         self.assertTrue(self._lost_and_found_dn(self.ldb_dc1, self.domain_dn) not in str(res2[0].dn))
243         self.assertEqual(str(res1[0]["name"][0]), res1[0].dn.get_rdn_value())
244         self.assertEqual(str(res2[0]["name"][0]), res2[0].dn.get_rdn_value())
245
246         # Delete both objects by GUID on DC1
247
248         self.ldb_dc1.delete('<GUID=%s>' % self.ou1)
249         self.ldb_dc1.delete('<GUID=%s>' % self.ou2)
250
251         self._net_drs_replicate(DC=self.dnsname_dc2, fromDC=self.dnsname_dc1, forced=True, full_sync=False)
252
253         self._check_deleted(self.ldb_dc1, self.ou1)
254         self._check_deleted(self.ldb_dc1, self.ou2)
255         # Check deleted on DC2
256         self._check_deleted(self.ldb_dc2, self.ou1)
257         self._check_deleted(self.ldb_dc2, self.ou2)
258
259     def test_ReplConflictsRemoteWin_with_child(self):
260         """Tests that objects created in conflict become conflict DNs"""
261         self._disable_inbound_repl(self.dnsname_dc1)
262         self._disable_inbound_repl(self.dnsname_dc2)
263
264         # Create conflicting objects on DC1 and DC2, with DC1 object created first
265         self.ou1 = self._create_ou(self.ldb_dc1, "OU=Test Parent Remote Conflict")
266         # We have to sleep to ensure that the two objects have different timestamps
267         time.sleep(1)
268         self.ou2 = self._create_ou(self.ldb_dc2, "OU=Test Parent Remote Conflict")
269         # Create children on DC2
270         ou1_child = self._create_ou(self.ldb_dc1, "OU=Test Child,OU=Test Parent Remote Conflict")
271         ou2_child = self._create_ou(self.ldb_dc2, "OU=Test Child,OU=Test Parent Remote Conflict")
272
273         self._net_drs_replicate(DC=self.dnsname_dc1, fromDC=self.dnsname_dc2, forced=True, full_sync=False)
274
275         # Check that DC2 got the DC1 object, and SELF.OU1 was make into conflict
276         res1 = self.ldb_dc1.search(base="<GUID=%s>" % self.ou1,
277                                   scope=SCOPE_BASE, attrs=["name"])
278         res2 = self.ldb_dc1.search(base="<GUID=%s>" % self.ou2,
279                                   scope=SCOPE_BASE, attrs=["name"])
280         print(res1[0]["name"][0])
281         print(res2[0]["name"][0])
282         self.assertTrue('CNF:%s' % self.ou1 in str(res1[0]["name"][0]))
283         self.assertTrue(self._lost_and_found_dn(self.ldb_dc1, self.domain_dn) not in str(res1[0].dn))
284         self.assertTrue(self._lost_and_found_dn(self.ldb_dc1, self.domain_dn) not in str(res2[0].dn))
285         self.assertEqual(str(res1[0]["name"][0]), res1[0].dn.get_rdn_value())
286         self.assertEqual(str(res2[0]["name"][0]), res2[0].dn.get_rdn_value())
287
288         # Delete both objects by GUID on DC1
289
290         self.ldb_dc1.delete('<GUID=%s>' % self.ou1, ["tree_delete:1"])
291         self.ldb_dc1.delete('<GUID=%s>' % self.ou2, ["tree_delete:1"])
292
293         self._net_drs_replicate(DC=self.dnsname_dc2, fromDC=self.dnsname_dc1, forced=True, full_sync=False)
294
295         self._check_deleted(self.ldb_dc1, self.ou1)
296         self._check_deleted(self.ldb_dc1, self.ou2)
297         # Check deleted on DC2
298         self._check_deleted(self.ldb_dc2, self.ou1)
299         self._check_deleted(self.ldb_dc2, self.ou2)
300
301         self._check_deleted(self.ldb_dc1, ou1_child)
302         self._check_deleted(self.ldb_dc1, ou2_child)
303         # Check deleted on DC2
304         self._check_deleted(self.ldb_dc2, ou1_child)
305         self._check_deleted(self.ldb_dc2, ou2_child)
306
307     def test_ReplConflictsRenamedVsNewRemoteWin(self):
308         """Tests resolving a DN conflict between a renamed object and a new object"""
309         self._disable_inbound_repl(self.dnsname_dc1)
310         self._disable_inbound_repl(self.dnsname_dc2)
311
312         # Create an OU and rename it on DC1
313         self.ou1 = self._create_ou(self.ldb_dc1, "OU=Test Remote Rename Conflict orig")
314         self.ldb_dc1.rename("<GUID=%s>" % self.ou1, "OU=Test Remote Rename Conflict,%s" % self.domain_dn)
315
316         # We have to sleep to ensure that the two objects have different timestamps
317         time.sleep(1)
318
319         # create a conflicting object with the same DN on DC2
320         self.ou2 = self._create_ou(self.ldb_dc2, "OU=Test Remote Rename Conflict")
321
322         self._net_drs_replicate(DC=self.dnsname_dc1, fromDC=self.dnsname_dc2, forced=True, full_sync=False)
323
324         # Check that DC2 got the DC1 object, and SELF.OU1 was made into conflict
325         res1 = self.ldb_dc1.search(base="<GUID=%s>" % self.ou1,
326                                   scope=SCOPE_BASE, attrs=["name"])
327         res2 = self.ldb_dc1.search(base="<GUID=%s>" % self.ou2,
328                                   scope=SCOPE_BASE, attrs=["name"])
329         print(res1[0]["name"][0])
330         print(res2[0]["name"][0])
331         self.assertTrue('CNF:%s' % self.ou1 in str(res1[0]["name"][0]))
332         self.assertTrue(self._lost_and_found_dn(self.ldb_dc1, self.domain_dn) not in str(res1[0].dn))
333         self.assertTrue(self._lost_and_found_dn(self.ldb_dc1, self.domain_dn) not in str(res2[0].dn))
334         self.assertEqual(str(res1[0]["name"][0]), res1[0].dn.get_rdn_value())
335         self.assertEqual(str(res2[0]["name"][0]), res2[0].dn.get_rdn_value())
336
337         # Delete both objects by GUID on DC1
338         self.ldb_dc1.delete('<GUID=%s>' % self.ou1)
339         self.ldb_dc1.delete('<GUID=%s>' % self.ou2)
340
341         self._net_drs_replicate(DC=self.dnsname_dc2, fromDC=self.dnsname_dc1, forced=True, full_sync=False)
342
343         self._check_deleted(self.ldb_dc1, self.ou1)
344         self._check_deleted(self.ldb_dc1, self.ou2)
345         # Check deleted on DC2
346         self._check_deleted(self.ldb_dc2, self.ou1)
347         self._check_deleted(self.ldb_dc2, self.ou2)
348
349     def test_ReplConflictsRenamedVsNewLocalWin(self):
350         """Tests resolving a DN conflict between a renamed object and a new object"""
351         self._disable_inbound_repl(self.dnsname_dc1)
352         self._disable_inbound_repl(self.dnsname_dc2)
353
354         # Create conflicting objects on DC1 and DC2, where the DC2 object has been renamed
355         self.ou2 = self._create_ou(self.ldb_dc2, "OU=Test Rename Local Conflict orig")
356         self.ldb_dc2.rename("<GUID=%s>" % self.ou2, "OU=Test Rename Local Conflict,%s" % self.domain_dn)
357         # We have to sleep to ensure that the two objects have different timestamps
358         time.sleep(1)
359         self.ou1 = self._create_ou(self.ldb_dc1, "OU=Test Rename Local Conflict")
360
361         self._net_drs_replicate(DC=self.dnsname_dc1, fromDC=self.dnsname_dc2, forced=True, full_sync=False)
362
363         # Check that DC2 got the DC1 object, and OU2 was made into conflict
364         res1 = self.ldb_dc1.search(base="<GUID=%s>" % self.ou1,
365                                   scope=SCOPE_BASE, attrs=["name"])
366         res2 = self.ldb_dc1.search(base="<GUID=%s>" % self.ou2,
367                                   scope=SCOPE_BASE, attrs=["name"])
368         print(res1[0]["name"][0])
369         print(res2[0]["name"][0])
370         self.assertTrue('CNF:%s' % self.ou2 in str(res2[0]["name"][0]))
371         self.assertTrue(self._lost_and_found_dn(self.ldb_dc1, self.domain_dn) not in str(res1[0].dn))
372         self.assertTrue(self._lost_and_found_dn(self.ldb_dc1, self.domain_dn) not in str(res2[0].dn))
373         self.assertEqual(str(res1[0]["name"][0]), res1[0].dn.get_rdn_value())
374         self.assertEqual(str(res2[0]["name"][0]), res2[0].dn.get_rdn_value())
375
376         # Delete both objects by GUID on DC1
377         self.ldb_dc1.delete('<GUID=%s>' % self.ou1)
378         self.ldb_dc1.delete('<GUID=%s>' % self.ou2)
379
380         self._net_drs_replicate(DC=self.dnsname_dc2, fromDC=self.dnsname_dc1, forced=True, full_sync=False)
381
382         self._check_deleted(self.ldb_dc1, self.ou1)
383         self._check_deleted(self.ldb_dc1, self.ou2)
384         # Check deleted on DC2
385         self._check_deleted(self.ldb_dc2, self.ou1)
386         self._check_deleted(self.ldb_dc2, self.ou2)
387
388     def test_ReplConflictsRenameRemoteWin(self):
389         """Tests that objects created in conflict become conflict DNs"""
390         self._disable_inbound_repl(self.dnsname_dc1)
391         self._disable_inbound_repl(self.dnsname_dc2)
392
393         # Create conflicting objects on DC1 and DC2, with DC1 object created first
394         self.ou1 = self._create_ou(self.ldb_dc1, "OU=Test Remote Rename Conflict")
395         self.ou2 = self._create_ou(self.ldb_dc2, "OU=Test Remote Rename Conflict 2")
396
397         self._net_drs_replicate(DC=self.dnsname_dc1, fromDC=self.dnsname_dc2, forced=True, full_sync=False)
398
399         self.ldb_dc1.rename("<GUID=%s>" % self.ou1, "OU=Test Remote Rename Conflict 3,%s" % self.domain_dn)
400         # We have to sleep to ensure that the two objects have different timestamps
401         time.sleep(1)
402         self.ldb_dc2.rename("<GUID=%s>" % self.ou2, "OU=Test Remote Rename Conflict 3,%s" % self.domain_dn)
403
404         self._net_drs_replicate(DC=self.dnsname_dc1, fromDC=self.dnsname_dc2, forced=True, full_sync=False)
405
406         # Check that DC2 got the DC1 object, and SELF.OU1 was make into conflict
407         res1 = self.ldb_dc1.search(base="<GUID=%s>" % self.ou1,
408                                   scope=SCOPE_BASE, attrs=["name"])
409         res2 = self.ldb_dc1.search(base="<GUID=%s>" % self.ou2,
410                                   scope=SCOPE_BASE, attrs=["name"])
411         print(res1[0]["name"][0])
412         print(res2[0]["name"][0])
413         self.assertTrue('CNF:%s' % self.ou1 in str(res1[0]["name"][0]))
414         self.assertTrue(self._lost_and_found_dn(self.ldb_dc1, self.domain_dn) not in str(res1[0].dn))
415         self.assertTrue(self._lost_and_found_dn(self.ldb_dc1, self.domain_dn) not in str(res2[0].dn))
416         self.assertEqual(str(res1[0]["name"][0]), res1[0].dn.get_rdn_value())
417         self.assertEqual(str(res2[0]["name"][0]), res2[0].dn.get_rdn_value())
418
419         # Delete both objects by GUID on DC1
420
421         self.ldb_dc1.delete('<GUID=%s>' % self.ou1)
422         self.ldb_dc1.delete('<GUID=%s>' % self.ou2)
423
424         self._net_drs_replicate(DC=self.dnsname_dc2, fromDC=self.dnsname_dc1, forced=True, full_sync=False)
425
426         self._check_deleted(self.ldb_dc1, self.ou1)
427         self._check_deleted(self.ldb_dc1, self.ou2)
428         # Check deleted on DC2
429         self._check_deleted(self.ldb_dc2, self.ou1)
430         self._check_deleted(self.ldb_dc2, self.ou2)
431
432
433     def test_ReplConflictsRenameRemoteWin_with_child(self):
434         """Tests that objects created in conflict become conflict DNs"""
435         self._disable_inbound_repl(self.dnsname_dc1)
436         self._disable_inbound_repl(self.dnsname_dc2)
437
438         # Create conflicting objects on DC1 and DC2, with DC1 object created first
439         self.ou1 = self._create_ou(self.ldb_dc1, "OU=Test Parent Remote Rename Conflict")
440         self.ou2 = self._create_ou(self.ldb_dc2, "OU=Test Parent Remote Rename Conflict 2")
441         # Create children on DC2
442         ou1_child = self._create_ou(self.ldb_dc1, "OU=Test Child,OU=Test Parent Remote Rename Conflict")
443         ou2_child = self._create_ou(self.ldb_dc2, "OU=Test Child,OU=Test Parent Remote Rename Conflict 2")
444
445         self._net_drs_replicate(DC=self.dnsname_dc1, fromDC=self.dnsname_dc2, forced=True, full_sync=False)
446
447         self.ldb_dc1.rename("<GUID=%s>" % self.ou1, "OU=Test Parent Remote Rename Conflict 3,%s" % self.domain_dn)
448         # We have to sleep to ensure that the two objects have different timestamps
449         time.sleep(1)
450         self.ldb_dc2.rename("<GUID=%s>" % self.ou2, "OU=Test Parent Remote Rename Conflict 3,%s" % self.domain_dn)
451
452         self._net_drs_replicate(DC=self.dnsname_dc1, fromDC=self.dnsname_dc2, forced=True, full_sync=False)
453
454         # Check that DC2 got the DC1 object, and SELF.OU1 was make into conflict
455         res1 = self.ldb_dc1.search(base="<GUID=%s>" % self.ou1,
456                                   scope=SCOPE_BASE, attrs=["name"])
457         res2 = self.ldb_dc1.search(base="<GUID=%s>" % self.ou2,
458                                   scope=SCOPE_BASE, attrs=["name"])
459         print(res1[0]["name"][0])
460         print(res2[0]["name"][0])
461         self.assertTrue('CNF:%s' % self.ou1 in str(res1[0]["name"][0]))
462         self.assertTrue(self._lost_and_found_dn(self.ldb_dc1, self.domain_dn) not in str(res1[0].dn))
463         self.assertTrue(self._lost_and_found_dn(self.ldb_dc1, self.domain_dn) not in str(res2[0].dn))
464         self.assertEqual(str(res1[0]["name"][0]), res1[0].dn.get_rdn_value())
465         self.assertEqual(str(res2[0]["name"][0]), res2[0].dn.get_rdn_value())
466
467         # Delete both objects by GUID on DC1
468
469         self.ldb_dc1.delete('<GUID=%s>' % self.ou1, ["tree_delete:1"])
470         self.ldb_dc1.delete('<GUID=%s>' % self.ou2, ["tree_delete:1"])
471
472         self._net_drs_replicate(DC=self.dnsname_dc2, fromDC=self.dnsname_dc1, forced=True, full_sync=False)
473
474         self._check_deleted(self.ldb_dc1, self.ou1)
475         self._check_deleted(self.ldb_dc1, self.ou2)
476         # Check deleted on DC2
477         self._check_deleted(self.ldb_dc2, self.ou1)
478         self._check_deleted(self.ldb_dc2, self.ou2)
479
480         self._check_deleted(self.ldb_dc1, ou1_child)
481         self._check_deleted(self.ldb_dc1, ou2_child)
482         # Check deleted on DC2
483         self._check_deleted(self.ldb_dc2, ou1_child)
484         self._check_deleted(self.ldb_dc2, ou2_child)
485
486
487     def test_ReplConflictsRenameLocalWin(self):
488         """Tests that objects created in conflict become conflict DNs"""
489         self._disable_inbound_repl(self.dnsname_dc1)
490         self._disable_inbound_repl(self.dnsname_dc2)
491
492         # Create conflicting objects on DC1 and DC2, with DC1 object created first
493         self.ou1 = self._create_ou(self.ldb_dc1, "OU=Test Rename Local Conflict")
494         self.ou2 = self._create_ou(self.ldb_dc2, "OU=Test Rename Local Conflict 2")
495
496         self._net_drs_replicate(DC=self.dnsname_dc1, fromDC=self.dnsname_dc2, forced=True, full_sync=False)
497
498         self.ldb_dc2.rename("<GUID=%s>" % self.ou2, "OU=Test Rename Local Conflict 3,%s" % self.domain_dn)
499         # We have to sleep to ensure that the two objects have different timestamps
500         time.sleep(1)
501         self.ldb_dc1.rename("<GUID=%s>" % self.ou1, "OU=Test Rename Local Conflict 3,%s" % self.domain_dn)
502
503         self._net_drs_replicate(DC=self.dnsname_dc1, fromDC=self.dnsname_dc2, forced=True, full_sync=False)
504
505         # Check that DC2 got the DC1 object, and OU2 was make into conflict
506         res1 = self.ldb_dc1.search(base="<GUID=%s>" % self.ou1,
507                                   scope=SCOPE_BASE, attrs=["name"])
508         res2 = self.ldb_dc1.search(base="<GUID=%s>" % self.ou2,
509                                   scope=SCOPE_BASE, attrs=["name"])
510         print(res1[0]["name"][0])
511         print(res2[0]["name"][0])
512         self.assertTrue('CNF:%s' % self.ou2 in str(res2[0]["name"][0]))
513         self.assertTrue(self._lost_and_found_dn(self.ldb_dc1, self.domain_dn) not in str(res1[0].dn))
514         self.assertTrue(self._lost_and_found_dn(self.ldb_dc1, self.domain_dn) not in str(res2[0].dn))
515         self.assertEqual(str(res1[0]["name"][0]), res1[0].dn.get_rdn_value())
516         self.assertEqual(str(res2[0]["name"][0]), res2[0].dn.get_rdn_value())
517
518         # Delete both objects by GUID on DC1
519
520         self.ldb_dc1.delete('<GUID=%s>' % self.ou1)
521         self.ldb_dc1.delete('<GUID=%s>' % self.ou2)
522
523         self._net_drs_replicate(DC=self.dnsname_dc2, fromDC=self.dnsname_dc1, forced=True, full_sync=False)
524
525         self._check_deleted(self.ldb_dc1, self.ou1)
526         self._check_deleted(self.ldb_dc1, self.ou2)
527         # Check deleted on DC2
528         self._check_deleted(self.ldb_dc2, self.ou1)
529         self._check_deleted(self.ldb_dc2, self.ou2)
530
531     def test_ReplLostAndFound(self):
532         """Tests that objects created under a OU deleted eleswhere end up in lostAndFound"""
533         self._disable_inbound_repl(self.dnsname_dc1)
534         self._disable_inbound_repl(self.dnsname_dc2)
535
536         # Create two OUs on DC2
537         self.ou1 = self._create_ou(self.ldb_dc2, "OU=Deleted parent")
538         self.ou2 = self._create_ou(self.ldb_dc2, "OU=Deleted parent 2")
539
540         # replicate them from DC2 to DC1
541         self._net_drs_replicate(DC=self.dnsname_dc1, fromDC=self.dnsname_dc2, forced=True, full_sync=False)
542
543         # Delete both objects by GUID on DC1
544
545         self.ldb_dc1.delete('<GUID=%s>' % self.ou1)
546         self.ldb_dc1.delete('<GUID=%s>' % self.ou2)
547
548         # Create children on DC2
549         ou1_child = self._create_ou(self.ldb_dc2, "OU=Test Child,OU=Deleted parent")
550         ou2_child = self._create_ou(self.ldb_dc2, "OU=Test Child,OU=Deleted parent 2")
551
552         # Replicate from DC2
553         self._net_drs_replicate(DC=self.dnsname_dc1, fromDC=self.dnsname_dc2, forced=True, full_sync=False)
554
555         # Check the sub-OUs are now in lostAndFound and the first one is a conflict DN
556
557         # Check that DC2 got the DC1 object, and one or other object was make into conflict
558         res1 = self.ldb_dc1.search(base="<GUID=%s>" % ou1_child,
559                                   scope=SCOPE_BASE, attrs=["name"])
560         res2 = self.ldb_dc1.search(base="<GUID=%s>" % ou2_child,
561                                   scope=SCOPE_BASE, attrs=["name"])
562         print(res1[0]["name"][0])
563         print(res2[0]["name"][0])
564         self.assertTrue('CNF:%s' % ou1_child in str(res1[0]["name"][0]) or 'CNF:%s' % ou2_child in str(res2[0]["name"][0]))
565         self.assertTrue(self._lost_and_found_dn(self.ldb_dc1, self.domain_dn) in str(res1[0].dn))
566         self.assertTrue(self._lost_and_found_dn(self.ldb_dc1, self.domain_dn) in str(res2[0].dn))
567         self.assertEqual(str(res1[0]["name"][0]), res1[0].dn.get_rdn_value())
568         self.assertEqual(str(res2[0]["name"][0]), res2[0].dn.get_rdn_value())
569
570         # Delete all objects by GUID on DC1
571
572         self.ldb_dc1.delete('<GUID=%s>' % ou1_child)
573         self.ldb_dc1.delete('<GUID=%s>' % ou2_child)
574
575         self._net_drs_replicate(DC=self.dnsname_dc2, fromDC=self.dnsname_dc1, forced=True, full_sync=False)
576
577
578         # Check all deleted on DC1
579         self._check_deleted(self.ldb_dc1, self.ou1)
580         self._check_deleted(self.ldb_dc1, self.ou2)
581         self._check_deleted(self.ldb_dc1, ou1_child)
582         self._check_deleted(self.ldb_dc1, ou2_child)
583         # Check all deleted on DC2
584         self._check_deleted(self.ldb_dc2, self.ou1)
585         self._check_deleted(self.ldb_dc2, self.ou2)
586         self._check_deleted(self.ldb_dc2, ou1_child)
587         self._check_deleted(self.ldb_dc2, ou2_child)
588
589     def test_ReplRenames(self):
590         """Tests that objects created under a OU deleted eleswhere end up in lostAndFound"""
591         self._disable_inbound_repl(self.dnsname_dc1)
592         self._disable_inbound_repl(self.dnsname_dc2)
593
594         # Create two OUs on DC2
595         self.ou1 = self._create_ou(self.ldb_dc2, "OU=Original parent")
596         self.ou2 = self._create_ou(self.ldb_dc2, "OU=Original parent 2")
597
598         # replicate them from DC2 to DC1
599         self._net_drs_replicate(DC=self.dnsname_dc1, fromDC=self.dnsname_dc2, forced=True, full_sync=False)
600
601         # Create children on DC1
602         ou1_child = self._create_ou(self.ldb_dc1, "OU=Test Child,OU=Original parent")
603         ou2_child = self._create_ou(self.ldb_dc1, "OU=Test Child 2,OU=Original parent")
604         ou3_child = self._create_ou(self.ldb_dc1, "OU=Test Case Child,OU=Original parent")
605
606         # replicate them from DC1 to DC2
607         self._net_drs_replicate(DC=self.dnsname_dc2, fromDC=self.dnsname_dc1, forced=True, full_sync=False)
608
609         self.ldb_dc1.rename("<GUID=%s>" % ou2_child, "OU=Test Child 3,OU=Original parent 2,%s" % self.domain_dn)
610         self.ldb_dc1.rename("<GUID=%s>" % ou1_child, "OU=Test Child 2,OU=Original parent 2,%s" % self.domain_dn)
611         self.ldb_dc1.rename("<GUID=%s>" % ou2_child, "OU=Test Child,OU=Original parent 2,%s" % self.domain_dn)
612         self.ldb_dc1.rename("<GUID=%s>" % ou3_child, "OU=Test CASE Child,OU=Original parent,%s" % self.domain_dn)
613         self.ldb_dc2.rename("<GUID=%s>" % self.ou2, "OU=Original parent 3,%s" % self.domain_dn)
614         self.ldb_dc2.rename("<GUID=%s>" % self.ou1, "OU=Original parent 2,%s" % self.domain_dn)
615
616         # replicate them from DC1 to DC2
617         self._net_drs_replicate(DC=self.dnsname_dc2, fromDC=self.dnsname_dc1, forced=True, full_sync=False)
618
619         # Check the sub-OUs are now under Original Parent 3 (original
620         # parent 2 for Test CASE Child), and both have the right names
621
622         # Check that DC2 got the DC1 object, and the renames are all correct
623         res1 = self.ldb_dc2.search(base="<GUID=%s>" % ou1_child,
624                                   scope=SCOPE_BASE, attrs=["name"])
625         res2 = self.ldb_dc2.search(base="<GUID=%s>" % ou2_child,
626                                   scope=SCOPE_BASE, attrs=["name"])
627         res3 = self.ldb_dc2.search(base="<GUID=%s>" % ou3_child,
628                                   scope=SCOPE_BASE, attrs=["name"])
629         print(res1[0].dn)
630         print(res2[0].dn)
631         print(res3[0].dn)
632         self.assertEqual('Test Child 2', res1[0]["name"][0])
633         self.assertEqual('Test Child', res2[0]["name"][0])
634         self.assertEqual('Test CASE Child', res3[0]["name"][0])
635         self.assertEqual(str(res1[0].dn), "OU=Test Child 2,OU=Original parent 3,%s" % self.domain_dn)
636         self.assertEqual(str(res2[0].dn), "OU=Test Child,OU=Original parent 3,%s" % self.domain_dn)
637         self.assertEqual(str(res3[0].dn), "OU=Test CASE Child,OU=Original parent 2,%s" % self.domain_dn)
638
639         # replicate them from DC2 to DC1
640         self._net_drs_replicate(DC=self.dnsname_dc1, fromDC=self.dnsname_dc2, forced=True, full_sync=False)
641
642         # Check that DC1 got the DC2 object, and the renames are all correct
643         res1 = self.ldb_dc1.search(base="<GUID=%s>" % ou1_child,
644                                   scope=SCOPE_BASE, attrs=["name"])
645         res2 = self.ldb_dc1.search(base="<GUID=%s>" % ou2_child,
646                                   scope=SCOPE_BASE, attrs=["name"])
647         res3 = self.ldb_dc1.search(base="<GUID=%s>" % ou3_child,
648                                   scope=SCOPE_BASE, attrs=["name"])
649         print(res1[0].dn)
650         print(res2[0].dn)
651         print(res3[0].dn)
652         self.assertEqual('Test Child 2', res1[0]["name"][0])
653         self.assertEqual('Test Child', res2[0]["name"][0])
654         self.assertEqual('Test CASE Child', res3[0]["name"][0])
655         self.assertEqual(str(res1[0].dn), "OU=Test Child 2,OU=Original parent 3,%s" % self.domain_dn)
656         self.assertEqual(str(res2[0].dn), "OU=Test Child,OU=Original parent 3,%s" % self.domain_dn)
657         self.assertEqual(str(res3[0].dn), "OU=Test CASE Child,OU=Original parent 2,%s" % self.domain_dn)
658
659         # Delete all objects by GUID on DC1
660
661         self.ldb_dc1.delete('<GUID=%s>' % ou1_child)
662         self.ldb_dc1.delete('<GUID=%s>' % ou2_child)
663         self.ldb_dc1.delete('<GUID=%s>' % ou3_child)
664         self.ldb_dc1.delete('<GUID=%s>' % self.ou1)
665         self.ldb_dc1.delete('<GUID=%s>' % self.ou2)
666
667         self._net_drs_replicate(DC=self.dnsname_dc2, fromDC=self.dnsname_dc1, forced=True, full_sync=False)
668
669
670         # Check all deleted on DC1
671         self._check_deleted(self.ldb_dc1, self.ou1)
672         self._check_deleted(self.ldb_dc1, self.ou2)
673         self._check_deleted(self.ldb_dc1, ou1_child)
674         self._check_deleted(self.ldb_dc1, ou2_child)
675         self._check_deleted(self.ldb_dc1, ou3_child)
676         # Check all deleted on DC2
677         self._check_deleted(self.ldb_dc2, self.ou1)
678         self._check_deleted(self.ldb_dc2, self.ou2)
679         self._check_deleted(self.ldb_dc2, ou1_child)
680         self._check_deleted(self.ldb_dc2, ou2_child)
681         self._check_deleted(self.ldb_dc2, ou3_child)
682
683     def reanimate_object(self, samdb, guid, new_dn):
684         """Re-animates a deleted object"""
685         res = samdb.search(base="<GUID=%s>" % guid, attrs=["isDeleted"],
686                            controls=['show_deleted:1'], scope=SCOPE_BASE)
687         if len(res) != 1:
688             return
689
690         msg = ldb.Message()
691         msg.dn = res[0].dn
692         msg["isDeleted"] = ldb.MessageElement([], ldb.FLAG_MOD_DELETE, "isDeleted")
693         msg["distinguishedName"] = ldb.MessageElement([new_dn], ldb.FLAG_MOD_REPLACE, "distinguishedName")
694         samdb.modify(msg, ["show_deleted:1"])
695
696     def test_ReplReanimationConflict(self):
697         """
698         Checks that if a reanimated object conflicts with a new object, then
699         the conflict is resolved correctly.
700         """
701
702         self._disable_inbound_repl(self.dnsname_dc1)
703         self._disable_inbound_repl(self.dnsname_dc2)
704
705         # create an object, "accidentally" delete it, and replicate the changes to both DCs
706         self.ou1 = self._create_ou(self.ldb_dc2, "OU=Conflict object")
707         self.ldb_dc2.delete('<GUID=%s>' % self.ou1)
708         self._net_drs_replicate(DC=self.dnsname_dc1, fromDC=self.dnsname_dc2, forced=True, full_sync=False)
709
710         # Now pretend that the admin for one DC resolves the problem by
711         # re-animating the object...
712         self.reanimate_object(self.ldb_dc1, self.ou1, "OU=Conflict object,%s" % self.domain_dn)
713
714         # ...whereas another admin just creates a user with the same name
715         # again on a different DC
716         time.sleep(1)
717         self.ou2 = self._create_ou(self.ldb_dc2, "OU=Conflict object")
718
719         # Now sync the DCs to resolve the conflict
720         self._net_drs_replicate(DC=self.dnsname_dc1, fromDC=self.dnsname_dc2, forced=True, full_sync=False)
721
722         # Check the latest change won and SELF.OU1 was made into a conflict
723         res1 = self.ldb_dc1.search(base="<GUID=%s>" % self.ou1,
724                                   scope=SCOPE_BASE, attrs=["name"])
725         res2 = self.ldb_dc1.search(base="<GUID=%s>" % self.ou2,
726                                   scope=SCOPE_BASE, attrs=["name"])
727         print(res1[0]["name"][0])
728         print(res2[0]["name"][0])
729         self.assertTrue('CNF:%s' % self.ou1 in str(res1[0]["name"][0]))
730         self.assertFalse('CNF:%s' % self.ou2 in str(res2[0]["name"][0]))
731
732         # Delete both objects by GUID on DC1
733         self.ldb_dc1.delete('<GUID=%s>' % self.ou1)
734         self.ldb_dc1.delete('<GUID=%s>' % self.ou2)
735
736         self._net_drs_replicate(DC=self.dnsname_dc2, fromDC=self.dnsname_dc1, forced=True, full_sync=False)
737
738         self._check_deleted(self.ldb_dc1, self.ou1)
739         self._check_deleted(self.ldb_dc1, self.ou2)
740         # Check deleted on DC2
741         self._check_deleted(self.ldb_dc2, self.ou1)
742         self._check_deleted(self.ldb_dc2, self.ou2)
743