source4/torture/rpc/dssync.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3
   4    DsGetNCChanges replication test
   5
   6    Copyright (C) Stefan (metze) Metzmacher 2005
   7    Copyright (C) Brad Henry 2005
   8
   9    This program is free software; you can redistribute it and/or modify
  10    it under the terms of the GNU General Public License as published by
  11    the Free Software Foundation; either version 2 of the License, or
  12    (at your option) any later version.
  13
  14    This program is distributed in the hope that it will be useful,
  15    but WITHOUT ANY WARRANTY; without even the implied warranty of
  16    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  17    GNU General Public License for more details.
  18
  19    You should have received a copy of the GNU General Public License
  20    along with this program; if not, write to the Free Software
  21    Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  22 */
  23
  24 #include "includes.h"
  25 #include "lib/cmdline/popt_common.h"
  26 #include "libnet/libnet.h"
  27 #include "librpc/gen_ndr/ndr_drsuapi.h"
  28 #include "librpc/gen_ndr/ndr_samr.h"
  29 #include "libcli/ldap/ldap.h"
  30 #include "libcli/cldap/cldap.h"
  31 #include "ads.h"
  32
  33 struct DsSyncBindInfo {
  34         struct dcerpc_pipe *pipe;
  35         struct drsuapi_DsBind req;
  36         struct GUID bind_guid;
  37         struct drsuapi_DsBindInfoCtr our_bind_info;
  38         struct policy_handle bind_handle;
  39 };
  40
  41 struct DsSyncLDAPInfo {
  42         struct ldap_connection *conn;
  43 };
  44
  45 struct DsSyncTest {
  46         struct dcerpc_binding *drsuapi_binding;
  47
  48         const char *ldap_url;
  49         const char *site_name;
  50
  51         const char *domain_dn;
  52
  53         /* what we need to do as 'Administrator' */
  54         struct {
  55                 struct cli_credentials *credentials;
  56                 struct DsSyncBindInfo drsuapi;
  57                 struct DsSyncLDAPInfo ldap;
  58         } admin;
  59
  60         /* what we need to do as the new dc machine account */
  61         struct {
  62                 struct cli_credentials *credentials;
  63                 struct DsSyncBindInfo drsuapi;
  64                 struct drsuapi_DsGetDCInfo2 dc_info2;
  65                 struct GUID invocation_id;
  66                 struct GUID object_guid;
  67         } new_dc;
  68
  69         /* info about the old dc */
  70         struct {
  71                 struct drsuapi_DsGetDomainControllerInfo dc_info;
  72         } old_dc;
  73 };
  74
  75 static struct DsSyncTest *test_create_context(TALLOC_CTX *mem_ctx)
  76 {
  77         NTSTATUS status;
  78         struct DsSyncTest *ctx;
  79         struct drsuapi_DsBindInfoCtr *our_bind_info;
  80         const char *binding = lp_parm_string(-1, "torture", "binding");
  81         ctx = talloc_zero(mem_ctx, struct DsSyncTest);
  82         if (!ctx) return NULL;
  83
  84         status = dcerpc_parse_binding(ctx, binding, &ctx->drsuapi_binding);
  85         if (!NT_STATUS_IS_OK(status)) {
  86                 printf("Bad binding string %s\n", binding);
  87                 return NULL;
  88         }
  89         ctx->drsuapi_binding->flags |= DCERPC_SIGN | DCERPC_SEAL;
  90
  91         ctx->ldap_url = talloc_asprintf(ctx, "ldap://%s/", ctx->drsuapi_binding->host);
  92
  93         /* ctx->admin ...*/
  94         ctx->admin.credentials                          = cmdline_credentials;
  95
  96         our_bind_info                                   = &ctx->admin.drsuapi.our_bind_info;
  97         our_bind_info->length                           = 28;
  98         our_bind_info->info.info28.supported_extensions = 0xFFFFFFFF;
  99         our_bind_info->info.info28.supported_extensions |= DRSUAPI_SUPPORTED_EXTENSION_ADDENTRYREPLY_V3;
 100         our_bind_info->info.info28.site_guid            = GUID_zero();
 101         our_bind_info->info.info28.u1                   = 0;
 102         our_bind_info->info.info28.repl_epoch           = 1;
 103
 104         GUID_from_string(DRSUAPI_DS_BIND_GUID, &ctx->admin.drsuapi.bind_guid);
 105
 106         ctx->admin.drsuapi.req.in.bind_guid             = &ctx->admin.drsuapi.bind_guid;
 107         ctx->admin.drsuapi.req.in.bind_info             = our_bind_info;
 108         ctx->admin.drsuapi.req.out.bind_handle          = &ctx->admin.drsuapi.bind_handle;
 109
 110         /* ctx->new_dc ...*/
 111
 112         our_bind_info                                   = &ctx->new_dc.drsuapi.our_bind_info;
 113         our_bind_info->length                           = 28;
 114         our_bind_info->info.info28.supported_extensions = 0x1ffffb7f;
 115         our_bind_info->info.info28.supported_extensions |= DRSUAPI_SUPPORTED_EXTENSION_LINKED_VALUE_REPLICATION;
 116         our_bind_info->info.info28.supported_extensions |= DRSUAPI_SUPPORTED_EXTENSION_ADDENTRYREPLY_V3;
 117         our_bind_info->info.info28.site_guid            = GUID_zero();
 118         our_bind_info->info.info28.u1                   = 508;
 119         our_bind_info->info.info28.repl_epoch           = 0;
 120
 121         GUID_from_string(DRSUAPI_DS_BIND_GUID_W2K3, &ctx->new_dc.drsuapi.bind_guid);
 122
 123         ctx->new_dc.drsuapi.req.in.bind_guid            = &ctx->new_dc.drsuapi.bind_guid;
 124         ctx->new_dc.drsuapi.req.in.bind_info            = our_bind_info;
 125         ctx->new_dc.drsuapi.req.out.bind_handle         = &ctx->new_dc.drsuapi.bind_handle;
 126
 127         /* ctx->old_dc ...*/
 128
 129         return ctx;
 130 }
 131
 132 static BOOL _test_DsBind(struct DsSyncTest *ctx, struct cli_credentials *credentials, struct DsSyncBindInfo *b)
 133 {
 134         NTSTATUS status;
 135         BOOL ret = True;
 136         struct event_context *event = NULL;
 137
 138         status = dcerpc_pipe_connect_b(ctx,
 139                                        &b->pipe, ctx->drsuapi_binding,
 140                                        DCERPC_DRSUAPI_UUID,
 141                                        DCERPC_DRSUAPI_VERSION,
 142                                        credentials, event);
 143
 144         if (!NT_STATUS_IS_OK(status)) {
 145                 printf("Failed to connect to server as a BDC: %s\n", nt_errstr(status));
 146                 return False;
 147         }
 148
 149         status = dcerpc_drsuapi_DsBind(b->pipe, ctx, &b->req);
 150         if (!NT_STATUS_IS_OK(status)) {
 151                 const char *errstr = nt_errstr(status);
 152                 if (NT_STATUS_EQUAL(status, NT_STATUS_NET_WRITE_FAULT)) {
 153                         errstr = dcerpc_errstr(ctx, b->pipe->last_fault_code);
 154                 }
 155                 printf("dcerpc_drsuapi_DsBind failed - %s\n", errstr);
 156                 ret = False;
 157         } else if (!W_ERROR_IS_OK(b->req.out.result)) {
 158                 printf("DsBind failed - %s\n", win_errstr(b->req.out.result));
 159                 ret = False;
 160         }
 161
 162         return ret;
 163 }
 164
 165 static BOOL test_LDAPBind(struct DsSyncTest *ctx, struct cli_credentials *credentials, struct DsSyncLDAPInfo *l)
 166 {
 167         NTSTATUS status;
 168         BOOL ret = True;
 169
 170         status = torture_ldap_connection(ctx, &l->conn, ctx->ldap_url);
 171         if (!NT_STATUS_IS_OK(status)) {
 172                 printf("failed to connect to LDAP: %s\n", ctx->ldap_url);
 173                 return False;
 174         }
 175
 176         printf("connected to LDAP: %s\n", ctx->ldap_url);
 177
 178         status = torture_ldap_bind_sasl(l->conn, credentials);
 179         if (!NT_STATUS_IS_OK(status)) {
 180                 printf("failed to bind to LDAP:\n");
 181                 return False;
 182         }
 183         printf("bound to LDAP.\n");
 184
 185         return ret;
 186 }
 187
 188 static BOOL test_GetInfo(struct DsSyncTest *ctx)
 189 {
 190         NTSTATUS status;
 191         struct drsuapi_DsCrackNames r;
 192         struct drsuapi_DsNameString names[1];
 193         BOOL ret = True;
 194
 195         struct cldap_socket *cldap = cldap_socket_init(ctx, NULL);
 196         struct cldap_netlogon search;
 197
 198         r.in.bind_handle                = &ctx->admin.drsuapi.bind_handle;
 199         r.in.level                      = 1;
 200         r.in.req.req1.unknown1          = 0x000004e4;
 201         r.in.req.req1.unknown2          = 0x00000407;
 202         r.in.req.req1.count             = 1;
 203         r.in.req.req1.names             = names;
 204         r.in.req.req1.format_flags      = DRSUAPI_DS_NAME_FLAG_NO_FLAGS;
 205         r.in.req.req1.format_offered    = DRSUAPI_DS_NAME_FORMAT_NT4_ACCOUNT;
 206         r.in.req.req1.format_desired    = DRSUAPI_DS_NAME_FORMAT_FQDN_1779;
 207         names[0].str = talloc_asprintf(ctx, "%s\\", lp_workgroup());
 208
 209         status = dcerpc_drsuapi_DsCrackNames(ctx->admin.drsuapi.pipe, ctx, &r);
 210         if (!NT_STATUS_IS_OK(status)) {
 211                 const char *errstr = nt_errstr(status);
 212                 if (NT_STATUS_EQUAL(status, NT_STATUS_NET_WRITE_FAULT)) {
 213                         errstr = dcerpc_errstr(ctx, ctx->admin.drsuapi.pipe->last_fault_code);
 214                 }
 215                 printf("dcerpc_drsuapi_DsCrackNames failed - %s\n", errstr);
 216                 return False;
 217         } else if (!W_ERROR_IS_OK(r.out.result)) {
 218                 printf("DsCrackNames failed - %s\n", win_errstr(r.out.result));
 219                 return False;
 220         }
 221
 222         ctx->domain_dn = r.out.ctr.ctr1->array[0].result_name;
 223
 224         ZERO_STRUCT(search);
 225         search.in.dest_address = ctx->drsuapi_binding->host;
 226         search.in.acct_control = -1;
 227         search.in.version = 6;
 228         status = cldap_netlogon(cldap, ctx, &search);
 229         if (!NT_STATUS_IS_OK(status)) {
 230                 const char *errstr = nt_errstr(status);
 231                 ctx->site_name = talloc_asprintf(ctx, "%s", "Default-First-Site-Name");
 232                 printf("cldap_netlogon() returned %s. Defaulting to Site-Name: %s\n", errstr, ctx->site_name);
 233         } else {
 234                 ctx->site_name = talloc_steal(ctx, search.out.netlogon.logon5.site_name);
 235                 printf("cldap_netlogon() returned Site-Name: %s.\n",ctx->site_name);
 236         }
 237
 238
 239         ctx->new_dc.invocation_id = GUID_random();
 240
 241         return ret;
 242 }
 243
 244
 245 static BOOL test_FetchData(struct DsSyncTest *ctx)
 246 {
 247         NTSTATUS status;
 248         BOOL ret = True;
 249         int i, y = 0;
 250         uint64_t highest_usn = 0;
 251         const char *partition = NULL;
 252         struct drsuapi_DsGetNCChanges r;
 253         struct drsuapi_DsReplicaObjectIdentifier nc;
 254         struct GUID null_guid;
 255         struct dom_sid null_sid;
 256         struct {
 257                 int32_t level;
 258         } array[] = {
 259 /*              {
 260                         5
 261                 },
 262 */              {
 263                         8
 264                 }
 265         };
 266
 267         ZERO_STRUCT(null_guid);
 268         ZERO_STRUCT(null_sid);
 269
 270         partition = lp_parm_string(-1, "dssync", "partition");
 271         if (partition == NULL) {
 272                 partition = ctx->domain_dn;
 273                 printf("dssync:partition not specified, defaulting to %s.\n", ctx->domain_dn);
 274         }
 275
 276         highest_usn = lp_parm_int(-1, "dssync", "highest_usn", 0);
 277
 278         for (i=0; i < ARRAY_SIZE(array); i++) {
 279                 printf("testing DsGetNCChanges level %d\n",
 280                         array[i].level);
 281
 282                 r.in.bind_handle        = &ctx->new_dc.drsuapi.bind_handle;
 283                 r.in.level              = array[i].level;
 284
 285                 switch (r.in.level) {
 286                 case 5:
 287                         nc.guid = null_guid;
 288                         nc.sid  = null_sid;
 289                         nc.dn   = partition;
 290
 291                         r.in.req.req5.destination_dsa_guid              = ctx->new_dc.invocation_id;
 292                         r.in.req.req5.source_dsa_guid                   = null_guid;
 293                         r.in.req.req5.naming_context                    = &nc;
 294                         r.in.req.req5.highwatermark.tmp_highest_usn     = highest_usn;
 295                         r.in.req.req5.highwatermark.reserved_usn        = 0;
 296                         r.in.req.req5.highwatermark.highest_usn         = highest_usn;
 297                         r.in.req.req5.uptodateness_vector               = NULL;
 298                         r.in.req.req5.replica_flags                     = 0;
 299                         if (lp_parm_bool(-1,"dssync","compression",False)) {
 300                                 r.in.req.req5.replica_flags             |= DRSUAPI_DS_REPLICA_NEIGHBOUR_COMPRESS_CHANGES;
 301                         }
 302                         if (lp_parm_bool(-1,"dssync","neighbour_writeable",True)) {
 303                                 r.in.req.req5.replica_flags             |= DRSUAPI_DS_REPLICA_NEIGHBOUR_WRITEABLE;
 304                         }
 305                         r.in.req.req5.replica_flags                     |= DRSUAPI_DS_REPLICA_NEIGHBOUR_SYNC_ON_STARTUP
 306                                                                         | DRSUAPI_DS_REPLICA_NEIGHBOUR_DO_SCHEDULED_SYNCS
 307                                                                         | DRSUAPI_DS_REPLICA_NEIGHBOUR_RETURN_OBJECT_PARENTS
 308                                                                         | DRSUAPI_DS_REPLICA_NEIGHBOUR_NEVER_SYNCED
 309                                                                         ;
 310                         r.in.req.req5.unknown2                          = 133;
 311                         r.in.req.req5.unknown3                          = 1336770;
 312                         r.in.req.req5.unknown4                          = 0;
 313                         r.in.req.req5.h1                                = 0;
 314
 315                         break;
 316                 case 8:
 317                         nc.guid = null_guid;
 318                         nc.sid  = null_sid;
 319                         nc.dn   = partition;
 320                         /* nc.dn can be set to any other ad partition */
 321
 322                         r.in.req.req8.destination_dsa_guid              = ctx->new_dc.invocation_id;
 323                         r.in.req.req8.source_dsa_guid                   = null_guid;
 324                         r.in.req.req8.naming_context                    = &nc;
 325                         r.in.req.req8.highwatermark.tmp_highest_usn     = highest_usn;
 326                         r.in.req.req8.highwatermark.reserved_usn        = 0;
 327                         r.in.req.req8.highwatermark.highest_usn         = highest_usn;
 328                         r.in.req.req8.uptodateness_vector               = NULL;
 329                         r.in.req.req8.replica_flags                     = 0;
 330                         if (lp_parm_bool(-1,"dssync","compression",False)) {
 331                                 r.in.req.req8.replica_flags             |= DRSUAPI_DS_REPLICA_NEIGHBOUR_COMPRESS_CHANGES;
 332                         }
 333                         if (lp_parm_bool(-1,"dssync","neighbour_writeable",True)) {
 334                                 r.in.req.req8.replica_flags             |= DRSUAPI_DS_REPLICA_NEIGHBOUR_WRITEABLE;
 335                         }
 336                         r.in.req.req8.replica_flags                     |= DRSUAPI_DS_REPLICA_NEIGHBOUR_SYNC_ON_STARTUP
 337                                                                         | DRSUAPI_DS_REPLICA_NEIGHBOUR_DO_SCHEDULED_SYNCS
 338                                                                         | DRSUAPI_DS_REPLICA_NEIGHBOUR_RETURN_OBJECT_PARENTS
 339                                                                         | DRSUAPI_DS_REPLICA_NEIGHBOUR_NEVER_SYNCED
 340                                                                         ;
 341                         r.in.req.req8.unknown2                          = 402;
 342                         r.in.req.req8.unknown3                          = 402116;
 343
 344                         r.in.req.req8.unknown4                          = 0;
 345                         r.in.req.req8.h1                                = 0;
 346                         r.in.req.req8.unique_ptr1                       = 0;
 347                         r.in.req.req8.unique_ptr2                       = 0;
 348                         r.in.req.req8.ctr12.count                       = 0;
 349                         r.in.req.req8.ctr12.array                       = NULL;
 350
 351                         break;
 352                 }
 353
 354                 printf("Dumping AD partition: %s\n", nc.dn);
 355                 for (y=0; ;y++) {
 356                         ZERO_STRUCT(r.out);
 357
 358                         if (r.in.level == 8) {
 359                                 DEBUG(0,("start[%d] tmp_higest_usn: %llu , highest_usn: %llu\n",y,
 360                                         r.in.req.req8.highwatermark.tmp_highest_usn,
 361                                         r.in.req.req8.highwatermark.highest_usn));
 362                         }
 363
 364                         status = dcerpc_drsuapi_DsGetNCChanges(ctx->new_dc.drsuapi.pipe, ctx, &r);
 365                         if (!NT_STATUS_IS_OK(status)) {
 366                                 const char *errstr = nt_errstr(status);
 367                                 if (NT_STATUS_EQUAL(status, NT_STATUS_NET_WRITE_FAULT)) {
 368                                         errstr = dcerpc_errstr(ctx, ctx->new_dc.drsuapi.pipe->last_fault_code);
 369                                 }
 370                                 printf("dcerpc_drsuapi_DsGetNCChanges failed - %s\n", errstr);
 371                                 ret = False;
 372                         } else if (!W_ERROR_IS_OK(r.out.result)) {
 373                                 printf("DsGetNCChanges failed - %s\n", win_errstr(r.out.result));
 374                                 ret = False;
 375                         }
 376
 377                         if (ret == True && r.out.level == 6) {
 378                                 DEBUG(0,("end[%d] tmp_highest_usn: %llu , highest_usn: %llu\n",y,
 379                                         r.out.ctr.ctr6.new_highwatermark.tmp_highest_usn,
 380                                         r.out.ctr.ctr6.new_highwatermark.highest_usn));
 381
 382                                 if (r.out.ctr.ctr6.new_highwatermark.tmp_highest_usn > r.out.ctr.ctr6.new_highwatermark.highest_usn) {
 383                                         r.in.req.req8.highwatermark = r.out.ctr.ctr6.new_highwatermark;
 384                                         continue;
 385                                 }
 386                         }
 387                         break;
 388                 }
 389         }
 390
 391         return ret;
 392 }
 393
 394 BOOL torture_rpc_dssync(void)
 395 {
 396         BOOL ret = True;
 397         TALLOC_CTX *mem_ctx;
 398         struct DsSyncTest *ctx;
 399
 400         mem_ctx = talloc_init("torture_rpc_dssync");
 401         ctx = test_create_context(mem_ctx);
 402
 403         ret &= _test_DsBind(ctx, ctx->admin.credentials, &ctx->admin.drsuapi);
 404         ret &= test_LDAPBind(ctx, ctx->admin.credentials, &ctx->admin.ldap);
 405         ret &= test_GetInfo(ctx);
 406         ret &= _test_DsBind(ctx, ctx->admin.credentials, &ctx->new_dc.drsuapi);
 407         ret &= test_FetchData(ctx);
 408
 409         return ret;
 410 }