source4/torture/rpc/dssync.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3
   4    DsGetNCChanges replication test
   5
   6    Copyright (C) Stefan (metze) Metzmacher 2005
   7    Copyright (C) Brad Henry 2005
   8
   9    This program is free software; you can redistribute it and/or modify
  10    it under the terms of the GNU General Public License as published by
  11    the Free Software Foundation; either version 2 of the License, or
  12    (at your option) any later version.
  13
  14    This program is distributed in the hope that it will be useful,
  15    but WITHOUT ANY WARRANTY; without even the implied warranty of
  16    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  17    GNU General Public License for more details.
  18
  19    You should have received a copy of the GNU General Public License
  20    along with this program; if not, write to the Free Software
  21    Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  22 */
  23
  24 #include "includes.h"
  25 #include "lib/cmdline/popt_common.h"
  26 #include "libnet/libnet.h"
  27 #include "librpc/gen_ndr/ndr_drsuapi.h"
  28 #include "librpc/gen_ndr/ndr_samr.h"
  29 #include "libcli/ldap/ldap.h"
  30 #include "libcli/cldap/cldap.h"
  31 #include "ads.h"
  32
  33 struct DsSyncBindInfo {
  34         struct dcerpc_pipe *pipe;
  35         struct drsuapi_DsBind req;
  36         struct GUID bind_guid;
  37         struct drsuapi_DsBindInfoCtr our_bind_info;
  38         struct policy_handle bind_handle;
  39 };
  40
  41 struct DsSyncLDAPInfo {
  42         struct ldap_connection *conn;
  43 };
  44
  45 struct DsSyncTest {
  46         struct dcerpc_binding *drsuapi_binding;
  47
  48         const char *ldap_url;
  49         const char *site_name;
  50
  51         const char *domain_dn;
  52
  53         /* what we need to do as 'Administrator' */
  54         struct {
  55                 struct cli_credentials *credentials;
  56                 struct DsSyncBindInfo drsuapi;
  57                 struct DsSyncLDAPInfo ldap;
  58         } admin;
  59
  60         /* what we need to do as the new dc machine account */
  61         struct {
  62                 struct cli_credentials *credentials;
  63                 struct DsSyncBindInfo drsuapi;
  64                 struct drsuapi_DsGetDCInfo2 dc_info2;
  65                 struct GUID invocation_id;
  66                 struct GUID object_guid;
  67         } new_dc;
  68
  69         /* info about the old dc */
  70         struct {
  71                 struct drsuapi_DsGetDomainControllerInfo dc_info;
  72         } old_dc;
  73 };
  74
  75 static struct DsSyncTest *test_create_context(TALLOC_CTX *mem_ctx)
  76 {
  77         NTSTATUS status;
  78         struct DsSyncTest *ctx;
  79         struct drsuapi_DsBindInfoCtr *our_bind_info;
  80         const char *binding = lp_parm_string(-1, "torture", "binding");
  81         ctx = talloc_zero(mem_ctx, struct DsSyncTest);
  82         if (!ctx) return NULL;
  83
  84         status = dcerpc_parse_binding(ctx, binding, &ctx->drsuapi_binding);
  85         if (!NT_STATUS_IS_OK(status)) {
  86                 printf("Bad binding string %s\n", binding);
  87                 return NULL;
  88         }
  89         ctx->drsuapi_binding->flags |= DCERPC_SIGN | DCERPC_SEAL;
  90
  91         ctx->ldap_url = talloc_asprintf(ctx, "ldap://%s/", ctx->drsuapi_binding->host);
  92
  93         /* ctx->admin ...*/
  94         ctx->admin.credentials                          = cmdline_credentials;
  95
  96         our_bind_info                                   = &ctx->admin.drsuapi.our_bind_info;
  97         our_bind_info->length                           = 28;
  98         our_bind_info->info.info28.supported_extensions = 0xFFFFFFFF;
  99         our_bind_info->info.info28.supported_extensions |= DRSUAPI_SUPPORTED_EXTENSION_ADDENTRYREPLY_V3;
 100         our_bind_info->info.info28.site_guid            = GUID_zero();
 101         our_bind_info->info.info28.u1                   = 0;
 102         our_bind_info->info.info28.repl_epoch           = 1;
 103
 104         GUID_from_string(DRSUAPI_DS_BIND_GUID, &ctx->admin.drsuapi.bind_guid);
 105
 106         ctx->admin.drsuapi.req.in.bind_guid             = &ctx->admin.drsuapi.bind_guid;
 107         ctx->admin.drsuapi.req.in.bind_info             = our_bind_info;
 108         ctx->admin.drsuapi.req.out.bind_handle          = &ctx->admin.drsuapi.bind_handle;
 109
 110         /* ctx->new_dc ...*/
 111
 112         our_bind_info                                   = &ctx->new_dc.drsuapi.our_bind_info;
 113         our_bind_info->length                           = 28;
 114         our_bind_info->info.info28.supported_extensions |= DRSUAPI_SUPPORTED_EXTENSION_BASE;
 115         our_bind_info->info.info28.supported_extensions |= DRSUAPI_SUPPORTED_EXTENSION_ASYNC_REPLICATION;
 116         our_bind_info->info.info28.supported_extensions |= DRSUAPI_SUPPORTED_EXTENSION_REMOVEAPI;
 117         our_bind_info->info.info28.supported_extensions |= DRSUAPI_SUPPORTED_EXTENSION_MOVEREQ_V2;
 118         our_bind_info->info.info28.supported_extensions |= DRSUAPI_SUPPORTED_EXTENSION_GETCHG_COMPRESS;
 119         our_bind_info->info.info28.supported_extensions |= DRSUAPI_SUPPORTED_EXTENSION_DCINFO_V1;
 120         our_bind_info->info.info28.supported_extensions |= DRSUAPI_SUPPORTED_EXTENSION_RESTORE_USN_OPTIMIZATION;
 121         our_bind_info->info.info28.supported_extensions |= DRSUAPI_SUPPORTED_EXTENSION_KCC_EXECUTE;
 122         our_bind_info->info.info28.supported_extensions |= DRSUAPI_SUPPORTED_EXTENSION_ADDENTRY_V2;
 123         our_bind_info->info.info28.supported_extensions |= DRSUAPI_SUPPORTED_EXTENSION_LINKED_VALUE_REPLICATION;
 124         our_bind_info->info.info28.supported_extensions |= DRSUAPI_SUPPORTED_EXTENSION_DCINFO_V2;
 125         our_bind_info->info.info28.supported_extensions |= DRSUAPI_SUPPORTED_EXTENSION_INSTANCE_TYPE_NOT_REQ_ON_MOD;
 126         our_bind_info->info.info28.supported_extensions |= DRSUAPI_SUPPORTED_EXTENSION_CRYPTO_BIND;
 127         our_bind_info->info.info28.supported_extensions |= DRSUAPI_SUPPORTED_EXTENSION_GET_REPL_INFO;
 128         our_bind_info->info.info28.supported_extensions |= DRSUAPI_SUPPORTED_EXTENSION_STRONG_ENCRYPTION;
 129         our_bind_info->info.info28.supported_extensions |= DRSUAPI_SUPPORTED_EXTENSION_DCINFO_V01;
 130         our_bind_info->info.info28.supported_extensions |= DRSUAPI_SUPPORTED_EXTENSION_TRANSITIVE_MEMBERSHIP;
 131         our_bind_info->info.info28.supported_extensions |= DRSUAPI_SUPPORTED_EXTENSION_ADD_SID_HISTORY;
 132         our_bind_info->info.info28.supported_extensions |= DRSUAPI_SUPPORTED_EXTENSION_POST_BETA3;
 133         our_bind_info->info.info28.supported_extensions |= DRSUAPI_SUPPORTED_EXTENSION_GET_MEMBERSHIPS2;
 134         our_bind_info->info.info28.supported_extensions |= DRSUAPI_SUPPORTED_EXTENSION_GETCHGREQ_V6;
 135         our_bind_info->info.info28.supported_extensions |= DRSUAPI_SUPPORTED_EXTENSION_NONDOMAIN_NCS;
 136         our_bind_info->info.info28.supported_extensions |= DRSUAPI_SUPPORTED_EXTENSION_GETCHGREQ_V8;
 137         our_bind_info->info.info28.supported_extensions |= DRSUAPI_SUPPORTED_EXTENSION_GETCHGREPLY_V5;
 138         our_bind_info->info.info28.supported_extensions |= DRSUAPI_SUPPORTED_EXTENSION_GETCHGREPLY_V6;
 139         our_bind_info->info.info28.supported_extensions |= DRSUAPI_SUPPORTED_EXTENSION_ADDENTRYREPLY_V3;
 140         our_bind_info->info.info28.supported_extensions |= DRSUAPI_SUPPORTED_EXTENSION_GETCHGREPLY_V7;
 141         our_bind_info->info.info28.supported_extensions |= DRSUAPI_SUPPORTED_EXTENSION_VERIFY_OBJECT;
 142         if (lp_parm_bool(-1,"dssync","xpress",False)) {
 143                 our_bind_info->info.info28.supported_extensions |= DRSUAPI_SUPPORTED_EXTENSION_XPRESS_COMPRESS;
 144         }
 145         our_bind_info->info.info28.site_guid            = GUID_zero();
 146         our_bind_info->info.info28.u1                   = 508;
 147         our_bind_info->info.info28.repl_epoch           = 0;
 148
 149         GUID_from_string(DRSUAPI_DS_BIND_GUID_W2K3, &ctx->new_dc.drsuapi.bind_guid);
 150
 151         ctx->new_dc.drsuapi.req.in.bind_guid            = &ctx->new_dc.drsuapi.bind_guid;
 152         ctx->new_dc.drsuapi.req.in.bind_info            = our_bind_info;
 153         ctx->new_dc.drsuapi.req.out.bind_handle         = &ctx->new_dc.drsuapi.bind_handle;
 154
 155         /* ctx->old_dc ...*/
 156
 157         return ctx;
 158 }
 159
 160 static BOOL _test_DsBind(struct DsSyncTest *ctx, struct cli_credentials *credentials, struct DsSyncBindInfo *b)
 161 {
 162         NTSTATUS status;
 163         BOOL ret = True;
 164         struct event_context *event = NULL;
 165
 166         status = dcerpc_pipe_connect_b(ctx,
 167                                        &b->pipe, ctx->drsuapi_binding,
 168                                        DCERPC_DRSUAPI_UUID,
 169                                        DCERPC_DRSUAPI_VERSION,
 170                                        credentials, event);
 171
 172         if (!NT_STATUS_IS_OK(status)) {
 173                 printf("Failed to connect to server as a BDC: %s\n", nt_errstr(status));
 174                 return False;
 175         }
 176
 177         status = dcerpc_drsuapi_DsBind(b->pipe, ctx, &b->req);
 178         if (!NT_STATUS_IS_OK(status)) {
 179                 const char *errstr = nt_errstr(status);
 180                 if (NT_STATUS_EQUAL(status, NT_STATUS_NET_WRITE_FAULT)) {
 181                         errstr = dcerpc_errstr(ctx, b->pipe->last_fault_code);
 182                 }
 183                 printf("dcerpc_drsuapi_DsBind failed - %s\n", errstr);
 184                 ret = False;
 185         } else if (!W_ERROR_IS_OK(b->req.out.result)) {
 186                 printf("DsBind failed - %s\n", win_errstr(b->req.out.result));
 187                 ret = False;
 188         }
 189
 190         return ret;
 191 }
 192
 193 static BOOL test_LDAPBind(struct DsSyncTest *ctx, struct cli_credentials *credentials, struct DsSyncLDAPInfo *l)
 194 {
 195         NTSTATUS status;
 196         BOOL ret = True;
 197
 198         status = torture_ldap_connection(ctx, &l->conn, ctx->ldap_url);
 199         if (!NT_STATUS_IS_OK(status)) {
 200                 printf("failed to connect to LDAP: %s\n", ctx->ldap_url);
 201                 return False;
 202         }
 203
 204         printf("connected to LDAP: %s\n", ctx->ldap_url);
 205
 206         status = torture_ldap_bind_sasl(l->conn, credentials);
 207         if (!NT_STATUS_IS_OK(status)) {
 208                 printf("failed to bind to LDAP:\n");
 209                 return False;
 210         }
 211         printf("bound to LDAP.\n");
 212
 213         return ret;
 214 }
 215
 216 static BOOL test_GetInfo(struct DsSyncTest *ctx)
 217 {
 218         NTSTATUS status;
 219         struct drsuapi_DsCrackNames r;
 220         struct drsuapi_DsNameString names[1];
 221         BOOL ret = True;
 222
 223         struct cldap_socket *cldap = cldap_socket_init(ctx, NULL);
 224         struct cldap_netlogon search;
 225
 226         r.in.bind_handle                = &ctx->admin.drsuapi.bind_handle;
 227         r.in.level                      = 1;
 228         r.in.req.req1.unknown1          = 0x000004e4;
 229         r.in.req.req1.unknown2          = 0x00000407;
 230         r.in.req.req1.count             = 1;
 231         r.in.req.req1.names             = names;
 232         r.in.req.req1.format_flags      = DRSUAPI_DS_NAME_FLAG_NO_FLAGS;
 233         r.in.req.req1.format_offered    = DRSUAPI_DS_NAME_FORMAT_NT4_ACCOUNT;
 234         r.in.req.req1.format_desired    = DRSUAPI_DS_NAME_FORMAT_FQDN_1779;
 235         names[0].str = talloc_asprintf(ctx, "%s\\", lp_workgroup());
 236
 237         status = dcerpc_drsuapi_DsCrackNames(ctx->admin.drsuapi.pipe, ctx, &r);
 238         if (!NT_STATUS_IS_OK(status)) {
 239                 const char *errstr = nt_errstr(status);
 240                 if (NT_STATUS_EQUAL(status, NT_STATUS_NET_WRITE_FAULT)) {
 241                         errstr = dcerpc_errstr(ctx, ctx->admin.drsuapi.pipe->last_fault_code);
 242                 }
 243                 printf("dcerpc_drsuapi_DsCrackNames failed - %s\n", errstr);
 244                 return False;
 245         } else if (!W_ERROR_IS_OK(r.out.result)) {
 246                 printf("DsCrackNames failed - %s\n", win_errstr(r.out.result));
 247                 return False;
 248         }
 249
 250         ctx->domain_dn = r.out.ctr.ctr1->array[0].result_name;
 251
 252         ZERO_STRUCT(search);
 253         search.in.dest_address = ctx->drsuapi_binding->host;
 254         search.in.acct_control = -1;
 255         search.in.version = 6;
 256         status = cldap_netlogon(cldap, ctx, &search);
 257         if (!NT_STATUS_IS_OK(status)) {
 258                 const char *errstr = nt_errstr(status);
 259                 ctx->site_name = talloc_asprintf(ctx, "%s", "Default-First-Site-Name");
 260                 printf("cldap_netlogon() returned %s. Defaulting to Site-Name: %s\n", errstr, ctx->site_name);
 261         } else {
 262                 ctx->site_name = talloc_steal(ctx, search.out.netlogon.logon5.site_name);
 263                 printf("cldap_netlogon() returned Site-Name: %s.\n",ctx->site_name);
 264         }
 265
 266
 267         ctx->new_dc.invocation_id = GUID_random();
 268
 269         return ret;
 270 }
 271
 272
 273 static BOOL test_FetchData(struct DsSyncTest *ctx)
 274 {
 275         NTSTATUS status;
 276         BOOL ret = True;
 277         int i, y = 0;
 278         uint64_t highest_usn = 0;
 279         const char *partition = NULL;
 280         struct drsuapi_DsGetNCChanges r;
 281         struct drsuapi_DsReplicaObjectIdentifier nc;
 282         struct GUID null_guid;
 283         struct dom_sid null_sid;
 284         struct {
 285                 int32_t level;
 286         } array[] = {
 287 /*              {
 288                         5
 289                 },
 290 */              {
 291                         8
 292                 }
 293         };
 294
 295         ZERO_STRUCT(null_guid);
 296         ZERO_STRUCT(null_sid);
 297
 298         partition = lp_parm_string(-1, "dssync", "partition");
 299         if (partition == NULL) {
 300                 partition = ctx->domain_dn;
 301                 printf("dssync:partition not specified, defaulting to %s.\n", ctx->domain_dn);
 302         }
 303
 304         highest_usn = lp_parm_int(-1, "dssync", "highest_usn", 0);
 305
 306         for (i=0; i < ARRAY_SIZE(array); i++) {
 307                 printf("testing DsGetNCChanges level %d\n",
 308                         array[i].level);
 309
 310                 r.in.bind_handle        = &ctx->new_dc.drsuapi.bind_handle;
 311                 r.in.level              = array[i].level;
 312
 313                 switch (r.in.level) {
 314                 case 5:
 315                         nc.guid = null_guid;
 316                         nc.sid  = null_sid;
 317                         nc.dn   = partition;
 318
 319                         r.in.req.req5.destination_dsa_guid              = ctx->new_dc.invocation_id;
 320                         r.in.req.req5.source_dsa_guid                   = null_guid;
 321                         r.in.req.req5.naming_context                    = &nc;
 322                         r.in.req.req5.highwatermark.tmp_highest_usn     = highest_usn;
 323                         r.in.req.req5.highwatermark.reserved_usn        = 0;
 324                         r.in.req.req5.highwatermark.highest_usn         = highest_usn;
 325                         r.in.req.req5.uptodateness_vector               = NULL;
 326                         r.in.req.req5.replica_flags                     = 0;
 327                         if (lp_parm_bool(-1,"dssync","compression",False)) {
 328                                 r.in.req.req5.replica_flags             |= DRSUAPI_DS_REPLICA_NEIGHBOUR_COMPRESS_CHANGES;
 329                         }
 330                         if (lp_parm_bool(-1,"dssync","neighbour_writeable",True)) {
 331                                 r.in.req.req5.replica_flags             |= DRSUAPI_DS_REPLICA_NEIGHBOUR_WRITEABLE;
 332                         }
 333                         r.in.req.req5.replica_flags                     |= DRSUAPI_DS_REPLICA_NEIGHBOUR_SYNC_ON_STARTUP
 334                                                                         | DRSUAPI_DS_REPLICA_NEIGHBOUR_DO_SCHEDULED_SYNCS
 335                                                                         | DRSUAPI_DS_REPLICA_NEIGHBOUR_RETURN_OBJECT_PARENTS
 336                                                                         | DRSUAPI_DS_REPLICA_NEIGHBOUR_NEVER_SYNCED
 337                                                                         ;
 338                         r.in.req.req5.unknown2                          = 133;
 339                         r.in.req.req5.unknown3                          = 1336770;
 340                         r.in.req.req5.unknown4                          = 0;
 341                         r.in.req.req5.h1                                = 0;
 342
 343                         break;
 344                 case 8:
 345                         nc.guid = null_guid;
 346                         nc.sid  = null_sid;
 347                         nc.dn   = partition;
 348                         /* nc.dn can be set to any other ad partition */
 349
 350                         r.in.req.req8.destination_dsa_guid              = ctx->new_dc.invocation_id;
 351                         r.in.req.req8.source_dsa_guid                   = null_guid;
 352                         r.in.req.req8.naming_context                    = &nc;
 353                         r.in.req.req8.highwatermark.tmp_highest_usn     = highest_usn;
 354                         r.in.req.req8.highwatermark.reserved_usn        = 0;
 355                         r.in.req.req8.highwatermark.highest_usn         = highest_usn;
 356                         r.in.req.req8.uptodateness_vector               = NULL;
 357                         r.in.req.req8.replica_flags                     = 0;
 358                         if (lp_parm_bool(-1,"dssync","compression",False)) {
 359                                 r.in.req.req8.replica_flags             |= DRSUAPI_DS_REPLICA_NEIGHBOUR_COMPRESS_CHANGES;
 360                         }
 361                         if (lp_parm_bool(-1,"dssync","neighbour_writeable",True)) {
 362                                 r.in.req.req8.replica_flags             |= DRSUAPI_DS_REPLICA_NEIGHBOUR_WRITEABLE;
 363                         }
 364                         r.in.req.req8.replica_flags                     |= DRSUAPI_DS_REPLICA_NEIGHBOUR_SYNC_ON_STARTUP
 365                                                                         | DRSUAPI_DS_REPLICA_NEIGHBOUR_DO_SCHEDULED_SYNCS
 366                                                                         | DRSUAPI_DS_REPLICA_NEIGHBOUR_RETURN_OBJECT_PARENTS
 367                                                                         | DRSUAPI_DS_REPLICA_NEIGHBOUR_NEVER_SYNCED
 368                                                                         ;
 369                         r.in.req.req8.unknown2                          = 402;
 370                         r.in.req.req8.unknown3                          = 402116;
 371
 372                         r.in.req.req8.unknown4                          = 0;
 373                         r.in.req.req8.h1                                = 0;
 374                         r.in.req.req8.unique_ptr1                       = 0;
 375                         r.in.req.req8.unique_ptr2                       = 0;
 376                         r.in.req.req8.ctr12.count                       = 0;
 377                         r.in.req.req8.ctr12.array                       = NULL;
 378
 379                         break;
 380                 }
 381
 382                 printf("Dumping AD partition: %s\n", nc.dn);
 383                 for (y=0; ;y++) {
 384                         ZERO_STRUCT(r.out);
 385
 386                         if (r.in.level == 8) {
 387                                 DEBUG(0,("start[%d] tmp_higest_usn: %llu , highest_usn: %llu\n",y,
 388                                         r.in.req.req8.highwatermark.tmp_highest_usn,
 389                                         r.in.req.req8.highwatermark.highest_usn));
 390                         }
 391
 392                         status = dcerpc_drsuapi_DsGetNCChanges(ctx->new_dc.drsuapi.pipe, ctx, &r);
 393                         if (!NT_STATUS_IS_OK(status)) {
 394                                 const char *errstr = nt_errstr(status);
 395                                 if (NT_STATUS_EQUAL(status, NT_STATUS_NET_WRITE_FAULT)) {
 396                                         errstr = dcerpc_errstr(ctx, ctx->new_dc.drsuapi.pipe->last_fault_code);
 397                                 }
 398                                 printf("dcerpc_drsuapi_DsGetNCChanges failed - %s\n", errstr);
 399                                 ret = False;
 400                         } else if (!W_ERROR_IS_OK(r.out.result)) {
 401                                 printf("DsGetNCChanges failed - %s\n", win_errstr(r.out.result));
 402                                 ret = False;
 403                         }
 404
 405                         if (ret == True && r.out.level == 6) {
 406                                 DEBUG(0,("end[%d] tmp_highest_usn: %llu , highest_usn: %llu\n",y,
 407                                         r.out.ctr.ctr6.new_highwatermark.tmp_highest_usn,
 408                                         r.out.ctr.ctr6.new_highwatermark.highest_usn));
 409
 410                                 if (r.out.ctr.ctr6.new_highwatermark.tmp_highest_usn > r.out.ctr.ctr6.new_highwatermark.highest_usn) {
 411                                         r.in.req.req8.highwatermark = r.out.ctr.ctr6.new_highwatermark;
 412                                         continue;
 413                                 }
 414                         }
 415                         break;
 416                 }
 417         }
 418
 419         return ret;
 420 }
 421
 422 BOOL torture_rpc_dssync(void)
 423 {
 424         BOOL ret = True;
 425         TALLOC_CTX *mem_ctx;
 426         struct DsSyncTest *ctx;
 427
 428         mem_ctx = talloc_init("torture_rpc_dssync");
 429         ctx = test_create_context(mem_ctx);
 430
 431         ret &= _test_DsBind(ctx, ctx->admin.credentials, &ctx->admin.drsuapi);
 432         ret &= test_LDAPBind(ctx, ctx->admin.credentials, &ctx->admin.ldap);
 433         ret &= test_GetInfo(ctx);
 434         ret &= _test_DsBind(ctx, ctx->admin.credentials, &ctx->new_dc.drsuapi);
 435         ret &= test_FetchData(ctx);
 436
 437         return ret;
 438 }