r21242: prepare trying to decrypt the encrypted attributes
[nivanova/samba-autobuild/.git] / source4 / torture / rpc / dssync.c
1 /* 
2    Unix SMB/CIFS implementation.
3
4    DsGetNCChanges replication test
5
6    Copyright (C) Stefan (metze) Metzmacher 2005
7    Copyright (C) Brad Henry 2005
8    
9    This program is free software; you can redistribute it and/or modify
10    it under the terms of the GNU General Public License as published by
11    the Free Software Foundation; either version 2 of the License, or
12    (at your option) any later version.
13    
14    This program is distributed in the hope that it will be useful,
15    but WITHOUT ANY WARRANTY; without even the implied warranty of
16    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
17    GNU General Public License for more details.
18    
19    You should have received a copy of the GNU General Public License
20    along with this program; if not, write to the Free Software
21    Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
22 */
23
24 #include "includes.h"
25 #include "lib/cmdline/popt_common.h"
26 #include "librpc/gen_ndr/ndr_drsuapi_c.h"
27 #include "libcli/cldap/cldap.h"
28 #include "libcli/ldap/ldap_client.h"
29 #include "torture/torture.h"
30 #include "torture/ldap/proto.h"
31 #include "libcli/auth/libcli_auth.h"
32 #include "lib/crypto/crypto.h"
33 #include "auth/credentials/credentials.h"
34 #include "libcli/auth/libcli_auth.h"
35 #include "auth/gensec/gensec.h"
36
37 struct DsSyncBindInfo {
38         struct dcerpc_pipe *pipe;
39         struct drsuapi_DsBind req;
40         struct GUID bind_guid;
41         struct drsuapi_DsBindInfoCtr our_bind_info_ctr;
42         struct drsuapi_DsBindInfo28 our_bind_info28;
43         struct drsuapi_DsBindInfo28 peer_bind_info28;
44         struct policy_handle bind_handle;
45         DATA_BLOB dce_key;
46         DATA_BLOB gen_key;
47         struct samr_Password nthash;
48 };
49
50 struct DsSyncLDAPInfo {
51         struct ldap_connection *conn;
52 };
53
54 struct DsSyncTest {
55         struct dcerpc_binding *drsuapi_binding;
56         
57         const char *ldap_url;
58         const char *site_name;
59         
60         const char *domain_dn;
61
62         /* what we need to do as 'Administrator' */
63         struct {
64                 struct cli_credentials *credentials;
65                 struct DsSyncBindInfo drsuapi;
66                 struct DsSyncLDAPInfo ldap;
67         } admin;
68
69         /* what we need to do as the new dc machine account */
70         struct {
71                 struct cli_credentials *credentials;
72                 struct DsSyncBindInfo drsuapi;
73                 struct drsuapi_DsGetDCInfo2 dc_info2;
74                 struct GUID invocation_id;
75                 struct GUID object_guid;
76         } new_dc;
77
78         /* info about the old dc */
79         struct {
80                 struct drsuapi_DsGetDomainControllerInfo dc_info;
81         } old_dc;
82 };
83
84 static struct DsSyncTest *test_create_context(TALLOC_CTX *mem_ctx)
85 {
86         NTSTATUS status;
87         struct DsSyncTest *ctx;
88         struct drsuapi_DsBindInfo28 *our_bind_info28;
89         struct drsuapi_DsBindInfoCtr *our_bind_info_ctr;
90         const char *binding = lp_parm_string(-1, "torture", "binding");
91         ctx = talloc_zero(mem_ctx, struct DsSyncTest);
92         if (!ctx) return NULL;
93
94         status = dcerpc_parse_binding(ctx, binding, &ctx->drsuapi_binding);
95         if (!NT_STATUS_IS_OK(status)) {
96                 printf("Bad binding string %s\n", binding);
97                 return NULL;
98         }
99         ctx->drsuapi_binding->flags |= DCERPC_SIGN | DCERPC_SEAL;
100
101         ctx->ldap_url = talloc_asprintf(ctx, "ldap://%s/", ctx->drsuapi_binding->host);
102
103         /* ctx->admin ...*/
104         ctx->admin.credentials                          = cmdline_credentials;
105
106         our_bind_info28                         = &ctx->admin.drsuapi.our_bind_info28;
107         our_bind_info28->supported_extensions   = 0xFFFFFFFF;
108         our_bind_info28->supported_extensions   |= DRSUAPI_SUPPORTED_EXTENSION_ADDENTRYREPLY_V3;
109         our_bind_info28->site_guid              = GUID_zero();
110         our_bind_info28->u1                     = 0;
111         our_bind_info28->repl_epoch             = 1;
112
113         our_bind_info_ctr                       = &ctx->admin.drsuapi.our_bind_info_ctr;
114         our_bind_info_ctr->length               = 28;
115         our_bind_info_ctr->info.info28          = *our_bind_info28;
116
117         GUID_from_string(DRSUAPI_DS_BIND_GUID, &ctx->admin.drsuapi.bind_guid);
118
119         ctx->admin.drsuapi.req.in.bind_guid             = &ctx->admin.drsuapi.bind_guid;
120         ctx->admin.drsuapi.req.in.bind_info             = our_bind_info_ctr;
121         ctx->admin.drsuapi.req.out.bind_handle          = &ctx->admin.drsuapi.bind_handle;
122
123         /* ctx->new_dc ...*/
124         ctx->new_dc.credentials                 = cmdline_credentials;
125
126         our_bind_info28                         = &ctx->new_dc.drsuapi.our_bind_info28;
127         our_bind_info28->supported_extensions   |= DRSUAPI_SUPPORTED_EXTENSION_BASE;
128         our_bind_info28->supported_extensions   |= DRSUAPI_SUPPORTED_EXTENSION_ASYNC_REPLICATION;
129         our_bind_info28->supported_extensions   |= DRSUAPI_SUPPORTED_EXTENSION_REMOVEAPI;
130         our_bind_info28->supported_extensions   |= DRSUAPI_SUPPORTED_EXTENSION_MOVEREQ_V2;
131         our_bind_info28->supported_extensions   |= DRSUAPI_SUPPORTED_EXTENSION_GETCHG_COMPRESS;
132         our_bind_info28->supported_extensions   |= DRSUAPI_SUPPORTED_EXTENSION_DCINFO_V1;
133         our_bind_info28->supported_extensions   |= DRSUAPI_SUPPORTED_EXTENSION_RESTORE_USN_OPTIMIZATION;
134         our_bind_info28->supported_extensions   |= DRSUAPI_SUPPORTED_EXTENSION_KCC_EXECUTE;
135         our_bind_info28->supported_extensions   |= DRSUAPI_SUPPORTED_EXTENSION_ADDENTRY_V2;
136         our_bind_info28->supported_extensions   |= DRSUAPI_SUPPORTED_EXTENSION_LINKED_VALUE_REPLICATION;
137         our_bind_info28->supported_extensions   |= DRSUAPI_SUPPORTED_EXTENSION_DCINFO_V2;
138         our_bind_info28->supported_extensions   |= DRSUAPI_SUPPORTED_EXTENSION_INSTANCE_TYPE_NOT_REQ_ON_MOD;
139         our_bind_info28->supported_extensions   |= DRSUAPI_SUPPORTED_EXTENSION_CRYPTO_BIND;
140         our_bind_info28->supported_extensions   |= DRSUAPI_SUPPORTED_EXTENSION_GET_REPL_INFO;
141         our_bind_info28->supported_extensions   |= DRSUAPI_SUPPORTED_EXTENSION_STRONG_ENCRYPTION;
142         our_bind_info28->supported_extensions   |= DRSUAPI_SUPPORTED_EXTENSION_DCINFO_V01;
143         our_bind_info28->supported_extensions   |= DRSUAPI_SUPPORTED_EXTENSION_TRANSITIVE_MEMBERSHIP;
144         our_bind_info28->supported_extensions   |= DRSUAPI_SUPPORTED_EXTENSION_ADD_SID_HISTORY;
145         our_bind_info28->supported_extensions   |= DRSUAPI_SUPPORTED_EXTENSION_POST_BETA3;
146         our_bind_info28->supported_extensions   |= DRSUAPI_SUPPORTED_EXTENSION_GET_MEMBERSHIPS2;
147         our_bind_info28->supported_extensions   |= DRSUAPI_SUPPORTED_EXTENSION_GETCHGREQ_V6;
148         our_bind_info28->supported_extensions   |= DRSUAPI_SUPPORTED_EXTENSION_NONDOMAIN_NCS;
149         our_bind_info28->supported_extensions   |= DRSUAPI_SUPPORTED_EXTENSION_GETCHGREQ_V8;
150         our_bind_info28->supported_extensions   |= DRSUAPI_SUPPORTED_EXTENSION_GETCHGREPLY_V5;
151         our_bind_info28->supported_extensions   |= DRSUAPI_SUPPORTED_EXTENSION_GETCHGREPLY_V6;
152         our_bind_info28->supported_extensions   |= DRSUAPI_SUPPORTED_EXTENSION_ADDENTRYREPLY_V3;
153         our_bind_info28->supported_extensions   |= DRSUAPI_SUPPORTED_EXTENSION_GETCHGREPLY_V7;
154         our_bind_info28->supported_extensions   |= DRSUAPI_SUPPORTED_EXTENSION_VERIFY_OBJECT;
155         if (lp_parm_bool(-1,"dssync","xpress",False)) {
156                 our_bind_info28->supported_extensions   |= DRSUAPI_SUPPORTED_EXTENSION_XPRESS_COMPRESS;
157         }
158         our_bind_info28->site_guid              = GUID_zero();
159         our_bind_info28->u1                     = 508;
160         our_bind_info28->repl_epoch             = 0;
161
162         our_bind_info_ctr                       = &ctx->new_dc.drsuapi.our_bind_info_ctr;
163         our_bind_info_ctr->length               = 28;
164         our_bind_info_ctr->info.info28          = *our_bind_info28;
165
166         GUID_from_string(DRSUAPI_DS_BIND_GUID_W2K3, &ctx->new_dc.drsuapi.bind_guid);
167
168         ctx->new_dc.drsuapi.req.in.bind_guid            = &ctx->new_dc.drsuapi.bind_guid;
169         ctx->new_dc.drsuapi.req.in.bind_info            = our_bind_info_ctr;
170         ctx->new_dc.drsuapi.req.out.bind_handle         = &ctx->new_dc.drsuapi.bind_handle;
171
172         ctx->new_dc.invocation_id                       = ctx->new_dc.drsuapi.bind_guid;
173
174         /* ctx->old_dc ...*/
175
176         return ctx;
177 }
178
179 static BOOL _test_DsBind(struct DsSyncTest *ctx, struct cli_credentials *credentials, struct DsSyncBindInfo *b)
180 {
181         NTSTATUS status;
182         BOOL ret = True;
183         struct event_context *event = NULL;
184         const struct samr_Password *nthash;
185
186         status = dcerpc_pipe_connect_b(ctx,
187                                        &b->pipe, ctx->drsuapi_binding, 
188                                            &dcerpc_table_drsuapi,
189                                        credentials, event);
190         
191         if (!NT_STATUS_IS_OK(status)) {
192                 printf("Failed to connect to server as a BDC: %s\n", nt_errstr(status));
193                 return False;
194         }
195
196         status = dcerpc_drsuapi_DsBind(b->pipe, ctx, &b->req);
197         if (!NT_STATUS_IS_OK(status)) {
198                 const char *errstr = nt_errstr(status);
199                 if (NT_STATUS_EQUAL(status, NT_STATUS_NET_WRITE_FAULT)) {
200                         errstr = dcerpc_errstr(ctx, b->pipe->last_fault_code);
201                 }
202                 printf("dcerpc_drsuapi_DsBind failed - %s\n", errstr);
203                 ret = False;
204         } else if (!W_ERROR_IS_OK(b->req.out.result)) {
205                 printf("DsBind failed - %s\n", win_errstr(b->req.out.result));
206                 ret = False;
207         }
208
209         ZERO_STRUCT(b->peer_bind_info28);
210         if (b->req.out.bind_info) {
211                 switch (b->req.out.bind_info->length) {
212                 case 24: {
213                         struct drsuapi_DsBindInfo24 *info24;
214                         info24 = &b->req.out.bind_info->info.info24;
215                         b->peer_bind_info28.supported_extensions= info24->supported_extensions;
216                         b->peer_bind_info28.site_guid           = info24->site_guid;
217                         b->peer_bind_info28.u1                  = info24->u1;
218                         b->peer_bind_info28.repl_epoch          = 0;
219                         break;
220                 }
221                 case 28:
222                         b->peer_bind_info28 = b->req.out.bind_info->info.info28;
223                         break;
224                 }
225         }
226
227         dcerpc_fetch_session_key(b->pipe, &b->dce_key);
228         gensec_session_key(b->pipe->conn->security_state.generic_state, &b->gen_key);
229         nthash = cli_credentials_get_nt_hash(credentials, NULL);
230         if (nthash) b->nthash = *nthash;
231
232         if (lp_parm_bool(-1,"dssync","print_pwd_blobs",False)) {
233                 DEBUG(0,("DCERPC session key:\n"));
234                 dump_data(0, b->dce_key.data, b->dce_key.length);
235                 DEBUG(0,("GENSEC session key:\n"));
236                 dump_data(0, b->gen_key.data, b->gen_key.length);
237                 DEBUG(0,("CREDENTIALS nthash:\n"));
238                 dump_data(0, b->nthash.hash, sizeof(b->nthash.hash));
239         }
240
241         return ret;
242 }
243
244 static BOOL test_LDAPBind(struct DsSyncTest *ctx, struct cli_credentials *credentials, struct DsSyncLDAPInfo *l)
245 {
246         NTSTATUS status;
247         BOOL ret = True;
248
249         status = torture_ldap_connection(ctx, &l->conn, ctx->ldap_url);
250         if (!NT_STATUS_IS_OK(status)) {
251                 printf("failed to connect to LDAP: %s\n", ctx->ldap_url);
252                 return False;
253         }
254
255         printf("connected to LDAP: %s\n", ctx->ldap_url);
256
257         status = torture_ldap_bind_sasl(l->conn, credentials);
258         if (!NT_STATUS_IS_OK(status)) {
259                 printf("failed to bind to LDAP:\n");
260                 return False;
261         }
262         printf("bound to LDAP.\n");
263
264         return ret;
265 }
266
267 static BOOL test_GetInfo(struct DsSyncTest *ctx)
268 {
269         NTSTATUS status;
270         struct drsuapi_DsCrackNames r;
271         struct drsuapi_DsNameString names[1];
272         BOOL ret = True;
273
274         struct cldap_socket *cldap = cldap_socket_init(ctx, NULL);
275         struct cldap_netlogon search;
276         
277         r.in.bind_handle                = &ctx->admin.drsuapi.bind_handle;
278         r.in.level                      = 1;
279         r.in.req.req1.codepage          = 1252; /* western european */
280         r.in.req.req1.language          = 0x00000407; /* german */
281         r.in.req.req1.count             = 1;
282         r.in.req.req1.names             = names;
283         r.in.req.req1.format_flags      = DRSUAPI_DS_NAME_FLAG_NO_FLAGS;                
284         r.in.req.req1.format_offered    = DRSUAPI_DS_NAME_FORMAT_NT4_ACCOUNT;
285         r.in.req.req1.format_desired    = DRSUAPI_DS_NAME_FORMAT_FQDN_1779;
286         names[0].str = talloc_asprintf(ctx, "%s\\", lp_workgroup());
287
288         status = dcerpc_drsuapi_DsCrackNames(ctx->admin.drsuapi.pipe, ctx, &r);
289         if (!NT_STATUS_IS_OK(status)) {
290                 const char *errstr = nt_errstr(status);
291                 if (NT_STATUS_EQUAL(status, NT_STATUS_NET_WRITE_FAULT)) {
292                         errstr = dcerpc_errstr(ctx, ctx->admin.drsuapi.pipe->last_fault_code);
293                 }
294                 printf("dcerpc_drsuapi_DsCrackNames failed - %s\n", errstr);
295                 return False;
296         } else if (!W_ERROR_IS_OK(r.out.result)) {
297                 printf("DsCrackNames failed - %s\n", win_errstr(r.out.result));
298                 return False;
299         }
300
301         ctx->domain_dn = r.out.ctr.ctr1->array[0].result_name;
302         
303         ZERO_STRUCT(search);
304         search.in.dest_address = ctx->drsuapi_binding->host;
305         search.in.acct_control = -1;
306         search.in.version = 6;
307         status = cldap_netlogon(cldap, ctx, &search);
308         if (!NT_STATUS_IS_OK(status)) {
309                 const char *errstr = nt_errstr(status);
310                 ctx->site_name = talloc_asprintf(ctx, "%s", "Default-First-Site-Name");
311                 printf("cldap_netlogon() returned %s. Defaulting to Site-Name: %s\n", errstr, ctx->site_name);          
312         } else {
313                 ctx->site_name = talloc_steal(ctx, search.out.netlogon.logon5.client_site);
314                 printf("cldap_netlogon() returned Client Site-Name: %s.\n",ctx->site_name);
315                 printf("cldap_netlogon() returned Server Site-Name: %s.\n",search.out.netlogon.logon5.server_site);
316         }
317
318         return ret;
319 }
320
321 static DATA_BLOB decrypt_blob(TALLOC_CTX *mem_ctx,
322                               struct DsSyncBindInfo *b,
323                               struct drsuapi_DsReplicaObjectIdentifier *id,
324                               uint32_t rid,
325                               const DATA_BLOB *buffer)
326 {
327         return data_blob(NULL,0);
328 }
329
330 static void test_analyse_objects(struct DsSyncTest *ctx,
331                                  struct drsuapi_DsReplicaObjectListItemEx *cur)
332 {
333         if (!lp_parm_bool(-1,"dssync","print_pwd_blobs",False)) {
334                 return; 
335         }
336
337         for (; cur; cur = cur->next_object) {
338                 const char *dn;
339                 struct dom_sid *sid = NULL;
340                 uint32_t rid = 0;
341                 BOOL dn_printed = False;
342                 uint32_t i;
343
344                 if (!cur->object.identifier) continue;
345
346                 dn = cur->object.identifier->dn;
347                 if (cur->object.identifier->sid.num_auths > 0) {
348                         sid = &cur->object.identifier->sid;
349                         rid = sid->sub_auths[sid->num_auths - 1];
350                 }
351
352                 for (i=0; i < cur->object.attribute_ctr.num_attributes; i++) {
353                         const char *name = NULL;
354                         DATA_BLOB *enc_data = NULL;
355                         DATA_BLOB plain_data;
356                         struct drsuapi_DsReplicaAttribute *attr;
357                         attr = &cur->object.attribute_ctr.attributes[i];
358
359                         switch (attr->attid) {
360                         case DRSUAPI_ATTRIBUTE_dBCSPwd:
361                                 name    = "dBCSPwd";
362                                 break;
363                         case DRSUAPI_ATTRIBUTE_unicodePwd:
364                                 name    = "unicodePwd";
365                                 break;
366                         case DRSUAPI_ATTRIBUTE_ntPwdHistory:
367                                 name    = "ntPwdHistory";
368                                 break;
369                         case DRSUAPI_ATTRIBUTE_lmPwdHistory:
370                                 name    = "lmPwdHistory";
371                                 break;
372                         case DRSUAPI_ATTRIBUTE_supplementalCredentials:
373                                 name    = "supplementalCredentials";
374                                 break;
375                         case DRSUAPI_ATTRIBUTE_priorValue:
376                                 name    = "priorValue";
377                                 break;
378                         case DRSUAPI_ATTRIBUTE_currentValue:
379                                 name    = "currentValue";
380                                 break;
381                         case DRSUAPI_ATTRIBUTE_trustAuthOutgoing:
382                                 name    = "trustAuthOutgoing";
383                                 break;
384                         case DRSUAPI_ATTRIBUTE_trustAuthIncoming:
385                                 name    = "trustAuthIncoming";
386                                 break;
387                         case DRSUAPI_ATTRIBUTE_initialAuthOutgoing:
388                                 name    = "initialAuthOutgoing";
389                                 break;
390                         case DRSUAPI_ATTRIBUTE_initialAuthIncoming:
391                                 name    = "initialAuthIncoming";
392                                 break;
393                         default:
394                                 continue;
395                         }
396
397                         if (attr->value_ctr.num_values != 1) continue;
398
399                         if (!attr->value_ctr.values[0].blob) continue;
400
401                         enc_data = attr->value_ctr.values[0].blob;
402                         ZERO_STRUCT(plain_data);
403
404                         plain_data = decrypt_blob(ctx, &ctx->new_dc.drsuapi,
405                                                   cur->object.identifier, rid,
406                                                   enc_data);
407                         if (!dn_printed) {
408                                 DEBUG(0,("DN: %s\n", dn));
409                                 dn_printed = True;
410                         }
411                         DEBUGADD(0,("ATTR: %s enc.length=%lu plain.length=%lu\n",
412                                     name, (long)enc_data->length, (long)plain_data.length));
413                         dump_data(0, enc_data->data, enc_data->length);
414                         if (plain_data.length) {
415                                 dump_data(0, plain_data.data, plain_data.length);
416                         }
417                 }
418         }
419 }
420
421 static BOOL test_FetchData(struct DsSyncTest *ctx)
422 {
423         NTSTATUS status;
424         BOOL ret = True;
425         int i, y = 0;
426         uint64_t highest_usn = 0;
427         const char *partition = NULL;
428         struct drsuapi_DsGetNCChanges r;
429         struct drsuapi_DsReplicaObjectIdentifier nc;
430         struct drsuapi_DsGetNCChangesCtr1 *ctr1 = NULL;
431         struct drsuapi_DsGetNCChangesCtr6 *ctr6 = NULL;
432         int32_t out_level = 0;
433         struct GUID null_guid;
434         struct dom_sid null_sid;
435         struct {
436                 int32_t level;
437         } array[] = {
438 /*              {
439                         5
440                 },
441 */              {
442                         8
443                 }
444         };
445
446         ZERO_STRUCT(null_guid);
447         ZERO_STRUCT(null_sid);
448
449         partition = lp_parm_string(-1, "dssync", "partition");
450         if (partition == NULL) {
451                 partition = ctx->domain_dn;
452                 printf("dssync:partition not specified, defaulting to %s.\n", ctx->domain_dn);
453         }
454
455         highest_usn = lp_parm_int(-1, "dssync", "highest_usn", 0);
456
457         for (i=0; i < ARRAY_SIZE(array); i++) {
458                 printf("testing DsGetNCChanges level %d\n",
459                         array[i].level);
460
461                 r.in.bind_handle        = &ctx->new_dc.drsuapi.bind_handle;
462                 r.in.level              = &array[i].level;
463
464                 switch (*r.in.level) {
465                 case 5:
466                         nc.guid = null_guid;
467                         nc.sid  = null_sid;
468                         nc.dn   = partition; 
469
470                         r.in.req.req5.destination_dsa_guid              = ctx->new_dc.invocation_id;
471                         r.in.req.req5.source_dsa_invocation_id          = null_guid;
472                         r.in.req.req5.naming_context                    = &nc;
473                         r.in.req.req5.highwatermark.tmp_highest_usn     = highest_usn;
474                         r.in.req.req5.highwatermark.reserved_usn        = 0;
475                         r.in.req.req5.highwatermark.highest_usn         = highest_usn;
476                         r.in.req.req5.uptodateness_vector               = NULL;
477                         r.in.req.req5.replica_flags                     = 0;
478                         if (lp_parm_bool(-1,"dssync","compression",False)) {
479                                 r.in.req.req5.replica_flags             |= DRSUAPI_DS_REPLICA_NEIGHBOUR_COMPRESS_CHANGES;
480                         }
481                         if (lp_parm_bool(-1,"dssync","neighbour_writeable",True)) {
482                                 r.in.req.req5.replica_flags             |= DRSUAPI_DS_REPLICA_NEIGHBOUR_WRITEABLE;
483                         }
484                         r.in.req.req5.replica_flags                     |= DRSUAPI_DS_REPLICA_NEIGHBOUR_SYNC_ON_STARTUP
485                                                                         | DRSUAPI_DS_REPLICA_NEIGHBOUR_DO_SCHEDULED_SYNCS
486                                                                         | DRSUAPI_DS_REPLICA_NEIGHBOUR_RETURN_OBJECT_PARENTS
487                                                                         | DRSUAPI_DS_REPLICA_NEIGHBOUR_NEVER_SYNCED
488                                                                         ;
489                         r.in.req.req5.max_object_count                  = 133;
490                         r.in.req.req5.max_ndr_size                      = 1336770;
491                         r.in.req.req5.unknown4                          = 0;
492                         r.in.req.req5.h1                                = 0;
493
494                         break;
495                 case 8:
496                         nc.guid = null_guid;
497                         nc.sid  = null_sid;
498                         nc.dn   = partition; 
499                         /* nc.dn can be set to any other ad partition */
500                         
501                         r.in.req.req8.destination_dsa_guid              = ctx->new_dc.invocation_id;
502                         r.in.req.req8.source_dsa_invocation_id          = null_guid;
503                         r.in.req.req8.naming_context                    = &nc;
504                         r.in.req.req8.highwatermark.tmp_highest_usn     = highest_usn;
505                         r.in.req.req8.highwatermark.reserved_usn        = 0;
506                         r.in.req.req8.highwatermark.highest_usn         = highest_usn;
507                         r.in.req.req8.uptodateness_vector               = NULL;
508                         r.in.req.req8.replica_flags                     = 0;
509                         if (lp_parm_bool(-1,"dssync","compression",False)) {
510                                 r.in.req.req8.replica_flags             |= DRSUAPI_DS_REPLICA_NEIGHBOUR_COMPRESS_CHANGES;
511                         }
512                         if (lp_parm_bool(-1,"dssync","neighbour_writeable",True)) {
513                                 r.in.req.req8.replica_flags             |= DRSUAPI_DS_REPLICA_NEIGHBOUR_WRITEABLE;
514                         }
515                         r.in.req.req8.replica_flags                     |= DRSUAPI_DS_REPLICA_NEIGHBOUR_SYNC_ON_STARTUP
516                                                                         | DRSUAPI_DS_REPLICA_NEIGHBOUR_DO_SCHEDULED_SYNCS
517                                                                         | DRSUAPI_DS_REPLICA_NEIGHBOUR_RETURN_OBJECT_PARENTS
518                                                                         | DRSUAPI_DS_REPLICA_NEIGHBOUR_NEVER_SYNCED
519                                                                         ;
520                         r.in.req.req8.max_object_count                  = 402;
521                         r.in.req.req8.max_ndr_size                      = 402116;
522
523                         r.in.req.req8.unknown4                          = 0;
524                         r.in.req.req8.h1                                = 0;
525                         r.in.req.req8.unique_ptr1                       = 0;
526                         r.in.req.req8.unique_ptr2                       = 0;
527                         r.in.req.req8.mapping_ctr.num_mappings          = 0;
528                         r.in.req.req8.mapping_ctr.mappings              = NULL;
529
530                         break;
531                 }
532                 
533                 printf("Dumping AD partition: %s\n", nc.dn);
534                 for (y=0; ;y++) {
535                         int32_t _level = 0;
536                         ZERO_STRUCT(r.out);
537                         r.out.level = &_level;
538
539                         if (*r.in.level == 5) {
540                                 DEBUG(0,("start[%d] tmp_higest_usn: %llu , highest_usn: %llu\n",y,
541                                         (long long)r.in.req.req5.highwatermark.tmp_highest_usn,
542                                         (long long)r.in.req.req5.highwatermark.highest_usn));
543                         }
544
545                         if (*r.in.level == 8) {
546                                 DEBUG(0,("start[%d] tmp_higest_usn: %llu , highest_usn: %llu\n",y,
547                                         (long long)r.in.req.req8.highwatermark.tmp_highest_usn,
548                                         (long long)r.in.req.req8.highwatermark.highest_usn));
549                         }
550
551                         status = dcerpc_drsuapi_DsGetNCChanges(ctx->new_dc.drsuapi.pipe, ctx, &r);
552                         if (!NT_STATUS_IS_OK(status)) {
553                                 const char *errstr = nt_errstr(status);
554                                 if (NT_STATUS_EQUAL(status, NT_STATUS_NET_WRITE_FAULT)) {
555                                         errstr = dcerpc_errstr(ctx, ctx->new_dc.drsuapi.pipe->last_fault_code);
556                                 }
557                                 printf("dcerpc_drsuapi_DsGetNCChanges failed - %s\n", errstr);
558                                 ret = False;
559                         } else if (!W_ERROR_IS_OK(r.out.result)) {
560                                 printf("DsGetNCChanges failed - %s\n", win_errstr(r.out.result));
561                                 ret = False;
562                         }
563
564                         if (ret == True && *r.out.level == 1) {
565                                 out_level = 1;
566                                 ctr1 = &r.out.ctr.ctr1;
567                         } else if (ret == True && *r.out.level == 2) {
568                                 out_level = 1;
569                                 ctr1 = r.out.ctr.ctr2.ctr.mszip1.ctr1;
570                         }
571
572                         if (out_level == 1) {
573                                 DEBUG(0,("end[%d] tmp_highest_usn: %llu , highest_usn: %llu\n",y,
574                                         (long long)ctr1->new_highwatermark.tmp_highest_usn,
575                                         (long long)ctr1->new_highwatermark.highest_usn));
576
577                                 test_analyse_objects(ctx, ctr1->first_object);
578
579                                 if (ctr1->new_highwatermark.tmp_highest_usn > ctr1->new_highwatermark.highest_usn) {
580                                         r.in.req.req5.highwatermark = ctr1->new_highwatermark;
581                                         continue;
582                                 }
583                         }
584
585                         if (ret == True && *r.out.level == 6) {
586                                 out_level = 6;
587                                 ctr6 = &r.out.ctr.ctr6;
588                         } else if (ret == True && *r.out.level == 7
589                                    && r.out.ctr.ctr7.level == 6
590                                    && r.out.ctr.ctr7.type == DRSUAPI_COMPRESSION_TYPE_MSZIP) {
591                                 out_level = 6;
592                                 ctr6 = r.out.ctr.ctr7.ctr.mszip6.ctr6;
593                         }
594
595                         if (out_level == 6) {
596                                 DEBUG(0,("end[%d] tmp_highest_usn: %llu , highest_usn: %llu\n",y,
597                                         (long long)ctr6->new_highwatermark.tmp_highest_usn,
598                                         (long long)ctr6->new_highwatermark.highest_usn));
599
600                                 test_analyse_objects(ctx, ctr6->first_object);
601
602                                 if (ctr6->new_highwatermark.tmp_highest_usn > ctr6->new_highwatermark.highest_usn) {
603                                         r.in.req.req8.highwatermark = ctr6->new_highwatermark;
604                                         continue;
605                                 }
606                         }
607
608                         break;
609                 }
610         }
611
612         return ret;
613 }
614
615 static BOOL test_FetchNT4Data(struct DsSyncTest *ctx)
616 {
617         NTSTATUS status;
618         BOOL ret = True;
619         int i, y = 0;
620         uint64_t highest_usn = 0;
621         const char *partition = NULL;
622         struct drsuapi_DsGetNT4ChangeLog r;
623         int32_t out_level = 0;
624         struct GUID null_guid;
625         struct dom_sid null_sid;
626         DATA_BLOB cookie;
627
628         ZERO_STRUCT(null_guid);
629         ZERO_STRUCT(null_sid);
630         ZERO_STRUCT(cookie);
631
632         ZERO_STRUCT(r);
633         r.in.bind_handle        = &ctx->new_dc.drsuapi.bind_handle;
634         r.in.level              = 1;
635
636         r.in.req.req1.unknown1  = lp_parm_int(-1, "dssync", "nt4-1", 3);
637         r.in.req.req1.unknown2  = lp_parm_int(-1, "dssync", "nt4-2", 0x00004000);
638
639         while (1) {
640                 r.in.req.req1.length    = cookie.length;
641                 r.in.req.req1.data      = cookie.data;
642
643                 status = dcerpc_drsuapi_DsGetNT4ChangeLog(ctx->new_dc.drsuapi.pipe, ctx, &r);
644                 if (!NT_STATUS_IS_OK(status)) {
645                         const char *errstr = nt_errstr(status);
646                         if (NT_STATUS_EQUAL(status, NT_STATUS_NET_WRITE_FAULT)) {
647                                 errstr = dcerpc_errstr(ctx, ctx->new_dc.drsuapi.pipe->last_fault_code);
648                         }
649                         printf("dcerpc_drsuapi_DsGetNT4ChangeLog failed - %s\n", errstr);
650                         ret = False;
651                 } else if (!W_ERROR_IS_OK(r.out.result)) {
652                         printf("DsGetNT4ChangeLog failed - %s\n", win_errstr(r.out.result));
653                         ret = False;
654                 } else if (r.out.level != 1) {
655                         printf("DsGetNT4ChangeLog unknown level - %u\n", r.out.level);
656                         ret = False;
657                 } else if (NT_STATUS_IS_OK(r.out.info.info1.status)) {
658                 } else if (NT_STATUS_EQUAL(r.out.info.info1.status, STATUS_MORE_ENTRIES)) {
659                         cookie.length   = r.out.info.info1.length1;
660                         cookie.data     = r.out.info.info1.data1;
661                         continue;
662                 } else {
663                         printf("DsGetNT4ChangeLog failed - %s\n", nt_errstr(r.out.info.info1.status));
664                         ret = False;
665                 }
666
667                 break;
668         }
669
670         return ret;
671 }
672
673 BOOL torture_rpc_dssync(struct torture_context *torture)
674 {
675         BOOL ret = True;
676         TALLOC_CTX *mem_ctx;
677         struct DsSyncTest *ctx;
678         
679         mem_ctx = talloc_init("torture_rpc_dssync");
680         ctx = test_create_context(mem_ctx);
681         
682         ret &= _test_DsBind(ctx, ctx->admin.credentials, &ctx->admin.drsuapi);
683         ret &= test_LDAPBind(ctx, ctx->admin.credentials, &ctx->admin.ldap);
684         ret &= test_GetInfo(ctx);
685         ret &= _test_DsBind(ctx, ctx->new_dc.credentials, &ctx->new_dc.drsuapi);
686         ret &= test_FetchData(ctx);
687         ret &= test_FetchNT4Data(ctx);
688
689         return ret;
690 }