PEP8: fix E225: missing whitespace around operator
[nivanova/samba-autobuild/.git] / source4 / torture / drs / python / getnc_exop.py
1 #!/usr/bin/env python
2 # -*- coding: utf-8 -*-
3 #
4 # Tests various schema replication scenarios
5 #
6 # Copyright (C) Kamen Mazdrashki <kamenim@samba.org> 2011
7 # Copyright (C) Andrew Bartlett <abartlet@samba.org> 2016
8 #
9 # This program is free software; you can redistribute it and/or modify
10 # it under the terms of the GNU General Public License as published by
11 # the Free Software Foundation; either version 3 of the License, or
12 # (at your option) any later version.
13 #
14 # This program is distributed in the hope that it will be useful,
15 # but WITHOUT ANY WARRANTY; without even the implied warranty of
16 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
17 # GNU General Public License for more details.
18 #
19 # You should have received a copy of the GNU General Public License
20 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
21 #
22
23 #
24 # Usage:
25 #  export DC1=dc1_dns_name
26 #  export DC2=dc2_dns_name
27 #  export SUBUNITRUN=$samba4srcdir/scripting/bin/subunitrun
28 #  PYTHONPATH="$PYTHONPATH:$samba4srcdir/torture/drs/python" $SUBUNITRUN getnc_exop -U"$DOMAIN/$DC_USERNAME"%"$DC_PASSWORD"
29 #
30
31 import random
32
33 import drs_base
34 from drs_base import AbstractLink
35
36 import samba.tests
37 import random
38 from samba import werror, WERRORError
39
40 import ldb
41 from ldb import SCOPE_BASE
42
43 from samba.dcerpc import drsuapi, misc, drsblobs
44 from samba.drs_utils import drs_DsBind
45 from samba.ndr import ndr_unpack, ndr_pack
46 from samba.compat import cmp_to_key_fn
47 from samba.compat import cmp_fn
48
49 def _linked_attribute_compare(la1, la2):
50     """See CompareLinks() in MS-DRSR section 4.1.10.5.17"""
51     la1, la1_target = la1
52     la2, la2_target = la2
53
54     # Ascending host object GUID
55     c = cmp_fn(ndr_pack(la1.identifier.guid), ndr_pack(la2.identifier.guid))
56     if c != 0:
57         return c
58
59     # Ascending attribute ID
60     if la1.attid != la2.attid:
61         return -1 if la1.attid < la2.attid else 1
62
63     la1_active = la1.flags & drsuapi.DRSUAPI_DS_LINKED_ATTRIBUTE_FLAG_ACTIVE
64     la2_active = la2.flags & drsuapi.DRSUAPI_DS_LINKED_ATTRIBUTE_FLAG_ACTIVE
65
66     # Ascending 'is present'
67     if la1_active != la2_active:
68         return 1 if la1_active else -1
69
70     # Ascending target object GUID
71     return cmp_fn(ndr_pack(la1_target), ndr_pack(la2_target))
72
73
74 class DrsReplicaSyncTestCase(drs_base.DrsBaseTestCase):
75     """Intended as a semi-black box test case for DsGetNCChanges
76        implementation for extended operations. It should be testing
77        how DsGetNCChanges handles different input params (mostly invalid).
78        Final goal is to make DsGetNCChanges as binary compatible to
79        Windows implementation as possible"""
80
81     def setUp(self):
82         super(DrsReplicaSyncTestCase, self).setUp()
83         self.base_dn = self.ldb_dc1.get_default_basedn()
84         self.ou = "OU=test_getncchanges,%s" % self.base_dn
85         self.ldb_dc1.add({
86             "dn": self.ou,
87             "objectclass": "organizationalUnit"})
88         (self.drs, self.drs_handle) = self._ds_bind(self.dnsname_dc1)
89         (self.default_hwm, self.default_utdv) = self._get_highest_hwm_utdv(self.ldb_dc1)
90
91     def tearDown(self):
92         try:
93             self.ldb_dc1.delete(self.ou, ["tree_delete:1"])
94         except ldb.LdbError as e:
95             (enum, string) = e.args
96             if enum == ldb.ERR_NO_SUCH_OBJECT:
97                 pass
98         super(DrsReplicaSyncTestCase, self).tearDown()
99
100     def _determine_fSMORoleOwner(self, fsmo_obj_dn):
101         """Returns (owner, not_owner) pair where:
102              owner: dns name for FSMO owner
103              not_owner: dns name for DC not owning the FSMO"""
104         # collect info to return later
105         fsmo_info_1 = {"dns_name": self.dnsname_dc1,
106                        "invocation_id": self.ldb_dc1.get_invocation_id(),
107                        "ntds_guid": self.ldb_dc1.get_ntds_GUID(),
108                        "server_dn": self.ldb_dc1.get_serverName()}
109         fsmo_info_2 = {"dns_name": self.dnsname_dc2,
110                        "invocation_id": self.ldb_dc2.get_invocation_id(),
111                        "ntds_guid": self.ldb_dc2.get_ntds_GUID(),
112                        "server_dn": self.ldb_dc2.get_serverName()}
113
114         msgs = self.ldb_dc1.search(scope=ldb.SCOPE_BASE, base=fsmo_info_1["server_dn"], attrs=["serverReference"])
115         fsmo_info_1["server_acct_dn"] = ldb.Dn(self.ldb_dc1, msgs[0]["serverReference"][0].decode('utf8'))
116         fsmo_info_1["rid_set_dn"] = ldb.Dn(self.ldb_dc1, "CN=RID Set") + fsmo_info_1["server_acct_dn"]
117
118         msgs = self.ldb_dc2.search(scope=ldb.SCOPE_BASE, base=fsmo_info_2["server_dn"], attrs=["serverReference"])
119         fsmo_info_2["server_acct_dn"] = ldb.Dn(self.ldb_dc2, msgs[0]["serverReference"][0].decode('utf8'))
120         fsmo_info_2["rid_set_dn"] = ldb.Dn(self.ldb_dc2, "CN=RID Set") + fsmo_info_2["server_acct_dn"]
121
122         # determine the owner dc
123         res = self.ldb_dc1.search(fsmo_obj_dn,
124                                   scope=SCOPE_BASE, attrs=["fSMORoleOwner"])
125         assert len(res) == 1, "Only one fSMORoleOwner value expected for %s!"%fsmo_obj_dn
126         fsmo_owner = res[0]["fSMORoleOwner"][0]
127         if fsmo_owner == self.info_dc1["dsServiceName"][0]:
128             return (fsmo_info_1, fsmo_info_2)
129         return (fsmo_info_2, fsmo_info_1)
130
131     def _check_exop_failed(self, ctr6, expected_failure):
132         self.assertEqual(ctr6.extended_ret, expected_failure)
133         #self.assertEqual(ctr6.object_count, 0)
134         #self.assertEqual(ctr6.first_object, None)
135         self.assertEqual(ctr6.more_data, False)
136         self.assertEqual(ctr6.nc_object_count, 0)
137         self.assertEqual(ctr6.nc_linked_attributes_count, 0)
138         self.assertEqual(ctr6.linked_attributes_count, 0)
139         self.assertEqual(ctr6.linked_attributes, [])
140         self.assertEqual(ctr6.drs_error[0], 0)
141
142     def test_do_single_repl(self):
143         """
144         Make sure that DRSUAPI_EXOP_REPL_OBJ never replicates more than
145         one object, even when we use DRS_GET_ANC/GET_TGT.
146         """
147
148         ou1 = "OU=get_anc1,%s" % self.ou
149         self.ldb_dc1.add({
150             "dn": ou1,
151             "objectclass": "organizationalUnit"
152         })
153         ou1_id = self._get_identifier(self.ldb_dc1, ou1)
154         ou2 = "OU=get_anc2,%s" % ou1
155         self.ldb_dc1.add({
156             "dn": ou2,
157             "objectclass": "organizationalUnit"
158         })
159         ou2_id = self._get_identifier(self.ldb_dc1, ou2)
160         dc3 = "CN=test_anc_dc_%u,%s" % (random.randint(0, 4294967295), ou2)
161         self.ldb_dc1.add({
162             "dn": dc3,
163             "objectclass": "computer",
164             "userAccountControl": "%d" % (samba.dsdb.UF_ACCOUNTDISABLE | samba.dsdb.UF_SERVER_TRUST_ACCOUNT)
165         })
166         dc3_id = self._get_identifier(self.ldb_dc1, dc3)
167
168         # Add some linked attributes (for checking GET_TGT behaviour)
169         m = ldb.Message()
170         m.dn = ldb.Dn(self.ldb_dc2, ou1)
171         m["managedBy"] = ldb.MessageElement(ou2, ldb.FLAG_MOD_ADD, "managedBy")
172         self.ldb_dc1.modify(m)
173         ou1_link = AbstractLink(drsuapi.DRSUAPI_ATTID_managedBy,
174                                 drsuapi.DRSUAPI_DS_LINKED_ATTRIBUTE_FLAG_ACTIVE,
175                                 ou1_id.guid, ou2_id.guid)
176
177         m.dn = ldb.Dn(self.ldb_dc2, dc3)
178         m["managedBy"] = ldb.MessageElement(ou2, ldb.FLAG_MOD_ADD, "managedBy")
179         self.ldb_dc1.modify(m)
180         dc3_link = AbstractLink(drsuapi.DRSUAPI_ATTID_managedBy,
181                                 drsuapi.DRSUAPI_DS_LINKED_ATTRIBUTE_FLAG_ACTIVE,
182                                 dc3_id.guid, ou2_id.guid)
183
184         req = self._getnc_req10(dest_dsa=None,
185                                 invocation_id=self.ldb_dc1.get_invocation_id(),
186                                 nc_dn_str=ou1,
187                                 exop=drsuapi.DRSUAPI_EXOP_REPL_OBJ,
188                                 replica_flags=drsuapi.DRSUAPI_DRS_WRIT_REP,
189                                 more_flags=drsuapi.DRSUAPI_DRS_GET_TGT)
190         (level, ctr) = self.drs.DsGetNCChanges(self.drs_handle, 10, req)
191         self._check_ctr6(ctr, [ou1], expected_links=[ou1_link])
192
193         # DRSUAPI_DRS_WRIT_REP means that we should only replicate the dn we give (dc3).
194         # DRSUAPI_DRS_GET_ANC means that we should also replicate its ancestors, but
195         # Windows doesn't do this if we use both.
196         req = self._getnc_req10(dest_dsa=None,
197                                 invocation_id=self.ldb_dc1.get_invocation_id(),
198                                 nc_dn_str=dc3,
199                                 exop=drsuapi.DRSUAPI_EXOP_REPL_OBJ,
200                                 replica_flags=drsuapi.DRSUAPI_DRS_WRIT_REP |
201                                 drsuapi.DRSUAPI_DRS_GET_ANC,
202                                 more_flags=drsuapi.DRSUAPI_DRS_GET_TGT)
203         (level, ctr) = self.drs.DsGetNCChanges(self.drs_handle, 10, req)
204         self._check_ctr6(ctr, [dc3], expected_links=[dc3_link])
205
206         # Even though the ancestor of ou2 (ou1) has changed since last hwm, and we're
207         # sending DRSUAPI_DRS_GET_ANC, the expected response is that it will only try
208         # and replicate the single object still.
209         req = self._getnc_req10(dest_dsa=None,
210                                 invocation_id=self.ldb_dc1.get_invocation_id(),
211                                 nc_dn_str=ou2,
212                                 exop=drsuapi.DRSUAPI_EXOP_REPL_OBJ,
213                                 replica_flags=drsuapi.DRSUAPI_DRS_CRITICAL_ONLY |
214                                 drsuapi.DRSUAPI_DRS_GET_ANC,
215                                 more_flags=drsuapi.DRSUAPI_DRS_GET_TGT)
216         (level, ctr) = self.drs.DsGetNCChanges(self.drs_handle, 10, req)
217         self._check_ctr6(ctr, [ou2])
218
219     def test_do_full_repl_on_ou(self):
220         """
221         Make sure that a full replication on a not-an-nc fails with
222         the right error code
223         """
224
225         non_nc_ou = "OU=not-an-NC,%s" % self.ou
226         self.ldb_dc1.add({
227             "dn": non_nc_ou,
228             "objectclass": "organizationalUnit"
229         })
230         req8 = self._exop_req8(dest_dsa=None,
231                                invocation_id=self.ldb_dc1.get_invocation_id(),
232                                nc_dn_str=non_nc_ou,
233                                exop=drsuapi.DRSUAPI_EXOP_NONE,
234                                replica_flags=drsuapi.DRSUAPI_DRS_WRIT_REP)
235
236         try:
237             (level, ctr) = self.drs.DsGetNCChanges(self.drs_handle, 8, req8)
238             self.fail("Expected DsGetNCChanges to fail with WERR_DS_CANT_FIND_EXPECTED_NC")
239         except WERRORError as e1:
240             (enum, estr) = e1.args
241             self.assertEquals(enum, werror.WERR_DS_CANT_FIND_EXPECTED_NC)
242
243     def test_link_utdv_hwm(self):
244         """Test verify the DRS_GET_ANC behavior."""
245
246         ou1 = "OU=get_anc1,%s" % self.ou
247         self.ldb_dc1.add({
248             "dn": ou1,
249             "objectclass": "organizationalUnit"
250         })
251         ou1_id = self._get_identifier(self.ldb_dc1, ou1)
252         ou2 = "OU=get_anc2,%s" % ou1
253         self.ldb_dc1.add({
254             "dn": ou2,
255             "objectclass": "organizationalUnit"
256         })
257         ou2_id = self._get_identifier(self.ldb_dc1, ou2)
258         dc3 = "CN=test_anc_dc_%u,%s" % (random.randint(0, 4294967295), ou2)
259         self.ldb_dc1.add({
260             "dn": dc3,
261             "objectclass": "computer",
262             "userAccountControl": "%d" % (samba.dsdb.UF_ACCOUNTDISABLE | samba.dsdb.UF_SERVER_TRUST_ACCOUNT)
263         })
264         dc3_id = self._get_identifier(self.ldb_dc1, dc3)
265
266         (hwm1, utdv1) = self._check_replication([ou1,ou2,dc3],
267                                                 drsuapi.DRSUAPI_DRS_WRIT_REP)
268
269         self._check_replication([ou1,ou2,dc3],
270                                 drsuapi.DRSUAPI_DRS_WRIT_REP |
271                                 drsuapi.DRSUAPI_DRS_GET_ANC)
272
273         self._check_replication([dc3],
274                                 drsuapi.DRSUAPI_DRS_CRITICAL_ONLY)
275
276         self._check_replication([ou1,ou2,dc3],
277                                 drsuapi.DRSUAPI_DRS_CRITICAL_ONLY |
278                                 drsuapi.DRSUAPI_DRS_GET_ANC)
279
280         m = ldb.Message()
281         m.dn = ldb.Dn(self.ldb_dc1, ou1)
282         m["displayName"] = ldb.MessageElement("OU1", ldb.FLAG_MOD_ADD, "displayName")
283         self.ldb_dc1.modify(m)
284
285         (hwm2, utdv2) = self._check_replication([ou2,dc3,ou1],
286                                                 drsuapi.DRSUAPI_DRS_WRIT_REP)
287
288         self._check_replication([ou1,ou2,dc3],
289                                 drsuapi.DRSUAPI_DRS_WRIT_REP |
290                                 drsuapi.DRSUAPI_DRS_GET_ANC)
291
292         self._check_replication([dc3],
293                                 drsuapi.DRSUAPI_DRS_CRITICAL_ONLY)
294
295         self._check_replication([ou1,ou2,dc3],
296                                 drsuapi.DRSUAPI_DRS_CRITICAL_ONLY |
297                                 drsuapi.DRSUAPI_DRS_GET_ANC)
298
299         self._check_replication([ou1],
300                                 drsuapi.DRSUAPI_DRS_WRIT_REP,
301                                 highwatermark=hwm1)
302
303         self._check_replication([ou1],
304                                 drsuapi.DRSUAPI_DRS_WRIT_REP |
305                                 drsuapi.DRSUAPI_DRS_GET_ANC,
306                                 highwatermark=hwm1)
307
308         self._check_replication([ou1],
309                                 drsuapi.DRSUAPI_DRS_WRIT_REP |
310                                 drsuapi.DRSUAPI_DRS_GET_ANC,
311                                 uptodateness_vector=utdv1)
312
313         m = ldb.Message()
314         m.dn = ldb.Dn(self.ldb_dc1, ou2)
315         m["displayName"] = ldb.MessageElement("OU2", ldb.FLAG_MOD_ADD, "displayName")
316         self.ldb_dc1.modify(m)
317
318         (hwm3, utdv3) = self._check_replication([dc3,ou1,ou2],
319                                                 drsuapi.DRSUAPI_DRS_WRIT_REP)
320
321         self._check_replication([ou1,ou2,dc3],
322                                 drsuapi.DRSUAPI_DRS_WRIT_REP |
323                                 drsuapi.DRSUAPI_DRS_GET_ANC)
324
325         self._check_replication([dc3],
326                                 drsuapi.DRSUAPI_DRS_CRITICAL_ONLY)
327
328         self._check_replication([ou1,ou2,dc3],
329                                 drsuapi.DRSUAPI_DRS_CRITICAL_ONLY |
330                                 drsuapi.DRSUAPI_DRS_GET_ANC)
331
332         self._check_replication([ou1,ou2],
333                                 drsuapi.DRSUAPI_DRS_WRIT_REP,
334                                 highwatermark=hwm1)
335
336         self._check_replication([ou1,ou2],
337                                 drsuapi.DRSUAPI_DRS_WRIT_REP |
338                                 drsuapi.DRSUAPI_DRS_GET_ANC,
339                                 highwatermark=hwm1)
340
341         self._check_replication([ou1,ou2],
342                                 drsuapi.DRSUAPI_DRS_WRIT_REP |
343                                 drsuapi.DRSUAPI_DRS_GET_ANC,
344                                 uptodateness_vector=utdv1)
345
346         m = ldb.Message()
347         m.dn = ldb.Dn(self.ldb_dc1, self.ou)
348         m["displayName"] = ldb.MessageElement("OU", ldb.FLAG_MOD_ADD, "displayName")
349         self.ldb_dc1.modify(m)
350
351         (hwm4, utdv4) = self._check_replication([dc3,ou1,ou2,self.ou],
352                                                 drsuapi.DRSUAPI_DRS_WRIT_REP)
353
354         self._check_replication([self.ou,ou1,ou2,dc3],
355                                 drsuapi.DRSUAPI_DRS_WRIT_REP |
356                                 drsuapi.DRSUAPI_DRS_GET_ANC)
357
358         self._check_replication([dc3],
359                                 drsuapi.DRSUAPI_DRS_CRITICAL_ONLY)
360
361         self._check_replication([self.ou,ou1,ou2,dc3],
362                                 drsuapi.DRSUAPI_DRS_CRITICAL_ONLY |
363                                 drsuapi.DRSUAPI_DRS_GET_ANC)
364
365         self._check_replication([self.ou,ou2],
366                                 drsuapi.DRSUAPI_DRS_WRIT_REP |
367                                 drsuapi.DRSUAPI_DRS_GET_ANC,
368                                 uptodateness_vector=utdv2)
369
370         cn3 = "CN=get_anc3,%s" % ou2
371         self.ldb_dc1.add({
372             "dn": cn3,
373             "objectclass": "container",
374         })
375         cn3_id = self._get_identifier(self.ldb_dc1, cn3)
376
377         (hwm5, utdv5) = self._check_replication([dc3,ou1,ou2,self.ou,cn3],
378                                                 drsuapi.DRSUAPI_DRS_WRIT_REP)
379
380         self._check_replication([self.ou,ou1,ou2,dc3,cn3],
381                                 drsuapi.DRSUAPI_DRS_WRIT_REP |
382                                 drsuapi.DRSUAPI_DRS_GET_ANC)
383
384         self._check_replication([dc3],
385                                 drsuapi.DRSUAPI_DRS_CRITICAL_ONLY)
386
387         self._check_replication([self.ou,ou1,ou2,dc3],
388                                 drsuapi.DRSUAPI_DRS_CRITICAL_ONLY |
389                                 drsuapi.DRSUAPI_DRS_GET_ANC)
390
391         m = ldb.Message()
392         m.dn = ldb.Dn(self.ldb_dc1, ou2)
393         m["managedBy"] = ldb.MessageElement(dc3, ldb.FLAG_MOD_ADD, "managedBy")
394         self.ldb_dc1.modify(m)
395         ou2_managedBy_dc3 = AbstractLink(drsuapi.DRSUAPI_ATTID_managedBy,
396                                          drsuapi.DRSUAPI_DS_LINKED_ATTRIBUTE_FLAG_ACTIVE,
397                                          ou2_id.guid, dc3_id.guid)
398
399         (hwm6, utdv6) = self._check_replication([dc3,ou1,self.ou,cn3,ou2],
400                                                 drsuapi.DRSUAPI_DRS_WRIT_REP,
401                                                 expected_links=[ou2_managedBy_dc3])
402
403         # Can fail against Windows due to equal precedence of dc3, cn3
404         self._check_replication([self.ou,ou1,ou2,dc3,cn3],
405                                 drsuapi.DRSUAPI_DRS_WRIT_REP |
406                                 drsuapi.DRSUAPI_DRS_GET_ANC,
407                                 expected_links=[ou2_managedBy_dc3])
408
409         self._check_replication([dc3],
410                                 drsuapi.DRSUAPI_DRS_CRITICAL_ONLY)
411
412         self._check_replication([self.ou,ou1,ou2,dc3],
413                                 drsuapi.DRSUAPI_DRS_CRITICAL_ONLY |
414                                 drsuapi.DRSUAPI_DRS_GET_ANC)
415
416         self._check_replication([],
417                                 drsuapi.DRSUAPI_DRS_WRIT_REP,
418                                 uptodateness_vector=utdv5,
419                                 expected_links=[ou2_managedBy_dc3])
420
421         self._check_replication([],
422                                 drsuapi.DRSUAPI_DRS_CRITICAL_ONLY,
423                                 uptodateness_vector=utdv5)
424
425         self._check_replication([],
426                                 drsuapi.DRSUAPI_DRS_CRITICAL_ONLY,
427                                 uptodateness_vector=utdv5)
428
429         m = ldb.Message()
430         m.dn = ldb.Dn(self.ldb_dc1, dc3)
431         m["managedBy"] = ldb.MessageElement(ou1, ldb.FLAG_MOD_ADD, "managedBy")
432         self.ldb_dc1.modify(m)
433         dc3_managedBy_ou1 = AbstractLink(drsuapi.DRSUAPI_ATTID_managedBy,
434                                          drsuapi.DRSUAPI_DS_LINKED_ATTRIBUTE_FLAG_ACTIVE,
435                                          dc3_id.guid, ou1_id.guid)
436
437         (hwm7, utdv7) = self._check_replication([ou1,self.ou,cn3,ou2,dc3],
438                                                 drsuapi.DRSUAPI_DRS_WRIT_REP,
439                                                 expected_links=[ou2_managedBy_dc3,dc3_managedBy_ou1])
440
441         # Can fail against Windows due to equal precedence of dc3, cn3
442         #self._check_replication([self.ou,ou1,ou2,dc3,cn3],
443         #    drsuapi.DRSUAPI_DRS_WRIT_REP|
444         #    drsuapi.DRSUAPI_DRS_GET_ANC,
445         #    expected_links=[ou2_managedBy_dc3,dc3_managedBy_ou1])
446
447         self._check_replication([dc3],
448                                 drsuapi.DRSUAPI_DRS_CRITICAL_ONLY,
449                                 expected_links=[dc3_managedBy_ou1])
450
451         self._check_replication([dc3],
452                                 drsuapi.DRSUAPI_DRS_CRITICAL_ONLY,
453                                 expected_links=[dc3_managedBy_ou1])
454
455         self._check_replication([self.ou,ou1,ou2,dc3],
456                                 drsuapi.DRSUAPI_DRS_CRITICAL_ONLY |
457                                 drsuapi.DRSUAPI_DRS_GET_ANC,
458                                 expected_links=[dc3_managedBy_ou1])
459
460         # GET_TGT seems to override DRS_CRITICAL_ONLY and also returns any
461         # object(s) that relate to the linked attributes (similar to GET_ANC)
462         self._check_replication([ou1, dc3],
463                                 drsuapi.DRSUAPI_DRS_CRITICAL_ONLY,
464                                 more_flags=drsuapi.DRSUAPI_DRS_GET_TGT,
465                                 expected_links=[dc3_managedBy_ou1], dn_ordered=False)
466
467         # Change DC3's managedBy to OU2 instead of OU1
468         # Note that the OU1 managedBy linked attribute will still exist as
469         # a tombstone object (and so will be returned in the replication still)
470         m = ldb.Message()
471         m.dn = ldb.Dn(self.ldb_dc1, dc3)
472         m["managedBy"] = ldb.MessageElement(ou2, ldb.FLAG_MOD_REPLACE, "managedBy")
473         self.ldb_dc1.modify(m)
474         dc3_managedBy_ou1.flags &= ~drsuapi.DRSUAPI_DS_LINKED_ATTRIBUTE_FLAG_ACTIVE
475         dc3_managedBy_ou2 = AbstractLink(drsuapi.DRSUAPI_ATTID_managedBy,
476                                          drsuapi.DRSUAPI_DS_LINKED_ATTRIBUTE_FLAG_ACTIVE,
477                                          dc3_id.guid, ou2_id.guid)
478
479         (hwm8, utdv8) = self._check_replication([ou1,self.ou,cn3,ou2,dc3],
480                                                 drsuapi.DRSUAPI_DRS_WRIT_REP,
481                                                 expected_links=[ou2_managedBy_dc3,dc3_managedBy_ou1,dc3_managedBy_ou2])
482
483         # Can fail against Windows due to equal precedence of dc3, cn3
484         #self._check_replication([self.ou,ou1,ou2,dc3,cn3],
485         #    drsuapi.DRSUAPI_DRS_WRIT_REP|
486         #    drsuapi.DRSUAPI_DRS_GET_ANC,
487         #    expected_links=[ou2_managedBy_dc3,dc3_managedBy_ou1,dc3_managedBy_ou2])
488
489         self._check_replication([dc3],
490                                 drsuapi.DRSUAPI_DRS_CRITICAL_ONLY,
491                                 expected_links=[dc3_managedBy_ou1,dc3_managedBy_ou2])
492
493         self._check_replication([self.ou,ou1,ou2,dc3],
494                                 drsuapi.DRSUAPI_DRS_CRITICAL_ONLY |
495                                 drsuapi.DRSUAPI_DRS_GET_ANC,
496                                 expected_links=[dc3_managedBy_ou1,dc3_managedBy_ou2])
497
498         # GET_TGT will also return any DNs referenced by the linked attributes
499         # (including the Tombstone attribute)
500         self._check_replication([ou1, ou2, dc3],
501                                 drsuapi.DRSUAPI_DRS_CRITICAL_ONLY,
502                                 more_flags=drsuapi.DRSUAPI_DRS_GET_TGT,
503                                 expected_links=[dc3_managedBy_ou1,dc3_managedBy_ou2], dn_ordered=False)
504
505         # Use the highwater-mark prior to changing ManagedBy - this should
506         # only return the old/Tombstone and new linked attributes (we already
507         # know all the DNs)
508         self._check_replication([],
509                                 drsuapi.DRSUAPI_DRS_WRIT_REP,
510                                 expected_links=[dc3_managedBy_ou1,dc3_managedBy_ou2],
511                                 highwatermark=hwm7)
512
513         self._check_replication([],
514                                 drsuapi.DRSUAPI_DRS_WRIT_REP |
515                                 drsuapi.DRSUAPI_DRS_GET_ANC,
516                                 expected_links=[dc3_managedBy_ou1,dc3_managedBy_ou2],
517                                 highwatermark=hwm7)
518
519         self._check_replication([],
520                                 drsuapi.DRSUAPI_DRS_CRITICAL_ONLY,
521                                 expected_links=[dc3_managedBy_ou1,dc3_managedBy_ou2],
522                                 highwatermark=hwm7)
523
524         self._check_replication([],
525                                 drsuapi.DRSUAPI_DRS_CRITICAL_ONLY |
526                                 drsuapi.DRSUAPI_DRS_GET_ANC,
527                                 expected_links=[dc3_managedBy_ou1,dc3_managedBy_ou2],
528                                 highwatermark=hwm7)
529
530         self._check_replication([],
531                                 drsuapi.DRSUAPI_DRS_CRITICAL_ONLY,
532                                 more_flags=drsuapi.DRSUAPI_DRS_GET_TGT,
533                                 expected_links=[dc3_managedBy_ou1,dc3_managedBy_ou2],
534                                 highwatermark=hwm7)
535
536         # Repeat the above set of tests using the uptodateness_vector
537         # instead of the highwater-mark
538         self._check_replication([],
539                                 drsuapi.DRSUAPI_DRS_WRIT_REP,
540                                 expected_links=[dc3_managedBy_ou1,dc3_managedBy_ou2],
541                                 uptodateness_vector=utdv7)
542
543         self._check_replication([],
544                                 drsuapi.DRSUAPI_DRS_WRIT_REP |
545                                 drsuapi.DRSUAPI_DRS_GET_ANC,
546                                 expected_links=[dc3_managedBy_ou1,dc3_managedBy_ou2],
547                                 uptodateness_vector=utdv7)
548
549         self._check_replication([],
550                                 drsuapi.DRSUAPI_DRS_CRITICAL_ONLY,
551                                 expected_links=[dc3_managedBy_ou1,dc3_managedBy_ou2],
552                                 uptodateness_vector=utdv7)
553
554         self._check_replication([],
555                                 drsuapi.DRSUAPI_DRS_CRITICAL_ONLY |
556                                 drsuapi.DRSUAPI_DRS_GET_ANC,
557                                 expected_links=[dc3_managedBy_ou1,dc3_managedBy_ou2],
558                                 uptodateness_vector=utdv7)
559
560         self._check_replication([],
561                                 drsuapi.DRSUAPI_DRS_CRITICAL_ONLY,
562                                 more_flags=drsuapi.DRSUAPI_DRS_GET_TGT,
563                                 expected_links=[dc3_managedBy_ou1,dc3_managedBy_ou2],
564                                 uptodateness_vector=utdv7)
565
566     def test_FSMONotOwner(self):
567         """Test role transfer with against DC not owner of the role"""
568         fsmo_dn = self.ldb_dc1.get_schema_basedn()
569         (fsmo_owner, fsmo_not_owner) = self._determine_fSMORoleOwner(fsmo_dn)
570
571         req8 = self._exop_req8(dest_dsa=fsmo_owner["ntds_guid"],
572                                invocation_id=fsmo_not_owner["invocation_id"],
573                                nc_dn_str=fsmo_dn,
574                                exop=drsuapi.DRSUAPI_EXOP_FSMO_REQ_ROLE)
575
576         (drs, drs_handle) = self._ds_bind(fsmo_not_owner["dns_name"])
577         (level, ctr) = drs.DsGetNCChanges(drs_handle, 8, req8)
578         self.assertEqual(level, 6, "Expected level 6 response!")
579         self._check_exop_failed(ctr, drsuapi.DRSUAPI_EXOP_ERR_FSMO_NOT_OWNER)
580         self.assertEqual(ctr.source_dsa_guid, misc.GUID(fsmo_not_owner["ntds_guid"]))
581         self.assertEqual(ctr.source_dsa_invocation_id, misc.GUID(fsmo_not_owner["invocation_id"]))
582
583     def test_InvalidDestDSA(self):
584         """Test role transfer with invalid destination DSA guid"""
585         fsmo_dn = self.ldb_dc1.get_schema_basedn()
586         (fsmo_owner, fsmo_not_owner) = self._determine_fSMORoleOwner(fsmo_dn)
587
588         req8 = self._exop_req8(dest_dsa="9c637462-5b8c-4467-aef2-bdb1f57bc4ef",
589                                invocation_id=fsmo_owner["invocation_id"],
590                                nc_dn_str=fsmo_dn,
591                                exop=drsuapi.DRSUAPI_EXOP_FSMO_REQ_ROLE)
592
593         (drs, drs_handle) = self._ds_bind(fsmo_owner["dns_name"])
594         (level, ctr) = drs.DsGetNCChanges(drs_handle, 8, req8)
595         self.assertEqual(level, 6, "Expected level 6 response!")
596         self._check_exop_failed(ctr, drsuapi.DRSUAPI_EXOP_ERR_UNKNOWN_CALLER)
597         self.assertEqual(ctr.source_dsa_guid, misc.GUID(fsmo_owner["ntds_guid"]))
598         self.assertEqual(ctr.source_dsa_invocation_id, misc.GUID(fsmo_owner["invocation_id"]))
599
600 class DrsReplicaPrefixMapTestCase(drs_base.DrsBaseTestCase):
601     def setUp(self):
602         super(DrsReplicaPrefixMapTestCase, self).setUp()
603         self.base_dn = self.ldb_dc1.get_default_basedn()
604         self.ou = "ou=pfm_exop,%s" % self.base_dn
605         self.ldb_dc1.add({
606             "dn": self.ou,
607             "objectclass": "organizationalUnit"})
608         self.user = "cn=testuser,%s" % self.ou
609         self.ldb_dc1.add({
610             "dn": self.user,
611             "objectclass": "user"})
612
613     def tearDown(self):
614         super(DrsReplicaPrefixMapTestCase, self).tearDown()
615         try:
616             self.ldb_dc1.delete(self.ou, ["tree_delete:1"])
617         except ldb.LdbError as e2:
618             (enum, string) = e2.args
619             if enum == ldb.ERR_NO_SUCH_OBJECT:
620                 pass
621
622     def test_missing_prefix_map_dsa(self):
623         partial_attribute_set = self.get_partial_attribute_set()
624
625         dc_guid_1 = self.ldb_dc1.get_invocation_id()
626
627         drs, drs_handle = self._ds_bind(self.dnsname_dc1)
628
629         req8 = self._exop_req8(dest_dsa=None,
630                                invocation_id=dc_guid_1,
631                                nc_dn_str=self.user,
632                                exop=drsuapi.DRSUAPI_EXOP_REPL_OBJ,
633                                partial_attribute_set=partial_attribute_set)
634
635         try:
636             (level, ctr) = drs.DsGetNCChanges(drs_handle, 8, req8)
637             self.assertEqual(ctr.extended_ret, drsuapi.DRSUAPI_EXOP_ERR_SUCCESS)
638         except RuntimeError:
639             self.fail("Missing prefixmap shouldn't have triggered an error")
640
641     def test_invalid_prefix_map_attid(self):
642         # Request for invalid attid
643         partial_attribute_set = self.get_partial_attribute_set([99999])
644
645         dc_guid_1 = self.ldb_dc1.get_invocation_id()
646         drs, drs_handle = self._ds_bind(self.dnsname_dc1)
647
648         try:
649             pfm = self._samdb_fetch_pfm_and_schi()
650         except KeyError:
651             # On Windows, prefixMap isn't available over LDAP
652             req8 = self._exop_req8(dest_dsa=None,
653                                    invocation_id=dc_guid_1,
654                                    nc_dn_str=self.user,
655                                    exop=drsuapi.DRSUAPI_EXOP_REPL_OBJ)
656             (level, ctr) = drs.DsGetNCChanges(drs_handle, 8, req8)
657             pfm = ctr.mapping_ctr
658
659         req8 = self._exop_req8(dest_dsa=None,
660                                invocation_id=dc_guid_1,
661                                nc_dn_str=self.user,
662                                exop=drsuapi.DRSUAPI_EXOP_REPL_OBJ,
663                                partial_attribute_set=partial_attribute_set,
664                                mapping_ctr=pfm)
665
666         try:
667             (level, ctr) = drs.DsGetNCChanges(drs_handle, 8, req8)
668             self.fail("Invalid attid (99999) should have triggered an error")
669         except RuntimeError as e3:
670             (ecode, emsg) = e3.args
671             self.assertEqual(ecode, 0x000020E2, "Error code should have been "
672                              "WERR_DS_DRA_SCHEMA_MISMATCH")
673
674     def test_secret_prefix_map_attid(self):
675         # Request for a secret attid
676         partial_attribute_set = self.get_partial_attribute_set([drsuapi.DRSUAPI_ATTID_unicodePwd])
677
678         dc_guid_1 = self.ldb_dc1.get_invocation_id()
679         drs, drs_handle = self._ds_bind(self.dnsname_dc1)
680
681         try:
682             pfm = self._samdb_fetch_pfm_and_schi()
683         except KeyError:
684             # On Windows, prefixMap isn't available over LDAP
685             req8 = self._exop_req8(dest_dsa=None,
686                                    invocation_id=dc_guid_1,
687                                    nc_dn_str=self.user,
688                                    exop=drsuapi.DRSUAPI_EXOP_REPL_OBJ)
689             (level, ctr) = drs.DsGetNCChanges(drs_handle, 8, req8)
690             pfm = ctr.mapping_ctr
691
692
693         req8 = self._exop_req8(dest_dsa=None,
694                                invocation_id=dc_guid_1,
695                                nc_dn_str=self.user,
696                                exop=drsuapi.DRSUAPI_EXOP_REPL_OBJ,
697                                partial_attribute_set=partial_attribute_set,
698                                mapping_ctr=pfm)
699
700         (level, ctr) = drs.DsGetNCChanges(drs_handle, 8, req8)
701
702         found = False
703         for attr in ctr.first_object.object.attribute_ctr.attributes:
704             if attr.attid == drsuapi.DRSUAPI_ATTID_unicodePwd:
705                 found = True
706                 break
707
708         self.assertTrue(found, "Ensure we get the unicodePwd attribute back")
709
710         for i, mapping in enumerate(pfm.mappings):
711             # OID: 2.5.4.*
712             # objectClass: 2.5.4.0
713             if mapping.oid.binary_oid == [85, 4]:
714                 idx1 = i
715             # OID: 1.2.840.113556.1.4.*
716             # unicodePwd: 1.2.840.113556.1.4.90
717             elif mapping.oid.binary_oid == [42, 134, 72, 134, 247, 20, 1, 4]:
718                 idx2 = i
719
720         (pfm.mappings[idx1].id_prefix,
721          pfm.mappings[idx2].id_prefix) = (pfm.mappings[idx2].id_prefix,
722                                           pfm.mappings[idx1].id_prefix)
723
724         tmp = pfm.mappings
725         tmp[idx1], tmp[idx2] = tmp[idx2], tmp[idx1]
726         pfm.mappings = tmp
727
728         # 90 for unicodePwd (with new prefix = 0)
729         # 589824, 589827 for objectClass and CN
730         # Use of three ensures sorting is correct
731         partial_attribute_set = self.get_partial_attribute_set([90, 589824, 589827])
732         req8 = self._exop_req8(dest_dsa=None,
733                                invocation_id=dc_guid_1,
734                                nc_dn_str=self.user,
735                                exop=drsuapi.DRSUAPI_EXOP_REPL_OBJ,
736                                partial_attribute_set=partial_attribute_set,
737                                mapping_ctr=pfm)
738
739         (level, ctr) = drs.DsGetNCChanges(drs_handle, 8, req8)
740
741         found = False
742         for attr in ctr.first_object.object.attribute_ctr.attributes:
743             if attr.attid == drsuapi.DRSUAPI_ATTID_unicodePwd:
744                 found = True
745                 break
746
747         self.assertTrue(found, "Ensure we get the unicodePwd attribute back")
748
749     def test_regular_prefix_map_attid(self):
750         # Request for a regular (non-secret) attid
751         partial_attribute_set = self.get_partial_attribute_set([drsuapi.DRSUAPI_ATTID_name])
752
753         dc_guid_1 = self.ldb_dc1.get_invocation_id()
754         drs, drs_handle = self._ds_bind(self.dnsname_dc1)
755
756         try:
757             pfm = self._samdb_fetch_pfm_and_schi()
758         except KeyError:
759             # On Windows, prefixMap isn't available over LDAP
760             req8 = self._exop_req8(dest_dsa=None,
761                                    invocation_id=dc_guid_1,
762                                    nc_dn_str=self.user,
763                                    exop=drsuapi.DRSUAPI_EXOP_REPL_OBJ)
764             (level, ctr) = drs.DsGetNCChanges(drs_handle, 8, req8)
765             pfm = ctr.mapping_ctr
766
767
768         req8 = self._exop_req8(dest_dsa=None,
769                                invocation_id=dc_guid_1,
770                                nc_dn_str=self.user,
771                                exop=drsuapi.DRSUAPI_EXOP_REPL_OBJ,
772                                partial_attribute_set=partial_attribute_set,
773                                mapping_ctr=pfm)
774
775         (level, ctr) = drs.DsGetNCChanges(drs_handle, 8, req8)
776
777         found = False
778         for attr in ctr.first_object.object.attribute_ctr.attributes:
779             if attr.attid == drsuapi.DRSUAPI_ATTID_name:
780                 found = True
781                 break
782
783         self.assertTrue(found, "Ensure we get the name attribute back")
784
785         for i, mapping in enumerate(pfm.mappings):
786             # OID: 2.5.4.*
787             # objectClass: 2.5.4.0
788             if mapping.oid.binary_oid == [85, 4]:
789                 idx1 = i
790             # OID: 1.2.840.113556.1.4.*
791             # name: 1.2.840.113556.1.4.1
792             elif mapping.oid.binary_oid == [42, 134, 72, 134, 247, 20, 1, 4]:
793                 idx2 = i
794
795         (pfm.mappings[idx1].id_prefix,
796          pfm.mappings[idx2].id_prefix) = (pfm.mappings[idx2].id_prefix,
797                                           pfm.mappings[idx1].id_prefix)
798
799         tmp = pfm.mappings
800         tmp[idx1], tmp[idx2] = tmp[idx2], tmp[idx1]
801         pfm.mappings = tmp
802
803         # 1 for name (with new prefix = 0)
804         partial_attribute_set = self.get_partial_attribute_set([1])
805         req8 = self._exop_req8(dest_dsa=None,
806                                invocation_id=dc_guid_1,
807                                nc_dn_str=self.user,
808                                exop=drsuapi.DRSUAPI_EXOP_REPL_OBJ,
809                                partial_attribute_set=partial_attribute_set,
810                                mapping_ctr=pfm)
811
812         (level, ctr) = drs.DsGetNCChanges(drs_handle, 8, req8)
813
814         found = False
815         for attr in ctr.first_object.object.attribute_ctr.attributes:
816             if attr.attid == drsuapi.DRSUAPI_ATTID_name:
817                 found = True
818                 break
819
820         self.assertTrue(found, "Ensure we get the name attribute back")
821
822     def test_regular_prefix_map_ex_attid(self):
823         # Request for a regular (non-secret) attid
824         partial_attribute_set = self.get_partial_attribute_set([drsuapi.DRSUAPI_ATTID_name])
825         partial_attribute_set_ex = self.get_partial_attribute_set([drsuapi.DRSUAPI_ATTID_unicodePwd])
826
827         dc_guid_1 = self.ldb_dc1.get_invocation_id()
828         drs, drs_handle = self._ds_bind(self.dnsname_dc1)
829
830         try:
831             pfm = self._samdb_fetch_pfm_and_schi()
832         except KeyError:
833             # On Windows, prefixMap isn't available over LDAP
834             req8 = self._exop_req8(dest_dsa=None,
835                                    invocation_id=dc_guid_1,
836                                    nc_dn_str=self.user,
837                                    exop=drsuapi.DRSUAPI_EXOP_REPL_OBJ)
838             (level, ctr) = drs.DsGetNCChanges(drs_handle, 8, req8)
839             pfm = ctr.mapping_ctr
840
841
842         req8 = self._exop_req8(dest_dsa=None,
843                                invocation_id=dc_guid_1,
844                                nc_dn_str=self.user,
845                                exop=drsuapi.DRSUAPI_EXOP_REPL_OBJ,
846                                partial_attribute_set=partial_attribute_set,
847                                partial_attribute_set_ex=partial_attribute_set_ex,
848                                mapping_ctr=pfm)
849
850         (level, ctr) = drs.DsGetNCChanges(drs_handle, 8, req8)
851
852         found = False
853         for attr in ctr.first_object.object.attribute_ctr.attributes:
854             if attr.attid == drsuapi.DRSUAPI_ATTID_name:
855                 found = True
856                 break
857
858         self.assertTrue(found, "Ensure we get the name attribute back")
859
860         found = False
861         for attr in ctr.first_object.object.attribute_ctr.attributes:
862             if attr.attid == drsuapi.DRSUAPI_ATTID_unicodePwd:
863                 found = True
864                 break
865
866         self.assertTrue(found, "Ensure we get the unicodePwd attribute back")
867
868         for i, mapping in enumerate(pfm.mappings):
869             # OID: 2.5.4.*
870             # objectClass: 2.5.4.0
871             if mapping.oid.binary_oid == [85, 4]:
872                 idx1 = i
873             # OID: 1.2.840.113556.1.4.*
874             # name: 1.2.840.113556.1.4.1
875             # unicodePwd: 1.2.840.113556.1.4.90
876             elif mapping.oid.binary_oid == [42, 134, 72, 134, 247, 20, 1, 4]:
877                 idx2 = i
878
879         (pfm.mappings[idx1].id_prefix,
880          pfm.mappings[idx2].id_prefix) = (pfm.mappings[idx2].id_prefix,
881                                           pfm.mappings[idx1].id_prefix)
882
883         tmp = pfm.mappings
884         tmp[idx1], tmp[idx2] = tmp[idx2], tmp[idx1]
885         pfm.mappings = tmp
886
887         # 1 for name (with new prefix = 0)
888         partial_attribute_set = self.get_partial_attribute_set([1])
889         # 90 for unicodePwd (with new prefix = 0)
890         # HOWEVER: Windows doesn't seem to respect incoming maps for PartialAttrSetEx
891         partial_attribute_set_ex = self.get_partial_attribute_set([drsuapi.DRSUAPI_ATTID_unicodePwd])
892         req8 = self._exop_req8(dest_dsa=None,
893                                invocation_id=dc_guid_1,
894                                nc_dn_str=self.user,
895                                exop=drsuapi.DRSUAPI_EXOP_REPL_OBJ,
896                                partial_attribute_set=partial_attribute_set,
897                                partial_attribute_set_ex=partial_attribute_set_ex,
898                                mapping_ctr=pfm)
899
900         (level, ctr) = drs.DsGetNCChanges(drs_handle, 8, req8)
901
902         found = False
903         for attr in ctr.first_object.object.attribute_ctr.attributes:
904             if attr.attid == drsuapi.DRSUAPI_ATTID_name:
905                 found = True
906                 break
907
908         self.assertTrue(found, "Ensure we get the name attribute back")
909
910         found = False
911         for attr in ctr.first_object.object.attribute_ctr.attributes:
912             if attr.attid == drsuapi.DRSUAPI_ATTID_unicodePwd:
913                 found = True
914                 break
915
916         self.assertTrue(found, "Ensure we get the unicodePwd attribute back")
917
918     def _samdb_fetch_pfm_and_schi(self):
919         """Fetch prefixMap and schemaInfo stored in SamDB using LDB connection"""
920         samdb = self.ldb_dc1
921         res = samdb.search(base=samdb.get_schema_basedn(), scope=SCOPE_BASE,
922                            attrs=["prefixMap", "schemaInfo"])
923
924         pfm = ndr_unpack(drsblobs.prefixMapBlob,
925                          str(res[0]['prefixMap']))
926
927         schi = drsuapi.DsReplicaOIDMapping()
928         schi.id_prefix = 0
929         if 'schemaInfo' in res[0]:
930             binary_oid = [x if isinstance(x, int) else ord(x) for x in res[0]['schemaInfo'][0]]
931             schi.oid.length = len(binary_oid)
932             schi.oid.binary_oid = binary_oid
933         else:
934             schema_info = drsblobs.schemaInfoBlob()
935             schema_info.revision = 0
936             schema_info.marker = 0xFF
937             schema_info.invocation_id = misc.GUID(samdb.get_invocation_id())
938
939             binary_oid = [x if isinstance(x, int) else ord(x) for x in ndr_pack(schema_info)]
940             # you have to set the length before setting binary_oid
941             schi.oid.length = len(binary_oid)
942             schi.oid.binary_oid = binary_oid
943
944         pfm.ctr.mappings = pfm.ctr.mappings + [schi]
945         pfm.ctr.num_mappings += 1
946         return pfm.ctr
947
948 class DrsReplicaSyncSortTestCase(drs_base.DrsBaseTestCase):
949     def setUp(self):
950         super(DrsReplicaSyncSortTestCase, self).setUp()
951         self.base_dn = self.ldb_dc1.get_default_basedn()
952         self.ou = "ou=sort_exop,%s" % self.base_dn
953         self.ldb_dc1.add({
954             "dn": self.ou,
955             "objectclass": "organizationalUnit"})
956
957     def tearDown(self):
958         super(DrsReplicaSyncSortTestCase, self).tearDown()
959         # tidyup groups and users
960         try:
961             self.ldb_dc1.delete(self.ou, ["tree_delete:1"])
962         except ldb.LdbError as e4:
963             (enum, string) = e4.args
964             if enum == ldb.ERR_NO_SUCH_OBJECT:
965                 pass
966
967     def add_linked_attribute(self, src, dest, attr='member'):
968         m = ldb.Message()
969         m.dn = ldb.Dn(self.ldb_dc1, src)
970         m[attr] = ldb.MessageElement(dest, ldb.FLAG_MOD_ADD, attr)
971         self.ldb_dc1.modify(m)
972
973     def remove_linked_attribute(self, src, dest, attr='member'):
974         m = ldb.Message()
975         m.dn = ldb.Dn(self.ldb_dc1, src)
976         m[attr] = ldb.MessageElement(dest, ldb.FLAG_MOD_DELETE, attr)
977         self.ldb_dc1.modify(m)
978
979     def test_sort_behaviour_single_object(self):
980         """Testing sorting behaviour on single objects"""
981
982         user1_dn = "cn=test_user1,%s" % self.ou
983         user2_dn = "cn=test_user2,%s" % self.ou
984         user3_dn = "cn=test_user3,%s" % self.ou
985         group_dn = "cn=test_group,%s" % self.ou
986
987         self.ldb_dc1.add({"dn": user1_dn, "objectclass": "user"})
988         self.ldb_dc1.add({"dn": user2_dn, "objectclass": "user"})
989         self.ldb_dc1.add({"dn": user3_dn, "objectclass": "user"})
990         self.ldb_dc1.add({"dn": group_dn, "objectclass": "group"})
991
992         u1_guid = misc.GUID(self.ldb_dc1.search(base=user1_dn,
993                                                 attrs=["objectGUID"])[0]['objectGUID'][0])
994         u2_guid = misc.GUID(self.ldb_dc1.search(base=user2_dn,
995                                                 attrs=["objectGUID"])[0]['objectGUID'][0])
996         u3_guid = misc.GUID(self.ldb_dc1.search(base=user3_dn,
997                                                 attrs=["objectGUID"])[0]['objectGUID'][0])
998         g_guid = misc.GUID(self.ldb_dc1.search(base=group_dn,
999                                                attrs=["objectGUID"])[0]['objectGUID'][0])
1000
1001         self.add_linked_attribute(group_dn, user1_dn,
1002                                   attr='member')
1003         self.add_linked_attribute(group_dn, user2_dn,
1004                                   attr='member')
1005         self.add_linked_attribute(group_dn, user3_dn,
1006                                   attr='member')
1007         self.add_linked_attribute(group_dn, user1_dn,
1008                                   attr='managedby')
1009         self.add_linked_attribute(group_dn, user2_dn,
1010                                   attr='nonSecurityMember')
1011         self.add_linked_attribute(group_dn, user3_dn,
1012                                   attr='nonSecurityMember')
1013
1014         set_inactive = AbstractLink(drsuapi.DRSUAPI_ATTID_nonSecurityMember,
1015                                     drsuapi.DRSUAPI_DS_LINKED_ATTRIBUTE_FLAG_ACTIVE,
1016                                     g_guid, u3_guid)
1017
1018         expected_links = set([set_inactive,
1019                               AbstractLink(drsuapi.DRSUAPI_ATTID_member,
1020                                            drsuapi.DRSUAPI_DS_LINKED_ATTRIBUTE_FLAG_ACTIVE,
1021                                            g_guid,
1022                                            u1_guid),
1023                               AbstractLink(drsuapi.DRSUAPI_ATTID_member,
1024                                            drsuapi.DRSUAPI_DS_LINKED_ATTRIBUTE_FLAG_ACTIVE,
1025                                            g_guid,
1026                                            u2_guid),
1027                               AbstractLink(drsuapi.DRSUAPI_ATTID_member,
1028                                            drsuapi.DRSUAPI_DS_LINKED_ATTRIBUTE_FLAG_ACTIVE,
1029                                            g_guid,
1030                                            u3_guid),
1031                               AbstractLink(drsuapi.DRSUAPI_ATTID_managedBy,
1032                                            drsuapi.DRSUAPI_DS_LINKED_ATTRIBUTE_FLAG_ACTIVE,
1033                                            g_guid,
1034                                            u1_guid),
1035                               AbstractLink(drsuapi.DRSUAPI_ATTID_nonSecurityMember,
1036                                            drsuapi.DRSUAPI_DS_LINKED_ATTRIBUTE_FLAG_ACTIVE,
1037                                            g_guid,
1038                                            u2_guid),
1039         ])
1040
1041         dc_guid_1 = self.ldb_dc1.get_invocation_id()
1042
1043         drs, drs_handle = self._ds_bind(self.dnsname_dc1)
1044
1045         req8 = self._exop_req8(dest_dsa=None,
1046                                invocation_id=dc_guid_1,
1047                                nc_dn_str=group_dn,
1048                                exop=drsuapi.DRSUAPI_EXOP_REPL_OBJ)
1049
1050         (level, ctr) = drs.DsGetNCChanges(drs_handle, 8, req8)
1051
1052         no_inactive = []
1053         for link in ctr.linked_attributes:
1054             target_guid = ndr_unpack(drsuapi.DsReplicaObjectIdentifier3,
1055                                      link.value.blob).guid
1056             no_inactive.append((link, target_guid))
1057             self.assertTrue(AbstractLink(link.attid, link.flags,
1058                                          link.identifier.guid,
1059                                          target_guid) in expected_links)
1060
1061         no_inactive.sort(key=cmp_to_key_fn(_linked_attribute_compare))
1062
1063         # assert the two arrays are the same
1064         self.assertEqual(len(expected_links), ctr.linked_attributes_count)
1065         self.assertEqual([x[0] for x in no_inactive], ctr.linked_attributes)
1066
1067         self.remove_linked_attribute(group_dn, user3_dn,
1068                                      attr='nonSecurityMember')
1069
1070         # Set the link inactive
1071         expected_links.remove(set_inactive)
1072         set_inactive.flags = 0
1073         expected_links.add(set_inactive)
1074
1075         has_inactive = []
1076         (level, ctr) = drs.DsGetNCChanges(drs_handle, 8, req8)
1077         for link in ctr.linked_attributes:
1078             target_guid = ndr_unpack(drsuapi.DsReplicaObjectIdentifier3,
1079                                      link.value.blob).guid
1080             has_inactive.append((link, target_guid))
1081             self.assertTrue(AbstractLink(link.attid, link.flags,
1082                                          link.identifier.guid,
1083                                          target_guid) in expected_links)
1084
1085         has_inactive.sort(key=cmp_to_key_fn(_linked_attribute_compare))
1086
1087         # assert the two arrays are the same
1088         self.assertEqual(len(expected_links), ctr.linked_attributes_count)
1089         self.assertEqual([x[0] for x in has_inactive], ctr.linked_attributes)
1090
1091     def test_sort_behaviour_ncchanges(self):
1092         """Testing sorting behaviour on a group of objects."""
1093         user1_dn = "cn=test_user1,%s" % self.ou
1094         group_dn = "cn=test_group,%s" % self.ou
1095         self.ldb_dc1.add({"dn": user1_dn, "objectclass": "user"})
1096         self.ldb_dc1.add({"dn": group_dn, "objectclass": "group"})
1097
1098         self.add_linked_attribute(group_dn, user1_dn,
1099                                   attr='member')
1100
1101         dc_guid_1 = self.ldb_dc1.get_invocation_id()
1102
1103         drs, drs_handle = self._ds_bind(self.dnsname_dc1)
1104
1105         # Make sure the max objects count is high enough
1106         req8 = self._exop_req8(dest_dsa=None,
1107                                invocation_id=dc_guid_1,
1108                                nc_dn_str=self.base_dn,
1109                                replica_flags=0,
1110                                max_objects=100,
1111                                exop=drsuapi.DRSUAPI_EXOP_NONE)
1112
1113         # Loop until we get linked attributes, or we get to the end.
1114         # Samba sends linked attributes at the end, unlike Windows.
1115         while True:
1116             (level, ctr) = drs.DsGetNCChanges(drs_handle, 8, req8)
1117             if ctr.more_data == 0 or ctr.linked_attributes_count != 0:
1118                 break
1119             req8.highwatermark = ctr.new_highwatermark
1120
1121         self.assertTrue(ctr.linked_attributes_count != 0)
1122
1123         no_inactive = []
1124         for link in ctr.linked_attributes:
1125             try:
1126                 target_guid = ndr_unpack(drsuapi.DsReplicaObjectIdentifier3,
1127                                          link.value.blob).guid
1128             except:
1129                 target_guid = ndr_unpack(drsuapi.DsReplicaObjectIdentifier3Binary,
1130                                          link.value.blob).guid
1131             no_inactive.append((link, target_guid))
1132
1133         no_inactive.sort(key=cmp_to_key_fn(_linked_attribute_compare))
1134
1135         # assert the two arrays are the same
1136         self.assertEqual([x[0] for x in no_inactive], ctr.linked_attributes)