Line data Source code
1 : /*
2 : Unix SMB/CIFS implementation.
3 :
4 : DsGetReplInfo test. Based on code from dssync.c
5 :
6 : Copyright (C) Erick Nogueira do Nascimento 2009
7 :
8 : This program is free software; you can redistribute it and/or modify
9 : it under the terms of the GNU General Public License as published by
10 : the Free Software Foundation; either version 3 of the License, or
11 : (at your option) any later version.
12 :
13 : This program is distributed in the hope that it will be useful,
14 : but WITHOUT ANY WARRANTY; without even the implied warranty of
15 : MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
16 : GNU General Public License for more details.
17 :
18 : You should have received a copy of the GNU General Public License
19 : along with this program. If not, see <http://www.gnu.org/licenses/>.
20 : */
21 :
22 : #include "includes.h"
23 : #include "lib/cmdline/cmdline.h"
24 : #include "librpc/gen_ndr/ndr_drsuapi_c.h"
25 : #include "librpc/gen_ndr/ndr_drsblobs.h"
26 : #include "libcli/cldap/cldap.h"
27 : #include "torture/torture.h"
28 : #include "../libcli/drsuapi/drsuapi.h"
29 : #include "auth/gensec/gensec.h"
30 : #include "param/param.h"
31 : #include "dsdb/samdb/samdb.h"
32 : #include "torture/rpc/torture_rpc.h"
33 : #include "torture/drs/proto.h"
34 : #include "lib/util/util_paths.h"
35 :
36 :
37 : struct DsGetinfoBindInfo {
38 : struct dcerpc_pipe *drs_pipe;
39 : struct dcerpc_binding_handle *drs_handle;
40 : struct drsuapi_DsBind req;
41 : struct GUID bind_guid;
42 : struct drsuapi_DsBindInfoCtr our_bind_info_ctr;
43 : struct drsuapi_DsBindInfo28 our_bind_info28;
44 : struct drsuapi_DsBindInfo28 peer_bind_info28;
45 : struct policy_handle bind_handle;
46 : };
47 :
48 : struct DsGetinfoTest {
49 : struct dcerpc_binding *drsuapi_binding;
50 :
51 : const char *ldap_url;
52 : const char *site_name;
53 :
54 : const char *domain_dn;
55 :
56 : /* what we need to do as 'Administrator' */
57 : struct {
58 : struct cli_credentials *credentials;
59 : struct DsGetinfoBindInfo drsuapi;
60 : } admin;
61 : };
62 :
63 :
64 :
65 : /*
66 : return the default DN for a ldap server given a connected RPC pipe to the
67 : server
68 : */
69 3 : static const char *torture_get_ldap_base_dn(struct torture_context *tctx, struct dcerpc_pipe *p)
70 : {
71 3 : const char *hostname = dcerpc_binding_get_string_option(p->binding, "host");
72 0 : struct ldb_context *ldb;
73 3 : const char *ldap_url = talloc_asprintf(p, "ldap://%s", hostname);
74 3 : const char *attrs[] = { "defaultNamingContext", NULL };
75 0 : const char *dnstr;
76 3 : TALLOC_CTX *tmp_ctx = talloc_new(tctx);
77 0 : int ret;
78 0 : struct ldb_result *res;
79 :
80 3 : ldb = ldb_init(tmp_ctx, tctx->ev);
81 3 : if (ldb == NULL) {
82 0 : talloc_free(tmp_ctx);
83 0 : return NULL;
84 : }
85 :
86 3 : if (ldb_set_opaque(ldb, "loadparm", tctx->lp_ctx)) {
87 0 : talloc_free(ldb);
88 0 : return NULL;
89 : }
90 :
91 3 : ldb_set_modules_dir(ldb,
92 3 : modules_path(ldb, "ldb"));
93 :
94 3 : ret = ldb_connect(ldb, ldap_url, 0, NULL);
95 3 : if (ret != LDB_SUCCESS) {
96 0 : torture_comment(tctx, "Failed to make LDB connection to target");
97 0 : talloc_free(tmp_ctx);
98 0 : return NULL;
99 : }
100 :
101 3 : ret = dsdb_search_dn(ldb, tmp_ctx, &res, ldb_dn_new(tmp_ctx, ldb, ""),
102 : attrs, 0);
103 3 : if (ret != LDB_SUCCESS) {
104 0 : torture_comment(tctx, "Failed to get defaultNamingContext");
105 0 : talloc_free(tmp_ctx);
106 0 : return NULL;
107 : }
108 :
109 3 : dnstr = ldb_msg_find_attr_as_string(res->msgs[0], "defaultNamingContext", NULL);
110 3 : dnstr = talloc_strdup(tctx, dnstr);
111 3 : talloc_free(tmp_ctx);
112 3 : return dnstr;
113 : }
114 :
115 :
116 3 : static struct DsGetinfoTest *test_create_context(struct torture_context *tctx)
117 : {
118 0 : NTSTATUS status;
119 0 : struct DsGetinfoTest *ctx;
120 0 : struct drsuapi_DsBindInfo28 *our_bind_info28;
121 0 : struct drsuapi_DsBindInfoCtr *our_bind_info_ctr;
122 3 : const char *binding = torture_setting_string(tctx, "binding", NULL);
123 3 : ctx = talloc_zero(tctx, struct DsGetinfoTest);
124 3 : if (!ctx) return NULL;
125 :
126 3 : status = dcerpc_parse_binding(ctx, binding, &ctx->drsuapi_binding);
127 3 : if (!NT_STATUS_IS_OK(status)) {
128 0 : printf("Bad binding string %s\n", binding);
129 0 : return NULL;
130 : }
131 3 : status = dcerpc_binding_set_flags(ctx->drsuapi_binding, DCERPC_SIGN | DCERPC_SEAL, 0);
132 3 : if (!NT_STATUS_IS_OK(status)) {
133 0 : printf("dcerpc_binding_set_flags - %s\n", nt_errstr(status));
134 0 : return NULL;
135 : }
136 :
137 : /* ctx->admin ...*/
138 3 : ctx->admin.credentials = samba_cmdline_get_creds();
139 :
140 3 : our_bind_info28 = &ctx->admin.drsuapi.our_bind_info28;
141 3 : our_bind_info28->supported_extensions = 0xFFFFFFFF;
142 3 : our_bind_info28->supported_extensions |= DRSUAPI_SUPPORTED_EXTENSION_ADDENTRYREPLY_V3;
143 3 : our_bind_info28->site_guid = GUID_zero();
144 3 : our_bind_info28->pid = 0;
145 3 : our_bind_info28->repl_epoch = 1;
146 :
147 3 : our_bind_info_ctr = &ctx->admin.drsuapi.our_bind_info_ctr;
148 3 : our_bind_info_ctr->length = 28;
149 3 : our_bind_info_ctr->info.info28 = *our_bind_info28;
150 :
151 3 : GUID_from_string(DRSUAPI_DS_BIND_GUID, &ctx->admin.drsuapi.bind_guid);
152 :
153 3 : ctx->admin.drsuapi.req.in.bind_guid = &ctx->admin.drsuapi.bind_guid;
154 3 : ctx->admin.drsuapi.req.in.bind_info = our_bind_info_ctr;
155 3 : ctx->admin.drsuapi.req.out.bind_handle = &ctx->admin.drsuapi.bind_handle;
156 :
157 3 : return ctx;
158 : }
159 :
160 3 : static bool _test_DsBind(struct torture_context *tctx,
161 : struct DsGetinfoTest *ctx, struct cli_credentials *credentials, struct DsGetinfoBindInfo *b)
162 : {
163 0 : NTSTATUS status;
164 3 : bool ret = true;
165 :
166 3 : status = dcerpc_pipe_connect_b(ctx,
167 3 : &b->drs_pipe, ctx->drsuapi_binding,
168 : &ndr_table_drsuapi,
169 : credentials, tctx->ev, tctx->lp_ctx);
170 :
171 3 : if (!NT_STATUS_IS_OK(status)) {
172 0 : printf("Failed to connect to server as a BDC: %s\n", nt_errstr(status));
173 0 : return false;
174 : }
175 3 : b->drs_handle = b->drs_pipe->binding_handle;
176 :
177 3 : status = dcerpc_drsuapi_DsBind_r(b->drs_handle, ctx, &b->req);
178 3 : if (!NT_STATUS_IS_OK(status)) {
179 0 : const char *errstr = nt_errstr(status);
180 0 : printf("dcerpc_drsuapi_DsBind failed - %s\n", errstr);
181 0 : ret = false;
182 3 : } else if (!W_ERROR_IS_OK(b->req.out.result)) {
183 0 : printf("DsBind failed - %s\n", win_errstr(b->req.out.result));
184 0 : ret = false;
185 : }
186 :
187 3 : ZERO_STRUCT(b->peer_bind_info28);
188 3 : if (b->req.out.bind_info) {
189 3 : switch (b->req.out.bind_info->length) {
190 0 : case 24: {
191 0 : struct drsuapi_DsBindInfo24 *info24;
192 0 : info24 = &b->req.out.bind_info->info.info24;
193 0 : b->peer_bind_info28.supported_extensions= info24->supported_extensions;
194 0 : b->peer_bind_info28.site_guid = info24->site_guid;
195 0 : b->peer_bind_info28.pid = info24->pid;
196 0 : b->peer_bind_info28.repl_epoch = 0;
197 0 : break;
198 : }
199 3 : case 28: {
200 3 : b->peer_bind_info28 = b->req.out.bind_info->info.info28;
201 3 : break;
202 : }
203 0 : case 32: {
204 0 : struct drsuapi_DsBindInfo32 *info32;
205 0 : info32 = &b->req.out.bind_info->info.info32;
206 0 : b->peer_bind_info28.supported_extensions= info32->supported_extensions;
207 0 : b->peer_bind_info28.site_guid = info32->site_guid;
208 0 : b->peer_bind_info28.pid = info32->pid;
209 0 : b->peer_bind_info28.repl_epoch = info32->repl_epoch;
210 0 : break;
211 : }
212 0 : case 48: {
213 0 : struct drsuapi_DsBindInfo48 *info48;
214 0 : info48 = &b->req.out.bind_info->info.info48;
215 0 : b->peer_bind_info28.supported_extensions= info48->supported_extensions;
216 0 : b->peer_bind_info28.site_guid = info48->site_guid;
217 0 : b->peer_bind_info28.pid = info48->pid;
218 0 : b->peer_bind_info28.repl_epoch = info48->repl_epoch;
219 0 : break;
220 : }
221 0 : case 52: {
222 0 : struct drsuapi_DsBindInfo52 *info52;
223 0 : info52 = &b->req.out.bind_info->info.info52;
224 0 : b->peer_bind_info28.supported_extensions= info52->supported_extensions;
225 0 : b->peer_bind_info28.site_guid = info52->site_guid;
226 0 : b->peer_bind_info28.pid = info52->pid;
227 0 : b->peer_bind_info28.repl_epoch = info52->repl_epoch;
228 0 : break;
229 : }
230 0 : default:
231 0 : printf("DsBind - warning: unknown BindInfo length: %u\n",
232 0 : b->req.out.bind_info->length);
233 : }
234 : }
235 :
236 3 : return ret;
237 : }
238 :
239 :
240 3 : static bool test_getinfo(struct torture_context *tctx,
241 : struct DsGetinfoTest *ctx)
242 : {
243 0 : NTSTATUS status;
244 3 : struct dcerpc_pipe *p = ctx->admin.drsuapi.drs_pipe;
245 3 : struct dcerpc_binding_handle *b = ctx->admin.drsuapi.drs_handle;
246 0 : struct drsuapi_DsReplicaGetInfo r;
247 0 : union drsuapi_DsReplicaGetInfoRequest req;
248 0 : union drsuapi_DsReplicaInfo info;
249 0 : enum drsuapi_DsReplicaInfoType info_type;
250 0 : int i;
251 3 : bool no_invalid_levels = true;
252 0 : struct {
253 : int32_t level;
254 : int32_t infotype;
255 : const char *obj_dn;
256 : const char *attribute_name;
257 : uint32_t flags;
258 3 : } array[] = {
259 : {
260 : .level = DRSUAPI_DS_REPLICA_GET_INFO,
261 : .infotype = DRSUAPI_DS_REPLICA_INFO_NEIGHBORS
262 : },{
263 : .level = DRSUAPI_DS_REPLICA_GET_INFO,
264 : .infotype = DRSUAPI_DS_REPLICA_INFO_CURSORS
265 : },{
266 : .level = DRSUAPI_DS_REPLICA_GET_INFO,
267 : .infotype = DRSUAPI_DS_REPLICA_INFO_OBJ_METADATA
268 : },{
269 : .level = DRSUAPI_DS_REPLICA_GET_INFO,
270 : .infotype = DRSUAPI_DS_REPLICA_INFO_KCC_DSA_CONNECT_FAILURES
271 : },{
272 : .level = DRSUAPI_DS_REPLICA_GET_INFO,
273 : .infotype = DRSUAPI_DS_REPLICA_INFO_KCC_DSA_LINK_FAILURES
274 : },{
275 : .level = DRSUAPI_DS_REPLICA_GET_INFO,
276 : .infotype = DRSUAPI_DS_REPLICA_INFO_PENDING_OPS
277 : },{
278 : .level = DRSUAPI_DS_REPLICA_GET_INFO2,
279 : .infotype = DRSUAPI_DS_REPLICA_INFO_ATTRIBUTE_VALUE_METADATA
280 : },{
281 : .level = DRSUAPI_DS_REPLICA_GET_INFO2,
282 : .infotype = DRSUAPI_DS_REPLICA_INFO_CURSORS2
283 : },{
284 : .level = DRSUAPI_DS_REPLICA_GET_INFO2,
285 : .infotype = DRSUAPI_DS_REPLICA_INFO_CURSORS3
286 : },{
287 : .level = DRSUAPI_DS_REPLICA_GET_INFO2,
288 : .infotype = DRSUAPI_DS_REPLICA_INFO_OBJ_METADATA2,
289 : .obj_dn = "CN=Domain Admins,CN=Users,",
290 : .flags = 0
291 : },{
292 : .level = DRSUAPI_DS_REPLICA_GET_INFO2,
293 : .infotype = DRSUAPI_DS_REPLICA_INFO_OBJ_METADATA2,
294 : .obj_dn = "CN=Domain Admins,CN=Users,",
295 : .flags = DRSUAPI_DS_LINKED_ATTRIBUTE_FLAG_ACTIVE
296 : },{
297 : .level = DRSUAPI_DS_REPLICA_GET_INFO2,
298 : .infotype = DRSUAPI_DS_REPLICA_INFO_ATTRIBUTE_VALUE_METADATA2
299 : },{
300 : .level = DRSUAPI_DS_REPLICA_GET_INFO2,
301 : .infotype = DRSUAPI_DS_REPLICA_INFO_REPSTO
302 : },{
303 : .level = DRSUAPI_DS_REPLICA_GET_INFO2,
304 : .infotype = DRSUAPI_DS_REPLICA_INFO_CLIENT_CONTEXTS
305 : },{
306 : .level = DRSUAPI_DS_REPLICA_GET_INFO2,
307 : .infotype = DRSUAPI_DS_REPLICA_INFO_UPTODATE_VECTOR_V1
308 : },{
309 : .level = DRSUAPI_DS_REPLICA_GET_INFO2,
310 : .infotype = DRSUAPI_DS_REPLICA_INFO_SERVER_OUTGOING_CALLS
311 : }
312 : };
313 :
314 3 : ctx->domain_dn = torture_get_ldap_base_dn(tctx, p);
315 3 : torture_assert(tctx, ctx->domain_dn != NULL, "Cannot get domain_dn");
316 :
317 3 : if (torture_setting_bool(tctx, "samba4", false)) {
318 3 : torture_comment(tctx, "skipping DsReplicaGetInfo test against Samba4\n");
319 3 : return true;
320 : }
321 :
322 0 : r.in.bind_handle = &ctx->admin.drsuapi.bind_handle;
323 0 : r.in.req = &req;
324 :
325 0 : for (i=0; i < ARRAY_SIZE(array); i++) {
326 0 : const char *object_dn;
327 :
328 0 : torture_comment(tctx, "Testing DsReplicaGetInfo level %d infotype %d\n",
329 : array[i].level, array[i].infotype);
330 :
331 0 : if (array[i].obj_dn) {
332 0 : object_dn = array[i].obj_dn;
333 0 : if (object_dn[strlen(object_dn)-1] == ',') {
334 : /* add the domain DN on the end */
335 0 : object_dn = talloc_asprintf(tctx, "%s%s", object_dn, ctx->domain_dn);
336 : }
337 : } else {
338 0 : object_dn = ctx->domain_dn;
339 : }
340 :
341 0 : r.in.level = array[i].level;
342 0 : switch(r.in.level) {
343 0 : case DRSUAPI_DS_REPLICA_GET_INFO:
344 0 : r.in.req->req1.info_type = array[i].infotype;
345 0 : r.in.req->req1.object_dn = object_dn;
346 0 : ZERO_STRUCT(r.in.req->req1.source_dsa_guid);
347 0 : break;
348 0 : case DRSUAPI_DS_REPLICA_GET_INFO2:
349 0 : r.in.req->req2.info_type = array[i].infotype;
350 0 : r.in.req->req2.object_dn = object_dn;
351 0 : ZERO_STRUCT(r.in.req->req2.source_dsa_guid);
352 0 : r.in.req->req2.flags = 0;
353 0 : r.in.req->req2.attribute_name = NULL;
354 0 : r.in.req->req2.value_dn_str = NULL;
355 0 : r.in.req->req2.enumeration_context = 0;
356 0 : break;
357 : }
358 :
359 : /* Construct a different request for some of the infoTypes */
360 0 : if (array[i].attribute_name != NULL) {
361 0 : r.in.req->req2.attribute_name = array[i].attribute_name;
362 : }
363 0 : if (array[i].flags != 0) {
364 0 : r.in.req->req2.flags |= array[i].flags;
365 : }
366 :
367 0 : r.out.info = &info;
368 0 : r.out.info_type = &info_type;
369 :
370 0 : status = dcerpc_drsuapi_DsReplicaGetInfo_r(b, tctx, &r);
371 0 : if (NT_STATUS_EQUAL(status, NT_STATUS_RPC_ENUM_VALUE_OUT_OF_RANGE)) {
372 0 : torture_comment(tctx,
373 : "DsReplicaGetInfo level %d and/or infotype %d not supported by server\n",
374 : array[i].level, array[i].infotype);
375 0 : continue;
376 : }
377 0 : torture_assert_ntstatus_ok(tctx, status, talloc_asprintf(tctx,
378 : "DsReplicaGetInfo level %d and/or infotype %d failed\n",
379 : array[i].level, array[i].infotype));
380 0 : if (W_ERROR_EQUAL(r.out.result, WERR_INVALID_LEVEL)) {
381 : /* this is a not yet supported level */
382 0 : torture_comment(tctx,
383 : "DsReplicaGetInfo level %d and/or infotype %d not yet supported by server\n",
384 : array[i].level, array[i].infotype);
385 0 : no_invalid_levels = false;
386 0 : continue;
387 : }
388 :
389 0 : torture_drsuapi_assert_call(tctx, p, status, &r, "dcerpc_drsuapi_DsReplicaGetInfo");
390 : }
391 :
392 0 : return no_invalid_levels;
393 : }
394 :
395 : /**
396 : * DSGETINFO test case setup
397 : */
398 3 : static bool torture_dsgetinfo_tcase_setup(struct torture_context *tctx, void **data)
399 : {
400 0 : bool bret;
401 0 : struct DsGetinfoTest *ctx;
402 :
403 3 : *data = ctx = test_create_context(tctx);
404 3 : torture_assert(tctx, ctx, "test_create_context() failed");
405 :
406 3 : bret = _test_DsBind(tctx, ctx, ctx->admin.credentials, &ctx->admin.drsuapi);
407 3 : torture_assert(tctx, bret, "_test_DsBind() failed");
408 :
409 3 : return true;
410 : }
411 :
412 : /**
413 : * DSGETINFO test case cleanup
414 : */
415 3 : static bool torture_dsgetinfo_tcase_teardown(struct torture_context *tctx, void *data)
416 : {
417 0 : struct DsGetinfoTest *ctx;
418 0 : struct drsuapi_DsUnbind r;
419 0 : struct policy_handle bind_handle;
420 :
421 3 : ctx = talloc_get_type(data, struct DsGetinfoTest);
422 :
423 3 : ZERO_STRUCT(r);
424 3 : r.out.bind_handle = &bind_handle;
425 :
426 : /* Unbing admin handle */
427 3 : r.in.bind_handle = &ctx->admin.drsuapi.bind_handle;
428 3 : if (ctx->admin.drsuapi.drs_handle) {
429 3 : dcerpc_drsuapi_DsUnbind_r(ctx->admin.drsuapi.drs_handle,
430 : ctx, &r);
431 : }
432 :
433 3 : talloc_free(ctx);
434 :
435 3 : return true;
436 : }
437 :
438 : /**
439 : * DSGETINFO test case implementation
440 : */
441 2358 : void torture_drs_rpc_dsgetinfo_tcase(struct torture_suite *suite)
442 : {
443 125 : typedef bool (*run_func) (struct torture_context *test, void *tcase_data);
444 2358 : struct torture_tcase *tcase = torture_suite_add_tcase(suite, "dsgetinfo");
445 :
446 2358 : torture_tcase_set_fixture(tcase,
447 : torture_dsgetinfo_tcase_setup,
448 : torture_dsgetinfo_tcase_teardown);
449 :
450 2358 : torture_tcase_add_simple_test(tcase, "DsGetReplicaInfo", (run_func)test_getinfo);
451 2358 : }
452 :
|
