source4/torture/rpc/dsgetinfo.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3
   4    DsGetReplInfo test. Based on code from dssync.c
   5
   6    Copyright (C) Erick Nogueira do Nascimento 2009
   7
   8    This program is free software; you can redistribute it and/or modify
   9    it under the terms of the GNU General Public License as published by
  10    the Free Software Foundation; either version 3 of the License, or
  11    (at your option) any later version.
  12
  13    This program is distributed in the hope that it will be useful,
  14    but WITHOUT ANY WARRANTY; without even the implied warranty of
  15    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  16    GNU General Public License for more details.
  17
  18    You should have received a copy of the GNU General Public License
  19    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  20 */
  21
  22 #include "includes.h"
  23 #include "lib/cmdline/cmdline.h"
  24 #include "librpc/gen_ndr/ndr_drsuapi_c.h"
  25 #include "librpc/gen_ndr/ndr_drsblobs.h"
  26 #include "libcli/cldap/cldap.h"
  27 #include "torture/torture.h"
  28 #include "../libcli/drsuapi/drsuapi.h"
  29 #include "auth/gensec/gensec.h"
  30 #include "param/param.h"
  31 #include "dsdb/samdb/samdb.h"
  32 #include "torture/rpc/torture_rpc.h"
  33 #include "torture/drs/proto.h"
  34 #include "lib/util/util_paths.h"
  35
  36
  37 struct DsGetinfoBindInfo {
  38         struct dcerpc_pipe *drs_pipe;
  39         struct dcerpc_binding_handle *drs_handle;
  40         struct drsuapi_DsBind req;
  41         struct GUID bind_guid;
  42         struct drsuapi_DsBindInfoCtr our_bind_info_ctr;
  43         struct drsuapi_DsBindInfo28 our_bind_info28;
  44         struct drsuapi_DsBindInfo28 peer_bind_info28;
  45         struct policy_handle bind_handle;
  46 };
  47
  48 struct DsGetinfoTest {
  49         struct dcerpc_binding *drsuapi_binding;
  50
  51         const char *ldap_url;
  52         const char *site_name;
  53
  54         const char *domain_dn;
  55
  56         /* what we need to do as 'Administrator' */
  57         struct {
  58                 struct cli_credentials *credentials;
  59                 struct DsGetinfoBindInfo drsuapi;
  60         } admin;
  61 };
  62
  63
  64
  65 /*
  66   return the default DN for a ldap server given a connected RPC pipe to the
  67   server
  68  */
  69 static const char *torture_get_ldap_base_dn(struct torture_context *tctx, struct dcerpc_pipe *p)
  70 {
  71         struct dcerpc_binding_handle *b = p->binding_handle;
  72         const struct dcerpc_binding *bd = dcerpc_binding_handle_get_binding(b);
  73         const char *hostname = dcerpc_binding_get_string_option(bd, "host");
  74         struct ldb_context *ldb;
  75         const char *ldap_url = talloc_asprintf(p, "ldap://%s", hostname);
  76         const char *attrs[] = { "defaultNamingContext", NULL };
  77         const char *dnstr;
  78         TALLOC_CTX *tmp_ctx = talloc_new(tctx);
  79         int ret;
  80         struct ldb_result *res;
  81
  82         ldb = ldb_init(tmp_ctx, tctx->ev);
  83         if (ldb == NULL) {
  84                 talloc_free(tmp_ctx);
  85                 return NULL;
  86         }
  87
  88         if (ldb_set_opaque(ldb, "loadparm", tctx->lp_ctx)) {
  89                 talloc_free(ldb);
  90                 return NULL;
  91         }
  92
  93         ldb_set_modules_dir(ldb,
  94                             modules_path(ldb, "ldb"));
  95
  96         ret = ldb_connect(ldb, ldap_url, 0, NULL);
  97         if (ret != LDB_SUCCESS) {
  98                 torture_comment(tctx, "Failed to make LDB connection to target");
  99                 talloc_free(tmp_ctx);
 100                 return NULL;
 101         }
 102
 103         ret = dsdb_search_dn(ldb, tmp_ctx, &res, ldb_dn_new(tmp_ctx, ldb, ""),
 104                              attrs, 0);
 105         if (ret != LDB_SUCCESS) {
 106                 torture_comment(tctx, "Failed to get defaultNamingContext");
 107                 talloc_free(tmp_ctx);
 108                 return NULL;
 109         }
 110
 111         dnstr = ldb_msg_find_attr_as_string(res->msgs[0], "defaultNamingContext", NULL);
 112         dnstr = talloc_strdup(tctx, dnstr);
 113         talloc_free(tmp_ctx);
 114         return dnstr;
 115 }
 116
 117
 118 static struct DsGetinfoTest *test_create_context(struct torture_context *tctx)
 119 {
 120         NTSTATUS status;
 121         struct DsGetinfoTest *ctx;
 122         struct drsuapi_DsBindInfo28 *our_bind_info28;
 123         struct drsuapi_DsBindInfoCtr *our_bind_info_ctr;
 124         const char *binding = torture_setting_string(tctx, "binding", NULL);
 125         ctx = talloc_zero(tctx, struct DsGetinfoTest);
 126         if (!ctx) return NULL;
 127
 128         status = dcerpc_parse_binding(ctx, binding, &ctx->drsuapi_binding);
 129         if (!NT_STATUS_IS_OK(status)) {
 130                 printf("Bad binding string %s\n", binding);
 131                 return NULL;
 132         }
 133         status = dcerpc_binding_set_flags(ctx->drsuapi_binding, DCERPC_SIGN | DCERPC_SEAL, 0);
 134         if (!NT_STATUS_IS_OK(status)) {
 135                 printf("dcerpc_binding_set_flags - %s\n", nt_errstr(status));
 136                 return NULL;
 137         }
 138
 139         /* ctx->admin ...*/
 140         ctx->admin.credentials = samba_cmdline_get_creds();
 141
 142         our_bind_info28                         = &ctx->admin.drsuapi.our_bind_info28;
 143         our_bind_info28->supported_extensions   = 0xFFFFFFFF;
 144         our_bind_info28->supported_extensions   |= DRSUAPI_SUPPORTED_EXTENSION_ADDENTRYREPLY_V3;
 145         our_bind_info28->site_guid              = GUID_zero();
 146         our_bind_info28->pid                    = 0;
 147         our_bind_info28->repl_epoch             = 1;
 148
 149         our_bind_info_ctr                       = &ctx->admin.drsuapi.our_bind_info_ctr;
 150         our_bind_info_ctr->length               = 28;
 151         our_bind_info_ctr->info.info28          = *our_bind_info28;
 152
 153         GUID_from_string(DRSUAPI_DS_BIND_GUID, &ctx->admin.drsuapi.bind_guid);
 154
 155         ctx->admin.drsuapi.req.in.bind_guid             = &ctx->admin.drsuapi.bind_guid;
 156         ctx->admin.drsuapi.req.in.bind_info             = our_bind_info_ctr;
 157         ctx->admin.drsuapi.req.out.bind_handle          = &ctx->admin.drsuapi.bind_handle;
 158
 159         return ctx;
 160 }
 161
 162 static bool _test_DsBind(struct torture_context *tctx,
 163                          struct DsGetinfoTest *ctx, struct cli_credentials *credentials, struct DsGetinfoBindInfo *b)
 164 {
 165         NTSTATUS status;
 166         bool ret = true;
 167
 168         status = dcerpc_pipe_connect_b(ctx,
 169                                        &b->drs_pipe, ctx->drsuapi_binding,
 170                                        &ndr_table_drsuapi,
 171                                        credentials, tctx->ev, tctx->lp_ctx);
 172
 173         if (!NT_STATUS_IS_OK(status)) {
 174                 printf("Failed to connect to server as a BDC: %s\n", nt_errstr(status));
 175                 return false;
 176         }
 177         b->drs_handle = b->drs_pipe->binding_handle;
 178
 179         status = dcerpc_drsuapi_DsBind_r(b->drs_handle, ctx, &b->req);
 180         if (!NT_STATUS_IS_OK(status)) {
 181                 const char *errstr = nt_errstr(status);
 182                 printf("dcerpc_drsuapi_DsBind failed - %s\n", errstr);
 183                 ret = false;
 184         } else if (!W_ERROR_IS_OK(b->req.out.result)) {
 185                 printf("DsBind failed - %s\n", win_errstr(b->req.out.result));
 186                 ret = false;
 187         }
 188
 189         ZERO_STRUCT(b->peer_bind_info28);
 190         if (b->req.out.bind_info) {
 191                 switch (b->req.out.bind_info->length) {
 192                 case 24: {
 193                         struct drsuapi_DsBindInfo24 *info24;
 194                         info24 = &b->req.out.bind_info->info.info24;
 195                         b->peer_bind_info28.supported_extensions= info24->supported_extensions;
 196                         b->peer_bind_info28.site_guid           = info24->site_guid;
 197                         b->peer_bind_info28.pid                 = info24->pid;
 198                         b->peer_bind_info28.repl_epoch          = 0;
 199                         break;
 200                 }
 201                 case 28: {
 202                         b->peer_bind_info28 = b->req.out.bind_info->info.info28;
 203                         break;
 204                 }
 205                 case 32: {
 206                         struct drsuapi_DsBindInfo32 *info32;
 207                         info32 = &b->req.out.bind_info->info.info32;
 208                         b->peer_bind_info28.supported_extensions= info32->supported_extensions;
 209                         b->peer_bind_info28.site_guid           = info32->site_guid;
 210                         b->peer_bind_info28.pid                 = info32->pid;
 211                         b->peer_bind_info28.repl_epoch          = info32->repl_epoch;
 212                         break;
 213                 }
 214                 case 48: {
 215                         struct drsuapi_DsBindInfo48 *info48;
 216                         info48 = &b->req.out.bind_info->info.info48;
 217                         b->peer_bind_info28.supported_extensions= info48->supported_extensions;
 218                         b->peer_bind_info28.site_guid           = info48->site_guid;
 219                         b->peer_bind_info28.pid                 = info48->pid;
 220                         b->peer_bind_info28.repl_epoch          = info48->repl_epoch;
 221                         break;
 222                 }
 223                 case 52: {
 224                         struct drsuapi_DsBindInfo52 *info52;
 225                         info52 = &b->req.out.bind_info->info.info52;
 226                         b->peer_bind_info28.supported_extensions= info52->supported_extensions;
 227                         b->peer_bind_info28.site_guid           = info52->site_guid;
 228                         b->peer_bind_info28.pid                 = info52->pid;
 229                         b->peer_bind_info28.repl_epoch          = info52->repl_epoch;
 230                         break;
 231                 }
 232                 default:
 233                         printf("DsBind - warning: unknown BindInfo length: %u\n",
 234                                b->req.out.bind_info->length);
 235                 }
 236         }
 237
 238         return ret;
 239 }
 240
 241
 242 static bool test_getinfo(struct torture_context *tctx,
 243                          struct DsGetinfoTest *ctx)
 244 {
 245         NTSTATUS status;
 246         struct dcerpc_pipe *p = ctx->admin.drsuapi.drs_pipe;
 247         struct dcerpc_binding_handle *b = ctx->admin.drsuapi.drs_handle;
 248         struct drsuapi_DsReplicaGetInfo r;
 249         union drsuapi_DsReplicaGetInfoRequest req;
 250         union drsuapi_DsReplicaInfo info;
 251         enum drsuapi_DsReplicaInfoType info_type;
 252         int i;
 253         bool no_invalid_levels = true;
 254         struct {
 255                 int32_t level;
 256                 int32_t infotype;
 257                 const char *obj_dn;
 258                 const char *attribute_name;
 259                 uint32_t flags;
 260         } array[] = {
 261                 {
 262                         .level = DRSUAPI_DS_REPLICA_GET_INFO,
 263                         .infotype = DRSUAPI_DS_REPLICA_INFO_NEIGHBORS
 264                 },{
 265                         .level = DRSUAPI_DS_REPLICA_GET_INFO,
 266                         .infotype = DRSUAPI_DS_REPLICA_INFO_CURSORS
 267                 },{
 268                         .level = DRSUAPI_DS_REPLICA_GET_INFO,
 269                         .infotype = DRSUAPI_DS_REPLICA_INFO_OBJ_METADATA
 270                 },{
 271                         .level = DRSUAPI_DS_REPLICA_GET_INFO,
 272                         .infotype = DRSUAPI_DS_REPLICA_INFO_KCC_DSA_CONNECT_FAILURES
 273                 },{
 274                         .level = DRSUAPI_DS_REPLICA_GET_INFO,
 275                         .infotype = DRSUAPI_DS_REPLICA_INFO_KCC_DSA_LINK_FAILURES
 276                 },{
 277                         .level = DRSUAPI_DS_REPLICA_GET_INFO,
 278                         .infotype = DRSUAPI_DS_REPLICA_INFO_PENDING_OPS
 279                 },{
 280                         .level = DRSUAPI_DS_REPLICA_GET_INFO2,
 281                         .infotype = DRSUAPI_DS_REPLICA_INFO_ATTRIBUTE_VALUE_METADATA
 282                 },{
 283                         .level = DRSUAPI_DS_REPLICA_GET_INFO2,
 284                         .infotype = DRSUAPI_DS_REPLICA_INFO_CURSORS2
 285                 },{
 286                         .level = DRSUAPI_DS_REPLICA_GET_INFO2,
 287                         .infotype = DRSUAPI_DS_REPLICA_INFO_CURSORS3
 288                 },{
 289                         .level = DRSUAPI_DS_REPLICA_GET_INFO2,
 290                         .infotype = DRSUAPI_DS_REPLICA_INFO_OBJ_METADATA2,
 291                         .obj_dn = "CN=Domain Admins,CN=Users,",
 292                         .flags = 0
 293                 },{
 294                         .level = DRSUAPI_DS_REPLICA_GET_INFO2,
 295                         .infotype = DRSUAPI_DS_REPLICA_INFO_OBJ_METADATA2,
 296                         .obj_dn = "CN=Domain Admins,CN=Users,",
 297                         .flags = DRSUAPI_DS_LINKED_ATTRIBUTE_FLAG_ACTIVE
 298                 },{
 299                         .level = DRSUAPI_DS_REPLICA_GET_INFO2,
 300                         .infotype = DRSUAPI_DS_REPLICA_INFO_ATTRIBUTE_VALUE_METADATA2
 301                 },{
 302                         .level = DRSUAPI_DS_REPLICA_GET_INFO2,
 303                         .infotype = DRSUAPI_DS_REPLICA_INFO_REPSTO
 304                 },{
 305                         .level = DRSUAPI_DS_REPLICA_GET_INFO2,
 306                         .infotype = DRSUAPI_DS_REPLICA_INFO_CLIENT_CONTEXTS
 307                 },{
 308                         .level = DRSUAPI_DS_REPLICA_GET_INFO2,
 309                         .infotype = DRSUAPI_DS_REPLICA_INFO_UPTODATE_VECTOR_V1
 310                 },{
 311                         .level = DRSUAPI_DS_REPLICA_GET_INFO2,
 312                         .infotype = DRSUAPI_DS_REPLICA_INFO_SERVER_OUTGOING_CALLS
 313                 }
 314         };
 315
 316         ctx->domain_dn = torture_get_ldap_base_dn(tctx, p);
 317         torture_assert(tctx, ctx->domain_dn != NULL, "Cannot get domain_dn");
 318
 319         if (torture_setting_bool(tctx, "samba4", false)) {
 320                 torture_comment(tctx, "skipping DsReplicaGetInfo test against Samba4\n");
 321                 return true;
 322         }
 323
 324         r.in.bind_handle        = &ctx->admin.drsuapi.bind_handle;
 325         r.in.req                = &req;
 326
 327         for (i=0; i < ARRAY_SIZE(array); i++) {
 328                 const char *object_dn;
 329
 330                 torture_comment(tctx, "Testing DsReplicaGetInfo level %d infotype %d\n",
 331                                 array[i].level, array[i].infotype);
 332
 333                 if (array[i].obj_dn) {
 334                         object_dn = array[i].obj_dn;
 335                         if (object_dn[strlen(object_dn)-1] == ',') {
 336                                 /* add the domain DN on the end */
 337                                 object_dn = talloc_asprintf(tctx, "%s%s", object_dn, ctx->domain_dn);
 338                         }
 339                 } else {
 340                         object_dn = ctx->domain_dn;
 341                 }
 342
 343                 r.in.level = array[i].level;
 344                 switch(r.in.level) {
 345                 case DRSUAPI_DS_REPLICA_GET_INFO:
 346                         r.in.req->req1.info_type        = array[i].infotype;
 347                         r.in.req->req1.object_dn        = object_dn;
 348                         ZERO_STRUCT(r.in.req->req1.source_dsa_guid);
 349                         break;
 350                 case DRSUAPI_DS_REPLICA_GET_INFO2:
 351                         r.in.req->req2.info_type        = array[i].infotype;
 352                         r.in.req->req2.object_dn        = object_dn;
 353                         ZERO_STRUCT(r.in.req->req2.source_dsa_guid);
 354                         r.in.req->req2.flags            = 0;
 355                         r.in.req->req2.attribute_name   = NULL;
 356                         r.in.req->req2.value_dn_str     = NULL;
 357                         r.in.req->req2.enumeration_context = 0;
 358                         break;
 359                 }
 360
 361                 /* Construct a different request for some of the infoTypes */
 362                 if (array[i].attribute_name != NULL) {
 363                         r.in.req->req2.attribute_name = array[i].attribute_name;
 364                 }
 365                 if (array[i].flags != 0) {
 366                         r.in.req->req2.flags |= array[i].flags;
 367                 }
 368
 369                 r.out.info              = &info;
 370                 r.out.info_type         = &info_type;
 371
 372                 status = dcerpc_drsuapi_DsReplicaGetInfo_r(b, tctx, &r);
 373                 if (NT_STATUS_EQUAL(status, NT_STATUS_RPC_ENUM_VALUE_OUT_OF_RANGE)) {
 374                         torture_comment(tctx,
 375                                         "DsReplicaGetInfo level %d and/or infotype %d not supported by server\n",
 376                                         array[i].level, array[i].infotype);
 377                         continue;
 378                 }
 379                 torture_assert_ntstatus_ok(tctx, status, talloc_asprintf(tctx,
 380                                         "DsReplicaGetInfo level %d and/or infotype %d failed\n",
 381                                         array[i].level, array[i].infotype));
 382                 if (W_ERROR_EQUAL(r.out.result, WERR_INVALID_LEVEL)) {
 383                         /* this is a not yet supported level */
 384                         torture_comment(tctx,
 385                                         "DsReplicaGetInfo level %d and/or infotype %d not yet supported by server\n",
 386                                         array[i].level, array[i].infotype);
 387                         no_invalid_levels = false;
 388                         continue;
 389                 }
 390
 391                 torture_drsuapi_assert_call(tctx, p, status, &r, "dcerpc_drsuapi_DsReplicaGetInfo");
 392         }
 393
 394         return no_invalid_levels;
 395 }
 396
 397 /**
 398  * DSGETINFO test case setup
 399  */
 400 static bool torture_dsgetinfo_tcase_setup(struct torture_context *tctx, void **data)
 401 {
 402         bool bret;
 403         struct DsGetinfoTest *ctx;
 404
 405         *data = ctx = test_create_context(tctx);
 406         torture_assert(tctx, ctx, "test_create_context() failed");
 407
 408         bret = _test_DsBind(tctx, ctx, ctx->admin.credentials, &ctx->admin.drsuapi);
 409         torture_assert(tctx, bret, "_test_DsBind() failed");
 410
 411         return true;
 412 }
 413
 414 /**
 415  * DSGETINFO test case cleanup
 416  */
 417 static bool torture_dsgetinfo_tcase_teardown(struct torture_context *tctx, void *data)
 418 {
 419         struct DsGetinfoTest *ctx;
 420         struct drsuapi_DsUnbind r;
 421         struct policy_handle bind_handle;
 422
 423         ctx = talloc_get_type(data, struct DsGetinfoTest);
 424
 425         ZERO_STRUCT(r);
 426         r.out.bind_handle = &bind_handle;
 427
 428         /* Unbing admin handle */
 429         r.in.bind_handle = &ctx->admin.drsuapi.bind_handle;
 430         if (ctx->admin.drsuapi.drs_handle) {
 431                 dcerpc_drsuapi_DsUnbind_r(ctx->admin.drsuapi.drs_handle,
 432                                           ctx, &r);
 433         }
 434
 435         talloc_free(ctx);
 436
 437         return true;
 438 }
 439
 440 /**
 441  * DSGETINFO test case implementation
 442  */
 443 void torture_drs_rpc_dsgetinfo_tcase(struct torture_suite *suite)
 444 {
 445         typedef bool (*run_func) (struct torture_context *test, void *tcase_data);
 446         struct torture_tcase *tcase = torture_suite_add_tcase(suite, "dsgetinfo");
 447
 448         torture_tcase_set_fixture(tcase,
 449                                   torture_dsgetinfo_tcase_setup,
 450                                   torture_dsgetinfo_tcase_teardown);
 451
 452         torture_tcase_add_simple_test(tcase, "DsGetReplicaInfo", (run_func)test_getinfo);
 453 }
 454