selftest: Confirm that the flags like DS_DIRECTORY_SERVICE_9_REQUIRED work

We need to confirm this both for forwarded requests, and also for requests
direct to the possible DC.

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Autobuild-User(master): Andrew Bartlett <abartlet@samba.org>
Autobuild-Date(master): Mon May 29 23:29:50 UTC 2023 on atb-devel-224

diff --git a/python/samba/tests/getdcname.py b/python/samba/tests/getdcname.py
index 34806f5e6625760ced641b574ecdf2fb4f01a943..55116bf98dc1f830f6e507e384c6d280c469bf01 100644 (file)
--- a/python/samba/tests/getdcname.py
+++ b/python/samba/tests/getdcname.py
@@ -40,6 +40,7 @@ class GetDCNameEx(samba.tests.TestCase):
         self.domain = os.environ.get('DOMAIN')
         self.trust_realm = os.environ.get('TRUST_REALM')
         self.trust_domain = os.environ.get('TRUST_DOMAIN')
+        self.trust_server = os.environ.get('TRUST_SERVER')
 
     def _call_get_dc_name(self, domain=None, domain_guid=None,
                           site_name=None, ex2=False, flags=0):
@@ -442,6 +443,88 @@ class GetDCNameEx(samba.tests.TestCase):
         self.assertEqual(response.domain_name.lower(),
                          self.realm.lower())
 
+    def test_get_dc_winbind_need_2012r2(self):
+        """Test requring that we have a FL2012R2 DC as answer
+        """
+        self.assertIsNotNone(self.trust_realm)
+
+        try:
+            response_trust = self._call_get_dc_name(domain=self.trust_realm,
+                                                flags=netlogon.DS_RETURN_DNS_NAME|netlogon.DS_DIRECTORY_SERVICE_9_REQUIRED)
+        except WERRORError as e:
+            enum, estr = e.args
+            self.fail(f"netr_DsRGetDCNameEx failed: {estr}")
+
+        self.assertTrue(response_trust.dc_unc is not None)
+        self.assertTrue(response_trust.dc_unc.startswith('\\\\'))
+        self.assertTrue(response_trust.dc_address is not None)
+        self.assertTrue(response_trust.dc_address.startswith('\\\\'))
+
+        self.assertEqual(response_trust.domain_name.lower(),
+                         self.trust_realm.lower())
+
+    def test_get_dc_direct_need_2012r2_but_not_found(self):
+        """Test requring that we have a FL2012R2 DC as answer, aginst the FL2008R2 domain
+
+        This test requires that the DC in the FL2008R2 does not claim
+        to be 2012R2 capable (off by default in Samba)
+
+        """
+        self.assertIsNotNone(self.realm)
+
+
+        try:
+            response = self._call_get_dc_name(domain=self.realm,
+                                              flags=netlogon.DS_RETURN_DNS_NAME|netlogon.DS_DIRECTORY_SERVICE_9_REQUIRED)
+
+            self.fail("Failed to detect requirement for 2012 that is not met")
+        except WERRORError as e:
+            enum, estr = e.args
+            if enum != werror.WERR_NO_SUCH_DOMAIN:
+                self.fail("Failed to detect requirement for 2012 that is not met")
+
+    def test_get_dc_direct_need_2012r2(self):
+        """Test requring that we have a FL2012R2 DC as answer
+        """
+        self.assertIsNotNone(self.trust_realm)
+
+        self.netlogon_conn = netlogon.netlogon(f"ncacn_ip_tcp:{self.trust_server}",
+                                               self.get_loadparm())
+
+        response_trust = self._call_get_dc_name(domain=self.trust_realm,
+                                                flags=netlogon.DS_RETURN_DNS_NAME|netlogon.DS_DIRECTORY_SERVICE_9_REQUIRED)
+
+        self.assertTrue(response_trust.dc_unc is not None)
+        self.assertTrue(response_trust.dc_unc.startswith('\\\\'))
+        self.assertTrue(response_trust.dc_address is not None)
+        self.assertTrue(response_trust.dc_address.startswith('\\\\'))
+
+        self.assertEqual(response_trust.domain_name.lower(),
+                         self.trust_realm.lower())
+
+    def test_get_dc_winbind_need_2012r2_but_not_found(self):
+        """Test requring that we have a FL2012R2 DC as answer, aginst the FL2008R2 domain
+
+        This test requires that the DC in the FL2008R2 does not claim
+        to be 2012R2 capable (off by default in Samba)
+
+        """
+        self.assertIsNotNone(self.realm)
+
+        self.netlogon_conn = netlogon.netlogon(f"ncacn_ip_tcp:{self.trust_server}",
+                                               self.get_loadparm())
+
+
+        try:
+            response = self._call_get_dc_name(domain=self.realm,
+                                              flags=netlogon.DS_RETURN_DNS_NAME|netlogon.DS_DIRECTORY_SERVICE_9_REQUIRED)
+
+            self.fail("Failed to detect requirement for 2012 that is not met")
+        except WERRORError as e:
+            enum, estr = e.args
+            if enum != werror.WERR_NO_SUCH_DOMAIN:
+                self.fail("Failed to detect requirement for 2012 that is not met")
+
     # TODO Thorough tests of domain GUID
     #
     # The domain GUID does not seem to be authoritative, and seems to be a

diff --git a/selftest/knownfail.d/getdcname b/selftest/knownfail.d/getdcname
new file mode 100644 (file)
index 0000000..a0091c0
--- /dev/null
+++ b/selftest/knownfail.d/getdcname
@@ -0,0 +1,3 @@
+^samba.tests.getdcname.samba.tests.getdcname.GetDCNameEx.test_get_dc_direct_need_2012r2_but_not_found
+^samba.tests.getdcname.samba.tests.getdcname.GetDCNameEx.test_get_dc_winbind_need_2012r2
+^samba.tests.getdcname.samba.tests.getdcname.GetDCNameEx.test_get_dc_winbind_need_2012r2_but_not_found