source4/torture/drs/rpc/msds_intid.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3
   4    msDS-IntId attribute replication test.
   5
   6    Copyright (C) Kamen Mazdrashki <kamenim@samba.org> 2010
   7
   8    This program is free software; you can redistribute it and/or modify
   9    it under the terms of the GNU General Public License as published by
  10    the Free Software Foundation; either version 3 of the License, or
  11    (at your option) any later version.
  12
  13    This program is distributed in the hope that it will be useful,
  14    but WITHOUT ANY WARRANTY; without even the implied warranty of
  15    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  16    GNU General Public License for more details.
  17
  18    You should have received a copy of the GNU General Public License
  19    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  20 */
  21
  22 #include "includes.h"
  23 #include "lib/cmdline/popt_common.h"
  24 #include "librpc/gen_ndr/ndr_drsuapi_c.h"
  25 #include "librpc/gen_ndr/ndr_drsblobs.h"
  26 #include "libcli/cldap/cldap.h"
  27 #include "torture/torture.h"
  28 #include "../libcli/drsuapi/drsuapi.h"
  29 #include "auth/gensec/gensec.h"
  30 #include "param/param.h"
  31 #include "dsdb/samdb/samdb.h"
  32 #include "torture/rpc/torture_rpc.h"
  33 #include "torture/drs/proto.h"
  34 #include "lib/tsocket/tsocket.h"
  35 #include "libcli/resolve/resolve.h"
  36
  37 struct DsSyncBindInfo {
  38         struct dcerpc_pipe *drs_pipe;
  39         struct dcerpc_binding_handle *drs_handle;
  40         struct drsuapi_DsBind req;
  41         struct GUID bind_guid;
  42         struct drsuapi_DsBindInfoCtr our_bind_info_ctr;
  43         struct drsuapi_DsBindInfo28 our_bind_info28;
  44         struct drsuapi_DsBindInfo28 peer_bind_info28;
  45         struct policy_handle bind_handle;
  46 };
  47
  48 struct DsaBindInfo {
  49         struct dcerpc_binding           *server_binding;
  50
  51         struct dcerpc_pipe              *drs_pipe;
  52         struct dcerpc_binding_handle    *drs_handle;
  53
  54         DATA_BLOB                       gensec_skey;
  55         struct drsuapi_DsBindInfo48     srv_info48;
  56         struct policy_handle            rpc_handle;
  57 };
  58
  59 struct DsIntIdTestCtx {
  60         const char *ldap_url;
  61         const char *domain_dn;
  62         const char *config_dn;
  63         const char *schema_dn;
  64
  65         /* what we need to do as 'Administrator' */
  66         struct cli_credentials  *creds;
  67         struct DsaBindInfo      dsa_bind;
  68         struct ldb_context      *ldb;
  69
  70 };
  71
  72 /* Format string to create provision LDIF with */
  73 #define PROVISION_LDIF_FMT \
  74                 "###########################################################\n" \
  75                 "# Format string with positional params:\n" \
  76                 "#  1 - (int) Unique ID between 1 and 2^16\n" \
  77                 "#  2 - (string) Domain DN\n" \
  78                 "###########################################################\n" \
  79                 "\n" \
  80                 "###########################################################\n" \
  81                 "# Update schema\n" \
  82                 "###########################################################\n" \
  83                 "dn: CN=msds-intid-%1$d,CN=Schema,CN=Configuration,%2$s\n" \
  84                 "changetype: add\n" \
  85                 "objectClass: top\n" \
  86                 "objectClass: attributeSchema\n" \
  87                 "cn: msds-intid-%1$d\n" \
  88                 "attributeID: 1.2.840.%1$d.1.5.9940\n" \
  89                 "attributeSyntax: 2.5.5.10\n" \
  90                 "omSyntax: 4\n" \
  91                 "instanceType: 4\n" \
  92                 "isSingleValued: TRUE\n" \
  93                 "systemOnly: FALSE\n" \
  94                 "\n" \
  95                 "# schemaUpdateNow\n" \
  96                 "DN:\n" \
  97                 "changeType: modify\n" \
  98                 "add: schemaUpdateNow\n" \
  99                 "schemaUpdateNow: 1\n" \
 100                 "-\n" \
 101                 "\n" \
 102                 "###########################################################\n" \
 103                 "# Update User class\n" \
 104                 "###########################################################\n" \
 105                 "dn: CN=User,CN=Schema,CN=Configuration,%2$s\n" \
 106                 "changetype: modify\n" \
 107                 "add: mayContain\n" \
 108                 "mayContain: msdsIntid%1$d\n" \
 109                 "-\n" \
 110                 "\n" \
 111                 "# schemaUpdateNow\n" \
 112                 "DN:\n" \
 113                 "changeType: modify\n" \
 114                 "add: schemaUpdateNow\n" \
 115                 "schemaUpdateNow: 1\n" \
 116                 "-\n" \
 117                 "\n" \
 118                 "###########################################################\n" \
 119                 "# create user to test with\n" \
 120                 "###########################################################\n" \
 121                 "dn: CN=dsIntId_usr_%1$d,CN=Users,%2$s\n" \
 122                 "changetype: add\n" \
 123                 "objectClass: user\n" \
 124                 "cn: dsIntId_usr_%1$d\n" \
 125                 "name: dsIntId_usr_%1$d\n" \
 126                 "displayName: dsIntId_usr_%1$d\n" \
 127                 "sAMAccountName: dsIntId_usr_%1$d\n" \
 128                 "msdsIntid%1$d: msDS-IntId-%1$d attribute value\n" \
 129                 "\n"
 130
 131
 132 static struct DsIntIdTestCtx *_dsintid_create_context(struct torture_context *tctx)
 133 {
 134         NTSTATUS status;
 135         struct DsIntIdTestCtx *ctx;
 136         struct dcerpc_binding *server_binding;
 137         const char *binding = torture_setting_string(tctx, "binding", NULL);
 138
 139         /* Create test suite context */
 140         ctx = talloc_zero(tctx, struct DsIntIdTestCtx);
 141         if (!ctx) {
 142                 torture_result(tctx, TORTURE_FAIL, "Not enough memory!");
 143                 return NULL;
 144         }
 145
 146         /* parse binding object */
 147         status = dcerpc_parse_binding(ctx, binding, &server_binding);
 148         if (!NT_STATUS_IS_OK(status)) {
 149                 torture_result(tctx, TORTURE_FAIL,
 150                                "Bad binding string '%s': %s", binding, nt_errstr(status));
 151                 return NULL;
 152         }
 153
 154         server_binding->flags |= DCERPC_SIGN | DCERPC_SEAL;
 155
 156         /* populate test suite context */
 157         ctx->creds = cmdline_credentials;
 158         ctx->dsa_bind.server_binding = server_binding;
 159
 160         ctx->ldap_url = talloc_asprintf(ctx, "ldap://%s", server_binding->host);
 161
 162         return ctx;
 163 }
 164
 165 static bool _test_DsaBind(struct torture_context *tctx,
 166                          TALLOC_CTX *mem_ctx,
 167                          struct cli_credentials *credentials,
 168                          uint32_t req_extensions,
 169                          struct DsaBindInfo *bi)
 170 {
 171         NTSTATUS status;
 172         struct GUID bind_guid;
 173         struct drsuapi_DsBind r;
 174         struct drsuapi_DsBindInfoCtr bind_info_ctr;
 175         uint32_t supported_extensions;
 176
 177         /* make DCE RPC connection */
 178         status = dcerpc_pipe_connect_b(mem_ctx,
 179                                        &bi->drs_pipe,
 180                                        bi->server_binding,
 181                                        &ndr_table_drsuapi,
 182                                        credentials, tctx->ev, tctx->lp_ctx);
 183         torture_assert_ntstatus_ok(tctx, status, "Failed to connect to server");
 184
 185         bi->drs_handle = bi->drs_pipe->binding_handle;
 186
 187         status = gensec_session_key(bi->drs_pipe->conn->security_state.generic_state,
 188                                     mem_ctx, &bi->gensec_skey);
 189         torture_assert_ntstatus_ok(tctx, status, "failed to get gensec session key");
 190
 191         /* Bind to DRSUAPI interface */
 192         GUID_from_string(DRSUAPI_DS_BIND_GUID_W2K3, &bind_guid);
 193
 194         /*
 195          * Add flags that should be 1, according to MS docs.
 196          * It turns out DRSUAPI_SUPPORTED_EXTENSION_POST_BETA3
 197          * is actually required in order for GetNCChanges() to
 198          * return schemaInfo entry in the prefixMap returned.
 199          * Use DRSUAPI_SUPPORTED_EXTENSION_STRONG_ENCRYPTION so
 200          * we are able to fetch sensitive data.
 201          */
 202         supported_extensions = req_extensions
 203                              | DRSUAPI_SUPPORTED_EXTENSION_BASE
 204                              | DRSUAPI_SUPPORTED_EXTENSION_RESTORE_USN_OPTIMIZATION
 205                              | DRSUAPI_SUPPORTED_EXTENSION_INSTANCE_TYPE_NOT_REQ_ON_MOD
 206                              | DRSUAPI_SUPPORTED_EXTENSION_POST_BETA3
 207                              | DRSUAPI_SUPPORTED_EXTENSION_STRONG_ENCRYPTION;
 208
 209         ZERO_STRUCT(bind_info_ctr);
 210         bind_info_ctr.length = 28;
 211         bind_info_ctr.info.info28.supported_extensions = supported_extensions;
 212
 213         r.in.bind_guid = &bind_guid;
 214         r.in.bind_info = &bind_info_ctr;
 215         r.out.bind_handle = &bi->rpc_handle;
 216
 217         status = dcerpc_drsuapi_DsBind_r(bi->drs_handle, mem_ctx, &r);
 218         torture_drsuapi_assert_call(tctx, bi->drs_pipe, status,
 219                                     &r, "dcerpc_drsuapi_DsBind_r");
 220
 221
 222         switch (r.out.bind_info->length) {
 223         case 24: {
 224                 struct drsuapi_DsBindInfo24 *info24;
 225                 info24 = &r.out.bind_info->info.info24;
 226                 bi->srv_info48.supported_extensions     = info24->supported_extensions;
 227                 bi->srv_info48.site_guid                = info24->site_guid;
 228                 bi->srv_info48.pid                      = info24->pid;
 229                 break;
 230         }
 231         case 28: {
 232                 struct drsuapi_DsBindInfo28 *info28;
 233                 info28 = &r.out.bind_info->info.info28;
 234                 bi->srv_info48.supported_extensions     = info28->supported_extensions;
 235                 bi->srv_info48.site_guid                = info28->site_guid;
 236                 bi->srv_info48.pid                      = info28->pid;
 237                 bi->srv_info48.repl_epoch               = info28->repl_epoch;
 238                 break;
 239         }
 240         case 48: {
 241                 bi->srv_info48 = r.out.bind_info->info.info48;
 242                 break;
 243         }
 244         case 32: {
 245                 struct drsuapi_DsBindInfo32 *info32;
 246                 info32 = &r.out.bind_info->info.info32;
 247                 bi->srv_info48.supported_extensions     = info32->supported_extensions;
 248                 bi->srv_info48.site_guid                = info32->site_guid;
 249                 bi->srv_info48.pid                      = info32->pid;
 250                 bi->srv_info48.repl_epoch               = info32->repl_epoch;
 251                 break;
 252         }
 253         case 52: {
 254                 struct drsuapi_DsBindInfo52 *info52;
 255                 info52 = &r.out.bind_info->info.info52;
 256                 bi->srv_info48.supported_extensions     = info52->supported_extensions;
 257                 bi->srv_info48.site_guid                = info52->site_guid;
 258                 bi->srv_info48.pid                      = info52->pid;
 259                 bi->srv_info48.repl_epoch               = info52->repl_epoch;
 260                 break;
 261         }
 262         default:
 263                 torture_result(tctx, TORTURE_FAIL,
 264                                "DsBind: unknown BindInfo length: %u",
 265                                r.out.bind_info->length);
 266                 return false;
 267         }
 268
 269         /* check if server supports extensions we've requested */
 270         if ((bi->srv_info48.supported_extensions & req_extensions) != req_extensions) {
 271                 torture_result(tctx, TORTURE_FAIL,
 272                                "Server does not support requested extensions. "
 273                                "Requested: 0x%08X, Supported: 0x%08X",
 274                                req_extensions, bi->srv_info48.supported_extensions);
 275                 return false;
 276         }
 277
 278         return true;
 279 }
 280
 281 static bool _test_LDAPBind(struct torture_context *tctx,
 282                            TALLOC_CTX *mem_ctx,
 283                            struct cli_credentials *credentials,
 284                            const char *ldap_url,
 285                            struct ldb_context **_ldb)
 286 {
 287         bool ret = true;
 288
 289         struct ldb_context *ldb;
 290
 291         const char *modules_option[] = { "modules:paged_searches", NULL };
 292         ldb = ldb_init(mem_ctx, tctx->ev);
 293         if (ldb == NULL) {
 294                 return false;
 295         }
 296
 297         /* Despite us loading the schema from the AD server, we need
 298          * the samba handlers to get the extended DN syntax stuff */
 299         ret = ldb_register_samba_handlers(ldb);
 300         if (ret != LDB_SUCCESS) {
 301                 talloc_free(ldb);
 302                 return NULL;
 303         }
 304
 305         ldb_set_modules_dir(ldb, modules_path(ldb, "ldb"));
 306
 307         if (ldb_set_opaque(ldb, "credentials", credentials) != LDB_SUCCESS) {
 308                 talloc_free(ldb);
 309                 return NULL;
 310         }
 311
 312         if (ldb_set_opaque(ldb, "loadparm", tctx->lp_ctx) != LDB_SUCCESS) {
 313                 talloc_free(ldb);
 314                 return NULL;
 315         }
 316
 317         ret = ldb_connect(ldb, ldap_url, 0, modules_option);
 318         if (ret != LDB_SUCCESS) {
 319                 talloc_free(ldb);
 320                 torture_assert_int_equal(tctx, ret, LDB_SUCCESS, "Failed to make LDB connection to target");
 321         }
 322
 323         *_ldb = ldb;
 324
 325         return true;
 326 }
 327
 328 static bool _test_provision(struct torture_context *tctx, struct DsIntIdTestCtx *ctx)
 329 {
 330         int ret;
 331         char *ldif_str;
 332         const char *pstr;
 333         struct ldb_ldif *ldif;
 334         uint32_t attr_id;
 335         struct ldb_context *ldb = ctx->ldb;
 336
 337         /* We must have LDB connection ready by this time */
 338         SMB_ASSERT(ldb != NULL);
 339
 340         ctx->domain_dn = ldb_dn_get_linearized(ldb_get_default_basedn(ldb));
 341         torture_assert(tctx, ctx->domain_dn != NULL, "Failed to get Domain DN");
 342
 343         ctx->config_dn = ldb_dn_get_linearized(ldb_get_config_basedn(ldb));
 344         torture_assert(tctx, ctx->config_dn != NULL, "Failed to get Domain DN");
 345
 346         ctx->schema_dn = ldb_dn_get_linearized(ldb_get_schema_basedn(ldb));
 347         torture_assert(tctx, ctx->schema_dn != NULL, "Failed to get Domain DN");
 348
 349         /* prepare LDIF to provision with */
 350         attr_id = generate_random() % 0xFFFF;
 351         pstr = ldif_str = talloc_asprintf(ctx, PROVISION_LDIF_FMT,
 352                                           attr_id, ctx->domain_dn);
 353
 354         /* Provision test data */
 355         while ((ldif = ldb_ldif_read_string(ldb, &pstr)) != NULL) {
 356                 switch (ldif->changetype) {
 357                 case LDB_CHANGETYPE_DELETE:
 358                         ret = ldb_delete(ldb, ldif->msg->dn);
 359                         break;
 360                 case LDB_CHANGETYPE_MODIFY:
 361                         ret = ldb_modify(ldb, ldif->msg);
 362                         break;
 363                 case LDB_CHANGETYPE_ADD:
 364                 default:
 365                         ret = ldb_add(ldb, ldif->msg);
 366                         break;
 367                 }
 368                 if (ret != LDB_SUCCESS) {
 369                         char *msg = talloc_asprintf(ctx,
 370                                                     "Failed to apply ldif - %s (%s): \n%s",
 371                                                     ldb_errstring(ldb),
 372                                                     ldb_strerror(ret),
 373                                                     ldb_ldif_write_string(ldb, ctx, ldif));
 374                         torture_fail(tctx, msg);
 375
 376                 }
 377                 ldb_ldif_read_free(ldb, ldif);
 378         }
 379
 380         return true;
 381 }
 382
 383
 384 static bool _test_GetNCChanges(struct torture_context *tctx,
 385                                struct DsaBindInfo *bi,
 386                                const char *nc_dn_str,
 387                                TALLOC_CTX *mem_ctx,
 388                                struct drsuapi_DsGetNCChangesCtr6 **_ctr6)
 389 {
 390         NTSTATUS status;
 391         struct drsuapi_DsGetNCChanges r;
 392         union drsuapi_DsGetNCChangesRequest req;
 393         struct drsuapi_DsReplicaObjectIdentifier nc;
 394         struct drsuapi_DsGetNCChangesCtr6 *ctr6_chunk = NULL;
 395         struct drsuapi_DsGetNCChangesCtr6 ctr6;
 396         uint32_t _level = 0;
 397         union drsuapi_DsGetNCChangesCtr ctr;
 398
 399         struct dom_sid null_sid;
 400
 401         ZERO_STRUCT(null_sid);
 402
 403         /* fill-in Naming Context */
 404         nc.guid = GUID_zero();
 405         nc.sid  = null_sid;
 406         nc.dn   = nc_dn_str;
 407
 408         /* fill-in request fields */
 409         req.req8.destination_dsa_guid           = GUID_random();
 410         req.req8.source_dsa_invocation_id       = GUID_zero();
 411         req.req8.naming_context                 = &nc;
 412         req.req8.highwatermark.tmp_highest_usn  = 0;
 413         req.req8.highwatermark.reserved_usn     = 0;
 414         req.req8.highwatermark.highest_usn      = 0;
 415         req.req8.uptodateness_vector            = NULL;
 416         req.req8.replica_flags                  = DRSUAPI_DRS_WRIT_REP
 417                                                 | DRSUAPI_DRS_INIT_SYNC
 418                                                 | DRSUAPI_DRS_PER_SYNC
 419                                                 | DRSUAPI_DRS_GET_ANC
 420                                                 | DRSUAPI_DRS_NEVER_SYNCED
 421                                                 ;
 422         req.req8.max_object_count               = 402;
 423         req.req8.max_ndr_size                   = 402116;
 424
 425         req.req8.extended_op                    = DRSUAPI_EXOP_NONE;
 426         req.req8.fsmo_info                      = 0;
 427         req.req8.partial_attribute_set          = NULL;
 428         req.req8.partial_attribute_set_ex       = NULL;
 429         req.req8.mapping_ctr.num_mappings       = 0;
 430         req.req8.mapping_ctr.mappings           = NULL;
 431
 432         r.in.bind_handle        = &bi->rpc_handle;
 433         r.in.level              = 8;
 434         r.in.req                = &req;
 435
 436         ZERO_STRUCT(r.out);
 437         r.out.level_out         = &_level;
 438         r.out.ctr               = &ctr;
 439
 440         ZERO_STRUCT(ctr6);
 441         do {
 442                 ZERO_STRUCT(ctr);
 443
 444                 status = dcerpc_drsuapi_DsGetNCChanges_r(bi->drs_handle, mem_ctx, &r);
 445                 torture_drsuapi_assert_call(tctx, bi->drs_pipe, status,
 446                                             &r, "dcerpc_drsuapi_DsGetNCChanges_r");
 447
 448                 /* we expect to get level 6 reply */
 449                 torture_assert_int_equal(tctx, _level, 6, "Expected level 6 reply");
 450
 451                 /* store this chunk for later use */
 452                 ctr6_chunk = &r.out.ctr->ctr6;
 453
 454                 if (!ctr6.first_object) {
 455                         ctr6 = *ctr6_chunk;
 456                 } else {
 457                         struct drsuapi_DsReplicaObjectListItemEx *cur;
 458
 459                         ctr6.object_count += ctr6_chunk->object_count;
 460                         for (cur = ctr6.first_object; cur->next_object; cur = cur->next_object) {}
 461                         cur->next_object = ctr6_chunk->first_object;
 462
 463                         /* TODO: store the chunk of linked_attributes if needed */
 464                 }
 465
 466                 /* prepare for next request */
 467                 r.in.req->req8.highwatermark = ctr6_chunk->new_highwatermark;
 468
 469         } while (ctr6_chunk->more_data);
 470
 471         *_ctr6 = talloc(mem_ctx, struct drsuapi_DsGetNCChangesCtr6);
 472         torture_assert(mem_ctx, *_ctr6, "Not enough memory");
 473         **_ctr6 = ctr6;
 474
 475         return true;
 476 }
 477
 478 static char * _make_error_message(TALLOC_CTX *mem_ctx,
 479                                   enum drsuapi_DsAttributeId drs_attid,
 480                                   const struct dsdb_attribute *dsdb_attr,
 481                                   const struct drsuapi_DsReplicaObjectIdentifier *identifier)
 482 {
 483         return talloc_asprintf(mem_ctx, "\nInvalid ATTID for %1$s (%2$s)\n"
 484                                " drs_attid:      %3$11d (0x%3$08X)\n"
 485                                " msDS_IntId:     %4$11d (0x%4$08X)\n"
 486                                " attributeId_id: %5$11d (0x%5$08X)",
 487                                dsdb_attr->lDAPDisplayName,
 488                                identifier->dn,
 489                                drs_attid,
 490                                dsdb_attr->msDS_IntId,
 491                                dsdb_attr->attributeID_id);
 492 }
 493
 494 /**
 495  * Fetch Schema NC and check ATTID values returned.
 496  * When Schema partition is replicated, ATTID
 497  * should always be made using prefixMap
 498  */
 499 static bool test_dsintid_schema(struct torture_context *tctx, struct DsIntIdTestCtx *ctx)
 500 {
 501         uint32_t i;
 502         const struct dsdb_schema *ldap_schema;
 503         struct drsuapi_DsGetNCChangesCtr6 *ctr6 = NULL;
 504         const struct dsdb_attribute *dsdb_attr;
 505         const struct drsuapi_DsReplicaAttribute *drs_attr;
 506         const struct drsuapi_DsReplicaAttributeCtr *attr_ctr;
 507         const struct drsuapi_DsReplicaObjectListItemEx *cur;
 508         const struct drsuapi_DsReplicaLinkedAttribute *la;
 509         TALLOC_CTX *mem_ctx;
 510
 511         mem_ctx = talloc_new(ctx);
 512         torture_assert(tctx, mem_ctx, "Not enough memory");
 513
 514         /* fetch whole Schema partition */
 515         torture_comment(tctx, "Fetch partition: %s\n", ctx->schema_dn);
 516         if (!_test_GetNCChanges(tctx, &ctx->dsa_bind, ctx->schema_dn, mem_ctx, &ctr6)) {
 517                 torture_fail(tctx, "_test_GetNCChanges() failed");
 518         }
 519
 520         /* load schema if not loaded yet */
 521         torture_comment(tctx, "Loading schema...\n");
 522         if (!drs_util_dsdb_schema_load_ldb(tctx, ctx->ldb, &ctr6->mapping_ctr, false)) {
 523                 torture_fail(tctx, "drs_util_dsdb_schema_load_ldb() failed");
 524         }
 525         ldap_schema = dsdb_get_schema(ctx->ldb, NULL);
 526
 527         /* verify ATTIDs fetched */
 528         torture_comment(tctx, "Verify ATTIDs fetched\n");
 529         for (cur = ctr6->first_object; cur; cur = cur->next_object) {
 530                 attr_ctr = &cur->object.attribute_ctr;
 531                 for (i = 0; i < attr_ctr->num_attributes; i++) {
 532                         drs_attr = &attr_ctr->attributes[i];
 533                         dsdb_attr = dsdb_attribute_by_attributeID_id(ldap_schema,
 534                                                                      drs_attr->attid);
 535
 536                         torture_assert(tctx,
 537                                        drs_attr->attid == dsdb_attr->attributeID_id,
 538                                        _make_error_message(ctx, drs_attr->attid,
 539                                                            dsdb_attr,
 540                                                            cur->object.identifier));
 541                         if (dsdb_attr->msDS_IntId) {
 542                                 torture_assert(tctx,
 543                                                drs_attr->attid != dsdb_attr->msDS_IntId,
 544                                                _make_error_message(ctx, drs_attr->attid,
 545                                                                    dsdb_attr,
 546                                                                    cur->object.identifier));
 547                         }
 548                 }
 549         }
 550
 551         /* verify ATTIDs for Linked Attributes */
 552         torture_comment(tctx, "Verify ATTIDs for Linked Attributes (%u)\n",
 553                         ctr6->linked_attributes_count);
 554         for (i = 0; i < ctr6->linked_attributes_count; i++) {
 555                 la = &ctr6->linked_attributes[i];
 556                 dsdb_attr = dsdb_attribute_by_attributeID_id(ldap_schema, la->attid);
 557
 558                 torture_assert(tctx,
 559                                la->attid == dsdb_attr->attributeID_id,
 560                                _make_error_message(ctx, la->attid,
 561                                                    dsdb_attr,
 562                                                    la->identifier))
 563                 if (dsdb_attr->msDS_IntId) {
 564                         torture_assert(tctx,
 565                                        la->attid != dsdb_attr->msDS_IntId,
 566                                        _make_error_message(ctx, la->attid,
 567                                                            dsdb_attr,
 568                                                            la->identifier))
 569                 }
 570         }
 571
 572         talloc_free(mem_ctx);
 573
 574         return true;
 575 }
 576
 577 /**
 578  * Fetch non-Schema NC and check ATTID values returned.
 579  * When non-Schema partition is replicated, ATTID
 580  * should be msDS-IntId value for the attribute
 581  * if this value exists
 582  */
 583 static bool _test_dsintid(struct torture_context *tctx,
 584                           struct DsIntIdTestCtx *ctx,
 585                           const char *nc_dn_str)
 586 {
 587         uint32_t i;
 588         const struct dsdb_schema *ldap_schema;
 589         struct drsuapi_DsGetNCChangesCtr6 *ctr6 = NULL;
 590         const struct dsdb_attribute *dsdb_attr;
 591         const struct drsuapi_DsReplicaAttribute *drs_attr;
 592         const struct drsuapi_DsReplicaAttributeCtr *attr_ctr;
 593         const struct drsuapi_DsReplicaObjectListItemEx *cur;
 594         const struct drsuapi_DsReplicaLinkedAttribute *la;
 595         TALLOC_CTX *mem_ctx;
 596
 597         mem_ctx = talloc_new(ctx);
 598         torture_assert(tctx, mem_ctx, "Not enough memory");
 599
 600         /* fetch whole Schema partition */
 601         torture_comment(tctx, "Fetch partition: %s\n", nc_dn_str);
 602         if (!_test_GetNCChanges(tctx, &ctx->dsa_bind, nc_dn_str, mem_ctx, &ctr6)) {
 603                 torture_fail(tctx, "_test_GetNCChanges() failed");
 604         }
 605
 606         /* load schema if not loaded yet */
 607         torture_comment(tctx, "Loading schema...\n");
 608         if (!drs_util_dsdb_schema_load_ldb(tctx, ctx->ldb, &ctr6->mapping_ctr, false)) {
 609                 torture_fail(tctx, "drs_util_dsdb_schema_load_ldb() failed");
 610         }
 611         ldap_schema = dsdb_get_schema(ctx->ldb, NULL);
 612
 613         /* verify ATTIDs fetched */
 614         torture_comment(tctx, "Verify ATTIDs fetched\n");
 615         for (cur = ctr6->first_object; cur; cur = cur->next_object) {
 616                 attr_ctr = &cur->object.attribute_ctr;
 617                 for (i = 0; i < attr_ctr->num_attributes; i++) {
 618                         drs_attr = &attr_ctr->attributes[i];
 619                         dsdb_attr = dsdb_attribute_by_attributeID_id(ldap_schema,
 620                                                                      drs_attr->attid);
 621                         if (dsdb_attr->msDS_IntId) {
 622                                 torture_assert(tctx,
 623                                                drs_attr->attid == dsdb_attr->msDS_IntId,
 624                                                _make_error_message(ctx, drs_attr->attid,
 625                                                                    dsdb_attr,
 626                                                                    cur->object.identifier));
 627                         } else {
 628                                 torture_assert(tctx,
 629                                                drs_attr->attid == dsdb_attr->attributeID_id,
 630                                                _make_error_message(ctx, drs_attr->attid,
 631                                                                    dsdb_attr,
 632                                                                    cur->object.identifier));
 633                         }
 634                 }
 635         }
 636
 637         /* verify ATTIDs for Linked Attributes */
 638         torture_comment(tctx, "Verify ATTIDs for Linked Attributes (%u)\n",
 639                         ctr6->linked_attributes_count);
 640         for (i = 0; i < ctr6->linked_attributes_count; i++) {
 641                 la = &ctr6->linked_attributes[i];
 642                 dsdb_attr = dsdb_attribute_by_attributeID_id(ldap_schema, la->attid);
 643
 644                 if (dsdb_attr->msDS_IntId) {
 645                         torture_assert(tctx,
 646                                        la->attid == dsdb_attr->msDS_IntId,
 647                                        _make_error_message(ctx, la->attid,
 648                                                            dsdb_attr,
 649                                                            la->identifier));
 650                 } else {
 651                         torture_assert(tctx,
 652                                        la->attid == dsdb_attr->attributeID_id,
 653                                        _make_error_message(ctx, la->attid,
 654                                                            dsdb_attr,
 655                                                            la->identifier));
 656                 }
 657         }
 658
 659         talloc_free(mem_ctx);
 660
 661         return true;
 662 }
 663
 664 /**
 665  * Fetch Domain NC and check ATTID values returned.
 666  * When Domain partition is replicated, ATTID
 667  * should be msDS-IntId value for the attribute
 668  * if this value exists
 669  */
 670 static bool test_dsintid_configuration(struct torture_context *tctx, struct DsIntIdTestCtx *ctx)
 671 {
 672         return _test_dsintid(tctx, ctx, ctx->config_dn);
 673 }
 674
 675 /**
 676  * Fetch Configuration NC and check ATTID values returned.
 677  * When Configuration partition is replicated, ATTID
 678  * should be msDS-IntId value for the attribute
 679  * if this value exists
 680  */
 681 static bool test_dsintid_domain(struct torture_context *tctx, struct DsIntIdTestCtx *ctx)
 682 {
 683         return _test_dsintid(tctx, ctx, ctx->domain_dn);
 684 }
 685
 686
 687 /**
 688  * DSSYNC test case setup
 689  */
 690 static bool torture_dsintid_tcase_setup(struct torture_context *tctx, void **data)
 691 {
 692         bool bret;
 693         struct DsIntIdTestCtx *ctx;
 694
 695         *data = ctx = _dsintid_create_context(tctx);
 696         torture_assert(tctx, ctx, "test_create_context() failed");
 697
 698         bret = _test_DsaBind(tctx, ctx, ctx->creds,
 699                              DRSUAPI_SUPPORTED_EXTENSION_GETCHGREQ_V8 |
 700                              DRSUAPI_SUPPORTED_EXTENSION_GETCHGREPLY_V6,
 701                              &ctx->dsa_bind);
 702         torture_assert(tctx, bret, "_test_DsaBind() failed");
 703
 704         bret = _test_LDAPBind(tctx, ctx, ctx->creds, ctx->ldap_url, &ctx->ldb);
 705         torture_assert(tctx, bret, "_test_LDAPBind() failed");
 706
 707         bret = _test_provision(tctx, ctx);
 708         torture_assert(tctx, bret, "_test_provision() failed");
 709
 710         return true;
 711 }
 712
 713 /**
 714  * DSSYNC test case cleanup
 715  */
 716 static bool torture_dsintid_tcase_teardown(struct torture_context *tctx, void *data)
 717 {
 718         struct DsIntIdTestCtx *ctx;
 719         struct drsuapi_DsUnbind r;
 720         struct policy_handle bind_handle;
 721
 722         ctx = talloc_get_type(data, struct DsIntIdTestCtx);
 723
 724         ZERO_STRUCT(r);
 725         r.out.bind_handle = &bind_handle;
 726
 727         /* Release DRSUAPI handle */
 728         r.in.bind_handle = &ctx->dsa_bind.rpc_handle;
 729         dcerpc_drsuapi_DsUnbind_r(ctx->dsa_bind.drs_handle, ctx, &r);
 730
 731         talloc_free(ctx);
 732
 733         return true;
 734 }
 735
 736 /**
 737  * DSSYNC test case implementation
 738  */
 739 void torture_drs_rpc_dsintid_tcase(struct torture_suite *suite)
 740 {
 741         typedef bool (*run_func) (struct torture_context *test, void *tcase_data);
 742
 743         struct torture_test *test;
 744         struct torture_tcase *tcase = torture_suite_add_tcase(suite, "msDSIntId");
 745
 746         torture_tcase_set_fixture(tcase,
 747                                   torture_dsintid_tcase_setup,
 748                                   torture_dsintid_tcase_teardown);
 749
 750         test = torture_tcase_add_simple_test(tcase, "Schema", (run_func)test_dsintid_schema);
 751         test = torture_tcase_add_simple_test(tcase, "Configuration", (run_func)test_dsintid_configuration);
 752         test = torture_tcase_add_simple_test(tcase, "Domain", (run_func)test_dsintid_domain);
 753 }