The branch, master has been updated via 163ed44... s4/drs: DsReplicaSync should search partition to Sync via e40635c... s4/utils: fix few 'net drs replicate' error messages via 0dd6a75... s4/drs-test: Tests Deleted objects replication from e0aa54d... selftest: Store the output of the last test run in st/subunit.
http://gitweb.samba.org/?p=samba.git;a=shortlog;h=master - Log ----------------------------------------------------------------- commit 163ed44903fd6d9bf3047d0987bcbb8f0a28e7e2 Author: Kamen Mazdrashki <kame...@samba.org> Date: Fri Jun 25 04:34:42 2010 +0300 s4/drs: DsReplicaSync should search partition to Sync by any valid DSName attribute given, be it - partition DN, partition GUID or partition SID commit e40635c48d4b5853cbf463455e2ec90178375100 Author: Kamen Mazdrashki <kame...@samba.org> Date: Fri Jun 25 04:31:41 2010 +0300 s4/utils: fix few 'net drs replicate' error messages mainly for the output to be more informative commit 0dd6a759ed41960500e0869bfe96d93b2d11f50a Author: Kamen Mazdrashki <kame...@samba.org> Date: Fri Jun 25 04:30:21 2010 +0300 s4/drs-test: Tests Deleted objects replication Tests how deleted objects are replicated between two DCs. Currently the test exploits following vulnerabilities: - DsReplicaSync is not correctly implemented - a 'deleted object' is restored (kind of) in case DC1 replicates from DC2 before the 'deleted object' is replicated ----------------------------------------------------------------------- Summary of changes: source4/dsdb/repl/drepl_out_pull.c | 29 ++++ source4/dsdb/repl/drepl_service.c | 15 +- source4/torture/drs/python/delete_object.py | 222 +++++++++++++++++++++++++++ source4/utils/net/drs/net_drs_replicate.c | 14 +- 4 files changed, 268 insertions(+), 12 deletions(-) create mode 100755 source4/torture/drs/python/delete_object.py Changeset truncated at 500 lines: diff --git a/source4/dsdb/repl/drepl_out_pull.c b/source4/dsdb/repl/drepl_out_pull.c index 329b298..c82b48d 100644 --- a/source4/dsdb/repl/drepl_out_pull.c +++ b/source4/dsdb/repl/drepl_out_pull.c @@ -32,6 +32,7 @@ #include "librpc/gen_ndr/ndr_drsuapi.h" #include "librpc/gen_ndr/ndr_drsblobs.h" #include "libcli/composite/composite.h" +#include "libcli/security/dom_sid.h" WERROR dreplsrv_schedule_partition_pull_source(struct dreplsrv_service *s, struct dreplsrv_partition_source_dsa *source, @@ -99,6 +100,34 @@ WERROR dreplsrv_schedule_partition_pull_by_guid(struct dreplsrv_service *s, TALL return WERR_NOT_FOUND; } +/* force an immediate of the specified partition by Naming Context */ +WERROR dreplsrv_schedule_partition_pull_by_nc(struct dreplsrv_service *s, TALLOC_CTX *mem_ctx, + struct drsuapi_DsReplicaObjectIdentifier *nc) +{ + struct dreplsrv_partition *p; + bool valid_sid, valid_guid; + struct dom_sid null_sid; + ZERO_STRUCT(null_sid); + + valid_sid = !dom_sid_equal(&null_sid, &nc->sid); + valid_guid = !GUID_all_zero(&nc->guid); + + if (!valid_sid && !valid_guid && !nc->dn) { + return WERR_DS_DRA_INVALID_PARAMETER; + } + + for (p = s->partitions; p; p = p->next) { + if ((valid_guid && GUID_equal(&p->nc.guid, &nc->guid)) + || strequal(p->nc.dn, nc->dn) + || (valid_sid && dom_sid_equal(&p->nc.sid, &nc->sid))) { + return dreplsrv_schedule_partition_pull(s, p, mem_ctx); + } + } + + return WERR_DS_DRA_BAD_NC; +} + + static void dreplsrv_pending_op_callback(struct tevent_req *subreq) { struct dreplsrv_out_operation *op = tevent_req_callback_data(subreq, diff --git a/source4/dsdb/repl/drepl_service.c b/source4/dsdb/repl/drepl_service.c index 59436d6..e48ae3e 100644 --- a/source4/dsdb/repl/drepl_service.c +++ b/source4/dsdb/repl/drepl_service.c @@ -110,16 +110,19 @@ static NTSTATUS drepl_replica_sync(struct irpc_message *msg, { struct dreplsrv_service *service = talloc_get_type(msg->private_data, struct dreplsrv_service); - struct GUID *guid = &r->in.req->req1.naming_context->guid; + struct drsuapi_DsReplicaObjectIdentifier *nc = r->in.req->req1.naming_context; - r->out.result = dreplsrv_schedule_partition_pull_by_guid(service, msg, guid); + r->out.result = dreplsrv_schedule_partition_pull_by_nc(service, msg, nc); if (W_ERROR_IS_OK(r->out.result)) { - DEBUG(3,("drepl_replica_sync: forcing sync of partition %s\n", - GUID_string(msg, guid))); + DEBUG(3,("drepl_replica_sync: forcing sync of partition (%s, %s)\n", + GUID_string(msg, &nc->guid), + nc->dn)); dreplsrv_run_pending_ops(service); } else { - DEBUG(3,("drepl_replica_sync: failed setup of sync of partition %s - %s\n", - GUID_string(msg, guid), win_errstr(r->out.result))); + DEBUG(3,("drepl_replica_sync: failed setup of sync of partition (%s, %s) - %s\n", + GUID_string(msg, &nc->guid), + nc->dn, + win_errstr(r->out.result))); } return NT_STATUS_OK; } diff --git a/source4/torture/drs/python/delete_object.py b/source4/torture/drs/python/delete_object.py new file mode 100755 index 0000000..6b75b80 --- /dev/null +++ b/source4/torture/drs/python/delete_object.py @@ -0,0 +1,222 @@ +#!/usr/bin/env python +# -*- coding: utf-8 -*- +# +# Unix SMB/CIFS implementation. +# Copyright (C) Kamen Mazdrashki <kame...@samba.org> 2010 +# +# This program is free software; you can redistribute it and/or modify +# it under the terms of the GNU General Public License as published by +# the Free Software Foundation; either version 3 of the License, or +# (at your option) any later version. +# +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with this program. If not, see <http://www.gnu.org/licenses/>. +# + +# +# Usage: +# export DC1=dc1_dns_name +# export DC2=dc2_dns_name +# export SUBUNITRUN=$samba4srcdir/scripting/bin/subunitrun +# PYTHONPATH="$PYTHONPATH:$samba4srcdir/torture/drs/python" $SUBUNITRUN delete_object -U"$DOMAIN/$DC_USERNAME"%"$DC_PASSWORD" +# + +import sys +import time +import os + +sys.path.append("bin/python") + +from samba.auth import system_session +from ldb import SCOPE_BASE, SCOPE_SUBTREE +from samba.samdb import SamDB + +import samba.tests + + +class DrsDeleteObjectTestCase(samba.tests.TestCase): + + # RootDSE msg for DC1 + info_dc1 = None + ldb_dc1 = None + # RootDSE msg for DC1 + info_dc2 = None + ldb_dc2 = None + + def setUp(self): + super(DrsDeleteObjectTestCase, self).setUp() + + # connect to DCs singleton + if self.ldb_dc1 is None: + DrsDeleteObjectTestCase.dc1 = get_env_var("DC1") + DrsDeleteObjectTestCase.ldb_dc1 = connect_samdb(self.dc1) + if self.ldb_dc2 is None: + DrsDeleteObjectTestCase.dc2 = get_env_var("DC2") + DrsDeleteObjectTestCase.ldb_dc2 = connect_samdb(self.dc2) + + # fetch rootDSEs + if self.info_dc1 is None: + ldb = self.ldb_dc1 + res = ldb.search(base="", expression="", scope=SCOPE_BASE, attrs=["*"]) + self.assertEquals(len(res), 1) + DrsDeleteObjectTestCase.info_dc1 = res[0] + if self.info_dc2 is None: + ldb = self.ldb_dc2 + res = ldb.search(base="", expression="", scope=SCOPE_BASE, attrs=["*"]) + self.assertEquals(len(res), 1) + DrsDeleteObjectTestCase.info_dc2 = res[0] + + # cache some of RootDSE props + self.schema_dn = self.info_dc1["schemaNamingContext"][0] + self.domain_dn = self.info_dc1["defaultNamingContext"][0] + self.config_dn = self.info_dc1["configurationNamingContext"][0] + self.forest_level = int(self.info_dc1["forestFunctionality"][0]) + + # we will need DCs DNS names for 'net drs' command + self.dnsname_dc1 = self.info_dc1["dnsHostName"][0] + self.dnsname_dc2 = self.info_dc2["dnsHostName"][0] + pass + + def test_noop(self): + pass + + def tearDown(self): + super(DrsDeleteObjectTestCase, self).tearDown() + + def _GUID_string(self, guid): + return self.ldb_dc1.schema_format_value("objectGUID", guid) + + def _deleted_objects_dn(self, sam_ldb): + wkdn = "<WKGUID=18E2EA80684F11D2B9AA00C04F79F805,%s>" % self.domain_dn + res = sam_ldb.search(base=wkdn, + scope=SCOPE_BASE, + controls=["show_deleted:1"]) + self.assertEquals(len(res), 1) + return str(res[0]["dn"]) + + def _make_username(self): + return "DrsDelObjUser_" + time.strftime("%s", time.gmtime()) + + def _check_user(self, sam_ldb, user_orig, is_deleted): + # search the user by guid as it may be deleted + guid_str = self._GUID_string(user_orig["objectGUID"][0]) + expression = "(objectGUID=%s)" % guid_str + res = sam_ldb.search(base=self.domain_dn, + expression=expression, + controls=["show_deleted:1"]) + self.assertEquals(len(res), 1) + user_cur = res[0] + # Deleted Object base DN + dodn = self._deleted_objects_dn(sam_ldb) + # now check properties of the user + name_orig = user_orig["cn"][0] + name_cur = user_cur["cn"][0] + if is_deleted: + self.assertEquals(user_cur["isDeleted"][0],"TRUE") + self.assertTrue(not("objectCategory" in user_cur)) + self.assertTrue(not("sAMAccountType" in user_cur)) + self.assertTrue(dodn in str(user_cur["dn"]), + "User %s is deleted but it is not located under %s!" % (name_orig, dodn)) + self.assertEquals(name_cur, name_orig + "\nDEL:" + guid_str) + else: + self.assertTrue(not("isDeleted" in user_cur)) + self.assertEquals(name_cur, name_orig) + self.assertEquals(user_orig["dn"], user_cur["dn"]) + self.assertTrue(dodn not in str(user_cur["dn"])) + pass + + def _net_drs_replicate(self, DC, fromDC): + # find out where is net command + net_cmd = os.path.abspath("./bin/net") + # make command line credentials string + creds = samba.tests.cmdline_credentials + cmd_line_auth = "-U%s/%s%%%s" % (creds.get_domain(), + creds.get_username(), creds.get_password()) + # bin/net drs replicate <Dest_DC_NAME> <Src_DC_NAME> <Naming Context> + cmd_line = "%s drs replicate %s %s %s %s" % (net_cmd, DC, fromDC, + self.domain_dn, cmd_line_auth) + ret = os.system(cmd_line) + self.assertEquals(ret, 0, "Replicating %s from %s has failed!" % (DC, fromDC)) + pass + + + def test_NetReplicateCmd(self): + # replicate Domain NC on DC2 from DC1 + self._net_drs_replicate(DC=self.dc2, fromDC=self.dc1) + # replicate Domain NC on DC1 from DC2 + self._net_drs_replicate(DC=self.dc1, fromDC=self.dc2) + pass + + def test_ReplicateDeteleteObject(self): + # work-out unique username to test with + username = self._make_username() + + # create user on DC1 + self.ldb_dc1.newuser(username=username, password="p...@ssword!") + ldb_res = self.ldb_dc1.search(base=self.domain_dn, + scope=SCOPE_SUBTREE, + expression="(samAccountName=%s)" % username) + self.assertEquals(len(ldb_res), 1) + user_orig = ldb_res[0] + user_dn = ldb_res[0]["dn"] + + # check user info on DC1 + print "Testing for %s with GUID %s" % (username, self._GUID_string(user_orig["objectGUID"][0])) + self._check_user(sam_ldb=self.ldb_dc1, user_orig=user_orig, is_deleted=False) + + # trigger replication from DC1 to DC2 + self._net_drs_replicate(DC=self.dc2, fromDC=self.dc1) + + # delete user on DC1 + self.ldb_dc1.delete(user_dn) + # check user info on DC1 - should be deleted + self._check_user(sam_ldb=self.ldb_dc1, user_orig=user_orig, is_deleted=True) + # check user info on DC2 - should be valid user + self._check_user(sam_ldb=self.ldb_dc2, user_orig=user_orig, is_deleted=False) + + # trigger replication from DC2 to DC1 + # to check if deleted object gets restored + self._net_drs_replicate(DC=self.dc1, fromDC=self.dc2) + # check user info on DC1 - should be deleted + self._check_user(sam_ldb=self.ldb_dc1, user_orig=user_orig, is_deleted=True) + # check user info on DC2 - should be valid user + self._check_user(sam_ldb=self.ldb_dc2, user_orig=user_orig, is_deleted=False) + + # trigger replication from DC1 to DC2 + # to check if deleted object is replicated + self._net_drs_replicate(DC=self.dc2, fromDC=self.dc1) + # check user info on DC1 - should be deleted + self._check_user(sam_ldb=self.ldb_dc1, user_orig=user_orig, is_deleted=True) + # check user info on DC2 - should be deleted + self._check_user(sam_ldb=self.ldb_dc2, user_orig=user_orig, is_deleted=True) + pass + + + +######################################################################################## +def get_env_var(var_name): + if not var_name in os.environ.keys(): + raise AssertionError("Please supply %s in environment" % var_name) + return os.environ[var_name] + +def connect_samdb(samdb_url): + ldb_options = [] + if not "://" in samdb_url: + if os.path.isfile(samdb_url): + samdb_url = "tdb://%s" % samdb_url + else: + samdb_url = "ldap://%s" % samdb_url + # user 'paged_search' module when connecting remotely + ldb_options = ["modules:paged_searches"] + + return SamDB(url=samdb_url, + lp=samba.tests.env_loadparm(), + session_info=system_session(), + credentials=samba.tests.cmdline_credentials, + options=ldb_options) + diff --git a/source4/utils/net/drs/net_drs_replicate.c b/source4/utils/net/drs/net_drs_replicate.c index 1b250eb..1e28c73 100644 --- a/source4/utils/net/drs/net_drs_replicate.c +++ b/source4/utils/net/drs/net_drs_replicate.c @@ -62,12 +62,12 @@ net_drs_server_dn_from_dc_name(struct net_drs_context *drs_ctx, "(&(objectCategory=server)(|(name=%1$s)(dNSHostName=%1$s)))", dc_name); if (ldb_err != LDB_SUCCESS) { - d_printf("ldb_seach() failed with err: %d (%s);", + d_printf("ldb_seach() failed with err: %d (%s).\n", ldb_err, ldb_errstring(drs_ctx->ldap.ldb)); goto failed; } if (ldb_res->count != 1) { - d_printf("ldb_search() should return exactly one record!"); + d_printf("ldb_search() should return exactly one record!\n"); goto failed; } @@ -116,12 +116,12 @@ static bool net_drs_ntds_guid_from_dc_name(struct net_drs_context *drs_ctx, server_dn, LDB_SCOPE_ONELEVEL, attrs, "%s", "(|(objectCategory=nTDSDSA)(objectCategory=nTDSDSARO))"); if (ldb_err != LDB_SUCCESS) { - d_printf("ldb_seach() failed with err: %d (%s)", + d_printf("ldb_seach() failed with err: %d (%s).\n", ldb_err, ldb_errstring(drs_ctx->ldap.ldb)); goto failed; } if (ldb_res->count != 1) { - d_printf("ldb_search() should return exactly one record!"); + d_printf("ldb_search() should return exactly one record!\n"); goto failed; } @@ -171,10 +171,12 @@ static bool net_drs_replicate_sync_nc(struct net_drs_context *drs_ctx, status = dcerpc_drsuapi_DsReplicaSync_r(drs_conn->drs_handle, drs_ctx, &req); if (!NT_STATUS_IS_OK(status)) { const char *errstr = nt_errstr(status); - d_printf("DsReplicaSync failed - %s.\n", errstr); + d_printf("DsReplicaSync RPC failed - %s.\n", errstr); return false; } else if (!W_ERROR_IS_OK(req.out.result)) { - d_printf("DsReplicaSync failed - %s.\n", win_errstr(req.out.result)); + d_printf("DsReplicaSync failed - %s (nc=[%s], dsa_guid=[%s]).\n", + win_errstr(req.out.result), + nc.dn, GUID_string(drs_ctx, &ntds_guid_src)); return false; } -- Samba Shared Repository