[SCM] Samba Shared Repository - branch master updated

Kamen Mazdrashki kamenim at samba.org
Thu Jun 24 21:05:17 MDT 2010


The branch, master has been updated
       via  163ed44... s4/drs: DsReplicaSync should search partition to Sync
       via  e40635c... s4/utils: fix few 'net drs replicate' error messages
       via  0dd6a75... s4/drs-test: Tests Deleted objects replication
      from  e0aa54d... selftest: Store the output of the last test run in st/subunit.

http://gitweb.samba.org/?p=samba.git;a=shortlog;h=master


- Log -----------------------------------------------------------------
commit 163ed44903fd6d9bf3047d0987bcbb8f0a28e7e2
Author: Kamen Mazdrashki <kamenim at samba.org>
Date:   Fri Jun 25 04:34:42 2010 +0300

    s4/drs: DsReplicaSync should search partition to Sync
    
    by any valid DSName attribute given, be it - partition DN,
    partition GUID or partition SID

commit e40635c48d4b5853cbf463455e2ec90178375100
Author: Kamen Mazdrashki <kamenim at samba.org>
Date:   Fri Jun 25 04:31:41 2010 +0300

    s4/utils: fix few 'net drs replicate' error messages
    
    mainly for the output to be more informative

commit 0dd6a759ed41960500e0869bfe96d93b2d11f50a
Author: Kamen Mazdrashki <kamenim at samba.org>
Date:   Fri Jun 25 04:30:21 2010 +0300

    s4/drs-test: Tests Deleted objects replication
    
    Tests how deleted objects are replicated between two DCs.
    Currently the test exploits following vulnerabilities:
     - DsReplicaSync is not correctly implemented
     - a 'deleted object' is restored (kind of) in case DC1 replicates
       from DC2 before the 'deleted object' is replicated

-----------------------------------------------------------------------

Summary of changes:
 source4/dsdb/repl/drepl_out_pull.c          |   29 ++++
 source4/dsdb/repl/drepl_service.c           |   15 +-
 source4/torture/drs/python/delete_object.py |  222 +++++++++++++++++++++++++++
 source4/utils/net/drs/net_drs_replicate.c   |   14 +-
 4 files changed, 268 insertions(+), 12 deletions(-)
 create mode 100755 source4/torture/drs/python/delete_object.py


Changeset truncated at 500 lines:

diff --git a/source4/dsdb/repl/drepl_out_pull.c b/source4/dsdb/repl/drepl_out_pull.c
index 329b298..c82b48d 100644
--- a/source4/dsdb/repl/drepl_out_pull.c
+++ b/source4/dsdb/repl/drepl_out_pull.c
@@ -32,6 +32,7 @@
 #include "librpc/gen_ndr/ndr_drsuapi.h"
 #include "librpc/gen_ndr/ndr_drsblobs.h"
 #include "libcli/composite/composite.h"
+#include "libcli/security/dom_sid.h"
 
 WERROR dreplsrv_schedule_partition_pull_source(struct dreplsrv_service *s,
 					       struct dreplsrv_partition_source_dsa *source,
@@ -99,6 +100,34 @@ WERROR dreplsrv_schedule_partition_pull_by_guid(struct dreplsrv_service *s, TALL
 	return WERR_NOT_FOUND;
 }
 
+/* force an immediate of the specified partition by Naming Context */
+WERROR dreplsrv_schedule_partition_pull_by_nc(struct dreplsrv_service *s, TALLOC_CTX *mem_ctx,
+					      struct drsuapi_DsReplicaObjectIdentifier *nc)
+{
+	struct dreplsrv_partition *p;
+	bool valid_sid, valid_guid;
+	struct dom_sid null_sid;
+	ZERO_STRUCT(null_sid);
+
+	valid_sid  = !dom_sid_equal(&null_sid, &nc->sid);
+	valid_guid = !GUID_all_zero(&nc->guid);
+
+	if (!valid_sid && !valid_guid && !nc->dn) {
+		return WERR_DS_DRA_INVALID_PARAMETER;
+	}
+
+	for (p = s->partitions; p; p = p->next) {
+		if ((valid_guid && GUID_equal(&p->nc.guid, &nc->guid))
+		    || strequal(p->nc.dn, nc->dn)
+		    || (valid_sid && dom_sid_equal(&p->nc.sid, &nc->sid))) {
+			return dreplsrv_schedule_partition_pull(s, p, mem_ctx);
+		}
+	}
+
+	return WERR_DS_DRA_BAD_NC;
+}
+
+
 static void dreplsrv_pending_op_callback(struct tevent_req *subreq)
 {
 	struct dreplsrv_out_operation *op = tevent_req_callback_data(subreq,
diff --git a/source4/dsdb/repl/drepl_service.c b/source4/dsdb/repl/drepl_service.c
index 59436d6..e48ae3e 100644
--- a/source4/dsdb/repl/drepl_service.c
+++ b/source4/dsdb/repl/drepl_service.c
@@ -110,16 +110,19 @@ static NTSTATUS drepl_replica_sync(struct irpc_message *msg,
 {
 	struct dreplsrv_service *service = talloc_get_type(msg->private_data,
 							   struct dreplsrv_service);
-	struct GUID *guid = &r->in.req->req1.naming_context->guid;
+	struct drsuapi_DsReplicaObjectIdentifier *nc = r->in.req->req1.naming_context;
 
-	r->out.result = dreplsrv_schedule_partition_pull_by_guid(service, msg, guid);
+	r->out.result = dreplsrv_schedule_partition_pull_by_nc(service, msg, nc);
 	if (W_ERROR_IS_OK(r->out.result)) {
-		DEBUG(3,("drepl_replica_sync: forcing sync of partition %s\n",
-			 GUID_string(msg, guid)));
+		DEBUG(3,("drepl_replica_sync: forcing sync of partition (%s, %s)\n",
+			 GUID_string(msg, &nc->guid),
+			 nc->dn));
 		dreplsrv_run_pending_ops(service);
 	} else {
-		DEBUG(3,("drepl_replica_sync: failed setup of sync of partition %s - %s\n",
-			 GUID_string(msg, guid), win_errstr(r->out.result)));
+		DEBUG(3,("drepl_replica_sync: failed setup of sync of partition (%s, %s) - %s\n",
+			 GUID_string(msg, &nc->guid),
+			 nc->dn,
+			 win_errstr(r->out.result)));
 	}
 	return NT_STATUS_OK;
 }
diff --git a/source4/torture/drs/python/delete_object.py b/source4/torture/drs/python/delete_object.py
new file mode 100755
index 0000000..6b75b80
--- /dev/null
+++ b/source4/torture/drs/python/delete_object.py
@@ -0,0 +1,222 @@
+#!/usr/bin/env python
+# -*- coding: utf-8 -*-
+#
+# Unix SMB/CIFS implementation.
+# Copyright (C) Kamen Mazdrashki <kamenim at samba.org> 2010
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 3 of the License, or
+# (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+#
+
+#
+# Usage:
+#  export DC1=dc1_dns_name
+#  export DC2=dc2_dns_name
+#  export SUBUNITRUN=$samba4srcdir/scripting/bin/subunitrun
+#  PYTHONPATH="$PYTHONPATH:$samba4srcdir/torture/drs/python" $SUBUNITRUN delete_object -U"$DOMAIN/$DC_USERNAME"%"$DC_PASSWORD"
+#
+
+import sys
+import time
+import os
+
+sys.path.append("bin/python")
+
+from samba.auth import system_session
+from ldb import SCOPE_BASE, SCOPE_SUBTREE
+from samba.samdb import SamDB
+
+import samba.tests
+
+
+class DrsDeleteObjectTestCase(samba.tests.TestCase):
+
+    # RootDSE msg for DC1
+    info_dc1 = None
+    ldb_dc1 = None
+    # RootDSE msg for DC1
+    info_dc2 = None
+    ldb_dc2 = None
+
+    def setUp(self):
+        super(DrsDeleteObjectTestCase, self).setUp()
+
+        # connect to DCs singleton
+        if self.ldb_dc1 is None:
+            DrsDeleteObjectTestCase.dc1 = get_env_var("DC1")
+            DrsDeleteObjectTestCase.ldb_dc1 = connect_samdb(self.dc1)
+        if self.ldb_dc2 is None:
+            DrsDeleteObjectTestCase.dc2 = get_env_var("DC2")
+            DrsDeleteObjectTestCase.ldb_dc2 = connect_samdb(self.dc2)
+
+        # fetch rootDSEs
+        if self.info_dc1 is None:
+            ldb = self.ldb_dc1
+            res = ldb.search(base="", expression="", scope=SCOPE_BASE, attrs=["*"])
+            self.assertEquals(len(res), 1)
+            DrsDeleteObjectTestCase.info_dc1 = res[0]
+        if self.info_dc2 is None:
+            ldb = self.ldb_dc2
+            res = ldb.search(base="", expression="", scope=SCOPE_BASE, attrs=["*"])
+            self.assertEquals(len(res), 1)
+            DrsDeleteObjectTestCase.info_dc2 = res[0]
+
+        # cache some of RootDSE props
+        self.schema_dn = self.info_dc1["schemaNamingContext"][0]
+        self.domain_dn = self.info_dc1["defaultNamingContext"][0]
+        self.config_dn = self.info_dc1["configurationNamingContext"][0]
+        self.forest_level = int(self.info_dc1["forestFunctionality"][0])
+
+        # we will need DCs DNS names for 'net drs' command
+        self.dnsname_dc1 = self.info_dc1["dnsHostName"][0]
+        self.dnsname_dc2 = self.info_dc2["dnsHostName"][0]
+        pass
+
+    def test_noop(self):
+        pass
+
+    def tearDown(self):
+        super(DrsDeleteObjectTestCase, self).tearDown()
+
+    def _GUID_string(self, guid):
+        return self.ldb_dc1.schema_format_value("objectGUID", guid)
+
+    def _deleted_objects_dn(self, sam_ldb):
+        wkdn = "<WKGUID=18E2EA80684F11D2B9AA00C04F79F805,%s>" % self.domain_dn
+        res = sam_ldb.search(base=wkdn,
+                             scope=SCOPE_BASE,
+                             controls=["show_deleted:1"])
+        self.assertEquals(len(res), 1)
+        return str(res[0]["dn"])
+
+    def _make_username(self):
+        return "DrsDelObjUser_" + time.strftime("%s", time.gmtime())
+    
+    def _check_user(self, sam_ldb, user_orig, is_deleted):
+        # search the user by guid as it may be deleted
+        guid_str = self._GUID_string(user_orig["objectGUID"][0])
+        expression = "(objectGUID=%s)" % guid_str
+        res = sam_ldb.search(base=self.domain_dn,
+                             expression=expression,
+                             controls=["show_deleted:1"])
+        self.assertEquals(len(res), 1)
+        user_cur = res[0]
+        # Deleted Object base DN
+        dodn = self._deleted_objects_dn(sam_ldb)
+        # now check properties of the user
+        name_orig = user_orig["cn"][0]
+        name_cur  = user_cur["cn"][0]
+        if is_deleted:
+            self.assertEquals(user_cur["isDeleted"][0],"TRUE")
+            self.assertTrue(not("objectCategory" in user_cur))
+            self.assertTrue(not("sAMAccountType" in user_cur))
+            self.assertTrue(dodn in str(user_cur["dn"]), 
+                            "User %s is deleted but it is not located under %s!" % (name_orig, dodn))
+            self.assertEquals(name_cur, name_orig + "\nDEL:" + guid_str)
+        else:
+            self.assertTrue(not("isDeleted" in user_cur))
+            self.assertEquals(name_cur, name_orig)
+            self.assertEquals(user_orig["dn"], user_cur["dn"])
+            self.assertTrue(dodn not in str(user_cur["dn"]))
+        pass
+
+    def _net_drs_replicate(self, DC, fromDC):
+        # find out where is net command
+        net_cmd = os.path.abspath("./bin/net")
+        # make command line credentials string
+        creds = samba.tests.cmdline_credentials
+        cmd_line_auth = "-U%s/%s%%%s" % (creds.get_domain(), 
+                                         creds.get_username(), creds.get_password())
+        # bin/net drs replicate <Dest_DC_NAME> <Src_DC_NAME> <Naming Context>
+        cmd_line = "%s drs replicate %s %s %s %s" % (net_cmd, DC, fromDC, 
+                                                     self.domain_dn, cmd_line_auth)
+        ret = os.system(cmd_line)
+        self.assertEquals(ret, 0, "Replicating %s from %s has failed!" % (DC, fromDC))
+        pass
+
+
+    def test_NetReplicateCmd(self):
+        # replicate Domain NC on DC2 from DC1
+        self._net_drs_replicate(DC=self.dc2, fromDC=self.dc1)
+        # replicate Domain NC on DC1 from DC2
+        self._net_drs_replicate(DC=self.dc1, fromDC=self.dc2)
+        pass
+
+    def test_ReplicateDeteleteObject(self):
+        # work-out unique username to test with
+        username = self._make_username()
+
+        # create user on DC1
+        self.ldb_dc1.newuser(username=username, password="P at sswOrd!")
+        ldb_res = self.ldb_dc1.search(base=self.domain_dn,
+                                      scope=SCOPE_SUBTREE,
+                                      expression="(samAccountName=%s)" % username)
+        self.assertEquals(len(ldb_res), 1)
+        user_orig = ldb_res[0]
+        user_dn   = ldb_res[0]["dn"]
+
+        # check user info on DC1
+        print "Testing for %s with GUID %s" % (username, self._GUID_string(user_orig["objectGUID"][0]))
+        self._check_user(sam_ldb=self.ldb_dc1, user_orig=user_orig, is_deleted=False)
+
+        # trigger replication from DC1 to DC2
+        self._net_drs_replicate(DC=self.dc2, fromDC=self.dc1)
+
+        # delete user on DC1
+        self.ldb_dc1.delete(user_dn)
+        # check user info on DC1 - should be deleted
+        self._check_user(sam_ldb=self.ldb_dc1, user_orig=user_orig, is_deleted=True)
+        # check user info on DC2 - should be valid user
+        self._check_user(sam_ldb=self.ldb_dc2, user_orig=user_orig, is_deleted=False)
+
+        # trigger replication from DC2 to DC1
+        # to check if deleted object gets restored
+        self._net_drs_replicate(DC=self.dc1, fromDC=self.dc2)
+        # check user info on DC1 - should be deleted
+        self._check_user(sam_ldb=self.ldb_dc1, user_orig=user_orig, is_deleted=True)
+        # check user info on DC2 - should be valid user
+        self._check_user(sam_ldb=self.ldb_dc2, user_orig=user_orig, is_deleted=False)
+
+        # trigger replication from DC1 to DC2
+        # to check if deleted object is replicated
+        self._net_drs_replicate(DC=self.dc2, fromDC=self.dc1)
+        # check user info on DC1 - should be deleted
+        self._check_user(sam_ldb=self.ldb_dc1, user_orig=user_orig, is_deleted=True)
+        # check user info on DC2 - should be deleted
+        self._check_user(sam_ldb=self.ldb_dc2, user_orig=user_orig, is_deleted=True)
+        pass
+
+
+
+########################################################################################
+def get_env_var(var_name):
+    if not var_name in os.environ.keys():
+        raise AssertionError("Please supply %s in environment" % var_name)
+    return os.environ[var_name]
+
+def connect_samdb(samdb_url):
+    ldb_options = []
+    if not "://" in samdb_url:
+        if os.path.isfile(samdb_url):
+            samdb_url = "tdb://%s" % samdb_url
+        else:
+            samdb_url = "ldap://%s" % samdb_url
+            # user 'paged_search' module when connecting remotely
+            ldb_options = ["modules:paged_searches"]
+    
+    return SamDB(url=samdb_url,
+                 lp=samba.tests.env_loadparm(),
+                 session_info=system_session(),
+                 credentials=samba.tests.cmdline_credentials,
+                 options=ldb_options)
+
diff --git a/source4/utils/net/drs/net_drs_replicate.c b/source4/utils/net/drs/net_drs_replicate.c
index 1b250eb..1e28c73 100644
--- a/source4/utils/net/drs/net_drs_replicate.c
+++ b/source4/utils/net/drs/net_drs_replicate.c
@@ -62,12 +62,12 @@ net_drs_server_dn_from_dc_name(struct net_drs_context *drs_ctx,
 	                     "(&(objectCategory=server)(|(name=%1$s)(dNSHostName=%1$s)))",
 	                     dc_name);
 	if (ldb_err != LDB_SUCCESS) {
-		d_printf("ldb_seach() failed with err: %d (%s);",
+		d_printf("ldb_seach() failed with err: %d (%s).\n",
 		         ldb_err, ldb_errstring(drs_ctx->ldap.ldb));
 		goto failed;
 	}
 	if (ldb_res->count != 1) {
-		d_printf("ldb_search() should return exactly one record!");
+		d_printf("ldb_search() should return exactly one record!\n");
 		goto failed;
 	}
 
@@ -116,12 +116,12 @@ static bool net_drs_ntds_guid_from_dc_name(struct net_drs_context *drs_ctx,
 	                     server_dn, LDB_SCOPE_ONELEVEL, attrs,
 	                     "%s", "(|(objectCategory=nTDSDSA)(objectCategory=nTDSDSARO))");
 	if (ldb_err != LDB_SUCCESS) {
-		d_printf("ldb_seach() failed with err: %d (%s)",
+		d_printf("ldb_seach() failed with err: %d (%s).\n",
 		         ldb_err, ldb_errstring(drs_ctx->ldap.ldb));
 		goto failed;
 	}
 	if (ldb_res->count != 1) {
-		d_printf("ldb_search() should return exactly one record!");
+		d_printf("ldb_search() should return exactly one record!\n");
 		goto failed;
 	}
 
@@ -171,10 +171,12 @@ static bool net_drs_replicate_sync_nc(struct net_drs_context *drs_ctx,
 	status = dcerpc_drsuapi_DsReplicaSync_r(drs_conn->drs_handle, drs_ctx, &req);
 	if (!NT_STATUS_IS_OK(status)) {
 		const char *errstr = nt_errstr(status);
-		d_printf("DsReplicaSync failed - %s.\n", errstr);
+		d_printf("DsReplicaSync RPC failed - %s.\n", errstr);
 		return false;
 	} else if (!W_ERROR_IS_OK(req.out.result)) {
-		d_printf("DsReplicaSync failed - %s.\n", win_errstr(req.out.result));
+		d_printf("DsReplicaSync failed - %s (nc=[%s], dsa_guid=[%s]).\n",
+		         win_errstr(req.out.result),
+		         nc.dn, GUID_string(drs_ctx, &ntds_guid_src));
 		return false;
 	}
 


-- 
Samba Shared Repository


More information about the samba-cvs mailing list