From 4c1a756f24a04fa8a0ac0ac8288a0d729f7c8853 Mon Sep 17 00:00:00 2001 From: Garming Sam Date: Thu, 25 Aug 2016 11:33:16 +1200 Subject: [PATCH 01/12] tests/schemainfo: run dsdb schema info tests with proper URI Signed-off-by: Garming Sam Reviewed-by: Andrew Bartlett BUG: https://bugzilla.samba.org/show_bug.cgi?id=12187 (cherry picked from commit fd49b44e0296348c835168f336297fd969e63c50) --- source4/dsdb/tests/python/dsdb_schema_info.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/source4/dsdb/tests/python/dsdb_schema_info.py b/source4/dsdb/tests/python/dsdb_schema_info.py index 18c2f08..e7933f4 100755 --- a/source4/dsdb/tests/python/dsdb_schema_info.py +++ b/source4/dsdb/tests/python/dsdb_schema_info.py @@ -51,7 +51,7 @@ class SchemaInfoTestCase(samba.tests.TestCase): # connect SamDB if we haven't yet if self.sam_db is None: - ldb_url = samba.tests.env_get_var_value("DC_SERVER") + ldb_url = "ldap://%s" % samba.tests.env_get_var_value("DC_SERVER") SchemaInfoTestCase.sam_db = samba.tests.connect_samdb(ldb_url) # fetch rootDSE -- 1.9.1 From 3b64223e275adffd32161dde95484409d49b820f Mon Sep 17 00:00:00 2001 From: Bob Campbell Date: Mon, 15 Aug 2016 16:19:20 +1200 Subject: [PATCH 02/12] getncchanges: Fix some whitespace Pair-programmed-with: Garming Sam Signed-off-by: Bob Campbell Signed-off-by: Garming Sam Reviewed-by: Andrew Bartlett BUG: https://bugzilla.samba.org/show_bug.cgi?id=12187 (cherry picked from commit 9563dab562cb2dfe4c226f03156bec0bf6eef847) --- source4/rpc_server/drsuapi/getncchanges.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/source4/rpc_server/drsuapi/getncchanges.c b/source4/rpc_server/drsuapi/getncchanges.c index f002836..f692429 100644 --- a/source4/rpc_server/drsuapi/getncchanges.c +++ b/source4/rpc_server/drsuapi/getncchanges.c @@ -1606,7 +1606,7 @@ WERROR dcesrv_drsuapi_DsGetNCChanges(struct dcesrv_call_state *dce_call, TALLOC_ DATA_BLOB session_key; WERROR werr; struct dcesrv_handle *h; - struct drsuapi_bind_state *b_state; + struct drsuapi_bind_state *b_state; struct drsuapi_getncchanges_state *getnc_state; struct drsuapi_DsGetNCChangesRequest10 *req10; uint32_t options; @@ -1688,7 +1688,7 @@ WERROR dcesrv_drsuapi_DsGetNCChanges(struct dcesrv_call_state *dce_call, TALLOC_ if (samdb_ntds_options(sam_ctx, &options) != LDB_SUCCESS) { return WERR_DS_DRA_INTERNAL_ERROR; } - + if ((options & DS_NTDSDSA_OPT_DISABLE_OUTBOUND_REPL) && !(req10->replica_flags & DRSUAPI_DRS_SYNC_FORCED)) { return WERR_DS_DRA_SOURCE_DISABLED; -- 1.9.1 From cc1e219dfea8a6825e50d52c59f55cc71a96e9de Mon Sep 17 00:00:00 2001 From: Garming Sam Date: Tue, 16 Aug 2016 10:53:39 +1200 Subject: [PATCH 03/12] replicated_objects: Add missing newline for debug Signed-off-by: Garming Sam Reviewed-by: Andrew Bartlett BUG: https://bugzilla.samba.org/show_bug.cgi?id=12187 (cherry picked from commit 216c0319c744c39848ae5da7d15dccb6769ea20a) --- source4/dsdb/repl/replicated_objects.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/source4/dsdb/repl/replicated_objects.c b/source4/dsdb/repl/replicated_objects.c index 89d288a..46b0b66 100644 --- a/source4/dsdb/repl/replicated_objects.c +++ b/source4/dsdb/repl/replicated_objects.c @@ -306,7 +306,7 @@ WERROR dsdb_repl_make_working_schema(struct ldb_context *ldb, werr = dsdb_schema_pfm_from_drsuapi_pfm(mapping_ctr, true, working_schema, &pfm_remote, NULL); if (!W_ERROR_IS_OK(werr)) { - DEBUG(0,(__location__ ": Failed to decode remote prefixMap: %s", + DEBUG(0,(__location__ ": Failed to decode remote prefixMap: %s\n", win_errstr(werr))); talloc_free(working_schema); return werr; @@ -667,7 +667,7 @@ WERROR dsdb_replicated_objects_convert(struct ldb_context *ldb, status = dsdb_schema_pfm_from_drsuapi_pfm(mapping_ctr, true, out, &pfm_remote, NULL); if (!W_ERROR_IS_OK(status)) { - DEBUG(0,(__location__ ": Failed to decode remote prefixMap: %s", + DEBUG(0,(__location__ ": Failed to decode remote prefixMap: %s\n", win_errstr(status))); talloc_free(out); return status; -- 1.9.1 From c3216dd01218bf5957e9d2c9603bcaccd319dad2 Mon Sep 17 00:00:00 2001 From: Garming Sam Date: Thu, 11 Aug 2016 14:28:27 +1200 Subject: [PATCH 04/12] drepl_out: Send the prefix map alongside the RODC partial attribute set Signed-off-by: Garming Sam Reviewed-by: Andrew Bartlett BUG: https://bugzilla.samba.org/show_bug.cgi?id=12187 (cherry picked from commit 317bbc4d0528dca03d94d61c38b038d314f8cad8) --- source4/dsdb/repl/drepl_out_helpers.c | 17 +++++++++++++---- 1 file changed, 13 insertions(+), 4 deletions(-) diff --git a/source4/dsdb/repl/drepl_out_helpers.c b/source4/dsdb/repl/drepl_out_helpers.c index 9fe8c3b..5292747 100644 --- a/source4/dsdb/repl/drepl_out_helpers.c +++ b/source4/dsdb/repl/drepl_out_helpers.c @@ -302,6 +302,7 @@ static void dreplsrv_op_pull_source_get_changes_done(struct tevent_req *subreq); static NTSTATUS dreplsrv_get_rodc_partial_attribute_set(struct dreplsrv_service *service, TALLOC_CTX *mem_ctx, struct drsuapi_DsPartialAttributeSet **_pas, + struct drsuapi_DsReplicaOIDMapping_Ctr **pfm, bool for_schema) { struct drsuapi_DsPartialAttributeSet *pas; @@ -340,6 +341,11 @@ static NTSTATUS dreplsrv_get_rodc_partial_attribute_set(struct dreplsrv_service } *_pas = pas; + + if (pfm != NULL) { + dsdb_get_oid_mappings_drsuapi(schema, true, mem_ctx, pfm); + } + return NT_STATUS_OK; } @@ -427,6 +433,7 @@ static void dreplsrv_op_pull_source_get_changes_trigger(struct tevent_req *req) uint32_t replica_flags; struct drsuapi_DsReplicaHighWaterMark highwatermark; struct ldb_dn *schema_dn = ldb_get_schema_basedn(service->samdb); + struct drsuapi_DsReplicaOIDMapping_Ctr *mappings = NULL; r = talloc(state, struct drsuapi_DsGetNCChanges); if (tevent_req_nomem(r, req)) { @@ -488,8 +495,10 @@ static void dreplsrv_op_pull_source_get_changes_trigger(struct tevent_req *req) if (ldb_dn_compare_base(schema_dn, partition->dn) == 0) { for_schema = true; } - - status = dreplsrv_get_rodc_partial_attribute_set(service, r, &pas, for_schema); + status = dreplsrv_get_rodc_partial_attribute_set(service, r, + &pas, + &mappings, + for_schema); if (!NT_STATUS_IS_OK(status)) { DEBUG(0,(__location__ ": Failed to construct RODC partial attribute set : %s\n", nt_errstr(status))); tevent_req_nterror(req, status); @@ -538,8 +547,8 @@ static void dreplsrv_op_pull_source_get_changes_trigger(struct tevent_req *req) r->in.req->req8.fsmo_info = state->op->fsmo_info; r->in.req->req8.partial_attribute_set = pas; r->in.req->req8.partial_attribute_set_ex= NULL; - r->in.req->req8.mapping_ctr.num_mappings= 0; - r->in.req->req8.mapping_ctr.mappings = NULL; + r->in.req->req8.mapping_ctr.num_mappings= mappings == NULL ? 0 : mappings->num_mappings; + r->in.req->req8.mapping_ctr.mappings = mappings == NULL ? NULL : mappings->mappings; } else { r->in.level = 5; r->in.req->req5.destination_dsa_guid = service->ntds_guid; -- 1.9.1 From c9e1847dad61c202716fc2960772403c9c49ac37 Mon Sep 17 00:00:00 2001 From: Garming Sam Date: Thu, 18 Aug 2016 13:18:28 +1200 Subject: [PATCH 05/12] drepl_out: Send the prefix map alongside the global catalog partial attribute set Signed-off-by: Garming Sam Reviewed-by: Andrew Bartlett BUG: https://bugzilla.samba.org/show_bug.cgi?id=12187 (cherry picked from commit 0ea126c63c1d5a0081b90a914c9ad7227cf7b748) --- source4/dsdb/repl/drepl_out_helpers.c | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-) diff --git a/source4/dsdb/repl/drepl_out_helpers.c b/source4/dsdb/repl/drepl_out_helpers.c index 5292747..ac0b947 100644 --- a/source4/dsdb/repl/drepl_out_helpers.c +++ b/source4/dsdb/repl/drepl_out_helpers.c @@ -355,7 +355,8 @@ static NTSTATUS dreplsrv_get_rodc_partial_attribute_set(struct dreplsrv_service */ static NTSTATUS dreplsrv_get_gc_partial_attribute_set(struct dreplsrv_service *service, TALLOC_CTX *mem_ctx, - struct drsuapi_DsPartialAttributeSet **_pas) + struct drsuapi_DsPartialAttributeSet **_pas, + struct drsuapi_DsReplicaOIDMapping_Ctr **pfm) { struct drsuapi_DsPartialAttributeSet *pas; struct dsdb_schema *schema; @@ -389,6 +390,11 @@ static NTSTATUS dreplsrv_get_gc_partial_attribute_set(struct dreplsrv_service *s } *_pas = pas; + + if (pfm != NULL) { + dsdb_get_oid_mappings_drsuapi(schema, true, mem_ctx, pfm); + } + return NT_STATUS_OK; } @@ -483,7 +489,9 @@ static void dreplsrv_op_pull_source_get_changes_trigger(struct tevent_req *req) } if (partition->partial_replica) { - status = dreplsrv_get_gc_partial_attribute_set(service, r, &pas); + status = dreplsrv_get_gc_partial_attribute_set(service, r, + &pas, + &mappings); if (!NT_STATUS_IS_OK(status)) { DEBUG(0,(__location__ ": Failed to construct GC partial attribute set : %s\n", nt_errstr(status))); tevent_req_nterror(req, status); -- 1.9.1 From a88f03ab6bfb2e64c79aea6af6fc65d05393b2b7 Mon Sep 17 00:00:00 2001 From: Bob Campbell Date: Mon, 15 Aug 2016 16:19:09 +1200 Subject: [PATCH 06/12] tests/getnc_exop: Ensure we do the fallback if not given a PAS This will cause silent errors in the translation, but as far as we know, Windows will accept it just fine. Pair-programmed-with: Garming Sam Signed-off-by: Garming Sam Signed-off-by: Bob Campbell Reviewed-by: Andrew Bartlett BUG: https://bugzilla.samba.org/show_bug.cgi?id=12187 (cherry picked from commit 1673590e8ec3001c6909a78e004f64433060a624) --- selftest/flapping | 1 + source4/torture/drs/python/getnc_exop.py | 53 ++++++++++++++++++++++++++++++-- 2 files changed, 52 insertions(+), 2 deletions(-) diff --git a/selftest/flapping b/selftest/flapping index 50fdf1e..c4b5481 100644 --- a/selftest/flapping +++ b/selftest/flapping @@ -34,3 +34,4 @@ ^samba3.blackbox.smbclient_tar.* # fails very, very often on sn-devel ^samba3.blackbox.smbclient_s3.*.sending a message to the remote server # flakey on sn-devel-104 and sn-devel-144 ^samba3.blackbox.smbclient_s3.*.creating a good symlink and deleting it by path # flakey on sn-devel-104 and sn-devel-144 +^samba4.drs.getnc_exop.python.*getnc_exop.DrsReplicaPrefixMapTestCase.* diff --git a/source4/torture/drs/python/getnc_exop.py b/source4/torture/drs/python/getnc_exop.py index ca6c443..97894bc 100644 --- a/source4/torture/drs/python/getnc_exop.py +++ b/source4/torture/drs/python/getnc_exop.py @@ -79,7 +79,7 @@ class AbstractLink: class ExopBaseTest: def _exop_req8(self, dest_dsa, invocation_id, nc_dn_str, exop, - replica_flags=0, max_objects=0): + replica_flags=0, max_objects=0, partial_attribute_set=None): req8 = drsuapi.DsGetNCChangesRequest8() req8.destination_dsa_guid = misc.GUID(dest_dsa) if dest_dsa else misc.GUID() @@ -96,7 +96,7 @@ class ExopBaseTest: req8.max_ndr_size = 402116 req8.extended_op = exop req8.fsmo_info = 0 - req8.partial_attribute_set = None + req8.partial_attribute_set = partial_attribute_set req8.partial_attribute_set_ex = None req8.mapping_ctr.num_mappings = 0 req8.mapping_ctr.mappings = None @@ -285,6 +285,55 @@ class DrsReplicaSyncTestCase(drs_base.DrsBaseTestCase, ExopBaseTest): # We don't check the linked_attributes_count as if the domain # has an RODC, it can gain links on the server account object +class DrsReplicaPrefixMapTestCase(drs_base.DrsBaseTestCase, ExopBaseTest): + def setUp(self): + super(DrsReplicaPrefixMapTestCase, self).setUp() + self.base_dn = self.ldb_dc1.get_default_basedn() + self.ou = "ou=pfm_exop,%s" % self.base_dn + self.ldb_dc1.add({ + "dn": self.ou, + "objectclass": "organizationalUnit"}) + self.user = "cn=testuser,%s" % self.ou + self.ldb_dc1.add({ + "dn": self.user, + "objectclass": "user"}) + + def tearDown(self): + super(DrsReplicaPrefixMapTestCase, self).tearDown() + try: + self.ldb_dc1.delete(self.ou, ["tree_delete:1"]) + except ldb.LdbError as (enum, string): + if enum == ldb.ERR_NO_SUCH_OBJECT: + pass + + def get_partial_attribute_set(self): + partial_attribute_set = drsuapi.DsPartialAttributeSet() + attids = [drsuapi.DRSUAPI_ATTID_objectClass, + drsuapi.DRSUAPI_ATTID_description, + drsuapi.DRSUAPI_ATTID_displayName] + partial_attribute_set.attids = attids + partial_attribute_set.num_attids = len(attids) + return partial_attribute_set + + def test_missing_prefix_map_dsa(self): + partial_attribute_set = self.get_partial_attribute_set() + + dc_guid_1 = self.ldb_dc1.get_invocation_id() + + drs, drs_handle = self._ds_bind(self.dnsname_dc1) + + req8 = self._exop_req8(dest_dsa=None, + invocation_id=dc_guid_1, + nc_dn_str=self.user, + exop=drsuapi.DRSUAPI_EXOP_REPL_OBJ, + partial_attribute_set=partial_attribute_set) + + try: + (level, ctr) = drs.DsGetNCChanges(drs_handle, 8, req8) + self.assertEqual(ctr.extended_ret, drsuapi.DRSUAPI_EXOP_ERR_SUCCESS) + except Exception: + self.fail("Missing prefixmap shouldn't have triggered an error") + class DrsReplicaSyncSortTestCase(drs_base.DrsBaseTestCase, ExopBaseTest): def setUp(self): super(DrsReplicaSyncSortTestCase, self).setUp() -- 1.9.1 From 66fc0c6fed2b60809e05e6d6939baba606fb0ef6 Mon Sep 17 00:00:00 2001 From: Garming Sam Date: Wed, 17 Aug 2016 14:26:55 +1200 Subject: [PATCH 07/12] tests/getnc_exop: Ensure that all attids are valid in a given PAS On Windows this does not seem to fail, but causes silent errors. Pair-programmed-with: Garming Sam Signed-off-by: Garming Sam Signed-off-by: Bob Campbell Reviewed-by: Andrew Bartlett BUG: https://bugzilla.samba.org/show_bug.cgi?id=12187 (cherry picked from commit 7f3ef150751452411db1e0c5b2ca6d8af2769d5c) --- source4/torture/drs/python/getnc_exop.py | 66 ++++++++++++++++++++++++++++---- 1 file changed, 59 insertions(+), 7 deletions(-) diff --git a/source4/torture/drs/python/getnc_exop.py b/source4/torture/drs/python/getnc_exop.py index 97894bc..858d02e 100644 --- a/source4/torture/drs/python/getnc_exop.py +++ b/source4/torture/drs/python/getnc_exop.py @@ -79,7 +79,8 @@ class AbstractLink: class ExopBaseTest: def _exop_req8(self, dest_dsa, invocation_id, nc_dn_str, exop, - replica_flags=0, max_objects=0, partial_attribute_set=None): + replica_flags=0, max_objects=0, partial_attribute_set=None, + mapping_ctr=None): req8 = drsuapi.DsGetNCChangesRequest8() req8.destination_dsa_guid = misc.GUID(dest_dsa) if dest_dsa else misc.GUID() @@ -98,8 +99,11 @@ class ExopBaseTest: req8.fsmo_info = 0 req8.partial_attribute_set = partial_attribute_set req8.partial_attribute_set_ex = None - req8.mapping_ctr.num_mappings = 0 - req8.mapping_ctr.mappings = None + if mapping_ctr: + req8.mapping_ctr = mapping_ctr + else: + req8.mapping_ctr.num_mappings = 0 + req8.mapping_ctr.mappings = None return req8 @@ -306,11 +310,8 @@ class DrsReplicaPrefixMapTestCase(drs_base.DrsBaseTestCase, ExopBaseTest): if enum == ldb.ERR_NO_SUCH_OBJECT: pass - def get_partial_attribute_set(self): + def get_partial_attribute_set(self, attids=[drsuapi.DRSUAPI_ATTID_objectClass]): partial_attribute_set = drsuapi.DsPartialAttributeSet() - attids = [drsuapi.DRSUAPI_ATTID_objectClass, - drsuapi.DRSUAPI_ATTID_description, - drsuapi.DRSUAPI_ATTID_displayName] partial_attribute_set.attids = attids partial_attribute_set.num_attids = len(attids) return partial_attribute_set @@ -334,6 +335,57 @@ class DrsReplicaPrefixMapTestCase(drs_base.DrsBaseTestCase, ExopBaseTest): except Exception: self.fail("Missing prefixmap shouldn't have triggered an error") + def test_invalid_prefix_map_attid(self): + # Request for invalid attid + partial_attribute_set = self.get_partial_attribute_set([99999]) + + pfm = self._samdb_fetch_pfm_and_schi() + + dc_guid_1 = self.ldb_dc1.get_invocation_id() + + drs, drs_handle = self._ds_bind(self.dnsname_dc1) + + req8 = self._exop_req8(dest_dsa=None, + invocation_id=dc_guid_1, + nc_dn_str=self.user, + exop=drsuapi.DRSUAPI_EXOP_REPL_OBJ, + partial_attribute_set=partial_attribute_set, + mapping_ctr=pfm) + + try: + (level, ctr) = drs.DsGetNCChanges(drs_handle, 8, req8) + self.fail("Invalid attid (99999) should have triggered an error") + except Exception as (ecode, emsg): + self.assertEqual(ecode, 0x000020E2, "Error code should have been " + "WERR_DS_DRA_SCHEMA_MISMATCH") + + def _samdb_fetch_pfm_and_schi(self): + """Fetch prefixMap and schemaInfo stored in SamDB using LDB connection""" + samdb = self.ldb_dc1 + res = samdb.search(base=samdb.get_schema_basedn(), scope=SCOPE_BASE, + attrs=["prefixMap", "schemaInfo"]) + + pfm = ndr_unpack(drsblobs.prefixMapBlob, + str(res[0]['prefixMap'])) + + schi = drsuapi.DsReplicaOIDMapping() + schi.id_prefix = 0 + + if 'schemaInfo' in res[0]: + schi.oid.length = len(map(ord, str(res[0]['schemaInfo']))) + schi.oid.binary_oid = map(ord, str(res[0]['schemaInfo'])) + else: + schema_info = drsblobs.schemaInfoBlob() + schema_info.revision = 0 + schema_info.marker = 0xFF + schema_info.invocation_id = misc.GUID(samdb.get_invocation_id()) + schi.oid.length = len(map(ord, ndr_pack(schema_info))) + schi.oid.binary_oid = map(ord, ndr_pack(schema_info)) + + pfm.ctr.mappings = pfm.ctr.mappings + [schi] + pfm.ctr.num_mappings += 1 + return pfm.ctr + class DrsReplicaSyncSortTestCase(drs_base.DrsBaseTestCase, ExopBaseTest): def setUp(self): super(DrsReplicaSyncSortTestCase, self).setUp() -- 1.9.1 From 6eb63953e13de70081d940b336174fa5339cc132 Mon Sep 17 00:00:00 2001 From: Garming Sam Date: Wed, 17 Aug 2016 16:04:49 +1200 Subject: [PATCH 08/12] tests/getnc_exop: Ensure the remote prefixmap is always used (secret attrs) Signed-off-by: Garming Sam Reviewed-by: Andrew Bartlett BUG: https://bugzilla.samba.org/show_bug.cgi?id=12187 (cherry picked from commit 1f4ea1686ff1575406b5e8e488feb7b900db12ef) --- source4/torture/drs/python/getnc_exop.py | 91 ++++++++++++++++++++++++++++++-- 1 file changed, 86 insertions(+), 5 deletions(-) diff --git a/source4/torture/drs/python/getnc_exop.py b/source4/torture/drs/python/getnc_exop.py index 858d02e..d4f8f1d 100644 --- a/source4/torture/drs/python/getnc_exop.py +++ b/source4/torture/drs/python/getnc_exop.py @@ -332,19 +332,27 @@ class DrsReplicaPrefixMapTestCase(drs_base.DrsBaseTestCase, ExopBaseTest): try: (level, ctr) = drs.DsGetNCChanges(drs_handle, 8, req8) self.assertEqual(ctr.extended_ret, drsuapi.DRSUAPI_EXOP_ERR_SUCCESS) - except Exception: + except RuntimeError: self.fail("Missing prefixmap shouldn't have triggered an error") def test_invalid_prefix_map_attid(self): # Request for invalid attid partial_attribute_set = self.get_partial_attribute_set([99999]) - pfm = self._samdb_fetch_pfm_and_schi() - dc_guid_1 = self.ldb_dc1.get_invocation_id() - drs, drs_handle = self._ds_bind(self.dnsname_dc1) + try: + pfm = self._samdb_fetch_pfm_and_schi() + except KeyError: + # On Windows, prefixMap isn't available over LDAP + req8 = self._exop_req8(dest_dsa=None, + invocation_id=dc_guid_1, + nc_dn_str=self.user, + exop=drsuapi.DRSUAPI_EXOP_REPL_OBJ) + (level, ctr) = drs.DsGetNCChanges(drs_handle, 8, req8) + pfm = ctr.mapping_ctr + req8 = self._exop_req8(dest_dsa=None, invocation_id=dc_guid_1, nc_dn_str=self.user, @@ -355,10 +363,83 @@ class DrsReplicaPrefixMapTestCase(drs_base.DrsBaseTestCase, ExopBaseTest): try: (level, ctr) = drs.DsGetNCChanges(drs_handle, 8, req8) self.fail("Invalid attid (99999) should have triggered an error") - except Exception as (ecode, emsg): + except RuntimeError as (ecode, emsg): self.assertEqual(ecode, 0x000020E2, "Error code should have been " "WERR_DS_DRA_SCHEMA_MISMATCH") + def test_secret_prefix_map_attid(self): + # Request for a secret attid + partial_attribute_set = self.get_partial_attribute_set([drsuapi.DRSUAPI_ATTID_unicodePwd]) + + dc_guid_1 = self.ldb_dc1.get_invocation_id() + drs, drs_handle = self._ds_bind(self.dnsname_dc1) + + try: + pfm = self._samdb_fetch_pfm_and_schi() + except KeyError: + # On Windows, prefixMap isn't available over LDAP + req8 = self._exop_req8(dest_dsa=None, + invocation_id=dc_guid_1, + nc_dn_str=self.user, + exop=drsuapi.DRSUAPI_EXOP_REPL_OBJ) + (level, ctr) = drs.DsGetNCChanges(drs_handle, 8, req8) + pfm = ctr.mapping_ctr + + + req8 = self._exop_req8(dest_dsa=None, + invocation_id=dc_guid_1, + nc_dn_str=self.user, + exop=drsuapi.DRSUAPI_EXOP_REPL_OBJ, + partial_attribute_set=partial_attribute_set, + mapping_ctr=pfm) + + (level, ctr) = drs.DsGetNCChanges(drs_handle, 8, req8) + + found = False + for attr in ctr.first_object.object.attribute_ctr.attributes: + if attr.attid == drsuapi.DRSUAPI_ATTID_unicodePwd: + found = True + break + + self.assertTrue(found, "Ensure we get the unicodePwd attribute back") + + for i, mapping in enumerate(pfm.mappings): + # OID: 2.5.4.* + # objectClass: 2.5.4.0 + if mapping.oid.binary_oid == [85, 4]: + idx1 = i + # OID: 1.2.840.113556.1.4.* + # unicodePwd: 1.2.840.113556.1.4.90 + elif mapping.oid.binary_oid == [42, 134, 72, 134, 247, 20, 1, 4]: + idx2 = i + + (pfm.mappings[idx1].id_prefix, + pfm.mappings[idx2].id_prefix) = (pfm.mappings[idx2].id_prefix, + pfm.mappings[idx1].id_prefix) + + tmp = pfm.mappings + tmp[idx1], tmp[idx2] = tmp[idx2], tmp[idx1] + pfm.mappings = tmp + + # 90 for unicodePwd (with new prefix = 0) + partial_attribute_set = self.get_partial_attribute_set([90]) + req8 = self._exop_req8(dest_dsa=None, + invocation_id=dc_guid_1, + nc_dn_str=self.user, + exop=drsuapi.DRSUAPI_EXOP_REPL_OBJ, + partial_attribute_set=partial_attribute_set, + mapping_ctr=pfm) + + (level, ctr) = drs.DsGetNCChanges(drs_handle, 8, req8) + + found = False + for attr in ctr.first_object.object.attribute_ctr.attributes: + if attr.attid == drsuapi.DRSUAPI_ATTID_unicodePwd: + found = True + break + + self.assertTrue(found, "Ensure we get the unicodePwd attribute back") + def _samdb_fetch_pfm_and_schi(self): """Fetch prefixMap and schemaInfo stored in SamDB using LDB connection""" samdb = self.ldb_dc1 -- 1.9.1 From 782ee212bbe0817ea2d7c65af82311b86e5c4e3e Mon Sep 17 00:00:00 2001 From: Garming Sam Date: Wed, 17 Aug 2016 16:36:58 +1200 Subject: [PATCH 09/12] tests/getnc_exop: Ensure the remote prefixmap is always used (name attr) Signed-off-by: Garming Sam Reviewed-by: Andrew Bartlett BUG: https://bugzilla.samba.org/show_bug.cgi?id=12187 (cherry picked from commit e495d1b2ed9aca45ce696dd8cc54458002ca0c3a) --- source4/torture/drs/python/getnc_exop.py | 73 ++++++++++++++++++++++++++++++++ 1 file changed, 73 insertions(+) diff --git a/source4/torture/drs/python/getnc_exop.py b/source4/torture/drs/python/getnc_exop.py index d4f8f1d..3de1f8b 100644 --- a/source4/torture/drs/python/getnc_exop.py +++ b/source4/torture/drs/python/getnc_exop.py @@ -440,6 +440,79 @@ class DrsReplicaPrefixMapTestCase(drs_base.DrsBaseTestCase, ExopBaseTest): self.assertTrue(found, "Ensure we get the unicodePwd attribute back") + def test_regular_prefix_map_attid(self): + # Request for a regular (non-secret) attid + partial_attribute_set = self.get_partial_attribute_set([drsuapi.DRSUAPI_ATTID_name]) + + dc_guid_1 = self.ldb_dc1.get_invocation_id() + drs, drs_handle = self._ds_bind(self.dnsname_dc1) + + try: + pfm = self._samdb_fetch_pfm_and_schi() + except KeyError: + # On Windows, prefixMap isn't available over LDAP + req8 = self._exop_req8(dest_dsa=None, + invocation_id=dc_guid_1, + nc_dn_str=self.user, + exop=drsuapi.DRSUAPI_EXOP_REPL_OBJ) + (level, ctr) = drs.DsGetNCChanges(drs_handle, 8, req8) + pfm = ctr.mapping_ctr + + + req8 = self._exop_req8(dest_dsa=None, + invocation_id=dc_guid_1, + nc_dn_str=self.user, + exop=drsuapi.DRSUAPI_EXOP_REPL_OBJ, + partial_attribute_set=partial_attribute_set, + mapping_ctr=pfm) + + (level, ctr) = drs.DsGetNCChanges(drs_handle, 8, req8) + + found = False + for attr in ctr.first_object.object.attribute_ctr.attributes: + if attr.attid == drsuapi.DRSUAPI_ATTID_name: + found = True + break + + self.assertTrue(found, "Ensure we get the name attribute back") + + for i, mapping in enumerate(pfm.mappings): + # OID: 2.5.4.* + # objectClass: 2.5.4.0 + if mapping.oid.binary_oid == [85, 4]: + idx1 = i + # OID: 1.2.840.113556.1.4.* + # name: 1.2.840.113556.1.4.1 + elif mapping.oid.binary_oid == [42, 134, 72, 134, 247, 20, 1, 4]: + idx2 = i + + (pfm.mappings[idx1].id_prefix, + pfm.mappings[idx2].id_prefix) = (pfm.mappings[idx2].id_prefix, + pfm.mappings[idx1].id_prefix) + + tmp = pfm.mappings + tmp[idx1], tmp[idx2] = tmp[idx2], tmp[idx1] + pfm.mappings = tmp + + # 1 for name (with new prefix = 0) + partial_attribute_set = self.get_partial_attribute_set([1]) + req8 = self._exop_req8(dest_dsa=None, + invocation_id=dc_guid_1, + nc_dn_str=self.user, + exop=drsuapi.DRSUAPI_EXOP_REPL_OBJ, + partial_attribute_set=partial_attribute_set, + mapping_ctr=pfm) + + (level, ctr) = drs.DsGetNCChanges(drs_handle, 8, req8) + + found = False + for attr in ctr.first_object.object.attribute_ctr.attributes: + if attr.attid == drsuapi.DRSUAPI_ATTID_name: + found = True + break + + self.assertTrue(found, "Ensure we get the name attribute back") + def _samdb_fetch_pfm_and_schi(self): """Fetch prefixMap and schemaInfo stored in SamDB using LDB connection""" samdb = self.ldb_dc1 -- 1.9.1 From 49edfed629bd2c60fb0045e6541fe68b9ca577dc Mon Sep 17 00:00:00 2001 From: Garming Sam Date: Thu, 18 Aug 2016 15:20:06 +1200 Subject: [PATCH 10/12] tests/getnc_exop: PartialAttrSetEx test (passes Windows, fails us) This has an odd behaviour where PartialAttrSetEx does not respect the incoming mapping. PartialAttrSetEx is not respected in Samba at all. Signed-off-by: Garming Sam Reviewed-by: Andrew Bartlett BUG: https://bugzilla.samba.org/show_bug.cgi?id=12187 (cherry picked from commit 36df826154ed90e92f877e6f36269893c44a2a16) --- source4/torture/drs/python/getnc_exop.py | 100 ++++++++++++++++++++++++++++++- 1 file changed, 98 insertions(+), 2 deletions(-) diff --git a/source4/torture/drs/python/getnc_exop.py b/source4/torture/drs/python/getnc_exop.py index 3de1f8b..8224df1 100644 --- a/source4/torture/drs/python/getnc_exop.py +++ b/source4/torture/drs/python/getnc_exop.py @@ -80,7 +80,7 @@ class AbstractLink: class ExopBaseTest: def _exop_req8(self, dest_dsa, invocation_id, nc_dn_str, exop, replica_flags=0, max_objects=0, partial_attribute_set=None, - mapping_ctr=None): + partial_attribute_set_ex=None, mapping_ctr=None): req8 = drsuapi.DsGetNCChangesRequest8() req8.destination_dsa_guid = misc.GUID(dest_dsa) if dest_dsa else misc.GUID() @@ -98,7 +98,7 @@ class ExopBaseTest: req8.extended_op = exop req8.fsmo_info = 0 req8.partial_attribute_set = partial_attribute_set - req8.partial_attribute_set_ex = None + req8.partial_attribute_set_ex = partial_attribute_set_ex if mapping_ctr: req8.mapping_ctr = mapping_ctr else: @@ -513,6 +513,102 @@ class DrsReplicaPrefixMapTestCase(drs_base.DrsBaseTestCase, ExopBaseTest): self.assertTrue(found, "Ensure we get the name attribute back") + def test_regular_prefix_map_ex_attid(self): + # Request for a regular (non-secret) attid + partial_attribute_set = self.get_partial_attribute_set([drsuapi.DRSUAPI_ATTID_name]) + partial_attribute_set_ex = self.get_partial_attribute_set([drsuapi.DRSUAPI_ATTID_unicodePwd]) + + dc_guid_1 = self.ldb_dc1.get_invocation_id() + drs, drs_handle = self._ds_bind(self.dnsname_dc1) + + try: + pfm = self._samdb_fetch_pfm_and_schi() + except KeyError: + # On Windows, prefixMap isn't available over LDAP + req8 = self._exop_req8(dest_dsa=None, + invocation_id=dc_guid_1, + nc_dn_str=self.user, + exop=drsuapi.DRSUAPI_EXOP_REPL_OBJ) + (level, ctr) = drs.DsGetNCChanges(drs_handle, 8, req8) + pfm = ctr.mapping_ctr + + + req8 = self._exop_req8(dest_dsa=None, + invocation_id=dc_guid_1, + nc_dn_str=self.user, + exop=drsuapi.DRSUAPI_EXOP_REPL_OBJ, + partial_attribute_set=partial_attribute_set, + partial_attribute_set_ex=partial_attribute_set_ex, + mapping_ctr=pfm) + + (level, ctr) = drs.DsGetNCChanges(drs_handle, 8, req8) + + found = False + for attr in ctr.first_object.object.attribute_ctr.attributes: + if attr.attid == drsuapi.DRSUAPI_ATTID_name: + found = True + break + + self.assertTrue(found, "Ensure we get the name attribute back") + + found = False + for attr in ctr.first_object.object.attribute_ctr.attributes: + if attr.attid == drsuapi.DRSUAPI_ATTID_unicodePwd: + found = True + break + + self.assertTrue(found, "Ensure we get the unicodePwd attribute back") + + for i, mapping in enumerate(pfm.mappings): + # OID: 2.5.4.* + # objectClass: 2.5.4.0 + if mapping.oid.binary_oid == [85, 4]: + idx1 = i + # OID: 1.2.840.113556.1.4.* + # name: 1.2.840.113556.1.4.1 + # unicodePwd: 1.2.840.113556.1.4.90 + elif mapping.oid.binary_oid == [42, 134, 72, 134, 247, 20, 1, 4]: + idx2 = i + + (pfm.mappings[idx1].id_prefix, + pfm.mappings[idx2].id_prefix) = (pfm.mappings[idx2].id_prefix, + pfm.mappings[idx1].id_prefix) + + tmp = pfm.mappings + tmp[idx1], tmp[idx2] = tmp[idx2], tmp[idx1] + pfm.mappings = tmp + + # 1 for name (with new prefix = 0) + partial_attribute_set = self.get_partial_attribute_set([1]) + # 90 for unicodePwd (with new prefix = 0) + # HOWEVER: Windows doesn't seem to respect incoming maps for PartialAttrSetEx + partial_attribute_set_ex = self.get_partial_attribute_set([drsuapi.DRSUAPI_ATTID_unicodePwd]) + req8 = self._exop_req8(dest_dsa=None, + invocation_id=dc_guid_1, + nc_dn_str=self.user, + exop=drsuapi.DRSUAPI_EXOP_REPL_OBJ, + partial_attribute_set=partial_attribute_set, + partial_attribute_set_ex=partial_attribute_set_ex, + mapping_ctr=pfm) + + (level, ctr) = drs.DsGetNCChanges(drs_handle, 8, req8) + + found = False + for attr in ctr.first_object.object.attribute_ctr.attributes: + if attr.attid == drsuapi.DRSUAPI_ATTID_name: + found = True + break + + self.assertTrue(found, "Ensure we get the name attribute back") + + found = False + for attr in ctr.first_object.object.attribute_ctr.attributes: + if attr.attid == drsuapi.DRSUAPI_ATTID_unicodePwd: + found = True + break + + self.assertTrue(found, "Ensure we get the unicodePwd attribute back") + def _samdb_fetch_pfm_and_schi(self): """Fetch prefixMap and schemaInfo stored in SamDB using LDB connection""" samdb = self.ldb_dc1 -- 1.9.1 From 377071e8032ded0c07aa7ddc58098e704bb36546 Mon Sep 17 00:00:00 2001 From: Garming Sam Date: Mon, 15 Aug 2016 14:10:38 +1200 Subject: [PATCH 11/12] getncchanges: Compute the partial attribute set from the remote schema This doesn't fix the partialAttrSetEx case, so the test is left in the knownfail file. Signed-off-by: Bob Campbell Signed-off-by: Garming Sam Reviewed-by: Andrew Bartlett BUG: https://bugzilla.samba.org/show_bug.cgi?id=12187 (cherry picked from commit 1a96f9329e718acac195e75a5156b1c147ad54ff) --- selftest/flapping | 1 - selftest/knownfail | 1 + source4/rpc_server/drsuapi/getncchanges.c | 193 +++++++++++++++++++++++++----- 3 files changed, 165 insertions(+), 30 deletions(-) diff --git a/selftest/flapping b/selftest/flapping index c4b5481..50fdf1e 100644 --- a/selftest/flapping +++ b/selftest/flapping @@ -34,4 +34,3 @@ ^samba3.blackbox.smbclient_tar.* # fails very, very often on sn-devel ^samba3.blackbox.smbclient_s3.*.sending a message to the remote server # flakey on sn-devel-104 and sn-devel-144 ^samba3.blackbox.smbclient_s3.*.creating a good symlink and deleting it by path # flakey on sn-devel-104 and sn-devel-144 -^samba4.drs.getnc_exop.python.*getnc_exop.DrsReplicaPrefixMapTestCase.* diff --git a/selftest/knownfail b/selftest/knownfail index ffcaf06..3b28589 100644 --- a/selftest/knownfail +++ b/selftest/knownfail @@ -290,3 +290,4 @@ ^samba4.smb2.read.access #ntvfs server blocks copychunk with execute access on read handle ^samba4.smb2.ioctl.copy_chunk_bad_access +^samba4.drs.getnc_exop.python.*getnc_exop.DrsReplicaPrefixMapTestCase.test_regular_prefix_map_ex_attid.* diff --git a/source4/rpc_server/drsuapi/getncchanges.c b/source4/rpc_server/drsuapi/getncchanges.c index f692429..c1de242 100644 --- a/source4/rpc_server/drsuapi/getncchanges.c +++ b/source4/rpc_server/drsuapi/getncchanges.c @@ -133,24 +133,57 @@ static bool udv_filter(const struct drsuapi_DsReplicaCursorCtrEx *udv, } -static int attid_cmp(enum drsuapi_DsAttributeId a1, enum drsuapi_DsAttributeId a2) +static int uint32_t_cmp(uint32_t a1, uint32_t a2) { if (a1 == a2) return 0; - return ((uint32_t)a1) > ((uint32_t)a2) ? 1 : -1; + return a1 > a2 ? 1 : -1; } -/* - check if an attribute is in a partial_attribute_set - */ -static bool check_partial_attribute_set(const struct dsdb_attribute *sa, - struct drsuapi_DsPartialAttributeSet *pas) +static int uint32_t_ptr_cmp(uint32_t *a1, uint32_t *a2, void *unused) { - enum drsuapi_DsAttributeId *result; - BINARY_ARRAY_SEARCH_V(pas->attids, pas->num_attids, (enum drsuapi_DsAttributeId)sa->attributeID_id, - attid_cmp, result); - return result != NULL; + if (*a1 == *a2) return 0; + return *a1 > *a2 ? 1 : -1; } +static WERROR getncchanges_attid_remote_to_local(const struct dsdb_schema *schema, + const struct dsdb_syntax_ctx *ctx, + enum drsuapi_DsAttributeId remote_attid_as_enum, + enum drsuapi_DsAttributeId *local_attid_as_enum, + const struct dsdb_attribute **_sa) +{ + WERROR werr; + const struct dsdb_attribute *sa = NULL; + + if (ctx->pfm_remote == NULL) { + DEBUG(7, ("No prefixMap supplied, falling back to local prefixMap.\n")); + goto fail; + } + + werr = dsdb_attribute_drsuapi_remote_to_local(ctx, + remote_attid_as_enum, + local_attid_as_enum, + _sa); + if (!W_ERROR_IS_OK(werr)) { + DEBUG(3, ("WARNING: Unable to resolve remote attid, falling back to local prefixMap.\n")); + goto fail; + } + + return werr; +fail: + + sa = dsdb_attribute_by_attributeID_id(schema, remote_attid_as_enum); + if (sa == NULL) { + return WERR_DS_DRA_SCHEMA_MISMATCH; + } else { + if (local_attid_as_enum != NULL) { + *local_attid_as_enum = sa->attributeID_id; + } + if (_sa != NULL) { + *_sa = sa; + } + return WERR_OK; + } +} /* drsuapi_DsGetNCChanges for one object @@ -167,7 +200,8 @@ static WERROR get_nc_changes_build_object(struct drsuapi_DsReplicaObjectListItem struct drsuapi_DsPartialAttributeSet *partial_attribute_set, struct drsuapi_DsReplicaCursorCtrEx *uptodateness_vector, enum drsuapi_DsExtendedOperation extended_op, - bool force_object_return) + bool force_object_return, + uint32_t *local_pas) { const struct ldb_val *md_value; uint32_t i, n; @@ -294,8 +328,13 @@ static WERROR get_nc_changes_build_object(struct drsuapi_DsReplicaObjectListItem } /* filter by partial_attribute_set */ - if (partial_attribute_set && !check_partial_attribute_set(sa, partial_attribute_set)) { - continue; + if (partial_attribute_set) { + uint32_t *result = NULL; + BINARY_ARRAY_SEARCH_V(local_pas, partial_attribute_set->num_attids, sa->attributeID_id, + uint32_t_cmp, result); + if (result == NULL) { + continue; + } } obj->meta_data_ctr->meta_data[n].originating_change_time = md.ctr.ctr1.array[i].originating_change_time; @@ -1185,11 +1224,13 @@ static WERROR getncchanges_change_master(struct drsuapi_bind_state *b_state, */ static WERROR dcesrv_drsuapi_is_reveal_secrets_request(struct drsuapi_bind_state *b_state, struct drsuapi_DsGetNCChangesRequest10 *req10, + struct dsdb_schema_prefixmap *pfm_remote, bool *is_secret_request) { enum drsuapi_DsExtendedOperation exop; uint32_t i; struct dsdb_schema *schema; + struct dsdb_syntax_ctx syntax_ctx; *is_secret_request = true; @@ -1223,14 +1264,24 @@ static WERROR dcesrv_drsuapi_is_reveal_secrets_request(struct drsuapi_bind_state } schema = dsdb_get_schema(b_state->sam_ctx, NULL); + dsdb_syntax_ctx_init(&syntax_ctx, b_state->sam_ctx, schema); + syntax_ctx.pfm_remote = pfm_remote; /* check the attributes they asked for */ for (i=0; ipartial_attribute_set->num_attids; i++) { const struct dsdb_attribute *sa; - sa = dsdb_attribute_by_attributeID_id(schema, req10->partial_attribute_set->attids[i]); - if (sa == NULL) { - return WERR_DS_DRA_SCHEMA_MISMATCH; + WERROR werr = getncchanges_attid_remote_to_local(schema, + &syntax_ctx, + req10->partial_attribute_set->attids[i], + NULL, + &sa); + + if (!W_ERROR_IS_OK(werr)) { + DEBUG(0,(__location__": attid 0x%08X not found: %s\n", + req10->partial_attribute_set->attids[i], win_errstr(werr))); + return werr; } + if (!dsdb_attr_in_rodc_fas(sa)) { *is_secret_request = true; return WERR_OK; @@ -1241,10 +1292,18 @@ static WERROR dcesrv_drsuapi_is_reveal_secrets_request(struct drsuapi_bind_state /* check the extended attributes they asked for */ for (i=0; ipartial_attribute_set_ex->num_attids; i++) { const struct dsdb_attribute *sa; - sa = dsdb_attribute_by_attributeID_id(schema, req10->partial_attribute_set_ex->attids[i]); - if (sa == NULL) { - return WERR_DS_DRA_SCHEMA_MISMATCH; + WERROR werr = getncchanges_attid_remote_to_local(schema, + &syntax_ctx, + req10->partial_attribute_set_ex->attids[i], + NULL, + &sa); + + if (!W_ERROR_IS_OK(werr)) { + DEBUG(0,(__location__": attid 0x%08X not found: %s\n", + req10->partial_attribute_set_ex->attids[i], win_errstr(werr))); + return werr; } + if (!dsdb_attr_in_rodc_fas(sa)) { *is_secret_request = true; return WERR_OK; @@ -1262,11 +1321,13 @@ static WERROR dcesrv_drsuapi_is_reveal_secrets_request(struct drsuapi_bind_state */ static WERROR dcesrv_drsuapi_is_gc_pas_request(struct drsuapi_bind_state *b_state, struct drsuapi_DsGetNCChangesRequest10 *req10, + struct dsdb_schema_prefixmap *pfm_remote, bool *is_gc_pas_request) { enum drsuapi_DsExtendedOperation exop; uint32_t i; struct dsdb_schema *schema; + struct dsdb_syntax_ctx syntax_ctx; exop = req10->extended_op; @@ -1291,14 +1352,24 @@ static WERROR dcesrv_drsuapi_is_gc_pas_request(struct drsuapi_bind_state *b_stat } schema = dsdb_get_schema(b_state->sam_ctx, NULL); + dsdb_syntax_ctx_init(&syntax_ctx, b_state->sam_ctx, schema); + syntax_ctx.pfm_remote = pfm_remote; /* check the attributes they asked for */ for (i=0; ipartial_attribute_set->num_attids; i++) { const struct dsdb_attribute *sa; - sa = dsdb_attribute_by_attributeID_id(schema, req10->partial_attribute_set->attids[i]); - if (sa == NULL) { - return WERR_DS_DRA_SCHEMA_MISMATCH; + WERROR werr = getncchanges_attid_remote_to_local(schema, + &syntax_ctx, + req10->partial_attribute_set->attids[i], + NULL, + &sa); + + if (!W_ERROR_IS_OK(werr)) { + DEBUG(0,(__location__": attid 0x%08X not found: %s\n", + req10->partial_attribute_set->attids[i], win_errstr(werr))); + return werr; } + if (!sa->isMemberOfPartialAttributeSet) { *is_gc_pas_request = false; return WERR_OK; @@ -1309,10 +1380,18 @@ static WERROR dcesrv_drsuapi_is_gc_pas_request(struct drsuapi_bind_state *b_stat /* check the extended attributes they asked for */ for (i=0; ipartial_attribute_set_ex->num_attids; i++) { const struct dsdb_attribute *sa; - sa = dsdb_attribute_by_attributeID_id(schema, req10->partial_attribute_set_ex->attids[i]); - if (sa == NULL) { - return WERR_DS_DRA_SCHEMA_MISMATCH; + WERROR werr = getncchanges_attid_remote_to_local(schema, + &syntax_ctx, + req10->partial_attribute_set_ex->attids[i], + NULL, + &sa); + + if (!W_ERROR_IS_OK(werr)) { + DEBUG(0,(__location__": attid 0x%08X not found: %s\n", + req10->partial_attribute_set_ex->attids[i], win_errstr(werr))); + return werr; } + if (!sa->isMemberOfPartialAttributeSet) { *is_gc_pas_request = false; return WERR_OK; @@ -1629,6 +1708,9 @@ WERROR dcesrv_drsuapi_DsGetNCChanges(struct dcesrv_call_state *dce_call, TALLOC_ bool has_get_all_changes = false; struct GUID invocation_id; static const struct drsuapi_DsReplicaLinkedAttribute no_linked_attr; + struct dsdb_schema_prefixmap *pfm_remote = NULL; + bool full = true; + uint32_t *local_pas = NULL; DCESRV_PULL_HANDLE_WERR(h, r->in.bind_handle, DRSUAPI_BIND_HANDLE); b_state = h->data; @@ -1706,9 +1788,35 @@ WERROR dcesrv_drsuapi_DsGetNCChanges(struct dcesrv_call_state *dce_call, TALLOC_ return werr; } + if (dsdb_functional_level(sam_ctx) >= DS_DOMAIN_FUNCTION_2008) { + full = req10->partial_attribute_set == NULL && + req10->partial_attribute_set_ex == NULL; + } else { + full = (options & DRSUAPI_DRS_WRIT_REP) != 0; + } + + werr = dsdb_schema_pfm_from_drsuapi_pfm(&req10->mapping_ctr, true, + mem_ctx, &pfm_remote, NULL); + + /* We were supplied a partial attribute set, without the prefix map! */ + if (!full && !W_ERROR_IS_OK(werr)) { + if (req10->mapping_ctr.num_mappings == 0) { + /* + * Despite the fact MS-DRSR specifies that this shouldn't + * happen, Windows RODCs will in fact not provide a prefixMap. + */ + DEBUG(5,(__location__ ": Failed to provide a remote prefixMap," + " falling back to local prefixMap\n")); + } else { + DEBUG(0,(__location__ ": Failed to decode remote prefixMap: %s\n", + win_errstr(werr))); + return werr; + } + } + /* allowed if the GC PAS and client has GUID_DRS_GET_FILTERED_ATTRIBUTES */ - werr = dcesrv_drsuapi_is_gc_pas_request(b_state, req10, &is_gc_pas_request); + werr = dcesrv_drsuapi_is_gc_pas_request(b_state, req10, pfm_remote, &is_gc_pas_request); if (!W_ERROR_IS_OK(werr)) { return werr; } @@ -1723,7 +1831,9 @@ WERROR dcesrv_drsuapi_DsGetNCChanges(struct dcesrv_call_state *dce_call, TALLOC_ } } - werr = dcesrv_drsuapi_is_reveal_secrets_request(b_state, req10, &is_secret_request); + werr = dcesrv_drsuapi_is_reveal_secrets_request(b_state, req10, + pfm_remote, + &is_secret_request); if (!W_ERROR_IS_OK(werr)) { return werr; } @@ -2040,6 +2150,30 @@ allowed: * 10 seconds by default. */ max_wait = lpcfg_parm_int(dce_call->conn->dce_ctx->lp_ctx, NULL, "drs", "max work time", 10); + + if (req10->partial_attribute_set != NULL) { + struct dsdb_syntax_ctx syntax_ctx; + uint32_t j = 0; + + dsdb_syntax_ctx_init(&syntax_ctx, b_state->sam_ctx, schema); + syntax_ctx.pfm_remote = pfm_remote; + + local_pas = talloc_array(b_state, uint32_t, req10->partial_attribute_set->num_attids); + + for (j = 0; j < req10->partial_attribute_set->num_attids; j++) { + getncchanges_attid_remote_to_local(schema, + &syntax_ctx, + req10->partial_attribute_set->attids[j], + (enum drsuapi_DsAttributeId *)&local_pas[j], + NULL); + } + + LDB_TYPESAFE_QSORT(local_pas, + req10->partial_attribute_set->num_attids, + NULL, + uint32_t_ptr_cmp); + } + for (i=getnc_state->num_processed; inum_records && !null_scope && @@ -2093,7 +2227,8 @@ allowed: req10->partial_attribute_set, req10->uptodateness_vector, req10->extended_op, - max_wait_reached); + max_wait_reached, + local_pas); if (!W_ERROR_IS_OK(werr)) { return werr; } -- 1.9.1 From be9bf2fb8fcb250d8a308c67c35897da06f36a04 Mon Sep 17 00:00:00 2001 From: Bob Campbell Date: Mon, 22 Aug 2016 14:43:41 +1200 Subject: [PATCH 12/12] tests/getnc_exop: Ensure that attribute list sorting is correct With a binary search, this can only be tested on 3+ elements. Pair-programmed-with: Garming Sam Signed-off-by: Bob Campbell Signed-off-by: Garming Sam Reviewed-by: Andrew Bartlett Autobuild-User(master): Garming Sam Autobuild-Date(master): Thu Aug 25 14:22:25 CEST 2016 on sn-devel-144 BUG: https://bugzilla.samba.org/show_bug.cgi?id=12187 (cherry picked from commit cb243d86d892cb148d01dd87f29f86f3e2c1ebd0) --- source4/torture/drs/python/getnc_exop.py | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/source4/torture/drs/python/getnc_exop.py b/source4/torture/drs/python/getnc_exop.py index 8224df1..d058e66 100644 --- a/source4/torture/drs/python/getnc_exop.py +++ b/source4/torture/drs/python/getnc_exop.py @@ -422,7 +422,9 @@ class DrsReplicaPrefixMapTestCase(drs_base.DrsBaseTestCase, ExopBaseTest): pfm.mappings = tmp # 90 for unicodePwd (with new prefix = 0) - partial_attribute_set = self.get_partial_attribute_set([90]) + # 589824, 589827 for objectClass and CN + # Use of three ensures sorting is correct + partial_attribute_set = self.get_partial_attribute_set([90, 589824, 589827]) req8 = self._exop_req8(dest_dsa=None, invocation_id=dc_guid_1, nc_dn_str=self.user, -- 1.9.1