From 89a1cbc01aea2bcf444ef4f5bb8edb8e289a0343 Mon Sep 17 00:00:00 2001 From: Arvid Requate Date: Tue, 20 Jun 2017 20:05:17 +0200 Subject: [PATCH 1/2] s4:torture/ldap: Test netlogon without NtVer BUG: https://bugzilla.samba.org/show_bug.cgi?id=11392 Signed-off-by: Arvid Requate --- selftest/knownfail.d/huawai | 1 + source4/torture/ldap/netlogon.c | 40 ++++++++++++++++++++++++++++++++++++++++ 2 files changed, 41 insertions(+) create mode 100644 selftest/knownfail.d/huawai diff --git a/selftest/knownfail.d/huawai b/selftest/knownfail.d/huawai new file mode 100644 index 00000000000..cbeaf68a247 --- /dev/null +++ b/selftest/knownfail.d/huawai @@ -0,0 +1 @@ +samba4.ldap.netlogon-udp.netlogon-udp\(ad_dc_ntvfs\) diff --git a/source4/torture/ldap/netlogon.c b/source4/torture/ldap/netlogon.c index 1b43ea7e595..743a1ea75e4 100644 --- a/source4/torture/ldap/netlogon.c +++ b/source4/torture/ldap/netlogon.c @@ -541,6 +541,45 @@ static bool test_netlogon_extra_attrs(struct torture_context *tctx, return true; } +/* + Bug #11392: Huawei Unified Storage System S5500 V3 sends no NtVer + [MS-ADTS] Section 7.3.3.2 "Domain Controller Response to an LDAP Ping" +*/ +static bool test_netlogon_huawei(struct torture_context *tctx, + request_rootdse_t request_rootdse, + void *conn) +{ + struct cldap_search io; + NTSTATUS status; + const char *attrs[] = { + "netlogon", + NULL + }; + struct ldb_message ldbmsg = { NULL, 0, NULL }; + + ZERO_STRUCT(io); + io.in.dest_address = NULL; + io.in.dest_port = 0; + io.in.timeout = 2; + io.in.retries = 2; + + torture_comment(tctx, "Requesting netlogon without NtVer filter\n"); + io.in.filter = talloc_asprintf(tctx, "(&(DnsDomain=%s))", + lpcfg_dnsdomain(tctx->lp_ctx)); + torture_assert(tctx, io.in.filter != NULL, "OOM"); + io.in.attributes = attrs; + status = request_rootdse(conn, tctx, &io); + CHECK_STATUS(status, NT_STATUS_OK); + torture_assert(tctx, io.out.response != NULL, "No Entries found."); + CHECK_VAL(io.out.response->num_attributes, 1); + + ldbmsg.num_elements = io.out.response->num_attributes; + ldbmsg.elements = io.out.response->attributes; + torture_assert(tctx, ldb_msg_find_element(&ldbmsg, "netlogon") != NULL, + "Attribute netlogon not found in Result Entry\n"); + + return true; +} bool torture_netlogon_tcp(struct torture_context *tctx) { @@ -609,6 +648,7 @@ bool torture_netlogon_udp(struct torture_context *tctx) ret &= test_ldap_netlogon(tctx, udp_ldap_netlogon, cldap, host); ret &= test_ldap_netlogon_flags(tctx, udp_ldap_netlogon, cldap, host); ret &= test_netlogon_extra_attrs(tctx, udp_ldap_rootdse, cldap); + ret &= test_netlogon_huawei(tctx, udp_ldap_rootdse, cldap); return ret; } -- 2.11.0 From 876da9ee3693c85bb7a09d7036b27e1ef6f0f42c Mon Sep 17 00:00:00 2001 From: Arvid Requate Date: Wed, 8 Jul 2015 11:48:39 +0200 Subject: [PATCH 2/2] s4-dsdb/netlogon: allow missing ntver in cldap ping Seen in the wild: Huawai storage array performs the initial CLDAP ping without NtVer in the filter. Samba doesn't send a searchResEntry in this case, only the searchResResult (success). [MS-ADTS] sect. 6.3.3.2 "Domain Controller Response to an LDAP Ping" specifies that in this case the DC should answer normally with a NETLOGON_SAM_LOGON_RESPONSE_NT40 structure. Signed-off-by: Arvid Requate --- selftest/knownfail.d/huawai | 1 - source4/dsdb/samdb/ldb_modules/netlogon.c | 4 ---- 2 files changed, 5 deletions(-) delete mode 100644 selftest/knownfail.d/huawai diff --git a/selftest/knownfail.d/huawai b/selftest/knownfail.d/huawai deleted file mode 100644 index cbeaf68a247..00000000000 --- a/selftest/knownfail.d/huawai +++ /dev/null @@ -1 +0,0 @@ -samba4.ldap.netlogon-udp.netlogon-udp\(ad_dc_ntvfs\) diff --git a/source4/dsdb/samdb/ldb_modules/netlogon.c b/source4/dsdb/samdb/ldb_modules/netlogon.c index c5f194dc4dc..ac3dec68a68 100644 --- a/source4/dsdb/samdb/ldb_modules/netlogon.c +++ b/source4/dsdb/samdb/ldb_modules/netlogon.c @@ -486,10 +486,6 @@ NTSTATUS parse_netlogon_request(struct ldb_parse_tree *tree, *domain = lpcfg_dnsdomain(lp_ctx); } - if (*version == -1) { - goto failed; - } - return NT_STATUS_OK; failed: -- 2.11.0