source: trunk/server/source4/torture/rpc/testjoin.c

Last change on this file was 745, checked in by Silvan Scherrer, 13 years ago

Samba Server: updated trunk to 3.6.0
File size: 23.0 KB
Line 
1/*
2 Unix SMB/CIFS implementation.
3
4 utility code to join/leave a domain
5
6 Copyright (C) Andrew Tridgell 2004
7
8 This program is free software; you can redistribute it and/or modify
9 it under the terms of the GNU General Public License as published by
10 the Free Software Foundation; either version 3 of the License, or
11 (at your option) any later version.
12
13 This program is distributed in the hope that it will be useful,
14 but WITHOUT ANY WARRANTY; without even the implied warranty of
15 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
16 GNU General Public License for more details.
17
18 You should have received a copy of the GNU General Public License
19 along with this program. If not, see <http://www.gnu.org/licenses/>.
20*/
21
22/*
23 this code is used by other torture modules to join/leave a domain
24 as either a member, bdc or thru a trust relationship
25*/
26
27#include "includes.h"
28#include "system/time.h"
29#include "../lib/crypto/crypto.h"
30#include "libnet/libnet.h"
31#include "lib/cmdline/popt_common.h"
32#include "librpc/gen_ndr/ndr_samr_c.h"
33
34#include "libcli/auth/libcli_auth.h"
35#include "torture/rpc/torture_rpc.h"
36#include "libcli/security/security.h"
37#include "param/param.h"
38
39struct test_join {
40 struct dcerpc_pipe *p;
41 struct policy_handle user_handle;
42 struct libnet_JoinDomain *libnet_r;
43 struct dom_sid *dom_sid;
44 const char *dom_netbios_name;
45 const char *dom_dns_name;
46 struct dom_sid *user_sid;
47 struct GUID user_guid;
48 const char *netbios_name;
49};
50
51
52static NTSTATUS DeleteUser_byname(struct dcerpc_binding_handle *b,
53 TALLOC_CTX *mem_ctx,
54 struct policy_handle *handle, const char *name)
55{
56 NTSTATUS status;
57 struct samr_DeleteUser d;
58 struct policy_handle user_handle;
59 uint32_t rid;
60 struct samr_LookupNames n;
61 struct samr_Ids rids, types;
62 struct lsa_String sname;
63 struct samr_OpenUser r;
64
65 sname.string = name;
66
67 n.in.domain_handle = handle;
68 n.in.num_names = 1;
69 n.in.names = &sname;
70 n.out.rids = &rids;
71 n.out.types = &types;
72
73 status = dcerpc_samr_LookupNames_r(b, mem_ctx, &n);
74 if (!NT_STATUS_IS_OK(status)) {
75 return status;
76 }
77 if (NT_STATUS_IS_OK(n.out.result)) {
78 rid = n.out.rids->ids[0];
79 } else {
80 return n.out.result;
81 }
82
83 r.in.domain_handle = handle;
84 r.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
85 r.in.rid = rid;
86 r.out.user_handle = &user_handle;
87
88 status = dcerpc_samr_OpenUser_r(b, mem_ctx, &r);
89 if (!NT_STATUS_IS_OK(status)) {
90 printf("OpenUser(%s) failed - %s\n", name, nt_errstr(status));
91 return status;
92 }
93 if (!NT_STATUS_IS_OK(r.out.result)) {
94 printf("OpenUser(%s) failed - %s\n", name, nt_errstr(r.out.result));
95 return r.out.result;
96 }
97
98 d.in.user_handle = &user_handle;
99 d.out.user_handle = &user_handle;
100 status = dcerpc_samr_DeleteUser_r(b, mem_ctx, &d);
101 if (!NT_STATUS_IS_OK(status)) {
102 return status;
103 }
104 if (!NT_STATUS_IS_OK(d.out.result)) {
105 return d.out.result;
106 }
107
108 return NT_STATUS_OK;
109}
110
111/*
112 create a test user in the domain
113 an opaque pointer is returned. Pass it to torture_leave_domain()
114 when finished
115*/
116
117struct test_join *torture_create_testuser_max_pwlen(struct torture_context *torture,
118 const char *username,
119 const char *domain,
120 uint16_t acct_type,
121 const char **random_password,
122 int max_pw_len)
123{
124 NTSTATUS status;
125 struct samr_Connect c;
126 struct samr_CreateUser2 r;
127 struct samr_OpenDomain o;
128 struct samr_LookupDomain l;
129 struct dom_sid2 *sid = NULL;
130 struct samr_GetUserPwInfo pwp;
131 struct samr_PwInfo info;
132 struct samr_SetUserInfo s;
133 union samr_UserInfo u;
134 struct policy_handle handle;
135 struct policy_handle domain_handle;
136 uint32_t access_granted;
137 uint32_t rid;
138 DATA_BLOB session_key;
139 struct lsa_String name;
140
141 int policy_min_pw_len = 0;
142 struct test_join *join;
143 char *random_pw;
144 const char *dc_binding = torture_setting_string(torture, "dc_binding", NULL);
145 struct dcerpc_binding_handle *b = NULL;
146
147 join = talloc(NULL, struct test_join);
148 if (join == NULL) {
149 return NULL;
150 }
151
152 ZERO_STRUCTP(join);
153
154 printf("Connecting to SAMR\n");
155
156 if (dc_binding) {
157 status = dcerpc_pipe_connect(join,
158 &join->p,
159 dc_binding,
160 &ndr_table_samr,
161 cmdline_credentials, NULL, torture->lp_ctx);
162
163 } else {
164 status = torture_rpc_connection(torture,
165 &join->p,
166 &ndr_table_samr);
167 }
168 if (!NT_STATUS_IS_OK(status)) {
169 return NULL;
170 }
171 b = join->p->binding_handle;
172
173 c.in.system_name = NULL;
174 c.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
175 c.out.connect_handle = &handle;
176
177 status = dcerpc_samr_Connect_r(b, join, &c);
178 if (!NT_STATUS_IS_OK(status)) {
179 const char *errstr = nt_errstr(status);
180 printf("samr_Connect failed - %s\n", errstr);
181 return NULL;
182 }
183 if (!NT_STATUS_IS_OK(c.out.result)) {
184 const char *errstr = nt_errstr(c.out.result);
185 printf("samr_Connect failed - %s\n", errstr);
186 return NULL;
187 }
188
189 if (domain) {
190 printf("Opening domain %s\n", domain);
191
192 name.string = domain;
193 l.in.connect_handle = &handle;
194 l.in.domain_name = &name;
195 l.out.sid = &sid;
196
197 status = dcerpc_samr_LookupDomain_r(b, join, &l);
198 if (!NT_STATUS_IS_OK(status)) {
199 printf("LookupDomain failed - %s\n", nt_errstr(status));
200 goto failed;
201 }
202 if (!NT_STATUS_IS_OK(l.out.result)) {
203 printf("LookupDomain failed - %s\n", nt_errstr(l.out.result));
204 goto failed;
205 }
206 } else {
207 struct samr_EnumDomains e;
208 uint32_t resume_handle = 0, num_entries;
209 struct samr_SamArray *sam;
210 int i;
211
212 e.in.connect_handle = &handle;
213 e.in.buf_size = (uint32_t)-1;
214 e.in.resume_handle = &resume_handle;
215 e.out.sam = &sam;
216 e.out.num_entries = &num_entries;
217 e.out.resume_handle = &resume_handle;
218
219 status = dcerpc_samr_EnumDomains_r(b, join, &e);
220 if (!NT_STATUS_IS_OK(status)) {
221 printf("EnumDomains failed - %s\n", nt_errstr(status));
222 goto failed;
223 }
224 if (!NT_STATUS_IS_OK(e.out.result)) {
225 printf("EnumDomains failed - %s\n", nt_errstr(e.out.result));
226 goto failed;
227 }
228 if ((num_entries != 2) || (sam && sam->count != 2)) {
229 printf("unexpected number of domains\n");
230 goto failed;
231 }
232 for (i=0; i < 2; i++) {
233 if (!strequal(sam->entries[i].name.string, "builtin")) {
234 domain = sam->entries[i].name.string;
235 break;
236 }
237 }
238 if (domain) {
239 printf("Opening domain %s\n", domain);
240
241 name.string = domain;
242 l.in.connect_handle = &handle;
243 l.in.domain_name = &name;
244 l.out.sid = &sid;
245
246 status = dcerpc_samr_LookupDomain_r(b, join, &l);
247 if (!NT_STATUS_IS_OK(status)) {
248 printf("LookupDomain failed - %s\n", nt_errstr(status));
249 goto failed;
250 }
251 if (!NT_STATUS_IS_OK(l.out.result)) {
252 printf("LookupDomain failed - %s\n", nt_errstr(l.out.result));
253 goto failed;
254 }
255 } else {
256 printf("cannot proceed without domain name\n");
257 goto failed;
258 }
259 }
260
261 talloc_steal(join, *l.out.sid);
262 join->dom_sid = *l.out.sid;
263 join->dom_netbios_name = talloc_strdup(join, domain);
264 if (!join->dom_netbios_name) goto failed;
265
266 o.in.connect_handle = &handle;
267 o.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
268 o.in.sid = *l.out.sid;
269 o.out.domain_handle = &domain_handle;
270
271 status = dcerpc_samr_OpenDomain_r(b, join, &o);
272 if (!NT_STATUS_IS_OK(status)) {
273 printf("OpenDomain failed - %s\n", nt_errstr(status));
274 goto failed;
275 }
276 if (!NT_STATUS_IS_OK(o.out.result)) {
277 printf("OpenDomain failed - %s\n", nt_errstr(o.out.result));
278 goto failed;
279 }
280
281 printf("Creating account %s\n", username);
282
283again:
284 name.string = username;
285 r.in.domain_handle = &domain_handle;
286 r.in.account_name = &name;
287 r.in.acct_flags = acct_type;
288 r.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
289 r.out.user_handle = &join->user_handle;
290 r.out.access_granted = &access_granted;
291 r.out.rid = &rid;
292
293 status = dcerpc_samr_CreateUser2_r(b, join, &r);
294 if (!NT_STATUS_IS_OK(status)) {
295 printf("CreateUser2 failed - %s\n", nt_errstr(status));
296 goto failed;
297 }
298
299 if (NT_STATUS_EQUAL(r.out.result, NT_STATUS_USER_EXISTS)) {
300 status = DeleteUser_byname(b, join, &domain_handle, name.string);
301 if (NT_STATUS_IS_OK(status)) {
302 goto again;
303 }
304 }
305
306 if (!NT_STATUS_IS_OK(r.out.result)) {
307 printf("CreateUser2 failed - %s\n", nt_errstr(r.out.result));
308 goto failed;
309 }
310
311 join->user_sid = dom_sid_add_rid(join, join->dom_sid, rid);
312
313 pwp.in.user_handle = &join->user_handle;
314 pwp.out.info = &info;
315
316 status = dcerpc_samr_GetUserPwInfo_r(b, join, &pwp);
317 if (NT_STATUS_IS_OK(status) && NT_STATUS_IS_OK(pwp.out.result)) {
318 policy_min_pw_len = pwp.out.info->min_password_length;
319 }
320
321 random_pw = generate_random_password(join, MAX(8, policy_min_pw_len), max_pw_len);
322
323 printf("Setting account password '%s'\n", random_pw);
324
325 ZERO_STRUCT(u);
326 s.in.user_handle = &join->user_handle;
327 s.in.info = &u;
328 s.in.level = 24;
329
330 encode_pw_buffer(u.info24.password.data, random_pw, STR_UNICODE);
331 u.info24.password_expired = 0;
332
333 status = dcerpc_fetch_session_key(join->p, &session_key);
334 if (!NT_STATUS_IS_OK(status)) {
335 printf("SetUserInfo level %u - no session key - %s\n",
336 s.in.level, nt_errstr(status));
337 torture_leave_domain(torture, join);
338 goto failed;
339 }
340
341 arcfour_crypt_blob(u.info24.password.data, 516, &session_key);
342
343 status = dcerpc_samr_SetUserInfo_r(b, join, &s);
344 if (!NT_STATUS_IS_OK(status)) {
345 printf("SetUserInfo failed - %s\n", nt_errstr(status));
346 goto failed;
347 }
348 if (!NT_STATUS_IS_OK(s.out.result)) {
349 printf("SetUserInfo failed - %s\n", nt_errstr(s.out.result));
350 goto failed;
351 }
352
353 ZERO_STRUCT(u);
354 s.in.user_handle = &join->user_handle;
355 s.in.info = &u;
356 s.in.level = 21;
357
358 u.info21.acct_flags = acct_type | ACB_PWNOEXP;
359 u.info21.fields_present = SAMR_FIELD_ACCT_FLAGS | SAMR_FIELD_DESCRIPTION | SAMR_FIELD_COMMENT | SAMR_FIELD_FULL_NAME;
360
361 u.info21.comment.string = talloc_asprintf(join,
362 "Tortured by Samba4: %s",
363 timestring(join, time(NULL)));
364
365 u.info21.full_name.string = talloc_asprintf(join,
366 "Torture account for Samba4: %s",
367 timestring(join, time(NULL)));
368
369 u.info21.description.string = talloc_asprintf(join,
370 "Samba4 torture account created by host %s: %s",
371 lpcfg_netbios_name(torture->lp_ctx),
372 timestring(join, time(NULL)));
373
374 printf("Resetting ACB flags, force pw change time\n");
375
376 status = dcerpc_samr_SetUserInfo_r(b, join, &s);
377 if (!NT_STATUS_IS_OK(status)) {
378 printf("SetUserInfo failed - %s\n", nt_errstr(status));
379 goto failed;
380 }
381 if (!NT_STATUS_IS_OK(s.out.result)) {
382 printf("SetUserInfo failed - %s\n", nt_errstr(s.out.result));
383 goto failed;
384 }
385
386 if (random_password) {
387 *random_password = random_pw;
388 }
389
390 return join;
391
392failed:
393 torture_leave_domain(torture, join);
394 return NULL;
395}
396
397
398struct test_join *torture_create_testuser(struct torture_context *torture,
399 const char *username,
400 const char *domain,
401 uint16_t acct_type,
402 const char **random_password)
403{
404 return torture_create_testuser_max_pwlen(torture, username, domain, acct_type, random_password, 255);
405}
406
407_PUBLIC_ struct test_join *torture_join_domain(struct torture_context *tctx,
408 const char *machine_name,
409 uint32_t acct_flags,
410 struct cli_credentials **machine_credentials)
411{
412 NTSTATUS status;
413 struct libnet_context *libnet_ctx;
414 struct libnet_JoinDomain *libnet_r;
415 struct test_join *tj;
416 struct samr_SetUserInfo s;
417 union samr_UserInfo u;
418
419 tj = talloc(tctx, struct test_join);
420 if (!tj) return NULL;
421
422 libnet_r = talloc(tj, struct libnet_JoinDomain);
423 if (!libnet_r) {
424 talloc_free(tj);
425 return NULL;
426 }
427
428 libnet_ctx = libnet_context_init(tctx->ev, tctx->lp_ctx);
429 if (!libnet_ctx) {
430 talloc_free(tj);
431 return NULL;
432 }
433
434 tj->libnet_r = libnet_r;
435
436 libnet_ctx->cred = cmdline_credentials;
437 libnet_r->in.binding = torture_setting_string(tctx, "binding", NULL);
438 if (!libnet_r->in.binding) {
439 libnet_r->in.binding = talloc_asprintf(libnet_r, "ncacn_np:%s", torture_setting_string(tctx, "host", NULL));
440 }
441 libnet_r->in.level = LIBNET_JOINDOMAIN_SPECIFIED;
442 libnet_r->in.netbios_name = machine_name;
443 libnet_r->in.account_name = talloc_asprintf(libnet_r, "%s$", machine_name);
444 if (!libnet_r->in.account_name) {
445 talloc_free(tj);
446 return NULL;
447 }
448
449 libnet_r->in.acct_type = acct_flags;
450 libnet_r->in.recreate_account = true;
451
452 status = libnet_JoinDomain(libnet_ctx, libnet_r, libnet_r);
453 if (!NT_STATUS_IS_OK(status)) {
454 if (libnet_r->out.error_string) {
455 DEBUG(0, ("Domain join failed - %s\n", libnet_r->out.error_string));
456 } else {
457 DEBUG(0, ("Domain join failed - %s\n", nt_errstr(status)));
458 }
459 talloc_free(tj);
460 return NULL;
461 }
462 tj->p = libnet_r->out.samr_pipe;
463 tj->user_handle = *libnet_r->out.user_handle;
464 tj->dom_sid = libnet_r->out.domain_sid;
465 talloc_steal(tj, libnet_r->out.domain_sid);
466 tj->dom_netbios_name = libnet_r->out.domain_name;
467 talloc_steal(tj, libnet_r->out.domain_name);
468 tj->dom_dns_name = libnet_r->out.realm;
469 talloc_steal(tj, libnet_r->out.realm);
470 tj->user_guid = libnet_r->out.account_guid;
471 tj->netbios_name = talloc_strdup(tj, machine_name);
472 if (!tj->netbios_name) {
473 talloc_free(tj);
474 return NULL;
475 }
476
477 ZERO_STRUCT(u);
478 s.in.user_handle = &tj->user_handle;
479 s.in.info = &u;
480 s.in.level = 21;
481
482 u.info21.fields_present = SAMR_FIELD_DESCRIPTION | SAMR_FIELD_COMMENT | SAMR_FIELD_FULL_NAME;
483 u.info21.comment.string = talloc_asprintf(tj,
484 "Tortured by Samba4: %s",
485 timestring(tj, time(NULL)));
486 u.info21.full_name.string = talloc_asprintf(tj,
487 "Torture account for Samba4: %s",
488 timestring(tj, time(NULL)));
489
490 u.info21.description.string = talloc_asprintf(tj,
491 "Samba4 torture account created by host %s: %s",
492 lpcfg_netbios_name(tctx->lp_ctx), timestring(tj, time(NULL)));
493
494 status = dcerpc_samr_SetUserInfo_r(tj->p->binding_handle, tj, &s);
495 if (!NT_STATUS_IS_OK(status)) {
496 printf("SetUserInfo (non-critical) failed - %s\n", nt_errstr(status));
497 }
498 if (!NT_STATUS_IS_OK(s.out.result)) {
499 printf("SetUserInfo (non-critical) failed - %s\n", nt_errstr(s.out.result));
500 }
501
502 *machine_credentials = cli_credentials_init(tj);
503 cli_credentials_set_conf(*machine_credentials, tctx->lp_ctx);
504 cli_credentials_set_workstation(*machine_credentials, machine_name, CRED_SPECIFIED);
505 cli_credentials_set_domain(*machine_credentials, libnet_r->out.domain_name, CRED_SPECIFIED);
506 if (libnet_r->out.realm) {
507 cli_credentials_set_realm(*machine_credentials, libnet_r->out.realm, CRED_SPECIFIED);
508 }
509 cli_credentials_set_username(*machine_credentials, libnet_r->in.account_name, CRED_SPECIFIED);
510 cli_credentials_set_password(*machine_credentials, libnet_r->out.join_password, CRED_SPECIFIED);
511 cli_credentials_set_kvno(*machine_credentials, libnet_r->out.kvno);
512 if (acct_flags & ACB_SVRTRUST) {
513 cli_credentials_set_secure_channel_type(*machine_credentials,
514 SEC_CHAN_BDC);
515 } else if (acct_flags & ACB_WSTRUST) {
516 cli_credentials_set_secure_channel_type(*machine_credentials,
517 SEC_CHAN_WKSTA);
518 } else {
519 DEBUG(0, ("Invalid account type specificed to torture_join_domain\n"));
520 talloc_free(*machine_credentials);
521 return NULL;
522 }
523
524 return tj;
525}
526
527struct dcerpc_pipe *torture_join_samr_pipe(struct test_join *join)
528{
529 return join->p;
530}
531
532struct policy_handle *torture_join_samr_user_policy(struct test_join *join)
533{
534 return &join->user_handle;
535}
536
537static NTSTATUS torture_leave_ads_domain(struct torture_context *torture,
538 TALLOC_CTX *mem_ctx,
539 struct libnet_JoinDomain *libnet_r)
540{
541 int rtn;
542 TALLOC_CTX *tmp_ctx;
543
544 struct ldb_dn *server_dn;
545 struct ldb_context *ldb_ctx;
546
547 char *remote_ldb_url;
548
549 /* Check if we are a domain controller. If not, exit. */
550 if (!libnet_r->out.server_dn_str) {
551 return NT_STATUS_OK;
552 }
553
554 tmp_ctx = talloc_named(mem_ctx, 0, "torture_leave temporary context");
555 if (!tmp_ctx) {
556 libnet_r->out.error_string = NULL;
557 return NT_STATUS_NO_MEMORY;
558 }
559
560 ldb_ctx = ldb_init(tmp_ctx, torture->ev);
561 if (!ldb_ctx) {
562 libnet_r->out.error_string = NULL;
563 talloc_free(tmp_ctx);
564 return NT_STATUS_NO_MEMORY;
565 }
566
567 /* Remove CN=Servers,... entry from the AD. */
568 server_dn = ldb_dn_new(tmp_ctx, ldb_ctx, libnet_r->out.server_dn_str);
569 if (! ldb_dn_validate(server_dn)) {
570 libnet_r->out.error_string = NULL;
571 talloc_free(tmp_ctx);
572 return NT_STATUS_NO_MEMORY;
573 }
574
575 remote_ldb_url = talloc_asprintf(tmp_ctx, "ldap://%s", libnet_r->out.samr_binding->host);
576 if (!remote_ldb_url) {
577 libnet_r->out.error_string = NULL;
578 talloc_free(tmp_ctx);
579 return NT_STATUS_NO_MEMORY;
580 }
581
582 ldb_set_opaque(ldb_ctx, "credentials", cmdline_credentials);
583 ldb_set_opaque(ldb_ctx, "loadparm", cmdline_lp_ctx);
584
585 rtn = ldb_connect(ldb_ctx, remote_ldb_url, 0, NULL);
586 if (rtn != 0) {
587 libnet_r->out.error_string = NULL;
588 talloc_free(tmp_ctx);
589 return NT_STATUS_UNSUCCESSFUL;
590 }
591
592 rtn = ldb_delete(ldb_ctx, server_dn);
593 if (rtn != 0) {
594 libnet_r->out.error_string = NULL;
595 talloc_free(tmp_ctx);
596 return NT_STATUS_UNSUCCESSFUL;
597 }
598
599 DEBUG(0, ("%s removed successfully.\n", libnet_r->out.server_dn_str));
600
601 talloc_free(tmp_ctx);
602 return NT_STATUS_OK;
603}
604
605/*
606 leave the domain, deleting the machine acct
607*/
608
609_PUBLIC_ void torture_leave_domain(struct torture_context *torture, struct test_join *join)
610{
611 struct samr_DeleteUser d;
612 NTSTATUS status;
613
614 if (!join) {
615 return;
616 }
617 d.in.user_handle = &join->user_handle;
618 d.out.user_handle = &join->user_handle;
619
620 /* Delete machine account */
621 status = dcerpc_samr_DeleteUser_r(join->p->binding_handle, join, &d);
622 if (!NT_STATUS_IS_OK(status)) {
623 printf("DeleteUser failed\n");
624 }
625 if (!NT_STATUS_IS_OK(d.out.result)) {
626 printf("Delete of machine account %s failed\n",
627 join->netbios_name);
628 } else {
629 printf("Delete of machine account %s was successful.\n",
630 join->netbios_name);
631 }
632
633 if (join->libnet_r) {
634 status = torture_leave_ads_domain(torture, join, join->libnet_r);
635 }
636
637 talloc_free(join);
638}
639
640/*
641 return the dom sid for a test join
642*/
643_PUBLIC_ const struct dom_sid *torture_join_sid(struct test_join *join)
644{
645 return join->dom_sid;
646}
647
648const struct dom_sid *torture_join_user_sid(struct test_join *join)
649{
650 return join->user_sid;
651}
652
653const char *torture_join_netbios_name(struct test_join *join)
654{
655 return join->netbios_name;
656}
657
658const struct GUID *torture_join_user_guid(struct test_join *join)
659{
660 return &join->user_guid;
661}
662
663const char *torture_join_dom_netbios_name(struct test_join *join)
664{
665 return join->dom_netbios_name;
666}
667
668const char *torture_join_dom_dns_name(struct test_join *join)
669{
670 return join->dom_dns_name;
671}
672
673const char *torture_join_server_dn_str(struct test_join *join)
674{
675 if (join->libnet_r) {
676 return join->libnet_r->out.server_dn_str;
677 }
678 return NULL;
679}
680
681
682#if 0 /* Left as the documentation of the join process, but see new implementation in libnet_become_dc.c */
683struct test_join_ads_dc {
684 struct test_join *join;
685};
686
687struct test_join_ads_dc *torture_join_domain_ads_dc(const char *machine_name,
688 const char *domain,
689 struct cli_credentials **machine_credentials)
690{
691 struct test_join_ads_dc *join;
692
693 join = talloc(NULL, struct test_join_ads_dc);
694 if (join == NULL) {
695 return NULL;
696 }
697
698 join->join = torture_join_domain(machine_name,
699 ACB_SVRTRUST,
700 machine_credentials);
701
702 if (!join->join) {
703 return NULL;
704 }
705
706/* W2K: */
707 /* W2K: modify userAccountControl from 4096 to 532480 */
708
709 /* W2K: modify RDN to OU=Domain Controllers and skip the $ from server name */
710
711 /* ask objectVersion of Schema Partition */
712
713 /* ask rIDManagerReferenz of the Domain Partition */
714
715 /* ask fsMORoleOwner of the RID-Manager$ object
716 * returns CN=NTDS Settings,CN=<DC>,CN=Servers,CN=Default-First-Site-Name, ...
717 */
718
719 /* ask for dnsHostName of CN=<DC>,CN=Servers,CN=Default-First-Site-Name, ... */
720
721 /* ask for objectGUID of CN=NTDS Settings,CN=<DC>,CN=Servers,CN=Default-First-Site-Name, ... */
722
723 /* ask for * of CN=Default-First-Site-Name, ... */
724
725 /* search (&(|(objectClass=user)(objectClass=computer))(sAMAccountName=<machine_name>$)) in Domain Partition
726 * attributes : distinguishedName, userAccountControl
727 */
728
729 /* ask * for CN=<machine_name>,CN=Servers,CN=Default-First-Site-Name,...
730 * should fail with noSuchObject
731 */
732
733 /* add CN=<machine_name>,CN=Servers,CN=Default-First-Site-Name,...
734 *
735 * objectClass = server
736 * systemFlags = 50000000
737 * serverReferenz = CN=<machine_name>,OU=Domain Controllers,...
738 */
739
740 /* ask for * of CN=NTDS Settings,CN=<machine_name>,CN=Servers,CN=Default-First-Site-Name, ...
741 * should fail with noSuchObject
742 */
743
744 /* search for (ncname=<domain_nc>) in CN=Partitions,CN=Configuration,...
745 * attributes: ncName, dnsRoot
746 */
747
748 /* modify add CN=<machine_name>,CN=Servers,CN=Default-First-Site-Name,...
749 * serverReferenz = CN=<machine_name>,OU=Domain Controllers,...
750 * should fail with attributeOrValueExists
751 */
752
753 /* modify replace CN=<machine_name>,CN=Servers,CN=Default-First-Site-Name,...
754 * serverReferenz = CN=<machine_name>,OU=Domain Controllers,...
755 */
756
757 /* DsAddEntry to create the CN=NTDS Settings,CN=<machine_name>,CN=Servers,CN=Default-First-Site-Name, ...
758 *
759 */
760
761 /* replicate CN=Schema,CN=Configuration,...
762 * using DRSUAPI_DS_BIND_GUID_W2K ("6abec3d1-3054-41c8-a362-5a0c5b7d5d71")
763 *
764 */
765
766 /* replicate CN=Configuration,...
767 * using DRSUAPI_DS_BIND_GUID_W2K ("6abec3d1-3054-41c8-a362-5a0c5b7d5d71")
768 *
769 */
770
771 /* replicate Domain Partition
772 * using DRSUAPI_DS_BIND_GUID_W2K ("6abec3d1-3054-41c8-a362-5a0c5b7d5d71")
773 *
774 */
775
776 /* call DsReplicaUpdateRefs() for all partitions like this:
777 * req1: struct drsuapi_DsReplicaUpdateRefsRequest1
778 * naming_context : *
779 * naming_context: struct drsuapi_DsReplicaObjectIdentifier
780 * __ndr_size : 0x000000ae (174)
781 * __ndr_size_sid : 0x00000000 (0)
782 * guid : 00000000-0000-0000-0000-000000000000
783 * sid : S-0-0
784 * dn : 'CN=Schema,CN=Configuration,DC=w2k3,DC=vmnet1,DC=vm,DC=base'
785 * dest_dsa_dns_name : *
786 * dest_dsa_dns_name : '4a0df188-a0b8-47ea-bbe5-e614723f16dd._msdcs.w2k3.vmnet1.vm.base'
787 * dest_dsa_guid : 4a0df188-a0b8-47ea-bbe5-e614723f16dd
788 * options : 0x0000001c (28)
789 * 0: DRSUAPI_DS_REPLICA_UPDATE_ASYNCHRONOUS_OPERATION
790 * 0: DRSUAPI_DS_REPLICA_UPDATE_WRITEABLE
791 * 1: DRSUAPI_DS_REPLICA_UPDATE_ADD_REFERENCE
792 * 1: DRSUAPI_DS_REPLICA_UPDATE_DELETE_REFERENCE
793 * 1: DRSUAPI_DS_REPLICA_UPDATE_0x00000010
794 *
795 * 4a0df188-a0b8-47ea-bbe5-e614723f16dd is the objectGUID the DsAddEntry() returned for the
796 * CN=NTDS Settings,CN=<machine_name>,CN=Servers,CN=Default-First-Site-Name, ...
797 */
798
799/* W2K3: see libnet/libnet_become_dc.c */
800 return join;
801}
802
803#endif
Note: See TracBrowser for help on using the repository browser.