s4-rpc_server/drsuapi: Return correct error code for an invalid DN to EXOP_REPL_OBJ...

BUG: https://bugzilla.samba.org/show_bug.cgi?id=10635

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>

diff --git a/selftest/knownfail.d/getncchanges b/selftest/knownfail.d/getncchanges
index 1ced3870b95d41ccfef1140ce4895c7b26dc7384..e97f61b10a4c6e423d583c504b9ae12f121fafc9 100644 (file)
--- a/selftest/knownfail.d/getncchanges
+++ b/selftest/knownfail.d/getncchanges
@@ -6,7 +6,5 @@ samba4.drs.getncchanges.python\(promoted_dc\).getncchanges.DrsReplicaSyncIntegri
 samba4.drs.getncchanges.python\(promoted_dc\).getncchanges.DrsReplicaSyncIntegrityTestCase.test_repl_get_tgt_multivalued_links\(promoted_dc\)
 # New tests for GetNCChanges with a GUID and a bad DN, like Azure AD Cloud Sync
 ^samba4.drs.getnc_exop.python\(.*\).getnc_exop.DrsReplicaSyncTestCase.test_InvalidDestDSA_and_GUID
-^samba4.drs.getnc_exop.python\(.*\).getnc_exop.DrsReplicaSyncTestCase.test_InvalidNC_DummyDN_InvalidGUID_REPL_SECRET
-^samba4.drs.getnc_exop.python\(.*\).getnc_exop.DrsReplicaSyncTestCase.test_InvalidNC_DummyDN_InvalidGUID_REPL_OBJ
 ^samba4.drs.getnc_exop.python\(.*\).getnc_exop.DrsReplicaSyncTestCase.test_InvalidDestDSA_and_GUID_RID_ALLOC
 ^samba4.drs.getnc_exop.python\(.*\).getnc_exop.DrsReplicaSyncTestCase.test_DummyDN_valid_GUID_REPL_SECRET

diff --git a/source4/rpc_server/drsuapi/getncchanges.c b/source4/rpc_server/drsuapi/getncchanges.c
index 02a6dd3f803746b57160889d36a1c24e76af7757..e2d0781fc4ad97933cacf400436af1ad17ba86e5 100644 (file)
--- a/source4/rpc_server/drsuapi/getncchanges.c
+++ b/source4/rpc_server/drsuapi/getncchanges.c
@@ -2794,6 +2794,20 @@ WERROR dcesrv_drsuapi_DsGetNCChanges(struct dcesrv_call_state *dce_call, TALLOC_
                                                 session_info->security_token,
                                                 req10->naming_context,
                                                 GUID_DRS_GET_CHANGES);
+
+       if (W_ERROR_EQUAL(werr, WERR_DS_DRA_BAD_NC)) {
+               /*
+                * These extended operations need a different error if
+                * the supplied DN can't be found
+                */
+               switch (req10->extended_op) {
+               case DRSUAPI_EXOP_REPL_OBJ:
+               case DRSUAPI_EXOP_REPL_SECRET:
+                       return WERR_DS_DRA_BAD_DN;
+               default:
+                       return werr;
+               }
+       }
        if (!W_ERROR_IS_OK(werr)) {
                return werr;
        }