source4/dsdb/samdb/ldb_modules/rootdse.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3
   4    rootDSE ldb module
   5
   6    Copyright (C) Andrew Tridgell 2005
   7    Copyright (C) Simo Sorce 2005-2008
   8
   9    This program is free software; you can redistribute it and/or modify
  10    it under the terms of the GNU General Public License as published by
  11    the Free Software Foundation; either version 3 of the License, or
  12    (at your option) any later version.
  13
  14    This program is distributed in the hope that it will be useful,
  15    but WITHOUT ANY WARRANTY; without even the implied warranty of
  16    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  17    GNU General Public License for more details.
  18
  19    You should have received a copy of the GNU General Public License
  20    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  21 */
  22
  23 #include "includes.h"
  24 #include "lib/ldb/include/ldb.h"
  25 #include "lib/ldb/include/ldb_module.h"
  26 #include "system/time.h"
  27 #include "dsdb/samdb/samdb.h"
  28 #include "version.h"
  29 #include "dsdb/samdb/ldb_modules/util.h"
  30 #include "libcli/security/security.h"
  31 #include "librpc/ndr/libndr.h"
  32
  33 struct private_data {
  34         unsigned int num_controls;
  35         char **controls;
  36         unsigned int num_partitions;
  37         struct ldb_dn **partitions;
  38 };
  39
  40 /*
  41   return 1 if a specific attribute has been requested
  42 */
  43 static int do_attribute(const char * const *attrs, const char *name)
  44 {
  45         return attrs == NULL ||
  46                 ldb_attr_in_list(attrs, name) ||
  47                 ldb_attr_in_list(attrs, "*");
  48 }
  49
  50 static int do_attribute_explicit(const char * const *attrs, const char *name)
  51 {
  52         return attrs != NULL && ldb_attr_in_list(attrs, name);
  53 }
  54
  55
  56 /*
  57   expand a DN attribute to include extended DN information if requested
  58  */
  59 static int expand_dn_in_message(struct ldb_module *module, struct ldb_message *msg,
  60                                 const char *attrname, struct ldb_control *edn_control,
  61                                 struct ldb_request *req)
  62 {
  63         struct ldb_dn *dn, *dn2;
  64         struct ldb_val *v;
  65         int ret;
  66         struct ldb_request *req2;
  67         char *dn_string;
  68         const char *no_attrs[] = { NULL };
  69         struct ldb_result *res;
  70         struct ldb_extended_dn_control *edn;
  71         TALLOC_CTX *tmp_ctx = talloc_new(req);
  72         struct ldb_context *ldb;
  73         int edn_type = 0;
  74
  75         ldb = ldb_module_get_ctx(module);
  76
  77         edn = talloc_get_type(edn_control->data, struct ldb_extended_dn_control);
  78         if (edn) {
  79                 edn_type = edn->type;
  80         }
  81
  82         v = discard_const_p(struct ldb_val, ldb_msg_find_ldb_val(msg, attrname));
  83         if (v == NULL) {
  84                 talloc_free(tmp_ctx);
  85                 return 0;
  86         }
  87
  88         dn_string = talloc_strndup(tmp_ctx, (const char *)v->data, v->length);
  89         if (dn_string == NULL) {
  90                 talloc_free(tmp_ctx);
  91                 return LDB_ERR_OPERATIONS_ERROR;
  92         }
  93
  94         res = talloc_zero(tmp_ctx, struct ldb_result);
  95         if (res == NULL) {
  96                 talloc_free(tmp_ctx);
  97                 return LDB_ERR_OPERATIONS_ERROR;
  98         }
  99
 100         dn = ldb_dn_new(tmp_ctx, ldb, dn_string);
 101         if (!ldb_dn_validate(dn)) {
 102                 talloc_free(tmp_ctx);
 103                 return LDB_ERR_OPERATIONS_ERROR;
 104         }
 105
 106         ret = ldb_build_search_req(&req2, ldb, tmp_ctx,
 107                                    dn,
 108                                    LDB_SCOPE_BASE,
 109                                    NULL,
 110                                    no_attrs,
 111                                    NULL,
 112                                    res, ldb_search_default_callback,
 113                                    req);
 114         if (ret != LDB_SUCCESS) {
 115                 talloc_free(tmp_ctx);
 116                 return ret;
 117         }
 118
 119
 120         ret = ldb_request_add_control(req2,
 121                                       LDB_CONTROL_EXTENDED_DN_OID,
 122                                       edn_control->critical, edn);
 123         if (ret != LDB_SUCCESS) {
 124                 talloc_free(tmp_ctx);
 125                 return ret;
 126         }
 127
 128         ret = ldb_next_request(module, req2);
 129         if (ret == LDB_SUCCESS) {
 130                 ret = ldb_wait(req2->handle, LDB_WAIT_ALL);
 131         }
 132         if (ret != LDB_SUCCESS) {
 133                 talloc_free(tmp_ctx);
 134                 return ret;
 135         }
 136
 137         if (!res || res->count != 1) {
 138                 talloc_free(tmp_ctx);
 139                 return LDB_ERR_OPERATIONS_ERROR;
 140         }
 141
 142         dn2 = res->msgs[0]->dn;
 143
 144         v->data = (uint8_t *)ldb_dn_get_extended_linearized(msg->elements, dn2, edn_type);
 145         v->length = strlen((char *)v->data);
 146
 147         if (v->data == NULL) {
 148                 talloc_free(tmp_ctx);
 149                 return LDB_ERR_OPERATIONS_ERROR;
 150         }
 151
 152         talloc_free(tmp_ctx);
 153
 154         return 0;
 155 }
 156
 157
 158 /*
 159   add dynamically generated attributes to rootDSE result
 160 */
 161 static int rootdse_add_dynamic(struct ldb_module *module, struct ldb_message *msg,
 162                                const char * const *attrs, struct ldb_request *req)
 163 {
 164         struct ldb_context *ldb;
 165         struct private_data *priv = talloc_get_type(ldb_module_get_private(module), struct private_data);
 166         char **server_sasl;
 167         const struct dsdb_schema *schema;
 168         int *val;
 169         struct ldb_control *edn_control;
 170         const char *dn_attrs[] = {
 171                 "configurationNamingContext",
 172                 "defaultNamingContext",
 173                 "dsServiceName",
 174                 "rootDomainNamingContext",
 175                 "schemaNamingContext",
 176                 "serverName",
 177                 NULL
 178         };
 179
 180         ldb = ldb_module_get_ctx(module);
 181         schema = dsdb_get_schema(ldb, NULL);
 182
 183         msg->dn = ldb_dn_new(msg, ldb, NULL);
 184
 185         /* don't return the distinduishedName, cn and name attributes */
 186         ldb_msg_remove_attr(msg, "distinguishedName");
 187         ldb_msg_remove_attr(msg, "cn");
 188         ldb_msg_remove_attr(msg, "name");
 189
 190         if (do_attribute(attrs, "currentTime")) {
 191                 if (ldb_msg_add_steal_string(msg, "currentTime",
 192                                              ldb_timestring(msg, time(NULL))) != 0) {
 193                         goto failed;
 194                 }
 195         }
 196
 197         if (priv && do_attribute(attrs, "supportedControl")) {
 198                 unsigned int i;
 199                 for (i = 0; i < priv->num_controls; i++) {
 200                         char *control = talloc_strdup(msg, priv->controls[i]);
 201                         if (!control) {
 202                                 goto failed;
 203                         }
 204                         if (ldb_msg_add_steal_string(msg, "supportedControl",
 205                                                      control) != 0) {
 206                                 goto failed;
 207                         }
 208                 }
 209         }
 210
 211         if (priv && do_attribute(attrs, "namingContexts")) {
 212                 unsigned int i;
 213                 for (i = 0; i < priv->num_partitions; i++) {
 214                         struct ldb_dn *dn = priv->partitions[i];
 215                         if (ldb_msg_add_steal_string(msg, "namingContexts",
 216                                                      ldb_dn_alloc_linearized(msg, dn)) != 0) {
 217                                 goto failed;
 218                         }
 219                 }
 220         }
 221
 222         server_sasl = talloc_get_type(ldb_get_opaque(ldb, "supportedSASLMechanims"),
 223                                        char *);
 224         if (server_sasl && do_attribute(attrs, "supportedSASLMechanisms")) {
 225                 unsigned int i;
 226                 for (i = 0; server_sasl && server_sasl[i]; i++) {
 227                         char *sasl_name = talloc_strdup(msg, server_sasl[i]);
 228                         if (!sasl_name) {
 229                                 goto failed;
 230                         }
 231                         if (ldb_msg_add_steal_string(msg, "supportedSASLMechanisms",
 232                                                      sasl_name) != 0) {
 233                                 goto failed;
 234                         }
 235                 }
 236         }
 237
 238         if (do_attribute(attrs, "highestCommittedUSN")) {
 239                 uint64_t seq_num;
 240                 int ret = ldb_sequence_number(ldb, LDB_SEQ_HIGHEST_SEQ, &seq_num);
 241                 if (ret == LDB_SUCCESS) {
 242                         if (ldb_msg_add_fmt(msg, "highestCommittedUSN",
 243                                             "%llu", (unsigned long long)seq_num) != 0) {
 244                                 goto failed;
 245                         }
 246                 }
 247         }
 248
 249         if (schema && do_attribute_explicit(attrs, "dsSchemaAttrCount")) {
 250                 struct dsdb_attribute *cur;
 251                 unsigned int n = 0;
 252
 253                 for (cur = schema->attributes; cur; cur = cur->next) {
 254                         n++;
 255                 }
 256
 257                 if (ldb_msg_add_fmt(msg, "dsSchemaAttrCount",
 258                                     "%u", n) != 0) {
 259                         goto failed;
 260                 }
 261         }
 262
 263         if (schema && do_attribute_explicit(attrs, "dsSchemaClassCount")) {
 264                 struct dsdb_class *cur;
 265                 unsigned int n = 0;
 266
 267                 for (cur = schema->classes; cur; cur = cur->next) {
 268                         n++;
 269                 }
 270
 271                 if (ldb_msg_add_fmt(msg, "dsSchemaClassCount",
 272                                     "%u", n) != 0) {
 273                         goto failed;
 274                 }
 275         }
 276
 277         if (schema && do_attribute_explicit(attrs, "dsSchemaPrefixCount")) {
 278                 if (ldb_msg_add_fmt(msg, "dsSchemaPrefixCount",
 279                                     "%u", schema->prefixmap->length) != 0) {
 280                         goto failed;
 281                 }
 282         }
 283
 284         if (do_attribute_explicit(attrs, "validFSMOs")) {
 285                 const struct dsdb_naming_fsmo *naming_fsmo;
 286                 const struct dsdb_pdc_fsmo *pdc_fsmo;
 287                 const char *dn_str;
 288
 289                 if (schema && schema->fsmo.we_are_master) {
 290                         dn_str = ldb_dn_get_linearized(samdb_schema_dn(ldb));
 291                         if (dn_str && dn_str[0]) {
 292                                 if (ldb_msg_add_fmt(msg, "validFSMOs", "%s", dn_str) != 0) {
 293                                         goto failed;
 294                                 }
 295                         }
 296                 }
 297
 298                 naming_fsmo = talloc_get_type(ldb_get_opaque(ldb, "dsdb_naming_fsmo"),
 299                                               struct dsdb_naming_fsmo);
 300                 if (naming_fsmo && naming_fsmo->we_are_master) {
 301                         dn_str = ldb_dn_get_linearized(samdb_partitions_dn(ldb, msg));
 302                         if (dn_str && dn_str[0]) {
 303                                 if (ldb_msg_add_fmt(msg, "validFSMOs", "%s", dn_str) != 0) {
 304                                         goto failed;
 305                                 }
 306                         }
 307                 }
 308
 309                 pdc_fsmo = talloc_get_type(ldb_get_opaque(ldb, "dsdb_pdc_fsmo"),
 310                                            struct dsdb_pdc_fsmo);
 311                 if (pdc_fsmo && pdc_fsmo->we_are_master) {
 312                         dn_str = ldb_dn_get_linearized(samdb_base_dn(ldb));
 313                         if (dn_str && dn_str[0]) {
 314                                 if (ldb_msg_add_fmt(msg, "validFSMOs", "%s", dn_str) != 0) {
 315                                         goto failed;
 316                                 }
 317                         }
 318                 }
 319         }
 320
 321         if (do_attribute_explicit(attrs, "vendorVersion")) {
 322                 if (ldb_msg_add_fmt(msg, "vendorVersion",
 323                                     "%s", SAMBA_VERSION_STRING) != 0) {
 324                         goto failed;
 325                 }
 326         }
 327
 328         if (priv && do_attribute(attrs, "domainFunctionality")) {
 329                 if (ldb_msg_add_fmt(msg, "domainFunctionality",
 330                                     "%d", dsdb_functional_level(ldb)) != 0) {
 331                         goto failed;
 332                 }
 333         }
 334
 335         if (priv && do_attribute(attrs, "forestFunctionality")
 336             && (val = talloc_get_type(ldb_get_opaque(ldb, "forestFunctionality"), int))) {
 337                 if (ldb_msg_add_fmt(msg, "forestFunctionality",
 338                                     "%d", *val) != 0) {
 339                         goto failed;
 340                 }
 341         }
 342
 343         if (priv && do_attribute(attrs, "domainControllerFunctionality")
 344             && (val = talloc_get_type(ldb_get_opaque(ldb, "domainControllerFunctionality"), int))) {
 345                 if (ldb_msg_add_fmt(msg, "domainControllerFunctionality",
 346                                     "%d", *val) != 0) {
 347                         goto failed;
 348                 }
 349         }
 350
 351         edn_control = ldb_request_get_control(req, LDB_CONTROL_EXTENDED_DN_OID);
 352
 353         /* if the client sent us the EXTENDED_DN control then we need
 354            to expand the DNs to have GUID and SID. W2K8 join relies on
 355            this */
 356         if (edn_control) {
 357                 unsigned int i;
 358                 int ret;
 359                 for (i=0; dn_attrs[i]; i++) {
 360                         if (!do_attribute(attrs, dn_attrs[i])) continue;
 361                         ret = expand_dn_in_message(module, msg, dn_attrs[i],
 362                                                    edn_control, req);
 363                         if (ret != LDB_SUCCESS) {
 364                                 DEBUG(0,(__location__ ": Failed to expand DN in rootDSE for %s\n",
 365                                          dn_attrs[i]));
 366                                 goto failed;
 367                         }
 368                 }
 369         }
 370
 371         if (do_attribute(attrs, "isGlobalCatalogReady")) {
 372                 /* MS-ADTS 3.1.1.3.2.10
 373                    Note, we should only return true here is we have
 374                    completed at least one synchronisation. As both
 375                    provision and vampire do a full sync, this means we
 376                    can return true is the gc bit is set in the NTDSDSA
 377                    options */
 378                 if (ldb_msg_add_fmt(msg, "isGlobalCatalogReady",
 379                                     "%s", samdb_is_gc(ldb)?"TRUE":"FALSE") != 0) {
 380                         goto failed;
 381                 }
 382         }
 383
 384         /* TODO: lots more dynamic attributes should be added here */
 385
 386         return LDB_SUCCESS;
 387
 388 failed:
 389         return LDB_ERR_OPERATIONS_ERROR;
 390 }
 391
 392 /*
 393   handle search requests
 394 */
 395
 396 struct rootdse_context {
 397         struct ldb_module *module;
 398         struct ldb_request *req;
 399 };
 400
 401 static struct rootdse_context *rootdse_init_context(struct ldb_module *module,
 402                                                     struct ldb_request *req)
 403 {
 404         struct ldb_context *ldb;
 405         struct rootdse_context *ac;
 406
 407         ldb = ldb_module_get_ctx(module);
 408
 409         ac = talloc_zero(req, struct rootdse_context);
 410         if (ac == NULL) {
 411                 ldb_set_errstring(ldb, "Out of Memory");
 412                 return NULL;
 413         }
 414
 415         ac->module = module;
 416         ac->req = req;
 417
 418         return ac;
 419 }
 420
 421 static int rootdse_callback(struct ldb_request *req, struct ldb_reply *ares)
 422 {
 423         struct rootdse_context *ac;
 424         int ret;
 425
 426         ac = talloc_get_type(req->context, struct rootdse_context);
 427
 428         if (!ares) {
 429                 return ldb_module_done(ac->req, NULL, NULL,
 430                                         LDB_ERR_OPERATIONS_ERROR);
 431         }
 432         if (ares->error != LDB_SUCCESS) {
 433                 return ldb_module_done(ac->req, ares->controls,
 434                                         ares->response, ares->error);
 435         }
 436
 437         switch (ares->type) {
 438         case LDB_REPLY_ENTRY:
 439                 /*
 440                  * if the client explicit asks for the 'netlogon' attribute
 441                  * the reply_entry needs to be skipped
 442                  */
 443                 if (ac->req->op.search.attrs &&
 444                     ldb_attr_in_list(ac->req->op.search.attrs, "netlogon")) {
 445                         talloc_free(ares);
 446                         return LDB_SUCCESS;
 447                 }
 448
 449                 /* for each record returned post-process to add any dynamic
 450                    attributes that have been asked for */
 451                 ret = rootdse_add_dynamic(ac->module, ares->message,
 452                                           ac->req->op.search.attrs, ac->req);
 453                 if (ret != LDB_SUCCESS) {
 454                         talloc_free(ares);
 455                         return ldb_module_done(ac->req, NULL, NULL, ret);
 456                 }
 457
 458                 return ldb_module_send_entry(ac->req, ares->message, ares->controls);
 459
 460         case LDB_REPLY_REFERRAL:
 461                 /* should we allow the backend to return referrals in this case
 462                  * ?? */
 463                 break;
 464
 465         case LDB_REPLY_DONE:
 466                 return ldb_module_done(ac->req, ares->controls,
 467                                         ares->response, ares->error);
 468         }
 469
 470         talloc_free(ares);
 471         return LDB_SUCCESS;
 472 }
 473
 474 static int rootdse_search(struct ldb_module *module, struct ldb_request *req)
 475 {
 476         struct ldb_context *ldb;
 477         struct rootdse_context *ac;
 478         struct ldb_request *down_req;
 479         int ret;
 480
 481         ldb = ldb_module_get_ctx(module);
 482
 483         /* see if its for the rootDSE - only a base search on the "" DN qualifies */
 484         if (!(req->op.search.scope == LDB_SCOPE_BASE && ldb_dn_is_null(req->op.search.base))) {
 485                 /* Otherwise, pass down to the rest of the stack */
 486                 return ldb_next_request(module, req);
 487         }
 488
 489         ac = rootdse_init_context(module, req);
 490         if (ac == NULL) {
 491                 return LDB_ERR_OPERATIONS_ERROR;
 492         }
 493
 494         /* in our db we store the rootDSE with a DN of @ROOTDSE */
 495         ret = ldb_build_search_req(&down_req, ldb, ac,
 496                                         ldb_dn_new(ac, ldb, "@ROOTDSE"),
 497                                         LDB_SCOPE_BASE,
 498                                         NULL,
 499                                         req->op.search.attrs,
 500                                         NULL,/* for now skip the controls from the client */
 501                                         ac, rootdse_callback,
 502                                         req);
 503         if (ret != LDB_SUCCESS) {
 504                 return ret;
 505         }
 506
 507         return ldb_next_request(module, down_req);
 508 }
 509
 510 static int rootdse_register_control(struct ldb_module *module, struct ldb_request *req)
 511 {
 512         struct private_data *priv = talloc_get_type(ldb_module_get_private(module), struct private_data);
 513         char **list;
 514
 515         list = talloc_realloc(priv, priv->controls, char *, priv->num_controls + 1);
 516         if (!list) {
 517                 return LDB_ERR_OPERATIONS_ERROR;
 518         }
 519
 520         list[priv->num_controls] = talloc_strdup(list, req->op.reg_control.oid);
 521         if (!list[priv->num_controls]) {
 522                 return LDB_ERR_OPERATIONS_ERROR;
 523         }
 524
 525         priv->num_controls += 1;
 526         priv->controls = list;
 527
 528         return ldb_module_done(req, NULL, NULL, LDB_SUCCESS);
 529 }
 530
 531 static int rootdse_register_partition(struct ldb_module *module, struct ldb_request *req)
 532 {
 533         struct private_data *priv = talloc_get_type(ldb_module_get_private(module), struct private_data);
 534         struct ldb_dn **list;
 535
 536         list = talloc_realloc(priv, priv->partitions, struct ldb_dn *, priv->num_partitions + 1);
 537         if (!list) {
 538                 return LDB_ERR_OPERATIONS_ERROR;
 539         }
 540
 541         list[priv->num_partitions] = ldb_dn_copy(list, req->op.reg_partition.dn);
 542         if (!list[priv->num_partitions]) {
 543                 return LDB_ERR_OPERATIONS_ERROR;
 544         }
 545
 546         priv->num_partitions += 1;
 547         priv->partitions = list;
 548
 549         return ldb_module_done(req, NULL, NULL, LDB_SUCCESS);
 550 }
 551
 552
 553 static int rootdse_request(struct ldb_module *module, struct ldb_request *req)
 554 {
 555         switch (req->operation) {
 556
 557         case LDB_REQ_REGISTER_CONTROL:
 558                 return rootdse_register_control(module, req);
 559         case LDB_REQ_REGISTER_PARTITION:
 560                 return rootdse_register_partition(module, req);
 561
 562         default:
 563                 break;
 564         }
 565         return ldb_next_request(module, req);
 566 }
 567
 568 static int rootdse_init(struct ldb_module *module)
 569 {
 570         int ret;
 571         struct ldb_context *ldb;
 572         struct ldb_result *res;
 573         struct private_data *data;
 574         const char *attrs[] = { "msDS-Behavior-Version", NULL };
 575         const char *ds_attrs[] = { "dsServiceName", NULL };
 576         TALLOC_CTX *mem_ctx;
 577
 578         ldb = ldb_module_get_ctx(module);
 579
 580         data = talloc_zero(module, struct private_data);
 581         if (data == NULL) {
 582                 return -1;
 583         }
 584
 585         data->num_controls = 0;
 586         data->controls = NULL;
 587         data->num_partitions = 0;
 588         data->partitions = NULL;
 589         ldb_module_set_private(module, data);
 590
 591         ldb_set_default_dns(ldb);
 592
 593         ret = ldb_next_init(module);
 594
 595         if (ret) {
 596                 return ret;
 597         }
 598
 599         mem_ctx = talloc_new(data);
 600         if (!mem_ctx) {
 601                 ldb_oom(ldb);
 602                 return LDB_ERR_OPERATIONS_ERROR;
 603         }
 604
 605         /* Now that the partitions are set up, do a search for:
 606            - domainControllerFunctionality
 607            - domainFunctionality
 608            - forestFunctionality
 609
 610            Then stuff these values into an opaque
 611         */
 612         ret = ldb_search(ldb, mem_ctx, &res,
 613                          ldb_get_default_basedn(ldb),
 614                          LDB_SCOPE_BASE, attrs, NULL);
 615         if (ret == LDB_SUCCESS && res->count == 1) {
 616                 int domain_behaviour_version
 617                         = ldb_msg_find_attr_as_int(res->msgs[0],
 618                                                    "msDS-Behavior-Version", -1);
 619                 if (domain_behaviour_version != -1) {
 620                         int *val = talloc(ldb, int);
 621                         if (!val) {
 622                                 ldb_oom(ldb);
 623                                 talloc_free(mem_ctx);
 624                                 return LDB_ERR_OPERATIONS_ERROR;
 625                         }
 626                         *val = domain_behaviour_version;
 627                         ret = ldb_set_opaque(ldb, "domainFunctionality", val);
 628                         if (ret != LDB_SUCCESS) {
 629                                 talloc_free(mem_ctx);
 630                                 return ret;
 631                         }
 632                 }
 633         }
 634
 635         ret = ldb_search(ldb, mem_ctx, &res,
 636                          samdb_partitions_dn(ldb, mem_ctx),
 637                          LDB_SCOPE_BASE, attrs, NULL);
 638         if (ret == LDB_SUCCESS && res->count == 1) {
 639                 int forest_behaviour_version
 640                         = ldb_msg_find_attr_as_int(res->msgs[0],
 641                                                    "msDS-Behavior-Version", -1);
 642                 if (forest_behaviour_version != -1) {
 643                         int *val = talloc(ldb, int);
 644                         if (!val) {
 645                                 ldb_oom(ldb);
 646                                 talloc_free(mem_ctx);
 647                                 return LDB_ERR_OPERATIONS_ERROR;
 648                         }
 649                         *val = forest_behaviour_version;
 650                         ret = ldb_set_opaque(ldb, "forestFunctionality", val);
 651                         if (ret != LDB_SUCCESS) {
 652                                 talloc_free(mem_ctx);
 653                                 return ret;
 654                         }
 655                 }
 656         }
 657
 658         ret = ldb_search(ldb, mem_ctx, &res,
 659                          ldb_dn_new(mem_ctx, ldb, ""),
 660                          LDB_SCOPE_BASE, ds_attrs, NULL);
 661         if (ret == LDB_SUCCESS && res->count == 1) {
 662                 struct ldb_dn *ds_dn
 663                         = ldb_msg_find_attr_as_dn(ldb, mem_ctx, res->msgs[0],
 664                                                   "dsServiceName");
 665                 if (ds_dn) {
 666                         ret = ldb_search(ldb, mem_ctx, &res, ds_dn,
 667                                          LDB_SCOPE_BASE, attrs, NULL);
 668                         if (ret == LDB_SUCCESS && res->count == 1) {
 669                                 int domain_controller_behaviour_version
 670                                         = ldb_msg_find_attr_as_int(res->msgs[0],
 671                                                                    "msDS-Behavior-Version", -1);
 672                                 if (domain_controller_behaviour_version != -1) {
 673                                         int *val = talloc(ldb, int);
 674                                         if (!val) {
 675                                                 ldb_oom(ldb);
 676                                                 talloc_free(mem_ctx);
 677                                         return LDB_ERR_OPERATIONS_ERROR;
 678                                         }
 679                                         *val = domain_controller_behaviour_version;
 680                                         ret = ldb_set_opaque(ldb,
 681                                                              "domainControllerFunctionality", val);
 682                                         if (ret != LDB_SUCCESS) {
 683                                                 talloc_free(mem_ctx);
 684                                                 return ret;
 685                                         }
 686                                 }
 687                         }
 688                 }
 689         }
 690
 691         talloc_free(mem_ctx);
 692
 693         return LDB_SUCCESS;
 694 }
 695
 696 /*
 697  * This function gets the string SCOPE_DN:OPTIONAL_FEATURE_GUID and parse it
 698  * to a DN and a GUID object
 699  */
 700 static int get_optional_feature_dn_guid(struct ldb_request *req, struct ldb_context *ldb,
 701                                                 TALLOC_CTX *mem_ctx,
 702                                                 struct ldb_dn **op_feature_scope_dn,
 703                                                 struct GUID *op_feature_guid)
 704 {
 705         const struct ldb_message *msg = req->op.mod.message;
 706         const char *ldb_val_str;
 707         char *dn, *guid;
 708         TALLOC_CTX *tmp_ctx = talloc_new(mem_ctx);
 709         NTSTATUS status;
 710
 711         ldb_val_str = ldb_msg_find_attr_as_string(msg, "enableOptionalFeature", NULL);
 712         if (!ldb_val_str) {
 713                 ldb_asprintf_errstring(ldb,
 714                                        "rootdse: unable to find enableOptionalFeature\n");
 715                 return LDB_ERR_UNWILLING_TO_PERFORM;
 716         }
 717
 718         guid = strchr(ldb_val_str, ':');
 719         if (!guid) {
 720                 ldb_asprintf_errstring(ldb,
 721                                        "rootdse: unable to find GUID in enableOptionalFeature\n");
 722                 return LDB_ERR_UNWILLING_TO_PERFORM;
 723         }
 724         status = GUID_from_string(guid+1, op_feature_guid);
 725         if (!NT_STATUS_IS_OK(status)) {
 726                 ldb_asprintf_errstring(ldb,
 727                                        "rootdse: bad GUID in enableOptionalFeature\n");
 728                 return LDB_ERR_UNWILLING_TO_PERFORM;
 729         }
 730
 731         dn = talloc_strndup(tmp_ctx, ldb_val_str, guid-ldb_val_str);
 732         if (!dn) {
 733                 ldb_asprintf_errstring(ldb,
 734                                        "rootdse: bad DN in enableOptionalFeature\n");
 735                 return LDB_ERR_UNWILLING_TO_PERFORM;
 736         }
 737
 738         *op_feature_scope_dn = ldb_dn_new(mem_ctx, ldb, dn);
 739
 740         talloc_free(tmp_ctx);
 741         return LDB_SUCCESS;
 742 }
 743
 744 /*
 745  * This function gets the OPTIONAL_FEATURE_GUID and looks for the optional feature
 746  * ldb_message object.
 747  */
 748 static int dsdb_find_optional_feature(struct ldb_module *module, struct ldb_context *ldb,
 749                                 TALLOC_CTX *mem_ctx, struct GUID op_feature_guid, struct ldb_message **msg)
 750 {
 751         struct ldb_result *res;
 752         TALLOC_CTX *tmp_ctx = talloc_new(mem_ctx);
 753         int ret;
 754
 755         ret = dsdb_module_search(module, tmp_ctx, &res, NULL, LDB_SCOPE_SUBTREE,
 756                                 NULL,
 757                                 DSDB_SEARCH_SEARCH_ALL_PARTITIONS,
 758                                  "(&(objectClass=msDS-OptionalFeature)"
 759                                  "(msDS-OptionalFeatureGUID=%s))",GUID_string(tmp_ctx, &op_feature_guid));
 760
 761         if (ret != LDB_SUCCESS) {
 762                 talloc_free(tmp_ctx);
 763                 return ret;
 764         }
 765         if (res->count == 0) {
 766                 talloc_free(tmp_ctx);
 767                 return LDB_ERR_NO_SUCH_OBJECT;
 768         }
 769         if (res->count != 1) {
 770                 ldb_asprintf_errstring(ldb,
 771                                 "More than one object found matching optional feature GUID %s\n",
 772                                 GUID_string(tmp_ctx, &op_feature_guid));
 773                 talloc_free(tmp_ctx);
 774                 return LDB_ERR_OPERATIONS_ERROR;
 775         }
 776
 777         *msg = talloc_steal(mem_ctx, res->msgs[0]);
 778
 779         talloc_free(tmp_ctx);
 780         return LDB_SUCCESS;
 781 }
 782
 783 static int rootdse_enable_recycle_bin(struct ldb_module *module,struct ldb_context *ldb,
 784                         TALLOC_CTX *mem_ctx, struct ldb_dn *op_feature_scope_dn,
 785                         struct ldb_message *op_feature_msg)
 786 {
 787         int ret;
 788         const int domain_func_level = dsdb_functional_level(ldb);
 789         struct ldb_dn *ntds_settings_dn;
 790         TALLOC_CTX *tmp_ctx;
 791         unsigned int el_count = 0;
 792         struct ldb_message *msg;
 793
 794         ret = ldb_msg_find_attr_as_int(op_feature_msg, "msDS-RequiredForestBehaviorVersion", 0);
 795         if (domain_func_level < ret){
 796                 ldb_asprintf_errstring(ldb,
 797                                                        "rootdse: Domain functional level must be at least %d\n",
 798                                                        ret);
 799                 return LDB_ERR_UNWILLING_TO_PERFORM;
 800         }
 801
 802         tmp_ctx = talloc_new(mem_ctx);
 803         ntds_settings_dn = samdb_ntds_settings_dn(ldb);
 804         if (!ntds_settings_dn) {
 805                 ldb_asprintf_errstring(ldb,
 806                                 __location__ ": Failed to find NTDS settings DN\n");
 807                 ret = LDB_ERR_OPERATIONS_ERROR;
 808                 talloc_free(tmp_ctx);
 809                 return ret;
 810         }
 811
 812         ntds_settings_dn = ldb_dn_copy(tmp_ctx, ntds_settings_dn);
 813         if (!ntds_settings_dn) {
 814                 DEBUG(0, (__location__ ": Failed to copy NTDS settings DN\n"));
 815                 ret = LDB_ERR_OPERATIONS_ERROR;
 816                 talloc_free(tmp_ctx);
 817                 return ret;
 818         }
 819
 820         msg = ldb_msg_new(tmp_ctx);
 821         msg->dn = ntds_settings_dn;
 822
 823         ldb_msg_add_linearized_dn(msg, "msDS-EnabledFeature", op_feature_msg->dn);
 824         msg->elements[el_count++].flags = LDB_FLAG_MOD_ADD;
 825
 826         ret = dsdb_module_modify(module, msg, 0);
 827         if (ret != LDB_SUCCESS) {
 828                 ldb_asprintf_errstring(ldb,
 829                                 "rootdse_enable_recycle_bin: Failed to modify object %s - %s",
 830                                 ldb_dn_get_linearized(ntds_settings_dn), ldb_errstring(ldb));
 831                 talloc_free(tmp_ctx);
 832                 return ret;
 833         }
 834
 835         msg->dn = op_feature_scope_dn;
 836         ret = dsdb_module_modify(module, msg, 0);
 837         if (ret != LDB_SUCCESS) {
 838                 ldb_asprintf_errstring(ldb, "rootdse_enable_recycle_bin: Failed to modify object %s - %s",
 839                                        ldb_dn_get_linearized(op_feature_scope_dn), ldb_errstring(ldb));
 840                 talloc_free(tmp_ctx);
 841                 return ret;
 842         }
 843
 844         return LDB_SUCCESS;
 845 }
 846
 847 static int rootdse_enableoptionalfeature(struct ldb_module *module, struct ldb_request *req)
 848 {
 849         /*
 850           steps:
 851                - check for system (only system can enable features)
 852                - extract GUID from the request
 853                - find the feature object
 854                - check functional level, must be at least msDS-RequiredForestBehaviorVersion
 855                - check if it is already enabled (if enabled return LDAP_ATTRIBUTE_OR_VALUE_EXISTS) - probably not needed, just return error from the add/modify
 856                - add/modify objects (see ntdsconnection code for an example)
 857          */
 858
 859         struct ldb_context *ldb = ldb_module_get_ctx(module);
 860         struct GUID op_feature_guid;
 861         struct ldb_dn *op_feature_scope_dn;
 862         struct ldb_message *op_feature_msg;
 863         struct auth_session_info *session_info =
 864                                 (struct auth_session_info *)ldb_get_opaque(ldb, "sessionInfo");
 865         TALLOC_CTX *tmp_ctx = talloc_new(ldb);
 866         int ret;
 867         const char *guid_string;
 868
 869         if (security_session_user_level(session_info) != SECURITY_SYSTEM) {
 870                 ldb_asprintf_errstring(ldb, "rootdse: Insufficient rights for enableoptionalfeature");
 871                 return LDB_ERR_UNWILLING_TO_PERFORM;
 872         }
 873
 874         ret = get_optional_feature_dn_guid(req, ldb, tmp_ctx, &op_feature_scope_dn, &op_feature_guid);
 875         if (ret != LDB_SUCCESS) {
 876                 talloc_free(tmp_ctx);
 877                 return ret;
 878         }
 879
 880         guid_string = GUID_string(tmp_ctx, &op_feature_guid);
 881         if (!guid_string) {
 882                 ldb_asprintf_errstring(ldb, "rootdse: bad optional feature GUID");
 883                 return LDB_ERR_UNWILLING_TO_PERFORM;
 884         }
 885
 886         ret = dsdb_find_optional_feature(module, ldb, tmp_ctx, op_feature_guid, &op_feature_msg);
 887         if (ret != LDB_SUCCESS) {
 888                 ldb_asprintf_errstring(ldb, "rootdse: unable to find optional feature for %s - %s",
 889                                                        guid_string, ldb_errstring(ldb));
 890                 talloc_free(tmp_ctx);
 891                 return ret;
 892         }
 893
 894         if (strcasecmp(DS_GUID_FEATURE_RECYCLE_BIN, guid_string) == 0) {
 895                         ret = rootdse_enable_recycle_bin(module, ldb,
 896                                                          tmp_ctx, op_feature_scope_dn,
 897                                                          op_feature_msg);
 898         } else {
 899                 ldb_asprintf_errstring(ldb, "rootdse: unknown optional feature %s",
 900                                        guid_string);
 901                 talloc_free(tmp_ctx);
 902                 return LDB_ERR_UNWILLING_TO_PERFORM;
 903         }
 904         if (ret != LDB_SUCCESS) {
 905                 ldb_asprintf_errstring(ldb, "rootdse: failed to set optional feature for %s - %s",
 906                                        guid_string, ldb_errstring(ldb));
 907                 talloc_free(tmp_ctx);
 908                 return ret;
 909         }
 910
 911         talloc_free(tmp_ctx);
 912         return ldb_module_done(req, NULL, NULL, LDB_SUCCESS);;
 913 }
 914
 915 static int rootdse_schemaupdatenow(struct ldb_module *module, struct ldb_request *req)
 916 {
 917         struct ldb_context *ldb = ldb_module_get_ctx(module);
 918         struct ldb_result *ext_res;
 919         int ret;
 920         struct ldb_dn *schema_dn;
 921
 922         schema_dn = samdb_schema_dn(ldb);
 923         if (!schema_dn) {
 924                 ldb_reset_err_string(ldb);
 925                 ldb_debug(ldb, LDB_DEBUG_WARNING,
 926                           "rootdse_modify: no schema dn present: (skip ldb_extended call)\n");
 927                 return ldb_next_request(module, req);
 928         }
 929
 930         ret = ldb_extended(ldb, DSDB_EXTENDED_SCHEMA_UPDATE_NOW_OID, schema_dn, &ext_res);
 931         if (ret != LDB_SUCCESS) {
 932                 return LDB_ERR_OPERATIONS_ERROR;
 933         }
 934
 935         talloc_free(ext_res);
 936         return ldb_module_done(req, NULL, NULL, ret);
 937 }
 938
 939 static int rootdse_modify(struct ldb_module *module, struct ldb_request *req)
 940 {
 941         struct ldb_context *ldb;
 942
 943         /*
 944                 If dn is not "" we should let it pass through
 945         */
 946         if (!ldb_dn_is_null(req->op.mod.message->dn)) {
 947                 return ldb_next_request(module, req);
 948         }
 949
 950         ldb = ldb_module_get_ctx(module);
 951
 952         /*
 953                 dn is empty so check for schemaUpdateNow attribute
 954                 "The type of modification and values specified in the LDAP modify operation do not matter." MSDN
 955         */
 956         if (ldb_msg_find_element(req->op.mod.message, "schemaUpdateNow")) {
 957                 return rootdse_schemaupdatenow(module, req);
 958         }
 959
 960         if (ldb_msg_find_element(req->op.mod.message, "enableOptionalFeature")) {
 961                 return rootdse_enableoptionalfeature(module, req);
 962         }
 963
 964         return LDB_ERR_OPERATIONS_ERROR;
 965 }
 966
 967 _PUBLIC_ const struct ldb_module_ops ldb_rootdse_module_ops = {
 968         .name           = "rootdse",
 969         .init_context   = rootdse_init,
 970         .search         = rootdse_search,
 971         .request        = rootdse_request,
 972         .modify         = rootdse_modify
 973 };