2 Unix SMB/CIFS implementation.
4 Copyright (C) Stefan Metzmacher <metze@samba.org> 2006
6 This program is free software; you can redistribute it and/or modify
7 it under the terms of the GNU General Public License as published by
8 the Free Software Foundation; either version 3 of the License, or
9 (at your option) any later version.
11 This program is distributed in the hope that it will be useful,
12 but WITHOUT ANY WARRANTY; without even the implied warranty of
13 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
14 GNU General Public License for more details.
16 You should have received a copy of the GNU General Public License
17 along with this program. If not, see <http://www.gnu.org/licenses/>.
21 #include "libnet/libnet.h"
22 #include "libcli/composite/composite.h"
23 #include "libcli/cldap/cldap.h"
25 #include <ldb_errors.h>
27 #include "dsdb/samdb/samdb.h"
28 #include "../libds/common/flags.h"
29 #include "librpc/gen_ndr/ndr_drsuapi_c.h"
30 #include "libcli/security/security.h"
31 #include "librpc/gen_ndr/ndr_misc.h"
32 #include "librpc/gen_ndr/ndr_security.h"
33 #include "librpc/gen_ndr/ndr_nbt.h"
34 #include "librpc/gen_ndr/ndr_drsuapi.h"
35 #include "auth/gensec/gensec.h"
36 #include "param/param.h"
37 #include "lib/tsocket/tsocket.h"
39 /*****************************************************************************
40 * Windows 2003 (w2k3) does the following steps when changing the server role
41 * from domain member to domain controller
43 * We mostly do the same.
44 *****************************************************************************/
48 * - using nbt name<1C> request and a samlogon mailslot request
50 * - using a DNS SRV _ldap._tcp.dc._msdcs. request and a CLDAP netlogon request
52 * see: becomeDC_recv_cldap() and becomeDC_send_cldap()
56 * Open 1st LDAP connection to the DC using admin credentials
58 * see: becomeDC_connect_ldap1() and becomeDC_ldap_connect()
62 * LDAP search 1st LDAP connection:
64 * see: becomeDC_ldap1_rootdse()
69 * filter: (objectClass=*)
73 * currentTime: 20061202155100.0Z
74 * subschemaSubentry: CN=Aggregate,CN=Schema,CN=Configuration,<domain_partition>
75 * dsServiceName: CN=<netbios_name>,CN=Servers,CN=<site_name>,CN=Sites,CN=Configuration,<domain_partition>
76 * namingContexts: <domain_partition>
77 * CN=Configuration,<domain_partition>
78 * CN=Schema,CN=Configuration,<domain_partition>
79 * defaultNamingContext: <domain_partition>
80 * schemaNamingContext: CN=Schema,CN=Configuration,<domain_partition>
81 * configurationNamingContext:CN=Configuration,<domain_partition>
82 * rootDomainNamingContext:<domain_partition>
83 * supportedControl: ...
84 * supportedLDAPVersion: 3
86 * supportedLDAPPolicies: ...
87 * highestCommittedUSN: ...
88 * supportedSASLMechanisms:GSSAPI
92 * dnsHostName: <dns_host_name>
93 * ldapServiceName: <domain_dns_name>:<netbios_name>$@<REALM>
94 * serverName: CN=Servers,CN=<site_name>,CN=Sites,CN=Configuration,<domain_partition>
95 * supportedCapabilities: ...
96 * isSynchronized: TRUE
97 * isGlobalCatalogReady: TRUE
98 * domainFunctionality: 0
99 * forestFunctionality: 0
100 * domainControllerFunctionality: 2
104 * LDAP search 1st LDAP connection:
106 * see: becomeDC_ldap1_crossref_behavior_version()
109 * basedn: CN=Configuration,<domain_partition>
111 * filter: (cn=Partitions)
112 * attrs: msDS-Behavior-Version
114 * CN=Partitions,CN=Configuration,<domain_partition>
115 * msDS-Behavior-Version: 0
119 * LDAP search 1st LDAP connection:
121 * NOTE: this seems to be a bug! as the messageID of the LDAP message is corrupted!
123 * not implemented here
126 * basedn: CN=Schema,CN=Configuration,<domain_partition>
128 * filter: (cn=Partitions)
129 * attrs: msDS-Behavior-Version
136 * LDAP search 1st LDAP connection:
138 * see: becomeDC_ldap1_domain_behavior_version()
141 * basedn: <domain_partition>
143 * filter: (objectClass=*)
144 * attrs: msDS-Behavior-Version
147 * msDS-Behavior-Version: 0
151 * LDAP search 1st LDAP connection:
153 * see: becomeDC_ldap1_schema_object_version()
156 * basedn: CN=Schema,CN=Configuration,<domain_partition>
158 * filter: (objectClass=*)
159 * attrs: objectVersion
161 * CN=Schema,CN=Configuration,<domain_partition>
166 * LDAP search 1st LDAP connection:
168 * not implemented, because the information is already there
173 * filter: (objectClass=*)
174 * attrs: defaultNamingContext
178 * defaultNamingContext: <domain_partition>
179 * dnsHostName: <dns_host_name>
183 * LDAP search 1st LDAP connection:
185 * see: becomeDC_ldap1_infrastructure_fsmo()
188 * basedn: <WKGUID=2fbac1870ade11d297c400c04fd8d5cd,domain_partition>
190 * filter: (objectClass=*)
193 * CN=Infrastructure,<domain_partition>
197 * LDAP search 1st LDAP connection:
199 * see: becomeDC_ldap1_w2k3_update_revision()
202 * basedn: CN=Windows2003Update,CN=DomainUpdates,CN=System,<domain_partition>
204 * filter: (objectClass=*)
207 * CN=Windows2003Update,CN=DomainUpdates,CN=System,<domain_partition>
212 * LDAP search 1st LDAP connection:
214 * see: becomeDC_ldap1_infrastructure_fsmo()
217 * basedn: CN=Infrastructure,<domain_partition>
219 * filter: (objectClass=*)
220 * attrs: fSMORoleOwner
222 * CN=Infrastructure,<domain_partition>
223 * fSMORoleOwner: CN=NTDS Settings,<infrastructure_fsmo_server_object>
227 * LDAP search 1st LDAP connection:
229 * see: becomeDC_ldap1_infrastructure_fsmo()
232 * basedn: <infrastructure_fsmo_server_object>
234 * filter: (objectClass=*)
237 * <infrastructure_fsmo_server_object>
238 * dnsHostName: <dns_host_name>
242 * LDAP search 1st LDAP connection:
244 * see: becomeDC_ldap1_infrastructure_fsmo()
247 * basedn: CN=NTDS Settings,<infrastructure_fsmo_server_object>
249 * filter: (objectClass=*)
252 * CN=NTDS Settings,<infrastructure_fsmo_server_object>
253 * objectGUID: <object_guid>
257 * LDAP search 1st LDAP connection:
259 * see: becomeDC_ldap1_rid_manager_fsmo()
262 * basedn: <domain_partition>
264 * filter: (objectClass=*)
265 * attrs: rIDManagerReference
268 * rIDManagerReference: CN=RID Manager$,CN=System,<domain_partition>
272 * LDAP search 1st LDAP connection:
274 * see: becomeDC_ldap1_rid_manager_fsmo()
277 * basedn: CN=RID Manager$,CN=System,<domain_partition>
279 * filter: (objectClass=*)
280 * attrs: fSMORoleOwner
282 * CN=Infrastructure,<domain_partition>
283 * fSMORoleOwner: CN=NTDS Settings,<rid_manager_fsmo_server_object>
287 * LDAP search 1st LDAP connection:
289 * see: becomeDC_ldap1_rid_manager_fsmo()
292 * basedn: <rid_manager_fsmo_server_object>
294 * filter: (objectClass=*)
297 * <rid_manager_fsmo_server_object>
298 * dnsHostName: <dns_host_name>
302 * LDAP search 1st LDAP connection:
304 * see: becomeDC_ldap1_rid_manager_fsmo()
307 * basedn: CN=NTDS Settings,<rid_manager_fsmo_server_object>
309 * filter: (objectClass=*)
310 * attrs: msDs-ReplicationEpoch
312 * CN=NTDS Settings,<rid_manager_fsmo_server_object>
316 * LDAP search 1st LDAP connection:
318 * see: becomeDC_ldap1_site_object()
321 * basedn: CN=<new_dc_site_name>,CN=Sites,CN=Configuration,<domain_partition>
323 * filter: (objectClass=*)
326 * CN=<new_dc_site_name>,CN=Sites,CN=Configuration,<domain_partition>
329 * cn: <new_dc_site_name>
330 * distinguishedName:CN=<new_dc_site_name>,CN=Sites,CN=Configuration,<domain_partition>
336 * showInAdvancedViewOnly: TRUE
337 * name: <new_dc_site_name>
338 * objectGUID: <object_guid>
339 * systemFlags: 1107296256 <0x42000000>
340 * objectCategory: CN=Site,CN=Schema,CN=Configuration,<domain_partition>
343 /***************************************************************
344 * Add this stage we call the check_options() callback function
345 * of the caller, to see if he wants us to continue
347 * see: becomeDC_check_options()
348 ***************************************************************/
351 * LDAP search 1st LDAP connection:
353 * see: becomeDC_ldap1_computer_object()
356 * basedn: <domain_partition>
358 * filter: (&(|(objectClass=user)(objectClass=computer))(sAMAccountName=<new_dc_account_name>))
359 * attrs: distinguishedName
362 * CN=<new_dc_netbios_name>,CN=Computers,<domain_partition>
363 * distinguishedName: CN=<new_dc_netbios_name>,CN=Computers,<domain_partition>
364 * userAccountControl: 4096 <0x1000>
368 * LDAP search 1st LDAP connection:
370 * see: becomeDC_ldap1_server_object_1()
373 * basedn: CN=<new_dc_netbios_name>,CN=Servers,CN=<new_dc_site_name>,CN=Sites,CN=Configuration,<domain_partition>
375 * filter: (objectClass=*)
379 * <matchedDN:CN=Servers,CN=<new_dc_site_name>,CN=Sites,CN=Configuration,<domain_partition>>
383 * LDAP search 1st LDAP connection:
385 * see: becomeDC_ldap1_server_object_2()
388 * basedn: CN=<new_dc_netbios_name>,CN=Computers,<domain_partition>
390 * filter: (objectClass=*)
391 * attrs: serverReferenceBL
394 * CN=<new_dc_netbios_name>,CN=Computers,<domain_partition>
398 * LDAP add 1st LDAP connection:
400 * see: becomeDC_ldap1_server_object_add()
403 * CN=<new_dc_netbios_name>,CN=Computers,<domain_partition>
404 * objectClass: server
405 * systemFlags: 50000000 <0x2FAF080>
406 * serverReference:CN=<new_dc_netbios_name>,CN=Computers,<domain_partition>
412 * LDAP search 1st LDAP connection:
414 * not implemented, maybe we can add that later
417 * basedn: CN=NTDS Settings,CN=<new_dc_netbios_name>,CN=Servers,CN=<new_dc_site_name>,CN=Sites,CN=Configuration,<domain_partition>
419 * filter: (objectClass=*)
423 * <matchedDN:CN=<new_dc_netbios_name>,CN=Servers,CN=<new_dc_site_name>,CN=Sites,CN=Configuration,<domain_partition>>
427 * LDAP search 1st LDAP connection:
429 * not implemented because it gives no new information
432 * basedn: CN=Partitions,CN=Configuration,<domain_partition>
434 * filter: (nCName=<domain_partition>)
437 * controls: LDAP_SERVER_EXTENDED_DN_OID:critical=false
439 * <GUID=<hex_guid>>;CN=<domain_netbios_name>,CN=Partitions,<domain_partition>>
440 * nCName: <GUID=<hex_guid>>;<SID=<hex_sid>>;<domain_partition>>
441 * dnsRoot: <domain_dns_name>
445 * LDAP modify 1st LDAP connection:
447 * see: becomeDC_ldap1_server_object_modify()
450 * CN=<new_dc_netbios_name>,CN=Servers,CN=<new_dc_site_name>,CN=Sites,CN=Configuration,<domain_partition>>
451 * serverReference:CN=<new_dc_netbios_name>,CN=Computers,<domain_partition>
453 * <attributeOrValueExist>
457 * LDAP modify 1st LDAP connection:
459 * see: becomeDC_ldap1_server_object_modify()
462 * CN=<new_dc_netbios_name>,CN=Servers,CN=<new_dc_site_name>,CN=Sites,CN=Configuration,<domain_partition>>
463 * serverReference:CN=<new_dc_netbios_name>,CN=Computers,<domain_partition>
469 * Open 1st DRSUAPI connection to the DC using admin credentials
470 * DsBind with DRSUAPI_DS_BIND_GUID_W2K3 ("6afab99c-6e26-464a-975f-f58f105218bc")
471 * (w2k3 does 2 DsBind() calls here..., where is first is unused and contains garbage at the end)
473 * see: becomeDC_drsuapi_connect_send(), becomeDC_drsuapi1_connect_recv(),
474 * becomeDC_drsuapi_bind_send(), becomeDC_drsuapi_bind_recv() and becomeDC_drsuapi1_bind_recv()
478 * DsAddEntry to create the CN=NTDS Settings,CN=<machine_name>,CN=Servers,CN=Default-First-Site-Name, ...
479 * on the 1st DRSUAPI connection
481 * see: becomeDC_drsuapi1_add_entry_send() and becomeDC_drsuapi1_add_entry_recv()
484 /***************************************************************
485 * Add this stage we call the prepare_db() callback function
486 * of the caller, to see if he wants us to continue
488 * see: becomeDC_prepare_db()
489 ***************************************************************/
492 * Open 2nd and 3rd DRSUAPI connection to the DC using admin credentials
493 * - a DsBind with DRSUAPI_DS_BIND_GUID_W2K3 ("6afab99c-6e26-464a-975f-f58f105218bc")
494 * on the 2nd connection
496 * see: becomeDC_drsuapi_connect_send(), becomeDC_drsuapi2_connect_recv(),
497 * becomeDC_drsuapi_bind_send(), becomeDC_drsuapi_bind_recv(), becomeDC_drsuapi2_bind_recv()
498 * and becomeDC_drsuapi3_connect_recv()
502 * replicate CN=Schema,CN=Configuration,...
503 * on the 3rd DRSUAPI connection and the bind_handle from the 2nd connection
505 * see: becomeDC_drsuapi_pull_partition_send(), becomeDC_drsuapi_pull_partition_recv(),
506 * becomeDC_drsuapi3_pull_schema_send() and becomeDC_drsuapi3_pull_schema_recv()
508 ***************************************************************
509 * Add this stage we call the schema_chunk() callback function
510 * for each replication message
511 ***************************************************************/
514 * replicate CN=Configuration,...
515 * on the 3rd DRSUAPI connection and the bind_handle from the 2nd connection
517 * see: becomeDC_drsuapi_pull_partition_send(), becomeDC_drsuapi_pull_partition_recv(),
518 * becomeDC_drsuapi3_pull_config_send() and becomeDC_drsuapi3_pull_config_recv()
520 ***************************************************************
521 * Add this stage we call the config_chunk() callback function
522 * for each replication message
523 ***************************************************************/
526 * LDAP unbind on the 1st LDAP connection
528 * not implemented, because it's not needed...
532 * Open 2nd LDAP connection to the DC using admin credentials
534 * see: becomeDC_connect_ldap2() and becomeDC_ldap_connect()
538 * LDAP search 2nd LDAP connection:
540 * not implemented because it gives no new information
541 * same as becomeDC_ldap1_computer_object()
544 * basedn: <domain_partition>
546 * filter: (&(|(objectClass=user)(objectClass=computer))(sAMAccountName=<new_dc_account_name>))
547 * attrs: distinguishedName
550 * CN=<new_dc_netbios_name>,CN=Computers,<domain_partition>
551 * distinguishedName: CN=<new_dc_netbios_name>,CN=Computers,<domain_partition>
552 * userAccountControl: 4096 <0x00001000>
556 * LDAP search 2nd LDAP connection:
558 * not implemented because it gives no new information
559 * same as becomeDC_ldap1_computer_object()
562 * basedn: CN=<new_dc_netbios_name>,CN=Computers,<domain_partition>
564 * filter: (objectClass=*)
565 * attrs: userAccountControl
567 * CN=<new_dc_netbios_name>,CN=Computers,<domain_partition>
568 * userAccountControl: 4096 <0x00001000>
572 * LDAP modify 2nd LDAP connection:
574 * see: becomeDC_ldap2_modify_computer()
577 * CN=<new_dc_netbios_name>,CN=Computers,<domain_partition>
578 * userAccountControl: 532480 <0x82000>
584 * LDAP search 2nd LDAP connection:
586 * see: becomeDC_ldap2_move_computer()
589 * basedn: <WKGUID=2fbac1870ade11d297c400c04fd8d5cd,<domain_partition>>
591 * filter: (objectClass=*)
594 * CN=Domain Controllers,<domain_partition>
598 * LDAP search 2nd LDAP connection:
600 * not implemented because it gives no new information
603 * basedn: CN=Domain Controllers,<domain_partition>
605 * filter: (objectClass=*)
606 * attrs: distinguishedName
608 * CN=Domain Controller,<domain_partition>
609 * distinguishedName: CN=Domain Controllers,<domain_partition>
613 * LDAP modifyRDN 2nd LDAP connection:
615 * see: becomeDC_ldap2_move_computer()
618 * entry: CN=<new_dc_netbios_name>,CN=Computers,<domain_partition>
619 * newrdn: CN=<new_dc_netbios_name>
621 * newparent: CN=Domain Controllers,<domain_partition>
627 * LDAP unbind on the 2nd LDAP connection
629 * not implemented, because it's not needed...
633 * replicate Domain Partition
634 * on the 3rd DRSUAPI connection and the bind_handle from the 2nd connection
636 * see: becomeDC_drsuapi_pull_partition_send(), becomeDC_drsuapi_pull_partition_recv(),
637 * becomeDC_drsuapi3_pull_domain_send() and becomeDC_drsuapi3_pull_domain_recv()
639 ***************************************************************
640 * Add this stage we call the domain_chunk() callback function
641 * for each replication message
642 ***************************************************************/
644 /* call DsReplicaUpdateRefs() for all partitions like this:
645 * req1: struct drsuapi_DsReplicaUpdateRefsRequest1
647 * naming_context: struct drsuapi_DsReplicaObjectIdentifier
648 * __ndr_size : 0x000000ae (174)
649 * __ndr_size_sid : 0x00000000 (0)
650 * guid : 00000000-0000-0000-0000-000000000000
652 * dn : 'CN=Schema,CN=Configuration,DC=w2k3,DC=vmnet1,DC=vm,DC=base'
654 * dest_dsa_dns_name : '4a0df188-a0b8-47ea-bbe5-e614723f16dd._msdcs.w2k3.vmnet1.vm.base'
655 * dest_dsa_guid : 4a0df188-a0b8-47ea-bbe5-e614723f16dd
656 * options : 0x0000001c (28)
657 * 0: DRSUAPI_DS_REPLICA_UPDATE_ASYNCHRONOUS_OPERATION
658 * 0: DRSUAPI_DS_REPLICA_UPDATE_WRITEABLE
659 * 1: DRSUAPI_DS_REPLICA_UPDATE_ADD_REFERENCE
660 * 1: DRSUAPI_DS_REPLICA_UPDATE_DELETE_REFERENCE
661 * 1: DRSUAPI_DS_REPLICA_UPDATE_0x00000010
663 * 4a0df188-a0b8-47ea-bbe5-e614723f16dd is the objectGUID the DsAddEntry() returned for the
664 * CN=NTDS Settings,CN=<machine_name>,CN=Servers,CN=Default-First-Site-Name, ...
665 * on the 2nd!!! DRSUAPI connection
667 * see: becomeDC_drsuapi_update_refs_send(), becomeDC_drsuapi2_update_refs_schema_recv(),
668 * becomeDC_drsuapi2_update_refs_config_recv() and becomeDC_drsuapi2_update_refs_domain_recv()
672 * Windows does opens the 4th and 5th DRSUAPI connection...
673 * and does a DsBind() with the objectGUID from DsAddEntry() as bind_guid
674 * on the 4th connection
676 * and then 2 full replications of the domain partition on the 5th connection
677 * with the bind_handle from the 4th connection
679 * not implemented because it gives no new information
682 struct libnet_BecomeDC_state
{
683 struct composite_context
*creq
;
685 struct libnet_context
*libnet
;
687 struct dom_sid zero_sid
;
690 struct cldap_socket
*sock
;
691 struct cldap_netlogon io
;
692 struct NETLOGON_SAM_LOGON_RESPONSE_EX netlogon
;
695 struct becomeDC_ldap
{
696 struct ldb_context
*ldb
;
697 const struct ldb_message
*rootdse
;
700 struct becomeDC_drsuapi
{
701 struct libnet_BecomeDC_state
*s
;
702 struct dcerpc_binding
*binding
;
703 struct dcerpc_pipe
*pipe
;
704 struct dcerpc_binding_handle
*drsuapi_handle
;
705 DATA_BLOB gensec_skey
;
706 struct drsuapi_DsBind bind_r
;
707 struct GUID bind_guid
;
708 struct drsuapi_DsBindInfoCtr bind_info_ctr
;
709 struct drsuapi_DsBindInfo28 local_info28
;
710 struct drsuapi_DsBindInfo28 remote_info28
;
711 struct policy_handle bind_handle
;
712 } drsuapi1
, drsuapi2
, drsuapi3
;
714 void *ndr_struct_ptr
;
716 struct libnet_BecomeDC_Domain domain
;
717 struct libnet_BecomeDC_Forest forest
;
718 struct libnet_BecomeDC_SourceDSA source_dsa
;
719 struct libnet_BecomeDC_DestDSA dest_dsa
;
721 struct libnet_BecomeDC_Partition schema_part
, config_part
, domain_part
;
723 struct becomeDC_fsmo
{
724 const char *dns_name
;
725 const char *server_dn_str
;
726 const char *ntds_dn_str
;
727 struct GUID ntds_guid
;
728 } infrastructure_fsmo
;
730 struct becomeDC_fsmo rid_manager_fsmo
;
732 struct libnet_BecomeDC_CheckOptions _co
;
733 struct libnet_BecomeDC_PrepareDB _pp
;
734 struct libnet_BecomeDC_StoreChunk _sc
;
735 struct libnet_BecomeDC_Callbacks callbacks
;
741 static int32_t get_dc_function_level(struct loadparm_context
*lp_ctx
)
743 /* per default we are (Windows) 2008 R2 compatible */
744 return lpcfg_parm_int(lp_ctx
, NULL
, "ads", "dc function level",
745 DS_DOMAIN_FUNCTION_2008_R2
);
748 static void becomeDC_recv_cldap(struct tevent_req
*req
);
750 static void becomeDC_send_cldap(struct libnet_BecomeDC_state
*s
)
752 struct composite_context
*c
= s
->creq
;
753 struct tevent_req
*req
;
754 struct tsocket_address
*dest_address
;
757 s
->cldap
.io
.in
.dest_address
= NULL
;
758 s
->cldap
.io
.in
.dest_port
= 0;
759 s
->cldap
.io
.in
.realm
= s
->domain
.dns_name
;
760 s
->cldap
.io
.in
.host
= s
->dest_dsa
.netbios_name
;
761 s
->cldap
.io
.in
.user
= NULL
;
762 s
->cldap
.io
.in
.domain_guid
= NULL
;
763 s
->cldap
.io
.in
.domain_sid
= NULL
;
764 s
->cldap
.io
.in
.acct_control
= -1;
765 s
->cldap
.io
.in
.version
= NETLOGON_NT_VERSION_5
| NETLOGON_NT_VERSION_5EX
;
766 s
->cldap
.io
.in
.map_response
= true;
768 ret
= tsocket_address_inet_from_strings(s
, "ip",
769 s
->source_dsa
.address
,
770 lpcfg_cldap_port(s
->libnet
->lp_ctx
),
773 c
->status
= map_nt_error_from_unix_common(errno
);
774 if (!composite_is_ok(c
)) return;
777 c
->status
= cldap_socket_init(s
, NULL
, dest_address
, &s
->cldap
.sock
);
778 if (!composite_is_ok(c
)) return;
780 req
= cldap_netlogon_send(s
, s
->libnet
->event_ctx
,
781 s
->cldap
.sock
, &s
->cldap
.io
);
782 if (composite_nomem(req
, c
)) return;
783 tevent_req_set_callback(req
, becomeDC_recv_cldap
, s
);
786 static void becomeDC_connect_ldap1(struct libnet_BecomeDC_state
*s
);
788 static void becomeDC_recv_cldap(struct tevent_req
*req
)
790 struct libnet_BecomeDC_state
*s
= tevent_req_callback_data(req
,
791 struct libnet_BecomeDC_state
);
792 struct composite_context
*c
= s
->creq
;
794 c
->status
= cldap_netlogon_recv(req
, s
, &s
->cldap
.io
);
796 if (!composite_is_ok(c
)) {
797 DEBUG(0,("Failed to send, receive or parse CLDAP reply from server %s for our host %s: %s\n",
798 s
->cldap
.io
.in
.dest_address
,
800 nt_errstr(c
->status
)));
803 s
->cldap
.netlogon
= s
->cldap
.io
.out
.netlogon
.data
.nt5_ex
;
805 s
->domain
.dns_name
= s
->cldap
.netlogon
.dns_domain
;
806 s
->domain
.netbios_name
= s
->cldap
.netlogon
.domain_name
;
807 s
->domain
.guid
= s
->cldap
.netlogon
.domain_uuid
;
809 s
->forest
.dns_name
= s
->cldap
.netlogon
.forest
;
811 s
->source_dsa
.dns_name
= s
->cldap
.netlogon
.pdc_dns_name
;
812 s
->source_dsa
.netbios_name
= s
->cldap
.netlogon
.pdc_name
;
813 s
->source_dsa
.site_name
= s
->cldap
.netlogon
.server_site
;
815 s
->dest_dsa
.site_name
= s
->cldap
.netlogon
.client_site
;
817 DEBUG(0,("CLDAP response: forest=%s dns=%s netbios=%s server_site=%s client_site=%s\n",
818 s
->forest
.dns_name
, s
->domain
.dns_name
, s
->domain
.netbios_name
,
819 s
->source_dsa
.site_name
, s
->dest_dsa
.site_name
));
820 if (!s
->dest_dsa
.site_name
|| strcmp(s
->dest_dsa
.site_name
, "") == 0) {
821 DEBUG(0,("Got empty client site - using server site name %s\n",
822 s
->source_dsa
.site_name
));
823 s
->dest_dsa
.site_name
= s
->source_dsa
.site_name
;
826 becomeDC_connect_ldap1(s
);
829 static NTSTATUS
becomeDC_ldap_connect(struct libnet_BecomeDC_state
*s
,
830 struct becomeDC_ldap
*ldap
)
834 url
= talloc_asprintf(s
, "ldap://%s/", s
->source_dsa
.dns_name
);
835 NT_STATUS_HAVE_NO_MEMORY(url
);
837 ldap
->ldb
= ldb_wrap_connect(s
, s
->libnet
->event_ctx
, s
->libnet
->lp_ctx
, url
,
842 if (ldap
->ldb
== NULL
) {
843 return NT_STATUS_UNEXPECTED_NETWORK_ERROR
;
849 static NTSTATUS
becomeDC_ldap1_rootdse(struct libnet_BecomeDC_state
*s
)
852 struct ldb_result
*r
;
853 struct ldb_dn
*basedn
;
854 static const char *attrs
[] = {
859 basedn
= ldb_dn_new(s
, s
->ldap1
.ldb
, NULL
);
860 NT_STATUS_HAVE_NO_MEMORY(basedn
);
862 ret
= ldb_search(s
->ldap1
.ldb
, s
, &r
, basedn
, LDB_SCOPE_BASE
, attrs
,
865 if (ret
!= LDB_SUCCESS
) {
866 return NT_STATUS_LDAP(ret
);
867 } else if (r
->count
!= 1) {
869 return NT_STATUS_INVALID_NETWORK_RESPONSE
;
872 s
->ldap1
.rootdse
= r
->msgs
[0];
874 s
->domain
.dn_str
= ldb_msg_find_attr_as_string(s
->ldap1
.rootdse
, "defaultNamingContext", NULL
);
875 if (!s
->domain
.dn_str
) return NT_STATUS_INVALID_NETWORK_RESPONSE
;
877 s
->forest
.root_dn_str
= ldb_msg_find_attr_as_string(s
->ldap1
.rootdse
, "rootDomainNamingContext", NULL
);
878 if (!s
->forest
.root_dn_str
) return NT_STATUS_INVALID_NETWORK_RESPONSE
;
879 s
->forest
.config_dn_str
= ldb_msg_find_attr_as_string(s
->ldap1
.rootdse
, "configurationNamingContext", NULL
);
880 if (!s
->forest
.config_dn_str
) return NT_STATUS_INVALID_NETWORK_RESPONSE
;
881 s
->forest
.schema_dn_str
= ldb_msg_find_attr_as_string(s
->ldap1
.rootdse
, "schemaNamingContext", NULL
);
882 if (!s
->forest
.schema_dn_str
) return NT_STATUS_INVALID_NETWORK_RESPONSE
;
884 s
->source_dsa
.server_dn_str
= ldb_msg_find_attr_as_string(s
->ldap1
.rootdse
, "serverName", NULL
);
885 if (!s
->source_dsa
.server_dn_str
) return NT_STATUS_INVALID_NETWORK_RESPONSE
;
886 s
->source_dsa
.ntds_dn_str
= ldb_msg_find_attr_as_string(s
->ldap1
.rootdse
, "dsServiceName", NULL
);
887 if (!s
->source_dsa
.ntds_dn_str
) return NT_STATUS_INVALID_NETWORK_RESPONSE
;
892 static NTSTATUS
becomeDC_ldap1_crossref_behavior_version(struct libnet_BecomeDC_state
*s
)
895 struct ldb_result
*r
;
896 struct ldb_dn
*basedn
;
897 static const char *attrs
[] = {
898 "msDs-Behavior-Version",
902 basedn
= ldb_dn_new(s
, s
->ldap1
.ldb
, s
->forest
.config_dn_str
);
903 NT_STATUS_HAVE_NO_MEMORY(basedn
);
905 ret
= ldb_search(s
->ldap1
.ldb
, s
, &r
, basedn
, LDB_SCOPE_ONELEVEL
, attrs
,
908 if (ret
!= LDB_SUCCESS
) {
909 return NT_STATUS_LDAP(ret
);
910 } else if (r
->count
!= 1) {
912 return NT_STATUS_INVALID_NETWORK_RESPONSE
;
915 s
->forest
.crossref_behavior_version
= ldb_msg_find_attr_as_uint(r
->msgs
[0], "msDs-Behavior-Version", 0);
916 if (s
->forest
.crossref_behavior_version
>
917 get_dc_function_level(s
->libnet
->lp_ctx
)) {
919 DEBUG(0,("The servers function level %u is above 'ads:dc function level' of %u\n",
920 s
->forest
.crossref_behavior_version
,
921 get_dc_function_level(s
->libnet
->lp_ctx
)));
922 return NT_STATUS_NOT_SUPPORTED
;
929 static NTSTATUS
becomeDC_ldap1_domain_behavior_version(struct libnet_BecomeDC_state
*s
)
932 struct ldb_result
*r
;
933 struct ldb_dn
*basedn
;
934 static const char *attrs
[] = {
935 "msDs-Behavior-Version",
939 basedn
= ldb_dn_new(s
, s
->ldap1
.ldb
, s
->domain
.dn_str
);
940 NT_STATUS_HAVE_NO_MEMORY(basedn
);
942 ret
= ldb_search(s
->ldap1
.ldb
, s
, &r
, basedn
, LDB_SCOPE_BASE
, attrs
,
945 if (ret
!= LDB_SUCCESS
) {
946 return NT_STATUS_LDAP(ret
);
947 } else if (r
->count
!= 1) {
949 return NT_STATUS_INVALID_NETWORK_RESPONSE
;
952 s
->domain
.behavior_version
= ldb_msg_find_attr_as_uint(r
->msgs
[0], "msDs-Behavior-Version", 0);
953 if (s
->domain
.behavior_version
>
954 get_dc_function_level(s
->libnet
->lp_ctx
)) {
956 DEBUG(0,("The servers function level %u is above 'ads:dc function level' of %u\n",
957 s
->forest
.crossref_behavior_version
,
958 get_dc_function_level(s
->libnet
->lp_ctx
)));
959 return NT_STATUS_NOT_SUPPORTED
;
966 static NTSTATUS
becomeDC_ldap1_schema_object_version(struct libnet_BecomeDC_state
*s
)
969 struct ldb_result
*r
;
970 struct ldb_dn
*basedn
;
971 static const char *attrs
[] = {
976 basedn
= ldb_dn_new(s
, s
->ldap1
.ldb
, s
->forest
.schema_dn_str
);
977 NT_STATUS_HAVE_NO_MEMORY(basedn
);
979 ret
= ldb_search(s
->ldap1
.ldb
, s
, &r
, basedn
, LDB_SCOPE_BASE
, attrs
,
982 if (ret
!= LDB_SUCCESS
) {
983 return NT_STATUS_LDAP(ret
);
984 } else if (r
->count
!= 1) {
986 return NT_STATUS_INVALID_NETWORK_RESPONSE
;
989 s
->forest
.schema_object_version
= ldb_msg_find_attr_as_uint(r
->msgs
[0], "objectVersion", 0);
995 static NTSTATUS
becomeDC_ldap1_w2k3_update_revision(struct libnet_BecomeDC_state
*s
)
998 struct ldb_result
*r
;
999 struct ldb_dn
*basedn
;
1000 static const char *attrs
[] = {
1005 basedn
= ldb_dn_new_fmt(s
, s
->ldap1
.ldb
, "CN=Windows2003Update,CN=DomainUpdates,CN=System,%s",
1007 NT_STATUS_HAVE_NO_MEMORY(basedn
);
1009 ret
= ldb_search(s
->ldap1
.ldb
, s
, &r
, basedn
, LDB_SCOPE_BASE
, attrs
,
1011 talloc_free(basedn
);
1012 if (ret
== LDB_ERR_NO_SUCH_OBJECT
) {
1013 /* w2k doesn't have this object */
1014 s
->domain
.w2k3_update_revision
= 0;
1015 return NT_STATUS_OK
;
1016 } else if (ret
!= LDB_SUCCESS
) {
1017 return NT_STATUS_LDAP(ret
);
1018 } else if (r
->count
!= 1) {
1020 return NT_STATUS_INVALID_NETWORK_RESPONSE
;
1023 s
->domain
.w2k3_update_revision
= ldb_msg_find_attr_as_uint(r
->msgs
[0], "revision", 0);
1026 return NT_STATUS_OK
;
1029 static NTSTATUS
becomeDC_ldap1_infrastructure_fsmo(struct libnet_BecomeDC_state
*s
)
1032 struct ldb_result
*r
;
1033 struct ldb_dn
*basedn
;
1034 struct ldb_dn
*ntds_dn
;
1035 struct ldb_dn
*server_dn
;
1036 static const char *dns_attrs
[] = {
1040 static const char *guid_attrs
[] = {
1045 ret
= dsdb_wellknown_dn(s
->ldap1
.ldb
, s
,
1046 ldb_get_default_basedn(s
->ldap1
.ldb
),
1047 DS_GUID_INFRASTRUCTURE_CONTAINER
,
1049 if (ret
!= LDB_SUCCESS
) {
1050 DEBUG(0,("Failed to get well known DN for DS_GUID_INFRASTRUCTURE_CONTAINER on %s: %s\n",
1051 ldb_dn_get_linearized(ldb_get_default_basedn(s
->ldap1
.ldb
)),
1052 ldb_errstring(s
->ldap1
.ldb
)));
1053 return NT_STATUS_LDAP(ret
);
1056 ret
= samdb_reference_dn(s
->ldap1
.ldb
, s
, basedn
, "fSMORoleOwner", &ntds_dn
);
1057 if (ret
!= LDB_SUCCESS
) {
1058 DEBUG(0,("Failed to get reference DN from fsmoRoleOwner on %s: %s\n",
1059 ldb_dn_get_linearized(basedn
),
1060 ldb_errstring(s
->ldap1
.ldb
)));
1061 talloc_free(basedn
);
1062 return NT_STATUS_LDAP(ret
);
1065 s
->infrastructure_fsmo
.ntds_dn_str
= ldb_dn_get_linearized(ntds_dn
);
1066 NT_STATUS_HAVE_NO_MEMORY(s
->infrastructure_fsmo
.ntds_dn_str
);
1068 server_dn
= ldb_dn_get_parent(s
, ntds_dn
);
1069 NT_STATUS_HAVE_NO_MEMORY(server_dn
);
1071 s
->infrastructure_fsmo
.server_dn_str
= ldb_dn_alloc_linearized(s
, server_dn
);
1072 NT_STATUS_HAVE_NO_MEMORY(s
->infrastructure_fsmo
.server_dn_str
);
1074 ret
= ldb_search(s
->ldap1
.ldb
, s
, &r
, server_dn
, LDB_SCOPE_BASE
,
1075 dns_attrs
, "(objectClass=*)");
1076 if (ret
!= LDB_SUCCESS
) {
1077 DEBUG(0,("Failed to get server DN %s: %s\n",
1078 ldb_dn_get_linearized(server_dn
),
1079 ldb_errstring(s
->ldap1
.ldb
)));
1080 return NT_STATUS_LDAP(ret
);
1081 } else if (r
->count
!= 1) {
1083 return NT_STATUS_INVALID_NETWORK_RESPONSE
;
1086 s
->infrastructure_fsmo
.dns_name
= ldb_msg_find_attr_as_string(r
->msgs
[0], "dnsHostName", NULL
);
1087 if (!s
->infrastructure_fsmo
.dns_name
) return NT_STATUS_INVALID_NETWORK_RESPONSE
;
1088 talloc_steal(s
, s
->infrastructure_fsmo
.dns_name
);
1092 ldb_dn_remove_extended_components(ntds_dn
);
1093 ret
= ldb_search(s
->ldap1
.ldb
, s
, &r
, ntds_dn
, LDB_SCOPE_BASE
,
1094 guid_attrs
, "(objectClass=*)");
1095 if (ret
!= LDB_SUCCESS
) {
1096 DEBUG(0,("Failed to get NTDS Settings DN %s: %s\n",
1097 ldb_dn_get_linearized(ntds_dn
),
1098 ldb_errstring(s
->ldap1
.ldb
)));
1099 return NT_STATUS_LDAP(ret
);
1100 } else if (r
->count
!= 1) {
1102 return NT_STATUS_INVALID_NETWORK_RESPONSE
;
1105 s
->infrastructure_fsmo
.ntds_guid
= samdb_result_guid(r
->msgs
[0], "objectGUID");
1109 return NT_STATUS_OK
;
1112 static NTSTATUS
becomeDC_ldap1_rid_manager_fsmo(struct libnet_BecomeDC_state
*s
)
1115 struct ldb_result
*r
;
1116 struct ldb_dn
*basedn
;
1117 const char *reference_dn_str
;
1118 struct ldb_dn
*ntds_dn
;
1119 struct ldb_dn
*server_dn
;
1120 static const char *rid_attrs
[] = {
1121 "rIDManagerReference",
1124 static const char *fsmo_attrs
[] = {
1128 static const char *dns_attrs
[] = {
1132 static const char *guid_attrs
[] = {
1137 basedn
= ldb_dn_new(s
, s
->ldap1
.ldb
, s
->domain
.dn_str
);
1138 NT_STATUS_HAVE_NO_MEMORY(basedn
);
1140 ret
= ldb_search(s
->ldap1
.ldb
, s
, &r
, basedn
, LDB_SCOPE_BASE
,
1141 rid_attrs
, "(objectClass=*)");
1142 talloc_free(basedn
);
1143 if (ret
!= LDB_SUCCESS
) {
1144 return NT_STATUS_LDAP(ret
);
1145 } else if (r
->count
!= 1) {
1147 return NT_STATUS_INVALID_NETWORK_RESPONSE
;
1150 reference_dn_str
= ldb_msg_find_attr_as_string(r
->msgs
[0], "rIDManagerReference", NULL
);
1151 if (!reference_dn_str
) return NT_STATUS_INVALID_NETWORK_RESPONSE
;
1153 basedn
= ldb_dn_new(s
, s
->ldap1
.ldb
, reference_dn_str
);
1154 NT_STATUS_HAVE_NO_MEMORY(basedn
);
1158 ret
= ldb_search(s
->ldap1
.ldb
, s
, &r
, basedn
, LDB_SCOPE_BASE
,
1159 fsmo_attrs
, "(objectClass=*)");
1160 talloc_free(basedn
);
1161 if (ret
!= LDB_SUCCESS
) {
1162 return NT_STATUS_LDAP(ret
);
1163 } else if (r
->count
!= 1) {
1165 return NT_STATUS_INVALID_NETWORK_RESPONSE
;
1168 s
->rid_manager_fsmo
.ntds_dn_str
= ldb_msg_find_attr_as_string(r
->msgs
[0], "fSMORoleOwner", NULL
);
1169 if (!s
->rid_manager_fsmo
.ntds_dn_str
) return NT_STATUS_INVALID_NETWORK_RESPONSE
;
1170 talloc_steal(s
, s
->rid_manager_fsmo
.ntds_dn_str
);
1174 ntds_dn
= ldb_dn_new(s
, s
->ldap1
.ldb
, s
->rid_manager_fsmo
.ntds_dn_str
);
1175 NT_STATUS_HAVE_NO_MEMORY(ntds_dn
);
1177 server_dn
= ldb_dn_get_parent(s
, ntds_dn
);
1178 NT_STATUS_HAVE_NO_MEMORY(server_dn
);
1180 s
->rid_manager_fsmo
.server_dn_str
= ldb_dn_alloc_linearized(s
, server_dn
);
1181 NT_STATUS_HAVE_NO_MEMORY(s
->rid_manager_fsmo
.server_dn_str
);
1183 ret
= ldb_search(s
->ldap1
.ldb
, s
, &r
, server_dn
, LDB_SCOPE_BASE
,
1184 dns_attrs
, "(objectClass=*)");
1185 if (ret
!= LDB_SUCCESS
) {
1186 return NT_STATUS_LDAP(ret
);
1187 } else if (r
->count
!= 1) {
1189 return NT_STATUS_INVALID_NETWORK_RESPONSE
;
1192 s
->rid_manager_fsmo
.dns_name
= ldb_msg_find_attr_as_string(r
->msgs
[0], "dnsHostName", NULL
);
1193 if (!s
->rid_manager_fsmo
.dns_name
) return NT_STATUS_INVALID_NETWORK_RESPONSE
;
1194 talloc_steal(s
, s
->rid_manager_fsmo
.dns_name
);
1198 ret
= ldb_search(s
->ldap1
.ldb
, s
, &r
, ntds_dn
, LDB_SCOPE_BASE
,
1199 guid_attrs
, "(objectClass=*)");
1200 if (ret
!= LDB_SUCCESS
) {
1201 return NT_STATUS_LDAP(ret
);
1202 } else if (r
->count
!= 1) {
1204 return NT_STATUS_INVALID_NETWORK_RESPONSE
;
1207 s
->rid_manager_fsmo
.ntds_guid
= samdb_result_guid(r
->msgs
[0], "objectGUID");
1211 return NT_STATUS_OK
;
1214 static NTSTATUS
becomeDC_ldap1_site_object(struct libnet_BecomeDC_state
*s
)
1217 struct ldb_result
*r
;
1218 struct ldb_dn
*basedn
;
1220 basedn
= ldb_dn_new_fmt(s
, s
->ldap1
.ldb
, "CN=%s,CN=Sites,%s",
1221 s
->dest_dsa
.site_name
,
1222 s
->forest
.config_dn_str
);
1223 NT_STATUS_HAVE_NO_MEMORY(basedn
);
1225 ret
= ldb_search(s
->ldap1
.ldb
, s
, &r
, basedn
, LDB_SCOPE_BASE
,
1226 NULL
, "(objectClass=*)");
1227 talloc_free(basedn
);
1228 if (ret
!= LDB_SUCCESS
) {
1229 return NT_STATUS_LDAP(ret
);
1230 } else if (r
->count
!= 1) {
1232 return NT_STATUS_INVALID_NETWORK_RESPONSE
;
1235 s
->dest_dsa
.site_guid
= samdb_result_guid(r
->msgs
[0], "objectGUID");
1238 return NT_STATUS_OK
;
1241 static NTSTATUS
becomeDC_check_options(struct libnet_BecomeDC_state
*s
)
1243 if (!s
->callbacks
.check_options
) return NT_STATUS_OK
;
1245 s
->_co
.domain
= &s
->domain
;
1246 s
->_co
.forest
= &s
->forest
;
1247 s
->_co
.source_dsa
= &s
->source_dsa
;
1249 return s
->callbacks
.check_options(s
->callbacks
.private_data
, &s
->_co
);
1252 static NTSTATUS
becomeDC_ldap1_computer_object(struct libnet_BecomeDC_state
*s
)
1255 struct ldb_result
*r
;
1256 struct ldb_dn
*basedn
;
1257 static const char *attrs
[] = {
1258 "distinguishedName",
1259 "userAccountControl",
1263 basedn
= ldb_dn_new(s
, s
->ldap1
.ldb
, s
->domain
.dn_str
);
1264 NT_STATUS_HAVE_NO_MEMORY(basedn
);
1266 ret
= ldb_search(s
->ldap1
.ldb
, s
, &r
, basedn
, LDB_SCOPE_SUBTREE
, attrs
,
1267 "(&(|(objectClass=user)(objectClass=computer))(sAMAccountName=%s$))",
1268 s
->dest_dsa
.netbios_name
);
1269 talloc_free(basedn
);
1270 if (ret
!= LDB_SUCCESS
) {
1271 return NT_STATUS_LDAP(ret
);
1272 } else if (r
->count
!= 1) {
1274 return NT_STATUS_INVALID_NETWORK_RESPONSE
;
1277 s
->dest_dsa
.computer_dn_str
= ldb_msg_find_attr_as_string(r
->msgs
[0], "distinguishedName", NULL
);
1278 if (!s
->dest_dsa
.computer_dn_str
) return NT_STATUS_INVALID_NETWORK_RESPONSE
;
1279 talloc_steal(s
, s
->dest_dsa
.computer_dn_str
);
1281 s
->dest_dsa
.user_account_control
= ldb_msg_find_attr_as_uint(r
->msgs
[0], "userAccountControl", 0);
1284 return NT_STATUS_OK
;
1287 static NTSTATUS
becomeDC_ldap1_server_object_1(struct libnet_BecomeDC_state
*s
)
1290 struct ldb_result
*r
;
1291 struct ldb_dn
*basedn
;
1292 const char *server_reference_dn_str
;
1293 struct ldb_dn
*server_reference_dn
;
1294 struct ldb_dn
*computer_dn
;
1296 basedn
= ldb_dn_new_fmt(s
, s
->ldap1
.ldb
, "CN=%s,CN=Servers,CN=%s,CN=Sites,%s",
1297 s
->dest_dsa
.netbios_name
,
1298 s
->dest_dsa
.site_name
,
1299 s
->forest
.config_dn_str
);
1300 NT_STATUS_HAVE_NO_MEMORY(basedn
);
1302 ret
= ldb_search(s
->ldap1
.ldb
, s
, &r
, basedn
, LDB_SCOPE_BASE
,
1303 NULL
, "(objectClass=*)");
1304 talloc_free(basedn
);
1305 if (ret
== LDB_ERR_NO_SUCH_OBJECT
) {
1306 /* if the object doesn't exist, we'll create it later */
1307 return NT_STATUS_OK
;
1308 } else if (ret
!= LDB_SUCCESS
) {
1309 return NT_STATUS_LDAP(ret
);
1310 } else if (r
->count
!= 1) {
1312 return NT_STATUS_INVALID_NETWORK_RESPONSE
;
1315 server_reference_dn_str
= ldb_msg_find_attr_as_string(r
->msgs
[0], "serverReference", NULL
);
1316 if (server_reference_dn_str
) {
1317 server_reference_dn
= ldb_dn_new(r
, s
->ldap1
.ldb
, server_reference_dn_str
);
1318 NT_STATUS_HAVE_NO_MEMORY(server_reference_dn
);
1320 computer_dn
= ldb_dn_new(r
, s
->ldap1
.ldb
, s
->dest_dsa
.computer_dn_str
);
1321 NT_STATUS_HAVE_NO_MEMORY(computer_dn
);
1324 * if the server object belongs to another DC in another domain
1325 * in the forest, we should not touch this object!
1327 if (ldb_dn_compare(computer_dn
, server_reference_dn
) != 0) {
1329 return NT_STATUS_OBJECT_NAME_COLLISION
;
1333 /* if the server object is already for the dest_dsa, then we don't need to create it */
1334 s
->dest_dsa
.server_dn_str
= ldb_msg_find_attr_as_string(r
->msgs
[0], "distinguishedName", NULL
);
1335 if (!s
->dest_dsa
.server_dn_str
) return NT_STATUS_INVALID_NETWORK_RESPONSE
;
1336 talloc_steal(s
, s
->dest_dsa
.server_dn_str
);
1339 return NT_STATUS_OK
;
1342 static NTSTATUS
becomeDC_ldap1_server_object_2(struct libnet_BecomeDC_state
*s
)
1345 struct ldb_result
*r
;
1346 struct ldb_dn
*basedn
;
1347 const char *server_reference_bl_dn_str
;
1348 static const char *attrs
[] = {
1349 "serverReferenceBL",
1353 /* if the server_dn_str has a valid value, we skip this lookup */
1354 if (s
->dest_dsa
.server_dn_str
) return NT_STATUS_OK
;
1356 basedn
= ldb_dn_new(s
, s
->ldap1
.ldb
, s
->dest_dsa
.computer_dn_str
);
1357 NT_STATUS_HAVE_NO_MEMORY(basedn
);
1359 ret
= ldb_search(s
->ldap1
.ldb
, s
, &r
, basedn
, LDB_SCOPE_BASE
,
1360 attrs
, "(objectClass=*)");
1361 talloc_free(basedn
);
1362 if (ret
!= LDB_SUCCESS
) {
1363 return NT_STATUS_LDAP(ret
);
1364 } else if (r
->count
!= 1) {
1366 return NT_STATUS_INVALID_NETWORK_RESPONSE
;
1369 server_reference_bl_dn_str
= ldb_msg_find_attr_as_string(r
->msgs
[0], "serverReferenceBL", NULL
);
1370 if (!server_reference_bl_dn_str
) {
1371 /* if no back link is present, we're done for this function */
1373 return NT_STATUS_OK
;
1376 /* if the server object is already for the dest_dsa, then we don't need to create it */
1377 s
->dest_dsa
.server_dn_str
= ldb_msg_find_attr_as_string(r
->msgs
[0], "serverReferenceBL", NULL
);
1378 if (s
->dest_dsa
.server_dn_str
) {
1379 /* if a back link is present, we know that the server object is present */
1380 talloc_steal(s
, s
->dest_dsa
.server_dn_str
);
1384 return NT_STATUS_OK
;
1387 static NTSTATUS
becomeDC_ldap1_server_object_add(struct libnet_BecomeDC_state
*s
)
1390 struct ldb_message
*msg
;
1391 char *server_dn_str
;
1393 /* if the server_dn_str has a valid value, we skip this lookup */
1394 if (s
->dest_dsa
.server_dn_str
) return NT_STATUS_OK
;
1396 msg
= ldb_msg_new(s
);
1397 NT_STATUS_HAVE_NO_MEMORY(msg
);
1399 msg
->dn
= ldb_dn_new_fmt(msg
, s
->ldap1
.ldb
, "CN=%s,CN=Servers,CN=%s,CN=Sites,%s",
1400 s
->dest_dsa
.netbios_name
,
1401 s
->dest_dsa
.site_name
,
1402 s
->forest
.config_dn_str
);
1403 NT_STATUS_HAVE_NO_MEMORY(msg
->dn
);
1405 ret
= ldb_msg_add_string(msg
, "objectClass", "server");
1408 return NT_STATUS_NO_MEMORY
;
1410 ret
= ldb_msg_add_string(msg
, "systemFlags", "50000000");
1413 return NT_STATUS_NO_MEMORY
;
1415 ret
= ldb_msg_add_string(msg
, "serverReference", s
->dest_dsa
.computer_dn_str
);
1418 return NT_STATUS_NO_MEMORY
;
1421 server_dn_str
= ldb_dn_alloc_linearized(s
, msg
->dn
);
1422 NT_STATUS_HAVE_NO_MEMORY(server_dn_str
);
1424 ret
= ldb_add(s
->ldap1
.ldb
, msg
);
1426 if (ret
!= LDB_SUCCESS
) {
1427 talloc_free(server_dn_str
);
1428 return NT_STATUS_LDAP(ret
);
1431 s
->dest_dsa
.server_dn_str
= server_dn_str
;
1433 return NT_STATUS_OK
;
1436 static NTSTATUS
becomeDC_ldap1_server_object_modify(struct libnet_BecomeDC_state
*s
)
1439 struct ldb_message
*msg
;
1442 /* make a 'modify' msg, and only for serverReference */
1443 msg
= ldb_msg_new(s
);
1444 NT_STATUS_HAVE_NO_MEMORY(msg
);
1445 msg
->dn
= ldb_dn_new(msg
, s
->ldap1
.ldb
, s
->dest_dsa
.server_dn_str
);
1446 NT_STATUS_HAVE_NO_MEMORY(msg
->dn
);
1448 ret
= ldb_msg_add_string(msg
, "serverReference", s
->dest_dsa
.computer_dn_str
);
1451 return NT_STATUS_NO_MEMORY
;
1454 /* mark all the message elements (should be just one)
1455 as LDB_FLAG_MOD_ADD */
1456 for (i
=0;i
<msg
->num_elements
;i
++) {
1457 msg
->elements
[i
].flags
= LDB_FLAG_MOD_ADD
;
1460 ret
= ldb_modify(s
->ldap1
.ldb
, msg
);
1461 if (ret
== LDB_SUCCESS
) {
1463 return NT_STATUS_OK
;
1464 } else if (ret
== LDB_ERR_ATTRIBUTE_OR_VALUE_EXISTS
) {
1465 /* retry with LDB_FLAG_MOD_REPLACE */
1468 return NT_STATUS_LDAP(ret
);
1471 /* mark all the message elements (should be just one)
1472 as LDB_FLAG_MOD_REPLACE */
1473 for (i
=0;i
<msg
->num_elements
;i
++) {
1474 msg
->elements
[i
].flags
= LDB_FLAG_MOD_REPLACE
;
1477 ret
= ldb_modify(s
->ldap1
.ldb
, msg
);
1479 if (ret
!= LDB_SUCCESS
) {
1480 return NT_STATUS_LDAP(ret
);
1483 return NT_STATUS_OK
;
1486 static void becomeDC_drsuapi_connect_send(struct libnet_BecomeDC_state
*s
,
1487 struct becomeDC_drsuapi
*drsuapi
,
1488 void (*recv_fn
)(struct composite_context
*req
));
1489 static void becomeDC_drsuapi1_connect_recv(struct composite_context
*req
);
1490 static void becomeDC_connect_ldap2(struct libnet_BecomeDC_state
*s
);
1492 static void becomeDC_connect_ldap1(struct libnet_BecomeDC_state
*s
)
1494 struct composite_context
*c
= s
->creq
;
1496 c
->status
= becomeDC_ldap_connect(s
, &s
->ldap1
);
1497 if (!composite_is_ok(c
)) return;
1499 c
->status
= becomeDC_ldap1_rootdse(s
);
1500 if (!composite_is_ok(c
)) return;
1502 c
->status
= becomeDC_ldap1_crossref_behavior_version(s
);
1503 if (!composite_is_ok(c
)) return;
1505 c
->status
= becomeDC_ldap1_domain_behavior_version(s
);
1506 if (!composite_is_ok(c
)) return;
1508 c
->status
= becomeDC_ldap1_schema_object_version(s
);
1509 if (!composite_is_ok(c
)) return;
1511 c
->status
= becomeDC_ldap1_w2k3_update_revision(s
);
1512 if (!composite_is_ok(c
)) return;
1514 c
->status
= becomeDC_ldap1_infrastructure_fsmo(s
);
1515 if (!composite_is_ok(c
)) return;
1517 c
->status
= becomeDC_ldap1_rid_manager_fsmo(s
);
1518 if (!composite_is_ok(c
)) return;
1520 c
->status
= becomeDC_ldap1_site_object(s
);
1521 if (!composite_is_ok(c
)) return;
1523 c
->status
= becomeDC_check_options(s
);
1524 if (!composite_is_ok(c
)) return;
1526 c
->status
= becomeDC_ldap1_computer_object(s
);
1527 if (!composite_is_ok(c
)) return;
1529 c
->status
= becomeDC_ldap1_server_object_1(s
);
1530 if (!composite_is_ok(c
)) return;
1532 c
->status
= becomeDC_ldap1_server_object_2(s
);
1533 if (!composite_is_ok(c
)) return;
1535 c
->status
= becomeDC_ldap1_server_object_add(s
);
1536 if (!composite_is_ok(c
)) return;
1538 c
->status
= becomeDC_ldap1_server_object_modify(s
);
1539 if (!composite_is_ok(c
)) return;
1541 becomeDC_drsuapi_connect_send(s
, &s
->drsuapi1
, becomeDC_drsuapi1_connect_recv
);
1544 static void becomeDC_drsuapi_connect_send(struct libnet_BecomeDC_state
*s
,
1545 struct becomeDC_drsuapi
*drsuapi
,
1546 void (*recv_fn
)(struct composite_context
*req
))
1548 struct composite_context
*c
= s
->creq
;
1549 struct composite_context
*creq
;
1554 if (!drsuapi
->binding
) {
1555 const char *krb5_str
= "";
1556 const char *print_str
= "";
1558 * Note: Replication only works with Windows 2000 when 'krb5' is
1559 * passed as auth_type here. If NTLMSSP is used, Windows
1560 * 2000 returns garbage in the DsGetNCChanges() response
1561 * if encrypted password attributes would be in the
1562 * response. That means the replication of the schema and
1563 * configuration partition works fine, but it fails for
1564 * the domain partition.
1566 if (lpcfg_parm_bool(s
->libnet
->lp_ctx
, NULL
, "become_dc",
1567 "force krb5", true))
1571 if (lpcfg_parm_bool(s
->libnet
->lp_ctx
, NULL
, "become_dc",
1574 print_str
= "print,";
1576 binding_str
= talloc_asprintf(s
, "ncacn_ip_tcp:%s[%s%sseal,target_hostname=%s]",
1577 s
->source_dsa
.address
,
1578 krb5_str
, print_str
,
1579 s
->source_dsa
.dns_name
);
1580 if (composite_nomem(binding_str
, c
)) return;
1581 c
->status
= dcerpc_parse_binding(s
, binding_str
, &drsuapi
->binding
);
1582 talloc_free(binding_str
);
1583 if (!composite_is_ok(c
)) return;
1586 if (DEBUGLEVEL
>= 10) {
1587 c
->status
= dcerpc_binding_set_flags(drsuapi
->binding
,
1588 DCERPC_DEBUG_PRINT_BOTH
,
1590 if (!composite_is_ok(c
)) return;
1593 creq
= dcerpc_pipe_connect_b_send(s
, drsuapi
->binding
, &ndr_table_drsuapi
,
1594 s
->libnet
->cred
, s
->libnet
->event_ctx
,
1596 composite_continue(c
, creq
, recv_fn
, s
);
1599 static void becomeDC_drsuapi_bind_send(struct libnet_BecomeDC_state
*s
,
1600 struct becomeDC_drsuapi
*drsuapi
,
1601 void (*recv_fn
)(struct tevent_req
*subreq
));
1602 static void becomeDC_drsuapi1_bind_recv(struct tevent_req
*subreq
);
1604 static void becomeDC_drsuapi1_connect_recv(struct composite_context
*req
)
1606 struct libnet_BecomeDC_state
*s
= talloc_get_type(req
->async
.private_data
,
1607 struct libnet_BecomeDC_state
);
1608 struct composite_context
*c
= s
->creq
;
1610 c
->status
= dcerpc_pipe_connect_b_recv(req
, s
, &s
->drsuapi1
.pipe
);
1611 if (!composite_is_ok(c
)) return;
1613 s
->drsuapi1
.drsuapi_handle
= s
->drsuapi1
.pipe
->binding_handle
;
1615 c
->status
= gensec_session_key(s
->drsuapi1
.pipe
->conn
->security_state
.generic_state
,
1617 &s
->drsuapi1
.gensec_skey
);
1618 if (!composite_is_ok(c
)) return;
1620 becomeDC_drsuapi_bind_send(s
, &s
->drsuapi1
, becomeDC_drsuapi1_bind_recv
);
1623 static void becomeDC_drsuapi_bind_send(struct libnet_BecomeDC_state
*s
,
1624 struct becomeDC_drsuapi
*drsuapi
,
1625 void (*recv_fn
)(struct tevent_req
*subreq
))
1627 struct composite_context
*c
= s
->creq
;
1628 struct drsuapi_DsBindInfo28
*bind_info28
;
1629 struct tevent_req
*subreq
;
1631 GUID_from_string(DRSUAPI_DS_BIND_GUID_W2K3
, &drsuapi
->bind_guid
);
1633 bind_info28
= &drsuapi
->local_info28
;
1634 bind_info28
->supported_extensions
|= DRSUAPI_SUPPORTED_EXTENSION_BASE
;
1635 bind_info28
->supported_extensions
|= DRSUAPI_SUPPORTED_EXTENSION_ASYNC_REPLICATION
;
1636 bind_info28
->supported_extensions
|= DRSUAPI_SUPPORTED_EXTENSION_REMOVEAPI
;
1637 bind_info28
->supported_extensions
|= DRSUAPI_SUPPORTED_EXTENSION_MOVEREQ_V2
;
1638 bind_info28
->supported_extensions
|= DRSUAPI_SUPPORTED_EXTENSION_GETCHG_COMPRESS
;
1639 bind_info28
->supported_extensions
|= DRSUAPI_SUPPORTED_EXTENSION_DCINFO_V1
;
1640 bind_info28
->supported_extensions
|= DRSUAPI_SUPPORTED_EXTENSION_RESTORE_USN_OPTIMIZATION
;
1641 bind_info28
->supported_extensions
|= DRSUAPI_SUPPORTED_EXTENSION_KCC_EXECUTE
;
1642 bind_info28
->supported_extensions
|= DRSUAPI_SUPPORTED_EXTENSION_ADDENTRY_V2
;
1643 if (s
->domain
.behavior_version
>= DS_DOMAIN_FUNCTION_2003
) {
1644 /* TODO: find out how this is really triggered! */
1645 bind_info28
->supported_extensions
|= DRSUAPI_SUPPORTED_EXTENSION_LINKED_VALUE_REPLICATION
;
1647 bind_info28
->supported_extensions
|= DRSUAPI_SUPPORTED_EXTENSION_DCINFO_V2
;
1648 bind_info28
->supported_extensions
|= DRSUAPI_SUPPORTED_EXTENSION_INSTANCE_TYPE_NOT_REQ_ON_MOD
;
1649 bind_info28
->supported_extensions
|= DRSUAPI_SUPPORTED_EXTENSION_CRYPTO_BIND
;
1650 bind_info28
->supported_extensions
|= DRSUAPI_SUPPORTED_EXTENSION_GET_REPL_INFO
;
1651 bind_info28
->supported_extensions
|= DRSUAPI_SUPPORTED_EXTENSION_STRONG_ENCRYPTION
;
1652 bind_info28
->supported_extensions
|= DRSUAPI_SUPPORTED_EXTENSION_DCINFO_V01
;
1653 bind_info28
->supported_extensions
|= DRSUAPI_SUPPORTED_EXTENSION_TRANSITIVE_MEMBERSHIP
;
1654 bind_info28
->supported_extensions
|= DRSUAPI_SUPPORTED_EXTENSION_ADD_SID_HISTORY
;
1655 bind_info28
->supported_extensions
|= DRSUAPI_SUPPORTED_EXTENSION_POST_BETA3
;
1656 bind_info28
->supported_extensions
|= DRSUAPI_SUPPORTED_EXTENSION_GETCHGREQ_V5
;
1657 bind_info28
->supported_extensions
|= DRSUAPI_SUPPORTED_EXTENSION_GET_MEMBERSHIPS2
;
1658 bind_info28
->supported_extensions
|= DRSUAPI_SUPPORTED_EXTENSION_GETCHGREQ_V6
;
1659 bind_info28
->supported_extensions
|= DRSUAPI_SUPPORTED_EXTENSION_NONDOMAIN_NCS
;
1660 bind_info28
->supported_extensions
|= DRSUAPI_SUPPORTED_EXTENSION_GETCHGREQ_V8
;
1661 bind_info28
->supported_extensions
|= DRSUAPI_SUPPORTED_EXTENSION_GETCHGREPLY_V5
;
1662 bind_info28
->supported_extensions
|= DRSUAPI_SUPPORTED_EXTENSION_GETCHGREPLY_V6
;
1663 bind_info28
->supported_extensions
|= DRSUAPI_SUPPORTED_EXTENSION_ADDENTRYREPLY_V3
;
1664 bind_info28
->supported_extensions
|= DRSUAPI_SUPPORTED_EXTENSION_GETCHGREPLY_V7
;
1665 bind_info28
->supported_extensions
|= DRSUAPI_SUPPORTED_EXTENSION_VERIFY_OBJECT
;
1666 #if 0 /* we don't support XPRESS compression yet */
1667 bind_info28
->supported_extensions
|= DRSUAPI_SUPPORTED_EXTENSION_XPRESS_COMPRESS
;
1669 bind_info28
->site_guid
= s
->dest_dsa
.site_guid
;
1670 bind_info28
->pid
= 0;
1671 bind_info28
->repl_epoch
= 0;
1673 drsuapi
->bind_info_ctr
.length
= 28;
1674 drsuapi
->bind_info_ctr
.info
.info28
= *bind_info28
;
1676 drsuapi
->bind_r
.in
.bind_guid
= &drsuapi
->bind_guid
;
1677 drsuapi
->bind_r
.in
.bind_info
= &drsuapi
->bind_info_ctr
;
1678 drsuapi
->bind_r
.out
.bind_handle
= &drsuapi
->bind_handle
;
1680 subreq
= dcerpc_drsuapi_DsBind_r_send(s
, c
->event_ctx
,
1681 drsuapi
->drsuapi_handle
,
1683 if (composite_nomem(subreq
, c
)) return;
1684 tevent_req_set_callback(subreq
, recv_fn
, s
);
1687 static WERROR
becomeDC_drsuapi_bind_recv(struct libnet_BecomeDC_state
*s
,
1688 struct becomeDC_drsuapi
*drsuapi
)
1690 if (!W_ERROR_IS_OK(drsuapi
->bind_r
.out
.result
)) {
1691 return drsuapi
->bind_r
.out
.result
;
1694 ZERO_STRUCT(drsuapi
->remote_info28
);
1695 if (drsuapi
->bind_r
.out
.bind_info
) {
1696 switch (drsuapi
->bind_r
.out
.bind_info
->length
) {
1698 struct drsuapi_DsBindInfo24
*info24
;
1699 info24
= &drsuapi
->bind_r
.out
.bind_info
->info
.info24
;
1700 drsuapi
->remote_info28
.supported_extensions
= info24
->supported_extensions
;
1701 drsuapi
->remote_info28
.site_guid
= info24
->site_guid
;
1702 drsuapi
->remote_info28
.pid
= info24
->pid
;
1703 drsuapi
->remote_info28
.repl_epoch
= 0;
1707 drsuapi
->remote_info28
= drsuapi
->bind_r
.out
.bind_info
->info
.info28
;
1711 struct drsuapi_DsBindInfo32
*info32
;
1712 info32
= &drsuapi
->bind_r
.out
.bind_info
->info
.info32
;
1713 drsuapi
->remote_info28
.supported_extensions
= info32
->supported_extensions
;
1714 drsuapi
->remote_info28
.site_guid
= info32
->site_guid
;
1715 drsuapi
->remote_info28
.pid
= info32
->pid
;
1716 drsuapi
->remote_info28
.repl_epoch
= info32
->repl_epoch
;
1720 struct drsuapi_DsBindInfo48
*info48
;
1721 info48
= &drsuapi
->bind_r
.out
.bind_info
->info
.info48
;
1722 drsuapi
->remote_info28
.supported_extensions
= info48
->supported_extensions
;
1723 drsuapi
->remote_info28
.site_guid
= info48
->site_guid
;
1724 drsuapi
->remote_info28
.pid
= info48
->pid
;
1725 drsuapi
->remote_info28
.repl_epoch
= info48
->repl_epoch
;
1729 struct drsuapi_DsBindInfo52
*info52
;
1730 info52
= &drsuapi
->bind_r
.out
.bind_info
->info
.info52
;
1731 drsuapi
->remote_info28
.supported_extensions
= info52
->supported_extensions
;
1732 drsuapi
->remote_info28
.site_guid
= info52
->site_guid
;
1733 drsuapi
->remote_info28
.pid
= info52
->pid
;
1734 drsuapi
->remote_info28
.repl_epoch
= info52
->repl_epoch
;
1738 DEBUG(1, ("Warning: invalid info length in bind info: %d\n",
1739 drsuapi
->bind_r
.out
.bind_info
->length
));
1747 static void becomeDC_drsuapi1_add_entry_send(struct libnet_BecomeDC_state
*s
);
1749 static void becomeDC_drsuapi1_bind_recv(struct tevent_req
*subreq
)
1751 struct libnet_BecomeDC_state
*s
= tevent_req_callback_data(subreq
,
1752 struct libnet_BecomeDC_state
);
1753 struct composite_context
*c
= s
->creq
;
1756 c
->status
= dcerpc_drsuapi_DsBind_r_recv(subreq
, s
);
1757 TALLOC_FREE(subreq
);
1758 if (!composite_is_ok(c
)) return;
1760 status
= becomeDC_drsuapi_bind_recv(s
, &s
->drsuapi1
);
1761 if (!W_ERROR_IS_OK(status
)) {
1762 composite_error(c
, werror_to_ntstatus(status
));
1766 becomeDC_drsuapi1_add_entry_send(s
);
1769 static void becomeDC_drsuapi1_add_entry_recv(struct tevent_req
*subreq
);
1771 static void becomeDC_drsuapi1_add_entry_send(struct libnet_BecomeDC_state
*s
)
1773 struct composite_context
*c
= s
->creq
;
1774 struct drsuapi_DsAddEntry
*r
;
1775 struct drsuapi_DsReplicaObjectIdentifier
*identifier
;
1776 uint32_t num_attrs
, i
= 0;
1777 struct drsuapi_DsReplicaAttribute
*attrs
;
1778 enum ndr_err_code ndr_err
;
1780 struct tevent_req
*subreq
;
1782 /* choose a random invocationId */
1783 s
->dest_dsa
.invocation_id
= GUID_random();
1786 * if the schema version indicates w2k3, then also send some w2k3
1787 * specific attributes.
1789 if (s
->forest
.schema_object_version
>= 30) {
1795 r
= talloc_zero(s
, struct drsuapi_DsAddEntry
);
1796 if (composite_nomem(r
, c
)) return;
1798 /* setup identifier */
1799 identifier
= talloc(r
, struct drsuapi_DsReplicaObjectIdentifier
);
1800 if (composite_nomem(identifier
, c
)) return;
1801 identifier
->guid
= GUID_zero();
1802 identifier
->sid
= s
->zero_sid
;
1803 identifier
->dn
= talloc_asprintf(identifier
, "CN=NTDS Settings,%s",
1804 s
->dest_dsa
.server_dn_str
);
1805 if (composite_nomem(identifier
->dn
, c
)) return;
1807 /* allocate attribute array */
1809 attrs
= talloc_array(r
, struct drsuapi_DsReplicaAttribute
, num_attrs
);
1810 if (composite_nomem(attrs
, c
)) return;
1812 /* ntSecurityDescriptor */
1814 struct drsuapi_DsAttributeValue
*vs
;
1816 struct security_descriptor
*v
;
1817 struct dom_sid
*domain_admins_sid
;
1818 const char *domain_admins_sid_str
;
1820 vs
= talloc_array(attrs
, struct drsuapi_DsAttributeValue
, 1);
1821 if (composite_nomem(vs
, c
)) return;
1823 vd
= talloc_array(vs
, DATA_BLOB
, 1);
1824 if (composite_nomem(vd
, c
)) return;
1826 domain_admins_sid
= dom_sid_add_rid(vs
, s
->domain
.sid
, DOMAIN_RID_ADMINS
);
1827 if (composite_nomem(domain_admins_sid
, c
)) return;
1829 domain_admins_sid_str
= dom_sid_string(domain_admins_sid
, domain_admins_sid
);
1830 if (composite_nomem(domain_admins_sid_str
, c
)) return;
1832 v
= security_descriptor_dacl_create(vd
,
1834 /* owner: domain admins */
1835 domain_admins_sid_str
,
1836 /* owner group: domain admins */
1837 domain_admins_sid_str
,
1838 /* authenticated users */
1839 SID_NT_AUTHENTICATED_USERS
,
1840 SEC_ACE_TYPE_ACCESS_ALLOWED
,
1841 SEC_STD_READ_CONTROL
|
1844 SEC_ADS_LIST_OBJECT
,
1847 domain_admins_sid_str
,
1848 SEC_ACE_TYPE_ACCESS_ALLOWED
,
1850 SEC_ADS_CREATE_CHILD
|
1852 SEC_ADS_SELF_WRITE
|
1854 SEC_ADS_WRITE_PROP
|
1855 SEC_ADS_DELETE_TREE
|
1856 SEC_ADS_LIST_OBJECT
|
1857 SEC_ADS_CONTROL_ACCESS
,
1861 SEC_ACE_TYPE_ACCESS_ALLOWED
,
1863 SEC_ADS_CREATE_CHILD
|
1864 SEC_ADS_DELETE_CHILD
|
1866 SEC_ADS_SELF_WRITE
|
1868 SEC_ADS_WRITE_PROP
|
1869 SEC_ADS_DELETE_TREE
|
1870 SEC_ADS_LIST_OBJECT
|
1871 SEC_ADS_CONTROL_ACCESS
,
1875 if (composite_nomem(v
, c
)) return;
1877 ndr_err
= ndr_push_struct_blob(&vd
[0], vd
, v
,
1878 (ndr_push_flags_fn_t
)ndr_push_security_descriptor
);
1879 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err
)) {
1880 c
->status
= ndr_map_error2ntstatus(ndr_err
);
1881 if (!composite_is_ok(c
)) return;
1884 vs
[0].blob
= &vd
[0];
1886 attrs
[i
].attid
= DRSUAPI_ATTID_ntSecurityDescriptor
;
1887 attrs
[i
].value_ctr
.num_values
= 1;
1888 attrs
[i
].value_ctr
.values
= vs
;
1893 /* objectClass: nTDSDSA */
1895 struct drsuapi_DsAttributeValue
*vs
;
1898 vs
= talloc_array(attrs
, struct drsuapi_DsAttributeValue
, 1);
1899 if (composite_nomem(vs
, c
)) return;
1901 vd
= talloc_array(vs
, DATA_BLOB
, 1);
1902 if (composite_nomem(vd
, c
)) return;
1904 vd
[0] = data_blob_talloc(vd
, NULL
, 4);
1905 if (composite_nomem(vd
[0].data
, c
)) return;
1907 /* value for nTDSDSA */
1908 SIVAL(vd
[0].data
, 0, 0x0017002F);
1910 vs
[0].blob
= &vd
[0];
1912 attrs
[i
].attid
= DRSUAPI_ATTID_objectClass
;
1913 attrs
[i
].value_ctr
.num_values
= 1;
1914 attrs
[i
].value_ctr
.values
= vs
;
1919 /* objectCategory: CN=NTDS-DSA,CN=Schema,... or CN=NTDS-DSA-RO,CN=Schema,... */
1921 struct drsuapi_DsAttributeValue
*vs
;
1923 struct drsuapi_DsReplicaObjectIdentifier3 v
[1];
1925 vs
= talloc_array(attrs
, struct drsuapi_DsAttributeValue
, 1);
1926 if (composite_nomem(vs
, c
)) return;
1928 vd
= talloc_array(vs
, DATA_BLOB
, 1);
1929 if (composite_nomem(vd
, c
)) return;
1931 v
[0].guid
= GUID_zero();
1932 v
[0].sid
= s
->zero_sid
;
1935 v
[0].dn
= talloc_asprintf(vd
, "CN=NTDS-DSA-RO,%s",
1936 s
->forest
.schema_dn_str
);
1938 v
[0].dn
= talloc_asprintf(vd
, "CN=NTDS-DSA,%s",
1939 s
->forest
.schema_dn_str
);
1941 if (composite_nomem(v
[0].dn
, c
)) return;
1943 ndr_err
= ndr_push_struct_blob(&vd
[0], vd
, &v
[0],
1944 (ndr_push_flags_fn_t
)ndr_push_drsuapi_DsReplicaObjectIdentifier3
);
1945 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err
)) {
1946 c
->status
= ndr_map_error2ntstatus(ndr_err
);
1947 if (!composite_is_ok(c
)) return;
1950 vs
[0].blob
= &vd
[0];
1952 attrs
[i
].attid
= DRSUAPI_ATTID_objectCategory
;
1953 attrs
[i
].value_ctr
.num_values
= 1;
1954 attrs
[i
].value_ctr
.values
= vs
;
1959 /* invocationId: random guid */
1961 struct drsuapi_DsAttributeValue
*vs
;
1963 const struct GUID
*v
;
1965 vs
= talloc_array(attrs
, struct drsuapi_DsAttributeValue
, 1);
1966 if (composite_nomem(vs
, c
)) return;
1968 vd
= talloc_array(vs
, DATA_BLOB
, 1);
1969 if (composite_nomem(vd
, c
)) return;
1971 v
= &s
->dest_dsa
.invocation_id
;
1973 c
->status
= GUID_to_ndr_blob(v
, vd
, &vd
[0]);
1974 if (!composite_is_ok(c
)) return;
1976 vs
[0].blob
= &vd
[0];
1978 attrs
[i
].attid
= DRSUAPI_ATTID_invocationId
;
1979 attrs
[i
].value_ctr
.num_values
= 1;
1980 attrs
[i
].value_ctr
.values
= vs
;
1985 /* hasMasterNCs: ... */
1987 struct drsuapi_DsAttributeValue
*vs
;
1989 struct drsuapi_DsReplicaObjectIdentifier3 v
[3];
1991 vs
= talloc_array(attrs
, struct drsuapi_DsAttributeValue
, 3);
1992 if (composite_nomem(vs
, c
)) return;
1994 vd
= talloc_array(vs
, DATA_BLOB
, 3);
1995 if (composite_nomem(vd
, c
)) return;
1997 v
[0].guid
= GUID_zero();
1998 v
[0].sid
= s
->zero_sid
;
1999 v
[0].dn
= s
->forest
.config_dn_str
;
2001 v
[1].guid
= GUID_zero();
2002 v
[1].sid
= s
->zero_sid
;
2003 v
[1].dn
= s
->domain
.dn_str
;
2005 v
[2].guid
= GUID_zero();
2006 v
[2].sid
= s
->zero_sid
;
2007 v
[2].dn
= s
->forest
.schema_dn_str
;
2009 ndr_err
= ndr_push_struct_blob(&vd
[0], vd
, &v
[0],
2010 (ndr_push_flags_fn_t
)ndr_push_drsuapi_DsReplicaObjectIdentifier3
);
2011 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err
)) {
2012 c
->status
= ndr_map_error2ntstatus(ndr_err
);
2013 if (!composite_is_ok(c
)) return;
2016 ndr_err
= ndr_push_struct_blob(&vd
[1], vd
, &v
[1],
2017 (ndr_push_flags_fn_t
)ndr_push_drsuapi_DsReplicaObjectIdentifier3
);
2018 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err
)) {
2019 c
->status
= ndr_map_error2ntstatus(ndr_err
);
2020 if (!composite_is_ok(c
)) return;
2023 ndr_err
= ndr_push_struct_blob(&vd
[2], vd
, &v
[2],
2024 (ndr_push_flags_fn_t
)ndr_push_drsuapi_DsReplicaObjectIdentifier3
);
2025 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err
)) {
2026 c
->status
= ndr_map_error2ntstatus(ndr_err
);
2027 if (!composite_is_ok(c
)) return;
2030 vs
[0].blob
= &vd
[0];
2031 vs
[1].blob
= &vd
[1];
2032 vs
[2].blob
= &vd
[2];
2034 attrs
[i
].attid
= DRSUAPI_ATTID_hasMasterNCs
;
2035 attrs
[i
].value_ctr
.num_values
= 3;
2036 attrs
[i
].value_ctr
.values
= vs
;
2041 /* msDS-hasMasterNCs: ... */
2043 struct drsuapi_DsAttributeValue
*vs
;
2045 struct drsuapi_DsReplicaObjectIdentifier3 v
[3];
2047 vs
= talloc_array(attrs
, struct drsuapi_DsAttributeValue
, 3);
2048 if (composite_nomem(vs
, c
)) return;
2050 vd
= talloc_array(vs
, DATA_BLOB
, 3);
2051 if (composite_nomem(vd
, c
)) return;
2053 v
[0].guid
= GUID_zero();
2054 v
[0].sid
= s
->zero_sid
;
2055 v
[0].dn
= s
->forest
.config_dn_str
;
2057 v
[1].guid
= GUID_zero();
2058 v
[1].sid
= s
->zero_sid
;
2059 v
[1].dn
= s
->domain
.dn_str
;
2061 v
[2].guid
= GUID_zero();
2062 v
[2].sid
= s
->zero_sid
;
2063 v
[2].dn
= s
->forest
.schema_dn_str
;
2065 ndr_err
= ndr_push_struct_blob(&vd
[0], vd
, &v
[0],
2066 (ndr_push_flags_fn_t
)ndr_push_drsuapi_DsReplicaObjectIdentifier3
);
2067 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err
)) {
2068 c
->status
= ndr_map_error2ntstatus(ndr_err
);
2069 if (!composite_is_ok(c
)) return;
2072 ndr_err
= ndr_push_struct_blob(&vd
[1], vd
, &v
[1],
2073 (ndr_push_flags_fn_t
)ndr_push_drsuapi_DsReplicaObjectIdentifier3
);
2074 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err
)) {
2075 c
->status
= ndr_map_error2ntstatus(ndr_err
);
2076 if (!composite_is_ok(c
)) return;
2079 ndr_err
= ndr_push_struct_blob(&vd
[2], vd
, &v
[2],
2080 (ndr_push_flags_fn_t
)ndr_push_drsuapi_DsReplicaObjectIdentifier3
);
2081 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err
)) {
2082 c
->status
= ndr_map_error2ntstatus(ndr_err
);
2083 if (!composite_is_ok(c
)) return;
2086 vs
[0].blob
= &vd
[0];
2087 vs
[1].blob
= &vd
[1];
2088 vs
[2].blob
= &vd
[2];
2090 attrs
[i
].attid
= DRSUAPI_ATTID_msDS_hasMasterNCs
;
2091 attrs
[i
].value_ctr
.num_values
= 3;
2092 attrs
[i
].value_ctr
.values
= vs
;
2097 /* dMDLocation: CN=Schema,... */
2099 struct drsuapi_DsAttributeValue
*vs
;
2101 struct drsuapi_DsReplicaObjectIdentifier3 v
[1];
2103 vs
= talloc_array(attrs
, struct drsuapi_DsAttributeValue
, 1);
2104 if (composite_nomem(vs
, c
)) return;
2106 vd
= talloc_array(vs
, DATA_BLOB
, 1);
2107 if (composite_nomem(vd
, c
)) return;
2109 v
[0].guid
= GUID_zero();
2110 v
[0].sid
= s
->zero_sid
;
2111 v
[0].dn
= s
->forest
.schema_dn_str
;
2113 ndr_err
= ndr_push_struct_blob(&vd
[0], vd
, &v
[0],
2114 (ndr_push_flags_fn_t
)ndr_push_drsuapi_DsReplicaObjectIdentifier3
);
2115 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err
)) {
2116 c
->status
= ndr_map_error2ntstatus(ndr_err
);
2117 if (!composite_is_ok(c
)) return;
2120 vs
[0].blob
= &vd
[0];
2122 attrs
[i
].attid
= DRSUAPI_ATTID_dMDLocation
;
2123 attrs
[i
].value_ctr
.num_values
= 1;
2124 attrs
[i
].value_ctr
.values
= vs
;
2129 /* msDS-HasDomainNCs: <domain_partition> */
2131 struct drsuapi_DsAttributeValue
*vs
;
2133 struct drsuapi_DsReplicaObjectIdentifier3 v
[1];
2135 vs
= talloc_array(attrs
, struct drsuapi_DsAttributeValue
, 1);
2136 if (composite_nomem(vs
, c
)) return;
2138 vd
= talloc_array(vs
, DATA_BLOB
, 1);
2139 if (composite_nomem(vd
, c
)) return;
2141 v
[0].guid
= GUID_zero();
2142 v
[0].sid
= s
->zero_sid
;
2143 v
[0].dn
= s
->domain
.dn_str
;
2145 ndr_err
= ndr_push_struct_blob(&vd
[0], vd
, &v
[0],
2146 (ndr_push_flags_fn_t
)ndr_push_drsuapi_DsReplicaObjectIdentifier3
);
2147 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err
)) {
2148 c
->status
= ndr_map_error2ntstatus(ndr_err
);
2149 if (!composite_is_ok(c
)) return;
2152 vs
[0].blob
= &vd
[0];
2154 attrs
[i
].attid
= DRSUAPI_ATTID_msDS_HasDomainNCs
;
2155 attrs
[i
].value_ctr
.num_values
= 1;
2156 attrs
[i
].value_ctr
.values
= vs
;
2161 /* msDS-Behavior-Version */
2163 struct drsuapi_DsAttributeValue
*vs
;
2166 vs
= talloc_array(attrs
, struct drsuapi_DsAttributeValue
, 1);
2167 if (composite_nomem(vs
, c
)) return;
2169 vd
= talloc_array(vs
, DATA_BLOB
, 1);
2170 if (composite_nomem(vd
, c
)) return;
2172 vd
[0] = data_blob_talloc(vd
, NULL
, 4);
2173 if (composite_nomem(vd
[0].data
, c
)) return;
2175 SIVAL(vd
[0].data
, 0, get_dc_function_level(s
->libnet
->lp_ctx
));
2177 vs
[0].blob
= &vd
[0];
2179 attrs
[i
].attid
= DRSUAPI_ATTID_msDS_Behavior_Version
;
2180 attrs
[i
].value_ctr
.num_values
= 1;
2181 attrs
[i
].value_ctr
.values
= vs
;
2188 struct drsuapi_DsAttributeValue
*vs
;
2191 vs
= talloc_array(attrs
, struct drsuapi_DsAttributeValue
, 1);
2192 if (composite_nomem(vs
, c
)) return;
2194 vd
= talloc_array(vs
, DATA_BLOB
, 1);
2195 if (composite_nomem(vd
, c
)) return;
2197 vd
[0] = data_blob_talloc(vd
, NULL
, 4);
2198 if (composite_nomem(vd
[0].data
, c
)) return;
2201 SIVAL(vd
[0].data
, 0, SYSTEM_FLAG_CONFIG_ALLOW_RENAME
);
2203 SIVAL(vd
[0].data
, 0, SYSTEM_FLAG_DISALLOW_MOVE_ON_DELETE
);
2206 vs
[0].blob
= &vd
[0];
2208 attrs
[i
].attid
= DRSUAPI_ATTID_systemFlags
;
2209 attrs
[i
].value_ctr
.num_values
= 1;
2210 attrs
[i
].value_ctr
.values
= vs
;
2215 /* serverReference: ... */
2217 struct drsuapi_DsAttributeValue
*vs
;
2219 struct drsuapi_DsReplicaObjectIdentifier3 v
[1];
2221 vs
= talloc_array(attrs
, struct drsuapi_DsAttributeValue
, 1);
2222 if (composite_nomem(vs
, c
)) return;
2224 vd
= talloc_array(vs
, DATA_BLOB
, 1);
2225 if (composite_nomem(vd
, c
)) return;
2227 v
[0].guid
= GUID_zero();
2228 v
[0].sid
= s
->zero_sid
;
2229 v
[0].dn
= s
->dest_dsa
.computer_dn_str
;
2231 ndr_err
= ndr_push_struct_blob(&vd
[0], vd
, &v
[0],
2232 (ndr_push_flags_fn_t
)ndr_push_drsuapi_DsReplicaObjectIdentifier3
);
2233 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err
)) {
2234 c
->status
= ndr_map_error2ntstatus(ndr_err
);
2235 if (!composite_is_ok(c
)) return;
2238 vs
[0].blob
= &vd
[0];
2240 attrs
[i
].attid
= DRSUAPI_ATTID_serverReference
;
2241 attrs
[i
].value_ctr
.num_values
= 1;
2242 attrs
[i
].value_ctr
.values
= vs
;
2249 struct drsuapi_DsAttributeValue
*vs
;
2252 vs
= talloc_array(attrs
, struct drsuapi_DsAttributeValue
, 1);
2253 if (composite_nomem(vs
, c
)) return;
2255 vd
= talloc_array(vs
, DATA_BLOB
, 1);
2256 if (composite_nomem(vd
, c
)) return;
2258 vd
[0] = data_blob_talloc(vd
, NULL
, 4);
2259 if (composite_nomem(vd
[0].data
, c
)) return;
2261 SIVAL(vd
[0].data
, 0, DS_NTDSDSA_OPT_DISABLE_OUTBOUND_REPL
);
2263 vs
[0].blob
= &vd
[0];
2265 attrs
[i
].attid
= DRSUAPI_ATTID_options
;
2266 attrs
[i
].value_ctr
.num_values
= 1;
2267 attrs
[i
].value_ctr
.values
= vs
;
2272 /* truncate the attribute list to the attribute count we have filled in */
2275 /* setup request structure */
2276 r
->in
.bind_handle
= &s
->drsuapi1
.bind_handle
;
2278 r
->in
.req
= talloc(s
, union drsuapi_DsAddEntryRequest
);
2279 r
->in
.req
->req2
.first_object
.next_object
= NULL
;
2280 r
->in
.req
->req2
.first_object
.object
.identifier
= identifier
;
2281 r
->in
.req
->req2
.first_object
.object
.flags
= 0x00000000;
2282 r
->in
.req
->req2
.first_object
.object
.attribute_ctr
.num_attributes
= num_attrs
;
2283 r
->in
.req
->req2
.first_object
.object
.attribute_ctr
.attributes
= attrs
;
2285 r
->out
.level_out
= talloc(s
, uint32_t);
2286 r
->out
.ctr
= talloc(s
, union drsuapi_DsAddEntryCtr
);
2288 s
->ndr_struct_ptr
= r
;
2289 subreq
= dcerpc_drsuapi_DsAddEntry_r_send(s
, c
->event_ctx
,
2290 s
->drsuapi1
.drsuapi_handle
, r
);
2291 if (composite_nomem(subreq
, c
)) return;
2292 tevent_req_set_callback(subreq
, becomeDC_drsuapi1_add_entry_recv
, s
);
2295 static void becomeDC_drsuapi2_connect_recv(struct composite_context
*req
);
2296 static NTSTATUS
becomeDC_prepare_db(struct libnet_BecomeDC_state
*s
);
2298 static void becomeDC_drsuapi1_add_entry_recv(struct tevent_req
*subreq
)
2300 struct libnet_BecomeDC_state
*s
= tevent_req_callback_data(subreq
,
2301 struct libnet_BecomeDC_state
);
2302 struct composite_context
*c
= s
->creq
;
2303 struct drsuapi_DsAddEntry
*r
= talloc_get_type_abort(s
->ndr_struct_ptr
,
2304 struct drsuapi_DsAddEntry
);
2306 uint32_t assoc_group_id
;
2308 s
->ndr_struct_ptr
= NULL
;
2310 c
->status
= dcerpc_drsuapi_DsAddEntry_r_recv(subreq
, r
);
2311 TALLOC_FREE(subreq
);
2312 if (!composite_is_ok(c
)) return;
2314 if (!W_ERROR_IS_OK(r
->out
.result
)) {
2315 composite_error(c
, werror_to_ntstatus(r
->out
.result
));
2319 if (*r
->out
.level_out
== 3) {
2321 union drsuapi_DsAddEntry_ErrData
*err_data
= r
->out
.ctr
->ctr3
.err_data
;
2323 /* check for errors */
2324 status
= err_data
? err_data
->v1
.status
: WERR_OK
;
2325 if (!W_ERROR_IS_OK(status
)) {
2326 struct drsuapi_DsAddEntryErrorInfo_Attr_V1
*attr_err
;
2327 struct drsuapi_DsAddEntry_AttrErrListItem_V1
*attr_err_li
;
2328 struct drsuapi_DsAddEntryErrorInfo_Name_V1
*name_err
;
2329 struct drsuapi_DsAddEntryErrorInfo_Referr_V1
*ref_err
;
2330 struct drsuapi_DsAddEntry_RefErrListItem_V1
*ref_li
;
2332 if (r
->out
.ctr
->ctr3
.err_ver
!= 1) {
2333 composite_error(c
, NT_STATUS_INVALID_NETWORK_RESPONSE
);
2337 DEBUG(0,("DsAddEntry (R3) of '%s' failed: "
2338 "Errors: dir_err = %d, status = %s;\n",
2339 r
->in
.req
->req3
.first_object
.object
.identifier
->dn
,
2340 err_data
->v1
.dir_err
,
2341 win_errstr(err_data
->v1
.status
)));
2343 if (!err_data
->v1
.info
) {
2344 DEBUG(0, ("DsAddEntry (R3): no error info returned!\n"));
2345 composite_error(c
, werror_to_ntstatus(status
));
2349 /* dump more detailed error */
2350 switch (err_data
->v1
.dir_err
) {
2351 case DRSUAPI_DIRERR_ATTRIBUTE
:
2352 /* Dump attribute errors */
2353 attr_err
= &err_data
->v1
.info
->attr_err
;
2354 DEBUGADD(0,(" Attribute Error: object = %s, count = %d;\n",
2357 attr_err_li
= &attr_err
->first
;
2358 for (; attr_err_li
; attr_err_li
= attr_err_li
->next
) {
2359 struct drsuapi_DsAddEntry_AttrErr_V1
*err
= &attr_err_li
->err_data
;
2360 DEBUGADD(0,(" Error: err = %s, problem = 0x%08X, attid = 0x%08X;\n",
2361 win_errstr(err
->extended_err
),
2364 /* TODO: should we print attribute value here? */
2367 case DRSUAPI_DIRERR_NAME
:
2368 /* Dump Name resolution error */
2369 name_err
= &err_data
->v1
.info
->name_err
;
2370 DEBUGADD(0,(" Name Error: err = %s, problem = 0x%08X, id_matched = %s;\n",
2371 win_errstr(name_err
->extended_err
),
2373 name_err
->id_matched
->dn
));
2375 case DRSUAPI_DIRERR_REFERRAL
:
2376 /* Dump Referral errors */
2377 ref_err
= &err_data
->v1
.info
->referral_err
;
2378 DEBUGADD(0,(" Referral Error: extended_err = %s\n",
2379 win_errstr(ref_err
->extended_err
)));
2380 ref_li
= &ref_err
->refer
;
2381 for (; ref_li
; ref_li
= ref_li
->next
) {
2382 struct drsuapi_DsaAddressListItem_V1
*addr
;
2383 DEBUGADD(0,(" Referral: id_target = %s, ref_type = 0x%04X,",
2384 ref_li
->id_target
->dn
,
2386 if (ref_li
->is_choice_set
) {
2387 DEBUGADD(0,(" choice = 0x%02X, ",
2390 DEBUGADD(0,(" add_list ("));
2391 for (addr
= ref_li
->addr_list
; addr
; addr
= addr
->next
) {
2392 DEBUGADD(0,("%s", addr
->address
->string
));
2397 DEBUGADD(0,(");\n"));
2400 case DRSUAPI_DIRERR_SECURITY
:
2401 /* Dump Security error. */
2402 DEBUGADD(0,(" Security Error: extended_err = %s, problem = 0x%08X\n",
2403 win_errstr(err_data
->v1
.info
->security_err
.extended_err
),
2404 err_data
->v1
.info
->security_err
.problem
));
2406 case DRSUAPI_DIRERR_SERVICE
:
2407 /* Dump Service error. */
2408 DEBUGADD(0,(" Service Error: extended_err = %s, problem = 0x%08X\n",
2409 win_errstr(err_data
->v1
.info
->service_err
.extended_err
),
2410 err_data
->v1
.info
->service_err
.problem
));
2412 case DRSUAPI_DIRERR_UPDATE
:
2413 /* Dump Update error. */
2414 DEBUGADD(0,(" Update Error: extended_err = %s, problem = 0x%08X\n",
2415 win_errstr(err_data
->v1
.info
->update_err
.extended_err
),
2416 err_data
->v1
.info
->update_err
.problem
));
2418 case DRSUAPI_DIRERR_SYSTEM
:
2420 DEBUGADD(0,(" System Error: extended_err = %s, problem = 0x%08X\n",
2421 win_errstr(err_data
->v1
.info
->system_err
.extended_err
),
2422 err_data
->v1
.info
->system_err
.problem
));
2424 case DRSUAPI_DIRERR_OK
: /* mute compiler warnings */
2426 DEBUGADD(0,(" Unknown DIRERR error class returned!\n"));
2430 composite_error(c
, werror_to_ntstatus(status
));
2434 if (1 != r
->out
.ctr
->ctr3
.count
) {
2435 DEBUG(0,("DsAddEntry - Ctr3: something very wrong had happened - "
2436 "method succeeded but objects returned are %d (expected 1).\n",
2437 r
->out
.ctr
->ctr3
.count
));
2438 composite_error(c
, NT_STATUS_INVALID_NETWORK_RESPONSE
);
2442 s
->dest_dsa
.ntds_guid
= r
->out
.ctr
->ctr3
.objects
[0].guid
;
2444 } else if (*r
->out
.level_out
== 2) {
2445 if (DRSUAPI_DIRERR_OK
!= r
->out
.ctr
->ctr2
.dir_err
) {
2446 DEBUG(0,("DsAddEntry failed with: dir_err = %d, extended_err = %s\n",
2447 r
->out
.ctr
->ctr2
.dir_err
,
2448 win_errstr(r
->out
.ctr
->ctr2
.extended_err
)));
2449 composite_error(c
, werror_to_ntstatus(r
->out
.ctr
->ctr2
.extended_err
));
2453 if (1 != r
->out
.ctr
->ctr2
.count
) {
2454 DEBUG(0,("DsAddEntry: something very wrong had happened - "
2455 "method succeeded but objects returned are %d (expected 1). "
2456 "Errors: dir_err = %d, extended_err = %s\n",
2457 r
->out
.ctr
->ctr2
.count
,
2458 r
->out
.ctr
->ctr2
.dir_err
,
2459 win_errstr(r
->out
.ctr
->ctr2
.extended_err
)));
2460 composite_error(c
, NT_STATUS_INVALID_NETWORK_RESPONSE
);
2464 s
->dest_dsa
.ntds_guid
= r
->out
.ctr
->ctr2
.objects
[0].guid
;
2466 composite_error(c
, NT_STATUS_INVALID_NETWORK_RESPONSE
);
2472 s
->dest_dsa
.ntds_dn_str
= talloc_asprintf(s
, "CN=NTDS Settings,%s",
2473 s
->dest_dsa
.server_dn_str
);
2474 if (composite_nomem(s
->dest_dsa
.ntds_dn_str
, c
)) return;
2476 c
->status
= becomeDC_prepare_db(s
);
2477 if (!composite_is_ok(c
)) return;
2479 /* this avoids the epmapper lookup on the 2nd connection */
2480 binding_str
= dcerpc_binding_string(s
, s
->drsuapi1
.binding
);
2481 if (composite_nomem(binding_str
, c
)) return;
2483 c
->status
= dcerpc_parse_binding(s
, binding_str
, &s
->drsuapi2
.binding
);
2484 talloc_free(binding_str
);
2485 if (!composite_is_ok(c
)) return;
2487 if (DEBUGLEVEL
>= 10) {
2488 c
->status
= dcerpc_binding_set_flags(s
->drsuapi2
.binding
,
2489 DCERPC_DEBUG_PRINT_BOTH
,
2491 if (!composite_is_ok(c
)) return;
2494 /* w2k3 uses the same assoc_group_id as on the first connection, so we do */
2495 assoc_group_id
= dcerpc_binding_get_assoc_group_id(s
->drsuapi1
.pipe
->binding
);
2496 c
->status
= dcerpc_binding_set_assoc_group_id(s
->drsuapi2
.binding
, assoc_group_id
);
2497 if (!composite_is_ok(c
)) return;
2499 becomeDC_drsuapi_connect_send(s
, &s
->drsuapi2
, becomeDC_drsuapi2_connect_recv
);
2502 static NTSTATUS
becomeDC_prepare_db(struct libnet_BecomeDC_state
*s
)
2504 if (!s
->callbacks
.prepare_db
) return NT_STATUS_OK
;
2506 s
->_pp
.domain
= &s
->domain
;
2507 s
->_pp
.forest
= &s
->forest
;
2508 s
->_pp
.source_dsa
= &s
->source_dsa
;
2509 s
->_pp
.dest_dsa
= &s
->dest_dsa
;
2511 return s
->callbacks
.prepare_db(s
->callbacks
.private_data
, &s
->_pp
);
2514 static void becomeDC_drsuapi2_bind_recv(struct tevent_req
*subreq
);
2516 static void becomeDC_drsuapi2_connect_recv(struct composite_context
*req
)
2518 struct libnet_BecomeDC_state
*s
= talloc_get_type(req
->async
.private_data
,
2519 struct libnet_BecomeDC_state
);
2520 struct composite_context
*c
= s
->creq
;
2522 c
->status
= dcerpc_pipe_connect_b_recv(req
, s
, &s
->drsuapi2
.pipe
);
2523 if (!composite_is_ok(c
)) return;
2525 s
->drsuapi2
.drsuapi_handle
= s
->drsuapi2
.pipe
->binding_handle
;
2527 c
->status
= gensec_session_key(s
->drsuapi2
.pipe
->conn
->security_state
.generic_state
,
2529 &s
->drsuapi2
.gensec_skey
);
2530 if (!composite_is_ok(c
)) return;
2532 becomeDC_drsuapi_bind_send(s
, &s
->drsuapi2
, becomeDC_drsuapi2_bind_recv
);
2535 static void becomeDC_drsuapi3_connect_recv(struct composite_context
*req
);
2537 static void becomeDC_drsuapi2_bind_recv(struct tevent_req
*subreq
)
2539 struct libnet_BecomeDC_state
*s
= tevent_req_callback_data(subreq
,
2540 struct libnet_BecomeDC_state
);
2541 struct composite_context
*c
= s
->creq
;
2543 uint32_t assoc_group_id
;
2546 c
->status
= dcerpc_drsuapi_DsBind_r_recv(subreq
, s
);
2547 TALLOC_FREE(subreq
);
2548 if (!composite_is_ok(c
)) return;
2550 status
= becomeDC_drsuapi_bind_recv(s
, &s
->drsuapi2
);
2551 if (!W_ERROR_IS_OK(status
)) {
2552 composite_error(c
, werror_to_ntstatus(status
));
2556 /* this avoids the epmapper lookup on the 3rd connection */
2557 binding_str
= dcerpc_binding_string(s
, s
->drsuapi1
.binding
);
2558 if (composite_nomem(binding_str
, c
)) return;
2560 c
->status
= dcerpc_parse_binding(s
, binding_str
, &s
->drsuapi3
.binding
);
2561 talloc_free(binding_str
);
2562 if (!composite_is_ok(c
)) return;
2564 if (DEBUGLEVEL
>= 10) {
2565 c
->status
= dcerpc_binding_set_flags(s
->drsuapi3
.binding
,
2566 DCERPC_DEBUG_PRINT_BOTH
,
2568 if (!composite_is_ok(c
)) return;
2571 /* w2k3 uses the same assoc_group_id as on the first connection, so we do */
2572 assoc_group_id
= dcerpc_binding_get_assoc_group_id(s
->drsuapi1
.pipe
->binding
);
2573 c
->status
= dcerpc_binding_set_assoc_group_id(s
->drsuapi3
.binding
, assoc_group_id
);
2574 if (!composite_is_ok(c
)) return;
2575 /* w2k3 uses the concurrent multiplex feature on the 3rd connection, so we do */
2576 c
->status
= dcerpc_binding_set_flags(s
->drsuapi3
.binding
,
2577 DCERPC_CONCURRENT_MULTIPLEX
,
2579 if (!composite_is_ok(c
)) return;
2581 becomeDC_drsuapi_connect_send(s
, &s
->drsuapi3
, becomeDC_drsuapi3_connect_recv
);
2584 static void becomeDC_drsuapi3_pull_schema_send(struct libnet_BecomeDC_state
*s
);
2586 static void becomeDC_drsuapi3_connect_recv(struct composite_context
*req
)
2588 struct libnet_BecomeDC_state
*s
= talloc_get_type(req
->async
.private_data
,
2589 struct libnet_BecomeDC_state
);
2590 struct composite_context
*c
= s
->creq
;
2592 c
->status
= dcerpc_pipe_connect_b_recv(req
, s
, &s
->drsuapi3
.pipe
);
2593 if (!composite_is_ok(c
)) return;
2595 s
->drsuapi3
.drsuapi_handle
= s
->drsuapi3
.pipe
->binding_handle
;
2597 c
->status
= gensec_session_key(s
->drsuapi3
.pipe
->conn
->security_state
.generic_state
,
2599 &s
->drsuapi3
.gensec_skey
);
2600 if (!composite_is_ok(c
)) return;
2602 becomeDC_drsuapi3_pull_schema_send(s
);
2605 static void becomeDC_drsuapi_pull_partition_send(struct libnet_BecomeDC_state
*s
,
2606 struct becomeDC_drsuapi
*drsuapi_h
,
2607 struct becomeDC_drsuapi
*drsuapi_p
,
2608 struct libnet_BecomeDC_Partition
*partition
,
2609 void (*recv_fn
)(struct tevent_req
*subreq
))
2611 struct composite_context
*c
= s
->creq
;
2612 struct drsuapi_DsGetNCChanges
*r
;
2613 struct tevent_req
*subreq
;
2615 r
= talloc(s
, struct drsuapi_DsGetNCChanges
);
2616 if (composite_nomem(r
, c
)) return;
2618 r
->out
.level_out
= talloc(r
, uint32_t);
2619 if (composite_nomem(r
->out
.level_out
, c
)) return;
2620 r
->in
.req
= talloc(r
, union drsuapi_DsGetNCChangesRequest
);
2621 if (composite_nomem(r
->in
.req
, c
)) return;
2622 r
->out
.ctr
= talloc(r
, union drsuapi_DsGetNCChangesCtr
);
2623 if (composite_nomem(r
->out
.ctr
, c
)) return;
2625 r
->in
.bind_handle
= &drsuapi_h
->bind_handle
;
2626 if (drsuapi_h
->remote_info28
.supported_extensions
& DRSUAPI_SUPPORTED_EXTENSION_GETCHGREQ_V8
) {
2628 r
->in
.req
->req8
.destination_dsa_guid
= partition
->destination_dsa_guid
;
2629 r
->in
.req
->req8
.source_dsa_invocation_id
= partition
->source_dsa_invocation_id
;
2630 r
->in
.req
->req8
.naming_context
= &partition
->nc
;
2631 r
->in
.req
->req8
.highwatermark
= partition
->highwatermark
;
2632 r
->in
.req
->req8
.uptodateness_vector
= NULL
;
2633 r
->in
.req
->req8
.replica_flags
= partition
->replica_flags
;
2634 r
->in
.req
->req8
.max_object_count
= 133;
2635 r
->in
.req
->req8
.max_ndr_size
= 1336811;
2636 r
->in
.req
->req8
.extended_op
= DRSUAPI_EXOP_NONE
;
2637 r
->in
.req
->req8
.fsmo_info
= 0;
2638 r
->in
.req
->req8
.partial_attribute_set
= NULL
;
2639 r
->in
.req
->req8
.partial_attribute_set_ex
= NULL
;
2640 r
->in
.req
->req8
.mapping_ctr
.num_mappings
= 0;
2641 r
->in
.req
->req8
.mapping_ctr
.mappings
= NULL
;
2644 r
->in
.req
->req5
.destination_dsa_guid
= partition
->destination_dsa_guid
;
2645 r
->in
.req
->req5
.source_dsa_invocation_id
= partition
->source_dsa_invocation_id
;
2646 r
->in
.req
->req5
.naming_context
= &partition
->nc
;
2647 r
->in
.req
->req5
.highwatermark
= partition
->highwatermark
;
2648 r
->in
.req
->req5
.uptodateness_vector
= NULL
;
2649 r
->in
.req
->req5
.replica_flags
= partition
->replica_flags
;
2650 r
->in
.req
->req5
.max_object_count
= 133;
2651 r
->in
.req
->req5
.max_ndr_size
= 1336770;
2652 r
->in
.req
->req5
.extended_op
= DRSUAPI_EXOP_NONE
;
2653 r
->in
.req
->req5
.fsmo_info
= 0;
2657 * we should try to use the drsuapi_p->pipe here, as w2k3 does
2658 * but it seems that some extra flags in the DCERPC Bind call
2659 * are needed for it. Or the same KRB5 TGS is needed on both
2662 s
->ndr_struct_ptr
= r
;
2663 subreq
= dcerpc_drsuapi_DsGetNCChanges_r_send(s
, c
->event_ctx
,
2664 drsuapi_p
->drsuapi_handle
,
2666 if (composite_nomem(subreq
, c
)) return;
2667 tevent_req_set_callback(subreq
, recv_fn
, s
);
2670 static WERROR
becomeDC_drsuapi_pull_partition_recv(struct libnet_BecomeDC_state
*s
,
2671 struct becomeDC_drsuapi
*drsuapi_h
,
2672 struct becomeDC_drsuapi
*drsuapi_p
,
2673 struct libnet_BecomeDC_Partition
*partition
,
2674 struct drsuapi_DsGetNCChanges
*r
)
2676 uint32_t req_level
= r
->in
.level
;
2677 struct drsuapi_DsGetNCChangesRequest5
*req5
= NULL
;
2678 struct drsuapi_DsGetNCChangesRequest8
*req8
= NULL
;
2679 struct drsuapi_DsGetNCChangesRequest10
*req10
= NULL
;
2680 uint32_t ctr_level
= 0;
2681 struct drsuapi_DsGetNCChangesCtr1
*ctr1
= NULL
;
2682 struct drsuapi_DsGetNCChangesCtr6
*ctr6
= NULL
;
2683 struct GUID
*source_dsa_guid
= NULL
;
2684 struct GUID
*source_dsa_invocation_id
= NULL
;
2685 struct drsuapi_DsReplicaHighWaterMark
*new_highwatermark
= NULL
;
2686 bool more_data
= false;
2689 if (!W_ERROR_IS_OK(r
->out
.result
)) {
2690 return r
->out
.result
;
2693 switch (r
->in
.level
) {
2698 req5
= &r
->in
.req
->req5
;
2701 req8
= &r
->in
.req
->req8
;
2704 req10
= &r
->in
.req
->req10
;
2707 return WERR_INVALID_PARAMETER
;
2710 if (*r
->out
.level_out
== 1) {
2712 ctr1
= &r
->out
.ctr
->ctr1
;
2713 } else if (*r
->out
.level_out
== 2 &&
2714 r
->out
.ctr
->ctr2
.mszip1
.ts
) {
2716 ctr1
= &r
->out
.ctr
->ctr2
.mszip1
.ts
->ctr1
;
2717 } else if (*r
->out
.level_out
== 6) {
2719 ctr6
= &r
->out
.ctr
->ctr6
;
2720 } else if (*r
->out
.level_out
== 7 &&
2721 r
->out
.ctr
->ctr7
.level
== 6 &&
2722 r
->out
.ctr
->ctr7
.type
== DRSUAPI_COMPRESSION_TYPE_MSZIP
&&
2723 r
->out
.ctr
->ctr7
.ctr
.mszip6
.ts
) {
2725 ctr6
= &r
->out
.ctr
->ctr7
.ctr
.mszip6
.ts
->ctr6
;
2726 } else if (*r
->out
.level_out
== 7 &&
2727 r
->out
.ctr
->ctr7
.level
== 6 &&
2728 r
->out
.ctr
->ctr7
.type
== DRSUAPI_COMPRESSION_TYPE_WIN2K3_LZ77_DIRECT2
&&
2729 r
->out
.ctr
->ctr7
.ctr
.xpress6
.ts
) {
2731 ctr6
= &r
->out
.ctr
->ctr7
.ctr
.xpress6
.ts
->ctr6
;
2733 return WERR_BAD_NET_RESP
;
2736 if (!ctr1
&& ! ctr6
) {
2737 return WERR_BAD_NET_RESP
;
2740 if (ctr_level
== 6) {
2741 if (!W_ERROR_IS_OK(ctr6
->drs_error
)) {
2742 return ctr6
->drs_error
;
2746 switch (ctr_level
) {
2748 source_dsa_guid
= &ctr1
->source_dsa_guid
;
2749 source_dsa_invocation_id
= &ctr1
->source_dsa_invocation_id
;
2750 new_highwatermark
= &ctr1
->new_highwatermark
;
2751 more_data
= ctr1
->more_data
;
2754 source_dsa_guid
= &ctr6
->source_dsa_guid
;
2755 source_dsa_invocation_id
= &ctr6
->source_dsa_invocation_id
;
2756 new_highwatermark
= &ctr6
->new_highwatermark
;
2757 more_data
= ctr6
->more_data
;
2761 partition
->highwatermark
= *new_highwatermark
;
2762 partition
->source_dsa_guid
= *source_dsa_guid
;
2763 partition
->source_dsa_invocation_id
= *source_dsa_invocation_id
;
2764 partition
->more_data
= more_data
;
2766 if (!partition
->store_chunk
) return WERR_OK
;
2768 s
->_sc
.domain
= &s
->domain
;
2769 s
->_sc
.forest
= &s
->forest
;
2770 s
->_sc
.source_dsa
= &s
->source_dsa
;
2771 s
->_sc
.dest_dsa
= &s
->dest_dsa
;
2772 s
->_sc
.partition
= partition
;
2773 s
->_sc
.req_level
= req_level
;
2776 s
->_sc
.req10
= req10
;
2777 s
->_sc
.ctr_level
= ctr_level
;
2781 * we need to use the drsuapi_p->gensec_skey here,
2782 * when we use drsuapi_p->pipe in the for this request
2784 s
->_sc
.gensec_skey
= &drsuapi_p
->gensec_skey
;
2786 werr
= partition
->store_chunk(s
->callbacks
.private_data
, &s
->_sc
);
2787 if (!W_ERROR_IS_OK(werr
)) {
2794 static void becomeDC_drsuapi3_pull_schema_recv(struct tevent_req
*subreq
);
2796 static void becomeDC_drsuapi3_pull_schema_send(struct libnet_BecomeDC_state
*s
)
2798 s
->schema_part
.nc
.guid
= GUID_zero();
2799 s
->schema_part
.nc
.sid
= s
->zero_sid
;
2800 s
->schema_part
.nc
.dn
= s
->forest
.schema_dn_str
;
2802 s
->schema_part
.destination_dsa_guid
= s
->drsuapi2
.bind_guid
;
2804 s
->schema_part
.replica_flags
= DRSUAPI_DRS_WRIT_REP
2805 | DRSUAPI_DRS_INIT_SYNC
2806 | DRSUAPI_DRS_PER_SYNC
2807 | DRSUAPI_DRS_FULL_SYNC_IN_PROGRESS
2808 | DRSUAPI_DRS_NEVER_SYNCED
2809 | DRSUAPI_DRS_USE_COMPRESSION
2810 | DRSUAPI_DRS_GET_ANC
;
2812 s
->schema_part
.replica_flags
&= ~DRSUAPI_DRS_WRIT_REP
;
2815 s
->schema_part
.store_chunk
= s
->callbacks
.schema_chunk
;
2817 becomeDC_drsuapi_pull_partition_send(s
, &s
->drsuapi2
, &s
->drsuapi3
, &s
->schema_part
,
2818 becomeDC_drsuapi3_pull_schema_recv
);
2821 static void becomeDC_drsuapi3_pull_config_send(struct libnet_BecomeDC_state
*s
);
2823 static void becomeDC_drsuapi3_pull_schema_recv(struct tevent_req
*subreq
)
2825 struct libnet_BecomeDC_state
*s
= tevent_req_callback_data(subreq
,
2826 struct libnet_BecomeDC_state
);
2827 struct composite_context
*c
= s
->creq
;
2828 struct drsuapi_DsGetNCChanges
*r
= talloc_get_type_abort(s
->ndr_struct_ptr
,
2829 struct drsuapi_DsGetNCChanges
);
2832 s
->ndr_struct_ptr
= NULL
;
2834 c
->status
= dcerpc_drsuapi_DsGetNCChanges_r_recv(subreq
, r
);
2835 TALLOC_FREE(subreq
);
2836 if (!composite_is_ok(c
)) return;
2838 status
= becomeDC_drsuapi_pull_partition_recv(s
, &s
->drsuapi2
, &s
->drsuapi3
, &s
->schema_part
, r
);
2839 if (!W_ERROR_IS_OK(status
)) {
2840 composite_error(c
, werror_to_ntstatus(status
));
2846 if (s
->schema_part
.more_data
) {
2847 becomeDC_drsuapi_pull_partition_send(s
, &s
->drsuapi2
, &s
->drsuapi3
, &s
->schema_part
,
2848 becomeDC_drsuapi3_pull_schema_recv
);
2852 becomeDC_drsuapi3_pull_config_send(s
);
2855 static void becomeDC_drsuapi3_pull_config_recv(struct tevent_req
*subreq
);
2857 static void becomeDC_drsuapi3_pull_config_send(struct libnet_BecomeDC_state
*s
)
2859 s
->config_part
.nc
.guid
= GUID_zero();
2860 s
->config_part
.nc
.sid
= s
->zero_sid
;
2861 s
->config_part
.nc
.dn
= s
->forest
.config_dn_str
;
2863 s
->config_part
.destination_dsa_guid
= s
->drsuapi2
.bind_guid
;
2865 s
->config_part
.replica_flags
= DRSUAPI_DRS_WRIT_REP
2866 | DRSUAPI_DRS_INIT_SYNC
2867 | DRSUAPI_DRS_PER_SYNC
2868 | DRSUAPI_DRS_FULL_SYNC_IN_PROGRESS
2869 | DRSUAPI_DRS_NEVER_SYNCED
2870 | DRSUAPI_DRS_USE_COMPRESSION
2871 | DRSUAPI_DRS_GET_ANC
;
2873 s
->schema_part
.replica_flags
&= ~DRSUAPI_DRS_WRIT_REP
;
2876 s
->config_part
.store_chunk
= s
->callbacks
.config_chunk
;
2878 becomeDC_drsuapi_pull_partition_send(s
, &s
->drsuapi2
, &s
->drsuapi3
, &s
->config_part
,
2879 becomeDC_drsuapi3_pull_config_recv
);
2882 static void becomeDC_drsuapi3_pull_config_recv(struct tevent_req
*subreq
)
2884 struct libnet_BecomeDC_state
*s
= tevent_req_callback_data(subreq
,
2885 struct libnet_BecomeDC_state
);
2886 struct composite_context
*c
= s
->creq
;
2887 struct drsuapi_DsGetNCChanges
*r
= talloc_get_type_abort(s
->ndr_struct_ptr
,
2888 struct drsuapi_DsGetNCChanges
);
2891 s
->ndr_struct_ptr
= NULL
;
2893 c
->status
= dcerpc_drsuapi_DsGetNCChanges_r_recv(subreq
, r
);
2894 TALLOC_FREE(subreq
);
2895 if (!composite_is_ok(c
)) return;
2897 status
= becomeDC_drsuapi_pull_partition_recv(s
, &s
->drsuapi2
, &s
->drsuapi3
, &s
->config_part
, r
);
2898 if (!W_ERROR_IS_OK(status
)) {
2899 composite_error(c
, werror_to_ntstatus(status
));
2905 if (s
->config_part
.more_data
) {
2906 becomeDC_drsuapi_pull_partition_send(s
, &s
->drsuapi2
, &s
->drsuapi3
, &s
->config_part
,
2907 becomeDC_drsuapi3_pull_config_recv
);
2911 becomeDC_connect_ldap2(s
);
2914 static void becomeDC_drsuapi3_pull_domain_recv(struct tevent_req
*subreq
);
2916 static void becomeDC_drsuapi3_pull_domain_send(struct libnet_BecomeDC_state
*s
)
2918 s
->domain_part
.nc
.guid
= GUID_zero();
2919 s
->domain_part
.nc
.sid
= s
->zero_sid
;
2920 s
->domain_part
.nc
.dn
= s
->domain
.dn_str
;
2922 s
->domain_part
.destination_dsa_guid
= s
->drsuapi2
.bind_guid
;
2924 s
->domain_part
.replica_flags
= DRSUAPI_DRS_WRIT_REP
2925 | DRSUAPI_DRS_INIT_SYNC
2926 | DRSUAPI_DRS_PER_SYNC
2927 | DRSUAPI_DRS_FULL_SYNC_IN_PROGRESS
2928 | DRSUAPI_DRS_NEVER_SYNCED
2929 | DRSUAPI_DRS_USE_COMPRESSION
2930 | DRSUAPI_DRS_GET_ANC
;
2931 if (s
->critical_only
) {
2932 s
->domain_part
.replica_flags
|= DRSUAPI_DRS_CRITICAL_ONLY
;
2935 s
->schema_part
.replica_flags
&= ~DRSUAPI_DRS_WRIT_REP
;
2938 s
->domain_part
.store_chunk
= s
->callbacks
.domain_chunk
;
2940 becomeDC_drsuapi_pull_partition_send(s
, &s
->drsuapi2
, &s
->drsuapi3
, &s
->domain_part
,
2941 becomeDC_drsuapi3_pull_domain_recv
);
2944 static void becomeDC_drsuapi_update_refs_send(struct libnet_BecomeDC_state
*s
,
2945 struct becomeDC_drsuapi
*drsuapi
,
2946 struct libnet_BecomeDC_Partition
*partition
,
2947 void (*recv_fn
)(struct tevent_req
*subreq
));
2948 static void becomeDC_drsuapi2_update_refs_schema_recv(struct tevent_req
*subreq
);
2950 static void becomeDC_drsuapi3_pull_domain_recv(struct tevent_req
*subreq
)
2952 struct libnet_BecomeDC_state
*s
= tevent_req_callback_data(subreq
,
2953 struct libnet_BecomeDC_state
);
2954 struct composite_context
*c
= s
->creq
;
2955 struct drsuapi_DsGetNCChanges
*r
= talloc_get_type_abort(s
->ndr_struct_ptr
,
2956 struct drsuapi_DsGetNCChanges
);
2959 s
->ndr_struct_ptr
= NULL
;
2961 c
->status
= dcerpc_drsuapi_DsGetNCChanges_r_recv(subreq
, r
);
2962 TALLOC_FREE(subreq
);
2963 if (!composite_is_ok(c
)) return;
2965 status
= becomeDC_drsuapi_pull_partition_recv(s
, &s
->drsuapi2
, &s
->drsuapi3
, &s
->domain_part
, r
);
2966 if (!W_ERROR_IS_OK(status
)) {
2967 composite_error(c
, werror_to_ntstatus(status
));
2973 if (s
->domain_part
.more_data
) {
2974 becomeDC_drsuapi_pull_partition_send(s
, &s
->drsuapi2
, &s
->drsuapi3
, &s
->domain_part
,
2975 becomeDC_drsuapi3_pull_domain_recv
);
2979 if (s
->critical_only
) {
2980 /* Remove the critical and ANC */
2981 s
->domain_part
.replica_flags
^= DRSUAPI_DRS_CRITICAL_ONLY
| DRSUAPI_DRS_GET_ANC
;
2982 s
->critical_only
= false;
2983 becomeDC_drsuapi_pull_partition_send(s
, &s
->drsuapi2
, &s
->drsuapi3
, &s
->domain_part
,
2984 becomeDC_drsuapi3_pull_domain_recv
);
2987 becomeDC_drsuapi_update_refs_send(s
, &s
->drsuapi2
, &s
->schema_part
,
2988 becomeDC_drsuapi2_update_refs_schema_recv
);
2991 static void becomeDC_drsuapi_update_refs_send(struct libnet_BecomeDC_state
*s
,
2992 struct becomeDC_drsuapi
*drsuapi
,
2993 struct libnet_BecomeDC_Partition
*partition
,
2994 void (*recv_fn
)(struct tevent_req
*subreq
))
2996 struct composite_context
*c
= s
->creq
;
2997 struct drsuapi_DsReplicaUpdateRefs
*r
;
2998 const char *ntds_guid_str
;
2999 const char *ntds_dns_name
;
3000 struct tevent_req
*subreq
;
3002 r
= talloc(s
, struct drsuapi_DsReplicaUpdateRefs
);
3003 if (composite_nomem(r
, c
)) return;
3005 ntds_guid_str
= GUID_string(r
, &s
->dest_dsa
.ntds_guid
);
3006 if (composite_nomem(ntds_guid_str
, c
)) return;
3008 ntds_dns_name
= talloc_asprintf(r
, "%s._msdcs.%s",
3010 s
->forest
.dns_name
);
3011 if (composite_nomem(ntds_dns_name
, c
)) return;
3013 r
->in
.bind_handle
= &drsuapi
->bind_handle
;
3015 r
->in
.req
.req1
.naming_context
= &partition
->nc
;
3016 r
->in
.req
.req1
.dest_dsa_dns_name
= ntds_dns_name
;
3017 r
->in
.req
.req1
.dest_dsa_guid
= s
->dest_dsa
.ntds_guid
;
3018 r
->in
.req
.req1
.options
= DRSUAPI_DRS_ADD_REF
| DRSUAPI_DRS_DEL_REF
;
3020 /* I think this is how we mark ourselves as a RODC */
3021 if (!lpcfg_parm_bool(s
->libnet
->lp_ctx
, NULL
, "repl", "RODC", false)) {
3022 r
->in
.req
.req1
.options
|= DRSUAPI_DRS_WRIT_REP
;
3025 s
->ndr_struct_ptr
= r
;
3026 subreq
= dcerpc_drsuapi_DsReplicaUpdateRefs_r_send(s
, c
->event_ctx
,
3027 drsuapi
->drsuapi_handle
,
3029 if (composite_nomem(subreq
, c
)) return;
3030 tevent_req_set_callback(subreq
, recv_fn
, s
);
3033 static void becomeDC_drsuapi2_update_refs_config_recv(struct tevent_req
*subreq
);
3035 static void becomeDC_drsuapi2_update_refs_schema_recv(struct tevent_req
*subreq
)
3037 struct libnet_BecomeDC_state
*s
= tevent_req_callback_data(subreq
,
3038 struct libnet_BecomeDC_state
);
3039 struct composite_context
*c
= s
->creq
;
3040 struct drsuapi_DsReplicaUpdateRefs
*r
= talloc_get_type_abort(s
->ndr_struct_ptr
,
3041 struct drsuapi_DsReplicaUpdateRefs
);
3043 s
->ndr_struct_ptr
= NULL
;
3045 c
->status
= dcerpc_drsuapi_DsReplicaUpdateRefs_r_recv(subreq
, r
);
3046 TALLOC_FREE(subreq
);
3047 if (!composite_is_ok(c
)) return;
3049 if (!W_ERROR_IS_OK(r
->out
.result
)) {
3050 composite_error(c
, werror_to_ntstatus(r
->out
.result
));
3056 becomeDC_drsuapi_update_refs_send(s
, &s
->drsuapi2
, &s
->config_part
,
3057 becomeDC_drsuapi2_update_refs_config_recv
);
3060 static void becomeDC_drsuapi2_update_refs_domain_recv(struct tevent_req
*subreq
);
3062 static void becomeDC_drsuapi2_update_refs_config_recv(struct tevent_req
*subreq
)
3064 struct libnet_BecomeDC_state
*s
= tevent_req_callback_data(subreq
,
3065 struct libnet_BecomeDC_state
);
3066 struct composite_context
*c
= s
->creq
;
3067 struct drsuapi_DsReplicaUpdateRefs
*r
= talloc_get_type(s
->ndr_struct_ptr
,
3068 struct drsuapi_DsReplicaUpdateRefs
);
3070 s
->ndr_struct_ptr
= NULL
;
3072 c
->status
= dcerpc_drsuapi_DsReplicaUpdateRefs_r_recv(subreq
, r
);
3073 TALLOC_FREE(subreq
);
3074 if (!composite_is_ok(c
)) return;
3076 if (!W_ERROR_IS_OK(r
->out
.result
)) {
3077 composite_error(c
, werror_to_ntstatus(r
->out
.result
));
3083 becomeDC_drsuapi_update_refs_send(s
, &s
->drsuapi2
, &s
->domain_part
,
3084 becomeDC_drsuapi2_update_refs_domain_recv
);
3087 static void becomeDC_drsuapi2_update_refs_domain_recv(struct tevent_req
*subreq
)
3089 struct libnet_BecomeDC_state
*s
= tevent_req_callback_data(subreq
,
3090 struct libnet_BecomeDC_state
);
3091 struct composite_context
*c
= s
->creq
;
3092 struct drsuapi_DsReplicaUpdateRefs
*r
= talloc_get_type(s
->ndr_struct_ptr
,
3093 struct drsuapi_DsReplicaUpdateRefs
);
3095 s
->ndr_struct_ptr
= NULL
;
3097 c
->status
= dcerpc_drsuapi_DsReplicaUpdateRefs_r_recv(subreq
, r
);
3098 TALLOC_FREE(subreq
);
3099 if (!composite_is_ok(c
)) return;
3101 if (!W_ERROR_IS_OK(r
->out
.result
)) {
3102 composite_error(c
, werror_to_ntstatus(r
->out
.result
));
3108 /* TODO: use DDNS updates and register dns names */
3112 static NTSTATUS
becomeDC_ldap2_modify_computer(struct libnet_BecomeDC_state
*s
)
3115 struct ldb_message
*msg
;
3117 uint32_t user_account_control
= UF_SERVER_TRUST_ACCOUNT
|
3118 UF_TRUSTED_FOR_DELEGATION
;
3120 /* as the value is already as we want it to be, we're done */
3121 if (s
->dest_dsa
.user_account_control
== user_account_control
) {
3122 return NT_STATUS_OK
;
3125 /* make a 'modify' msg, and only for serverReference */
3126 msg
= ldb_msg_new(s
);
3127 NT_STATUS_HAVE_NO_MEMORY(msg
);
3128 msg
->dn
= ldb_dn_new(msg
, s
->ldap2
.ldb
, s
->dest_dsa
.computer_dn_str
);
3129 NT_STATUS_HAVE_NO_MEMORY(msg
->dn
);
3131 ret
= samdb_msg_add_uint(s
->ldap2
.ldb
, msg
, msg
, "userAccountControl",
3132 user_account_control
);
3133 if (ret
!= LDB_SUCCESS
) {
3135 return NT_STATUS_NO_MEMORY
;
3138 /* mark all the message elements (should be just one)
3139 as LDB_FLAG_MOD_REPLACE */
3140 for (i
=0;i
<msg
->num_elements
;i
++) {
3141 msg
->elements
[i
].flags
= LDB_FLAG_MOD_REPLACE
;
3144 ret
= ldb_modify(s
->ldap2
.ldb
, msg
);
3146 if (ret
!= LDB_SUCCESS
) {
3147 return NT_STATUS_LDAP(ret
);
3150 s
->dest_dsa
.user_account_control
= user_account_control
;
3152 return NT_STATUS_OK
;
3155 static NTSTATUS
becomeDC_ldap2_move_computer(struct libnet_BecomeDC_state
*s
)
3158 struct ldb_dn
*old_dn
;
3159 struct ldb_dn
*new_dn
;
3161 ret
= dsdb_wellknown_dn(s
->ldap2
.ldb
, s
,
3162 ldb_get_default_basedn(s
->ldap2
.ldb
),
3163 DS_GUID_DOMAIN_CONTROLLERS_CONTAINER
,
3165 if (ret
!= LDB_SUCCESS
) {
3166 return NT_STATUS_LDAP(ret
);
3169 if (!ldb_dn_add_child_fmt(new_dn
, "CN=%s", s
->dest_dsa
.netbios_name
)) {
3170 talloc_free(new_dn
);
3171 return NT_STATUS_NO_MEMORY
;
3174 old_dn
= ldb_dn_new(new_dn
, s
->ldap2
.ldb
, s
->dest_dsa
.computer_dn_str
);
3175 NT_STATUS_HAVE_NO_MEMORY(old_dn
);
3177 if (ldb_dn_compare(old_dn
, new_dn
) == 0) {
3178 /* we don't need to rename if the old and new dn match */
3179 talloc_free(new_dn
);
3180 return NT_STATUS_OK
;
3183 ret
= ldb_rename(s
->ldap2
.ldb
, old_dn
, new_dn
);
3184 if (ret
!= LDB_SUCCESS
) {
3185 talloc_free(new_dn
);
3186 return NT_STATUS_LDAP(ret
);
3189 s
->dest_dsa
.computer_dn_str
= ldb_dn_alloc_linearized(s
, new_dn
);
3190 NT_STATUS_HAVE_NO_MEMORY(s
->dest_dsa
.computer_dn_str
);
3192 talloc_free(new_dn
);
3194 return NT_STATUS_OK
;
3197 static void becomeDC_connect_ldap2(struct libnet_BecomeDC_state
*s
)
3199 struct composite_context
*c
= s
->creq
;
3201 c
->status
= becomeDC_ldap_connect(s
, &s
->ldap2
);
3202 if (!composite_is_ok(c
)) return;
3204 c
->status
= becomeDC_ldap2_modify_computer(s
);
3205 if (!composite_is_ok(c
)) return;
3207 c
->status
= becomeDC_ldap2_move_computer(s
);
3208 if (!composite_is_ok(c
)) return;
3210 s
->critical_only
= true;
3211 becomeDC_drsuapi3_pull_domain_send(s
);
3214 struct composite_context
*libnet_BecomeDC_send(struct libnet_context
*ctx
, TALLOC_CTX
*mem_ctx
, struct libnet_BecomeDC
*r
)
3216 struct composite_context
*c
;
3217 struct libnet_BecomeDC_state
*s
;
3220 c
= composite_create(mem_ctx
, ctx
->event_ctx
);
3221 if (c
== NULL
) return NULL
;
3223 s
= talloc_zero(c
, struct libnet_BecomeDC_state
);
3224 if (composite_nomem(s
, c
)) return c
;
3225 c
->private_data
= s
;
3230 s
->domain
.dns_name
= talloc_strdup(s
, r
->in
.domain_dns_name
);
3231 if (composite_nomem(s
->domain
.dns_name
, c
)) return c
;
3232 s
->domain
.netbios_name
= talloc_strdup(s
, r
->in
.domain_netbios_name
);
3233 if (composite_nomem(s
->domain
.netbios_name
, c
)) return c
;
3234 s
->domain
.sid
= dom_sid_dup(s
, r
->in
.domain_sid
);
3235 if (composite_nomem(s
->domain
.sid
, c
)) return c
;
3237 /* Source DSA input */
3238 s
->source_dsa
.address
= talloc_strdup(s
, r
->in
.source_dsa_address
);
3239 if (composite_nomem(s
->source_dsa
.address
, c
)) return c
;
3241 /* Destination DSA input */
3242 s
->dest_dsa
.netbios_name
= talloc_strdup(s
, r
->in
.dest_dsa_netbios_name
);
3243 if (composite_nomem(s
->dest_dsa
.netbios_name
, c
)) return c
;
3245 /* Destination DSA dns_name construction */
3246 tmp_name
= strlower_talloc(s
, s
->dest_dsa
.netbios_name
);
3247 if (composite_nomem(tmp_name
, c
)) return c
;
3248 tmp_name
= talloc_asprintf_append_buffer(tmp_name
, ".%s",s
->domain
.dns_name
);
3249 if (composite_nomem(tmp_name
, c
)) return c
;
3250 s
->dest_dsa
.dns_name
= tmp_name
;
3252 /* Callback function pointers */
3253 s
->callbacks
= r
->in
.callbacks
;
3256 s
->rodc_join
= r
->in
.rodc_join
;
3258 becomeDC_send_cldap(s
);
3262 NTSTATUS
libnet_BecomeDC_recv(struct composite_context
*c
, TALLOC_CTX
*mem_ctx
, struct libnet_BecomeDC
*r
)
3266 status
= composite_wait(c
);
3268 ZERO_STRUCT(r
->out
);
3274 NTSTATUS
libnet_BecomeDC(struct libnet_context
*ctx
, TALLOC_CTX
*mem_ctx
, struct libnet_BecomeDC
*r
)
3277 struct composite_context
*c
;
3278 c
= libnet_BecomeDC_send(ctx
, mem_ctx
, r
);
3279 status
= libnet_BecomeDC_recv(c
, mem_ctx
, r
);