?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
s4:libnet_become_dc - add checks for valid domain/forest function levels
[Samba.git] / source4 / libnet / libnet_become_dc.c
blobefd64aa295ebb10fca3a03c34b0ba6b0b43b3b69
1 /*
2 Unix SMB/CIFS implementation.
3
4 Copyright (C) Stefan Metzmacher <metze@samba.org> 2006
5
6 This program is free software; you can redistribute it and/or modify
7 it under the terms of the GNU General Public License as published by
8 the Free Software Foundation; either version 3 of the License, or
9 (at your option) any later version.
10
11 This program is distributed in the hope that it will be useful,
12 but WITHOUT ANY WARRANTY; without even the implied warranty of
13 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
14 GNU General Public License for more details.
15
16 You should have received a copy of the GNU General Public License
17 along with this program. If not, see <http://www.gnu.org/licenses/>.
18 */
19
20 #include "includes.h"
21 #include "libnet/libnet.h"
22 #include "libcli/composite/composite.h"
23 #include "libcli/cldap/cldap.h"
24 #include "lib/ldb/include/ldb.h"
25 #include "lib/ldb/include/ldb_errors.h"
26 #include "lib/ldb_wrap.h"
27 #include "dsdb/samdb/samdb.h"
28 #include "../libds/common/flags.h"
29 #include "librpc/gen_ndr/ndr_drsuapi_c.h"
30 #include "libcli/security/security.h"
31 #include "librpc/gen_ndr/ndr_misc.h"
32 #include "librpc/gen_ndr/ndr_security.h"
33 #include "librpc/gen_ndr/ndr_nbt.h"
34 #include "librpc/gen_ndr/ndr_drsuapi.h"
35 #include "auth/gensec/gensec.h"
36 #include "param/param.h"
37
38 /*****************************************************************************
39 * Windows 2003 (w2k3) does the following steps when changing the server role
40 * from domain member to domain controller
41 *
42 * We mostly do the same.
43 *****************************************************************************/
44
45 /*
46 * lookup DC:
47 * - using nbt name<1C> request and a samlogon mailslot request
48 * or
49 * - using a DNS SRV _ldap._tcp.dc._msdcs. request and a CLDAP netlogon request
50 *
51 * see: becomeDC_recv_cldap() and becomeDC_send_cldap()
52 */
53
54 /*
55 * Open 1st LDAP connection to the DC using admin credentials
56 *
57 * see: becomeDC_connect_ldap1() and becomeDC_ldap_connect()
58 */
59
60 /*
61 * LDAP search 1st LDAP connection:
62 *
63 * see: becomeDC_ldap1_rootdse()
64 *
65 * Request:
66 * basedn: ""
67 * scope: base
68 * filter: (objectClass=*)
69 * attrs: *
70 * Result:
71 * ""
72 * currentTime: 20061202155100.0Z
73 * subschemaSubentry: CN=Aggregate,CN=Schema,CN=Configuration,<domain_partition>
74 * dsServiceName: CN=<netbios_name>,CN=Servers,CN=<site_name>,CN=Sites,CN=Configuration,<domain_partition>
75 * namingContexts: <domain_partition>
76 * CN=Configuration,<domain_partition>
77 * CN=Schema,CN=Configuration,<domain_partition>
78 * defaultNamingContext: <domain_partition>
79 * schemaNamingContext: CN=Schema,CN=Configuration,<domain_partition>
80 * configurationNamingContext:CN=Configuration,<domain_partition>
81 * rootDomainNamingContext:<domain_partition>
82 * supportedControl: ...
83 * supportedLDAPVersion: 3
84 * 2
85 * supportedLDAPPolicies: ...
86 * highestCommitedUSN: ...
87 * supportedSASLMechanisms:GSSAPI
88 * GSS-SPNEGO
89 * EXTERNAL
90 * DIGEST-MD5
91 * dnsHostName: <dns_host_name>
92 * ldapServiceName: <domain_dns_name>:<netbios_name>$@<REALM>
93 * serverName: CN=Servers,CN=<site_name>,CN=Sites,CN=Configuration,<domain_partition>
94 * supportedCapabilities: ...
95 * isSyncronized: TRUE
96 * isGlobalCatalogReady: TRUE
97 * domainFunctionality: 0
98 * forestFunctionality: 0
99 * domainControllerFunctionality: 2
100 */
101
102 /*
103 * LDAP search 1st LDAP connection:
104 *
105 * see: becomeDC_ldap1_crossref_behavior_version()
106 *
107 * Request:
108 * basedn: CN=Configuration,<domain_partition>
109 * scope: one
110 * filter: (cn=Partitions)
111 * attrs: msDS-Behavior-Version
112 * Result:
113 * CN=Partitions,CN=Configuration,<domain_partition>
114 * msDS-Behavior-Version: 0
115 */
116
117 /*
118 * LDAP search 1st LDAP connection:
119 *
120 * NOTE: this seems to be a bug! as the messageID of the LDAP message is corrupted!
121 *
122 * not implemented here
123 *
124 * Request:
125 * basedn: CN=Schema,CN=Configuration,<domain_partition>
126 * scope: one
127 * filter: (cn=Partitions)
128 * attrs: msDS-Behavior-Version
129 * Result:
130 * <none>
131 *
132 */
133
134 /*
135 * LDAP search 1st LDAP connection:
136 *
137 * see: becomeDC_ldap1_domain_behavior_version()
138 *
139 * Request:
140 * basedn: <domain_partition>
141 * scope: base
142 * filter: (objectClass=*)
143 * attrs: msDS-Behavior-Version
144 * Result:
145 * <domain_partition>
146 * msDS-Behavior-Version: 0
147 */
148
149 /*
150 * LDAP search 1st LDAP connection:
151 *
152 * see: becomeDC_ldap1_schema_object_version()
153 *
154 * Request:
155 * basedn: CN=Schema,CN=Configuration,<domain_partition>
156 * scope: base
157 * filter: (objectClass=*)
158 * attrs: objectVersion
159 * Result:
160 * CN=Schema,CN=Configuration,<domain_partition>
161 * objectVersion: 30
162 */
163
164 /*
165 * LDAP search 1st LDAP connection:
166 *
167 * not implemented, because the information is already there
168 *
169 * Request:
170 * basedn: ""
171 * scope: base
172 * filter: (objectClass=*)
173 * attrs: defaultNamingContext
174 * dnsHostName
175 * Result:
176 * ""
177 * defaultNamingContext: <domain_partition>
178 * dnsHostName: <dns_host_name>
179 */
180
181 /*
182 * LDAP search 1st LDAP connection:
183 *
184 * see: becomeDC_ldap1_infrastructure_fsmo()
185 *
186 * Request:
187 * basedn: <WKGUID=2fbac1870ade11d297c400c04fd8d5cd,domain_partition>
188 * scope: base
189 * filter: (objectClass=*)
190 * attrs: 1.1
191 * Result:
192 * CN=Infrastructure,<domain_partition>
193 */
194
195 /*
196 * LDAP search 1st LDAP connection:
197 *
198 * see: becomeDC_ldap1_w2k3_update_revision()
199 *
200 * Request:
201 * basedn: CN=Windows2003Update,CN=DomainUpdates,CN=System,<domain_partition>
202 * scope: base
203 * filter: (objectClass=*)
204 * attrs: revision
205 * Result:
206 * CN=Windows2003Update,CN=DomainUpdates,CN=System,<domain_partition>
207 * revision: 8
208 */
209
210 /*
211 * LDAP search 1st LDAP connection:
212 *
213 * see: becomeDC_ldap1_infrastructure_fsmo()
214 *
215 * Request:
216 * basedn: CN=Infrastructure,<domain_partition>
217 * scope: base
218 * filter: (objectClass=*)
219 * attrs: fSMORoleOwner
220 * Result:
221 * CN=Infrastructure,<domain_partition>
222 * fSMORoleOwner: CN=NTDS Settings,<infrastructure_fsmo_server_object>
223 */
224
225 /*
226 * LDAP search 1st LDAP connection:
227 *
228 * see: becomeDC_ldap1_infrastructure_fsmo()
229 *
230 * Request:
231 * basedn: <infrastructure_fsmo_server_object>
232 * scope: base
233 * filter: (objectClass=*)
234 * attrs: dnsHostName
235 * Result:
236 * <infrastructure_fsmo_server_object>
237 * dnsHostName: <dns_host_name>
238 */
239
240 /*
241 * LDAP search 1st LDAP connection:
242 *
243 * see: becomeDC_ldap1_infrastructure_fsmo()
244 *
245 * Request:
246 * basedn: CN=NTDS Settings,<infrastructure_fsmo_server_object>
247 * scope: base
248 * filter: (objectClass=*)
249 * attrs: objectGUID
250 * Result:
251 * CN=NTDS Settings,<infrastructure_fsmo_server_object>
252 * objectGUID: <object_guid>
253 */
254
255 /*
256 * LDAP search 1st LDAP connection:
257 *
258 * see: becomeDC_ldap1_rid_manager_fsmo()
259 *
260 * Request:
261 * basedn: <domain_partition>
262 * scope: base
263 * filter: (objectClass=*)
264 * attrs: rIDManagerReference
265 * Result:
266 * <domain_partition>
267 * rIDManagerReference: CN=RID Manager$,CN=System,<domain_partition>
268 */
269
270 /*
271 * LDAP search 1st LDAP connection:
272 *
273 * see: becomeDC_ldap1_rid_manager_fsmo()
274 *
275 * Request:
276 * basedn: CN=RID Manager$,CN=System,<domain_partition>
277 * scope: base
278 * filter: (objectClass=*)
279 * attrs: fSMORoleOwner
280 * Result:
281 * CN=Infrastructure,<domain_partition>
282 * fSMORoleOwner: CN=NTDS Settings,<rid_manager_fsmo_server_object>
283 */
284
285 /*
286 * LDAP search 1st LDAP connection:
287 *
288 * see: becomeDC_ldap1_rid_manager_fsmo()
289 *
290 * Request:
291 * basedn: <rid_manager_fsmo_server_object>
292 * scope: base
293 * filter: (objectClass=*)
294 * attrs: dnsHostName
295 * Result:
296 * <rid_manager_fsmo_server_object>
297 * dnsHostName: <dns_host_name>
298 */
299
300 /*
301 * LDAP search 1st LDAP connection:
302 *
303 * see: becomeDC_ldap1_rid_manager_fsmo()
304 *
305 * Request:
306 * basedn: CN=NTDS Settings,<rid_manager_fsmo_server_object>
307 * scope: base
308 * filter: (objectClass=*)
309 * attrs: msDs-ReplicationEpoch
310 * Result:
311 * CN=NTDS Settings,<rid_manager_fsmo_server_object>
312 */
313
314 /*
315 * LDAP search 1st LDAP connection:
316 *
317 * see: becomeDC_ldap1_site_object()
318 *
319 * Request:
320 * basedn: CN=<new_dc_site_name>,CN=Sites,CN=Configuration,<domain_partition>
321 * scope: base
322 * filter: (objectClass=*)
323 * attrs:
324 * Result:
325 * CN=<new_dc_site_name>,CN=Sites,CN=Configuration,<domain_partition>
326 * objectClass: top
327 * site
328 * cn: <new_dc_site_name>
329 * distinguishedName:CN=<new_dc_site_name>,CN=Sites,CN=Configuration,<domain_partition>
330 * instanceType: 4
331 * whenCreated: ...
332 * whenChanged: ...
333 * uSNCreated: ...
334 * uSNChanged: ...
335 * showInAdvancedViewOnly: TRUE
336 * name: <new_dc_site_name>
337 * objectGUID: <object_guid>
338 * systemFlags: 1107296256 <0x42000000>
339 * objectCategory: CN=Site,C=Schema,CN=Configuration,<domain_partition>
340 */
341
342 /***************************************************************
343 * Add this stage we call the check_options() callback function
344 * of the caller, to see if he wants us to continue
345 *
346 * see: becomeDC_check_options()
347 ***************************************************************/
348
349 /*
350 * LDAP search 1st LDAP connection:
351 *
352 * see: becomeDC_ldap1_computer_object()
353 *
354 * Request:
355 * basedn: <domain_partition>
356 * scope: sub
357 * filter: (&(|(objectClass=user)(objectClass=computer))(sAMAccountName=<new_dc_account_name>))
358 * attrs: distinguishedName
359 * userAccountControl
360 * Result:
361 * CN=<new_dc_netbios_name>,CN=Computers,<domain_partition>
362 * distinguishedName: CN=<new_dc_netbios_name>,CN=Computers,<domain_partition>
363 * userAccoountControl: 4096 <0x1000>
364 */
365
366 /*
367 * LDAP search 1st LDAP connection:
368 *
369 * see: becomeDC_ldap1_server_object_1()
370 *
371 * Request:
372 * basedn: CN=<new_dc_netbios_name>,CN=Servers,CN=<new_dc_site_name>,CN=Sites,CN=Configuration,<domain_partition>
373 * scope: base
374 * filter: (objectClass=*)
375 * attrs:
376 * Result:
377 * <noSuchObject>
378 * <matchedDN:CN=Servers,CN=<new_dc_site_name>,CN=Sites,CN=Configuration,<domain_partition>>
379 */
380
381 /*
382 * LDAP search 1st LDAP connection:
383 *
384 * see: becomeDC_ldap1_server_object_2()
385 *
386 * Request:
387 * basedn: CN=<new_dc_netbios_name>,CN=Computers,<domain_partition>
388 * scope: base
389 * filter: (objectClass=*)
390 * attrs: serverReferenceBL
391 * typesOnly: TRUE!!!
392 * Result:
393 * CN=<new_dc_netbios_name>,CN=Computers,<domain_partition>
394 */
395
396 /*
397 * LDAP add 1st LDAP connection:
398 *
399 * see: becomeDC_ldap1_server_object_add()
400 *
401 * Request:
402 * CN=<new_dc_netbios_name>,CN=Computers,<domain_partition>
403 * objectClass: server
404 * systemFlags: 50000000 <0x2FAF080>
405 * serverReference:CN=<new_dc_netbios_name>,CN=Computers,<domain_partition>
406 * Result:
407 * <success>
408 */
409
410 /*
411 * LDAP search 1st LDAP connection:
412 *
413 * not implemented, maybe we can add that later
414 *
415 * Request:
416 * basedn: CN=NTDS Settings,CN=<new_dc_netbios_name>,CN=Servers,CN=<new_dc_site_name>,CN=Sites,CN=Configuration,<domain_partition>
417 * scope: base
418 * filter: (objectClass=*)
419 * attrs:
420 * Result:
421 * <noSuchObject>
422 * <matchedDN:CN=<new_dc_netbios_name>,CN=Servers,CN=<new_dc_site_name>,CN=Sites,CN=Configuration,<domain_partition>>
423 */
424
425 /*
426 * LDAP search 1st LDAP connection:
427 *
428 * not implemented because it gives no new information
429 *
430 * Request:
431 * basedn: CN=Partitions,CN=Configuration,<domain_partition>
432 * scope: sub
433 * filter: (nCName=<domain_partition>)
434 * attrs: nCName
435 * dnsRoot
436 * controls: LDAP_SERVER_EXTENDED_DN_OID:critical=false
437 * Result:
438 * <GUID=<hex_guid>>;CN=<domain_netbios_name>,CN=Partitions,<domain_partition>>
439 * nCName: <GUID=<hex_guid>>;<SID=<hex_sid>>;<domain_partition>>
440 * dnsRoot: <domain_dns_name>
441 */
442
443 /*
444 * LDAP modify 1st LDAP connection:
445 *
446 * see: becomeDC_ldap1_server_object_modify()
447 *
448 * Request (add):
449 * CN=<new_dc_netbios_name>,CN=Servers,CN=<new_dc_site_name>,CN=Sites,CN=Configuration,<domain_partition>>
450 * serverReference:CN=<new_dc_netbios_name>,CN=Computers,<domain_partition>
451 * Result:
452 * <attributeOrValueExist>
453 */
454
455 /*
456 * LDAP modify 1st LDAP connection:
457 *
458 * see: becomeDC_ldap1_server_object_modify()
459 *
460 * Request (replace):
461 * CN=<new_dc_netbios_name>,CN=Servers,CN=<new_dc_site_name>,CN=Sites,CN=Configuration,<domain_partition>>
462 * serverReference:CN=<new_dc_netbios_name>,CN=Computers,<domain_partition>
463 * Result:
464 * <success>
465 */
466
467 /*
468 * Open 1st DRSUAPI connection to the DC using admin credentials
469 * DsBind with DRSUAPI_DS_BIND_GUID_W2K3 ("6afab99c-6e26-464a-975f-f58f105218bc")
470 * (w2k3 does 2 DsBind() calls here..., where is first is unused and contains garbage at the end)
471 *
472 * see: becomeDC_drsuapi_connect_send(), becomeDC_drsuapi1_connect_recv(),
473 * becomeDC_drsuapi_bind_send(), becomeDC_drsuapi_bind_recv() and becomeDC_drsuapi1_bind_recv()
474 */
475
476 /*
477 * DsAddEntry to create the CN=NTDS Settings,CN=<machine_name>,CN=Servers,CN=Default-First-Site-Name, ...
478 * on the 1st DRSUAPI connection
479 *
480 * see: becomeDC_drsuapi1_add_entry_send() and becomeDC_drsuapi1_add_entry_recv()
481 */
482
483 /***************************************************************
484 * Add this stage we call the prepare_db() callback function
485 * of the caller, to see if he wants us to continue
486 *
487 * see: becomeDC_prepare_db()
488 ***************************************************************/
489
490 /*
491 * Open 2nd and 3rd DRSUAPI connection to the DC using admin credentials
492 * - a DsBind with DRSUAPI_DS_BIND_GUID_W2K3 ("6afab99c-6e26-464a-975f-f58f105218bc")
493 * on the 2nd connection
494 *
495 * see: becomeDC_drsuapi_connect_send(), becomeDC_drsuapi2_connect_recv(),
496 * becomeDC_drsuapi_bind_send(), becomeDC_drsuapi_bind_recv(), becomeDC_drsuapi2_bind_recv()
497 * and becomeDC_drsuapi3_connect_recv()
498 */
499
500 /*
501 * replicate CN=Schema,CN=Configuration,...
502 * on the 3rd DRSUAPI connection and the bind_handle from the 2nd connection
503 *
504 * see: becomeDC_drsuapi_pull_partition_send(), becomeDC_drsuapi_pull_partition_recv(),
505 * becomeDC_drsuapi3_pull_schema_send() and becomeDC_drsuapi3_pull_schema_recv()
506 *
507 ***************************************************************
508 * Add this stage we call the schema_chunk() callback function
509 * for each replication message
510 ***************************************************************/
511
512 /*
513 * replicate CN=Configuration,...
514 * on the 3rd DRSUAPI connection and the bind_handle from the 2nd connection
515 *
516 * see: becomeDC_drsuapi_pull_partition_send(), becomeDC_drsuapi_pull_partition_recv(),
517 * becomeDC_drsuapi3_pull_config_send() and becomeDC_drsuapi3_pull_config_recv()
518 *
519 ***************************************************************
520 * Add this stage we call the config_chunk() callback function
521 * for each replication message
522 ***************************************************************/
523
524 /*
525 * LDAP unbind on the 1st LDAP connection
526 *
527 * not implemented, because it's not needed...
528 */
529
530 /*
531 * Open 2nd LDAP connection to the DC using admin credentials
532 *
533 * see: becomeDC_connect_ldap2() and becomeDC_ldap_connect()
534 */
535
536 /*
537 * LDAP search 2nd LDAP connection:
538 *
539 * not implemented because it gives no new information
540 * same as becomeDC_ldap1_computer_object()
541 *
542 * Request:
543 * basedn: <domain_partition>
544 * scope: sub
545 * filter: (&(|(objectClass=user)(objectClass=computer))(sAMAccountName=<new_dc_account_name>))
546 * attrs: distinguishedName
547 * userAccountControl
548 * Result:
549 * CN=<new_dc_netbios_name>,CN=Computers,<domain_partition>
550 * distinguishedName: CN=<new_dc_netbios_name>,CN=Computers,<domain_partition>
551 * userAccoountControl: 4096 <0x00001000>
552 */
553
554 /*
555 * LDAP search 2nd LDAP connection:
556 *
557 * not implemented because it gives no new information
558 * same as becomeDC_ldap1_computer_object()
559 *
560 * Request:
561 * basedn: CN=<new_dc_netbios_name>,CN=Computers,<domain_partition>
562 * scope: base
563 * filter: (objectClass=*)
564 * attrs: userAccountControl
565 * Result:
566 * CN=<new_dc_netbios_name>,CN=Computers,<domain_partition>
567 * userAccoountControl: 4096 <0x00001000>
568 */
569
570 /*
571 * LDAP modify 2nd LDAP connection:
572 *
573 * see: becomeDC_ldap2_modify_computer()
574 *
575 * Request (replace):
576 * CN=<new_dc_netbios_name>,CN=Computers,<domain_partition>
577 * userAccoountControl: 532480 <0x82000>
578 * Result:
579 * <success>
580 */
581
582 /*
583 * LDAP search 2nd LDAP connection:
584 *
585 * see: becomeDC_ldap2_move_computer()
586 *
587 * Request:
588 * basedn: <WKGUID=2fbac1870ade11d297c400c04fd8d5cd,<domain_partition>>
589 * scope: base
590 * filter: (objectClass=*)
591 * attrs: 1.1
592 * Result:
593 * CN=Domain Controllers,<domain_partition>
594 */
595
596 /*
597 * LDAP search 2nd LDAP connection:
598 *
599 * not implemented because it gives no new information
600 *
601 * Request:
602 * basedn: CN=Domain Controllers,<domain_partition>
603 * scope: base
604 * filter: (objectClass=*)
605 * attrs: distinguishedName
606 * Result:
607 * CN=Domain Controller,<domain_partition>
608 * distinguishedName: CN=Domain Controllers,<domain_partition>
609 */
610
611 /*
612 * LDAP modifyRDN 2nd LDAP connection:
613 *
614 * see: becomeDC_ldap2_move_computer()
615 *
616 * Request:
617 * entry: CN=<new_dc_netbios_name>,CN=Computers,<domain_partition>
618 * newrdn: CN=<new_dc_netbios_name>
619 * deleteoldrdn: TRUE
620 * newparent: CN=Domain Controllers,<domain_partition>
621 * Result:
622 * <success>
623 */
624
625 /*
626 * LDAP unbind on the 2nd LDAP connection
627 *
628 * not implemented, because it's not needed...
629 */
630
631 /*
632 * replicate Domain Partition
633 * on the 3rd DRSUAPI connection and the bind_handle from the 2nd connection
634 *
635 * see: becomeDC_drsuapi_pull_partition_send(), becomeDC_drsuapi_pull_partition_recv(),
636 * becomeDC_drsuapi3_pull_domain_send() and becomeDC_drsuapi3_pull_domain_recv()
637 *
638 ***************************************************************
639 * Add this stage we call the domain_chunk() callback function
640 * for each replication message
641 ***************************************************************/
642
643 /* call DsReplicaUpdateRefs() for all partitions like this:
644 * req1: struct drsuapi_DsReplicaUpdateRefsRequest1
645 *
646 * naming_context: struct drsuapi_DsReplicaObjectIdentifier
647 * __ndr_size : 0x000000ae (174)
648 * __ndr_size_sid : 0x00000000 (0)
649 * guid : 00000000-0000-0000-0000-000000000000
650 * sid : S-0-0
651 * dn : 'CN=Schema,CN=Configuration,DC=w2k3,DC=vmnet1,DC=vm,DC=base'
652 *
653 * dest_dsa_dns_name : '4a0df188-a0b8-47ea-bbe5-e614723f16dd._msdcs.w2k3.vmnet1.vm.base'
654 * dest_dsa_guid : 4a0df188-a0b8-47ea-bbe5-e614723f16dd
655 * options : 0x0000001c (28)
656 * 0: DRSUAPI_DS_REPLICA_UPDATE_ASYNCHRONOUS_OPERATION
657 * 0: DRSUAPI_DS_REPLICA_UPDATE_WRITEABLE
658 * 1: DRSUAPI_DS_REPLICA_UPDATE_ADD_REFERENCE
659 * 1: DRSUAPI_DS_REPLICA_UPDATE_DELETE_REFERENCE
660 * 1: DRSUAPI_DS_REPLICA_UPDATE_0x00000010
661 *
662 * 4a0df188-a0b8-47ea-bbe5-e614723f16dd is the objectGUID the DsAddEntry() returned for the
663 * CN=NTDS Settings,CN=<machine_name>,CN=Servers,CN=Default-First-Site-Name, ...
664 * on the 2nd!!! DRSUAPI connection
665 *
666 * see: becomeDC_drsuapi_update_refs_send(), becomeDC_drsuapi2_update_refs_schema_recv(),
667 * becomeDC_drsuapi2_update_refs_config_recv() and becomeDC_drsuapi2_update_refs_domain_recv()
668 */
669
670 /*
671 * Windows does opens the 4th and 5th DRSUAPI connection...
672 * and does a DsBind() with the objectGUID from DsAddEntry() as bind_guid
673 * on the 4th connection
674 *
675 * and then 2 full replications of the domain partition on the 5th connection
676 * with the bind_handle from the 4th connection
677 *
678 * not implemented because it gives no new information
679 */
680
681 struct libnet_BecomeDC_state {
682 struct composite_context *creq;
683
684 struct libnet_context *libnet;
685
686 struct dom_sid zero_sid;
687
688 struct {
689 struct cldap_socket *sock;
690 struct cldap_netlogon io;
691 struct NETLOGON_SAM_LOGON_RESPONSE_EX netlogon;
692 } cldap;
693
694 struct becomeDC_ldap {
695 struct ldb_context *ldb;
696 const struct ldb_message *rootdse;
697 } ldap1, ldap2;
698
699 struct becomeDC_drsuapi {
700 struct libnet_BecomeDC_state *s;
701 struct dcerpc_binding *binding;
702 struct dcerpc_pipe *pipe;
703 DATA_BLOB gensec_skey;
704 struct drsuapi_DsBind bind_r;
705 struct GUID bind_guid;
706 struct drsuapi_DsBindInfoCtr bind_info_ctr;
707 struct drsuapi_DsBindInfo28 local_info28;
708 struct drsuapi_DsBindInfo28 remote_info28;
709 struct policy_handle bind_handle;
710 } drsuapi1, drsuapi2, drsuapi3;
711
712 struct libnet_BecomeDC_Domain domain;
713 struct libnet_BecomeDC_Forest forest;
714 struct libnet_BecomeDC_SourceDSA source_dsa;
715 struct libnet_BecomeDC_DestDSA dest_dsa;
716
717 struct libnet_BecomeDC_Partition schema_part, config_part, domain_part;
718
719 struct becomeDC_fsmo {
720 const char *dns_name;
721 const char *server_dn_str;
722 const char *ntds_dn_str;
723 struct GUID ntds_guid;
724 } infrastructure_fsmo;
725
726 struct becomeDC_fsmo rid_manager_fsmo;
727
728 struct libnet_BecomeDC_CheckOptions _co;
729 struct libnet_BecomeDC_PrepareDB _pp;
730 struct libnet_BecomeDC_StoreChunk _sc;
731 struct libnet_BecomeDC_Callbacks callbacks;
732 };
733
734 static int32_t get_dc_function_level(struct loadparm_context *lp_ctx)
735 {
736 /* per default we are (Windows) 2008 compatible */
737 return lp_parm_int(lp_ctx, NULL, "ads", "dc function level",
738 DS_DC_FUNCTION_2008);
739 }
740
741 static int32_t get_min_function_level(struct loadparm_context *lp_ctx)
742 {
743 /* per default it is (Windows) 2003 Native compatible */
744 return lp_parm_int(lp_ctx, NULL, "ads", "min function level",
745 DS_DOMAIN_FUNCTION_2003);
746 }
747
748 static void becomeDC_recv_cldap(struct tevent_req *req);
749
750 static void becomeDC_send_cldap(struct libnet_BecomeDC_state *s)
751 {
752 struct composite_context *c = s->creq;
753 struct tevent_req *req;
754
755 s->cldap.io.in.dest_address = s->source_dsa.address;
756 s->cldap.io.in.dest_port = lp_cldap_port(s->libnet->lp_ctx);
757 s->cldap.io.in.realm = s->domain.dns_name;
758 s->cldap.io.in.host = s->dest_dsa.netbios_name;
759 s->cldap.io.in.user = NULL;
760 s->cldap.io.in.domain_guid = NULL;
761 s->cldap.io.in.domain_sid = NULL;
762 s->cldap.io.in.acct_control = -1;
763 s->cldap.io.in.version = NETLOGON_NT_VERSION_5 | NETLOGON_NT_VERSION_5EX;
764 s->cldap.io.in.map_response = true;
765
766 c->status = cldap_socket_init(s, s->libnet->event_ctx,
767 NULL, NULL, &s->cldap.sock);//TODO
768 if (!composite_is_ok(c)) return;
769
770 req = cldap_netlogon_send(s, s->cldap.sock, &s->cldap.io);
771 if (composite_nomem(req, c)) return;
772 tevent_req_set_callback(req, becomeDC_recv_cldap, s);
773 }
774
775 static void becomeDC_connect_ldap1(struct libnet_BecomeDC_state *s);
776
777 static void becomeDC_recv_cldap(struct tevent_req *req)
778 {
779 struct libnet_BecomeDC_state *s = tevent_req_callback_data(req,
780 struct libnet_BecomeDC_state);
781 struct composite_context *c = s->creq;
782
783 c->status = cldap_netlogon_recv(req,
784 lp_iconv_convenience(s->libnet->lp_ctx),
785 s, &s->cldap.io);
786 talloc_free(req);
787 if (!composite_is_ok(c)) return;
788
789 s->cldap.netlogon = s->cldap.io.out.netlogon.data.nt5_ex;
790
791 s->domain.dns_name = s->cldap.netlogon.dns_domain;
792 s->domain.netbios_name = s->cldap.netlogon.domain;
793 s->domain.guid = s->cldap.netlogon.domain_uuid;
794
795 s->forest.dns_name = s->cldap.netlogon.forest;
796
797 s->source_dsa.dns_name = s->cldap.netlogon.pdc_dns_name;
798 s->source_dsa.netbios_name = s->cldap.netlogon.pdc_name;
799 s->source_dsa.site_name = s->cldap.netlogon.server_site;
800
801 s->dest_dsa.site_name = s->cldap.netlogon.client_site;
802
803 becomeDC_connect_ldap1(s);
804 }
805
806 static NTSTATUS becomeDC_ldap_connect(struct libnet_BecomeDC_state *s,
807 struct becomeDC_ldap *ldap)
808 {
809 char *url;
810
811 url = talloc_asprintf(s, "ldap://%s/", s->source_dsa.dns_name);
812 NT_STATUS_HAVE_NO_MEMORY(url);
813
814 ldap->ldb = ldb_wrap_connect(s, s->libnet->event_ctx, s->libnet->lp_ctx, url,
815 NULL,
816 s->libnet->cred,
817 0, NULL);
818 talloc_free(url);
819 if (ldap->ldb == NULL) {
820 return NT_STATUS_UNEXPECTED_NETWORK_ERROR;
821 }
822
823 return NT_STATUS_OK;
824 }
825
826 static NTSTATUS becomeDC_ldap1_rootdse(struct libnet_BecomeDC_state *s)
827 {
828 int ret;
829 struct ldb_result *r;
830 struct ldb_dn *basedn;
831 static const char *attrs[] = {
832 "*",
833 NULL
834 };
835
836 basedn = ldb_dn_new(s, s->ldap1.ldb, NULL);
837 NT_STATUS_HAVE_NO_MEMORY(basedn);
838
839 ret = ldb_search(s->ldap1.ldb, s, &r, basedn, LDB_SCOPE_BASE, attrs,
840 "(objectClass=*)");
841 talloc_free(basedn);
842 if (ret != LDB_SUCCESS) {
843 return NT_STATUS_LDAP(ret);
844 } else if (r->count != 1) {
845 talloc_free(r);
846 return NT_STATUS_INVALID_NETWORK_RESPONSE;
847 }
848
849 s->ldap1.rootdse = r->msgs[0];
850
851 s->domain.dn_str = ldb_msg_find_attr_as_string(s->ldap1.rootdse, "defaultNamingContext", NULL);
852 if (!s->domain.dn_str) return NT_STATUS_INVALID_NETWORK_RESPONSE;
853
854 s->forest.root_dn_str = ldb_msg_find_attr_as_string(s->ldap1.rootdse, "rootDomainNamingContext", NULL);
855 if (!s->forest.root_dn_str) return NT_STATUS_INVALID_NETWORK_RESPONSE;
856 s->forest.config_dn_str = ldb_msg_find_attr_as_string(s->ldap1.rootdse, "configurationNamingContext", NULL);
857 if (!s->forest.config_dn_str) return NT_STATUS_INVALID_NETWORK_RESPONSE;
858 s->forest.schema_dn_str = ldb_msg_find_attr_as_string(s->ldap1.rootdse, "schemaNamingContext", NULL);
859 if (!s->forest.schema_dn_str) return NT_STATUS_INVALID_NETWORK_RESPONSE;
860
861 s->source_dsa.server_dn_str = ldb_msg_find_attr_as_string(s->ldap1.rootdse, "serverName", NULL);
862 if (!s->source_dsa.server_dn_str) return NT_STATUS_INVALID_NETWORK_RESPONSE;
863 s->source_dsa.ntds_dn_str = ldb_msg_find_attr_as_string(s->ldap1.rootdse, "dsServiceName", NULL);
864 if (!s->source_dsa.ntds_dn_str) return NT_STATUS_INVALID_NETWORK_RESPONSE;
865
866 return NT_STATUS_OK;
867 }
868
869 static NTSTATUS becomeDC_ldap1_crossref_behavior_version(struct libnet_BecomeDC_state *s)
870 {
871 int ret;
872 struct ldb_result *r;
873 struct ldb_dn *basedn;
874 static const char *attrs[] = {
875 "msDs-Behavior-Version",
876 NULL
877 };
878
879 basedn = ldb_dn_new(s, s->ldap1.ldb, s->forest.config_dn_str);
880 NT_STATUS_HAVE_NO_MEMORY(basedn);
881
882 ret = ldb_search(s->ldap1.ldb, s, &r, basedn, LDB_SCOPE_ONELEVEL, attrs,
883 "(cn=Partitions)");
884 talloc_free(basedn);
885 if (ret != LDB_SUCCESS) {
886 return NT_STATUS_LDAP(ret);
887 } else if (r->count != 1) {
888 talloc_free(r);
889 return NT_STATUS_INVALID_NETWORK_RESPONSE;
890 }
891
892 s->forest.crossref_behavior_version = ldb_msg_find_attr_as_uint(r->msgs[0], "msDs-Behavior-Version", 0);
893 if (s->forest.crossref_behavior_version <
894 get_min_function_level(s->libnet->lp_ctx)) {
895 talloc_free(r);
896 /* we don't support forest function levels below the specified
897 * value. */
898 return NT_STATUS_NOT_SUPPORTED;
899 }
900 if (s->forest.crossref_behavior_version >
901 get_dc_function_level(s->libnet->lp_ctx)) {
902 talloc_free(r);
903 /* if the DC function level is lower than the forest one we
904 * cannot join. */
905 return NT_STATUS_NOT_SUPPORTED;
906 }
907
908 talloc_free(r);
909 return NT_STATUS_OK;
910 }
911
912 static NTSTATUS becomeDC_ldap1_domain_behavior_version(struct libnet_BecomeDC_state *s)
913 {
914 int ret;
915 struct ldb_result *r;
916 struct ldb_dn *basedn;
917 static const char *attrs[] = {
918 "msDs-Behavior-Version",
919 NULL
920 };
921
922 basedn = ldb_dn_new(s, s->ldap1.ldb, s->domain.dn_str);
923 NT_STATUS_HAVE_NO_MEMORY(basedn);
924
925 ret = ldb_search(s->ldap1.ldb, s, &r, basedn, LDB_SCOPE_BASE, attrs,
926 "(objectClass=*)");
927 talloc_free(basedn);
928 if (ret != LDB_SUCCESS) {
929 return NT_STATUS_LDAP(ret);
930 } else if (r->count != 1) {
931 talloc_free(r);
932 return NT_STATUS_INVALID_NETWORK_RESPONSE;
933 }
934
935 s->domain.behavior_version = ldb_msg_find_attr_as_uint(r->msgs[0], "msDs-Behavior-Version", 0);
936 if (s->domain.behavior_version <
937 get_min_function_level(s->libnet->lp_ctx)) {
938 talloc_free(r);
939 /* we don't support domain function levels below the specified
940 * value. */
941 return NT_STATUS_NOT_SUPPORTED;
942 }
943 if (s->domain.behavior_version >
944 get_dc_function_level(s->libnet->lp_ctx)) {
945 talloc_free(r);
946 /* if the DC function level is lower than the forest one we
947 * cannot join. */
948 return NT_STATUS_NOT_SUPPORTED;
949 }
950
951 talloc_free(r);
952 return NT_STATUS_OK;
953 }
954
955 static NTSTATUS becomeDC_ldap1_schema_object_version(struct libnet_BecomeDC_state *s)
956 {
957 int ret;
958 struct ldb_result *r;
959 struct ldb_dn *basedn;
960 static const char *attrs[] = {
961 "objectVersion",
962 NULL
963 };
964
965 basedn = ldb_dn_new(s, s->ldap1.ldb, s->forest.schema_dn_str);
966 NT_STATUS_HAVE_NO_MEMORY(basedn);
967
968 ret = ldb_search(s->ldap1.ldb, s, &r, basedn, LDB_SCOPE_BASE, attrs,
969 "(objectClass=*)");
970 talloc_free(basedn);
971 if (ret != LDB_SUCCESS) {
972 return NT_STATUS_LDAP(ret);
973 } else if (r->count != 1) {
974 talloc_free(r);
975 return NT_STATUS_INVALID_NETWORK_RESPONSE;
976 }
977
978 s->forest.schema_object_version = ldb_msg_find_attr_as_uint(r->msgs[0], "objectVersion", 0);
979
980 talloc_free(r);
981 return NT_STATUS_OK;
982 }
983
984 static NTSTATUS becomeDC_ldap1_w2k3_update_revision(struct libnet_BecomeDC_state *s)
985 {
986 int ret;
987 struct ldb_result *r;
988 struct ldb_dn *basedn;
989 static const char *attrs[] = {
990 "revision",
991 NULL
992 };
993
994 basedn = ldb_dn_new_fmt(s, s->ldap1.ldb, "CN=Windows2003Update,CN=DomainUpdates,CN=System,%s",
995 s->domain.dn_str);
996 NT_STATUS_HAVE_NO_MEMORY(basedn);
997
998 ret = ldb_search(s->ldap1.ldb, s, &r, basedn, LDB_SCOPE_BASE, attrs,
999 "(objectClass=*)");
1000 talloc_free(basedn);
1001 if (ret == LDB_ERR_NO_SUCH_OBJECT) {
1002 /* w2k doesn't have this object */
1003 s->domain.w2k3_update_revision = 0;
1004 return NT_STATUS_OK;
1005 } else if (ret != LDB_SUCCESS) {
1006 return NT_STATUS_LDAP(ret);
1007 } else if (r->count != 1) {
1008 talloc_free(r);
1009 return NT_STATUS_INVALID_NETWORK_RESPONSE;
1010 }
1011
1012 s->domain.w2k3_update_revision = ldb_msg_find_attr_as_uint(r->msgs[0], "revision", 0);
1013
1014 talloc_free(r);
1015 return NT_STATUS_OK;
1016 }
1017
1018 static NTSTATUS becomeDC_ldap1_infrastructure_fsmo(struct libnet_BecomeDC_state *s)
1019 {
1020 int ret;
1021 struct ldb_result *r;
1022 struct ldb_dn *basedn;
1023 struct ldb_dn *ntds_dn;
1024 struct ldb_dn *server_dn;
1025 static const char *_1_1_attrs[] = {
1026 "1.1",
1027 NULL
1028 };
1029 static const char *fsmo_attrs[] = {
1030 "fSMORoleOwner",
1031 NULL
1032 };
1033 static const char *dns_attrs[] = {
1034 "dnsHostName",
1035 NULL
1036 };
1037 static const char *guid_attrs[] = {
1038 "objectGUID",
1039 NULL
1040 };
1041
1042 basedn = ldb_dn_new_fmt(s, s->ldap1.ldb, "<WKGUID=2fbac1870ade11d297c400c04fd8d5cd,%s>",
1043 s->domain.dn_str);
1044 NT_STATUS_HAVE_NO_MEMORY(basedn);
1045
1046 ret = ldb_search(s->ldap1.ldb, s, &r, basedn, LDB_SCOPE_BASE,
1047 _1_1_attrs, "(objectClass=*)");
1048 talloc_free(basedn);
1049 if (ret != LDB_SUCCESS) {
1050 return NT_STATUS_LDAP(ret);
1051 } else if (r->count != 1) {
1052 talloc_free(r);
1053 return NT_STATUS_INVALID_NETWORK_RESPONSE;
1054 }
1055
1056 basedn = talloc_steal(s, r->msgs[0]->dn);
1057 talloc_free(r);
1058
1059 ret = ldb_search(s->ldap1.ldb, s, &r, basedn, LDB_SCOPE_BASE,
1060 fsmo_attrs, "(objectClass=*)");
1061 talloc_free(basedn);
1062 if (ret != LDB_SUCCESS) {
1063 return NT_STATUS_LDAP(ret);
1064 } else if (r->count != 1) {
1065 talloc_free(r);
1066 return NT_STATUS_INVALID_NETWORK_RESPONSE;
1067 }
1068
1069 s->infrastructure_fsmo.ntds_dn_str = samdb_result_string(r->msgs[0], "fSMORoleOwner", NULL);
1070 if (!s->infrastructure_fsmo.ntds_dn_str) return NT_STATUS_INVALID_NETWORK_RESPONSE;
1071 talloc_steal(s, s->infrastructure_fsmo.ntds_dn_str);
1072
1073 talloc_free(r);
1074
1075 ntds_dn = ldb_dn_new(s, s->ldap1.ldb, s->infrastructure_fsmo.ntds_dn_str);
1076 NT_STATUS_HAVE_NO_MEMORY(ntds_dn);
1077
1078 server_dn = ldb_dn_get_parent(s, ntds_dn);
1079 NT_STATUS_HAVE_NO_MEMORY(server_dn);
1080
1081 s->infrastructure_fsmo.server_dn_str = ldb_dn_alloc_linearized(s, server_dn);
1082 NT_STATUS_HAVE_NO_MEMORY(s->infrastructure_fsmo.server_dn_str);
1083
1084 ret = ldb_search(s->ldap1.ldb, s, &r, server_dn, LDB_SCOPE_BASE,
1085 dns_attrs, "(objectClass=*)");
1086 if (ret != LDB_SUCCESS) {
1087 return NT_STATUS_LDAP(ret);
1088 } else if (r->count != 1) {
1089 talloc_free(r);
1090 return NT_STATUS_INVALID_NETWORK_RESPONSE;
1091 }
1092
1093 s->infrastructure_fsmo.dns_name = samdb_result_string(r->msgs[0], "dnsHostName", NULL);
1094 if (!s->infrastructure_fsmo.dns_name) return NT_STATUS_INVALID_NETWORK_RESPONSE;
1095 talloc_steal(s, s->infrastructure_fsmo.dns_name);
1096
1097 talloc_free(r);
1098
1099 ret = ldb_search(s->ldap1.ldb, s, &r, ntds_dn, LDB_SCOPE_BASE,
1100 guid_attrs, "(objectClass=*)");
1101 if (ret != LDB_SUCCESS) {
1102 return NT_STATUS_LDAP(ret);
1103 } else if (r->count != 1) {
1104 talloc_free(r);
1105 return NT_STATUS_INVALID_NETWORK_RESPONSE;
1106 }
1107
1108 s->infrastructure_fsmo.ntds_guid = samdb_result_guid(r->msgs[0], "objectGUID");
1109
1110 talloc_free(r);
1111
1112 return NT_STATUS_OK;
1113 }
1114
1115 static NTSTATUS becomeDC_ldap1_rid_manager_fsmo(struct libnet_BecomeDC_state *s)
1116 {
1117 int ret;
1118 struct ldb_result *r;
1119 struct ldb_dn *basedn;
1120 const char *reference_dn_str;
1121 struct ldb_dn *ntds_dn;
1122 struct ldb_dn *server_dn;
1123 static const char *rid_attrs[] = {
1124 "rIDManagerReference",
1125 NULL
1126 };
1127 static const char *fsmo_attrs[] = {
1128 "fSMORoleOwner",
1129 NULL
1130 };
1131 static const char *dns_attrs[] = {
1132 "dnsHostName",
1133 NULL
1134 };
1135 static const char *guid_attrs[] = {
1136 "objectGUID",
1137 NULL
1138 };
1139
1140 basedn = ldb_dn_new(s, s->ldap1.ldb, s->domain.dn_str);
1141 NT_STATUS_HAVE_NO_MEMORY(basedn);
1142
1143 ret = ldb_search(s->ldap1.ldb, s, &r, basedn, LDB_SCOPE_BASE,
1144 rid_attrs, "(objectClass=*)");
1145 talloc_free(basedn);
1146 if (ret != LDB_SUCCESS) {
1147 return NT_STATUS_LDAP(ret);
1148 } else if (r->count != 1) {
1149 talloc_free(r);
1150 return NT_STATUS_INVALID_NETWORK_RESPONSE;
1151 }
1152
1153 reference_dn_str = samdb_result_string(r->msgs[0], "rIDManagerReference", NULL);
1154 if (!reference_dn_str) return NT_STATUS_INVALID_NETWORK_RESPONSE;
1155
1156 basedn = ldb_dn_new(s, s->ldap1.ldb, reference_dn_str);
1157 NT_STATUS_HAVE_NO_MEMORY(basedn);
1158
1159 talloc_free(r);
1160
1161 ret = ldb_search(s->ldap1.ldb, s, &r, basedn, LDB_SCOPE_BASE,
1162 fsmo_attrs, "(objectClass=*)");
1163 talloc_free(basedn);
1164 if (ret != LDB_SUCCESS) {
1165 return NT_STATUS_LDAP(ret);
1166 } else if (r->count != 1) {
1167 talloc_free(r);
1168 return NT_STATUS_INVALID_NETWORK_RESPONSE;
1169 }
1170
1171 s->rid_manager_fsmo.ntds_dn_str = samdb_result_string(r->msgs[0], "fSMORoleOwner", NULL);
1172 if (!s->rid_manager_fsmo.ntds_dn_str) return NT_STATUS_INVALID_NETWORK_RESPONSE;
1173 talloc_steal(s, s->rid_manager_fsmo.ntds_dn_str);
1174
1175 talloc_free(r);
1176
1177 ntds_dn = ldb_dn_new(s, s->ldap1.ldb, s->rid_manager_fsmo.ntds_dn_str);
1178 NT_STATUS_HAVE_NO_MEMORY(ntds_dn);
1179
1180 server_dn = ldb_dn_get_parent(s, ntds_dn);
1181 NT_STATUS_HAVE_NO_MEMORY(server_dn);
1182
1183 s->rid_manager_fsmo.server_dn_str = ldb_dn_alloc_linearized(s, server_dn);
1184 NT_STATUS_HAVE_NO_MEMORY(s->rid_manager_fsmo.server_dn_str);
1185
1186 ret = ldb_search(s->ldap1.ldb, s, &r, server_dn, LDB_SCOPE_BASE,
1187 dns_attrs, "(objectClass=*)");
1188 if (ret != LDB_SUCCESS) {
1189 return NT_STATUS_LDAP(ret);
1190 } else if (r->count != 1) {
1191 talloc_free(r);
1192 return NT_STATUS_INVALID_NETWORK_RESPONSE;
1193 }
1194
1195 s->rid_manager_fsmo.dns_name = samdb_result_string(r->msgs[0], "dnsHostName", NULL);
1196 if (!s->rid_manager_fsmo.dns_name) return NT_STATUS_INVALID_NETWORK_RESPONSE;
1197 talloc_steal(s, s->rid_manager_fsmo.dns_name);
1198
1199 talloc_free(r);
1200
1201 ret = ldb_search(s->ldap1.ldb, s, &r, ntds_dn, LDB_SCOPE_BASE,
1202 guid_attrs, "(objectClass=*)");
1203 if (ret != LDB_SUCCESS) {
1204 return NT_STATUS_LDAP(ret);
1205 } else if (r->count != 1) {
1206 talloc_free(r);
1207 return NT_STATUS_INVALID_NETWORK_RESPONSE;
1208 }
1209
1210 s->rid_manager_fsmo.ntds_guid = samdb_result_guid(r->msgs[0], "objectGUID");
1211
1212 talloc_free(r);
1213
1214 return NT_STATUS_OK;
1215 }
1216
1217 static NTSTATUS becomeDC_ldap1_site_object(struct libnet_BecomeDC_state *s)
1218 {
1219 int ret;
1220 struct ldb_result *r;
1221 struct ldb_dn *basedn;
1222
1223 basedn = ldb_dn_new_fmt(s, s->ldap1.ldb, "CN=%s,CN=Sites,%s",
1224 s->dest_dsa.site_name,
1225 s->forest.config_dn_str);
1226 NT_STATUS_HAVE_NO_MEMORY(basedn);
1227
1228 ret = ldb_search(s->ldap1.ldb, s, &r, basedn, LDB_SCOPE_BASE,
1229 NULL, "(objectClass=*)");
1230 talloc_free(basedn);
1231 if (ret != LDB_SUCCESS) {
1232 return NT_STATUS_LDAP(ret);
1233 } else if (r->count != 1) {
1234 talloc_free(r);
1235 return NT_STATUS_INVALID_NETWORK_RESPONSE;
1236 }
1237
1238 s->dest_dsa.site_guid = samdb_result_guid(r->msgs[0], "objectGUID");
1239
1240 talloc_free(r);
1241 return NT_STATUS_OK;
1242 }
1243
1244 static NTSTATUS becomeDC_check_options(struct libnet_BecomeDC_state *s)
1245 {
1246 if (!s->callbacks.check_options) return NT_STATUS_OK;
1247
1248 s->_co.domain = &s->domain;
1249 s->_co.forest = &s->forest;
1250 s->_co.source_dsa = &s->source_dsa;
1251
1252 return s->callbacks.check_options(s->callbacks.private_data, &s->_co);
1253 }
1254
1255 static NTSTATUS becomeDC_ldap1_computer_object(struct libnet_BecomeDC_state *s)
1256 {
1257 int ret;
1258 struct ldb_result *r;
1259 struct ldb_dn *basedn;
1260 static const char *attrs[] = {
1261 "distinguishedName",
1262 "userAccountControl",
1263 NULL
1264 };
1265
1266 basedn = ldb_dn_new(s, s->ldap1.ldb, s->domain.dn_str);
1267 NT_STATUS_HAVE_NO_MEMORY(basedn);
1268
1269 ret = ldb_search(s->ldap1.ldb, s, &r, basedn, LDB_SCOPE_SUBTREE, attrs,
1270 "(&(|(objectClass=user)(objectClass=computer))(sAMAccountName=%s$))",
1271 s->dest_dsa.netbios_name);
1272 talloc_free(basedn);
1273 if (ret != LDB_SUCCESS) {
1274 return NT_STATUS_LDAP(ret);
1275 } else if (r->count != 1) {
1276 talloc_free(r);
1277 return NT_STATUS_INVALID_NETWORK_RESPONSE;
1278 }
1279
1280 s->dest_dsa.computer_dn_str = samdb_result_string(r->msgs[0], "distinguishedName", NULL);
1281 if (!s->dest_dsa.computer_dn_str) return NT_STATUS_INVALID_NETWORK_RESPONSE;
1282 talloc_steal(s, s->dest_dsa.computer_dn_str);
1283
1284 s->dest_dsa.user_account_control = samdb_result_uint(r->msgs[0], "userAccountControl", 0);
1285
1286 talloc_free(r);
1287 return NT_STATUS_OK;
1288 }
1289
1290 static NTSTATUS becomeDC_ldap1_server_object_1(struct libnet_BecomeDC_state *s)
1291 {
1292 int ret;
1293 struct ldb_result *r;
1294 struct ldb_dn *basedn;
1295 const char *server_reference_dn_str;
1296 struct ldb_dn *server_reference_dn;
1297 struct ldb_dn *computer_dn;
1298
1299 basedn = ldb_dn_new_fmt(s, s->ldap1.ldb, "CN=%s,CN=Servers,CN=%s,CN=Sites,%s",
1300 s->dest_dsa.netbios_name,
1301 s->dest_dsa.site_name,
1302 s->forest.config_dn_str);
1303 NT_STATUS_HAVE_NO_MEMORY(basedn);
1304
1305 ret = ldb_search(s->ldap1.ldb, s, &r, basedn, LDB_SCOPE_BASE,
1306 NULL, "(objectClass=*)");
1307 talloc_free(basedn);
1308 if (ret == LDB_ERR_NO_SUCH_OBJECT) {
1309 /* if the object doesn't exist, we'll create it later */
1310 return NT_STATUS_OK;
1311 } else if (ret != LDB_SUCCESS) {
1312 return NT_STATUS_LDAP(ret);
1313 } else if (r->count != 1) {
1314 talloc_free(r);
1315 return NT_STATUS_INVALID_NETWORK_RESPONSE;
1316 }
1317
1318 server_reference_dn_str = samdb_result_string(r->msgs[0], "serverReference", NULL);
1319 if (server_reference_dn_str) {
1320 server_reference_dn = ldb_dn_new(r, s->ldap1.ldb, server_reference_dn_str);
1321 NT_STATUS_HAVE_NO_MEMORY(server_reference_dn);
1322
1323 computer_dn = ldb_dn_new(r, s->ldap1.ldb, s->dest_dsa.computer_dn_str);
1324 NT_STATUS_HAVE_NO_MEMORY(computer_dn);
1325
1326 /*
1327 * if the server object belongs to another DC in another domain
1328 * in the forest, we should not touch this object!
1329 */
1330 if (ldb_dn_compare(computer_dn, server_reference_dn) != 0) {
1331 talloc_free(r);
1332 return NT_STATUS_OBJECT_NAME_COLLISION;
1333 }
1334 }
1335
1336 /* if the server object is already for the dest_dsa, then we don't need to create it */
1337 s->dest_dsa.server_dn_str = samdb_result_string(r->msgs[0], "distinguishedName", NULL);
1338 if (!s->dest_dsa.server_dn_str) return NT_STATUS_INVALID_NETWORK_RESPONSE;
1339 talloc_steal(s, s->dest_dsa.server_dn_str);
1340
1341 talloc_free(r);
1342 return NT_STATUS_OK;
1343 }
1344
1345 static NTSTATUS becomeDC_ldap1_server_object_2(struct libnet_BecomeDC_state *s)
1346 {
1347 int ret;
1348 struct ldb_result *r;
1349 struct ldb_dn *basedn;
1350 const char *server_reference_bl_dn_str;
1351 static const char *attrs[] = {
1352 "serverReferenceBL",
1353 NULL
1354 };
1355
1356 /* if the server_dn_str has a valid value, we skip this lookup */
1357 if (s->dest_dsa.server_dn_str) return NT_STATUS_OK;
1358
1359 basedn = ldb_dn_new(s, s->ldap1.ldb, s->dest_dsa.computer_dn_str);
1360 NT_STATUS_HAVE_NO_MEMORY(basedn);
1361
1362 ret = ldb_search(s->ldap1.ldb, s, &r, basedn, LDB_SCOPE_BASE,
1363 attrs, "(objectClass=*)");
1364 talloc_free(basedn);
1365 if (ret != LDB_SUCCESS) {
1366 return NT_STATUS_LDAP(ret);
1367 } else if (r->count != 1) {
1368 talloc_free(r);
1369 return NT_STATUS_INVALID_NETWORK_RESPONSE;
1370 }
1371
1372 server_reference_bl_dn_str = samdb_result_string(r->msgs[0], "serverReferenceBL", NULL);
1373 if (!server_reference_bl_dn_str) {
1374 /* if no back link is present, we're done for this function */
1375 talloc_free(r);
1376 return NT_STATUS_OK;
1377 }
1378
1379 /* if the server object is already for the dest_dsa, then we don't need to create it */
1380 s->dest_dsa.server_dn_str = samdb_result_string(r->msgs[0], "serverReferenceBL", NULL);
1381 if (s->dest_dsa.server_dn_str) {
1382 /* if a back link is present, we know that the server object is present */
1383 talloc_steal(s, s->dest_dsa.server_dn_str);
1384 }
1385
1386 talloc_free(r);
1387 return NT_STATUS_OK;
1388 }
1389
1390 static NTSTATUS becomeDC_ldap1_server_object_add(struct libnet_BecomeDC_state *s)
1391 {
1392 int ret;
1393 struct ldb_message *msg;
1394 char *server_dn_str;
1395
1396 /* if the server_dn_str has a valid value, we skip this lookup */
1397 if (s->dest_dsa.server_dn_str) return NT_STATUS_OK;
1398
1399 msg = ldb_msg_new(s);
1400 NT_STATUS_HAVE_NO_MEMORY(msg);
1401
1402 msg->dn = ldb_dn_new_fmt(msg, s->ldap1.ldb, "CN=%s,CN=Servers,CN=%s,CN=Sites,%s",
1403 s->dest_dsa.netbios_name,
1404 s->dest_dsa.site_name,
1405 s->forest.config_dn_str);
1406 NT_STATUS_HAVE_NO_MEMORY(msg->dn);
1407
1408 ret = ldb_msg_add_string(msg, "objectClass", "server");
1409 if (ret != 0) {
1410 talloc_free(msg);
1411 return NT_STATUS_NO_MEMORY;
1412 }
1413 ret = ldb_msg_add_string(msg, "systemFlags", "50000000");
1414 if (ret != 0) {
1415 talloc_free(msg);
1416 return NT_STATUS_NO_MEMORY;
1417 }
1418 ret = ldb_msg_add_string(msg, "serverReference", s->dest_dsa.computer_dn_str);
1419 if (ret != 0) {
1420 talloc_free(msg);
1421 return NT_STATUS_NO_MEMORY;
1422 }
1423
1424 server_dn_str = ldb_dn_alloc_linearized(s, msg->dn);
1425 NT_STATUS_HAVE_NO_MEMORY(server_dn_str);
1426
1427 ret = ldb_add(s->ldap1.ldb, msg);
1428 talloc_free(msg);
1429 if (ret != LDB_SUCCESS) {
1430 talloc_free(server_dn_str);
1431 return NT_STATUS_LDAP(ret);
1432 }
1433
1434 s->dest_dsa.server_dn_str = server_dn_str;
1435
1436 return NT_STATUS_OK;
1437 }
1438
1439 static NTSTATUS becomeDC_ldap1_server_object_modify(struct libnet_BecomeDC_state *s)
1440 {
1441 int ret;
1442 struct ldb_message *msg;
1443 uint32_t i;
1444
1445 /* make a 'modify' msg, and only for serverReference */
1446 msg = ldb_msg_new(s);
1447 NT_STATUS_HAVE_NO_MEMORY(msg);
1448 msg->dn = ldb_dn_new(msg, s->ldap1.ldb, s->dest_dsa.server_dn_str);
1449 NT_STATUS_HAVE_NO_MEMORY(msg->dn);
1450
1451 ret = ldb_msg_add_string(msg, "serverReference", s->dest_dsa.computer_dn_str);
1452 if (ret != 0) {
1453 talloc_free(msg);
1454 return NT_STATUS_NO_MEMORY;
1455 }
1456
1457 /* mark all the message elements (should be just one)
1458 as LDB_FLAG_MOD_ADD */
1459 for (i=0;i<msg->num_elements;i++) {
1460 msg->elements[i].flags = LDB_FLAG_MOD_ADD;
1461 }
1462
1463 ret = ldb_modify(s->ldap1.ldb, msg);
1464 if (ret == LDB_SUCCESS) {
1465 talloc_free(msg);
1466 return NT_STATUS_OK;
1467 } else if (ret == LDB_ERR_ATTRIBUTE_OR_VALUE_EXISTS) {
1468 /* retry with LDB_FLAG_MOD_REPLACE */
1469 } else {
1470 talloc_free(msg);
1471 return NT_STATUS_LDAP(ret);
1472 }
1473
1474 /* mark all the message elements (should be just one)
1475 as LDB_FLAG_MOD_REPLACE */
1476 for (i=0;i<msg->num_elements;i++) {
1477 msg->elements[i].flags = LDB_FLAG_MOD_REPLACE;
1478 }
1479
1480 ret = ldb_modify(s->ldap1.ldb, msg);
1481 talloc_free(msg);
1482 if (ret != LDB_SUCCESS) {
1483 return NT_STATUS_LDAP(ret);
1484 }
1485
1486 return NT_STATUS_OK;
1487 }
1488
1489 static void becomeDC_drsuapi_connect_send(struct libnet_BecomeDC_state *s,
1490 struct becomeDC_drsuapi *drsuapi,
1491 void (*recv_fn)(struct composite_context *req));
1492 static void becomeDC_drsuapi1_connect_recv(struct composite_context *req);
1493 static void becomeDC_connect_ldap2(struct libnet_BecomeDC_state *s);
1494
1495 static void becomeDC_connect_ldap1(struct libnet_BecomeDC_state *s)
1496 {
1497 struct composite_context *c = s->creq;
1498
1499 c->status = becomeDC_ldap_connect(s, &s->ldap1);
1500 if (!composite_is_ok(c)) return;
1501
1502 c->status = becomeDC_ldap1_rootdse(s);
1503 if (!composite_is_ok(c)) return;
1504
1505 c->status = becomeDC_ldap1_crossref_behavior_version(s);
1506 if (!composite_is_ok(c)) return;
1507
1508 c->status = becomeDC_ldap1_domain_behavior_version(s);
1509 if (!composite_is_ok(c)) return;
1510
1511 c->status = becomeDC_ldap1_schema_object_version(s);
1512 if (!composite_is_ok(c)) return;
1513
1514 c->status = becomeDC_ldap1_w2k3_update_revision(s);
1515 if (!composite_is_ok(c)) return;
1516
1517 c->status = becomeDC_ldap1_infrastructure_fsmo(s);
1518 if (!composite_is_ok(c)) return;
1519
1520 c->status = becomeDC_ldap1_rid_manager_fsmo(s);
1521 if (!composite_is_ok(c)) return;
1522
1523 c->status = becomeDC_ldap1_site_object(s);
1524 if (!composite_is_ok(c)) return;
1525
1526 c->status = becomeDC_check_options(s);
1527 if (!composite_is_ok(c)) return;
1528
1529 c->status = becomeDC_ldap1_computer_object(s);
1530 if (!composite_is_ok(c)) return;
1531
1532 c->status = becomeDC_ldap1_server_object_1(s);
1533 if (!composite_is_ok(c)) return;
1534
1535 c->status = becomeDC_ldap1_server_object_2(s);
1536 if (!composite_is_ok(c)) return;
1537
1538 c->status = becomeDC_ldap1_server_object_add(s);
1539 if (!composite_is_ok(c)) return;
1540
1541 c->status = becomeDC_ldap1_server_object_modify(s);
1542 if (!composite_is_ok(c)) return;
1543
1544 becomeDC_drsuapi_connect_send(s, &s->drsuapi1, becomeDC_drsuapi1_connect_recv);
1545 }
1546
1547 static void becomeDC_drsuapi_connect_send(struct libnet_BecomeDC_state *s,
1548 struct becomeDC_drsuapi *drsuapi,
1549 void (*recv_fn)(struct composite_context *req))
1550 {
1551 struct composite_context *c = s->creq;
1552 struct composite_context *creq;
1553 char *binding_str;
1554
1555 drsuapi->s = s;
1556
1557 if (!drsuapi->binding) {
1558 const char *krb5_str = "";
1559 const char *print_str = "";
1560 /*
1561 * Note: Replication only works with Windows 2000 when 'krb5' is
1562 * passed as auth_type here. If NTLMSSP is used, Windows
1563 * 2000 returns garbage in the DsGetNCChanges() response
1564 * if encrypted password attributes would be in the
1565 * response. That means the replication of the schema and
1566 * configuration partition works fine, but it fails for
1567 * the domain partition.
1568 */
1569 if (lp_parm_bool(s->libnet->lp_ctx, NULL, "become_dc",
1570 "force krb5", true))
1571 {
1572 krb5_str = "krb5,";
1573 }
1574 if (lp_parm_bool(s->libnet->lp_ctx, NULL, "become_dc",
1575 "print", false))
1576 {
1577 print_str = "print,";
1578 }
1579 binding_str = talloc_asprintf(s, "ncacn_ip_tcp:%s[%s%sseal]",
1580 s->source_dsa.dns_name,
1581 krb5_str, print_str);
1582 if (composite_nomem(binding_str, c)) return;
1583 c->status = dcerpc_parse_binding(s, binding_str, &drsuapi->binding);
1584 talloc_free(binding_str);
1585 if (!composite_is_ok(c)) return;
1586 }
1587
1588 creq = dcerpc_pipe_connect_b_send(s, drsuapi->binding, &ndr_table_drsuapi,
1589 s->libnet->cred, s->libnet->event_ctx,
1590 s->libnet->lp_ctx);
1591 composite_continue(c, creq, recv_fn, s);
1592 }
1593
1594 static void becomeDC_drsuapi_bind_send(struct libnet_BecomeDC_state *s,
1595 struct becomeDC_drsuapi *drsuapi,
1596 void (*recv_fn)(struct rpc_request *req));
1597 static void becomeDC_drsuapi1_bind_recv(struct rpc_request *req);
1598
1599 static void becomeDC_drsuapi1_connect_recv(struct composite_context *req)
1600 {
1601 struct libnet_BecomeDC_state *s = talloc_get_type(req->async.private_data,
1602 struct libnet_BecomeDC_state);
1603 struct composite_context *c = s->creq;
1604
1605 c->status = dcerpc_pipe_connect_b_recv(req, s, &s->drsuapi1.pipe);
1606 if (!composite_is_ok(c)) return;
1607
1608 c->status = gensec_session_key(s->drsuapi1.pipe->conn->security_state.generic_state,
1609 &s->drsuapi1.gensec_skey);
1610 if (!composite_is_ok(c)) return;
1611
1612 becomeDC_drsuapi_bind_send(s, &s->drsuapi1, becomeDC_drsuapi1_bind_recv);
1613 }
1614
1615 static void becomeDC_drsuapi_bind_send(struct libnet_BecomeDC_state *s,
1616 struct becomeDC_drsuapi *drsuapi,
1617 void (*recv_fn)(struct rpc_request *req))
1618 {
1619 struct composite_context *c = s->creq;
1620 struct rpc_request *req;
1621 struct drsuapi_DsBindInfo28 *bind_info28;
1622
1623 GUID_from_string(DRSUAPI_DS_BIND_GUID_W2K3, &drsuapi->bind_guid);
1624
1625 bind_info28 = &drsuapi->local_info28;
1626 bind_info28->supported_extensions |= DRSUAPI_SUPPORTED_EXTENSION_BASE;
1627 bind_info28->supported_extensions |= DRSUAPI_SUPPORTED_EXTENSION_ASYNC_REPLICATION;
1628 bind_info28->supported_extensions |= DRSUAPI_SUPPORTED_EXTENSION_REMOVEAPI;
1629 bind_info28->supported_extensions |= DRSUAPI_SUPPORTED_EXTENSION_MOVEREQ_V2;
1630 bind_info28->supported_extensions |= DRSUAPI_SUPPORTED_EXTENSION_GETCHG_COMPRESS;
1631 bind_info28->supported_extensions |= DRSUAPI_SUPPORTED_EXTENSION_DCINFO_V1;
1632 bind_info28->supported_extensions |= DRSUAPI_SUPPORTED_EXTENSION_RESTORE_USN_OPTIMIZATION;
1633 bind_info28->supported_extensions |= DRSUAPI_SUPPORTED_EXTENSION_KCC_EXECUTE;
1634 bind_info28->supported_extensions |= DRSUAPI_SUPPORTED_EXTENSION_ADDENTRY_V2;
1635 if (s->domain.behavior_version >= DS_DOMAIN_FUNCTION_2003) {
1636 /* TODO: find out how this is really triggered! */
1637 bind_info28->supported_extensions |= DRSUAPI_SUPPORTED_EXTENSION_LINKED_VALUE_REPLICATION;
1638 }
1639 bind_info28->supported_extensions |= DRSUAPI_SUPPORTED_EXTENSION_DCINFO_V2;
1640 bind_info28->supported_extensions |= DRSUAPI_SUPPORTED_EXTENSION_INSTANCE_TYPE_NOT_REQ_ON_MOD;
1641 bind_info28->supported_extensions |= DRSUAPI_SUPPORTED_EXTENSION_CRYPTO_BIND;
1642 bind_info28->supported_extensions |= DRSUAPI_SUPPORTED_EXTENSION_GET_REPL_INFO;
1643 bind_info28->supported_extensions |= DRSUAPI_SUPPORTED_EXTENSION_STRONG_ENCRYPTION;
1644 bind_info28->supported_extensions |= DRSUAPI_SUPPORTED_EXTENSION_DCINFO_V01;
1645 bind_info28->supported_extensions |= DRSUAPI_SUPPORTED_EXTENSION_TRANSITIVE_MEMBERSHIP;
1646 bind_info28->supported_extensions |= DRSUAPI_SUPPORTED_EXTENSION_ADD_SID_HISTORY;
1647 bind_info28->supported_extensions |= DRSUAPI_SUPPORTED_EXTENSION_POST_BETA3;
1648 bind_info28->supported_extensions |= DRSUAPI_SUPPORTED_EXTENSION_00100000;
1649 bind_info28->supported_extensions |= DRSUAPI_SUPPORTED_EXTENSION_GET_MEMBERSHIPS2;
1650 bind_info28->supported_extensions |= DRSUAPI_SUPPORTED_EXTENSION_GETCHGREQ_V6;
1651 bind_info28->supported_extensions |= DRSUAPI_SUPPORTED_EXTENSION_NONDOMAIN_NCS;
1652 bind_info28->supported_extensions |= DRSUAPI_SUPPORTED_EXTENSION_GETCHGREQ_V8;
1653 bind_info28->supported_extensions |= DRSUAPI_SUPPORTED_EXTENSION_GETCHGREPLY_V5;
1654 bind_info28->supported_extensions |= DRSUAPI_SUPPORTED_EXTENSION_GETCHGREPLY_V6;
1655 bind_info28->supported_extensions |= DRSUAPI_SUPPORTED_EXTENSION_ADDENTRYREPLY_V3;
1656 bind_info28->supported_extensions |= DRSUAPI_SUPPORTED_EXTENSION_GETCHGREPLY_V7;
1657 bind_info28->supported_extensions |= DRSUAPI_SUPPORTED_EXTENSION_VERIFY_OBJECT;
1658 #if 0 /* we don't support XPRESS compression yet */
1659 bind_info28->supported_extensions |= DRSUAPI_SUPPORTED_EXTENSION_XPRESS_COMPRESS;
1660 #endif
1661 bind_info28->site_guid = s->dest_dsa.site_guid;
1662 bind_info28->pid = 0;
1663 bind_info28->repl_epoch = 0;
1664
1665 drsuapi->bind_info_ctr.length = 28;
1666 drsuapi->bind_info_ctr.info.info28 = *bind_info28;
1667
1668 drsuapi->bind_r.in.bind_guid = &drsuapi->bind_guid;
1669 drsuapi->bind_r.in.bind_info = &drsuapi->bind_info_ctr;
1670 drsuapi->bind_r.out.bind_handle = &drsuapi->bind_handle;
1671
1672 req = dcerpc_drsuapi_DsBind_send(drsuapi->pipe, s, &drsuapi->bind_r);
1673 composite_continue_rpc(c, req, recv_fn, s);
1674 }
1675
1676 static WERROR becomeDC_drsuapi_bind_recv(struct libnet_BecomeDC_state *s,
1677 struct becomeDC_drsuapi *drsuapi)
1678 {
1679 if (!W_ERROR_IS_OK(drsuapi->bind_r.out.result)) {
1680 return drsuapi->bind_r.out.result;
1681 }
1682
1683 ZERO_STRUCT(drsuapi->remote_info28);
1684 if (drsuapi->bind_r.out.bind_info) {
1685 switch (drsuapi->bind_r.out.bind_info->length) {
1686 case 24: {
1687 struct drsuapi_DsBindInfo24 *info24;
1688 info24 = &drsuapi->bind_r.out.bind_info->info.info24;
1689 drsuapi->remote_info28.supported_extensions = info24->supported_extensions;
1690 drsuapi->remote_info28.site_guid = info24->site_guid;
1691 drsuapi->remote_info28.pid = info24->pid;
1692 drsuapi->remote_info28.repl_epoch = 0;
1693 break;
1694 }
1695 case 48: {
1696 struct drsuapi_DsBindInfo48 *info48;
1697 info48 = &drsuapi->bind_r.out.bind_info->info.info48;
1698 drsuapi->remote_info28.supported_extensions = info48->supported_extensions;
1699 drsuapi->remote_info28.site_guid = info48->site_guid;
1700 drsuapi->remote_info28.pid = info48->pid;
1701 drsuapi->remote_info28.repl_epoch = info48->repl_epoch;
1702 break;
1703 }
1704 case 28:
1705 drsuapi->remote_info28 = drsuapi->bind_r.out.bind_info->info.info28;
1706 break;
1707 }
1708 }
1709
1710 return WERR_OK;
1711 }
1712
1713 static void becomeDC_drsuapi1_add_entry_send(struct libnet_BecomeDC_state *s);
1714
1715 static void becomeDC_drsuapi1_bind_recv(struct rpc_request *req)
1716 {
1717 struct libnet_BecomeDC_state *s = talloc_get_type(req->async.private_data,
1718 struct libnet_BecomeDC_state);
1719 struct composite_context *c = s->creq;
1720 WERROR status;
1721
1722 bool print = false;
1723
1724 if (req->p->conn->flags & DCERPC_DEBUG_PRINT_OUT) {
1725 print = true;
1726 }
1727
1728 c->status = dcerpc_ndr_request_recv(req);
1729 if (!composite_is_ok(c)) return;
1730
1731 if (print) {
1732 NDR_PRINT_OUT_DEBUG(drsuapi_DsBind, &s->drsuapi1.bind_r);
1733 }
1734
1735 status = becomeDC_drsuapi_bind_recv(s, &s->drsuapi1);
1736 if (!W_ERROR_IS_OK(status)) {
1737 composite_error(c, werror_to_ntstatus(status));
1738 return;
1739 }
1740
1741 becomeDC_drsuapi1_add_entry_send(s);
1742 }
1743
1744 static void becomeDC_drsuapi1_add_entry_recv(struct rpc_request *req);
1745
1746 static void becomeDC_drsuapi1_add_entry_send(struct libnet_BecomeDC_state *s)
1747 {
1748 struct composite_context *c = s->creq;
1749 struct rpc_request *req;
1750 struct drsuapi_DsAddEntry *r;
1751 struct drsuapi_DsReplicaObjectIdentifier *identifier;
1752 uint32_t num_attrs, i = 0;
1753 struct drsuapi_DsReplicaAttribute *attrs;
1754 struct smb_iconv_convenience *iconv_convenience = lp_iconv_convenience(s->libnet->lp_ctx);
1755 enum ndr_err_code ndr_err;
1756 bool w2k3;
1757
1758 /* choose a random invocationId */
1759 s->dest_dsa.invocation_id = GUID_random();
1760
1761 /*
1762 * if the schema version indicates w2k3, then also send some w2k3
1763 * specific attributes.
1764 */
1765 if (s->forest.schema_object_version >= 30) {
1766 w2k3 = true;
1767 } else {
1768 w2k3 = false;
1769 }
1770
1771 r = talloc_zero(s, struct drsuapi_DsAddEntry);
1772 if (composite_nomem(r, c)) return;
1773
1774 /* setup identifier */
1775 identifier = talloc(r, struct drsuapi_DsReplicaObjectIdentifier);
1776 if (composite_nomem(identifier, c)) return;
1777 identifier->guid = GUID_zero();
1778 identifier->sid = s->zero_sid;
1779 identifier->dn = talloc_asprintf(identifier, "CN=NTDS Settings,%s",
1780 s->dest_dsa.server_dn_str);
1781 if (composite_nomem(identifier->dn, c)) return;
1782
1783 /* allocate attribute array */
1784 num_attrs = 11;
1785 attrs = talloc_array(r, struct drsuapi_DsReplicaAttribute, num_attrs);
1786 if (composite_nomem(attrs, c)) return;
1787
1788 /* ntSecurityDescriptor */
1789 {
1790 struct drsuapi_DsAttributeValue *vs;
1791 DATA_BLOB *vd;
1792 struct security_descriptor *v;
1793 struct dom_sid *domain_admins_sid;
1794 const char *domain_admins_sid_str;
1795
1796 vs = talloc_array(attrs, struct drsuapi_DsAttributeValue, 1);
1797 if (composite_nomem(vs, c)) return;
1798
1799 vd = talloc_array(vs, DATA_BLOB, 1);
1800 if (composite_nomem(vd, c)) return;
1801
1802 domain_admins_sid = dom_sid_add_rid(vs, s->domain.sid, DOMAIN_RID_ADMINS);
1803 if (composite_nomem(domain_admins_sid, c)) return;
1804
1805 domain_admins_sid_str = dom_sid_string(domain_admins_sid, domain_admins_sid);
1806 if (composite_nomem(domain_admins_sid_str, c)) return;
1807
1808 v = security_descriptor_dacl_create(vd,
1809 0,
1810 /* owner: domain admins */
1811 domain_admins_sid_str,
1812 /* owner group: domain admins */
1813 domain_admins_sid_str,
1814 /* authenticated users */
1815 SID_NT_AUTHENTICATED_USERS,
1816 SEC_ACE_TYPE_ACCESS_ALLOWED,
1817 SEC_STD_READ_CONTROL |
1818 SEC_ADS_LIST |
1819 SEC_ADS_READ_PROP |
1820 SEC_ADS_LIST_OBJECT,
1821 0,
1822 /* domain admins */
1823 domain_admins_sid_str,
1824 SEC_ACE_TYPE_ACCESS_ALLOWED,
1825 SEC_STD_REQUIRED |
1826 SEC_ADS_CREATE_CHILD |
1827 SEC_ADS_LIST |
1828 SEC_ADS_SELF_WRITE |
1829 SEC_ADS_READ_PROP |
1830 SEC_ADS_WRITE_PROP |
1831 SEC_ADS_DELETE_TREE |
1832 SEC_ADS_LIST_OBJECT |
1833 SEC_ADS_CONTROL_ACCESS,
1834 0,
1835 /* system */
1836 SID_NT_SYSTEM,
1837 SEC_ACE_TYPE_ACCESS_ALLOWED,
1838 SEC_STD_REQUIRED |
1839 SEC_ADS_CREATE_CHILD |
1840 SEC_ADS_DELETE_CHILD |
1841 SEC_ADS_LIST |
1842 SEC_ADS_SELF_WRITE |
1843 SEC_ADS_READ_PROP |
1844 SEC_ADS_WRITE_PROP |
1845 SEC_ADS_DELETE_TREE |
1846 SEC_ADS_LIST_OBJECT |
1847 SEC_ADS_CONTROL_ACCESS,
1848 0,
1849 /* end */
1850 NULL);
1851 if (composite_nomem(v, c)) return;
1852
1853 ndr_err = ndr_push_struct_blob(&vd[0], vd, iconv_convenience, v,(ndr_push_flags_fn_t)ndr_push_security_descriptor);
1854 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
1855 c->status = ndr_map_error2ntstatus(ndr_err);
1856 if (!composite_is_ok(c)) return;
1857 }
1858
1859 vs[0].blob = &vd[0];
1860
1861 attrs[i].attid = DRSUAPI_ATTRIBUTE_ntSecurityDescriptor;
1862 attrs[i].value_ctr.num_values = 1;
1863 attrs[i].value_ctr.values = vs;
1864
1865 i++;
1866 }
1867
1868 /* objectClass: nTDSDSA */
1869 {
1870 struct drsuapi_DsAttributeValue *vs;
1871 DATA_BLOB *vd;
1872
1873 vs = talloc_array(attrs, struct drsuapi_DsAttributeValue, 1);
1874 if (composite_nomem(vs, c)) return;
1875
1876 vd = talloc_array(vs, DATA_BLOB, 1);
1877 if (composite_nomem(vd, c)) return;
1878
1879 vd[0] = data_blob_talloc(vd, NULL, 4);
1880 if (composite_nomem(vd[0].data, c)) return;
1881
1882 /* value for nTDSDSA */
1883 SIVAL(vd[0].data, 0, 0x0017002F);
1884
1885 vs[0].blob = &vd[0];
1886
1887 attrs[i].attid = DRSUAPI_ATTRIBUTE_objectClass;
1888 attrs[i].value_ctr.num_values = 1;
1889 attrs[i].value_ctr.values = vs;
1890
1891 i++;
1892 }
1893
1894 /* objectCategory: CN=NTDS-DSA,CN=Schema,... */
1895 {
1896 struct drsuapi_DsAttributeValue *vs;
1897 DATA_BLOB *vd;
1898 struct drsuapi_DsReplicaObjectIdentifier3 v[1];
1899
1900 vs = talloc_array(attrs, struct drsuapi_DsAttributeValue, 1);
1901 if (composite_nomem(vs, c)) return;
1902
1903 vd = talloc_array(vs, DATA_BLOB, 1);
1904 if (composite_nomem(vd, c)) return;
1905
1906 v[0].guid = GUID_zero();
1907 v[0].sid = s->zero_sid;
1908 v[0].dn = talloc_asprintf(vd, "CN=NTDS-DSA,%s",
1909 s->forest.schema_dn_str);
1910 if (composite_nomem(v[0].dn, c)) return;
1911
1912 ndr_err = ndr_push_struct_blob(&vd[0], vd, iconv_convenience, &v[0],
1913 (ndr_push_flags_fn_t)ndr_push_drsuapi_DsReplicaObjectIdentifier3);
1914 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
1915 c->status = ndr_map_error2ntstatus(ndr_err);
1916 if (!composite_is_ok(c)) return;
1917 }
1918
1919 vs[0].blob = &vd[0];
1920
1921 attrs[i].attid = DRSUAPI_ATTRIBUTE_objectCategory;
1922 attrs[i].value_ctr.num_values = 1;
1923 attrs[i].value_ctr.values = vs;
1924
1925 i++;
1926 }
1927
1928 /* invocationId: random guid */
1929 {
1930 struct drsuapi_DsAttributeValue *vs;
1931 DATA_BLOB *vd;
1932 const struct GUID *v;
1933
1934 vs = talloc_array(attrs, struct drsuapi_DsAttributeValue, 1);
1935 if (composite_nomem(vs, c)) return;
1936
1937 vd = talloc_array(vs, DATA_BLOB, 1);
1938 if (composite_nomem(vd, c)) return;
1939
1940 v = &s->dest_dsa.invocation_id;
1941
1942 ndr_err = ndr_push_struct_blob(&vd[0], vd, iconv_convenience, v, (ndr_push_flags_fn_t)ndr_push_GUID);
1943 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
1944 c->status = ndr_map_error2ntstatus(ndr_err);
1945 if (!composite_is_ok(c)) return;
1946 }
1947
1948 vs[0].blob = &vd[0];
1949
1950 attrs[i].attid = DRSUAPI_ATTRIBUTE_invocationId;
1951 attrs[i].value_ctr.num_values = 1;
1952 attrs[i].value_ctr.values = vs;
1953
1954 i++;
1955 }
1956
1957 /* hasMasterNCs: ... */
1958 {
1959 struct drsuapi_DsAttributeValue *vs;
1960 DATA_BLOB *vd;
1961 struct drsuapi_DsReplicaObjectIdentifier3 v[3];
1962
1963 vs = talloc_array(attrs, struct drsuapi_DsAttributeValue, 3);
1964 if (composite_nomem(vs, c)) return;
1965
1966 vd = talloc_array(vs, DATA_BLOB, 3);
1967 if (composite_nomem(vd, c)) return;
1968
1969 v[0].guid = GUID_zero();
1970 v[0].sid = s->zero_sid;
1971 v[0].dn = s->forest.config_dn_str;
1972
1973 v[1].guid = GUID_zero();
1974 v[1].sid = s->zero_sid;
1975 v[1].dn = s->domain.dn_str;
1976
1977 v[2].guid = GUID_zero();
1978 v[2].sid = s->zero_sid;
1979 v[2].dn = s->forest.schema_dn_str;
1980
1981 ndr_err = ndr_push_struct_blob(&vd[0], vd, iconv_convenience, &v[0],
1982 (ndr_push_flags_fn_t)ndr_push_drsuapi_DsReplicaObjectIdentifier3);
1983 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
1984 c->status = ndr_map_error2ntstatus(ndr_err);
1985 if (!composite_is_ok(c)) return;
1986 }
1987
1988 ndr_err = ndr_push_struct_blob(&vd[1], vd, iconv_convenience, &v[1],
1989 (ndr_push_flags_fn_t)ndr_push_drsuapi_DsReplicaObjectIdentifier3);
1990 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
1991 c->status = ndr_map_error2ntstatus(ndr_err);
1992 if (!composite_is_ok(c)) return;
1993 }
1994
1995 ndr_err = ndr_push_struct_blob(&vd[2], vd, iconv_convenience, &v[2],
1996 (ndr_push_flags_fn_t)ndr_push_drsuapi_DsReplicaObjectIdentifier3);
1997 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
1998 c->status = ndr_map_error2ntstatus(ndr_err);
1999 if (!composite_is_ok(c)) return;
2000 }
2001
2002 vs[0].blob = &vd[0];
2003 vs[1].blob = &vd[1];
2004 vs[2].blob = &vd[2];
2005
2006 attrs[i].attid = DRSUAPI_ATTRIBUTE_hasMasterNCs;
2007 attrs[i].value_ctr.num_values = 3;
2008 attrs[i].value_ctr.values = vs;
2009
2010 i++;
2011 }
2012
2013 /* msDS-hasMasterNCs: ... */
2014 if (w2k3) {
2015 struct drsuapi_DsAttributeValue *vs;
2016 DATA_BLOB *vd;
2017 struct drsuapi_DsReplicaObjectIdentifier3 v[3];
2018
2019 vs = talloc_array(attrs, struct drsuapi_DsAttributeValue, 3);
2020 if (composite_nomem(vs, c)) return;
2021
2022 vd = talloc_array(vs, DATA_BLOB, 3);
2023 if (composite_nomem(vd, c)) return;
2024
2025 v[0].guid = GUID_zero();
2026 v[0].sid = s->zero_sid;
2027 v[0].dn = s->forest.config_dn_str;
2028
2029 v[1].guid = GUID_zero();
2030 v[1].sid = s->zero_sid;
2031 v[1].dn = s->domain.dn_str;
2032
2033 v[2].guid = GUID_zero();
2034 v[2].sid = s->zero_sid;
2035 v[2].dn = s->forest.schema_dn_str;
2036
2037 ndr_err = ndr_push_struct_blob(&vd[0], vd, iconv_convenience, &v[0],
2038 (ndr_push_flags_fn_t)ndr_push_drsuapi_DsReplicaObjectIdentifier3);
2039 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
2040 c->status = ndr_map_error2ntstatus(ndr_err);
2041 if (!composite_is_ok(c)) return;
2042 }
2043
2044 ndr_err = ndr_push_struct_blob(&vd[1], vd, iconv_convenience, &v[1],
2045 (ndr_push_flags_fn_t)ndr_push_drsuapi_DsReplicaObjectIdentifier3);
2046 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
2047 c->status = ndr_map_error2ntstatus(ndr_err);
2048 if (!composite_is_ok(c)) return;
2049 }
2050
2051 ndr_err = ndr_push_struct_blob(&vd[2], vd, iconv_convenience, &v[2],
2052 (ndr_push_flags_fn_t)ndr_push_drsuapi_DsReplicaObjectIdentifier3);
2053 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
2054 c->status = ndr_map_error2ntstatus(ndr_err);
2055 if (!composite_is_ok(c)) return;
2056 }
2057
2058 vs[0].blob = &vd[0];
2059 vs[1].blob = &vd[1];
2060 vs[2].blob = &vd[2];
2061
2062 attrs[i].attid = DRSUAPI_ATTRIBUTE_msDS_hasMasterNCs;
2063 attrs[i].value_ctr.num_values = 3;
2064 attrs[i].value_ctr.values = vs;
2065
2066 i++;
2067 }
2068
2069 /* dMDLocation: CN=Schema,... */
2070 {
2071 struct drsuapi_DsAttributeValue *vs;
2072 DATA_BLOB *vd;
2073 struct drsuapi_DsReplicaObjectIdentifier3 v[1];
2074
2075 vs = talloc_array(attrs, struct drsuapi_DsAttributeValue, 1);
2076 if (composite_nomem(vs, c)) return;
2077
2078 vd = talloc_array(vs, DATA_BLOB, 1);
2079 if (composite_nomem(vd, c)) return;
2080
2081 v[0].guid = GUID_zero();
2082 v[0].sid = s->zero_sid;
2083 v[0].dn = s->forest.schema_dn_str;
2084
2085 ndr_err = ndr_push_struct_blob(&vd[0], vd, iconv_convenience, &v[0],
2086 (ndr_push_flags_fn_t)ndr_push_drsuapi_DsReplicaObjectIdentifier3);
2087 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
2088 c->status = ndr_map_error2ntstatus(ndr_err);
2089 if (!composite_is_ok(c)) return;
2090 }
2091
2092 vs[0].blob = &vd[0];
2093
2094 attrs[i].attid = DRSUAPI_ATTRIBUTE_dMDLocation;
2095 attrs[i].value_ctr.num_values = 1;
2096 attrs[i].value_ctr.values = vs;
2097
2098 i++;
2099 }
2100
2101 /* msDS-HasDomainNCs: <domain_partition> */
2102 if (w2k3) {
2103 struct drsuapi_DsAttributeValue *vs;
2104 DATA_BLOB *vd;
2105 struct drsuapi_DsReplicaObjectIdentifier3 v[1];
2106
2107 vs = talloc_array(attrs, struct drsuapi_DsAttributeValue, 1);
2108 if (composite_nomem(vs, c)) return;
2109
2110 vd = talloc_array(vs, DATA_BLOB, 1);
2111 if (composite_nomem(vd, c)) return;
2112
2113 v[0].guid = GUID_zero();
2114 v[0].sid = s->zero_sid;
2115 v[0].dn = s->domain.dn_str;
2116
2117 ndr_err = ndr_push_struct_blob(&vd[0], vd, iconv_convenience, &v[0],
2118 (ndr_push_flags_fn_t)ndr_push_drsuapi_DsReplicaObjectIdentifier3);
2119 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
2120 c->status = ndr_map_error2ntstatus(ndr_err);
2121 if (!composite_is_ok(c)) return;
2122 }
2123
2124 vs[0].blob = &vd[0];
2125
2126 attrs[i].attid = DRSUAPI_ATTRIBUTE_msDS_HasDomainNCs;
2127 attrs[i].value_ctr.num_values = 1;
2128 attrs[i].value_ctr.values = vs;
2129
2130 i++;
2131 }
2132
2133 /* msDS-Behavior-Version */
2134 if (w2k3) {
2135 struct drsuapi_DsAttributeValue *vs;
2136 DATA_BLOB *vd;
2137
2138 vs = talloc_array(attrs, struct drsuapi_DsAttributeValue, 1);
2139 if (composite_nomem(vs, c)) return;
2140
2141 vd = talloc_array(vs, DATA_BLOB, 1);
2142 if (composite_nomem(vd, c)) return;
2143
2144 vd[0] = data_blob_talloc(vd, NULL, 4);
2145 if (composite_nomem(vd[0].data, c)) return;
2146
2147 SIVAL(vd[0].data, 0, get_dc_function_level(s->libnet->lp_ctx));
2148
2149 vs[0].blob = &vd[0];
2150
2151 attrs[i].attid = DRSUAPI_ATTRIBUTE_msDS_Behavior_Version;
2152 attrs[i].value_ctr.num_values = 1;
2153 attrs[i].value_ctr.values = vs;
2154
2155 i++;
2156 }
2157
2158 /* systemFlags */
2159 {
2160 struct drsuapi_DsAttributeValue *vs;
2161 DATA_BLOB *vd;
2162
2163 vs = talloc_array(attrs, struct drsuapi_DsAttributeValue, 1);
2164 if (composite_nomem(vs, c)) return;
2165
2166 vd = talloc_array(vs, DATA_BLOB, 1);
2167 if (composite_nomem(vd, c)) return;
2168
2169 vd[0] = data_blob_talloc(vd, NULL, 4);
2170 if (composite_nomem(vd[0].data, c)) return;
2171
2172 SIVAL(vd[0].data, 0, SYSTEM_FLAG_DISALLOW_MOVE_ON_DELETE);
2173
2174 vs[0].blob = &vd[0];
2175
2176 attrs[i].attid = DRSUAPI_ATTRIBUTE_systemFlags;
2177 attrs[i].value_ctr.num_values = 1;
2178 attrs[i].value_ctr.values = vs;
2179
2180 i++;
2181 }
2182
2183 /* serverReference: ... */
2184 {
2185 struct drsuapi_DsAttributeValue *vs;
2186 DATA_BLOB *vd;
2187 struct drsuapi_DsReplicaObjectIdentifier3 v[1];
2188
2189 vs = talloc_array(attrs, struct drsuapi_DsAttributeValue, 1);
2190 if (composite_nomem(vs, c)) return;
2191
2192 vd = talloc_array(vs, DATA_BLOB, 1);
2193 if (composite_nomem(vd, c)) return;
2194
2195 v[0].guid = GUID_zero();
2196 v[0].sid = s->zero_sid;
2197 v[0].dn = s->dest_dsa.computer_dn_str;
2198
2199 ndr_err = ndr_push_struct_blob(&vd[0], vd, iconv_convenience, &v[0],
2200 (ndr_push_flags_fn_t)ndr_push_drsuapi_DsReplicaObjectIdentifier3);
2201 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
2202 c->status = ndr_map_error2ntstatus(ndr_err);
2203 if (!composite_is_ok(c)) return;
2204 }
2205
2206 vs[0].blob = &vd[0];
2207
2208 attrs[i].attid = DRSUAPI_ATTRIBUTE_serverReference;
2209 attrs[i].value_ctr.num_values = 1;
2210 attrs[i].value_ctr.values = vs;
2211
2212 i++;
2213 }
2214
2215 /* truncate the attribute list to the attribute count we have filled in */
2216 num_attrs = i;
2217
2218 /* setup request structure */
2219 r->in.bind_handle = &s->drsuapi1.bind_handle;
2220 r->in.level = 2;
2221 r->in.req = talloc(s, union drsuapi_DsAddEntryRequest);
2222 r->in.req->req2.first_object.next_object = NULL;
2223 r->in.req->req2.first_object.object.identifier = identifier;
2224 r->in.req->req2.first_object.object.flags = 0x00000000;
2225 r->in.req->req2.first_object.object.attribute_ctr.num_attributes= num_attrs;
2226 r->in.req->req2.first_object.object.attribute_ctr.attributes = attrs;
2227
2228 r->out.level_out = talloc(s, int32_t);
2229 r->out.ctr = talloc(s, union drsuapi_DsAddEntryCtr);
2230
2231 req = dcerpc_drsuapi_DsAddEntry_send(s->drsuapi1.pipe, r, r);
2232 composite_continue_rpc(c, req, becomeDC_drsuapi1_add_entry_recv, s);
2233 }
2234
2235 static void becomeDC_drsuapi2_connect_recv(struct composite_context *req);
2236 static NTSTATUS becomeDC_prepare_db(struct libnet_BecomeDC_state *s);
2237
2238 static void becomeDC_drsuapi1_add_entry_recv(struct rpc_request *req)
2239 {
2240 struct libnet_BecomeDC_state *s = talloc_get_type(req->async.private_data,
2241 struct libnet_BecomeDC_state);
2242 struct composite_context *c = s->creq;
2243 struct drsuapi_DsAddEntry *r = talloc_get_type(req->ndr.struct_ptr,
2244 struct drsuapi_DsAddEntry);
2245 char *binding_str;
2246 bool print = false;
2247
2248 if (req->p->conn->flags & DCERPC_DEBUG_PRINT_OUT) {
2249 print = true;
2250 }
2251
2252 c->status = dcerpc_ndr_request_recv(req);
2253 if (!composite_is_ok(c)) return;
2254
2255 if (print) {
2256 NDR_PRINT_OUT_DEBUG(drsuapi_DsAddEntry, r);
2257 }
2258
2259 if (!W_ERROR_IS_OK(r->out.result)) {
2260 composite_error(c, werror_to_ntstatus(r->out.result));
2261 return;
2262 }
2263
2264 if (*r->out.level_out == 3) {
2265 if (r->out.ctr->ctr3.count != 1) {
2266 WERROR status;
2267
2268 if (r->out.ctr->ctr3.level != 1) {
2269 composite_error(c, NT_STATUS_INVALID_NETWORK_RESPONSE);
2270 return;
2271 }
2272
2273 if (!r->out.ctr->ctr3.error) {
2274 composite_error(c, NT_STATUS_INVALID_NETWORK_RESPONSE);
2275 return;
2276 }
2277
2278 status = r->out.ctr->ctr3.error->info1.status;
2279
2280 if (!r->out.ctr->ctr3.error->info1.info) {
2281 composite_error(c, werror_to_ntstatus(status));
2282 return;
2283 }
2284
2285 /* see if we can get a more detailed error */
2286 switch (r->out.ctr->ctr3.error->info1.level) {
2287 case 1:
2288 status = r->out.ctr->ctr3.error->info1.info->error1.status;
2289 break;
2290 case 4:
2291 case 5:
2292 case 6:
2293 case 7:
2294 status = r->out.ctr->ctr3.error->info1.info->errorX.status;
2295 break;
2296 }
2297
2298 composite_error(c, werror_to_ntstatus(status));
2299 return;
2300 }
2301
2302 s->dest_dsa.ntds_guid = r->out.ctr->ctr3.objects[0].guid;
2303 } else if (*r->out.level_out == 2) {
2304 if (r->out.ctr->ctr2.count != 1) {
2305 composite_error(c, werror_to_ntstatus(r->out.ctr->ctr2.error.status));
2306 return;
2307 }
2308
2309 s->dest_dsa.ntds_guid = r->out.ctr->ctr2.objects[0].guid;
2310 } else {
2311 composite_error(c, NT_STATUS_INVALID_NETWORK_RESPONSE);
2312 return;
2313 }
2314
2315 talloc_free(r);
2316
2317 s->dest_dsa.ntds_dn_str = talloc_asprintf(s, "CN=NTDS Settings,%s",
2318 s->dest_dsa.server_dn_str);
2319 if (composite_nomem(s->dest_dsa.ntds_dn_str, c)) return;
2320
2321 c->status = becomeDC_prepare_db(s);
2322 if (!composite_is_ok(c)) return;
2323
2324 /* this avoids the epmapper lookup on the 2nd connection */
2325 binding_str = dcerpc_binding_string(s, s->drsuapi1.binding);
2326 if (composite_nomem(binding_str, c)) return;
2327
2328 c->status = dcerpc_parse_binding(s, binding_str, &s->drsuapi2.binding);
2329 talloc_free(binding_str);
2330 if (!composite_is_ok(c)) return;
2331
2332 /* w2k3 uses the same assoc_group_id as on the first connection, so we do */
2333 s->drsuapi2.binding->assoc_group_id = s->drsuapi1.pipe->assoc_group_id;
2334
2335 becomeDC_drsuapi_connect_send(s, &s->drsuapi2, becomeDC_drsuapi2_connect_recv);
2336 }
2337
2338 static NTSTATUS becomeDC_prepare_db(struct libnet_BecomeDC_state *s)
2339 {
2340 if (!s->callbacks.prepare_db) return NT_STATUS_OK;
2341
2342 s->_pp.domain = &s->domain;
2343 s->_pp.forest = &s->forest;
2344 s->_pp.source_dsa = &s->source_dsa;
2345 s->_pp.dest_dsa = &s->dest_dsa;
2346
2347 return s->callbacks.prepare_db(s->callbacks.private_data, &s->_pp);
2348 }
2349
2350 static void becomeDC_drsuapi2_bind_recv(struct rpc_request *req);
2351
2352 static void becomeDC_drsuapi2_connect_recv(struct composite_context *req)
2353 {
2354 struct libnet_BecomeDC_state *s = talloc_get_type(req->async.private_data,
2355 struct libnet_BecomeDC_state);
2356 struct composite_context *c = s->creq;
2357
2358 c->status = dcerpc_pipe_connect_b_recv(req, s, &s->drsuapi2.pipe);
2359 if (!composite_is_ok(c)) return;
2360
2361 c->status = gensec_session_key(s->drsuapi2.pipe->conn->security_state.generic_state,
2362 &s->drsuapi2.gensec_skey);
2363 if (!composite_is_ok(c)) return;
2364
2365 becomeDC_drsuapi_bind_send(s, &s->drsuapi2, becomeDC_drsuapi2_bind_recv);
2366 }
2367
2368 static void becomeDC_drsuapi3_connect_recv(struct composite_context *req);
2369
2370 static void becomeDC_drsuapi2_bind_recv(struct rpc_request *req)
2371 {
2372 struct libnet_BecomeDC_state *s = talloc_get_type(req->async.private_data,
2373 struct libnet_BecomeDC_state);
2374 struct composite_context *c = s->creq;
2375 char *binding_str;
2376 WERROR status;
2377
2378 bool print = false;
2379
2380 if (req->p->conn->flags & DCERPC_DEBUG_PRINT_OUT) {
2381 print = true;
2382 }
2383
2384 c->status = dcerpc_ndr_request_recv(req);
2385 if (!composite_is_ok(c)) return;
2386
2387 if (print) {
2388 NDR_PRINT_OUT_DEBUG(drsuapi_DsBind, &s->drsuapi2.bind_r);
2389 }
2390
2391 status = becomeDC_drsuapi_bind_recv(s, &s->drsuapi2);
2392 if (!W_ERROR_IS_OK(status)) {
2393 composite_error(c, werror_to_ntstatus(status));
2394 return;
2395 }
2396
2397 /* this avoids the epmapper lookup on the 3rd connection */
2398 binding_str = dcerpc_binding_string(s, s->drsuapi1.binding);
2399 if (composite_nomem(binding_str, c)) return;
2400
2401 c->status = dcerpc_parse_binding(s, binding_str, &s->drsuapi3.binding);
2402 talloc_free(binding_str);
2403 if (!composite_is_ok(c)) return;
2404
2405 /* w2k3 uses the same assoc_group_id as on the first connection, so we do */
2406 s->drsuapi3.binding->assoc_group_id = s->drsuapi1.pipe->assoc_group_id;
2407 /* w2k3 uses the concurrent multiplex feature on the 3rd connection, so we do */
2408 s->drsuapi3.binding->flags |= DCERPC_CONCURRENT_MULTIPLEX;
2409
2410 becomeDC_drsuapi_connect_send(s, &s->drsuapi3, becomeDC_drsuapi3_connect_recv);
2411 }
2412
2413 static void becomeDC_drsuapi3_pull_schema_send(struct libnet_BecomeDC_state *s);
2414
2415 static void becomeDC_drsuapi3_connect_recv(struct composite_context *req)
2416 {
2417 struct libnet_BecomeDC_state *s = talloc_get_type(req->async.private_data,
2418 struct libnet_BecomeDC_state);
2419 struct composite_context *c = s->creq;
2420
2421 c->status = dcerpc_pipe_connect_b_recv(req, s, &s->drsuapi3.pipe);
2422 if (!composite_is_ok(c)) return;
2423
2424 c->status = gensec_session_key(s->drsuapi3.pipe->conn->security_state.generic_state,
2425 &s->drsuapi3.gensec_skey);
2426 if (!composite_is_ok(c)) return;
2427
2428 becomeDC_drsuapi3_pull_schema_send(s);
2429 }
2430
2431 static void becomeDC_drsuapi_pull_partition_send(struct libnet_BecomeDC_state *s,
2432 struct becomeDC_drsuapi *drsuapi_h,
2433 struct becomeDC_drsuapi *drsuapi_p,
2434 struct libnet_BecomeDC_Partition *partition,
2435 void (*recv_fn)(struct rpc_request *req))
2436 {
2437 struct composite_context *c = s->creq;
2438 struct rpc_request *req;
2439 struct drsuapi_DsGetNCChanges *r;
2440
2441 r = talloc(s, struct drsuapi_DsGetNCChanges);
2442 if (composite_nomem(r, c)) return;
2443
2444 r->out.level_out = talloc(r, int32_t);
2445 if (composite_nomem(r->out.level_out, c)) return;
2446 r->in.req = talloc(r, union drsuapi_DsGetNCChangesRequest);
2447 if (composite_nomem(r->in.req, c)) return;
2448 r->out.ctr = talloc(r, union drsuapi_DsGetNCChangesCtr);
2449 if (composite_nomem(r->out.ctr, c)) return;
2450
2451 r->in.bind_handle = &drsuapi_h->bind_handle;
2452 if (drsuapi_h->remote_info28.supported_extensions & DRSUAPI_SUPPORTED_EXTENSION_GETCHGREQ_V8) {
2453 r->in.level = 8;
2454 r->in.req->req8.destination_dsa_guid = partition->destination_dsa_guid;
2455 r->in.req->req8.source_dsa_invocation_id= partition->source_dsa_invocation_id;
2456 r->in.req->req8.naming_context = &partition->nc;
2457 r->in.req->req8.highwatermark = partition->highwatermark;
2458 r->in.req->req8.uptodateness_vector = NULL;
2459 r->in.req->req8.replica_flags = partition->replica_flags;
2460 r->in.req->req8.max_object_count = 133;
2461 r->in.req->req8.max_ndr_size = 1336811;
2462 r->in.req->req8.extended_op = DRSUAPI_EXOP_NONE;
2463 r->in.req->req8.fsmo_info = 0;
2464 r->in.req->req8.partial_attribute_set = NULL;
2465 r->in.req->req8.partial_attribute_set_ex= NULL;
2466 r->in.req->req8.mapping_ctr.num_mappings= 0;
2467 r->in.req->req8.mapping_ctr.mappings = NULL;
2468 } else {
2469 r->in.level = 5;
2470 r->in.req->req5.destination_dsa_guid = partition->destination_dsa_guid;
2471 r->in.req->req5.source_dsa_invocation_id= partition->source_dsa_invocation_id;
2472 r->in.req->req5.naming_context = &partition->nc;
2473 r->in.req->req5.highwatermark = partition->highwatermark;
2474 r->in.req->req5.uptodateness_vector = NULL;
2475 r->in.req->req5.replica_flags = partition->replica_flags;
2476 r->in.req->req5.max_object_count = 133;
2477 r->in.req->req5.max_ndr_size = 1336770;
2478 r->in.req->req5.extended_op = DRSUAPI_EXOP_NONE;
2479 r->in.req->req5.fsmo_info = 0;
2480 }
2481
2482 /*
2483 * we should try to use the drsuapi_p->pipe here, as w2k3 does
2484 * but it seems that some extra flags in the DCERPC Bind call
2485 * are needed for it. Or the same KRB5 TGS is needed on both
2486 * connections.
2487 */
2488 req = dcerpc_drsuapi_DsGetNCChanges_send(drsuapi_p->pipe, r, r);
2489 composite_continue_rpc(c, req, recv_fn, s);
2490 }
2491
2492 static WERROR becomeDC_drsuapi_pull_partition_recv(struct libnet_BecomeDC_state *s,
2493 struct becomeDC_drsuapi *drsuapi_h,
2494 struct becomeDC_drsuapi *drsuapi_p,
2495 struct libnet_BecomeDC_Partition *partition,
2496 struct drsuapi_DsGetNCChanges *r)
2497 {
2498 uint32_t ctr_level = 0;
2499 struct drsuapi_DsGetNCChangesCtr1 *ctr1 = NULL;
2500 struct drsuapi_DsGetNCChangesCtr6 *ctr6 = NULL;
2501 struct GUID *source_dsa_guid = NULL;
2502 struct GUID *source_dsa_invocation_id = NULL;
2503 struct drsuapi_DsReplicaHighWaterMark *new_highwatermark = NULL;
2504 bool more_data = false;
2505 NTSTATUS nt_status;
2506
2507 if (!W_ERROR_IS_OK(r->out.result)) {
2508 return r->out.result;
2509 }
2510
2511 if (*r->out.level_out == 1) {
2512 ctr_level = 1;
2513 ctr1 = &r->out.ctr->ctr1;
2514 } else if (*r->out.level_out == 2 &&
2515 r->out.ctr->ctr2.mszip1.ts) {
2516 ctr_level = 1;
2517 ctr1 = &r->out.ctr->ctr2.mszip1.ts->ctr1;
2518 } else if (*r->out.level_out == 6) {
2519 ctr_level = 6;
2520 ctr6 = &r->out.ctr->ctr6;
2521 } else if (*r->out.level_out == 7 &&
2522 r->out.ctr->ctr7.level == 6 &&
2523 r->out.ctr->ctr7.type == DRSUAPI_COMPRESSION_TYPE_MSZIP &&
2524 r->out.ctr->ctr7.ctr.mszip6.ts) {
2525 ctr_level = 6;
2526 ctr6 = &r->out.ctr->ctr7.ctr.mszip6.ts->ctr6;
2527 } else if (*r->out.level_out == 7 &&
2528 r->out.ctr->ctr7.level == 6 &&
2529 r->out.ctr->ctr7.type == DRSUAPI_COMPRESSION_TYPE_XPRESS &&
2530 r->out.ctr->ctr7.ctr.xpress6.ts) {
2531 ctr_level = 6;
2532 ctr6 = &r->out.ctr->ctr7.ctr.xpress6.ts->ctr6;
2533 } else {
2534 return WERR_BAD_NET_RESP;
2535 }
2536
2537 if (!ctr1 && ! ctr6) {
2538 return WERR_BAD_NET_RESP;
2539 }
2540
2541 if (ctr_level == 6) {
2542 if (!W_ERROR_IS_OK(ctr6->drs_error)) {
2543 return ctr6->drs_error;
2544 }
2545 }
2546
2547 switch (ctr_level) {
2548 case 1:
2549 source_dsa_guid = &ctr1->source_dsa_guid;
2550 source_dsa_invocation_id = &ctr1->source_dsa_invocation_id;
2551 new_highwatermark = &ctr1->new_highwatermark;
2552 more_data = ctr1->more_data;
2553 break;
2554 case 6:
2555 source_dsa_guid = &ctr6->source_dsa_guid;
2556 source_dsa_invocation_id = &ctr6->source_dsa_invocation_id;
2557 new_highwatermark = &ctr6->new_highwatermark;
2558 more_data = ctr6->more_data;
2559 break;
2560 }
2561
2562 partition->highwatermark = *new_highwatermark;
2563 partition->source_dsa_guid = *source_dsa_guid;
2564 partition->source_dsa_invocation_id = *source_dsa_invocation_id;
2565 partition->more_data = more_data;
2566
2567 if (!partition->store_chunk) return WERR_OK;
2568
2569 s->_sc.domain = &s->domain;
2570 s->_sc.forest = &s->forest;
2571 s->_sc.source_dsa = &s->source_dsa;
2572 s->_sc.dest_dsa = &s->dest_dsa;
2573 s->_sc.partition = partition;
2574 s->_sc.ctr_level = ctr_level;
2575 s->_sc.ctr1 = ctr1;
2576 s->_sc.ctr6 = ctr6;
2577 /*
2578 * we need to use the drsuapi_p->gensec_skey here,
2579 * when we use drsuapi_p->pipe in the for this request
2580 */
2581 s->_sc.gensec_skey = &drsuapi_p->gensec_skey;
2582
2583 nt_status = partition->store_chunk(s->callbacks.private_data, &s->_sc);
2584 if (!NT_STATUS_IS_OK(nt_status)) {
2585 return ntstatus_to_werror(nt_status);
2586 }
2587
2588 return WERR_OK;
2589 }
2590
2591 static void becomeDC_drsuapi3_pull_schema_recv(struct rpc_request *req);
2592
2593 static void becomeDC_drsuapi3_pull_schema_send(struct libnet_BecomeDC_state *s)
2594 {
2595 s->schema_part.nc.guid = GUID_zero();
2596 s->schema_part.nc.sid = s->zero_sid;
2597 s->schema_part.nc.dn = s->forest.schema_dn_str;
2598
2599 s->schema_part.destination_dsa_guid = s->drsuapi2.bind_guid;
2600
2601 s->schema_part.replica_flags = DRSUAPI_DS_REPLICA_NEIGHBOUR_WRITEABLE
2602 | DRSUAPI_DS_REPLICA_NEIGHBOUR_SYNC_ON_STARTUP
2603 | DRSUAPI_DS_REPLICA_NEIGHBOUR_DO_SCHEDULED_SYNCS
2604 | DRSUAPI_DS_REPLICA_NEIGHBOUR_FULL_IN_PROGRESS
2605 | DRSUAPI_DS_REPLICA_NEIGHBOUR_NEVER_SYNCED
2606 | DRSUAPI_DS_REPLICA_NEIGHBOUR_COMPRESS_CHANGES;
2607
2608 s->schema_part.store_chunk = s->callbacks.schema_chunk;
2609
2610 becomeDC_drsuapi_pull_partition_send(s, &s->drsuapi2, &s->drsuapi3, &s->schema_part,
2611 becomeDC_drsuapi3_pull_schema_recv);
2612 }
2613
2614 static void becomeDC_drsuapi3_pull_config_send(struct libnet_BecomeDC_state *s);
2615
2616 static void becomeDC_drsuapi3_pull_schema_recv(struct rpc_request *req)
2617 {
2618 struct libnet_BecomeDC_state *s = talloc_get_type(req->async.private_data,
2619 struct libnet_BecomeDC_state);
2620 struct composite_context *c = s->creq;
2621 struct drsuapi_DsGetNCChanges *r = talloc_get_type(req->ndr.struct_ptr,
2622 struct drsuapi_DsGetNCChanges);
2623 WERROR status;
2624
2625 bool print = false;
2626
2627 if (req->p->conn->flags & DCERPC_DEBUG_PRINT_OUT) {
2628 print = true;
2629 }
2630
2631 c->status = dcerpc_ndr_request_recv(req);
2632 if (!composite_is_ok(c)) return;
2633
2634 if (print) {
2635 NDR_PRINT_OUT_DEBUG(drsuapi_DsGetNCChanges, r);
2636 }
2637
2638 status = becomeDC_drsuapi_pull_partition_recv(s, &s->drsuapi2, &s->drsuapi3, &s->schema_part, r);
2639 if (!W_ERROR_IS_OK(status)) {
2640 composite_error(c, werror_to_ntstatus(status));
2641 return;
2642 }
2643
2644 talloc_free(r);
2645
2646 if (s->schema_part.more_data) {
2647 becomeDC_drsuapi_pull_partition_send(s, &s->drsuapi2, &s->drsuapi3, &s->schema_part,
2648 becomeDC_drsuapi3_pull_schema_recv);
2649 return;
2650 }
2651
2652 becomeDC_drsuapi3_pull_config_send(s);
2653 }
2654
2655 static void becomeDC_drsuapi3_pull_config_recv(struct rpc_request *req);
2656
2657 static void becomeDC_drsuapi3_pull_config_send(struct libnet_BecomeDC_state *s)
2658 {
2659 s->config_part.nc.guid = GUID_zero();
2660 s->config_part.nc.sid = s->zero_sid;
2661 s->config_part.nc.dn = s->forest.config_dn_str;
2662
2663 s->config_part.destination_dsa_guid = s->drsuapi2.bind_guid;
2664
2665 s->config_part.replica_flags = DRSUAPI_DS_REPLICA_NEIGHBOUR_WRITEABLE
2666 | DRSUAPI_DS_REPLICA_NEIGHBOUR_SYNC_ON_STARTUP
2667 | DRSUAPI_DS_REPLICA_NEIGHBOUR_DO_SCHEDULED_SYNCS
2668 | DRSUAPI_DS_REPLICA_NEIGHBOUR_FULL_IN_PROGRESS
2669 | DRSUAPI_DS_REPLICA_NEIGHBOUR_NEVER_SYNCED
2670 | DRSUAPI_DS_REPLICA_NEIGHBOUR_COMPRESS_CHANGES;
2671
2672 s->config_part.store_chunk = s->callbacks.config_chunk;
2673
2674 becomeDC_drsuapi_pull_partition_send(s, &s->drsuapi2, &s->drsuapi3, &s->config_part,
2675 becomeDC_drsuapi3_pull_config_recv);
2676 }
2677
2678 static void becomeDC_drsuapi3_pull_config_recv(struct rpc_request *req)
2679 {
2680 struct libnet_BecomeDC_state *s = talloc_get_type(req->async.private_data,
2681 struct libnet_BecomeDC_state);
2682 struct composite_context *c = s->creq;
2683 struct drsuapi_DsGetNCChanges *r = talloc_get_type(req->ndr.struct_ptr,
2684 struct drsuapi_DsGetNCChanges);
2685 WERROR status;
2686
2687 bool print = false;
2688
2689 if (req->p->conn->flags & DCERPC_DEBUG_PRINT_OUT) {
2690 print = true;
2691 }
2692
2693 c->status = dcerpc_ndr_request_recv(req);
2694 if (!composite_is_ok(c)) return;
2695
2696 if (print) {
2697 NDR_PRINT_OUT_DEBUG(drsuapi_DsGetNCChanges, r);
2698 }
2699
2700 status = becomeDC_drsuapi_pull_partition_recv(s, &s->drsuapi2, &s->drsuapi3, &s->config_part, r);
2701 if (!W_ERROR_IS_OK(status)) {
2702 composite_error(c, werror_to_ntstatus(status));
2703 return;
2704 }
2705
2706 talloc_free(r);
2707
2708 if (s->config_part.more_data) {
2709 becomeDC_drsuapi_pull_partition_send(s, &s->drsuapi2, &s->drsuapi3, &s->config_part,
2710 becomeDC_drsuapi3_pull_config_recv);
2711 return;
2712 }
2713
2714 becomeDC_connect_ldap2(s);
2715 }
2716
2717 static void becomeDC_drsuapi3_pull_domain_recv(struct rpc_request *req);
2718
2719 static void becomeDC_drsuapi3_pull_domain_send(struct libnet_BecomeDC_state *s)
2720 {
2721 s->domain_part.nc.guid = GUID_zero();
2722 s->domain_part.nc.sid = s->zero_sid;
2723 s->domain_part.nc.dn = s->domain.dn_str;
2724
2725 s->domain_part.destination_dsa_guid = s->drsuapi2.bind_guid;
2726
2727 s->domain_part.replica_flags = DRSUAPI_DS_REPLICA_NEIGHBOUR_WRITEABLE
2728 | DRSUAPI_DS_REPLICA_NEIGHBOUR_SYNC_ON_STARTUP
2729 | DRSUAPI_DS_REPLICA_NEIGHBOUR_DO_SCHEDULED_SYNCS
2730 | DRSUAPI_DS_REPLICA_NEIGHBOUR_FULL_IN_PROGRESS
2731 | DRSUAPI_DS_REPLICA_NEIGHBOUR_NEVER_SYNCED
2732 | DRSUAPI_DS_REPLICA_NEIGHBOUR_COMPRESS_CHANGES;
2733
2734 s->domain_part.store_chunk = s->callbacks.domain_chunk;
2735
2736 becomeDC_drsuapi_pull_partition_send(s, &s->drsuapi2, &s->drsuapi3, &s->domain_part,
2737 becomeDC_drsuapi3_pull_domain_recv);
2738 }
2739
2740 static void becomeDC_drsuapi_update_refs_send(struct libnet_BecomeDC_state *s,
2741 struct becomeDC_drsuapi *drsuapi,
2742 struct libnet_BecomeDC_Partition *partition,
2743 void (*recv_fn)(struct rpc_request *req));
2744 static void becomeDC_drsuapi2_update_refs_schema_recv(struct rpc_request *req);
2745
2746 static void becomeDC_drsuapi3_pull_domain_recv(struct rpc_request *req)
2747 {
2748 struct libnet_BecomeDC_state *s = talloc_get_type(req->async.private_data,
2749 struct libnet_BecomeDC_state);
2750 struct composite_context *c = s->creq;
2751 struct drsuapi_DsGetNCChanges *r = talloc_get_type(req->ndr.struct_ptr,
2752 struct drsuapi_DsGetNCChanges);
2753 WERROR status;
2754 bool print = false;
2755
2756 if (req->p->conn->flags & DCERPC_DEBUG_PRINT_OUT) {
2757 print = true;
2758 }
2759
2760 c->status = dcerpc_ndr_request_recv(req);
2761 if (!composite_is_ok(c)) return;
2762
2763 if (print) {
2764 NDR_PRINT_OUT_DEBUG(drsuapi_DsGetNCChanges, r);
2765 }
2766
2767 status = becomeDC_drsuapi_pull_partition_recv(s, &s->drsuapi2, &s->drsuapi3, &s->domain_part, r);
2768 if (!W_ERROR_IS_OK(status)) {
2769 composite_error(c, werror_to_ntstatus(status));
2770 return;
2771 }
2772
2773 talloc_free(r);
2774
2775 if (s->domain_part.more_data) {
2776 becomeDC_drsuapi_pull_partition_send(s, &s->drsuapi2, &s->drsuapi3, &s->domain_part,
2777 becomeDC_drsuapi3_pull_domain_recv);
2778 return;
2779 }
2780
2781 becomeDC_drsuapi_update_refs_send(s, &s->drsuapi2, &s->schema_part,
2782 becomeDC_drsuapi2_update_refs_schema_recv);
2783 }
2784
2785 static void becomeDC_drsuapi_update_refs_send(struct libnet_BecomeDC_state *s,
2786 struct becomeDC_drsuapi *drsuapi,
2787 struct libnet_BecomeDC_Partition *partition,
2788 void (*recv_fn)(struct rpc_request *req))
2789 {
2790 struct composite_context *c = s->creq;
2791 struct rpc_request *req;
2792 struct drsuapi_DsReplicaUpdateRefs *r;
2793 const char *ntds_guid_str;
2794 const char *ntds_dns_name;
2795
2796 r = talloc(s, struct drsuapi_DsReplicaUpdateRefs);
2797 if (composite_nomem(r, c)) return;
2798
2799 ntds_guid_str = GUID_string(r, &s->dest_dsa.ntds_guid);
2800 if (composite_nomem(ntds_guid_str, c)) return;
2801
2802 ntds_dns_name = talloc_asprintf(r, "%s._msdcs.%s",
2803 ntds_guid_str,
2804 s->domain.dns_name);
2805 if (composite_nomem(ntds_dns_name, c)) return;
2806
2807 r->in.bind_handle = &drsuapi->bind_handle;
2808 r->in.level = 1;
2809 r->in.req.req1.naming_context = &partition->nc;
2810 r->in.req.req1.dest_dsa_dns_name= ntds_dns_name;
2811 r->in.req.req1.dest_dsa_guid = s->dest_dsa.ntds_guid;
2812 r->in.req.req1.options = DRSUAPI_DS_REPLICA_UPDATE_ADD_REFERENCE
2813 | DRSUAPI_DS_REPLICA_UPDATE_DELETE_REFERENCE;
2814
2815 /* I think this is how we mark ourselves as a RODC */
2816 if (!lp_parm_bool(s->libnet->lp_ctx, NULL, "repl", "RODC", false)) {
2817 r->in.req.req1.options |= DRSUAPI_DS_REPLICA_UPDATE_WRITEABLE;
2818 }
2819
2820 req = dcerpc_drsuapi_DsReplicaUpdateRefs_send(drsuapi->pipe, r, r);
2821 composite_continue_rpc(c, req, recv_fn, s);
2822 }
2823
2824 static void becomeDC_drsuapi2_update_refs_config_recv(struct rpc_request *req);
2825
2826 static void becomeDC_drsuapi2_update_refs_schema_recv(struct rpc_request *req)
2827 {
2828 struct libnet_BecomeDC_state *s = talloc_get_type(req->async.private_data,
2829 struct libnet_BecomeDC_state);
2830 struct composite_context *c = s->creq;
2831 struct drsuapi_DsReplicaUpdateRefs *r = talloc_get_type(req->ndr.struct_ptr,
2832 struct drsuapi_DsReplicaUpdateRefs);
2833 bool print = false;
2834
2835 if (req->p->conn->flags & DCERPC_DEBUG_PRINT_OUT) {
2836 print = true;
2837 }
2838
2839 c->status = dcerpc_ndr_request_recv(req);
2840 if (!composite_is_ok(c)) return;
2841
2842 if (print) {
2843 NDR_PRINT_OUT_DEBUG(drsuapi_DsReplicaUpdateRefs, r);
2844 }
2845
2846 if (!W_ERROR_IS_OK(r->out.result)) {
2847 composite_error(c, werror_to_ntstatus(r->out.result));
2848 return;
2849 }
2850
2851 talloc_free(r);
2852
2853 becomeDC_drsuapi_update_refs_send(s, &s->drsuapi2, &s->config_part,
2854 becomeDC_drsuapi2_update_refs_config_recv);
2855 }
2856
2857 static void becomeDC_drsuapi2_update_refs_domain_recv(struct rpc_request *req);
2858
2859 static void becomeDC_drsuapi2_update_refs_config_recv(struct rpc_request *req)
2860 {
2861 struct libnet_BecomeDC_state *s = talloc_get_type(req->async.private_data,
2862 struct libnet_BecomeDC_state);
2863 struct composite_context *c = s->creq;
2864 struct drsuapi_DsReplicaUpdateRefs *r = talloc_get_type(req->ndr.struct_ptr,
2865 struct drsuapi_DsReplicaUpdateRefs);
2866
2867 c->status = dcerpc_ndr_request_recv(req);
2868 if (!composite_is_ok(c)) return;
2869
2870 if (!W_ERROR_IS_OK(r->out.result)) {
2871 composite_error(c, werror_to_ntstatus(r->out.result));
2872 return;
2873 }
2874
2875 talloc_free(r);
2876
2877 becomeDC_drsuapi_update_refs_send(s, &s->drsuapi2, &s->domain_part,
2878 becomeDC_drsuapi2_update_refs_domain_recv);
2879 }
2880
2881 static void becomeDC_drsuapi2_update_refs_domain_recv(struct rpc_request *req)
2882 {
2883 struct libnet_BecomeDC_state *s = talloc_get_type(req->async.private_data,
2884 struct libnet_BecomeDC_state);
2885 struct composite_context *c = s->creq;
2886 struct drsuapi_DsReplicaUpdateRefs *r = talloc_get_type(req->ndr.struct_ptr,
2887 struct drsuapi_DsReplicaUpdateRefs);
2888
2889 c->status = dcerpc_ndr_request_recv(req);
2890 if (!composite_is_ok(c)) return;
2891
2892 if (!W_ERROR_IS_OK(r->out.result)) {
2893 composite_error(c, werror_to_ntstatus(r->out.result));
2894 return;
2895 }
2896
2897 talloc_free(r);
2898
2899 /* TODO: use DDNS updates and register dns names */
2900 composite_done(c);
2901 }
2902
2903 static NTSTATUS becomeDC_ldap2_modify_computer(struct libnet_BecomeDC_state *s)
2904 {
2905 int ret;
2906 struct ldb_message *msg;
2907 uint32_t i;
2908 uint32_t user_account_control = UF_SERVER_TRUST_ACCOUNT |
2909 UF_TRUSTED_FOR_DELEGATION;
2910
2911 /* as the value is already as we want it to be, we're done */
2912 if (s->dest_dsa.user_account_control == user_account_control) {
2913 return NT_STATUS_OK;
2914 }
2915
2916 /* make a 'modify' msg, and only for serverReference */
2917 msg = ldb_msg_new(s);
2918 NT_STATUS_HAVE_NO_MEMORY(msg);
2919 msg->dn = ldb_dn_new(msg, s->ldap2.ldb, s->dest_dsa.computer_dn_str);
2920 NT_STATUS_HAVE_NO_MEMORY(msg->dn);
2921
2922 ret = ldb_msg_add_fmt(msg, "userAccountControl", "%u", user_account_control);
2923 if (ret != 0) {
2924 talloc_free(msg);
2925 return NT_STATUS_NO_MEMORY;
2926 }
2927
2928 /* mark all the message elements (should be just one)
2929 as LDB_FLAG_MOD_REPLACE */
2930 for (i=0;i<msg->num_elements;i++) {
2931 msg->elements[i].flags = LDB_FLAG_MOD_REPLACE;
2932 }
2933
2934 ret = ldb_modify(s->ldap2.ldb, msg);
2935 talloc_free(msg);
2936 if (ret != LDB_SUCCESS) {
2937 return NT_STATUS_LDAP(ret);
2938 }
2939
2940 s->dest_dsa.user_account_control = user_account_control;
2941
2942 return NT_STATUS_OK;
2943 }
2944
2945 static NTSTATUS becomeDC_ldap2_move_computer(struct libnet_BecomeDC_state *s)
2946 {
2947 int ret;
2948 struct ldb_result *r;
2949 struct ldb_dn *basedn;
2950 struct ldb_dn *old_dn;
2951 struct ldb_dn *new_dn;
2952 static const char *_1_1_attrs[] = {
2953 "1.1",
2954 NULL
2955 };
2956
2957 basedn = ldb_dn_new_fmt(s, s->ldap2.ldb, "<WKGUID=a361b2ffffd211d1aa4b00c04fd7d83a,%s>",
2958 s->domain.dn_str);
2959 NT_STATUS_HAVE_NO_MEMORY(basedn);
2960
2961 ret = ldb_search(s->ldap2.ldb, s, &r, basedn, LDB_SCOPE_BASE,
2962 _1_1_attrs, "(objectClass=*)");
2963 talloc_free(basedn);
2964 if (ret != LDB_SUCCESS) {
2965 return NT_STATUS_LDAP(ret);
2966 } else if (r->count != 1) {
2967 talloc_free(r);
2968 return NT_STATUS_INVALID_NETWORK_RESPONSE;
2969 }
2970
2971 old_dn = ldb_dn_new(r, s->ldap2.ldb, s->dest_dsa.computer_dn_str);
2972 NT_STATUS_HAVE_NO_MEMORY(old_dn);
2973
2974 new_dn = r->msgs[0]->dn;
2975
2976 if (!ldb_dn_add_child_fmt(new_dn, "CN=%s", s->dest_dsa.netbios_name)) {
2977 talloc_free(r);
2978 return NT_STATUS_NO_MEMORY;
2979 }
2980
2981 if (ldb_dn_compare(old_dn, new_dn) == 0) {
2982 /* we don't need to rename if the old and new dn match */
2983 talloc_free(r);
2984 return NT_STATUS_OK;
2985 }
2986
2987 ret = ldb_rename(s->ldap2.ldb, old_dn, new_dn);
2988 if (ret != LDB_SUCCESS) {
2989 talloc_free(r);
2990 return NT_STATUS_LDAP(ret);
2991 }
2992
2993 s->dest_dsa.computer_dn_str = ldb_dn_alloc_linearized(s, new_dn);
2994 NT_STATUS_HAVE_NO_MEMORY(s->dest_dsa.computer_dn_str);
2995
2996 talloc_free(r);
2997
2998 return NT_STATUS_OK;
2999 }
3000
3001 static void becomeDC_connect_ldap2(struct libnet_BecomeDC_state *s)
3002 {
3003 struct composite_context *c = s->creq;
3004
3005 c->status = becomeDC_ldap_connect(s, &s->ldap2);
3006 if (!composite_is_ok(c)) return;
3007
3008 c->status = becomeDC_ldap2_modify_computer(s);
3009 if (!composite_is_ok(c)) return;
3010
3011 c->status = becomeDC_ldap2_move_computer(s);
3012 if (!composite_is_ok(c)) return;
3013
3014 becomeDC_drsuapi3_pull_domain_send(s);
3015 }
3016
3017 struct composite_context *libnet_BecomeDC_send(struct libnet_context *ctx, TALLOC_CTX *mem_ctx, struct libnet_BecomeDC *r)
3018 {
3019 struct composite_context *c;
3020 struct libnet_BecomeDC_state *s;
3021 char *tmp_name;
3022
3023 c = composite_create(mem_ctx, ctx->event_ctx);
3024 if (c == NULL) return NULL;
3025
3026 s = talloc_zero(c, struct libnet_BecomeDC_state);
3027 if (composite_nomem(s, c)) return c;
3028 c->private_data = s;
3029 s->creq = c;
3030 s->libnet = ctx;
3031
3032 /* Domain input */
3033 s->domain.dns_name = talloc_strdup(s, r->in.domain_dns_name);
3034 if (composite_nomem(s->domain.dns_name, c)) return c;
3035 s->domain.netbios_name = talloc_strdup(s, r->in.domain_netbios_name);
3036 if (composite_nomem(s->domain.netbios_name, c)) return c;
3037 s->domain.sid = dom_sid_dup(s, r->in.domain_sid);
3038 if (composite_nomem(s->domain.sid, c)) return c;
3039
3040 /* Source DSA input */
3041 s->source_dsa.address = talloc_strdup(s, r->in.source_dsa_address);
3042 if (composite_nomem(s->source_dsa.address, c)) return c;
3043
3044 /* Destination DSA input */
3045 s->dest_dsa.netbios_name= talloc_strdup(s, r->in.dest_dsa_netbios_name);
3046 if (composite_nomem(s->dest_dsa.netbios_name, c)) return c;
3047
3048 /* Destination DSA dns_name construction */
3049 tmp_name = strlower_talloc(s, s->dest_dsa.netbios_name);
3050 if (composite_nomem(tmp_name, c)) return c;
3051 tmp_name = talloc_asprintf_append_buffer(tmp_name, ".%s",s->domain.dns_name);
3052 if (composite_nomem(tmp_name, c)) return c;
3053 s->dest_dsa.dns_name = tmp_name;
3054
3055 /* Callback function pointers */
3056 s->callbacks = r->in.callbacks;
3057
3058 becomeDC_send_cldap(s);
3059 return c;
3060 }
3061
3062 NTSTATUS libnet_BecomeDC_recv(struct composite_context *c, TALLOC_CTX *mem_ctx, struct libnet_BecomeDC *r)
3063 {
3064 NTSTATUS status;
3065
3066 status = composite_wait(c);
3067
3068 ZERO_STRUCT(r->out);
3069
3070 talloc_free(c);
3071 return status;
3072 }
3073
3074 NTSTATUS libnet_BecomeDC(struct libnet_context *ctx, TALLOC_CTX *mem_ctx, struct libnet_BecomeDC *r)
3075 {
3076 NTSTATUS status;
3077 struct composite_context *c;
3078 c = libnet_BecomeDC_send(ctx, mem_ctx, r);
3079 status = libnet_BecomeDC_recv(c, mem_ctx, r);
3080 return status;
3081 }
Samba GIT mirror