?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
dsdb-acl: fix the order of special and system checks
[Samba/gebeck_regimport.git] / source4 / libnet / libnet_samsync_ldb.c
blobccf737f64c15eebaf3b157a58eb496405451bafd
1 /*
2 Unix SMB/CIFS implementation.
3
4 Extract the user/system database from a remote SamSync server
5
6 Copyright (C) Andrew Bartlett <abartlet@samba.org> 2004-2005
7 Copyright (C) Andrew Tridgell 2004
8 Copyright (C) Volker Lendecke 2004
9
10 This program is free software; you can redistribute it and/or modify
11 it under the terms of the GNU General Public License as published by
12 the Free Software Foundation; either version 3 of the License, or
13 (at your option) any later version.
14
15 This program is distributed in the hope that it will be useful,
16 but WITHOUT ANY WARRANTY; without even the implied warranty of
17 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
18 GNU General Public License for more details.
19
20 You should have received a copy of the GNU General Public License
21 along with this program. If not, see <http://www.gnu.org/licenses/>.
22 */
23
24
25 #include "includes.h"
26 #include "libnet/libnet.h"
27 #include "libcli/ldap/ldap_ndr.h"
28 #include "dsdb/samdb/samdb.h"
29 #include "auth/auth.h"
30 #include "../lib/util/util_ldb.h"
31 #include "librpc/gen_ndr/ndr_misc.h"
32 #include "ldb_wrap.h"
33 #include "libcli/security/security.h"
34 #include "param/param.h"
35
36 struct samsync_ldb_secret {
37 struct samsync_ldb_secret *prev, *next;
38 DATA_BLOB secret;
39 char *name;
40 NTTIME mtime;
41 };
42
43 struct samsync_ldb_trusted_domain {
44 struct samsync_ldb_trusted_domain *prev, *next;
45 struct dom_sid *sid;
46 char *name;
47 };
48
49 struct samsync_ldb_state {
50 /* Values from the LSA lookup */
51 const struct libnet_SamSync_state *samsync_state;
52
53 struct dom_sid *dom_sid[3];
54 struct ldb_context *sam_ldb, *remote_ldb, *pdb;
55 struct ldb_dn *base_dn[3];
56 struct samsync_ldb_secret *secrets;
57 struct samsync_ldb_trusted_domain *trusted_domains;
58 };
59
60 /* This wrapper is needed for the "ADD_OR_DEL" macros */
61 static int samdb_msg_add_string(struct ldb_context *sam_ldb,
62 TALLOC_CTX *mem_ctx, struct ldb_message *msg,
63 const char *attr_name, const char *str)
64 {
65 return ldb_msg_add_string(msg, attr_name, str);
66 }
67
68 static NTSTATUS samsync_ldb_add_foreignSecurityPrincipal(TALLOC_CTX *mem_ctx,
69 struct samsync_ldb_state *state,
70 struct dom_sid *sid,
71 struct ldb_dn **fsp_dn,
72 char **error_string)
73 {
74 const char *sidstr = dom_sid_string(mem_ctx, sid);
75 /* We assume that ForeignSecurityPrincipals are under the BASEDN of the main domain */
76 struct ldb_dn *basedn = samdb_search_dn(state->sam_ldb, mem_ctx,
77 state->base_dn[SAM_DATABASE_DOMAIN],
78 "(&(objectClass=container)(cn=ForeignSecurityPrincipals))");
79 struct ldb_message *msg;
80 int ret;
81
82 if (!sidstr) {
83 return NT_STATUS_NO_MEMORY;
84 }
85
86 if (basedn == NULL) {
87 *error_string = talloc_asprintf(mem_ctx,
88 "Failed to find DN for "
89 "ForeignSecurityPrincipal container under %s",
90 ldb_dn_get_linearized(state->base_dn[SAM_DATABASE_DOMAIN]));
91 return NT_STATUS_INTERNAL_DB_CORRUPTION;
92 }
93
94 msg = ldb_msg_new(mem_ctx);
95 if (msg == NULL) {
96 return NT_STATUS_NO_MEMORY;
97 }
98
99 /* add core elements to the ldb_message for the alias */
100 msg->dn = basedn;
101 if ( ! ldb_dn_add_child_fmt(msg->dn, "CN=%s", sidstr))
102 return NT_STATUS_UNSUCCESSFUL;
103
104 ldb_msg_add_string(msg, "objectClass", "foreignSecurityPrincipal");
105
106 *fsp_dn = msg->dn;
107
108 /* create the alias */
109 ret = ldb_add(state->sam_ldb, msg);
110 if (ret != LDB_SUCCESS) {
111 *error_string = talloc_asprintf(mem_ctx, "Failed to create foreignSecurityPrincipal "
112 "record %s: %s",
113 ldb_dn_get_linearized(msg->dn),
114 ldb_errstring(state->sam_ldb));
115 return NT_STATUS_INTERNAL_DB_CORRUPTION;
116 }
117 return NT_STATUS_OK;
118 }
119
120 static NTSTATUS samsync_ldb_handle_domain(TALLOC_CTX *mem_ctx,
121 struct samsync_ldb_state *state,
122 enum netr_SamDatabaseID database,
123 struct netr_DELTA_ENUM *delta,
124 char **error_string)
125 {
126 struct netr_DELTA_DOMAIN *domain = delta->delta_union.domain;
127 const char *domain_name = domain->domain_name.string;
128 struct ldb_message *msg;
129 int ret;
130
131 msg = ldb_msg_new(mem_ctx);
132 if (msg == NULL) {
133 return NT_STATUS_NO_MEMORY;
134 }
135
136 if (database == SAM_DATABASE_DOMAIN) {
137 struct ldb_dn *partitions_basedn;
138 const char *domain_attrs[] = {"nETBIOSName", "nCName", NULL};
139 struct ldb_message **msgs_domain;
140 int ret_domain;
141
142 partitions_basedn = samdb_partitions_dn(state->sam_ldb, mem_ctx);
143
144 ret_domain = gendb_search(state->sam_ldb, mem_ctx, partitions_basedn, &msgs_domain, domain_attrs,
145 "(&(&(nETBIOSName=%s)(objectclass=crossRef))(ncName=*))",
146 domain_name);
147 if (ret_domain == -1) {
148 *error_string = talloc_asprintf(mem_ctx, "gendb_search for domain failed: %s", ldb_errstring(state->sam_ldb));
149 return NT_STATUS_INTERNAL_DB_CORRUPTION;
150 }
151
152 if (ret_domain != 1) {
153 *error_string = talloc_asprintf(mem_ctx, "Failed to find existing domain record for %s: %d results", domain_name,
154 ret_domain);
155 return NT_STATUS_NO_SUCH_DOMAIN;
156 }
157
158 state->base_dn[database] = samdb_result_dn(state->sam_ldb, state, msgs_domain[0], "nCName", NULL);
159
160 if (state->dom_sid[database]) {
161 /* Update the domain sid with the incoming
162 * domain (found on LSA pipe, database sid may
163 * be random) */
164 ret = samdb_msg_add_dom_sid(state->sam_ldb,
165 mem_ctx,
166 msg,
167 "objectSid",
168 state->dom_sid[database]);
169 if (ret != LDB_SUCCESS) {
170 return NT_STATUS_INTERNAL_ERROR;
171 }
172 } else {
173 /* Well, we will have to use the one from the database */
174 state->dom_sid[database] = samdb_search_dom_sid(state->sam_ldb, state,
175 state->base_dn[database],
176 "objectSid", NULL);
177 if (state->dom_sid[database] == NULL) {
178 return NT_STATUS_INTERNAL_ERROR;
179 }
180 }
181
182 if (state->samsync_state->domain_guid) {
183 struct ldb_val v;
184 NTSTATUS status;
185 status = GUID_to_ndr_blob(state->samsync_state->domain_guid, msg, &v);
186 if (!NT_STATUS_IS_OK(status)) {
187 *error_string = talloc_asprintf(mem_ctx, "ndr_push of domain GUID failed!");
188 return status;
189 }
190
191 ret = ldb_msg_add_value(msg, "objectGUID", &v, NULL);
192 if (ret != LDB_SUCCESS) {
193 return NT_STATUS_INTERNAL_ERROR;
194 }
195 }
196 } else if (database == SAM_DATABASE_BUILTIN) {
197 /* work out the builtin_dn - useful for so many calls its worth
198 fetching here */
199 const char *dnstring = samdb_search_string(state->sam_ldb, mem_ctx, NULL,
200 "distinguishedName", "objectClass=builtinDomain");
201 state->base_dn[database] = ldb_dn_new(state, state->sam_ldb, dnstring);
202 if ( ! ldb_dn_validate(state->base_dn[database])) {
203 return NT_STATUS_INTERNAL_ERROR;
204 }
205 } else {
206 /* PRIVs DB */
207 return NT_STATUS_INVALID_PARAMETER;
208 }
209
210 msg->dn = talloc_reference(mem_ctx, state->base_dn[database]);
211 if (!msg->dn) {
212 return NT_STATUS_NO_MEMORY;
213 }
214
215 ldb_msg_add_string(msg, "oEMInformation",
216 domain->oem_information.string);
217
218 samdb_msg_add_int64(state->sam_ldb, mem_ctx,
219 msg, "forceLogoff", domain->force_logoff_time);
220
221 samdb_msg_add_uint(state->sam_ldb, mem_ctx,
222 msg, "minPwdLen", domain->min_password_length);
223
224 samdb_msg_add_int64(state->sam_ldb, mem_ctx,
225 msg, "maxPwdAge", domain->max_password_age);
226
227 samdb_msg_add_int64(state->sam_ldb, mem_ctx,
228 msg, "minPwdAge", domain->min_password_age);
229
230 samdb_msg_add_uint(state->sam_ldb, mem_ctx,
231 msg, "pwdHistoryLength", domain->password_history_length);
232
233 samdb_msg_add_uint64(state->sam_ldb, mem_ctx,
234 msg, "modifiedCount",
235 domain->sequence_num);
236
237 samdb_msg_add_uint64(state->sam_ldb, mem_ctx,
238 msg, "creationTime", domain->domain_create_time);
239
240 /* TODO: Account lockout, password properties */
241
242 ret = dsdb_replace(state->sam_ldb, msg, 0);
243 if (ret != LDB_SUCCESS) {
244 *error_string = talloc_asprintf(mem_ctx,
245 "Failed to modify domain record %s: %s",
246 ldb_dn_get_linearized(msg->dn),
247 ldb_errstring(state->sam_ldb));
248 return NT_STATUS_INTERNAL_DB_CORRUPTION;
249 }
250 return NT_STATUS_OK;
251 }
252
253 static NTSTATUS samsync_ldb_handle_user(TALLOC_CTX *mem_ctx,
254 struct samsync_ldb_state *state,
255 enum netr_SamDatabaseID database,
256 struct netr_DELTA_ENUM *delta,
257 char **error_string)
258 {
259 uint32_t rid = delta->delta_id_union.rid;
260 struct netr_DELTA_USER *user = delta->delta_union.user;
261 const char *container, *obj_class;
262 char *cn_name;
263 int cn_name_len;
264 const struct dom_sid *user_sid;
265 struct ldb_message *msg;
266 struct ldb_message **msgs;
267 struct ldb_message **remote_msgs = NULL;
268 unsigned int i;
269 int ret;
270 uint32_t acb;
271 bool add = false;
272 const char *attrs[] = { NULL };
273 /* we may change this to a global search, then fill in only the things not in ldap later */
274 const char *remote_attrs[] = { "userPrincipalName", "servicePrincipalName",
275 "msDS-KeyVersionNumber", "objectGUID", NULL};
276
277 user_sid = dom_sid_add_rid(mem_ctx, state->dom_sid[database], rid);
278 if (!user_sid) {
279 return NT_STATUS_NO_MEMORY;
280 }
281
282 msg = ldb_msg_new(mem_ctx);
283 if (msg == NULL) {
284 return NT_STATUS_NO_MEMORY;
285 }
286
287 msg->dn = NULL;
288 /* search for the user, by rid */
289 ret = gendb_search(state->sam_ldb, mem_ctx, state->base_dn[database],
290 &msgs, attrs, "(&(objectClass=user)(objectSid=%s))",
291 ldap_encode_ndr_dom_sid(mem_ctx, user_sid));
292
293 if (ret == -1) {
294 *error_string = talloc_asprintf(mem_ctx, "LDB for user %s failed: %s",
295 dom_sid_string(mem_ctx, user_sid),
296 ldb_errstring(state->sam_ldb));
297 return NT_STATUS_INTERNAL_DB_CORRUPTION;
298 } else if (ret == 0) {
299 add = true;
300 } else if (ret > 1) {
301 *error_string = talloc_asprintf(mem_ctx, "More than one user with SID: %s in local LDB",
302 dom_sid_string(mem_ctx, user_sid));
303 return NT_STATUS_INTERNAL_DB_CORRUPTION;
304 } else {
305 msg->dn = msgs[0]->dn;
306 talloc_steal(msg, msgs[0]->dn);
307 }
308
309 /* and do the same on the remote database */
310 if (state->remote_ldb) {
311 ret = gendb_search(state->remote_ldb, mem_ctx, state->base_dn[database],
312 &remote_msgs, remote_attrs, "(&(objectClass=user)(objectSid=%s))",
313 ldap_encode_ndr_dom_sid(mem_ctx, user_sid));
314
315 if (ret == -1) {
316 *error_string = talloc_asprintf(mem_ctx, "remote LDAP for user %s failed: %s",
317 dom_sid_string(mem_ctx, user_sid),
318 ldb_errstring(state->remote_ldb));
319 return NT_STATUS_INTERNAL_DB_CORRUPTION;
320 } else if (ret == 0) {
321 *error_string = talloc_asprintf(mem_ctx, "User exists in samsync but not in remote LDAP domain! (base: %s, SID: %s)",
322 ldb_dn_get_linearized(state->base_dn[database]),
323 dom_sid_string(mem_ctx, user_sid));
324 return NT_STATUS_NO_SUCH_USER;
325 } else if (ret > 1) {
326 *error_string = talloc_asprintf(mem_ctx, "More than one user in remote LDAP domain with SID: %s",
327 dom_sid_string(mem_ctx, user_sid));
328 return NT_STATUS_INTERNAL_DB_CORRUPTION;
329
330 /* Try to put things in the same location as the remote server */
331 } else if (add) {
332 msg->dn = talloc_steal(msg, remote_msgs[0]->dn);
333 }
334 }
335
336 cn_name = talloc_strdup(mem_ctx, user->account_name.string);
337 NT_STATUS_HAVE_NO_MEMORY(cn_name);
338 cn_name_len = strlen(cn_name);
339
340 #define ADD_OR_DEL(type, attrib, field) do { \
341 if (user->field) { \
342 samdb_msg_add_ ## type(state->sam_ldb, mem_ctx, msg, \
343 attrib, user->field); \
344 } else if (!add) { \
345 samdb_msg_add_delete(state->sam_ldb, mem_ctx, msg, \
346 attrib); \
347 } \
348 } while (0);
349
350 ADD_OR_DEL(string, "samAccountName", account_name.string);
351 ADD_OR_DEL(string, "displayName", full_name.string);
352
353 if (samdb_msg_add_dom_sid(state->sam_ldb, mem_ctx, msg,
354 "objectSid", dom_sid_add_rid(mem_ctx, state->dom_sid[database], rid))) {
355 return NT_STATUS_NO_MEMORY;
356 }
357
358 ADD_OR_DEL(uint, "primaryGroupID", primary_gid);
359 ADD_OR_DEL(string, "homeDirectory", home_directory.string);
360 ADD_OR_DEL(string, "homeDrive", home_drive.string);
361 ADD_OR_DEL(string, "scriptPath", logon_script.string);
362 ADD_OR_DEL(string, "description", description.string);
363 ADD_OR_DEL(string, "userWorkstations", workstations.string);
364
365 ADD_OR_DEL(uint64, "lastLogon", last_logon);
366 ADD_OR_DEL(uint64, "lastLogoff", last_logoff);
367
368 if (samdb_msg_add_logon_hours(state->sam_ldb, mem_ctx, msg, "logonHours", &user->logon_hours) != 0) {
369 return NT_STATUS_NO_MEMORY;
370 }
371
372 ADD_OR_DEL(uint, "badPwdCount", bad_password_count);
373 ADD_OR_DEL(uint, "logonCount", logon_count);
374
375 ADD_OR_DEL(uint64, "pwdLastSet", last_password_change);
376 ADD_OR_DEL(uint64, "accountExpires", acct_expiry);
377
378 if (samdb_msg_add_acct_flags(state->sam_ldb, mem_ctx, msg,
379 "userAccountControl", user->acct_flags) != 0) {
380 return NT_STATUS_NO_MEMORY;
381 }
382
383 if (user->lm_password_present) {
384 samdb_msg_add_hash(state->sam_ldb, mem_ctx, msg,
385 "dBCSPwd", &user->lmpassword);
386 } else if (!add) {
387 samdb_msg_add_delete(state->sam_ldb, mem_ctx, msg,
388 "dBCSPwd");
389 }
390 if (user->nt_password_present) {
391 samdb_msg_add_hash(state->sam_ldb, mem_ctx, msg,
392 "unicodePwd", &user->ntpassword);
393 } else if (!add) {
394 samdb_msg_add_delete(state->sam_ldb, mem_ctx, msg,
395 "unicodePwd");
396 }
397
398 ADD_OR_DEL(string, "comment", comment.string);
399
400 if (samdb_msg_add_parameters(state->sam_ldb, mem_ctx, msg, "userParameters", &user->parameters) != 0) {
401 return NT_STATUS_NO_MEMORY;
402 }
403
404 ADD_OR_DEL(uint, "countryCode", country_code);
405 ADD_OR_DEL(uint, "codePage", code_page);
406
407 ADD_OR_DEL(string, "profilePath", profile_path.string);
408
409 #undef ADD_OR_DEL
410
411 for (i=0; remote_attrs[i]; i++) {
412 struct ldb_message_element *el = ldb_msg_find_element(remote_msgs[0], remote_attrs[i]);
413 if (!el) {
414 samdb_msg_add_delete(state->sam_ldb, mem_ctx, msg,
415 remote_attrs[i]);
416 } else {
417 ldb_msg_add(msg, el, LDB_FLAG_MOD_REPLACE);
418 }
419 }
420
421 acb = user->acct_flags;
422 if (acb & (ACB_WSTRUST)) {
423 cn_name[cn_name_len - 1] = '\0';
424 container = "Computers";
425 obj_class = "computer";
426
427 } else if (acb & ACB_SVRTRUST) {
428 if (cn_name[cn_name_len - 1] != '$') {
429 return NT_STATUS_FOOBAR;
430 }
431 cn_name[cn_name_len - 1] = '\0';
432 container = "Domain Controllers";
433 obj_class = "computer";
434 } else {
435 container = "Users";
436 obj_class = "user";
437 }
438 if (add) {
439 ldb_msg_add_string(msg, "objectClass", obj_class);
440 if (!msg->dn) {
441 msg->dn = ldb_dn_copy(mem_ctx, state->base_dn[database]);
442 ldb_dn_add_child_fmt(msg->dn, "CN=%s,CN=%s", cn_name, container);
443 if (!msg->dn) {
444 return NT_STATUS_NO_MEMORY;
445 }
446 }
447
448 ret = ldb_add(state->sam_ldb, msg);
449 if (ret != LDB_SUCCESS) {
450 struct ldb_dn *first_try_dn = msg->dn;
451 /* Try again with the default DN */
452 if (!remote_msgs) {
453 *error_string = talloc_asprintf(mem_ctx, "Failed to create user record. Tried %s: %s",
454 ldb_dn_get_linearized(first_try_dn),
455 ldb_errstring(state->sam_ldb));
456 return NT_STATUS_INTERNAL_DB_CORRUPTION;
457 } else {
458 msg->dn = talloc_steal(msg, remote_msgs[0]->dn);
459 ret = ldb_add(state->sam_ldb, msg);
460 if (ret != LDB_SUCCESS) {
461 *error_string = talloc_asprintf(mem_ctx, "Failed to create user record. Tried both %s and %s: %s",
462 ldb_dn_get_linearized(first_try_dn),
463 ldb_dn_get_linearized(msg->dn),
464 ldb_errstring(state->sam_ldb));
465 return NT_STATUS_INTERNAL_DB_CORRUPTION;
466 }
467 }
468 }
469 } else {
470 ret = dsdb_replace(state->sam_ldb, msg, 0);
471 if (ret != LDB_SUCCESS) {
472 *error_string = talloc_asprintf(mem_ctx, "Failed to modify user record %s: %s",
473 ldb_dn_get_linearized(msg->dn),
474 ldb_errstring(state->sam_ldb));
475 return NT_STATUS_INTERNAL_DB_CORRUPTION;
476 }
477 }
478
479 return NT_STATUS_OK;
480 }
481
482 static NTSTATUS samsync_ldb_delete_user(TALLOC_CTX *mem_ctx,
483 struct samsync_ldb_state *state,
484 enum netr_SamDatabaseID database,
485 struct netr_DELTA_ENUM *delta,
486 char **error_string)
487 {
488 uint32_t rid = delta->delta_id_union.rid;
489 struct ldb_message **msgs;
490 int ret;
491 const char *attrs[] = { NULL };
492
493 /* search for the user, by rid */
494 ret = gendb_search(state->sam_ldb, mem_ctx, state->base_dn[database],
495 &msgs, attrs, "(&(objectClass=user)(objectSid=%s))",
496 ldap_encode_ndr_dom_sid(mem_ctx, dom_sid_add_rid(mem_ctx, state->dom_sid[database], rid)));
497
498 if (ret == -1) {
499 *error_string = talloc_asprintf(mem_ctx, "gendb_search failed: %s", ldb_errstring(state->sam_ldb));
500 return NT_STATUS_INTERNAL_DB_CORRUPTION;
501 } else if (ret == 0) {
502 return NT_STATUS_NO_SUCH_USER;
503 } else if (ret > 1) {
504 *error_string = talloc_asprintf(mem_ctx, "More than one user with SID: %s",
505 dom_sid_string(mem_ctx,
506 dom_sid_add_rid(mem_ctx,
507 state->dom_sid[database],
508 rid)));
509 return NT_STATUS_INTERNAL_DB_CORRUPTION;
510 }
511
512 ret = ldb_delete(state->sam_ldb, msgs[0]->dn);
513 if (ret != LDB_SUCCESS) {
514 *error_string = talloc_asprintf(mem_ctx, "Failed to delete user record %s: %s",
515 ldb_dn_get_linearized(msgs[0]->dn),
516 ldb_errstring(state->sam_ldb));
517 return NT_STATUS_INTERNAL_DB_CORRUPTION;
518 }
519
520 return NT_STATUS_OK;
521 }
522
523 static NTSTATUS samsync_ldb_handle_group(TALLOC_CTX *mem_ctx,
524 struct samsync_ldb_state *state,
525 enum netr_SamDatabaseID database,
526 struct netr_DELTA_ENUM *delta,
527 char **error_string)
528 {
529 uint32_t rid = delta->delta_id_union.rid;
530 struct netr_DELTA_GROUP *group = delta->delta_union.group;
531 const char *container, *obj_class;
532 const char *cn_name;
533
534 struct ldb_message *msg;
535 struct ldb_message **msgs;
536 int ret;
537 bool add = false;
538 const char *attrs[] = { NULL };
539
540 msg = ldb_msg_new(mem_ctx);
541 if (msg == NULL) {
542 return NT_STATUS_NO_MEMORY;
543 }
544
545 /* search for the group, by rid */
546 ret = gendb_search(state->sam_ldb, mem_ctx, state->base_dn[database], &msgs, attrs,
547 "(&(objectClass=group)(objectSid=%s))",
548 ldap_encode_ndr_dom_sid(mem_ctx, dom_sid_add_rid(mem_ctx, state->dom_sid[database], rid)));
549
550 if (ret == -1) {
551 *error_string = talloc_asprintf(mem_ctx, "gendb_search failed: %s", ldb_errstring(state->sam_ldb));
552 return NT_STATUS_INTERNAL_DB_CORRUPTION;
553 } else if (ret == 0) {
554 add = true;
555 } else if (ret > 1) {
556 *error_string = talloc_asprintf(mem_ctx, "More than one group/alias with SID: %s",
557 dom_sid_string(mem_ctx,
558 dom_sid_add_rid(mem_ctx,
559 state->dom_sid[database],
560 rid)));
561 return NT_STATUS_INTERNAL_DB_CORRUPTION;
562 } else {
563 msg->dn = talloc_steal(msg, msgs[0]->dn);
564 }
565
566 cn_name = group->group_name.string;
567
568 #define ADD_OR_DEL(type, attrib, field) do { \
569 if (group->field) { \
570 samdb_msg_add_ ## type(state->sam_ldb, mem_ctx, msg, \
571 attrib, group->field); \
572 } else if (!add) { \
573 samdb_msg_add_delete(state->sam_ldb, mem_ctx, msg, \
574 attrib); \
575 } \
576 } while (0);
577
578 ADD_OR_DEL(string, "samAccountName", group_name.string);
579
580 if (samdb_msg_add_dom_sid(state->sam_ldb, mem_ctx, msg,
581 "objectSid", dom_sid_add_rid(mem_ctx, state->dom_sid[database], rid))) {
582 return NT_STATUS_NO_MEMORY;
583 }
584
585 ADD_OR_DEL(string, "description", description.string);
586
587 #undef ADD_OR_DEL
588
589 container = "Users";
590 obj_class = "group";
591
592 if (add) {
593 ldb_msg_add_string(msg, "objectClass", obj_class);
594 msg->dn = ldb_dn_copy(mem_ctx, state->base_dn[database]);
595 ldb_dn_add_child_fmt(msg->dn, "CN=%s,CN=%s", cn_name, container);
596 if (!msg->dn) {
597 return NT_STATUS_NO_MEMORY;
598 }
599
600 ret = ldb_add(state->sam_ldb, msg);
601 if (ret != LDB_SUCCESS) {
602 *error_string = talloc_asprintf(mem_ctx, "Failed to create group record %s: %s",
603 ldb_dn_get_linearized(msg->dn),
604 ldb_errstring(state->sam_ldb));
605 return NT_STATUS_INTERNAL_DB_CORRUPTION;
606 }
607 } else {
608 ret = dsdb_replace(state->sam_ldb, msg, 0);
609 if (ret != LDB_SUCCESS) {
610 *error_string = talloc_asprintf(mem_ctx, "Failed to modify group record %s: %s",
611 ldb_dn_get_linearized(msg->dn),
612 ldb_errstring(state->sam_ldb));
613 return NT_STATUS_INTERNAL_DB_CORRUPTION;
614 }
615 }
616
617 return NT_STATUS_OK;
618 }
619
620 static NTSTATUS samsync_ldb_delete_group(TALLOC_CTX *mem_ctx,
621 struct samsync_ldb_state *state,
622 enum netr_SamDatabaseID database,
623 struct netr_DELTA_ENUM *delta,
624 char **error_string)
625 {
626 uint32_t rid = delta->delta_id_union.rid;
627 struct ldb_message **msgs;
628 int ret;
629 const char *attrs[] = { NULL };
630
631 /* search for the group, by rid */
632 ret = gendb_search(state->sam_ldb, mem_ctx, state->base_dn[database], &msgs, attrs,
633 "(&(objectClass=group)(objectSid=%s))",
634 ldap_encode_ndr_dom_sid(mem_ctx, dom_sid_add_rid(mem_ctx, state->dom_sid[database], rid)));
635
636 if (ret == -1) {
637 *error_string = talloc_asprintf(mem_ctx, "gendb_search failed: %s", ldb_errstring(state->sam_ldb));
638 return NT_STATUS_INTERNAL_DB_CORRUPTION;
639 } else if (ret == 0) {
640 return NT_STATUS_NO_SUCH_GROUP;
641 } else if (ret > 1) {
642 *error_string = talloc_asprintf(mem_ctx, "More than one group/alias with SID: %s",
643 dom_sid_string(mem_ctx,
644 dom_sid_add_rid(mem_ctx,
645 state->dom_sid[database],
646 rid)));
647 return NT_STATUS_INTERNAL_DB_CORRUPTION;
648 }
649
650 ret = ldb_delete(state->sam_ldb, msgs[0]->dn);
651 if (ret != LDB_SUCCESS) {
652 *error_string = talloc_asprintf(mem_ctx, "Failed to delete group record %s: %s",
653 ldb_dn_get_linearized(msgs[0]->dn),
654 ldb_errstring(state->sam_ldb));
655 return NT_STATUS_INTERNAL_DB_CORRUPTION;
656 }
657
658 return NT_STATUS_OK;
659 }
660
661 static NTSTATUS samsync_ldb_handle_group_member(TALLOC_CTX *mem_ctx,
662 struct samsync_ldb_state *state,
663 enum netr_SamDatabaseID database,
664 struct netr_DELTA_ENUM *delta,
665 char **error_string)
666 {
667 uint32_t rid = delta->delta_id_union.rid;
668 struct netr_DELTA_GROUP_MEMBER *group_member = delta->delta_union.group_member;
669 struct ldb_message *msg;
670 struct ldb_message **msgs;
671 int ret;
672 const char *attrs[] = { NULL };
673 const char *str_dn;
674 uint32_t i;
675
676 msg = ldb_msg_new(mem_ctx);
677 if (msg == NULL) {
678 return NT_STATUS_NO_MEMORY;
679 }
680
681 /* search for the group, by rid */
682 ret = gendb_search(state->sam_ldb, mem_ctx, state->base_dn[database], &msgs, attrs,
683 "(&(objectClass=group)(objectSid=%s))",
684 ldap_encode_ndr_dom_sid(mem_ctx, dom_sid_add_rid(mem_ctx, state->dom_sid[database], rid)));
685
686 if (ret == -1) {
687 *error_string = talloc_asprintf(mem_ctx, "gendb_search failed: %s", ldb_errstring(state->sam_ldb));
688 return NT_STATUS_INTERNAL_DB_CORRUPTION;
689 } else if (ret == 0) {
690 return NT_STATUS_NO_SUCH_GROUP;
691 } else if (ret > 1) {
692 *error_string = talloc_asprintf(mem_ctx, "More than one group/alias with SID: %s",
693 dom_sid_string(mem_ctx,
694 dom_sid_add_rid(mem_ctx,
695 state->dom_sid[database],
696 rid)));
697 return NT_STATUS_INTERNAL_DB_CORRUPTION;
698 } else {
699 msg->dn = talloc_steal(msg, msgs[0]->dn);
700 }
701
702 talloc_free(msgs);
703
704 for (i=0; i<group_member->num_rids; i++) {
705 /* search for the group, by rid */
706 ret = gendb_search(state->sam_ldb, mem_ctx, state->base_dn[database], &msgs, attrs,
707 "(&(objectClass=user)(objectSid=%s))",
708 ldap_encode_ndr_dom_sid(mem_ctx, dom_sid_add_rid(mem_ctx, state->dom_sid[database], group_member->rids[i])));
709
710 if (ret == -1) {
711 *error_string = talloc_asprintf(mem_ctx, "gendb_search failed: %s", ldb_errstring(state->sam_ldb));
712 return NT_STATUS_INTERNAL_DB_CORRUPTION;
713 } else if (ret == 0) {
714 return NT_STATUS_NO_SUCH_USER;
715 } else if (ret > 1) {
716 return NT_STATUS_INTERNAL_DB_CORRUPTION;
717 } else {
718 str_dn = ldb_dn_alloc_linearized(msg, msgs[0]->dn);
719 NT_STATUS_HAVE_NO_MEMORY(str_dn);
720 ret = ldb_msg_add_string(msg, "member", str_dn);
721 if (ret != LDB_SUCCESS) return NT_STATUS_NO_MEMORY;
722 }
723
724 talloc_free(msgs);
725 }
726
727 ret = dsdb_replace(state->sam_ldb, msg, 0);
728 if (ret != LDB_SUCCESS) {
729 *error_string = talloc_asprintf(mem_ctx, "Failed to modify group record %s: %s",
730 ldb_dn_get_linearized(msg->dn),
731 ldb_errstring(state->sam_ldb));
732 return NT_STATUS_INTERNAL_DB_CORRUPTION;
733 }
734
735 return NT_STATUS_OK;
736 }
737
738 static NTSTATUS samsync_ldb_handle_alias(TALLOC_CTX *mem_ctx,
739 struct samsync_ldb_state *state,
740 enum netr_SamDatabaseID database,
741 struct netr_DELTA_ENUM *delta,
742 char **error_string)
743 {
744 uint32_t rid = delta->delta_id_union.rid;
745 struct netr_DELTA_ALIAS *alias = delta->delta_union.alias;
746 const char *container, *obj_class;
747 const char *cn_name;
748
749 struct ldb_message *msg;
750 struct ldb_message **msgs;
751 int ret;
752 bool add = false;
753 const char *attrs[] = { NULL };
754
755 msg = ldb_msg_new(mem_ctx);
756 if (msg == NULL) {
757 return NT_STATUS_NO_MEMORY;
758 }
759
760 /* search for the alias, by rid */
761 ret = gendb_search(state->sam_ldb, mem_ctx, state->base_dn[database], &msgs, attrs,
762 "(&(objectClass=group)(objectSid=%s))",
763 ldap_encode_ndr_dom_sid(mem_ctx, dom_sid_add_rid(mem_ctx, state->dom_sid[database], rid)));
764
765 if (ret == -1) {
766 *error_string = talloc_asprintf(mem_ctx, "gendb_search failed: %s", ldb_errstring(state->sam_ldb));
767 return NT_STATUS_INTERNAL_DB_CORRUPTION;
768 } else if (ret == 0) {
769 add = true;
770 } else if (ret > 1) {
771 *error_string = talloc_asprintf(mem_ctx, "More than one group/alias with SID: %s",
772 dom_sid_string(mem_ctx,
773 dom_sid_add_rid(mem_ctx,
774 state->dom_sid[database],
775 rid)));
776 return NT_STATUS_INTERNAL_DB_CORRUPTION;
777 } else {
778 msg->dn = talloc_steal(mem_ctx, msgs[0]->dn);
779 }
780
781 cn_name = alias->alias_name.string;
782
783 #define ADD_OR_DEL(type, attrib, field) do { \
784 if (alias->field) { \
785 samdb_msg_add_ ## type(state->sam_ldb, mem_ctx, msg, \
786 attrib, alias->field); \
787 } else if (!add) { \
788 samdb_msg_add_delete(state->sam_ldb, mem_ctx, msg, \
789 attrib); \
790 } \
791 } while (0);
792
793 ADD_OR_DEL(string, "samAccountName", alias_name.string);
794
795 if (samdb_msg_add_dom_sid(state->sam_ldb, mem_ctx, msg,
796 "objectSid", dom_sid_add_rid(mem_ctx, state->dom_sid[database], rid))) {
797 return NT_STATUS_NO_MEMORY;
798 }
799
800 ADD_OR_DEL(string, "description", description.string);
801
802 #undef ADD_OR_DEL
803
804 samdb_msg_add_uint(state->sam_ldb, mem_ctx, msg, "groupType", 0x80000004);
805
806 container = "Users";
807 obj_class = "group";
808
809 if (add) {
810 ldb_msg_add_string(msg, "objectClass", obj_class);
811 msg->dn = ldb_dn_copy(mem_ctx, state->base_dn[database]);
812 ldb_dn_add_child_fmt(msg->dn, "CN=%s,CN=%s", cn_name, container);
813 if (!msg->dn) {
814 return NT_STATUS_NO_MEMORY;
815 }
816
817 ret = ldb_add(state->sam_ldb, msg);
818 if (ret != LDB_SUCCESS) {
819 *error_string = talloc_asprintf(mem_ctx, "Failed to create alias record %s: %s",
820 ldb_dn_get_linearized(msg->dn),
821 ldb_errstring(state->sam_ldb));
822 return NT_STATUS_INTERNAL_DB_CORRUPTION;
823 }
824 } else {
825 ret = dsdb_replace(state->sam_ldb, msg, 0);
826 if (ret != LDB_SUCCESS) {
827 *error_string = talloc_asprintf(mem_ctx, "Failed to modify alias record %s: %s",
828 ldb_dn_get_linearized(msg->dn),
829 ldb_errstring(state->sam_ldb));
830 return NT_STATUS_INTERNAL_DB_CORRUPTION;
831 }
832 }
833
834 return NT_STATUS_OK;
835 }
836
837 static NTSTATUS samsync_ldb_delete_alias(TALLOC_CTX *mem_ctx,
838 struct samsync_ldb_state *state,
839 enum netr_SamDatabaseID database,
840 struct netr_DELTA_ENUM *delta,
841 char **error_string)
842 {
843 uint32_t rid = delta->delta_id_union.rid;
844 struct ldb_message **msgs;
845 int ret;
846 const char *attrs[] = { NULL };
847
848 /* search for the alias, by rid */
849 ret = gendb_search(state->sam_ldb, mem_ctx, state->base_dn[database], &msgs, attrs,
850 "(&(objectClass=group)(objectSid=%s))",
851 ldap_encode_ndr_dom_sid(mem_ctx, dom_sid_add_rid(mem_ctx, state->dom_sid[database], rid)));
852
853 if (ret == -1) {
854 *error_string = talloc_asprintf(mem_ctx, "gendb_search failed: %s", ldb_errstring(state->sam_ldb));
855 return NT_STATUS_INTERNAL_DB_CORRUPTION;
856 } else if (ret == 0) {
857 return NT_STATUS_NO_SUCH_ALIAS;
858 } else if (ret > 1) {
859 return NT_STATUS_INTERNAL_DB_CORRUPTION;
860 }
861
862 ret = ldb_delete(state->sam_ldb, msgs[0]->dn);
863 if (ret != LDB_SUCCESS) {
864 *error_string = talloc_asprintf(mem_ctx, "Failed to delete alias record %s: %s",
865 ldb_dn_get_linearized(msgs[0]->dn),
866 ldb_errstring(state->sam_ldb));
867 return NT_STATUS_INTERNAL_DB_CORRUPTION;
868 }
869
870 return NT_STATUS_OK;
871 }
872
873 static NTSTATUS samsync_ldb_handle_alias_member(TALLOC_CTX *mem_ctx,
874 struct samsync_ldb_state *state,
875 enum netr_SamDatabaseID database,
876 struct netr_DELTA_ENUM *delta,
877 char **error_string)
878 {
879 uint32_t rid = delta->delta_id_union.rid;
880 struct netr_DELTA_ALIAS_MEMBER *alias_member = delta->delta_union.alias_member;
881 struct ldb_message *msg;
882 struct ldb_message **msgs;
883 int ret;
884 const char *attrs[] = { NULL };
885 uint32_t i;
886
887 msg = ldb_msg_new(mem_ctx);
888 if (msg == NULL) {
889 return NT_STATUS_NO_MEMORY;
890 }
891
892 /* search for the alias, by rid */
893 ret = gendb_search(state->sam_ldb, mem_ctx, state->base_dn[database], &msgs, attrs,
894 "(&(objectClass=group)(objectSid=%s))",
895 ldap_encode_ndr_dom_sid(mem_ctx, dom_sid_add_rid(mem_ctx, state->dom_sid[database], rid)));
896
897 if (ret == -1) {
898 *error_string = talloc_asprintf(mem_ctx, "gendb_search failed: %s", ldb_errstring(state->sam_ldb));
899 return NT_STATUS_INTERNAL_DB_CORRUPTION;
900 } else if (ret == 0) {
901 return NT_STATUS_NO_SUCH_GROUP;
902 } else if (ret > 1) {
903 *error_string = talloc_asprintf(mem_ctx, "More than one group/alias with SID: %s",
904 dom_sid_string(mem_ctx,
905 dom_sid_add_rid(mem_ctx,
906 state->dom_sid[database],
907 rid)));
908 return NT_STATUS_INTERNAL_DB_CORRUPTION;
909 } else {
910 msg->dn = talloc_steal(msg, msgs[0]->dn);
911 }
912
913 talloc_free(msgs);
914
915 for (i=0; i<alias_member->sids.num_sids; i++) {
916 struct ldb_dn *alias_member_dn;
917 const char *str_dn;
918 /* search for members, in the top basedn (normal users are builtin aliases) */
919 ret = gendb_search(state->sam_ldb, mem_ctx, state->base_dn[SAM_DATABASE_DOMAIN], &msgs, attrs,
920 "(objectSid=%s)",
921 ldap_encode_ndr_dom_sid(mem_ctx, alias_member->sids.sids[i].sid));
922
923 if (ret == -1) {
924 *error_string = talloc_asprintf(mem_ctx, "gendb_search failed: %s", ldb_errstring(state->sam_ldb));
925 return NT_STATUS_INTERNAL_DB_CORRUPTION;
926 } else if (ret == 0) {
927 NTSTATUS nt_status;
928 nt_status = samsync_ldb_add_foreignSecurityPrincipal(mem_ctx, state,
929 alias_member->sids.sids[i].sid,
930 &alias_member_dn,
931 error_string);
932 if (!NT_STATUS_IS_OK(nt_status)) {
933 return nt_status;
934 }
935 } else if (ret > 1) {
936 return NT_STATUS_INTERNAL_DB_CORRUPTION;
937 } else {
938 alias_member_dn = msgs[0]->dn;
939 }
940 str_dn = ldb_dn_alloc_linearized(msg, alias_member_dn);
941 NT_STATUS_HAVE_NO_MEMORY(str_dn);
942 ret = ldb_msg_add_string(msg, "member", str_dn);
943 if (ret != LDB_SUCCESS) return NT_STATUS_NO_MEMORY;
944
945 talloc_free(msgs);
946 }
947
948 ret = dsdb_replace(state->sam_ldb, msg, 0);
949 if (ret != LDB_SUCCESS) {
950 *error_string = talloc_asprintf(mem_ctx, "Failed to modify group record %s: %s",
951 ldb_dn_get_linearized(msg->dn),
952 ldb_errstring(state->sam_ldb));
953 return NT_STATUS_INTERNAL_DB_CORRUPTION;
954 }
955
956 return NT_STATUS_OK;
957 }
958
959 static NTSTATUS samsync_ldb_handle_account(TALLOC_CTX *mem_ctx,
960 struct samsync_ldb_state *state,
961 enum netr_SamDatabaseID database,
962 struct netr_DELTA_ENUM *delta,
963 char **error_string)
964 {
965 struct dom_sid *sid = delta->delta_id_union.sid;
966 struct netr_DELTA_ACCOUNT *account = delta->delta_union.account;
967
968 struct ldb_message *msg;
969 int ret;
970 uint32_t i;
971 char *dnstr, *sidstr;
972
973 msg = ldb_msg_new(mem_ctx);
974 if (msg == NULL) {
975 return NT_STATUS_NO_MEMORY;
976 }
977
978 sidstr = dom_sid_string(msg, sid);
979 NT_STATUS_HAVE_NO_MEMORY_AND_FREE(sidstr, msg);
980
981 dnstr = talloc_asprintf(msg, "sid=%s", sidstr);
982 NT_STATUS_HAVE_NO_MEMORY_AND_FREE(dnstr, msg);
983
984 msg->dn = ldb_dn_new(msg, state->pdb, dnstr);
985 NT_STATUS_HAVE_NO_MEMORY_AND_FREE(msg->dn, msg);
986
987 for (i=0; i< account->privilege_entries; i++) {
988 ldb_msg_add_string(msg, "privilege", account->privilege_name[i].string);
989 }
990
991 ret = dsdb_replace(state->pdb, msg, 0);
992 if (ret == LDB_ERR_NO_SUCH_OBJECT) {
993 if (samdb_msg_add_dom_sid(state->pdb, msg, msg, "objectSid", sid) != LDB_SUCCESS) {
994 talloc_free(msg);
995 return NT_STATUS_NO_MEMORY;
996 }
997 ldb_msg_add_string(msg, "comment", "added via samsync");
998 ret = ldb_add(state->pdb, msg);
999 }
1000
1001 if (ret != LDB_SUCCESS) {
1002 *error_string = talloc_asprintf(mem_ctx, "Failed to modify privilege record %s",
1003 ldb_dn_get_linearized(msg->dn));
1004 return NT_STATUS_INTERNAL_DB_CORRUPTION;
1005 }
1006
1007 return NT_STATUS_OK;
1008 }
1009
1010 static NTSTATUS samsync_ldb_delete_account(TALLOC_CTX *mem_ctx,
1011 struct samsync_ldb_state *state,
1012 enum netr_SamDatabaseID database,
1013 struct netr_DELTA_ENUM *delta,
1014 char **error_string)
1015 {
1016 struct dom_sid *sid = delta->delta_id_union.sid;
1017
1018 struct ldb_message *msg;
1019 struct ldb_message **msgs;
1020 int ret;
1021 const char *attrs[] = { NULL };
1022
1023 msg = ldb_msg_new(mem_ctx);
1024 if (msg == NULL) {
1025 return NT_STATUS_NO_MEMORY;
1026 }
1027
1028 /* search for the account, by sid, in the top basedn */
1029 ret = gendb_search(state->sam_ldb, mem_ctx, state->base_dn[SAM_DATABASE_DOMAIN], &msgs, attrs,
1030 "(objectSid=%s)",
1031 ldap_encode_ndr_dom_sid(mem_ctx, sid));
1032
1033 if (ret == -1) {
1034 *error_string = talloc_asprintf(mem_ctx, "gendb_search failed: %s", ldb_errstring(state->sam_ldb));
1035 return NT_STATUS_INTERNAL_DB_CORRUPTION;
1036 } else if (ret == 0) {
1037 return NT_STATUS_NO_SUCH_USER;
1038 } else if (ret > 1) {
1039 *error_string = talloc_asprintf(mem_ctx, "More than one account with SID: %s",
1040 dom_sid_string(mem_ctx, sid));
1041 return NT_STATUS_INTERNAL_DB_CORRUPTION;
1042 } else {
1043 msg->dn = talloc_steal(msg, msgs[0]->dn);
1044 }
1045
1046 samdb_msg_add_delete(state->sam_ldb, mem_ctx, msg,
1047 "privilege");
1048
1049 ret = dsdb_replace(state->sam_ldb, msg, 0);
1050 if (ret != LDB_SUCCESS) {
1051 *error_string = talloc_asprintf(mem_ctx, "Failed to modify privilege record %s",
1052 ldb_dn_get_linearized(msg->dn));
1053 return NT_STATUS_INTERNAL_DB_CORRUPTION;
1054 }
1055
1056 return NT_STATUS_OK;
1057 }
1058
1059 static NTSTATUS libnet_samsync_ldb_fn(TALLOC_CTX *mem_ctx,
1060 void *private_data,
1061 enum netr_SamDatabaseID database,
1062 struct netr_DELTA_ENUM *delta,
1063 char **error_string)
1064 {
1065 NTSTATUS nt_status = NT_STATUS_OK;
1066 struct samsync_ldb_state *state = talloc_get_type(private_data, struct samsync_ldb_state);
1067
1068 *error_string = NULL;
1069 switch (delta->delta_type) {
1070 case NETR_DELTA_DOMAIN:
1071 {
1072 nt_status = samsync_ldb_handle_domain(mem_ctx,
1073 state,
1074 database,
1075 delta,
1076 error_string);
1077 break;
1078 }
1079 case NETR_DELTA_USER:
1080 {
1081 nt_status = samsync_ldb_handle_user(mem_ctx,
1082 state,
1083 database,
1084 delta,
1085 error_string);
1086 break;
1087 }
1088 case NETR_DELTA_DELETE_USER:
1089 {
1090 nt_status = samsync_ldb_delete_user(mem_ctx,
1091 state,
1092 database,
1093 delta,
1094 error_string);
1095 break;
1096 }
1097 case NETR_DELTA_GROUP:
1098 {
1099 nt_status = samsync_ldb_handle_group(mem_ctx,
1100 state,
1101 database,
1102 delta,
1103 error_string);
1104 break;
1105 }
1106 case NETR_DELTA_DELETE_GROUP:
1107 {
1108 nt_status = samsync_ldb_delete_group(mem_ctx,
1109 state,
1110 database,
1111 delta,
1112 error_string);
1113 break;
1114 }
1115 case NETR_DELTA_GROUP_MEMBER:
1116 {
1117 nt_status = samsync_ldb_handle_group_member(mem_ctx,
1118 state,
1119 database,
1120 delta,
1121 error_string);
1122 break;
1123 }
1124 case NETR_DELTA_ALIAS:
1125 {
1126 nt_status = samsync_ldb_handle_alias(mem_ctx,
1127 state,
1128 database,
1129 delta,
1130 error_string);
1131 break;
1132 }
1133 case NETR_DELTA_DELETE_ALIAS:
1134 {
1135 nt_status = samsync_ldb_delete_alias(mem_ctx,
1136 state,
1137 database,
1138 delta,
1139 error_string);
1140 break;
1141 }
1142 case NETR_DELTA_ALIAS_MEMBER:
1143 {
1144 nt_status = samsync_ldb_handle_alias_member(mem_ctx,
1145 state,
1146 database,
1147 delta,
1148 error_string);
1149 break;
1150 }
1151 case NETR_DELTA_ACCOUNT:
1152 {
1153 nt_status = samsync_ldb_handle_account(mem_ctx,
1154 state,
1155 database,
1156 delta,
1157 error_string);
1158 break;
1159 }
1160 case NETR_DELTA_DELETE_ACCOUNT:
1161 {
1162 nt_status = samsync_ldb_delete_account(mem_ctx,
1163 state,
1164 database,
1165 delta,
1166 error_string);
1167 break;
1168 }
1169 default:
1170 /* Can't dump them all right now */
1171 break;
1172 }
1173 if (!NT_STATUS_IS_OK(nt_status) && !*error_string) {
1174 *error_string = talloc_asprintf(mem_ctx, "Failed to handle samsync delta: %s", nt_errstr(nt_status));
1175 }
1176 return nt_status;
1177 }
1178
1179 static NTSTATUS libnet_samsync_ldb_init(TALLOC_CTX *mem_ctx,
1180 void *private_data,
1181 struct libnet_SamSync_state *samsync_state,
1182 char **error_string)
1183 {
1184 struct samsync_ldb_state *state = talloc_get_type(private_data, struct samsync_ldb_state);
1185 const char *server = dcerpc_server_name(samsync_state->netlogon_pipe);
1186 char *ldap_url;
1187
1188 state->samsync_state = samsync_state;
1189
1190 ZERO_STRUCT(state->dom_sid);
1191 if (state->samsync_state->domain_sid) {
1192 state->dom_sid[SAM_DATABASE_DOMAIN] = dom_sid_dup(state, state->samsync_state->domain_sid);
1193 }
1194
1195 state->dom_sid[SAM_DATABASE_BUILTIN] = dom_sid_parse_talloc(state, SID_BUILTIN);
1196
1197 if (state->samsync_state->realm) {
1198 if (!server || !*server) {
1199 /* huh? how do we not have a server name? */
1200 *error_string = talloc_strdup(mem_ctx, "No DCE/RPC server name available. How did we connect?");
1201 return NT_STATUS_INVALID_PARAMETER;
1202 }
1203 ldap_url = talloc_asprintf(state, "ldap://%s", server);
1204
1205 state->remote_ldb = ldb_wrap_connect(mem_ctx,
1206 NULL,
1207 state->samsync_state->machine_net_ctx->lp_ctx,
1208 ldap_url,
1209 NULL, state->samsync_state->machine_net_ctx->cred,
1210 0);
1211 if (!state->remote_ldb) {
1212 *error_string = talloc_asprintf(mem_ctx, "Failed to connect to remote LDAP server at %s (used to extract additional data in SamSync replication)", ldap_url);
1213 return NT_STATUS_NO_LOGON_SERVERS;
1214 }
1215 } else {
1216 state->remote_ldb = NULL;
1217 }
1218 return NT_STATUS_OK;
1219 }
1220
1221 NTSTATUS libnet_samsync_ldb(struct libnet_context *ctx, TALLOC_CTX *mem_ctx, struct libnet_samsync_ldb *r)
1222 {
1223 NTSTATUS nt_status;
1224 struct libnet_SamSync r2;
1225 struct samsync_ldb_state *state = talloc(mem_ctx, struct samsync_ldb_state);
1226
1227 if (!state) {
1228 return NT_STATUS_NO_MEMORY;
1229 }
1230
1231 state->secrets = NULL;
1232 state->trusted_domains = NULL;
1233
1234 state->sam_ldb = samdb_connect(mem_ctx,
1235 ctx->event_ctx,
1236 ctx->lp_ctx,
1237 r->in.session_info,
1238 0);
1239 if (!state->sam_ldb) {
1240 return NT_STATUS_INTERNAL_DB_ERROR;
1241 }
1242
1243 state->pdb = privilege_connect(mem_ctx,
1244 ctx->lp_ctx);
1245 if (!state->pdb) {
1246 return NT_STATUS_INTERNAL_DB_ERROR;
1247 }
1248
1249 r2.out.error_string = NULL;
1250 r2.in.binding_string = r->in.binding_string;
1251 r2.in.init_fn = libnet_samsync_ldb_init;
1252 r2.in.delta_fn = libnet_samsync_ldb_fn;
1253 r2.in.fn_ctx = state;
1254 r2.in.machine_account = NULL; /* TODO: Create a machine account, fill this in, and the delete it */
1255 nt_status = libnet_SamSync_netlogon(ctx, state, &r2);
1256 r->out.error_string = r2.out.error_string;
1257 talloc_steal(mem_ctx, r->out.error_string);
1258
1259 if (!NT_STATUS_IS_OK(nt_status)) {
1260 talloc_free(state);
1261 return nt_status;
1262 }
1263 talloc_free(state);
1264 return nt_status;
1265 }
reg import