source4/libnet/libnet_become_dc.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3
   4    Copyright (C) Stefan Metzmacher      2006
   5
   6    This program is free software; you can redistribute it and/or modify
   7    it under the terms of the GNU General Public License as published by
   8    the Free Software Foundation; either version 2 of the License, or
   9    (at your option) any later version.
  10
  11    This program is distributed in the hope that it will be useful,
  12    but WITHOUT ANY WARRANTY; without even the implied warranty of
  13    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  14    GNU General Public License for more details.
  15
  16    You should have received a copy of the GNU General Public License
  17    along with this program; if not, write to the Free Software
  18    Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  19 */
  20
  21 #include "includes.h"
  22 #include "libnet/libnet.h"
  23 #include "libcli/composite/composite.h"
  24 #include "libcli/cldap/cldap.h"
  25 #include "lib/ldb/include/ldb.h"
  26 #include "lib/ldb/include/ldb_errors.h"
  27 #include "lib/db_wrap.h"
  28 #include "dsdb/samdb/samdb.h"
  29 #include "dsdb/common/flags.h"
  30 #include "librpc/gen_ndr/ndr_drsuapi_c.h"
  31 #include "libcli/security/security.h"
  32
  33 struct libnet_BecomeDC_state {
  34         struct composite_context *creq;
  35
  36         struct libnet_context *libnet;
  37
  38         struct dom_sid zero_sid;
  39
  40         struct {
  41                 struct cldap_socket *sock;
  42                 struct cldap_netlogon io;
  43                 struct nbt_cldap_netlogon_5 netlogon5;
  44         } cldap;
  45
  46         struct becomeDC_ldap {
  47                 struct ldb_context *ldb;
  48                 const struct ldb_message *rootdse;
  49         } ldap1, ldap2;
  50
  51         struct becomeDC_drsuapi {
  52                 struct libnet_BecomeDC_state *s;
  53                 struct dcerpc_binding *binding;
  54                 struct dcerpc_pipe *pipe;
  55                 struct drsuapi_DsBind bind_r;
  56                 struct GUID bind_guid;
  57                 struct drsuapi_DsBindInfoCtr bind_info_ctr;
  58                 struct drsuapi_DsBindInfo28 local_info28;
  59                 struct drsuapi_DsBindInfo28 remote_info28;
  60                 struct policy_handle bind_handle;
  61         } drsuapi1, drsuapi2, drsuapi3;
  62
  63         struct {
  64                 /* input */
  65                 const char *dns_name;
  66                 const char *netbios_name;
  67                 const struct dom_sid *sid;
  68
  69                 /* constructed */
  70                 struct GUID guid;
  71                 const char *dn_str;
  72         } domain;
  73
  74         struct {
  75                 /* constructed */
  76                 const char *dns_name;
  77                 const char *root_dn_str;
  78                 const char *config_dn_str;
  79                 const char *schema_dn_str;
  80         } forest;
  81
  82         struct {
  83                 /* input */
  84                 const char *address;
  85
  86                 /* constructed */
  87                 const char *dns_name;
  88                 const char *netbios_name;
  89                 const char *site_name;
  90                 const char *server_dn_str;
  91                 const char *ntds_dn_str;
  92         } source_dsa;
  93
  94         struct {
  95                 /* input */
  96                 const char *netbios_name;
  97
  98                 /* constructed */
  99                 const char *dns_name;
 100                 const char *site_name;
 101                 struct GUID site_guid;
 102                 const char *computer_dn_str;
 103                 const char *server_dn_str;
 104                 const char *ntds_dn_str;
 105                 struct GUID ntds_guid;
 106                 struct GUID invocation_id;
 107                 uint32_t user_account_control;
 108         } dest_dsa;
 109
 110         struct {
 111                 uint32_t domain_behavior_version;
 112                 uint32_t config_behavior_version;
 113                 uint32_t schema_object_version;
 114                 uint32_t w2k3_update_revision;
 115         } ads_options;
 116
 117         struct becomeDC_partition {
 118                 struct drsuapi_DsReplicaObjectIdentifier nc;
 119                 struct GUID destination_dsa_guid;
 120                 struct GUID source_dsa_guid;
 121                 struct GUID source_dsa_invocation_id;
 122                 struct drsuapi_DsReplicaHighWaterMark highwatermark;
 123                 struct drsuapi_DsReplicaCoursorCtrEx *uptodateness_vector;
 124                 uint32_t replica_flags;
 125
 126                 struct drsuapi_DsReplicaObjectListItemEx *first_object;
 127                 struct drsuapi_DsReplicaObjectListItemEx *last_object;
 128         } schema_part, config_part, domain_part;
 129
 130         struct becomeDC_fsmo {
 131                 const char *dns_name;
 132                 const char *server_dn_str;
 133                 const char *ntds_dn_str;
 134                 struct GUID ntds_guid;
 135         } infrastructure_fsmo;
 136
 137         struct becomeDC_fsmo rid_manager_fsmo;
 138 };
 139
 140 static void becomeDC_connect_ldap1(struct libnet_BecomeDC_state *s);
 141
 142 static void becomeDC_recv_cldap(struct cldap_request *req)
 143 {
 144         struct libnet_BecomeDC_state *s = talloc_get_type(req->async.private,
 145                                           struct libnet_BecomeDC_state);
 146         struct composite_context *c = s->creq;
 147
 148         c->status = cldap_netlogon_recv(req, s, &s->cldap.io);
 149         if (!composite_is_ok(c)) return;
 150
 151         s->cldap.netlogon5 = s->cldap.io.out.netlogon.logon5;
 152
 153         s->domain.dns_name              = s->cldap.netlogon5.dns_domain;
 154         s->domain.netbios_name          = s->cldap.netlogon5.domain;
 155         s->domain.guid                  = s->cldap.netlogon5.domain_uuid;
 156
 157         s->forest.dns_name              = s->cldap.netlogon5.forest;
 158
 159         s->source_dsa.dns_name          = s->cldap.netlogon5.pdc_dns_name;
 160         s->source_dsa.netbios_name      = s->cldap.netlogon5.pdc_name;
 161         s->source_dsa.site_name         = s->cldap.netlogon5.server_site;
 162
 163         s->dest_dsa.site_name           = s->cldap.netlogon5.client_site;
 164
 165         becomeDC_connect_ldap1(s);
 166 }
 167
 168 static void becomeDC_send_cldap(struct libnet_BecomeDC_state *s)
 169 {
 170         struct composite_context *c = s->creq;
 171         struct cldap_request *req;
 172
 173         s->cldap.io.in.dest_address     = s->source_dsa.address;
 174         s->cldap.io.in.realm            = s->domain.dns_name;
 175         s->cldap.io.in.host             = s->dest_dsa.netbios_name;
 176         s->cldap.io.in.user             = NULL;
 177         s->cldap.io.in.domain_guid      = NULL;
 178         s->cldap.io.in.domain_sid       = NULL;
 179         s->cldap.io.in.acct_control     = -1;
 180         s->cldap.io.in.version          = 6;
 181
 182         s->cldap.sock = cldap_socket_init(s, s->libnet->event_ctx);
 183         if (composite_nomem(s->cldap.sock, c)) return;
 184
 185         req = cldap_netlogon_send(s->cldap.sock, &s->cldap.io);
 186         if (composite_nomem(req, c)) return;
 187         req->async.fn           = becomeDC_recv_cldap;
 188         req->async.private      = s;
 189 }
 190
 191 static NTSTATUS becomeDC_ldap_connect(struct libnet_BecomeDC_state *s, struct becomeDC_ldap *ldap)
 192 {
 193         char *url;
 194
 195         url = talloc_asprintf(s, "ldap://%s/", s->source_dsa.dns_name);
 196         NT_STATUS_HAVE_NO_MEMORY(url);
 197
 198         ldap->ldb = ldb_wrap_connect(s, url,
 199                                      NULL,
 200                                      s->libnet->cred,
 201                                      0, NULL);
 202         talloc_free(url);
 203         if (ldap->ldb == NULL) {
 204                 return NT_STATUS_UNEXPECTED_NETWORK_ERROR;
 205         }
 206
 207         return NT_STATUS_OK;
 208 }
 209
 210 static NTSTATUS becomeDC_ldap1_rootdse(struct libnet_BecomeDC_state *s)
 211 {
 212         int ret;
 213         struct ldb_result *r;
 214         struct ldb_dn *basedn;
 215         static const char *attrs[] = {
 216                 "*",
 217                 NULL
 218         };
 219
 220         basedn = ldb_dn_new(s, s->ldap1.ldb, NULL);
 221         NT_STATUS_HAVE_NO_MEMORY(basedn);
 222
 223         ret = ldb_search(s->ldap1.ldb, basedn, LDB_SCOPE_BASE,
 224                          "(objectClass=*)", attrs, &r);
 225         talloc_free(basedn);
 226         if (ret != LDB_SUCCESS) {
 227                 return NT_STATUS_LDAP(ret);
 228         } else if (r->count != 1) {
 229                 talloc_free(r);
 230                 return NT_STATUS_INVALID_NETWORK_RESPONSE;
 231         }
 232         talloc_steal(s, r);
 233
 234         s->ldap1.rootdse = r->msgs[0];
 235
 236         s->domain.dn_str        = ldb_msg_find_attr_as_string(s->ldap1.rootdse, "defaultNamingContext", NULL);
 237         if (!s->domain.dn_str) return NT_STATUS_INVALID_NETWORK_RESPONSE;
 238
 239         s->forest.root_dn_str   = ldb_msg_find_attr_as_string(s->ldap1.rootdse, "rootDomainNamingContext", NULL);
 240         if (!s->forest.root_dn_str) return NT_STATUS_INVALID_NETWORK_RESPONSE;
 241         s->forest.config_dn_str = ldb_msg_find_attr_as_string(s->ldap1.rootdse, "configurationNamingContext", NULL);
 242         if (!s->forest.config_dn_str) return NT_STATUS_INVALID_NETWORK_RESPONSE;
 243         s->forest.schema_dn_str = ldb_msg_find_attr_as_string(s->ldap1.rootdse, "schemaNamingContext", NULL);
 244         if (!s->forest.schema_dn_str) return NT_STATUS_INVALID_NETWORK_RESPONSE;
 245
 246         s->source_dsa.server_dn_str     = ldb_msg_find_attr_as_string(s->ldap1.rootdse, "serverName", NULL);
 247         if (!s->source_dsa.server_dn_str) return NT_STATUS_INVALID_NETWORK_RESPONSE;
 248         s->source_dsa.ntds_dn_str       = ldb_msg_find_attr_as_string(s->ldap1.rootdse, "dsServiceName", NULL);
 249         if (!s->source_dsa.ntds_dn_str) return NT_STATUS_INVALID_NETWORK_RESPONSE;
 250
 251         return NT_STATUS_OK;
 252 }
 253
 254 static NTSTATUS becomeDC_ldap1_config_behavior_version(struct libnet_BecomeDC_state *s)
 255 {
 256         int ret;
 257         struct ldb_result *r;
 258         struct ldb_dn *basedn;
 259         static const char *attrs[] = {
 260                 "msDs-Behavior-Version",
 261                 NULL
 262         };
 263
 264         basedn = ldb_dn_new(s, s->ldap1.ldb, s->forest.config_dn_str);
 265         NT_STATUS_HAVE_NO_MEMORY(basedn);
 266
 267         ret = ldb_search(s->ldap1.ldb, basedn, LDB_SCOPE_ONELEVEL,
 268                          "(cn=Partitions)", attrs, &r);
 269         talloc_free(basedn);
 270         if (ret != LDB_SUCCESS) {
 271                 return NT_STATUS_LDAP(ret);
 272         } else if (r->count != 1) {
 273                 talloc_free(r);
 274                 return NT_STATUS_INVALID_NETWORK_RESPONSE;
 275         }
 276
 277         s->ads_options.config_behavior_version = ldb_msg_find_attr_as_uint(r->msgs[0], "msDs-Behavior-Version", 0);
 278
 279         talloc_free(r);
 280         return NT_STATUS_OK;
 281 }
 282
 283 static NTSTATUS becomeDC_ldap1_domain_behavior_version(struct libnet_BecomeDC_state *s)
 284 {
 285         int ret;
 286         struct ldb_result *r;
 287         struct ldb_dn *basedn;
 288         static const char *attrs[] = {
 289                 "msDs-Behavior-Version",
 290                 NULL
 291         };
 292
 293         basedn = ldb_dn_new(s, s->ldap1.ldb, s->domain.dn_str);
 294         NT_STATUS_HAVE_NO_MEMORY(basedn);
 295
 296         ret = ldb_search(s->ldap1.ldb, basedn, LDB_SCOPE_BASE,
 297                          "(objectClass=*)", attrs, &r);
 298         talloc_free(basedn);
 299         if (ret != LDB_SUCCESS) {
 300                 return NT_STATUS_LDAP(ret);
 301         } else if (r->count != 1) {
 302                 talloc_free(r);
 303                 return NT_STATUS_INVALID_NETWORK_RESPONSE;
 304         }
 305
 306         s->ads_options.domain_behavior_version = ldb_msg_find_attr_as_uint(r->msgs[0], "msDs-Behavior-Version", 0);
 307
 308         talloc_free(r);
 309         return NT_STATUS_OK;
 310 }
 311
 312 static NTSTATUS becomeDC_ldap1_schema_object_version(struct libnet_BecomeDC_state *s)
 313 {
 314         int ret;
 315         struct ldb_result *r;
 316         struct ldb_dn *basedn;
 317         static const char *attrs[] = {
 318                 "objectVersion",
 319                 NULL
 320         };
 321
 322         basedn = ldb_dn_new(s, s->ldap1.ldb, s->forest.schema_dn_str);
 323         NT_STATUS_HAVE_NO_MEMORY(basedn);
 324
 325         ret = ldb_search(s->ldap1.ldb, basedn, LDB_SCOPE_BASE,
 326                          "(objectClass=*)", attrs, &r);
 327         talloc_free(basedn);
 328         if (ret != LDB_SUCCESS) {
 329                 return NT_STATUS_LDAP(ret);
 330         } else if (r->count != 1) {
 331                 talloc_free(r);
 332                 return NT_STATUS_INVALID_NETWORK_RESPONSE;
 333         }
 334
 335         s->ads_options.schema_object_version = ldb_msg_find_attr_as_uint(r->msgs[0], "objectVersion", 0);
 336
 337         talloc_free(r);
 338         return NT_STATUS_OK;
 339 }
 340
 341 static NTSTATUS becomeDC_ldap1_w2k3_update_revision(struct libnet_BecomeDC_state *s)
 342 {
 343         int ret;
 344         struct ldb_result *r;
 345         struct ldb_dn *basedn;
 346         static const char *attrs[] = {
 347                 "revision",
 348                 NULL
 349         };
 350
 351         basedn = ldb_dn_new_fmt(s, s->ldap1.ldb, "CN=Windows2003Update,CN=DomainUpdates,CN=System,%s",
 352                                 s->domain.dn_str);
 353         NT_STATUS_HAVE_NO_MEMORY(basedn);
 354
 355         ret = ldb_search(s->ldap1.ldb, basedn, LDB_SCOPE_BASE,
 356                          "(objectClass=*)", attrs, &r);
 357         talloc_free(basedn);
 358         if (ret != LDB_SUCCESS) {
 359                 return NT_STATUS_LDAP(ret);
 360         } else if (r->count != 1) {
 361                 talloc_free(r);
 362                 return NT_STATUS_INVALID_NETWORK_RESPONSE;
 363         }
 364
 365         s->ads_options.w2k3_update_revision = ldb_msg_find_attr_as_uint(r->msgs[0], "revision", 0);
 366
 367         talloc_free(r);
 368         return NT_STATUS_OK;
 369 }
 370
 371 static NTSTATUS becomeDC_ldap1_infrastructure_fsmo(struct libnet_BecomeDC_state *s)
 372 {
 373         int ret;
 374         struct ldb_result *r;
 375         struct ldb_dn *basedn;
 376         struct ldb_dn *ntds_dn;
 377         struct ldb_dn *server_dn;
 378         static const char *_1_1_attrs[] = {
 379                 "1.1",
 380                 NULL
 381         };
 382         static const char *fsmo_attrs[] = {
 383                 "fSMORoleOwner",
 384                 NULL
 385         };
 386         static const char *dns_attrs[] = {
 387                 "dnsHostName",
 388                 NULL
 389         };
 390         static const char *guid_attrs[] = {
 391                 "objectGUID",
 392                 NULL
 393         };
 394
 395         basedn = ldb_dn_new_fmt(s, s->ldap1.ldb, "<WKGUID=2fbac1870ade11d297c400c04fd8d5cd,%s>",
 396                                 s->domain.dn_str);
 397         NT_STATUS_HAVE_NO_MEMORY(basedn);
 398
 399         ret = ldb_search(s->ldap1.ldb, basedn, LDB_SCOPE_BASE,
 400                          "(objectClass=*)", _1_1_attrs, &r);
 401         talloc_free(basedn);
 402         if (ret != LDB_SUCCESS) {
 403                 return NT_STATUS_LDAP(ret);
 404         } else if (r->count != 1) {
 405                 talloc_free(r);
 406                 return NT_STATUS_INVALID_NETWORK_RESPONSE;
 407         }
 408
 409         basedn = talloc_steal(s, r->msgs[0]->dn);
 410         talloc_free(r);
 411
 412         ret = ldb_search(s->ldap1.ldb, basedn, LDB_SCOPE_BASE,
 413                          "(objectClass=*)", fsmo_attrs, &r);
 414         talloc_free(basedn);
 415         if (ret != LDB_SUCCESS) {
 416                 return NT_STATUS_LDAP(ret);
 417         } else if (r->count != 1) {
 418                 talloc_free(r);
 419                 return NT_STATUS_INVALID_NETWORK_RESPONSE;
 420         }
 421
 422         s->infrastructure_fsmo.ntds_dn_str      = samdb_result_string(r->msgs[0], "fSMORoleOwner", NULL);
 423         if (!s->infrastructure_fsmo.ntds_dn_str) return NT_STATUS_INVALID_NETWORK_RESPONSE;
 424         talloc_steal(s, s->infrastructure_fsmo.ntds_dn_str);
 425
 426         talloc_free(r);
 427
 428         ntds_dn = ldb_dn_new(s, s->ldap1.ldb, s->infrastructure_fsmo.ntds_dn_str);
 429         NT_STATUS_HAVE_NO_MEMORY(ntds_dn);
 430
 431         server_dn = ldb_dn_get_parent(s, ntds_dn);
 432         NT_STATUS_HAVE_NO_MEMORY(server_dn);
 433
 434         s->infrastructure_fsmo.server_dn_str = ldb_dn_alloc_linearized(s, server_dn);
 435         NT_STATUS_HAVE_NO_MEMORY(s->infrastructure_fsmo.server_dn_str);
 436
 437         ret = ldb_search(s->ldap1.ldb, server_dn, LDB_SCOPE_BASE,
 438                          "(objectClass=*)", dns_attrs, &r);
 439         if (ret != LDB_SUCCESS) {
 440                 return NT_STATUS_LDAP(ret);
 441         } else if (r->count != 1) {
 442                 talloc_free(r);
 443                 return NT_STATUS_INVALID_NETWORK_RESPONSE;
 444         }
 445
 446         s->infrastructure_fsmo.dns_name = samdb_result_string(r->msgs[0], "dnsHostName", NULL);
 447         if (!s->infrastructure_fsmo.dns_name) return NT_STATUS_INVALID_NETWORK_RESPONSE;
 448         talloc_steal(s, s->infrastructure_fsmo.dns_name);
 449
 450         talloc_free(r);
 451
 452         ret = ldb_search(s->ldap1.ldb, ntds_dn, LDB_SCOPE_BASE,
 453                          "(objectClass=*)", guid_attrs, &r);
 454         if (ret != LDB_SUCCESS) {
 455                 return NT_STATUS_LDAP(ret);
 456         } else if (r->count != 1) {
 457                 talloc_free(r);
 458                 return NT_STATUS_INVALID_NETWORK_RESPONSE;
 459         }
 460
 461         s->infrastructure_fsmo.ntds_guid = samdb_result_guid(r->msgs[0], "objectGUID");
 462
 463         talloc_free(r);
 464
 465         return NT_STATUS_OK;
 466 }
 467
 468 static NTSTATUS becomeDC_ldap1_rid_manager_fsmo(struct libnet_BecomeDC_state *s)
 469 {
 470         int ret;
 471         struct ldb_result *r;
 472         struct ldb_dn *basedn;
 473         const char *reference_dn_str;
 474         struct ldb_dn *ntds_dn;
 475         struct ldb_dn *server_dn;
 476         static const char *rid_attrs[] = {
 477                 "rIDManagerReference",
 478                 NULL
 479         };
 480         static const char *fsmo_attrs[] = {
 481                 "fSMORoleOwner",
 482                 NULL
 483         };
 484         static const char *dns_attrs[] = {
 485                 "dnsHostName",
 486                 NULL
 487         };
 488         static const char *guid_attrs[] = {
 489                 "objectGUID",
 490                 NULL
 491         };
 492
 493         basedn = ldb_dn_new(s, s->ldap1.ldb, s->domain.dn_str);
 494         NT_STATUS_HAVE_NO_MEMORY(basedn);
 495
 496         ret = ldb_search(s->ldap1.ldb, basedn, LDB_SCOPE_BASE,
 497                          "(objectClass=*)", rid_attrs, &r);
 498         talloc_free(basedn);
 499         if (ret != LDB_SUCCESS) {
 500                 return NT_STATUS_LDAP(ret);
 501         } else if (r->count != 1) {
 502                 talloc_free(r);
 503                 return NT_STATUS_INVALID_NETWORK_RESPONSE;
 504         }
 505
 506         reference_dn_str        = samdb_result_string(r->msgs[0], "rIDManagerReference", NULL);
 507         if (!reference_dn_str) return NT_STATUS_INVALID_NETWORK_RESPONSE;
 508
 509         basedn = ldb_dn_new(s, s->ldap1.ldb, reference_dn_str);
 510         NT_STATUS_HAVE_NO_MEMORY(basedn);
 511
 512         talloc_free(r);
 513
 514         ret = ldb_search(s->ldap1.ldb, basedn, LDB_SCOPE_BASE,
 515                          "(objectClass=*)", fsmo_attrs, &r);
 516         talloc_free(basedn);
 517         if (ret != LDB_SUCCESS) {
 518                 return NT_STATUS_LDAP(ret);
 519         } else if (r->count != 1) {
 520                 talloc_free(r);
 521                 return NT_STATUS_INVALID_NETWORK_RESPONSE;
 522         }
 523
 524         s->rid_manager_fsmo.ntds_dn_str = samdb_result_string(r->msgs[0], "fSMORoleOwner", NULL);
 525         if (!s->rid_manager_fsmo.ntds_dn_str) return NT_STATUS_INVALID_NETWORK_RESPONSE;
 526         talloc_steal(s, s->rid_manager_fsmo.ntds_dn_str);
 527
 528         talloc_free(r);
 529
 530         ntds_dn = ldb_dn_new(s, s->ldap1.ldb, s->rid_manager_fsmo.ntds_dn_str);
 531         NT_STATUS_HAVE_NO_MEMORY(ntds_dn);
 532
 533         server_dn = ldb_dn_get_parent(s, ntds_dn);
 534         NT_STATUS_HAVE_NO_MEMORY(server_dn);
 535
 536         s->rid_manager_fsmo.server_dn_str = ldb_dn_alloc_linearized(s, server_dn);
 537         NT_STATUS_HAVE_NO_MEMORY(s->rid_manager_fsmo.server_dn_str);
 538
 539         ret = ldb_search(s->ldap1.ldb, server_dn, LDB_SCOPE_BASE,
 540                          "(objectClass=*)", dns_attrs, &r);
 541         if (ret != LDB_SUCCESS) {
 542                 return NT_STATUS_LDAP(ret);
 543         } else if (r->count != 1) {
 544                 talloc_free(r);
 545                 return NT_STATUS_INVALID_NETWORK_RESPONSE;
 546         }
 547
 548         s->rid_manager_fsmo.dns_name    = samdb_result_string(r->msgs[0], "dnsHostName", NULL);
 549         if (!s->rid_manager_fsmo.dns_name) return NT_STATUS_INVALID_NETWORK_RESPONSE;
 550         talloc_steal(s, s->rid_manager_fsmo.dns_name);
 551
 552         talloc_free(r);
 553
 554         ret = ldb_search(s->ldap1.ldb, ntds_dn, LDB_SCOPE_BASE,
 555                          "(objectClass=*)", guid_attrs, &r);
 556         if (ret != LDB_SUCCESS) {
 557                 return NT_STATUS_LDAP(ret);
 558         } else if (r->count != 1) {
 559                 talloc_free(r);
 560                 return NT_STATUS_INVALID_NETWORK_RESPONSE;
 561         }
 562
 563         s->rid_manager_fsmo.ntds_guid = samdb_result_guid(r->msgs[0], "objectGUID");
 564
 565         talloc_free(r);
 566
 567         return NT_STATUS_OK;
 568 }
 569
 570 static NTSTATUS becomeDC_ldap1_site_object(struct libnet_BecomeDC_state *s)
 571 {
 572         int ret;
 573         struct ldb_result *r;
 574         struct ldb_dn *basedn;
 575
 576         basedn = ldb_dn_new_fmt(s, s->ldap1.ldb, "CN=%s,CN=Sites,%s",
 577                                 s->dest_dsa.site_name,
 578                                 s->forest.config_dn_str);
 579         NT_STATUS_HAVE_NO_MEMORY(basedn);
 580
 581         ret = ldb_search(s->ldap1.ldb, basedn, LDB_SCOPE_BASE,
 582                          "(objectClass=*)", NULL, &r);
 583         talloc_free(basedn);
 584         if (ret != LDB_SUCCESS) {
 585                 return NT_STATUS_LDAP(ret);
 586         } else if (r->count != 1) {
 587                 talloc_free(r);
 588                 return NT_STATUS_INVALID_NETWORK_RESPONSE;
 589         }
 590
 591         s->dest_dsa.site_guid = samdb_result_guid(r->msgs[0], "objectGUID");
 592
 593         talloc_free(r);
 594         return NT_STATUS_OK;
 595 }
 596
 597 static NTSTATUS becomeDC_ldap1_computer_object(struct libnet_BecomeDC_state *s)
 598 {
 599         int ret;
 600         struct ldb_result *r;
 601         struct ldb_dn *basedn;
 602         char *filter;
 603         static const char *attrs[] = {
 604                 "distinguishedName",
 605                 "userAccountControl",
 606                 NULL
 607         };
 608
 609         basedn = ldb_dn_new(s, s->ldap1.ldb, s->domain.dn_str);
 610         NT_STATUS_HAVE_NO_MEMORY(basedn);
 611
 612         filter = talloc_asprintf(basedn, "(&(|(objectClass=user)(objectClass=computer))(sAMAccountName=%s$))",
 613                                  s->dest_dsa.netbios_name);
 614         NT_STATUS_HAVE_NO_MEMORY(filter);
 615
 616         ret = ldb_search(s->ldap1.ldb, basedn, LDB_SCOPE_SUBTREE,
 617                          filter, attrs, &r);
 618         talloc_free(basedn);
 619         if (ret != LDB_SUCCESS) {
 620                 return NT_STATUS_LDAP(ret);
 621         } else if (r->count != 1) {
 622                 talloc_free(r);
 623                 return NT_STATUS_INVALID_NETWORK_RESPONSE;
 624         }
 625
 626         s->dest_dsa.computer_dn_str     = samdb_result_string(r->msgs[0], "distinguishedName", NULL);
 627         if (!s->dest_dsa.computer_dn_str) return NT_STATUS_INVALID_NETWORK_RESPONSE;
 628         talloc_steal(s, s->dest_dsa.computer_dn_str);
 629
 630         s->dest_dsa.user_account_control = samdb_result_uint(r->msgs[0], "userAccountControl", 0);
 631
 632         talloc_free(r);
 633         return NT_STATUS_OK;
 634 }
 635
 636 static NTSTATUS becomeDC_ldap1_server_object_1(struct libnet_BecomeDC_state *s)
 637 {
 638         int ret;
 639         struct ldb_result *r;
 640         struct ldb_dn *basedn;
 641         const char *server_reference_dn_str;
 642         struct ldb_dn *server_reference_dn;
 643         struct ldb_dn *computer_dn;
 644
 645         basedn = ldb_dn_new_fmt(s, s->ldap1.ldb, "CN=%s,CN=Servers,CN=%s,CN=Sites,%s",
 646                                 s->dest_dsa.netbios_name,
 647                                 s->dest_dsa.site_name,
 648                                 s->forest.config_dn_str);
 649         NT_STATUS_HAVE_NO_MEMORY(basedn);
 650
 651         ret = ldb_search(s->ldap1.ldb, basedn, LDB_SCOPE_BASE,
 652                          "(objectClass=*)", NULL, &r);
 653         talloc_free(basedn);
 654         if (ret == LDB_ERR_NO_SUCH_OBJECT) {
 655                 /* if the object doesn't exist, we'll create it later */
 656                 return NT_STATUS_OK;
 657         } else if (ret != LDB_SUCCESS) {
 658                 return NT_STATUS_LDAP(ret);
 659         } else if (r->count != 1) {
 660                 talloc_free(r);
 661                 return NT_STATUS_INVALID_NETWORK_RESPONSE;
 662         }
 663
 664         server_reference_dn_str = samdb_result_string(r->msgs[0], "serverReference", NULL);
 665         if (server_reference_dn_str) {
 666                 server_reference_dn     = ldb_dn_new(r, s->ldap1.ldb, server_reference_dn_str);
 667                 NT_STATUS_HAVE_NO_MEMORY(server_reference_dn);
 668
 669                 computer_dn             = ldb_dn_new(r, s->ldap1.ldb, s->dest_dsa.computer_dn_str);
 670                 NT_STATUS_HAVE_NO_MEMORY(computer_dn);
 671
 672                 /*
 673                  * if the server object belongs to another DC in another domain in the forest,
 674                  * we should not touch this object!
 675                  */
 676                 if (ldb_dn_compare(computer_dn, server_reference_dn) != 0) {
 677                         talloc_free(r);
 678                         return NT_STATUS_OBJECT_NAME_COLLISION;
 679                 }
 680         }
 681
 682         /* if the server object is already for the dest_dsa, then we don't need to create it */
 683         s->dest_dsa.server_dn_str       = samdb_result_string(r->msgs[0], "distinguishedName", NULL);
 684         if (!s->dest_dsa.server_dn_str) return NT_STATUS_INVALID_NETWORK_RESPONSE;
 685         talloc_steal(s, s->dest_dsa.server_dn_str);
 686
 687         talloc_free(r);
 688         return NT_STATUS_OK;
 689 }
 690
 691 static NTSTATUS becomeDC_ldap1_server_object_2(struct libnet_BecomeDC_state *s)
 692 {
 693         int ret;
 694         struct ldb_result *r;
 695         struct ldb_dn *basedn;
 696         const char *server_reference_bl_dn_str;
 697         static const char *attrs[] = {
 698                 "serverReferenceBL",
 699                 NULL
 700         };
 701
 702         /* if the server_dn_str has a valid value, we skip this lookup */
 703         if (s->dest_dsa.server_dn_str) return NT_STATUS_OK;
 704
 705         basedn = ldb_dn_new(s, s->ldap1.ldb, s->dest_dsa.computer_dn_str);
 706         NT_STATUS_HAVE_NO_MEMORY(basedn);
 707
 708         ret = ldb_search(s->ldap1.ldb, basedn, LDB_SCOPE_BASE,
 709                          "(objectClass=*)", attrs, &r);
 710         talloc_free(basedn);
 711         if (ret != LDB_SUCCESS) {
 712                 return NT_STATUS_LDAP(ret);
 713         } else if (r->count != 1) {
 714                 talloc_free(r);
 715                 return NT_STATUS_INVALID_NETWORK_RESPONSE;
 716         }
 717
 718         server_reference_bl_dn_str = samdb_result_string(r->msgs[0], "serverReferenceBL", NULL);
 719         if (!server_reference_bl_dn_str) {
 720                 /* if no back link is present, we're done for this function */
 721                 talloc_free(r);
 722                 return NT_STATUS_OK;
 723         }
 724
 725         /* if the server object is already for the dest_dsa, then we don't need to create it */
 726         s->dest_dsa.server_dn_str       = samdb_result_string(r->msgs[0], "serverReferenceBL", NULL);
 727         if (s->dest_dsa.server_dn_str) {
 728                 /* if a back link is present, we know that the server object is present */
 729                 talloc_steal(s, s->dest_dsa.server_dn_str);
 730         }
 731
 732         talloc_free(r);
 733         return NT_STATUS_OK;
 734 }
 735
 736 static NTSTATUS becomeDC_ldap1_server_object_add(struct libnet_BecomeDC_state *s)
 737 {
 738         int ret;
 739         struct ldb_message *msg;
 740         char *server_dn_str;
 741
 742         /* if the server_dn_str has a valid value, we skip this lookup */
 743         if (s->dest_dsa.server_dn_str) return NT_STATUS_OK;
 744
 745         msg = ldb_msg_new(s);
 746         NT_STATUS_HAVE_NO_MEMORY(msg);
 747
 748         msg->dn = ldb_dn_new_fmt(msg, s->ldap1.ldb, "CN=%s,CN=Servers,CN=%s,CN=Sites,%s",
 749                                  s->dest_dsa.netbios_name,
 750                                  s->dest_dsa.site_name,
 751                                  s->forest.config_dn_str);
 752         NT_STATUS_HAVE_NO_MEMORY(msg->dn);
 753
 754         ret = ldb_msg_add_string(msg, "objectClass", "server");
 755         if (ret != 0) {
 756                 talloc_free(msg);
 757                 return NT_STATUS_NO_MEMORY;
 758         }
 759         ret = ldb_msg_add_string(msg, "systemFlags", "50000000");
 760         if (ret != 0) {
 761                 talloc_free(msg);
 762                 return NT_STATUS_NO_MEMORY;
 763         }
 764         ret = ldb_msg_add_string(msg, "serverReference", s->dest_dsa.computer_dn_str);
 765         if (ret != 0) {
 766                 talloc_free(msg);
 767                 return NT_STATUS_NO_MEMORY;
 768         }
 769
 770         server_dn_str = ldb_dn_alloc_linearized(s, msg->dn);
 771         NT_STATUS_HAVE_NO_MEMORY(server_dn_str);
 772
 773         ret = ldb_add(s->ldap1.ldb, msg);
 774         talloc_free(msg);
 775         if (ret != LDB_SUCCESS) {
 776                 talloc_free(server_dn_str);
 777                 return NT_STATUS_LDAP(ret);
 778         }
 779
 780         s->dest_dsa.server_dn_str = server_dn_str;
 781
 782         return NT_STATUS_OK;
 783 }
 784
 785 static NTSTATUS becomeDC_ldap1_server_object_modify(struct libnet_BecomeDC_state *s)
 786 {
 787         int ret;
 788         struct ldb_message *msg;
 789         uint32_t i;
 790
 791         /* make a 'modify' msg, and only for serverReference */
 792         msg = ldb_msg_new(s);
 793         NT_STATUS_HAVE_NO_MEMORY(msg);
 794         msg->dn = ldb_dn_new(msg, s->ldap1.ldb, s->dest_dsa.server_dn_str);
 795         NT_STATUS_HAVE_NO_MEMORY(msg->dn);
 796
 797         ret = ldb_msg_add_string(msg, "serverReference", s->dest_dsa.computer_dn_str);
 798         if (ret != 0) {
 799                 talloc_free(msg);
 800                 return NT_STATUS_NO_MEMORY;
 801         }
 802
 803         /* mark all the message elements (should be just one)
 804            as LDB_FLAG_MOD_ADD */
 805         for (i=0;i<msg->num_elements;i++) {
 806                 msg->elements[i].flags = LDB_FLAG_MOD_ADD;
 807         }
 808
 809         ret = ldb_modify(s->ldap1.ldb, msg);
 810         if (ret == LDB_SUCCESS) {
 811                 talloc_free(msg);
 812                 return NT_STATUS_OK;
 813         } else if (ret == LDB_ERR_ATTRIBUTE_OR_VALUE_EXISTS) {
 814                 /* retry with LDB_FLAG_MOD_REPLACE */
 815         } else {
 816                 talloc_free(msg);
 817                 return NT_STATUS_LDAP(ret);
 818         }
 819
 820         /* mark all the message elements (should be just one)
 821            as LDB_FLAG_MOD_REPLACE */
 822         for (i=0;i<msg->num_elements;i++) {
 823                 msg->elements[i].flags = LDB_FLAG_MOD_REPLACE;
 824         }
 825
 826         ret = ldb_modify(s->ldap1.ldb, msg);
 827         talloc_free(msg);
 828         if (ret != LDB_SUCCESS) {
 829                 return NT_STATUS_LDAP(ret);
 830         }
 831
 832         return NT_STATUS_OK;
 833 }
 834
 835 static void becomeDC_drsuapi_connect_send(struct libnet_BecomeDC_state *s,
 836                                           struct becomeDC_drsuapi *drsuapi,
 837                                           void (*recv_fn)(struct composite_context *req));
 838 static void becomeDC_drsuapi1_connect_recv(struct composite_context *req);
 839 static void becomeDC_connect_ldap2(struct libnet_BecomeDC_state *s);
 840
 841 static void becomeDC_connect_ldap1(struct libnet_BecomeDC_state *s)
 842 {
 843         struct composite_context *c = s->creq;
 844
 845         c->status = becomeDC_ldap_connect(s, &s->ldap1);
 846         if (!composite_is_ok(c)) return;
 847
 848         c->status = becomeDC_ldap1_rootdse(s);
 849         if (!composite_is_ok(c)) return;
 850
 851         c->status = becomeDC_ldap1_config_behavior_version(s);
 852         if (!composite_is_ok(c)) return;
 853
 854         c->status = becomeDC_ldap1_domain_behavior_version(s);
 855         if (!composite_is_ok(c)) return;
 856
 857         c->status = becomeDC_ldap1_schema_object_version(s);
 858         if (!composite_is_ok(c)) return;
 859
 860         c->status = becomeDC_ldap1_w2k3_update_revision(s);
 861         if (!composite_is_ok(c)) return;
 862
 863         c->status = becomeDC_ldap1_infrastructure_fsmo(s);
 864         if (!composite_is_ok(c)) return;
 865
 866         c->status = becomeDC_ldap1_rid_manager_fsmo(s);
 867         if (!composite_is_ok(c)) return;
 868
 869         c->status = becomeDC_ldap1_site_object(s);
 870         if (!composite_is_ok(c)) return;
 871
 872         c->status = becomeDC_ldap1_computer_object(s);
 873         if (!composite_is_ok(c)) return;
 874
 875         c->status = becomeDC_ldap1_server_object_1(s);
 876         if (!composite_is_ok(c)) return;
 877
 878         c->status = becomeDC_ldap1_server_object_2(s);
 879         if (!composite_is_ok(c)) return;
 880
 881         c->status = becomeDC_ldap1_server_object_add(s);
 882         if (!composite_is_ok(c)) return;
 883
 884         c->status = becomeDC_ldap1_server_object_modify(s);
 885         if (!composite_is_ok(c)) return;
 886
 887         becomeDC_drsuapi_connect_send(s, &s->drsuapi1, becomeDC_drsuapi1_connect_recv);
 888 }
 889
 890 static void becomeDC_drsuapi_connect_send(struct libnet_BecomeDC_state *s,
 891                                           struct becomeDC_drsuapi *drsuapi,
 892                                           void (*recv_fn)(struct composite_context *req))
 893 {
 894         struct composite_context *c = s->creq;
 895         struct composite_context *creq;
 896         char *binding_str;
 897
 898         drsuapi->s = s;
 899
 900         if (!drsuapi->binding) {
 901                 binding_str = talloc_asprintf(s, "ncacn_ip_tcp:%s[krb5,seal]", s->source_dsa.dns_name);
 902                 if (composite_nomem(binding_str, c)) return;
 903
 904                 c->status = dcerpc_parse_binding(s, binding_str, &drsuapi->binding);
 905                 talloc_free(binding_str);
 906                 if (!composite_is_ok(c)) return;
 907         }
 908
 909         creq = dcerpc_pipe_connect_b_send(s, drsuapi->binding, &dcerpc_table_drsuapi,
 910                                           s->libnet->cred, s->libnet->event_ctx);
 911         composite_continue(c, creq, recv_fn, s);
 912 }
 913
 914 static void becomeDC_drsuapi_bind_send(struct libnet_BecomeDC_state *s,
 915                                        struct becomeDC_drsuapi *drsuapi,
 916                                        void (*recv_fn)(struct rpc_request *req));
 917 static void becomeDC_drsuapi1_bind_recv(struct rpc_request *req);
 918
 919 static void becomeDC_drsuapi1_connect_recv(struct composite_context *req)
 920 {
 921         struct libnet_BecomeDC_state *s = talloc_get_type(req->async.private_data,
 922                                           struct libnet_BecomeDC_state);
 923         struct composite_context *c = s->creq;
 924
 925         c->status = dcerpc_pipe_connect_b_recv(req, s, &s->drsuapi1.pipe);
 926         if (!composite_is_ok(c)) return;
 927
 928         becomeDC_drsuapi_bind_send(s, &s->drsuapi1, becomeDC_drsuapi1_bind_recv);
 929 }
 930
 931 static void becomeDC_drsuapi_bind_send(struct libnet_BecomeDC_state *s,
 932                                        struct becomeDC_drsuapi *drsuapi,
 933                                        void (*recv_fn)(struct rpc_request *req))
 934 {
 935         struct composite_context *c = s->creq;
 936         struct rpc_request *req;
 937         struct drsuapi_DsBindInfo28 *bind_info28;
 938
 939         GUID_from_string(DRSUAPI_DS_BIND_GUID_W2K3, &drsuapi->bind_guid);
 940
 941         bind_info28                             = &drsuapi->local_info28;
 942         bind_info28->supported_extensions       |= DRSUAPI_SUPPORTED_EXTENSION_BASE;
 943         bind_info28->supported_extensions       |= DRSUAPI_SUPPORTED_EXTENSION_ASYNC_REPLICATION;
 944         bind_info28->supported_extensions       |= DRSUAPI_SUPPORTED_EXTENSION_REMOVEAPI;
 945         bind_info28->supported_extensions       |= DRSUAPI_SUPPORTED_EXTENSION_MOVEREQ_V2;
 946         bind_info28->supported_extensions       |= DRSUAPI_SUPPORTED_EXTENSION_GETCHG_COMPRESS;
 947         bind_info28->supported_extensions       |= DRSUAPI_SUPPORTED_EXTENSION_DCINFO_V1;
 948         bind_info28->supported_extensions       |= DRSUAPI_SUPPORTED_EXTENSION_RESTORE_USN_OPTIMIZATION;
 949         bind_info28->supported_extensions       |= DRSUAPI_SUPPORTED_EXTENSION_KCC_EXECUTE;
 950         bind_info28->supported_extensions       |= DRSUAPI_SUPPORTED_EXTENSION_ADDENTRY_V2;
 951         if (s->ads_options.domain_behavior_version == 2) {
 952                 /* TODO: find out how this is really triggered! */
 953                 bind_info28->supported_extensions       |= DRSUAPI_SUPPORTED_EXTENSION_LINKED_VALUE_REPLICATION;
 954         }
 955         bind_info28->supported_extensions       |= DRSUAPI_SUPPORTED_EXTENSION_DCINFO_V2;
 956         bind_info28->supported_extensions       |= DRSUAPI_SUPPORTED_EXTENSION_INSTANCE_TYPE_NOT_REQ_ON_MOD;
 957         bind_info28->supported_extensions       |= DRSUAPI_SUPPORTED_EXTENSION_CRYPTO_BIND;
 958         bind_info28->supported_extensions       |= DRSUAPI_SUPPORTED_EXTENSION_GET_REPL_INFO;
 959         bind_info28->supported_extensions       |= DRSUAPI_SUPPORTED_EXTENSION_STRONG_ENCRYPTION;
 960         bind_info28->supported_extensions       |= DRSUAPI_SUPPORTED_EXTENSION_DCINFO_V01;
 961         bind_info28->supported_extensions       |= DRSUAPI_SUPPORTED_EXTENSION_TRANSITIVE_MEMBERSHIP;
 962         bind_info28->supported_extensions       |= DRSUAPI_SUPPORTED_EXTENSION_ADD_SID_HISTORY;
 963         bind_info28->supported_extensions       |= DRSUAPI_SUPPORTED_EXTENSION_POST_BETA3;
 964         bind_info28->supported_extensions       |= DRSUAPI_SUPPORTED_EXTENSION_00100000;
 965         bind_info28->supported_extensions       |= DRSUAPI_SUPPORTED_EXTENSION_GET_MEMBERSHIPS2;
 966         bind_info28->supported_extensions       |= DRSUAPI_SUPPORTED_EXTENSION_GETCHGREQ_V6;
 967         bind_info28->supported_extensions       |= DRSUAPI_SUPPORTED_EXTENSION_NONDOMAIN_NCS;
 968         bind_info28->supported_extensions       |= DRSUAPI_SUPPORTED_EXTENSION_GETCHGREQ_V8;
 969         bind_info28->supported_extensions       |= DRSUAPI_SUPPORTED_EXTENSION_GETCHGREPLY_V5;
 970         bind_info28->supported_extensions       |= DRSUAPI_SUPPORTED_EXTENSION_GETCHGREPLY_V6;
 971         bind_info28->supported_extensions       |= DRSUAPI_SUPPORTED_EXTENSION_ADDENTRYREPLY_V3;
 972         bind_info28->supported_extensions       |= DRSUAPI_SUPPORTED_EXTENSION_GETCHGREPLY_V7;
 973         bind_info28->supported_extensions       |= DRSUAPI_SUPPORTED_EXTENSION_VERIFY_OBJECT;
 974 #if 0 /* we don't support XPRESS compression yet */
 975         bind_info28->supported_extensions       |= DRSUAPI_SUPPORTED_EXTENSION_XPRESS_COMPRESS;
 976 #endif
 977         bind_info28->site_guid                  = s->dest_dsa.site_guid;
 978         if (s->ads_options.domain_behavior_version == 2) {
 979                 /* TODO: find out how this is really triggered! */
 980                 bind_info28->u1                         = 528;
 981         } else {
 982                 bind_info28->u1                         = 516;
 983         }
 984         bind_info28->repl_epoch                 = 0;
 985
 986         drsuapi->bind_info_ctr.length           = 28;
 987         drsuapi->bind_info_ctr.info.info28      = *bind_info28;
 988
 989         drsuapi->bind_r.in.bind_guid = &drsuapi->bind_guid;
 990         drsuapi->bind_r.in.bind_info = &drsuapi->bind_info_ctr;
 991         drsuapi->bind_r.out.bind_handle = &drsuapi->bind_handle;
 992
 993         req = dcerpc_drsuapi_DsBind_send(drsuapi->pipe, s, &drsuapi->bind_r);
 994         composite_continue_rpc(c, req, recv_fn, s);
 995 }
 996
 997 static WERROR becomeDC_drsuapi_bind_recv(struct libnet_BecomeDC_state *s,
 998                                          struct becomeDC_drsuapi *drsuapi)
 999 {
1000         if (!W_ERROR_IS_OK(drsuapi->bind_r.out.result)) {
1001                 return drsuapi->bind_r.out.result;
1002         }
1003
1004         ZERO_STRUCT(drsuapi->remote_info28);
1005         if (drsuapi->bind_r.out.bind_info) {
1006                 switch (drsuapi->bind_r.out.bind_info->length) {
1007                 case 24: {
1008                         struct drsuapi_DsBindInfo24 *info24;
1009                         info24 = &drsuapi->bind_r.out.bind_info->info.info24;
1010                         drsuapi->remote_info28.supported_extensions     = info24->supported_extensions;
1011                         drsuapi->remote_info28.site_guid                = info24->site_guid;
1012                         drsuapi->remote_info28.u1                       = info24->u1;
1013                         drsuapi->remote_info28.repl_epoch               = 0;
1014                         break;
1015                 }
1016                 case 28:
1017                         drsuapi->remote_info28 = drsuapi->bind_r.out.bind_info->info.info28;
1018                         break;
1019                 }
1020         }
1021
1022         return WERR_OK;
1023 }
1024
1025 static void becomeDC_drsuapi1_add_entry_send(struct libnet_BecomeDC_state *s);
1026
1027 static void becomeDC_drsuapi1_bind_recv(struct rpc_request *req)
1028 {
1029         struct libnet_BecomeDC_state *s = talloc_get_type(req->async.private,
1030                                           struct libnet_BecomeDC_state);
1031         struct composite_context *c = s->creq;
1032         WERROR status;
1033
1034         c->status = dcerpc_ndr_request_recv(req);
1035         if (!composite_is_ok(c)) return;
1036
1037         status = becomeDC_drsuapi_bind_recv(s, &s->drsuapi1);
1038         if (!W_ERROR_IS_OK(status)) {
1039                 composite_error(c, werror_to_ntstatus(status));
1040                 return;
1041         }
1042
1043         becomeDC_drsuapi1_add_entry_send(s);
1044 }
1045
1046 static void becomeDC_drsuapi1_add_entry_recv(struct rpc_request *req);
1047
1048 static void becomeDC_drsuapi1_add_entry_send(struct libnet_BecomeDC_state *s)
1049 {
1050         struct composite_context *c = s->creq;
1051         struct rpc_request *req;
1052         struct drsuapi_DsAddEntry *r;
1053         struct drsuapi_DsReplicaObjectIdentifier *identifier;
1054         uint32_t num_attrs, i = 0;
1055         struct drsuapi_DsReplicaAttribute *attrs;
1056
1057         /* choose a random invocationId */
1058         s->dest_dsa.invocation_id = GUID_random();
1059
1060         r = talloc_zero(s, struct drsuapi_DsAddEntry);
1061         if (composite_nomem(r, c)) return;
1062
1063         /* setup identifier */
1064         identifier              = talloc(r, struct drsuapi_DsReplicaObjectIdentifier);
1065         if (composite_nomem(identifier, c)) return;
1066         identifier->guid        = GUID_zero();
1067         identifier->sid         = s->zero_sid;
1068         identifier->dn          = talloc_asprintf(identifier, "CN=NTDS Settings,%s",
1069                                                   s->dest_dsa.server_dn_str);
1070         if (composite_nomem(identifier->dn, c)) return;
1071
1072         /* allocate attribute array */
1073         num_attrs       = 11;
1074         attrs           = talloc_array(r, struct drsuapi_DsReplicaAttribute, num_attrs);
1075         if (composite_nomem(attrs, c)) return;
1076
1077         /* ntSecurityDescriptor */
1078         {
1079                 struct drsuapi_DsAttributeValueSecurityDescriptor *vs;
1080                 struct security_descriptor *v;
1081                 struct dom_sid *domain_admins_sid;
1082                 const char *domain_admins_sid_str;
1083
1084                 vs = talloc_array(attrs, struct drsuapi_DsAttributeValueSecurityDescriptor, 1);
1085                 if (composite_nomem(vs, c)) return;
1086
1087                 domain_admins_sid = dom_sid_add_rid(vs, s->domain.sid, DOMAIN_RID_ADMINS);
1088                 if (composite_nomem(domain_admins_sid, c)) return;
1089
1090                 domain_admins_sid_str = dom_sid_string(domain_admins_sid, domain_admins_sid);
1091                 if (composite_nomem(domain_admins_sid_str, c)) return;
1092
1093                 v = security_descriptor_create(vs,
1094                                                /* owner: domain admins */
1095                                                domain_admins_sid_str,
1096                                                /* owner group: domain admins */
1097                                                domain_admins_sid_str,
1098                                                /* authenticated users */
1099                                                SID_NT_AUTHENTICATED_USERS,
1100                                                SEC_ACE_TYPE_ACCESS_ALLOWED,
1101                                                SEC_STD_READ_CONTROL |
1102                                                SEC_ADS_LIST |
1103                                                SEC_ADS_READ_PROP |
1104                                                SEC_ADS_LIST_OBJECT,
1105                                                0,
1106                                                /* domain admins */
1107                                                domain_admins_sid_str,
1108                                                SEC_ACE_TYPE_ACCESS_ALLOWED,
1109                                                SEC_STD_REQUIRED |
1110                                                SEC_ADS_CREATE_CHILD |
1111                                                SEC_ADS_LIST |
1112                                                SEC_ADS_SELF_WRITE |
1113                                                SEC_ADS_READ_PROP |
1114                                                SEC_ADS_WRITE_PROP |
1115                                                SEC_ADS_DELETE_TREE |
1116                                                SEC_ADS_LIST_OBJECT |
1117                                                SEC_ADS_CONTROL_ACCESS,
1118                                                0,
1119                                                /* system */
1120                                                SID_NT_SYSTEM,
1121                                                SEC_ACE_TYPE_ACCESS_ALLOWED,
1122                                                SEC_STD_REQUIRED |
1123                                                SEC_ADS_CREATE_CHILD |
1124                                                SEC_ADS_DELETE_CHILD |
1125                                                SEC_ADS_LIST |
1126                                                SEC_ADS_SELF_WRITE |
1127                                                SEC_ADS_READ_PROP |
1128                                                SEC_ADS_WRITE_PROP |
1129                                                SEC_ADS_DELETE_TREE |
1130                                                SEC_ADS_LIST_OBJECT |
1131                                                SEC_ADS_CONTROL_ACCESS,
1132                                                0,
1133                                                /* end */
1134                                                NULL);
1135                 if (composite_nomem(v, c)) return;
1136
1137                 vs[0].sd                = v;
1138
1139                 attrs[i].attid                                          = DRSUAPI_ATTRIBUTE_ntSecurityDescriptor;
1140                 attrs[i].value_ctr.security_descriptor.num_values       = 1;
1141                 attrs[i].value_ctr.security_descriptor.values           = vs;
1142
1143                 i++;
1144         }
1145
1146         /* objectClass: nTDSDSA */
1147         {
1148                 struct drsuapi_DsAttributeValueObjectClassId *vs;
1149                 enum drsuapi_DsObjectClassId *v;
1150
1151                 vs = talloc_array(attrs, struct drsuapi_DsAttributeValueObjectClassId, 1);
1152                 if (composite_nomem(vs, c)) return;
1153
1154                 v = talloc_array(vs, enum drsuapi_DsObjectClassId, 1);
1155                 if (composite_nomem(v, c)) return;
1156
1157                 /* value for nTDSDSA */
1158                 v[0]                    = 0x0017002F;
1159
1160                 vs[0].objectClassId     = &v[0];
1161
1162                 attrs[i].attid                                  = DRSUAPI_ATTRIBUTE_objectClass;
1163                 attrs[i].value_ctr.object_class_id.num_values   = 1;
1164                 attrs[i].value_ctr.object_class_id.values       = vs;
1165
1166                 i++;
1167         }
1168
1169         /* objectCategory: CN=NTDS-DSA,CN=Schema,... */
1170         {
1171                 struct drsuapi_DsAttributeValueDNString *vs;
1172                 struct drsuapi_DsReplicaObjectIdentifier3 *v;
1173
1174                 vs = talloc_array(attrs, struct drsuapi_DsAttributeValueDNString, 1);
1175                 if (composite_nomem(vs, c)) return;
1176
1177                 v = talloc_array(vs, struct drsuapi_DsReplicaObjectIdentifier3, 1);
1178                 if (composite_nomem(v, c)) return;
1179
1180                 /* value for nTDSDSA */
1181                 v[0].guid               = GUID_zero();
1182                 v[0].sid                = s->zero_sid;
1183                 v[0].dn                 = talloc_asprintf(v, "CN=NTDS-DSA,%s",
1184                                                           s->forest.schema_dn_str);
1185                 if (composite_nomem(v->dn, c)) return;
1186
1187                 vs[0].object            = &v[0];
1188
1189                 attrs[i].attid                                  = DRSUAPI_ATTRIBUTE_objectCategory;
1190                 attrs[i].value_ctr.dn_string.num_values         = 1;
1191                 attrs[i].value_ctr.dn_string.values             = vs;
1192
1193                 i++;
1194         }
1195
1196         /* invocationId: random guid */
1197         {
1198                 struct drsuapi_DsAttributeValueGUID *vs;
1199                 struct GUID *v;
1200
1201                 vs = talloc_array(attrs, struct drsuapi_DsAttributeValueGUID, 1);
1202                 if (composite_nomem(vs, c)) return;
1203
1204                 v = talloc_array(vs, struct GUID, 1);
1205                 if (composite_nomem(v, c)) return;
1206
1207                 /* value for nTDSDSA */
1208                 v[0]                    = s->dest_dsa.invocation_id;
1209
1210                 vs[0].guid              = &v[0];
1211
1212                 attrs[i].attid                                  = DRSUAPI_ATTRIBUTE_invocationId;
1213                 attrs[i].value_ctr.guid.num_values              = 1;
1214                 attrs[i].value_ctr.guid.values                  = vs;
1215
1216                 i++;
1217         }
1218
1219         /* hasMasterNCs: ... */
1220         {
1221                 struct drsuapi_DsAttributeValueDNString *vs;
1222                 struct drsuapi_DsReplicaObjectIdentifier3 *v;
1223
1224                 vs = talloc_array(attrs, struct drsuapi_DsAttributeValueDNString, 3);
1225                 if (composite_nomem(vs, c)) return;
1226
1227                 v = talloc_array(vs, struct drsuapi_DsReplicaObjectIdentifier3, 3);
1228                 if (composite_nomem(v, c)) return;
1229
1230                 v[0].guid               = GUID_zero();
1231                 v[0].sid                = s->zero_sid;
1232                 v[0].dn                 = s->forest.config_dn_str;
1233
1234                 v[1].guid               = GUID_zero();
1235                 v[1].sid                = s->zero_sid;
1236                 v[1].dn                 = s->domain.dn_str;
1237
1238                 v[2].guid               = GUID_zero();
1239                 v[2].sid                = s->zero_sid;
1240                 v[2].dn                 = s->forest.schema_dn_str;
1241
1242                 vs[0].object            = &v[0];
1243                 vs[1].object            = &v[1];
1244                 vs[2].object            = &v[2];
1245
1246                 attrs[i].attid                                  = DRSUAPI_ATTRIBUTE_hasMasterNCs;
1247                 attrs[i].value_ctr.dn_string.num_values         = 3;
1248                 attrs[i].value_ctr.dn_string.values             = vs;
1249
1250                 i++;
1251         }
1252
1253         /* msDS-hasMasterNCs: ... */
1254         {
1255                 struct drsuapi_DsAttributeValueDNString *vs;
1256                 struct drsuapi_DsReplicaObjectIdentifier3 *v;
1257
1258                 vs = talloc_array(attrs, struct drsuapi_DsAttributeValueDNString, 3);
1259                 if (composite_nomem(vs, c)) return;
1260
1261                 v = talloc_array(vs, struct drsuapi_DsReplicaObjectIdentifier3, 3);
1262                 if (composite_nomem(v, c)) return;
1263
1264                 v[0].guid               = GUID_zero();
1265                 v[0].sid                = s->zero_sid;
1266                 v[0].dn                 = s->forest.config_dn_str;
1267
1268                 v[1].guid               = GUID_zero();
1269                 v[1].sid                = s->zero_sid;
1270                 v[1].dn                 = s->domain.dn_str;
1271
1272                 v[2].guid               = GUID_zero();
1273                 v[2].sid                = s->zero_sid;
1274                 v[2].dn                 = s->forest.schema_dn_str;
1275
1276                 vs[0].object            = &v[0];
1277                 vs[1].object            = &v[1];
1278                 vs[2].object            = &v[2];
1279
1280                 attrs[i].attid                                  = DRSUAPI_ATTRIBUTE_msDS_hasMasterNCs;
1281                 attrs[i].value_ctr.dn_string.num_values         = 3;
1282                 attrs[i].value_ctr.dn_string.values             = vs;
1283
1284                 i++;
1285         }
1286
1287         /* dMDLocation: CN=Schema,... */
1288         {
1289                 struct drsuapi_DsAttributeValueDNString *vs;
1290                 struct drsuapi_DsReplicaObjectIdentifier3 *v;
1291
1292                 vs = talloc_array(attrs, struct drsuapi_DsAttributeValueDNString, 1);
1293                 if (composite_nomem(vs, c)) return;
1294
1295                 v = talloc_array(vs, struct drsuapi_DsReplicaObjectIdentifier3, 1);
1296                 if (composite_nomem(v, c)) return;
1297
1298                 v[0].guid               = GUID_zero();
1299                 v[0].sid                = s->zero_sid;
1300                 v[0].dn                 = s->forest.schema_dn_str;
1301
1302                 vs[0].object            = &v[0];
1303
1304                 attrs[i].attid                                  = DRSUAPI_ATTRIBUTE_dMDLocation;
1305                 attrs[i].value_ctr.dn_string.num_values         = 1;
1306                 attrs[i].value_ctr.dn_string.values             = vs;
1307
1308                 i++;
1309         }
1310
1311         /* msDS-HasDomainNCs: <domain_partition> */
1312         {
1313                 struct drsuapi_DsAttributeValueDNString *vs;
1314                 struct drsuapi_DsReplicaObjectIdentifier3 *v;
1315
1316                 vs = talloc_array(attrs, struct drsuapi_DsAttributeValueDNString, 1);
1317                 if (composite_nomem(vs, c)) return;
1318
1319                 v = talloc_array(vs, struct drsuapi_DsReplicaObjectIdentifier3, 1);
1320                 if (composite_nomem(v, c)) return;
1321
1322                 v[0].guid               = GUID_zero();
1323                 v[0].sid                = s->zero_sid;
1324                 v[0].dn                 = s->domain.dn_str;
1325
1326                 vs[0].object            = &v[0];
1327
1328                 attrs[i].attid                                  = DRSUAPI_ATTRIBUTE_msDS_HasDomainNCs;
1329                 attrs[i].value_ctr.dn_string.num_values         = 1;
1330                 attrs[i].value_ctr.dn_string.values             = vs;
1331
1332                 i++;
1333         }
1334
1335         /* msDS-Behavior-Version */
1336         {
1337                 struct drsuapi_DsAttributeValueUINT32 *vs;
1338                 uint32_t *v;
1339
1340                 vs = talloc_array(attrs, struct drsuapi_DsAttributeValueUINT32, 1);
1341                 if (composite_nomem(vs, c)) return;
1342
1343                 v = talloc_array(vs, uint32_t, 1);
1344                 if (composite_nomem(v, c)) return;
1345
1346                 v[0]                    = 0x00000002;
1347
1348                 vs[0].value             = &v[0];
1349
1350                 attrs[i].attid                                  = DRSUAPI_ATTRIBUTE_msDS_Behavior_Version;
1351                 attrs[i].value_ctr.uint32.num_values            = 1;
1352                 attrs[i].value_ctr.uint32.values                = vs;
1353
1354                 i++;
1355         }
1356
1357         /* systemFlags */
1358         {
1359                 struct drsuapi_DsAttributeValueUINT32 *vs;
1360                 uint32_t *v;
1361
1362                 vs = talloc_array(attrs, struct drsuapi_DsAttributeValueUINT32, 1);
1363                 if (composite_nomem(vs, c)) return;
1364
1365                 v = talloc_array(vs, uint32_t, 1);
1366                 if (composite_nomem(v, c)) return;
1367
1368                 v[0]                    = SYSTEM_FLAG_DISALLOW_MOVE_ON_DELETE;
1369
1370                 vs[0].value             = &v[0];
1371
1372                 attrs[i].attid                                  = DRSUAPI_ATTRIBUTE_systemFlags;
1373                 attrs[i].value_ctr.uint32.num_values            = 1;
1374                 attrs[i].value_ctr.uint32.values                = vs;
1375
1376                 i++;
1377         }
1378
1379         /* serverReference: ... */
1380         {
1381                 struct drsuapi_DsAttributeValueDNString *vs;
1382                 struct drsuapi_DsReplicaObjectIdentifier3 *v;
1383
1384                 vs = talloc_array(attrs, struct drsuapi_DsAttributeValueDNString, 1);
1385                 if (composite_nomem(vs, c)) return;
1386
1387                 v = talloc_array(vs, struct drsuapi_DsReplicaObjectIdentifier3, 1);
1388                 if (composite_nomem(v, c)) return;
1389
1390                 v[0].guid               = GUID_zero();
1391                 v[0].sid                = s->zero_sid;
1392                 v[0].dn                 = s->dest_dsa.computer_dn_str;
1393
1394                 vs[0].object            = &v[0];
1395
1396                 attrs[i].attid                                  = DRSUAPI_ATTRIBUTE_serverReference;
1397                 attrs[i].value_ctr.dn_string.num_values         = 1;
1398                 attrs[i].value_ctr.dn_string.values             = vs;
1399
1400                 i++;
1401         }
1402
1403         /* truncate the attribute list to the attribute count we have filled in */
1404         num_attrs = i;
1405
1406         /* setup request structure */
1407         r->in.bind_handle                                               = &s->drsuapi1.bind_handle;
1408         r->in.level                                                     = 2;
1409         r->in.req.req2.first_object.next_object                         = NULL;
1410         r->in.req.req2.first_object.object.identifier                   = identifier;
1411         r->in.req.req2.first_object.object.unknown1                     = 0x00000000;
1412         r->in.req.req2.first_object.object.attribute_ctr.num_attributes = num_attrs;
1413         r->in.req.req2.first_object.object.attribute_ctr.attributes     = attrs;
1414
1415         req = dcerpc_drsuapi_DsAddEntry_send(s->drsuapi1.pipe, r, r);
1416         composite_continue_rpc(c, req, becomeDC_drsuapi1_add_entry_recv, s);
1417 }
1418
1419 static void becomeDC_drsuapi2_connect_recv(struct composite_context *req);
1420
1421 static void becomeDC_drsuapi1_add_entry_recv(struct rpc_request *req)
1422 {
1423         struct libnet_BecomeDC_state *s = talloc_get_type(req->async.private,
1424                                           struct libnet_BecomeDC_state);
1425         struct composite_context *c = s->creq;
1426         struct drsuapi_DsAddEntry *r = talloc_get_type(req->ndr.struct_ptr,
1427                                        struct drsuapi_DsAddEntry);
1428
1429         c->status = dcerpc_ndr_request_recv(req);
1430         if (!composite_is_ok(c)) return;
1431
1432         if (!W_ERROR_IS_OK(r->out.result)) {
1433                 composite_error(c, werror_to_ntstatus(r->out.result));
1434                 return;
1435         }
1436
1437         if (r->out.level == 3) {
1438                 if (r->out.ctr.ctr3.count != 1) {
1439                         WERROR status;
1440
1441                         if (r->out.ctr.ctr3.level != 1) {
1442                                 composite_error(c, NT_STATUS_INVALID_NETWORK_RESPONSE);
1443                                 return;
1444                         }
1445
1446                         if (!r->out.ctr.ctr3.error) {
1447                                 composite_error(c, NT_STATUS_INVALID_NETWORK_RESPONSE);
1448                                 return;
1449                         }
1450
1451                         status = r->out.ctr.ctr3.error->info1.status;
1452
1453                         if (!r->out.ctr.ctr3.error->info1.info) {
1454                                 composite_error(c, werror_to_ntstatus(status));
1455                                 return;
1456                         }
1457
1458                         /* see if we can get a more detailed error */
1459                         switch (r->out.ctr.ctr3.error->info1.level) {
1460                         case 1:
1461                                 status = r->out.ctr.ctr3.error->info1.info->error1.status;
1462                                 break;
1463                         case 4:
1464                         case 5:
1465                         case 6:
1466                         case 7:
1467                                 status = r->out.ctr.ctr3.error->info1.info->errorX.status;
1468                                 break;
1469                         }
1470
1471                         composite_error(c, werror_to_ntstatus(status));
1472                         return;
1473                 }
1474
1475                 s->dest_dsa.ntds_guid   = r->out.ctr.ctr3.objects[0].guid;
1476         } else if (r->out.level == 2) {
1477                 if (r->out.ctr.ctr2.count != 1) {
1478                         composite_error(c, werror_to_ntstatus(r->out.ctr.ctr2.error.status));
1479                         return;
1480                 }
1481
1482                 s->dest_dsa.ntds_guid   = r->out.ctr.ctr2.objects[0].guid;
1483         } else {
1484                 composite_error(c, NT_STATUS_INVALID_NETWORK_RESPONSE);
1485                 return;
1486         }
1487
1488         talloc_free(r);
1489
1490         becomeDC_drsuapi_connect_send(s, &s->drsuapi2, becomeDC_drsuapi2_connect_recv);
1491 }
1492
1493 static void becomeDC_drsuapi2_bind_recv(struct rpc_request *req);
1494
1495 static void becomeDC_drsuapi2_connect_recv(struct composite_context *req)
1496 {
1497         struct libnet_BecomeDC_state *s = talloc_get_type(req->async.private_data,
1498                                           struct libnet_BecomeDC_state);
1499         struct composite_context *c = s->creq;
1500
1501         c->status = dcerpc_pipe_connect_b_recv(req, s, &s->drsuapi2.pipe);
1502         if (!composite_is_ok(c)) return;
1503
1504         becomeDC_drsuapi_bind_send(s, &s->drsuapi2, becomeDC_drsuapi2_bind_recv);
1505 }
1506
1507 static void becomeDC_drsuapi3_connect_recv(struct composite_context *req);
1508
1509 static void becomeDC_drsuapi2_bind_recv(struct rpc_request *req)
1510 {
1511         struct libnet_BecomeDC_state *s = talloc_get_type(req->async.private,
1512                                           struct libnet_BecomeDC_state);
1513         struct composite_context *c = s->creq;
1514         WERROR status;
1515
1516         c->status = dcerpc_ndr_request_recv(req);
1517         if (!composite_is_ok(c)) return;
1518
1519         status = becomeDC_drsuapi_bind_recv(s, &s->drsuapi2);
1520         if (!W_ERROR_IS_OK(status)) {
1521                 composite_error(c, werror_to_ntstatus(status));
1522                 return;
1523         }
1524
1525         /* this avoids the epmapper lookup on the 2nd connection */
1526         s->drsuapi3.binding = s->drsuapi2.binding;
1527
1528         becomeDC_drsuapi_connect_send(s, &s->drsuapi3, becomeDC_drsuapi3_connect_recv);
1529 }
1530
1531 static void becomeDC_drsuapi3_pull_schema_send(struct libnet_BecomeDC_state *s);
1532
1533 static void becomeDC_drsuapi3_connect_recv(struct composite_context *req)
1534 {
1535         struct libnet_BecomeDC_state *s = talloc_get_type(req->async.private_data,
1536                                           struct libnet_BecomeDC_state);
1537         struct composite_context *c = s->creq;
1538
1539         c->status = dcerpc_pipe_connect_b_recv(req, s, &s->drsuapi3.pipe);
1540         if (!composite_is_ok(c)) return;
1541
1542         becomeDC_drsuapi3_pull_schema_send(s);
1543 }
1544
1545 static void becomeDC_drsuapi_pull_partition_send(struct libnet_BecomeDC_state *s,
1546                                                  struct becomeDC_drsuapi *drsuapi_h,
1547                                                  struct becomeDC_drsuapi *drsuapi_p,
1548                                                  struct becomeDC_partition *partition,
1549                                                  void (*recv_fn)(struct rpc_request *req))
1550 {
1551         struct composite_context *c = s->creq;
1552         struct rpc_request *req;
1553         struct drsuapi_DsGetNCChanges *r;
1554
1555         r = talloc(s, struct drsuapi_DsGetNCChanges);
1556         if (composite_nomem(r, c)) return;
1557
1558         r->in.bind_handle       = &drsuapi_h->bind_handle;
1559         if (drsuapi_h->remote_info28.supported_extensions & DRSUAPI_SUPPORTED_EXTENSION_GETCHGREQ_V8) {
1560                 r->in.level                             = 8;
1561                 r->in.req.req8.destination_dsa_guid     = partition->destination_dsa_guid;
1562                 r->in.req.req8.source_dsa_invocation_id = partition->source_dsa_invocation_id;
1563                 r->in.req.req8.naming_context           = &partition->nc;
1564                 r->in.req.req8.highwatermark            = partition->highwatermark;
1565                 r->in.req.req8.uptodateness_vector      = partition->uptodateness_vector;
1566                 r->in.req.req8.replica_flags            = partition->replica_flags;
1567                 r->in.req.req8.max_object_count         = 133;
1568                 r->in.req.req8.max_ndr_size             = 1336811;
1569                 r->in.req.req8.unknown4                 = 0;
1570                 r->in.req.req8.h1                       = 0;
1571                 r->in.req.req8.unique_ptr1              = 0;
1572                 r->in.req.req8.unique_ptr2              = 0;
1573                 r->in.req.req8.ctr12.count              = 0;
1574                 r->in.req.req8.ctr12.array              = NULL;
1575         } else {
1576                 r->in.level                             = 5;
1577                 r->in.req.req5.destination_dsa_guid     = partition->destination_dsa_guid;
1578                 r->in.req.req5.source_dsa_invocation_id = partition->source_dsa_invocation_id;
1579                 r->in.req.req5.naming_context           = &partition->nc;
1580                 r->in.req.req5.highwatermark            = partition->highwatermark;
1581                 r->in.req.req5.uptodateness_vector      = partition->uptodateness_vector;
1582                 r->in.req.req5.replica_flags            = partition->replica_flags;
1583                 r->in.req.req5.max_object_count         = 133;
1584                 r->in.req.req5.max_ndr_size             = 1336770;
1585                 r->in.req.req5.unknown4                 = 0;
1586                 r->in.req.req5.h1                       = 0;
1587         }
1588
1589 DEBUG(0,("start NC[%s] tmp_highest_usn[%llu] highest_usn[%llu]\n",
1590         partition->nc.dn,
1591         partition->highwatermark.tmp_highest_usn,
1592         partition->highwatermark.highest_usn));
1593
1594         /*
1595          * we should try to use the drsuapi_p->pipe here, as w2k3 does
1596          * but it seems that some extra flags in the DCERPC Bind call
1597          * are needed for it. Or the same KRB5 TGS is needed on both
1598          * connections.
1599          */
1600         req = dcerpc_drsuapi_DsGetNCChanges_send(drsuapi_h->pipe, r, r);
1601         composite_continue_rpc(c, req, recv_fn, s);
1602 }
1603
1604 static WERROR becomeDC_drsuapi_pull_partition_recv(struct libnet_BecomeDC_state *s,
1605                                                    struct becomeDC_partition *partition,
1606                                                    struct drsuapi_DsGetNCChanges *r)
1607 {
1608         struct drsuapi_DsGetNCChangesCtr1 *ctr1 = NULL;
1609         struct drsuapi_DsGetNCChangesCtr6 *ctr6 = NULL;
1610         uint32_t out_level = 0;
1611         struct GUID *source_dsa_guid;
1612         struct GUID *source_dsa_invocation_id;
1613         struct drsuapi_DsReplicaHighWaterMark *new_highwatermark;
1614         struct drsuapi_DsReplicaObjectListItemEx *first_object;
1615         struct drsuapi_DsReplicaObjectListItemEx *cur;
1616
1617         if (!W_ERROR_IS_OK(r->out.result)) {
1618                 return r->out.result;
1619         }
1620
1621         if (r->out.level == 1) {
1622                 out_level = 1;
1623                 ctr1 = &r->out.ctr.ctr1;
1624         } else if (r->out.level == 2) {
1625                 out_level = 1;
1626                 ctr1 = r->out.ctr.ctr2.ctr.mszip1.ctr1;
1627         } else if (r->out.level == 6) {
1628                 out_level = 6;
1629                 ctr6 = &r->out.ctr.ctr6;
1630         } else if (r->out.level == 7 &&
1631                    r->out.ctr.ctr7.level == 6 &&
1632                    r->out.ctr.ctr7.type == DRSUAPI_COMPRESSION_TYPE_MSZIP) {
1633                 out_level = 6;
1634                 ctr6 = r->out.ctr.ctr7.ctr.mszip6.ctr6;
1635         } else {
1636                 return WERR_BAD_NET_RESP;
1637         }
1638
1639         switch (out_level) {
1640         case 1:
1641                 source_dsa_guid                 = &ctr1->source_dsa_guid;
1642                 source_dsa_invocation_id        = &ctr1->source_dsa_invocation_id;
1643                 new_highwatermark               = &ctr1->new_highwatermark;
1644                 first_object                    = ctr1->first_object;
1645                 break;
1646         case 6:
1647                 source_dsa_guid                 = &ctr6->source_dsa_guid;
1648                 source_dsa_invocation_id        = &ctr6->source_dsa_invocation_id;
1649                 new_highwatermark               = &ctr6->new_highwatermark;
1650                 first_object                    = ctr6->first_object;
1651                 break;
1652         }
1653
1654         partition->highwatermark                = *new_highwatermark;
1655         partition->source_dsa_guid              = *source_dsa_guid;
1656         partition->source_dsa_invocation_id     = *source_dsa_invocation_id;
1657
1658         if (!partition->first_object) {
1659                 partition->first_object = talloc_steal(s, first_object);
1660         } else {
1661                 partition->last_object->next_object = talloc_steal(partition->last_object,
1662                                                                    first_object);
1663         }
1664         for (cur = first_object; cur->next_object; cur = cur->next_object) {}
1665         partition->last_object = cur;
1666
1667 DEBUG(0,("end NC[%s] tmp_highest_usn[%llu] highest_usn[%llu]\n",
1668         partition->nc.dn,
1669         partition->highwatermark.tmp_highest_usn,
1670         partition->highwatermark.highest_usn));
1671
1672         return WERR_OK;
1673 }
1674
1675 static void becomeDC_drsuapi3_pull_schema_recv(struct rpc_request *req);
1676
1677 static void becomeDC_drsuapi3_pull_schema_send(struct libnet_BecomeDC_state *s)
1678 {
1679         s->schema_part.nc.guid  = GUID_zero();
1680         s->schema_part.nc.sid   = s->zero_sid;
1681         s->schema_part.nc.dn    = s->forest.schema_dn_str;
1682
1683         s->schema_part.destination_dsa_guid     = s->drsuapi2.bind_guid;
1684
1685         s->schema_part.replica_flags    = DRSUAPI_DS_REPLICA_NEIGHBOUR_WRITEABLE
1686                                         | DRSUAPI_DS_REPLICA_NEIGHBOUR_SYNC_ON_STARTUP
1687                                         | DRSUAPI_DS_REPLICA_NEIGHBOUR_DO_SCHEDULED_SYNCS
1688                                         | DRSUAPI_DS_REPLICA_NEIGHBOUR_FULL_IN_PROGRESS
1689                                         | DRSUAPI_DS_REPLICA_NEIGHBOUR_NEVER_SYNCED
1690                                         | DRSUAPI_DS_REPLICA_NEIGHBOUR_COMPRESS_CHANGES;
1691
1692         becomeDC_drsuapi_pull_partition_send(s, &s->drsuapi2, &s->drsuapi3, &s->schema_part,
1693                                              becomeDC_drsuapi3_pull_schema_recv);
1694 }
1695
1696 static void becomeDC_drsuapi3_pull_config_send(struct libnet_BecomeDC_state *s);
1697
1698 static void becomeDC_drsuapi3_pull_schema_recv(struct rpc_request *req)
1699 {
1700         struct libnet_BecomeDC_state *s = talloc_get_type(req->async.private,
1701                                           struct libnet_BecomeDC_state);
1702         struct composite_context *c = s->creq;
1703         struct drsuapi_DsGetNCChanges *r = talloc_get_type(req->ndr.struct_ptr,
1704                                            struct drsuapi_DsGetNCChanges);
1705         WERROR status;
1706
1707         c->status = dcerpc_ndr_request_recv(req);
1708         if (!composite_is_ok(c)) return;
1709
1710         status = becomeDC_drsuapi_pull_partition_recv(s, &s->schema_part, r);
1711         if (!W_ERROR_IS_OK(status)) {
1712                 composite_error(c, werror_to_ntstatus(status));
1713                 return;
1714         }
1715
1716         talloc_free(r);
1717
1718         if (s->schema_part.highwatermark.tmp_highest_usn > s->schema_part.highwatermark.highest_usn) {
1719                 becomeDC_drsuapi_pull_partition_send(s, &s->drsuapi2, &s->drsuapi3, &s->schema_part,
1720                                                      becomeDC_drsuapi3_pull_schema_recv);
1721                 return;
1722         }
1723
1724         becomeDC_drsuapi3_pull_config_send(s);
1725 }
1726
1727 static void becomeDC_drsuapi3_pull_config_recv(struct rpc_request *req);
1728
1729 static void becomeDC_drsuapi3_pull_config_send(struct libnet_BecomeDC_state *s)
1730 {
1731         s->config_part.nc.guid  = GUID_zero();
1732         s->config_part.nc.sid   = s->zero_sid;
1733         s->config_part.nc.dn    = s->forest.config_dn_str;
1734
1735         s->config_part.destination_dsa_guid     = s->drsuapi2.bind_guid;
1736
1737         s->config_part.replica_flags    = DRSUAPI_DS_REPLICA_NEIGHBOUR_WRITEABLE
1738                                         | DRSUAPI_DS_REPLICA_NEIGHBOUR_SYNC_ON_STARTUP
1739                                         | DRSUAPI_DS_REPLICA_NEIGHBOUR_DO_SCHEDULED_SYNCS
1740                                         | DRSUAPI_DS_REPLICA_NEIGHBOUR_FULL_IN_PROGRESS
1741                                         | DRSUAPI_DS_REPLICA_NEIGHBOUR_NEVER_SYNCED
1742                                         | DRSUAPI_DS_REPLICA_NEIGHBOUR_COMPRESS_CHANGES;
1743
1744         becomeDC_drsuapi_pull_partition_send(s, &s->drsuapi2, &s->drsuapi3, &s->config_part,
1745                                              becomeDC_drsuapi3_pull_config_recv);
1746 }
1747
1748 static void becomeDC_drsuapi3_pull_config_recv(struct rpc_request *req)
1749 {
1750         struct libnet_BecomeDC_state *s = talloc_get_type(req->async.private,
1751                                           struct libnet_BecomeDC_state);
1752         struct composite_context *c = s->creq;
1753         struct drsuapi_DsGetNCChanges *r = talloc_get_type(req->ndr.struct_ptr,
1754                                            struct drsuapi_DsGetNCChanges);
1755         WERROR status;
1756
1757         c->status = dcerpc_ndr_request_recv(req);
1758         if (!composite_is_ok(c)) return;
1759
1760         status = becomeDC_drsuapi_pull_partition_recv(s, &s->config_part, r);
1761         if (!W_ERROR_IS_OK(status)) {
1762                 composite_error(c, werror_to_ntstatus(status));
1763                 return;
1764         }
1765
1766         talloc_free(r);
1767
1768         if (s->config_part.highwatermark.tmp_highest_usn > s->config_part.highwatermark.highest_usn) {
1769                 becomeDC_drsuapi_pull_partition_send(s, &s->drsuapi2, &s->drsuapi3, &s->config_part,
1770                                                      becomeDC_drsuapi3_pull_config_recv);
1771                 return;
1772         }
1773
1774         becomeDC_connect_ldap2(s);
1775 }
1776
1777 static void becomeDC_drsuapi3_pull_domain_recv(struct rpc_request *req);
1778
1779 static void becomeDC_drsuapi3_pull_domain_send(struct libnet_BecomeDC_state *s)
1780 {
1781         s->domain_part.nc.guid  = GUID_zero();
1782         s->domain_part.nc.sid   = s->zero_sid;
1783         s->domain_part.nc.dn    = s->domain.dn_str;
1784
1785         s->domain_part.destination_dsa_guid     = s->drsuapi2.bind_guid;
1786
1787         s->domain_part.replica_flags    = DRSUAPI_DS_REPLICA_NEIGHBOUR_WRITEABLE
1788                                         | DRSUAPI_DS_REPLICA_NEIGHBOUR_SYNC_ON_STARTUP
1789                                         | DRSUAPI_DS_REPLICA_NEIGHBOUR_DO_SCHEDULED_SYNCS
1790                                         | DRSUAPI_DS_REPLICA_NEIGHBOUR_FULL_IN_PROGRESS
1791                                         | DRSUAPI_DS_REPLICA_NEIGHBOUR_NEVER_SYNCED
1792                                         | DRSUAPI_DS_REPLICA_NEIGHBOUR_COMPRESS_CHANGES;
1793
1794         becomeDC_drsuapi_pull_partition_send(s, &s->drsuapi2, &s->drsuapi3, &s->domain_part,
1795                                              becomeDC_drsuapi3_pull_domain_recv);
1796 }
1797
1798 static void becomeDC_drsuapi3_pull_domain_recv(struct rpc_request *req)
1799 {
1800         struct libnet_BecomeDC_state *s = talloc_get_type(req->async.private,
1801                                           struct libnet_BecomeDC_state);
1802         struct composite_context *c = s->creq;
1803         struct drsuapi_DsGetNCChanges *r = talloc_get_type(req->ndr.struct_ptr,
1804                                            struct drsuapi_DsGetNCChanges);
1805         WERROR status;
1806
1807         c->status = dcerpc_ndr_request_recv(req);
1808         if (!composite_is_ok(c)) return;
1809
1810         status = becomeDC_drsuapi_pull_partition_recv(s, &s->domain_part, r);
1811         if (!W_ERROR_IS_OK(status)) {
1812                 composite_error(c, werror_to_ntstatus(status));
1813                 return;
1814         }
1815
1816         talloc_free(r);
1817
1818         if (s->domain_part.highwatermark.tmp_highest_usn > s->domain_part.highwatermark.highest_usn) {
1819                 becomeDC_drsuapi_pull_partition_send(s, &s->drsuapi2, &s->drsuapi3, &s->domain_part,
1820                                                      becomeDC_drsuapi3_pull_domain_recv);
1821                 return;
1822         }
1823
1824         composite_error(c, NT_STATUS_NOT_IMPLEMENTED);
1825 }
1826
1827 static NTSTATUS becomeDC_ldap2_modify_computer(struct libnet_BecomeDC_state *s)
1828 {
1829         int ret;
1830         struct ldb_message *msg;
1831         uint32_t i;
1832         uint32_t user_account_control = UF_SERVER_TRUST_ACCOUNT |
1833                                         UF_TRUSTED_FOR_DELEGATION;
1834
1835         /* as the value is already as we want it to be, we're done */
1836         if (s->dest_dsa.user_account_control == user_account_control) {
1837                 return NT_STATUS_OK;
1838         }
1839
1840         /* make a 'modify' msg, and only for serverReference */
1841         msg = ldb_msg_new(s);
1842         NT_STATUS_HAVE_NO_MEMORY(msg);
1843         msg->dn = ldb_dn_new(msg, s->ldap2.ldb, s->dest_dsa.computer_dn_str);
1844         NT_STATUS_HAVE_NO_MEMORY(msg->dn);
1845
1846         ret = ldb_msg_add_fmt(msg, "userAccountControl", "%u", user_account_control);
1847         if (ret != 0) {
1848                 talloc_free(msg);
1849                 return NT_STATUS_NO_MEMORY;
1850         }
1851
1852         /* mark all the message elements (should be just one)
1853            as LDB_FLAG_MOD_REPLACE */
1854         for (i=0;i<msg->num_elements;i++) {
1855                 msg->elements[i].flags = LDB_FLAG_MOD_REPLACE;
1856         }
1857
1858         ret = ldb_modify(s->ldap2.ldb, msg);
1859         talloc_free(msg);
1860         if (ret != LDB_SUCCESS) {
1861                 return NT_STATUS_LDAP(ret);
1862         }
1863
1864         s->dest_dsa.user_account_control = user_account_control;
1865
1866         return NT_STATUS_OK;
1867 }
1868
1869 static NTSTATUS becomeDC_ldap2_move_computer(struct libnet_BecomeDC_state *s)
1870 {
1871         int ret;
1872         struct ldb_result *r;
1873         struct ldb_dn *basedn;
1874         struct ldb_dn *old_dn;
1875         struct ldb_dn *new_dn;
1876         static const char *_1_1_attrs[] = {
1877                 "1.1",
1878                 NULL
1879         };
1880
1881         basedn = ldb_dn_new_fmt(s, s->ldap2.ldb, "<WKGUID=a361b2ffffd211d1aa4b00c04fd7d83a,%s>",
1882                                 s->domain.dn_str);
1883         NT_STATUS_HAVE_NO_MEMORY(basedn);
1884
1885         ret = ldb_search(s->ldap2.ldb, basedn, LDB_SCOPE_BASE,
1886                          "(objectClass=*)", _1_1_attrs, &r);
1887         talloc_free(basedn);
1888         if (ret != LDB_SUCCESS) {
1889                 return NT_STATUS_LDAP(ret);
1890         } else if (r->count != 1) {
1891                 talloc_free(r);
1892                 return NT_STATUS_INVALID_NETWORK_RESPONSE;
1893         }
1894
1895         old_dn = ldb_dn_new(r, s->ldap2.ldb, s->dest_dsa.computer_dn_str);
1896         NT_STATUS_HAVE_NO_MEMORY(old_dn);
1897
1898         new_dn = r->msgs[0]->dn;
1899
1900         if (!ldb_dn_add_child_fmt(new_dn, "CN=%s", s->dest_dsa.netbios_name)) {
1901                 talloc_free(r);
1902                 return NT_STATUS_NO_MEMORY;
1903         }
1904
1905         if (ldb_dn_compare(old_dn, new_dn) == 0) {
1906                 /* we don't need to rename if the old and new dn match */
1907                 talloc_free(r);
1908                 return NT_STATUS_OK;
1909         }
1910
1911         ret = ldb_rename(s->ldap2.ldb, old_dn, new_dn);
1912         if (ret != LDB_SUCCESS) {
1913                 talloc_free(r);
1914                 return NT_STATUS_LDAP(ret);
1915         }
1916
1917         s->dest_dsa.computer_dn_str = ldb_dn_alloc_linearized(s, new_dn);
1918         NT_STATUS_HAVE_NO_MEMORY(s->dest_dsa.computer_dn_str);
1919
1920         talloc_free(r);
1921
1922         return NT_STATUS_OK;
1923 }
1924
1925 static void becomeDC_connect_ldap2(struct libnet_BecomeDC_state *s)
1926 {
1927         struct composite_context *c = s->creq;
1928
1929         c->status = becomeDC_ldap_connect(s, &s->ldap2);
1930         if (!composite_is_ok(c)) return;
1931
1932         c->status = becomeDC_ldap2_modify_computer(s);
1933         if (!composite_is_ok(c)) return;
1934
1935         c->status = becomeDC_ldap2_move_computer(s);
1936         if (!composite_is_ok(c)) return;
1937
1938         becomeDC_drsuapi3_pull_domain_send(s);
1939 }
1940
1941 struct composite_context *libnet_BecomeDC_send(struct libnet_context *ctx, TALLOC_CTX *mem_ctx, struct libnet_BecomeDC *r)
1942 {
1943         struct composite_context *c;
1944         struct libnet_BecomeDC_state *s;
1945         char *tmp_name;
1946
1947         c = composite_create(mem_ctx, ctx->event_ctx);
1948         if (c == NULL) return NULL;
1949
1950         s = talloc_zero(c, struct libnet_BecomeDC_state);
1951         if (composite_nomem(s, c)) return c;
1952         c->private_data = s;
1953         s->creq         = c;
1954         s->libnet       = ctx;
1955
1956         /* Domain input */
1957         s->domain.dns_name      = talloc_strdup(s, r->in.domain_dns_name);
1958         if (composite_nomem(s->domain.dns_name, c)) return c;
1959         s->domain.netbios_name  = talloc_strdup(s, r->in.domain_netbios_name);
1960         if (composite_nomem(s->domain.netbios_name, c)) return c;
1961         s->domain.sid           = dom_sid_dup(s, r->in.domain_sid);
1962         if (composite_nomem(s->domain.sid, c)) return c;
1963
1964         /* Source DSA input */
1965         s->source_dsa.address   = talloc_strdup(s, r->in.source_dsa_address);
1966         if (composite_nomem(s->source_dsa.address, c)) return c;
1967
1968         /* Destination DSA input */
1969         s->dest_dsa.netbios_name= talloc_strdup(s, r->in.dest_dsa_netbios_name);
1970         if (composite_nomem(s->dest_dsa.netbios_name, c)) return c;
1971
1972         /* Destination DSA dns_name construction */
1973         tmp_name                = strlower_talloc(s, s->dest_dsa.netbios_name);
1974         if (composite_nomem(tmp_name, c)) return c;
1975         s->dest_dsa.dns_name    = talloc_asprintf_append(tmp_name, ".%s",
1976                                                          s->domain.dns_name);
1977         if (composite_nomem(s->dest_dsa.dns_name, c)) return c;
1978
1979         becomeDC_send_cldap(s);
1980         return c;
1981 }
1982
1983 NTSTATUS libnet_BecomeDC_recv(struct composite_context *c, TALLOC_CTX *mem_ctx, struct libnet_BecomeDC *r)
1984 {
1985         NTSTATUS status;
1986
1987         status = composite_wait(c);
1988
1989         ZERO_STRUCT(r->out);
1990
1991         talloc_free(c);
1992         return status;
1993 }
1994
1995 NTSTATUS libnet_BecomeDC(struct libnet_context *ctx, TALLOC_CTX *mem_ctx, struct libnet_BecomeDC *r)
1996 {
1997         NTSTATUS status;
1998         struct composite_context *c;
1999         c = libnet_BecomeDC_send(ctx, mem_ctx, r);
2000         status = libnet_BecomeDC_recv(c, mem_ctx, r);
2001         return status;
2002 }