source4/dsdb/samdb/ldb_modules/descriptor.c

   1 /*
   2    ldb database library
   3
   4    Copyright (C) Simo Sorce  2006-2008
   5    Copyright (C) Andrew Bartlett <abartlet@samba.org> 2005-2007
   6    Copyright (C) Nadezhda Ivanova  2009
   7
   8    This program is free software; you can redistribute it and/or modify
   9    it under the terms of the GNU General Public License as published by
  10    the Free Software Foundation; either version 3 of the License, or
  11    (at your option) any later version.
  12
  13    This program is distributed in the hope that it will be useful,
  14    but WITHOUT ANY WARRANTY; without even the implied warranty of
  15    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  16    GNU General Public License for more details.
  17
  18    You should have received a copy of the GNU General Public License
  19    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  20 */
  21
  22 /*
  23  *  Name: ldb
  24  *
  25  *  Component: DS Security descriptor module
  26  *
  27  *  Description:
  28  *  - Calculate the security descriptor of a newly created object
  29  *  - Perform sd recalculation on a move operation
  30  *  - Handle sd modification invariants
  31  *
  32  *  Author: Nadezhda Ivanova
  33  */
  34
  35 #include "includes.h"
  36 #include <ldb_module.h>
  37 #include "util/dlinklist.h"
  38 #include "dsdb/samdb/samdb.h"
  39 #include "librpc/ndr/libndr.h"
  40 #include "librpc/gen_ndr/ndr_security.h"
  41 #include "libcli/security/security.h"
  42 #include "auth/auth.h"
  43 #include "param/param.h"
  44 #include "dsdb/samdb/ldb_modules/util.h"
  45 #include "lib/util/util_tdb.h"
  46 #include "lib/dbwrap/dbwrap.h"
  47 #include "lib/dbwrap/dbwrap_rbt.h"
  48
  49 struct descriptor_changes {
  50         struct descriptor_changes *prev, *next;
  51         struct ldb_dn *nc_root;
  52         struct GUID guid;
  53         struct GUID parent_guid;
  54         bool force_self;
  55         bool force_children;
  56         struct ldb_dn *stopped_dn;
  57         size_t ref_count;
  58         size_t sort_count;
  59 };
  60
  61 struct descriptor_transaction {
  62         TALLOC_CTX *mem;
  63         struct {
  64                 /*
  65                  * We used to have a list of changes, appended with each
  66                  * DSDB_EXTENDED_SEC_DESC_PROPAGATION_OID operation.
  67                  *
  68                  * But the main problem was that a replication
  69                  * cycle (mainly the initial replication) calls
  70                  * DSDB_EXTENDED_SEC_DESC_PROPAGATION_OID for the
  71                  * same object[GUID] more than once. With
  72                  * DRSUAPI_DRS_GET_TGT we'll get the naming
  73                  * context head object and other top level
  74                  * containers, every often.
  75                  *
  76                  * It means we'll process objects more
  77                  * than once and waste a lot of time
  78                  * doing the same work again and again.
  79                  *
  80                  * We use an objectGUID based map in order to
  81                  * avoid registering objects more than once.
  82                  * In an domain with 22000 object it can
  83                  * reduce the work from 4 hours down to ~ 3.5 minutes.
  84                  */
  85                 struct descriptor_changes *list;
  86                 struct db_context *map;
  87                 size_t num_registrations;
  88                 size_t num_registered;
  89                 size_t num_toplevel;
  90                 size_t num_processed;
  91         } changes;
  92         struct {
  93                 struct db_context *map;
  94                 size_t num_processed;
  95                 size_t num_skipped;
  96         } objects;
  97 };
  98
  99 struct descriptor_data {
 100         struct descriptor_transaction transaction;
 101 };
 102
 103 struct descriptor_context {
 104         struct ldb_module *module;
 105         struct ldb_request *req;
 106         struct ldb_message *msg;
 107         struct ldb_reply *search_res;
 108         struct ldb_reply *search_oc_res;
 109         struct ldb_val *parentsd_val;
 110         struct ldb_message_element *sd_element;
 111         struct ldb_val *sd_val;
 112         uint32_t sd_flags;
 113         int (*step_fn)(struct descriptor_context *);
 114 };
 115
 116 static struct dom_sid *get_default_ag(TALLOC_CTX *mem_ctx,
 117                                struct ldb_dn *dn,
 118                                const struct security_token *token,
 119                                struct ldb_context *ldb)
 120 {
 121         TALLOC_CTX *tmp_ctx = talloc_new(mem_ctx);
 122         const struct dom_sid *domain_sid = samdb_domain_sid(ldb);
 123         struct dom_sid *da_sid = dom_sid_add_rid(tmp_ctx, domain_sid, DOMAIN_RID_ADMINS);
 124         struct dom_sid *ea_sid = dom_sid_add_rid(tmp_ctx, domain_sid, DOMAIN_RID_ENTERPRISE_ADMINS);
 125         struct dom_sid *sa_sid = dom_sid_add_rid(tmp_ctx, domain_sid, DOMAIN_RID_SCHEMA_ADMINS);
 126         struct dom_sid *dag_sid;
 127         struct ldb_dn *nc_root;
 128         int ret;
 129
 130         ret = dsdb_find_nc_root(ldb, tmp_ctx, dn, &nc_root);
 131         if (ret != LDB_SUCCESS) {
 132                 talloc_free(tmp_ctx);
 133                 return NULL;
 134         }
 135
 136         if (ldb_dn_compare(nc_root, ldb_get_schema_basedn(ldb)) == 0) {
 137                 if (security_token_has_sid(token, sa_sid)) {
 138                         dag_sid = dom_sid_dup(mem_ctx, sa_sid);
 139                 } else if (security_token_has_sid(token, ea_sid)) {
 140                         dag_sid = dom_sid_dup(mem_ctx, ea_sid);
 141                 } else if (security_token_has_sid(token, da_sid)) {
 142                         dag_sid = dom_sid_dup(mem_ctx, da_sid);
 143                 } else if (security_token_is_system(token)) {
 144                         dag_sid = dom_sid_dup(mem_ctx, sa_sid);
 145                 } else {
 146                         dag_sid = NULL;
 147                 }
 148         } else if (ldb_dn_compare(nc_root, ldb_get_config_basedn(ldb)) == 0) {
 149                 if (security_token_has_sid(token, ea_sid)) {
 150                         dag_sid = dom_sid_dup(mem_ctx, ea_sid);
 151                 } else if (security_token_has_sid(token, da_sid)) {
 152                         dag_sid = dom_sid_dup(mem_ctx, da_sid);
 153                 } else if (security_token_is_system(token)) {
 154                         dag_sid = dom_sid_dup(mem_ctx, ea_sid);
 155                 } else {
 156                         dag_sid = NULL;
 157                 }
 158         } else if (ldb_dn_compare(nc_root, ldb_get_default_basedn(ldb)) == 0) {
 159                 if (security_token_has_sid(token, da_sid)) {
 160                         dag_sid = dom_sid_dup(mem_ctx, da_sid);
 161                 } else if (security_token_has_sid(token, ea_sid)) {
 162                                 dag_sid = dom_sid_dup(mem_ctx, ea_sid);
 163                 } else if (security_token_is_system(token)) {
 164                         dag_sid = dom_sid_dup(mem_ctx, da_sid);
 165                 } else {
 166                         dag_sid = NULL;
 167                 }
 168         } else {
 169                 dag_sid = NULL;
 170         }
 171
 172         talloc_free(tmp_ctx);
 173         return dag_sid;
 174 }
 175
 176 static struct security_descriptor *get_sd_unpacked(struct ldb_module *module, TALLOC_CTX *mem_ctx,
 177                                             const struct dsdb_class *objectclass)
 178 {
 179         struct ldb_context *ldb = ldb_module_get_ctx(module);
 180         struct security_descriptor *sd;
 181         const struct dom_sid *domain_sid = samdb_domain_sid(ldb);
 182
 183         if (!objectclass->defaultSecurityDescriptor || !domain_sid) {
 184                 return NULL;
 185         }
 186
 187         sd = sddl_decode(mem_ctx,
 188                          objectclass->defaultSecurityDescriptor,
 189                          domain_sid);
 190         return sd;
 191 }
 192
 193 static struct dom_sid *get_default_group(TALLOC_CTX *mem_ctx,
 194                                          struct ldb_context *ldb,
 195                                          struct dom_sid *dag)
 196 {
 197         /*
 198          * This depends on the function level of the DC
 199          * which is 2008R2 in our case. Which means it is
 200          * higher than 2003 and we should use the
 201          * "default administrator group" also as owning group.
 202          *
 203          * This matches dcpromo for a 2003 domain
 204          * on a Windows 2008R2 DC.
 205          */
 206         return dag;
 207 }
 208
 209 static struct security_descriptor *descr_handle_sd_flags(TALLOC_CTX *mem_ctx,
 210                                                          struct security_descriptor *new_sd,
 211                                                          struct security_descriptor *old_sd,
 212                                                          uint32_t sd_flags)
 213 {
 214         struct security_descriptor *final_sd;
 215         /* if there is no control or control == 0 modify everything */
 216         if (!sd_flags) {
 217                 return new_sd;
 218         }
 219
 220         final_sd = talloc_zero(mem_ctx, struct security_descriptor);
 221         final_sd->revision = SECURITY_DESCRIPTOR_REVISION_1;
 222         final_sd->type = SEC_DESC_SELF_RELATIVE;
 223
 224         if (sd_flags & (SECINFO_OWNER)) {
 225                 if (new_sd->owner_sid) {
 226                         final_sd->owner_sid = talloc_memdup(mem_ctx, new_sd->owner_sid, sizeof(struct dom_sid));
 227                 }
 228                 final_sd->type |= new_sd->type & SEC_DESC_OWNER_DEFAULTED;
 229         }
 230         else if (old_sd) {
 231                 if (old_sd->owner_sid) {
 232                         final_sd->owner_sid = talloc_memdup(mem_ctx, old_sd->owner_sid, sizeof(struct dom_sid));
 233                 }
 234                 final_sd->type |= old_sd->type & SEC_DESC_OWNER_DEFAULTED;
 235         }
 236
 237         if (sd_flags & (SECINFO_GROUP)) {
 238                 if (new_sd->group_sid) {
 239                         final_sd->group_sid = talloc_memdup(mem_ctx, new_sd->group_sid, sizeof(struct dom_sid));
 240                 }
 241                 final_sd->type |= new_sd->type & SEC_DESC_GROUP_DEFAULTED;
 242         }
 243         else if (old_sd) {
 244                 if (old_sd->group_sid) {
 245                         final_sd->group_sid = talloc_memdup(mem_ctx, old_sd->group_sid, sizeof(struct dom_sid));
 246                 }
 247                 final_sd->type |= old_sd->type & SEC_DESC_GROUP_DEFAULTED;
 248         }
 249
 250         if (sd_flags & (SECINFO_SACL)) {
 251                 final_sd->sacl = security_acl_dup(mem_ctx,new_sd->sacl);
 252                 final_sd->type |= new_sd->type & (SEC_DESC_SACL_PRESENT |
 253                         SEC_DESC_SACL_DEFAULTED|SEC_DESC_SACL_AUTO_INHERIT_REQ |
 254                         SEC_DESC_SACL_AUTO_INHERITED|SEC_DESC_SACL_PROTECTED |
 255                         SEC_DESC_SERVER_SECURITY);
 256         }
 257         else if (old_sd && old_sd->sacl) {
 258                 final_sd->sacl = security_acl_dup(mem_ctx,old_sd->sacl);
 259                 final_sd->type |= old_sd->type & (SEC_DESC_SACL_PRESENT |
 260                         SEC_DESC_SACL_DEFAULTED|SEC_DESC_SACL_AUTO_INHERIT_REQ |
 261                         SEC_DESC_SACL_AUTO_INHERITED|SEC_DESC_SACL_PROTECTED |
 262                         SEC_DESC_SERVER_SECURITY);
 263         }
 264
 265         if (sd_flags & (SECINFO_DACL)) {
 266                 final_sd->dacl = security_acl_dup(mem_ctx,new_sd->dacl);
 267                 final_sd->type |= new_sd->type & (SEC_DESC_DACL_PRESENT |
 268                         SEC_DESC_DACL_DEFAULTED|SEC_DESC_DACL_AUTO_INHERIT_REQ |
 269                         SEC_DESC_DACL_AUTO_INHERITED|SEC_DESC_DACL_PROTECTED |
 270                         SEC_DESC_DACL_TRUSTED);
 271         }
 272         else if (old_sd && old_sd->dacl) {
 273                 final_sd->dacl = security_acl_dup(mem_ctx,old_sd->dacl);
 274                 final_sd->type |= old_sd->type & (SEC_DESC_DACL_PRESENT |
 275                         SEC_DESC_DACL_DEFAULTED|SEC_DESC_DACL_AUTO_INHERIT_REQ |
 276                         SEC_DESC_DACL_AUTO_INHERITED|SEC_DESC_DACL_PROTECTED |
 277                         SEC_DESC_DACL_TRUSTED);
 278         }
 279         /* not so sure about this */
 280         final_sd->type |= new_sd->type & SEC_DESC_RM_CONTROL_VALID;
 281         return final_sd;
 282 }
 283
 284 static struct security_descriptor *get_new_descriptor_nonlinear(struct ldb_module *module,
 285                                                                 struct ldb_dn *dn,
 286                                                                 TALLOC_CTX *mem_ctx,
 287                                                                 const struct dsdb_class *objectclass,
 288                                                                 const struct ldb_val *parent,
 289                                                                 const struct ldb_val *object,
 290                                                                 const struct ldb_val *old_sd,
 291                                                                 uint32_t sd_flags)
 292 {
 293         struct security_descriptor *user_descriptor = NULL, *parent_descriptor = NULL;
 294         struct security_descriptor *old_descriptor = NULL;
 295         struct security_descriptor *new_sd, *final_sd;
 296         enum ndr_err_code ndr_err;
 297         struct ldb_context *ldb = ldb_module_get_ctx(module);
 298         struct auth_session_info *session_info
 299                 = ldb_get_opaque(ldb, DSDB_SESSION_INFO);
 300         const struct dom_sid *domain_sid = samdb_domain_sid(ldb);
 301         struct dom_sid *default_owner;
 302         struct dom_sid *default_group;
 303         struct security_descriptor *default_descriptor = NULL;
 304         struct GUID *object_list = NULL;
 305
 306         if (objectclass != NULL) {
 307                 default_descriptor = get_sd_unpacked(module, mem_ctx, objectclass);
 308                 object_list = talloc_zero_array(mem_ctx, struct GUID, 2);
 309                 if (object_list == NULL) {
 310                         return NULL;
 311                 }
 312                 object_list[0] = objectclass->schemaIDGUID;
 313         }
 314
 315         if (object) {
 316                 user_descriptor = talloc(mem_ctx, struct security_descriptor);
 317                 if (!user_descriptor) {
 318                         return NULL;
 319                 }
 320                 ndr_err = ndr_pull_struct_blob(object, user_descriptor,
 321                                                user_descriptor,
 322                                                (ndr_pull_flags_fn_t)ndr_pull_security_descriptor);
 323
 324                 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
 325                         talloc_free(user_descriptor);
 326                         return NULL;
 327                 }
 328         } else {
 329                 user_descriptor = default_descriptor;
 330         }
 331
 332         if (old_sd) {
 333                 old_descriptor = talloc(mem_ctx, struct security_descriptor);
 334                 if (!old_descriptor) {
 335                         return NULL;
 336                 }
 337                 ndr_err = ndr_pull_struct_blob(old_sd, old_descriptor,
 338                                                old_descriptor,
 339                                                (ndr_pull_flags_fn_t)ndr_pull_security_descriptor);
 340
 341                 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
 342                         talloc_free(old_descriptor);
 343                         return NULL;
 344                 }
 345         }
 346
 347         if (parent) {
 348                 parent_descriptor = talloc(mem_ctx, struct security_descriptor);
 349                 if (!parent_descriptor) {
 350                         return NULL;
 351                 }
 352                 ndr_err = ndr_pull_struct_blob(parent, parent_descriptor,
 353                                                parent_descriptor,
 354                                                (ndr_pull_flags_fn_t)ndr_pull_security_descriptor);
 355
 356                 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
 357                         talloc_free(parent_descriptor);
 358                         return NULL;
 359                 }
 360         }
 361
 362         if (user_descriptor && default_descriptor &&
 363             (user_descriptor->dacl == NULL))
 364         {
 365                 user_descriptor->dacl = default_descriptor->dacl;
 366                 user_descriptor->type |= default_descriptor->type & (
 367                         SEC_DESC_DACL_PRESENT |
 368                         SEC_DESC_DACL_DEFAULTED|SEC_DESC_DACL_AUTO_INHERIT_REQ |
 369                         SEC_DESC_DACL_AUTO_INHERITED|SEC_DESC_DACL_PROTECTED |
 370                         SEC_DESC_DACL_TRUSTED);
 371         }
 372
 373         if (user_descriptor && default_descriptor &&
 374             (user_descriptor->sacl == NULL))
 375         {
 376                 user_descriptor->sacl = default_descriptor->sacl;
 377                 user_descriptor->type |= default_descriptor->type & (
 378                         SEC_DESC_SACL_PRESENT |
 379                         SEC_DESC_SACL_DEFAULTED|SEC_DESC_SACL_AUTO_INHERIT_REQ |
 380                         SEC_DESC_SACL_AUTO_INHERITED|SEC_DESC_SACL_PROTECTED |
 381                         SEC_DESC_SERVER_SECURITY);
 382         }
 383
 384
 385         if (!(sd_flags & SECINFO_OWNER) && user_descriptor) {
 386                 user_descriptor->owner_sid = NULL;
 387
 388                 /*
 389                  * We need the correct owner sid
 390                  * when calculating the DACL or SACL
 391                  */
 392                 if (old_descriptor) {
 393                         user_descriptor->owner_sid = old_descriptor->owner_sid;
 394                 }
 395         }
 396         if (!(sd_flags & SECINFO_GROUP) && user_descriptor) {
 397                 user_descriptor->group_sid = NULL;
 398
 399                 /*
 400                  * We need the correct group sid
 401                  * when calculating the DACL or SACL
 402                  */
 403                 if (old_descriptor) {
 404                         user_descriptor->group_sid = old_descriptor->group_sid;
 405                 }
 406         }
 407         if (!(sd_flags & SECINFO_DACL) && user_descriptor) {
 408                 user_descriptor->dacl = NULL;
 409
 410                 /*
 411                  * We add SEC_DESC_DACL_PROTECTED so that
 412                  * create_security_descriptor() skips
 413                  * the unused inheritance calculation
 414                  */
 415                 user_descriptor->type |= SEC_DESC_DACL_PROTECTED;
 416         }
 417         if (!(sd_flags & SECINFO_SACL) && user_descriptor) {
 418                 user_descriptor->sacl = NULL;
 419
 420                 /*
 421                  * We add SEC_DESC_SACL_PROTECTED so that
 422                  * create_security_descriptor() skips
 423                  * the unused inheritance calculation
 424                  */
 425                 user_descriptor->type |= SEC_DESC_SACL_PROTECTED;
 426         }
 427
 428         default_owner = get_default_ag(mem_ctx, dn,
 429                                        session_info->security_token, ldb);
 430         default_group = get_default_group(mem_ctx, ldb, default_owner);
 431         new_sd = create_security_descriptor(mem_ctx,
 432                                             parent_descriptor,
 433                                             user_descriptor,
 434                                             true,
 435                                             object_list,
 436                                             SEC_DACL_AUTO_INHERIT |
 437                                             SEC_SACL_AUTO_INHERIT,
 438                                             session_info->security_token,
 439                                             default_owner, default_group,
 440                                             map_generic_rights_ds);
 441         if (!new_sd) {
 442                 return NULL;
 443         }
 444         final_sd = descr_handle_sd_flags(mem_ctx, new_sd, old_descriptor, sd_flags);
 445
 446         if (!final_sd) {
 447                 return NULL;
 448         }
 449
 450         if (final_sd->dacl) {
 451                 final_sd->dacl->revision = SECURITY_ACL_REVISION_ADS;
 452         }
 453         if (final_sd->sacl) {
 454                 final_sd->sacl->revision = SECURITY_ACL_REVISION_ADS;
 455         }
 456
 457         {
 458                 TALLOC_CTX *tmp_ctx = talloc_new(mem_ctx);
 459                 DBG_DEBUG("Object %s created with descriptor %s\n\n",
 460                           ldb_dn_get_linearized(dn),
 461                           sddl_encode(tmp_ctx, final_sd, domain_sid));
 462                 TALLOC_FREE(tmp_ctx);
 463         }
 464
 465         return final_sd;
 466 }
 467
 468 static DATA_BLOB *get_new_descriptor(struct ldb_module *module,
 469                                      struct ldb_dn *dn,
 470                                      TALLOC_CTX *mem_ctx,
 471                                      const struct dsdb_class *objectclass,
 472                                      const struct ldb_val *parent,
 473                                      const struct ldb_val *object,
 474                                      const struct ldb_val *old_sd,
 475                                      uint32_t sd_flags)
 476 {
 477         struct security_descriptor *final_sd = NULL;
 478         enum ndr_err_code ndr_err;
 479         DATA_BLOB *linear_sd = talloc(mem_ctx, DATA_BLOB);
 480
 481         if (!linear_sd) {
 482                 return NULL;
 483         }
 484
 485         final_sd = get_new_descriptor_nonlinear(module,
 486                                                 dn,
 487                                                 mem_ctx,
 488                                                 objectclass,
 489                                                 parent,
 490                                                 object,
 491                                                 old_sd,
 492                                                 sd_flags);
 493         if (final_sd == NULL) {
 494                 return NULL;
 495         }
 496
 497         ndr_err = ndr_push_struct_blob(linear_sd, mem_ctx,
 498                                        final_sd,
 499                                        (ndr_push_flags_fn_t)ndr_push_security_descriptor);
 500         if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
 501                 return NULL;
 502         }
 503
 504         return linear_sd;
 505 }
 506
 507 static DATA_BLOB *descr_get_descriptor_to_show(struct ldb_module *module,
 508                                                TALLOC_CTX *mem_ctx,
 509                                                struct ldb_val *sd,
 510                                                uint32_t sd_flags)
 511 {
 512         struct security_descriptor *old_sd, *final_sd;
 513         DATA_BLOB *linear_sd;
 514         enum ndr_err_code ndr_err;
 515
 516         old_sd = talloc(mem_ctx, struct security_descriptor);
 517         if (!old_sd) {
 518                 return NULL;
 519         }
 520         ndr_err = ndr_pull_struct_blob(sd, old_sd,
 521                                        old_sd,
 522                                        (ndr_pull_flags_fn_t)ndr_pull_security_descriptor);
 523
 524         if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
 525                 talloc_free(old_sd);
 526                 return NULL;
 527         }
 528
 529         final_sd = descr_handle_sd_flags(mem_ctx, old_sd, NULL, sd_flags);
 530
 531         if (!final_sd) {
 532                 return NULL;
 533         }
 534
 535         linear_sd = talloc(mem_ctx, DATA_BLOB);
 536         if (!linear_sd) {
 537                 return NULL;
 538         }
 539
 540         ndr_err = ndr_push_struct_blob(linear_sd, mem_ctx,
 541                                        final_sd,
 542                                        (ndr_push_flags_fn_t)ndr_push_security_descriptor);
 543         if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
 544                 return NULL;
 545         }
 546
 547         return linear_sd;
 548 }
 549
 550 static struct descriptor_context *descriptor_init_context(struct ldb_module *module,
 551                                                           struct ldb_request *req)
 552 {
 553         struct ldb_context *ldb;
 554         struct descriptor_context *ac;
 555
 556         ldb = ldb_module_get_ctx(module);
 557
 558         ac = talloc_zero(req, struct descriptor_context);
 559         if (ac == NULL) {
 560                 ldb_set_errstring(ldb, "Out of Memory");
 561                 return NULL;
 562         }
 563
 564         ac->module = module;
 565         ac->req = req;
 566         return ac;
 567 }
 568
 569 static int descriptor_search_callback(struct ldb_request *req, struct ldb_reply *ares)
 570 {
 571         struct descriptor_context *ac;
 572         struct ldb_val *sd_val = NULL;
 573         struct ldb_message_element *sd_el;
 574         DATA_BLOB *show_sd;
 575         int ret = LDB_SUCCESS;
 576
 577         ac = talloc_get_type(req->context, struct descriptor_context);
 578
 579         if (!ares) {
 580                 ret = LDB_ERR_OPERATIONS_ERROR;
 581                 goto fail;
 582         }
 583         if (ares->error != LDB_SUCCESS) {
 584                 return ldb_module_done(ac->req, ares->controls,
 585                                         ares->response, ares->error);
 586         }
 587
 588         switch (ares->type) {
 589         case LDB_REPLY_ENTRY:
 590                 sd_el = ldb_msg_find_element(ares->message, "nTSecurityDescriptor");
 591                 if (sd_el) {
 592                         sd_val = sd_el->values;
 593                 }
 594
 595                 if (sd_val) {
 596                         show_sd = descr_get_descriptor_to_show(ac->module, ac->req,
 597                                                                sd_val, ac->sd_flags);
 598                         if (!show_sd) {
 599                                 ret = LDB_ERR_OPERATIONS_ERROR;
 600                                 goto fail;
 601                         }
 602                         ldb_msg_remove_attr(ares->message, "nTSecurityDescriptor");
 603                         ret = ldb_msg_add_steal_value(ares->message, "nTSecurityDescriptor", show_sd);
 604                         if (ret != LDB_SUCCESS) {
 605                                 goto fail;
 606                         }
 607                 }
 608                 return ldb_module_send_entry(ac->req, ares->message, ares->controls);
 609
 610         case LDB_REPLY_REFERRAL:
 611                 return ldb_module_send_referral(ac->req, ares->referral);
 612
 613         case LDB_REPLY_DONE:
 614                 return ldb_module_done(ac->req, ares->controls,
 615                                         ares->response, ares->error);
 616         }
 617
 618 fail:
 619         talloc_free(ares);
 620         return ldb_module_done(ac->req, NULL, NULL, ret);
 621 }
 622
 623 static bool can_write_owner(TALLOC_CTX *mem_ctx,
 624                             struct ldb_context *ldb,
 625                             struct ldb_dn *dn,
 626                             const struct security_token *security_token,
 627                             const struct dom_sid *owner_sid)
 628 {
 629         const struct dom_sid *default_owner = NULL;
 630
 631         /* If the user possesses SE_RESTORE_PRIVILEGE, the write is allowed. */
 632         bool ok = security_token_has_privilege(security_token, SEC_PRIV_RESTORE);
 633         if (ok) {
 634                 return true;
 635         }
 636
 637         /* The user can write their own SID to a security descriptor. */
 638         ok = security_token_is_sid(security_token, owner_sid);
 639         if (ok) {
 640                 return true;
 641         }
 642
 643         /*
 644          * The user can write the SID of the "default administrators group" that
 645          * they are a member of.
 646          */
 647         default_owner = get_default_ag(mem_ctx, dn,
 648                                        security_token, ldb);
 649         if (default_owner != NULL) {
 650                 ok = security_token_is_sid(security_token, owner_sid);
 651         }
 652
 653         return ok;
 654 }
 655
 656 static int descriptor_add(struct ldb_module *module, struct ldb_request *req)
 657 {
 658         struct ldb_context *ldb = ldb_module_get_ctx(module);
 659         struct ldb_request *add_req;
 660         struct ldb_message *msg;
 661         struct ldb_result *parent_res;
 662         const struct ldb_val *parent_sd = NULL;
 663         const struct ldb_val *user_sd = NULL;
 664         struct ldb_dn *dn = req->op.add.message->dn;
 665         struct ldb_dn *parent_dn, *nc_root;
 666         struct ldb_message_element *objectclass_element, *sd_element;
 667         int ret;
 668         const struct dsdb_schema *schema;
 669         DATA_BLOB *sd;
 670         const struct dsdb_class *objectclass;
 671         static const char * const parent_attrs[] = { "nTSecurityDescriptor", NULL };
 672         uint32_t instanceType;
 673         bool isNC = false;
 674         enum ndr_err_code ndr_err;
 675         struct dsdb_control_calculated_default_sd *control_sd = NULL;
 676         uint32_t sd_flags = dsdb_request_sd_flags(req, NULL);
 677         struct security_descriptor *user_descriptor = NULL;
 678
 679         /* do not manipulate our control entries */
 680         if (ldb_dn_is_special(dn)) {
 681                 return ldb_next_request(module, req);
 682         }
 683
 684         user_sd = ldb_msg_find_ldb_val(req->op.add.message, "nTSecurityDescriptor");
 685         sd_element = ldb_msg_find_element(req->op.add.message, "nTSecurityDescriptor");
 686         /* nTSecurityDescriptor without a value is an error, letting through so it is handled */
 687         if (user_sd == NULL && sd_element) {
 688                 return ldb_next_request(module, req);
 689         }
 690
 691         ldb_debug(ldb, LDB_DEBUG_TRACE,"descriptor_add: %s\n", ldb_dn_get_linearized(dn));
 692
 693         instanceType = ldb_msg_find_attr_as_uint(req->op.add.message, "instanceType", 0);
 694
 695         if (instanceType & INSTANCE_TYPE_IS_NC_HEAD) {
 696                 isNC = true;
 697         }
 698
 699         if (!isNC) {
 700                 ret = dsdb_find_nc_root(ldb, req, dn, &nc_root);
 701                 if (ret != LDB_SUCCESS) {
 702                         ldb_debug(ldb, LDB_DEBUG_TRACE,"descriptor_add: Could not find NC root for %s\n",
 703                                 ldb_dn_get_linearized(dn));
 704                         return ret;
 705                 }
 706
 707                 if (ldb_dn_compare(dn, nc_root) == 0) {
 708                         DEBUG(0, ("Found DN %s being a NC by the old method\n", ldb_dn_get_linearized(dn)));
 709                         isNC = true;
 710                 }
 711         }
 712
 713         if (isNC) {
 714                 DEBUG(2, ("DN: %s is a NC\n", ldb_dn_get_linearized(dn)));
 715         }
 716         if (!isNC) {
 717                 /* if the object has a parent, retrieve its SD to
 718                  * use for calculation. Unfortunately we do not yet have
 719                  * instanceType, so we use dsdb_find_nc_root. */
 720
 721                 parent_dn = ldb_dn_get_parent(req, dn);
 722                 if (parent_dn == NULL) {
 723                         return ldb_oom(ldb);
 724                 }
 725
 726                 /* we aren't any NC */
 727                 ret = dsdb_module_search_dn(module, req, &parent_res, parent_dn,
 728                                             parent_attrs,
 729                                             DSDB_FLAG_NEXT_MODULE |
 730                                             DSDB_FLAG_AS_SYSTEM |
 731                                             DSDB_SEARCH_SHOW_RECYCLED,
 732                                             req);
 733                 if (ret != LDB_SUCCESS) {
 734                         ldb_debug(ldb, LDB_DEBUG_TRACE,"descriptor_add: Could not find SD for %s\n",
 735                                   ldb_dn_get_linearized(parent_dn));
 736                         return ret;
 737                 }
 738                 if (parent_res->count != 1) {
 739                         return ldb_operr(ldb);
 740                 }
 741                 parent_sd = ldb_msg_find_ldb_val(parent_res->msgs[0], "nTSecurityDescriptor");
 742         }
 743
 744         schema = dsdb_get_schema(ldb, req);
 745
 746         objectclass_element = ldb_msg_find_element(req->op.add.message, "objectClass");
 747         if (objectclass_element == NULL) {
 748                 return ldb_operr(ldb);
 749         }
 750
 751         objectclass = dsdb_get_last_structural_class(schema,
 752                                                      objectclass_element);
 753         if (objectclass == NULL) {
 754                 return ldb_operr(ldb);
 755         }
 756
 757         /*
 758          * The SD_FLAG control is ignored on add
 759          * and we default to all bits set.
 760          */
 761         sd_flags = SECINFO_OWNER|SECINFO_GROUP|SECINFO_SACL|SECINFO_DACL;
 762
 763         control_sd = talloc(req, struct dsdb_control_calculated_default_sd);
 764         if (control_sd == NULL) {
 765                 return ldb_operr(ldb);
 766         }
 767         control_sd->specified_sd = false;
 768         control_sd->specified_sacl = false;
 769         if (user_sd != NULL) {
 770                 user_descriptor = talloc(req, struct security_descriptor);
 771                 if (user_descriptor == NULL) {
 772                         return ldb_operr(ldb);
 773                 }
 774                 ndr_err = ndr_pull_struct_blob(user_sd, user_descriptor,
 775                                                user_descriptor,
 776                                                (ndr_pull_flags_fn_t)ndr_pull_security_descriptor);
 777
 778                 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
 779                         talloc_free(user_descriptor);
 780                         return ldb_operr(ldb);
 781                 }
 782                 /*
 783                  * calculate the permissions needed, since in acl we no longer have
 784                  * access to the original user descriptor
 785                  */
 786                 control_sd->specified_sd = true;
 787                 control_sd->specified_sacl = user_descriptor->sacl != NULL;
 788
 789                 if (user_descriptor->owner_sid != NULL) {
 790                         /* Verify the owner of the security descriptor. */
 791
 792                         const struct auth_session_info *session_info
 793                                 = ldb_get_opaque(ldb, DSDB_SESSION_INFO);
 794
 795                         bool ok = can_write_owner(req,
 796                                                   ldb,
 797                                                   dn,
 798                                                   session_info->security_token,
 799                                                   user_descriptor->owner_sid);
 800                         talloc_free(user_descriptor);
 801                         if (!ok) {
 802                                 return dsdb_module_werror(module,
 803                                                           LDB_ERR_CONSTRAINT_VIOLATION,
 804                                                           WERR_INVALID_OWNER,
 805                                                           "invalid addition of owner SID");
 806                         }
 807                 }
 808         }
 809
 810         sd = get_new_descriptor(module, dn, req,
 811                                 objectclass, parent_sd,
 812                                 user_sd, NULL, sd_flags);
 813         if (sd == NULL) {
 814                 return ldb_operr(ldb);
 815         }
 816
 817         control_sd->default_sd = get_new_descriptor_nonlinear(module,
 818                                                               dn,
 819                                                               req,
 820                                                               objectclass,
 821                                                               parent_sd,
 822                                                               NULL,
 823                                                               NULL,
 824                                                               sd_flags);
 825         if (control_sd->default_sd == NULL) {
 826                 return ldb_operr(ldb);
 827         }
 828
 829         msg = ldb_msg_copy_shallow(req, req->op.add.message);
 830         if (msg == NULL) {
 831                 return ldb_oom(ldb);
 832         }
 833         if (sd_element != NULL) {
 834                 sd_element->values[0] = *sd;
 835         } else {
 836                 ret = ldb_msg_add_steal_value(msg,
 837                                               "nTSecurityDescriptor",
 838                                               sd);
 839                 if (ret != LDB_SUCCESS) {
 840                         return ret;
 841                 }
 842         }
 843
 844         ret = ldb_build_add_req(&add_req, ldb, req,
 845                                 msg,
 846                                 req->controls,
 847                                 req, dsdb_next_callback,
 848                                 req);
 849
 850         LDB_REQ_SET_LOCATION(add_req);
 851         if (ret != LDB_SUCCESS) {
 852                 return ldb_error(ldb, ret,
 853                                  "descriptor_add: Error creating new add request.");
 854         }
 855
 856         dom_sid_parse("S-1-0-0", control_sd->default_sd->owner_sid);
 857         ret = ldb_request_add_control(add_req,
 858                                       DSDB_CONTROL_CALCULATED_DEFAULT_SD_OID,
 859                                       false, (void *)control_sd);
 860         if (ret != LDB_SUCCESS) {
 861                 return ldb_module_operr(module);
 862         }
 863         return ldb_next_request(module, add_req);
 864 }
 865
 866 static int descriptor_modify(struct ldb_module *module, struct ldb_request *req)
 867 {
 868         struct ldb_context *ldb = ldb_module_get_ctx(module);
 869         struct ldb_request *mod_req;
 870         struct ldb_message *msg;
 871         struct ldb_result *current_res, *parent_res;
 872         const struct ldb_val *old_sd = NULL;
 873         const struct ldb_val *parent_sd = NULL;
 874         const struct ldb_val *user_sd = NULL;
 875         struct ldb_dn *dn = req->op.mod.message->dn;
 876         struct ldb_dn *parent_dn;
 877         struct ldb_message_element *objectclass_element, *sd_element;
 878         int ret;
 879         uint32_t instanceType;
 880         bool explicit_sd_flags = false;
 881         uint32_t sd_flags = dsdb_request_sd_flags(req, &explicit_sd_flags);
 882         const struct dsdb_schema *schema;
 883         DATA_BLOB *sd;
 884         const struct dsdb_class *objectclass;
 885         static const char * const parent_attrs[] = { "nTSecurityDescriptor", NULL };
 886         static const char * const current_attrs[] = { "nTSecurityDescriptor",
 887                                                       "instanceType",
 888                                                       "objectClass", NULL };
 889         struct GUID parent_guid = { .time_low = 0 };
 890         struct ldb_control *sd_propagation_control;
 891         int cmp_ret = -1;
 892
 893         /* do not manipulate our control entries */
 894         if (ldb_dn_is_special(dn)) {
 895                 return ldb_next_request(module, req);
 896         }
 897
 898         sd_propagation_control = ldb_request_get_control(req,
 899                                         DSDB_CONTROL_SEC_DESC_PROPAGATION_OID);
 900         if (sd_propagation_control != NULL) {
 901                 if (sd_propagation_control->data != module) {
 902                         return ldb_operr(ldb);
 903                 }
 904                 if (req->op.mod.message->num_elements != 0) {
 905                         return ldb_operr(ldb);
 906                 }
 907                 if (explicit_sd_flags) {
 908                         return ldb_operr(ldb);
 909                 }
 910                 if (sd_flags != 0xF) {
 911                         return ldb_operr(ldb);
 912                 }
 913                 if (sd_propagation_control->critical == 0) {
 914                         return ldb_operr(ldb);
 915                 }
 916
 917                 sd_propagation_control->critical = 0;
 918         }
 919
 920         sd_element = ldb_msg_find_element(req->op.mod.message, "nTSecurityDescriptor");
 921         if (sd_propagation_control == NULL && sd_element == NULL) {
 922                 return ldb_next_request(module, req);
 923         }
 924
 925         /*
 926          * nTSecurityDescriptor with DELETE is not supported yet.
 927          * TODO: handle this correctly.
 928          */
 929         if (sd_propagation_control == NULL &&
 930             LDB_FLAG_MOD_TYPE(sd_element->flags) == LDB_FLAG_MOD_DELETE)
 931         {
 932                 return ldb_module_error(module,
 933                                         LDB_ERR_UNWILLING_TO_PERFORM,
 934                                         "MOD_DELETE for nTSecurityDescriptor "
 935                                         "not supported yet");
 936         }
 937
 938         user_sd = ldb_msg_find_ldb_val(req->op.mod.message, "nTSecurityDescriptor");
 939         /* nTSecurityDescriptor without a value is an error, letting through so it is handled */
 940         if (sd_propagation_control == NULL && user_sd == NULL) {
 941                 return ldb_next_request(module, req);
 942         }
 943
 944         if (sd_flags & SECINFO_OWNER && user_sd != NULL) {
 945                 /* Verify the new owner of the security descriptor. */
 946
 947                 struct security_descriptor *user_descriptor = NULL;
 948                 enum ndr_err_code ndr_err;
 949                 const struct auth_session_info *session_info;
 950                 bool ok;
 951
 952                 user_descriptor = talloc(req, struct security_descriptor);
 953
 954                 if (user_descriptor == NULL) {
 955                         return ldb_operr(ldb);
 956                 }
 957                 ndr_err = ndr_pull_struct_blob(user_sd, user_descriptor,
 958                                                user_descriptor,
 959                                                (ndr_pull_flags_fn_t)ndr_pull_security_descriptor);
 960
 961                 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
 962                         talloc_free(user_descriptor);
 963                         return ldb_operr(ldb);
 964                 }
 965
 966                 session_info = ldb_get_opaque(ldb, DSDB_SESSION_INFO);
 967
 968                 ok = can_write_owner(req,
 969                                      ldb,
 970                                      dn,
 971                                      session_info->security_token,
 972                                      user_descriptor->owner_sid);
 973                 talloc_free(user_descriptor);
 974                 if (!ok) {
 975                         return dsdb_module_werror(module,
 976                                                   LDB_ERR_CONSTRAINT_VIOLATION,
 977                                                   WERR_INVALID_OWNER,
 978                                                   "invalid modification of owner SID");
 979                 }
 980         }
 981
 982         ldb_debug(ldb, LDB_DEBUG_TRACE,"descriptor_modify: %s\n", ldb_dn_get_linearized(dn));
 983
 984         ret = dsdb_module_search_dn(module, req, &current_res, dn,
 985                                     current_attrs,
 986                                     DSDB_FLAG_NEXT_MODULE |
 987                                     DSDB_FLAG_AS_SYSTEM |
 988                                     DSDB_SEARCH_SHOW_RECYCLED |
 989                                     DSDB_SEARCH_SHOW_EXTENDED_DN,
 990                                     req);
 991         if (ret != LDB_SUCCESS) {
 992                 ldb_debug(ldb, LDB_DEBUG_ERROR,"descriptor_modify: Could not find %s\n",
 993                           ldb_dn_get_linearized(dn));
 994                 return ret;
 995         }
 996
 997         instanceType = ldb_msg_find_attr_as_uint(current_res->msgs[0],
 998                                                  "instanceType", 0);
 999         /* if the object has a parent, retrieve its SD to
1000          * use for calculation */
1001         if (!ldb_dn_is_null(current_res->msgs[0]->dn) &&
1002             !(instanceType & INSTANCE_TYPE_IS_NC_HEAD)) {
1003                 NTSTATUS status;
1004
1005                 parent_dn = ldb_dn_get_parent(req, dn);
1006                 if (parent_dn == NULL) {
1007                         return ldb_oom(ldb);
1008                 }
1009                 ret = dsdb_module_search_dn(module, req, &parent_res, parent_dn,
1010                                             parent_attrs,
1011                                             DSDB_FLAG_NEXT_MODULE |
1012                                             DSDB_FLAG_AS_SYSTEM |
1013                                             DSDB_SEARCH_SHOW_RECYCLED |
1014                                             DSDB_SEARCH_SHOW_EXTENDED_DN,
1015                                             req);
1016                 if (ret != LDB_SUCCESS) {
1017                         ldb_debug(ldb, LDB_DEBUG_ERROR, "descriptor_modify: Could not find SD for %s\n",
1018                                   ldb_dn_get_linearized(parent_dn));
1019                         return ret;
1020                 }
1021                 if (parent_res->count != 1) {
1022                         return ldb_operr(ldb);
1023                 }
1024                 parent_sd = ldb_msg_find_ldb_val(parent_res->msgs[0], "nTSecurityDescriptor");
1025
1026                 status = dsdb_get_extended_dn_guid(parent_res->msgs[0]->dn,
1027                                                    &parent_guid,
1028                                                    "GUID");
1029                 if (!NT_STATUS_IS_OK(status)) {
1030                         return ldb_operr(ldb);
1031                 }
1032         }
1033
1034         schema = dsdb_get_schema(ldb, req);
1035
1036         objectclass_element = ldb_msg_find_element(current_res->msgs[0], "objectClass");
1037         if (objectclass_element == NULL) {
1038                 return ldb_operr(ldb);
1039         }
1040
1041         objectclass = dsdb_get_last_structural_class(schema,
1042                                                      objectclass_element);
1043         if (objectclass == NULL) {
1044                 return ldb_operr(ldb);
1045         }
1046
1047         old_sd = ldb_msg_find_ldb_val(current_res->msgs[0], "nTSecurityDescriptor");
1048         if (old_sd == NULL) {
1049                 return ldb_operr(ldb);
1050         }
1051
1052         if (sd_propagation_control != NULL) {
1053                 /*
1054                  * This just triggers a recalculation of the
1055                  * inherited aces.
1056                  */
1057                 user_sd = old_sd;
1058         }
1059
1060         sd = get_new_descriptor(module, current_res->msgs[0]->dn, req,
1061                                 objectclass, parent_sd,
1062                                 user_sd, old_sd, sd_flags);
1063         if (sd == NULL) {
1064                 return ldb_operr(ldb);
1065         }
1066         msg = ldb_msg_copy_shallow(req, req->op.mod.message);
1067         if (msg == NULL) {
1068                 return ldb_oom(ldb);
1069         }
1070         cmp_ret = data_blob_cmp(old_sd, sd);
1071         if (sd_propagation_control != NULL) {
1072                 if (cmp_ret == 0) {
1073                         /*
1074                          * The nTSecurityDescriptor is unchanged,
1075                          * which means we can stop the processing.
1076                          *
1077                          * We mark the control as critical again,
1078                          * as we have not processed it, so the caller
1079                          * can tell that the descriptor was unchanged.
1080                          */
1081                         sd_propagation_control->critical = 1;
1082                         return ldb_module_done(req, NULL, NULL, LDB_SUCCESS);
1083                 }
1084
1085                 ret = ldb_msg_append_value(msg, "nTSecurityDescriptor",
1086                                            sd, LDB_FLAG_MOD_REPLACE);
1087                 if (ret != LDB_SUCCESS) {
1088                         return ldb_oom(ldb);
1089                 }
1090         } else if (cmp_ret != 0) {
1091                 struct GUID guid;
1092                 struct ldb_dn *nc_root;
1093                 NTSTATUS status;
1094
1095                 ret = dsdb_find_nc_root(ldb,
1096                                         msg,
1097                                         current_res->msgs[0]->dn,
1098                                         &nc_root);
1099                 if (ret != LDB_SUCCESS) {
1100                         return ldb_oom(ldb);
1101                 }
1102
1103                 status = dsdb_get_extended_dn_guid(current_res->msgs[0]->dn,
1104                                                    &guid,
1105                                                    "GUID");
1106                 if (!NT_STATUS_IS_OK(status)) {
1107                         return ldb_operr(ldb);
1108                 }
1109
1110                 /*
1111                  * Force SD propagation on children of this record
1112                  */
1113                 ret = dsdb_module_schedule_sd_propagation(module,
1114                                                           nc_root,
1115                                                           guid,
1116                                                           parent_guid,
1117                                                           false);
1118                 if (ret != LDB_SUCCESS) {
1119                         return ldb_operr(ldb);
1120                 }
1121                 sd_element->values[0] = *sd;
1122         } else {
1123                 sd_element->values[0] = *sd;
1124         }
1125
1126         ret = ldb_build_mod_req(&mod_req, ldb, req,
1127                                 msg,
1128                                 req->controls,
1129                                 req,
1130                                 dsdb_next_callback,
1131                                 req);
1132         LDB_REQ_SET_LOCATION(mod_req);
1133         if (ret != LDB_SUCCESS) {
1134                 return ret;
1135         }
1136
1137         return ldb_next_request(module, mod_req);
1138 }
1139
1140 static int descriptor_search(struct ldb_module *module, struct ldb_request *req)
1141 {
1142         int ret;
1143         struct ldb_context *ldb;
1144         struct ldb_request *down_req;
1145         struct descriptor_context *ac;
1146         bool explicit_sd_flags = false;
1147         uint32_t sd_flags = dsdb_request_sd_flags(req, &explicit_sd_flags);
1148         bool show_sd = explicit_sd_flags;
1149
1150         if (!show_sd &&
1151             ldb_attr_in_list(req->op.search.attrs, "nTSecurityDescriptor"))
1152         {
1153                 show_sd = true;
1154         }
1155
1156         if (!show_sd) {
1157                 return ldb_next_request(module, req);
1158         }
1159
1160         ldb = ldb_module_get_ctx(module);
1161         ac = descriptor_init_context(module, req);
1162         if (ac == NULL) {
1163                 return ldb_operr(ldb);
1164         }
1165         ac->sd_flags = sd_flags;
1166
1167         ret = ldb_build_search_req_ex(&down_req, ldb, ac,
1168                                       req->op.search.base,
1169                                       req->op.search.scope,
1170                                       req->op.search.tree,
1171                                       req->op.search.attrs,
1172                                       req->controls,
1173                                       ac, descriptor_search_callback,
1174                                       ac->req);
1175         LDB_REQ_SET_LOCATION(down_req);
1176         if (ret != LDB_SUCCESS) {
1177                 return ret;
1178         }
1179
1180         return ldb_next_request(ac->module, down_req);
1181 }
1182
1183 static int descriptor_rename(struct ldb_module *module, struct ldb_request *req)
1184 {
1185         struct ldb_context *ldb = ldb_module_get_ctx(module);
1186         struct ldb_dn *olddn = req->op.rename.olddn;
1187         struct ldb_dn *newdn = req->op.rename.newdn;
1188         int ret;
1189
1190         /* do not manipulate our control entries */
1191         if (ldb_dn_is_special(req->op.rename.olddn)) {
1192                 return ldb_next_request(module, req);
1193         }
1194
1195         ldb_debug(ldb, LDB_DEBUG_TRACE,"descriptor_rename: %s\n",
1196                   ldb_dn_get_linearized(olddn));
1197
1198         if (ldb_dn_compare(olddn, newdn) != 0) {
1199                 struct ldb_dn *nc_root;
1200                 struct GUID guid;
1201
1202                 ret = dsdb_find_nc_root(ldb, req, newdn, &nc_root);
1203                 if (ret != LDB_SUCCESS) {
1204                         return ldb_oom(ldb);
1205                 }
1206
1207                 ret = dsdb_module_guid_by_dn(module,
1208                                              olddn,
1209                                              &guid,
1210                                              req);
1211                 if (ret == LDB_SUCCESS) {
1212                         /*
1213                          * Without disturbing any errors if the olddn
1214                          * does not exit, force SD propagation on
1215                          * this record (get a new inherited SD from
1216                          * the potentially new parent
1217                          *
1218                          * We don't now the parent guid here,
1219                          * but we're not in a hot code path here,
1220                          * as the "descriptor" module is located
1221                          * above the "repl_meta_data", only
1222                          * originating changes are handled here.
1223                          *
1224                          * If it turns out to be a problem we may
1225                          * search for the new parent guid.
1226                          */
1227                         struct GUID parent_guid = { .time_low = 0 };
1228
1229                         ret = dsdb_module_schedule_sd_propagation(module,
1230                                                                   nc_root,
1231                                                                   guid,
1232                                                                   parent_guid,
1233                                                                   true);
1234                         if (ret != LDB_SUCCESS) {
1235                                 return ldb_operr(ldb);
1236                         }
1237                 }
1238         }
1239
1240         return ldb_next_request(module, req);
1241 }
1242
1243 static void descriptor_changes_parser(TDB_DATA key, TDB_DATA data, void *private_data)
1244 {
1245         struct descriptor_changes **c_ptr = (struct descriptor_changes **)private_data;
1246         uintptr_t ptr = 0;
1247
1248         SMB_ASSERT(data.dsize == sizeof(ptr));
1249
1250         memcpy(&ptr, data.dptr, data.dsize);
1251
1252         *c_ptr = talloc_get_type_abort((void *)ptr, struct descriptor_changes);
1253 }
1254
1255 static void descriptor_object_parser(TDB_DATA key, TDB_DATA data, void *private_data)
1256 {
1257         SMB_ASSERT(data.dsize == 0);
1258 }
1259
1260 static int descriptor_extended_sec_desc_propagation(struct ldb_module *module,
1261                                                     struct ldb_request *req)
1262 {
1263         struct descriptor_data *descriptor_private =
1264                 talloc_get_type_abort(ldb_module_get_private(module),
1265                 struct descriptor_data);
1266         struct descriptor_transaction *t = &descriptor_private->transaction;
1267         struct ldb_context *ldb = ldb_module_get_ctx(module);
1268         struct dsdb_extended_sec_desc_propagation_op *op;
1269         struct descriptor_changes *c = NULL;
1270         TDB_DATA key;
1271         NTSTATUS status;
1272
1273         op = talloc_get_type(req->op.extended.data,
1274                              struct dsdb_extended_sec_desc_propagation_op);
1275         if (op == NULL) {
1276                 ldb_debug(ldb, LDB_DEBUG_FATAL,
1277                           "descriptor_extended_sec_desc_propagation: "
1278                           "invalid extended data\n");
1279                 return LDB_ERR_PROTOCOL_ERROR;
1280         }
1281
1282         if (t->mem == NULL) {
1283                 return ldb_module_operr(module);
1284         }
1285
1286         if (GUID_equal(&op->parent_guid, &op->guid)) {
1287                 /*
1288                  * This is an unexpected situation,
1289                  * it should never happen!
1290                  */
1291                 DBG_ERR("ERROR: Object %s is its own parent (nc_root=%s)\n",
1292                         GUID_string(t->mem, &op->guid),
1293                         ldb_dn_get_extended_linearized(t->mem, op->nc_root, 1));
1294                 return ldb_module_operr(module);
1295         }
1296
1297         /*
1298          * First we check if we already have an registration
1299          * for the given object.
1300          */
1301
1302         key = make_tdb_data((const void*)&op->guid, sizeof(op->guid));
1303         status = dbwrap_parse_record(t->changes.map, key,
1304                                      descriptor_changes_parser, &c);
1305         if (NT_STATUS_EQUAL(status, NT_STATUS_NOT_FOUND)) {
1306                 c = NULL;
1307                 status = NT_STATUS_OK;
1308         }
1309         if (!NT_STATUS_IS_OK(status)) {
1310                 ldb_debug(ldb, LDB_DEBUG_FATAL,
1311                           "dbwrap_parse_record() - %s\n",
1312                           nt_errstr(status));
1313                 return ldb_module_operr(module);
1314         }
1315
1316         if (c == NULL) {
1317                 /*
1318                  * Create a new structure if we
1319                  * don't know about the object yet.
1320                  */
1321
1322                 c = talloc_zero(t->mem, struct descriptor_changes);
1323                 if (c == NULL) {
1324                         return ldb_module_oom(module);
1325                 }
1326                 c->nc_root = ldb_dn_copy(c, op->nc_root);
1327                 if (c->nc_root == NULL) {
1328                         return ldb_module_oom(module);
1329                 }
1330                 c->guid = op->guid;
1331         }
1332
1333         if (ldb_dn_compare(c->nc_root, op->nc_root) != 0) {
1334                 /*
1335                  * This is an unexpected situation,
1336                  * we don't expect the nc root to change
1337                  * during a replication cycle.
1338                  */
1339                 DBG_ERR("ERROR: Object %s nc_root changed %s => %s\n",
1340                         GUID_string(c, &c->guid),
1341                         ldb_dn_get_extended_linearized(c, c->nc_root, 1),
1342                         ldb_dn_get_extended_linearized(c, op->nc_root, 1));
1343                 return ldb_module_operr(module);
1344         }
1345
1346         c->ref_count += 1;
1347
1348         /*
1349          * always use the last known parent_guid.
1350          */
1351         c->parent_guid = op->parent_guid;
1352
1353         /*
1354          * Note that we only set, but don't clear values here,
1355          * it means c->force_self and c->force_children can
1356          * both be true in the end.
1357          */
1358         if (op->include_self) {
1359                 c->force_self = true;
1360         } else {
1361                 c->force_children = true;
1362         }
1363
1364         if (c->ref_count == 1) {
1365                 struct TDB_DATA val = make_tdb_data((const void*)&c, sizeof(c));
1366
1367                 /*
1368                  * Remember the change by objectGUID in order
1369                  * to avoid processing it more than once.
1370                  */
1371
1372                 status = dbwrap_store(t->changes.map, key, val, TDB_INSERT);
1373                 if (!NT_STATUS_IS_OK(status)) {
1374                         ldb_debug(ldb, LDB_DEBUG_FATAL,
1375                                   "dbwrap_parse_record() - %s\n",
1376                                   nt_errstr(status));
1377                         return ldb_module_operr(module);
1378                 }
1379
1380                 DLIST_ADD_END(t->changes.list, c);
1381                 t->changes.num_registered += 1;
1382         }
1383         t->changes.num_registrations += 1;
1384
1385         return ldb_module_done(req, NULL, NULL, LDB_SUCCESS);
1386 }
1387
1388 static int descriptor_extended(struct ldb_module *module, struct ldb_request *req)
1389 {
1390         if (strcmp(req->op.extended.oid, DSDB_EXTENDED_SEC_DESC_PROPAGATION_OID) == 0) {
1391                 return descriptor_extended_sec_desc_propagation(module, req);
1392         }
1393
1394         return ldb_next_request(module, req);
1395 }
1396
1397 static int descriptor_init(struct ldb_module *module)
1398 {
1399         struct ldb_context *ldb = ldb_module_get_ctx(module);
1400         int ret;
1401         struct descriptor_data *descriptor_private;
1402
1403         ret = ldb_mod_register_control(module, LDB_CONTROL_SD_FLAGS_OID);
1404         if (ret != LDB_SUCCESS) {
1405                 ldb_debug(ldb, LDB_DEBUG_ERROR,
1406                         "descriptor: Unable to register control with rootdse!\n");
1407                 return ldb_operr(ldb);
1408         }
1409
1410         descriptor_private = talloc_zero(module, struct descriptor_data);
1411         if (descriptor_private == NULL) {
1412                 ldb_oom(ldb);
1413                 return LDB_ERR_OPERATIONS_ERROR;
1414         }
1415         ldb_module_set_private(module, descriptor_private);
1416
1417         return ldb_next_init(module);
1418 }
1419
1420 static int descriptor_sd_propagation_object(struct ldb_module *module,
1421                                             struct ldb_message *msg,
1422                                             bool *stop)
1423 {
1424         struct descriptor_data *descriptor_private =
1425                 talloc_get_type_abort(ldb_module_get_private(module),
1426                 struct descriptor_data);
1427         struct descriptor_transaction *t = &descriptor_private->transaction;
1428         struct ldb_context *ldb = ldb_module_get_ctx(module);
1429         struct ldb_request *sub_req;
1430         struct ldb_result *mod_res;
1431         struct ldb_control *sd_propagation_control;
1432         struct GUID guid;
1433         int ret;
1434         TDB_DATA key;
1435         TDB_DATA empty_val = { .dsize = 0, };
1436         NTSTATUS status;
1437         struct descriptor_changes *c = NULL;
1438
1439         *stop = false;
1440
1441         /*
1442          * We get the GUID of the object
1443          * in order to have the cache key
1444          * for the object.
1445          */
1446
1447         status = dsdb_get_extended_dn_guid(msg->dn, &guid, "GUID");
1448         if (!NT_STATUS_IS_OK(status)) {
1449                 return ldb_operr(ldb);
1450         }
1451         key = make_tdb_data((const void*)&guid, sizeof(guid));
1452
1453         /*
1454          * Check if we already processed this object.
1455          */
1456         status = dbwrap_parse_record(t->objects.map, key,
1457                                      descriptor_object_parser, NULL);
1458         if (NT_STATUS_IS_OK(status)) {
1459                 /*
1460                  * All work is already one
1461                  */
1462                 t->objects.num_skipped += 1;
1463                 *stop = true;
1464                 return LDB_SUCCESS;
1465         }
1466         if (!NT_STATUS_EQUAL(status, NT_STATUS_NOT_FOUND)) {
1467                 ldb_debug(ldb, LDB_DEBUG_FATAL,
1468                           "dbwrap_parse_record() - %s\n",
1469                           nt_errstr(status));
1470                 return ldb_module_operr(module);
1471         }
1472
1473         t->objects.num_processed += 1;
1474
1475         /*
1476          * Remember that we're processing this object.
1477          */
1478         status = dbwrap_store(t->objects.map, key, empty_val, TDB_INSERT);
1479         if (!NT_STATUS_IS_OK(status)) {
1480                 ldb_debug(ldb, LDB_DEBUG_FATAL,
1481                           "dbwrap_parse_record() - %s\n",
1482                           nt_errstr(status));
1483                 return ldb_module_operr(module);
1484         }
1485
1486         /*
1487          * Check that if there's a descriptor_change in our list,
1488          * which we may be able to remove from the pending list
1489          * when we processed the object.
1490          */
1491
1492         status = dbwrap_parse_record(t->changes.map, key, descriptor_changes_parser, &c);
1493         if (NT_STATUS_EQUAL(status, NT_STATUS_NOT_FOUND)) {
1494                 c = NULL;
1495                 status = NT_STATUS_OK;
1496         }
1497         if (!NT_STATUS_IS_OK(status)) {
1498                 ldb_debug(ldb, LDB_DEBUG_FATAL,
1499                           "dbwrap_parse_record() - %s\n",
1500                           nt_errstr(status));
1501                 return ldb_module_operr(module);
1502         }
1503
1504         mod_res = talloc_zero(msg, struct ldb_result);
1505         if (mod_res == NULL) {
1506                 return ldb_module_oom(module);
1507         }
1508
1509         ret = ldb_build_mod_req(&sub_req, ldb, mod_res,
1510                                 msg,
1511                                 NULL,
1512                                 mod_res,
1513                                 ldb_modify_default_callback,
1514                                 NULL);
1515         LDB_REQ_SET_LOCATION(sub_req);
1516         if (ret != LDB_SUCCESS) {
1517                 return ldb_module_operr(module);
1518         }
1519
1520         ldb_req_mark_trusted(sub_req);
1521
1522         ret = ldb_request_add_control(sub_req,
1523                                       DSDB_CONTROL_SEC_DESC_PROPAGATION_OID,
1524                                       true, module);
1525         if (ret != LDB_SUCCESS) {
1526                 return ldb_module_operr(module);
1527         }
1528
1529         sd_propagation_control = ldb_request_get_control(sub_req,
1530                                         DSDB_CONTROL_SEC_DESC_PROPAGATION_OID);
1531         if (sd_propagation_control == NULL) {
1532                 return ldb_module_operr(module);
1533         }
1534
1535         ret = dsdb_request_add_controls(sub_req,
1536                                         DSDB_FLAG_AS_SYSTEM |
1537                                         DSDB_SEARCH_SHOW_RECYCLED);
1538         if (ret != LDB_SUCCESS) {
1539                 return ldb_module_operr(module);
1540         }
1541
1542         ret = descriptor_modify(module, sub_req);
1543         if (ret == LDB_SUCCESS) {
1544                 ret = ldb_wait(sub_req->handle, LDB_WAIT_ALL);
1545         }
1546         if (ret != LDB_SUCCESS) {
1547                 ldb_asprintf_errstring(ldb_module_get_ctx(module),
1548                                        "descriptor_modify on %s failed: %s",
1549                                        ldb_dn_get_linearized(msg->dn),
1550                                        ldb_errstring(ldb_module_get_ctx(module)));
1551                 return LDB_ERR_OPERATIONS_ERROR;
1552         }
1553
1554         if (sd_propagation_control->critical != 0) {
1555                 if (c == NULL) {
1556                         /*
1557                          * If we don't have a
1558                          * descriptor_changes structure
1559                          * we're done.
1560                          */
1561                         *stop = true;
1562                 } else if (!c->force_children) {
1563                         /*
1564                          * If we don't need to
1565                          * propagate to children,
1566                          * we're done.
1567                          */
1568                         *stop = true;
1569                 }
1570         }
1571
1572         if (c != NULL && !c->force_children) {
1573                 /*
1574                  * Remove the pending change,
1575                  * we already done all required work,
1576                  * there's no need to do it again.
1577                  *
1578                  * Note DLIST_REMOVE() is a noop
1579                  * if the element is not part of
1580                  * the list.
1581                  */
1582                 DLIST_REMOVE(t->changes.list, c);
1583         }
1584
1585         talloc_free(mod_res);
1586
1587         return LDB_SUCCESS;
1588 }
1589
1590 static int descriptor_sd_propagation_msg_sort(struct ldb_message **m1,
1591                                               struct ldb_message **m2)
1592 {
1593         struct ldb_dn *dn1 = (*m1)->dn;
1594         struct ldb_dn *dn2 = (*m2)->dn;
1595
1596         /*
1597          * This sorts in tree order, parents first
1598          */
1599         return ldb_dn_compare(dn2, dn1);
1600 }
1601
1602 static int descriptor_sd_propagation_recursive(struct ldb_module *module,
1603                                                struct descriptor_changes *change)
1604 {
1605         struct descriptor_data *descriptor_private =
1606                 talloc_get_type_abort(ldb_module_get_private(module),
1607                 struct descriptor_data);
1608         struct descriptor_transaction *t = &descriptor_private->transaction;
1609         struct ldb_result *guid_res = NULL;
1610         struct ldb_result *res = NULL;
1611         unsigned int i;
1612         const char * const no_attrs[] = { "@__NONE__", NULL };
1613         struct ldb_dn *stopped_dn = NULL;
1614         struct GUID_txt_buf guid_buf;
1615         int ret;
1616         bool stop = false;
1617
1618         t->changes.num_processed += 1;
1619
1620         /*
1621          * First confirm this object has children, or exists
1622          * (depending on change->force_self)
1623          *
1624          * LDB_SCOPE_SUBTREE searches are expensive.
1625          *
1626          * We know this is safe against a rename race as we are in the
1627          * prepare_commit(), so must be in a transaction.
1628          */
1629
1630         /* Find the DN by GUID, as this is stable under rename */
1631         ret = dsdb_module_search(module,
1632                                  change,
1633                                  &guid_res,
1634                                  change->nc_root,
1635                                  LDB_SCOPE_SUBTREE,
1636                                  no_attrs,
1637                                  DSDB_FLAG_NEXT_MODULE |
1638                                  DSDB_FLAG_AS_SYSTEM |
1639                                  DSDB_SEARCH_SHOW_DELETED |
1640                                  DSDB_SEARCH_SHOW_RECYCLED |
1641                                  DSDB_SEARCH_SHOW_EXTENDED_DN,
1642                                  NULL, /* parent_req */
1643                                  "(objectGUID=%s)",
1644                                  GUID_buf_string(&change->guid,
1645                                                  &guid_buf));
1646
1647         if (ret != LDB_SUCCESS) {
1648                 return ret;
1649         }
1650
1651         if (guid_res->count != 1) {
1652                 /*
1653                  * We were just given this GUID during the same
1654                  * transaction, if it is missing this is a big
1655                  * problem.
1656                  *
1657                  * Cleanup of tombstones does not trigger this module
1658                  * as it just does a delete.
1659                  */
1660                 ldb_asprintf_errstring(ldb_module_get_ctx(module),
1661                                        "failed to find GUID %s under %s "
1662                                        "for transaction-end SD inheritance: %d results",
1663                                        GUID_buf_string(&change->guid,
1664                                                        &guid_buf),
1665                                        ldb_dn_get_linearized(change->nc_root),
1666                                        guid_res->count);
1667                 return LDB_ERR_OPERATIONS_ERROR;
1668         }
1669
1670         /*
1671          * OK, so there was a parent, are there children?  Note: that
1672          * this time we do not search for deleted/recycled objects
1673          */
1674         ret = dsdb_module_search(module,
1675                                  change,
1676                                  &res,
1677                                  guid_res->msgs[0]->dn,
1678                                  LDB_SCOPE_ONELEVEL,
1679                                  no_attrs,
1680                                  DSDB_FLAG_NEXT_MODULE |
1681                                  DSDB_FLAG_AS_SYSTEM,
1682                                  NULL, /* parent_req */
1683                                  "(objectClass=*)");
1684         if (ret != LDB_SUCCESS) {
1685                 /*
1686                  * LDB_ERR_NO_SUCH_OBJECT, say if the DN was a deleted
1687                  * object, is ignored by the caller
1688                  */
1689                 return ret;
1690         }
1691
1692         if (res->count == 0 && !change->force_self) {
1693                 /* All done, no children */
1694                 TALLOC_FREE(res);
1695                 return LDB_SUCCESS;
1696         }
1697
1698         /*
1699          * First, if we are in force_self mode (eg renamed under new
1700          * parent) then apply the SD to the top object
1701          */
1702         if (change->force_self) {
1703                 ret = descriptor_sd_propagation_object(module,
1704                                                        guid_res->msgs[0],
1705                                                        &stop);
1706                 if (ret != LDB_SUCCESS) {
1707                         TALLOC_FREE(guid_res);
1708                         return ret;
1709                 }
1710
1711                 if (stop == true && !change->force_children) {
1712                         /* There was no change, nothing more to do */
1713                         TALLOC_FREE(guid_res);
1714                         return LDB_SUCCESS;
1715                 }
1716
1717                 if (res->count == 0) {
1718                         /* All done! */
1719                         TALLOC_FREE(guid_res);
1720                         return LDB_SUCCESS;
1721                 }
1722         }
1723
1724         /*
1725          * Look for children
1726          *
1727          * Note: that we do not search for deleted/recycled objects
1728          */
1729         ret = dsdb_module_search(module,
1730                                  change,
1731                                  &res,
1732                                  guid_res->msgs[0]->dn,
1733                                  LDB_SCOPE_SUBTREE,
1734                                  no_attrs,
1735                                  DSDB_FLAG_NEXT_MODULE |
1736                                  DSDB_FLAG_AS_SYSTEM |
1737                                  DSDB_SEARCH_SHOW_EXTENDED_DN,
1738                                  NULL, /* parent_req */
1739                                  "(objectClass=*)");
1740         if (ret != LDB_SUCCESS) {
1741                 return ret;
1742         }
1743
1744         TYPESAFE_QSORT(res->msgs, res->count,
1745                        descriptor_sd_propagation_msg_sort);
1746
1747         /* We start from 1, the top object has been done */
1748         for (i = 1; i < res->count; i++) {
1749                 /*
1750                  * ldb_dn_compare_base() does not match for NULL but
1751                  * this is clearer
1752                  */
1753                 if (stopped_dn != NULL) {
1754                         ret = ldb_dn_compare_base(stopped_dn,
1755                                                   res->msgs[i]->dn);
1756                         /*
1757                          * Skip further processing of this
1758                          * sub-subtree
1759                          */
1760                         if (ret == 0) {
1761                                 continue;
1762                         }
1763                 }
1764                 ret = descriptor_sd_propagation_object(module,
1765                                                        res->msgs[i],
1766                                                        &stop);
1767                 if (ret != LDB_SUCCESS) {
1768                         return ret;
1769                 }
1770
1771                 if (stop) {
1772                         /*
1773                          * If this child didn't change, then nothing
1774                          * under it needs to change
1775                          *
1776                          * res has been sorted into tree order so the
1777                          * next few entries can be skipped
1778                          */
1779                         stopped_dn = res->msgs[i]->dn;
1780                 }
1781         }
1782
1783         TALLOC_FREE(res);
1784         return LDB_SUCCESS;
1785 }
1786
1787 static int descriptor_start_transaction(struct ldb_module *module)
1788 {
1789         struct descriptor_data *descriptor_private =
1790                 talloc_get_type_abort(ldb_module_get_private(module),
1791                 struct descriptor_data);
1792         struct descriptor_transaction *t = &descriptor_private->transaction;
1793
1794         if (t->mem != NULL) {
1795                 return ldb_module_operr(module);
1796         }
1797
1798         *t = (struct descriptor_transaction) { .mem = NULL, };
1799         t->mem = talloc_new(descriptor_private);
1800         if (t->mem == NULL) {
1801                 return ldb_module_oom(module);
1802         }
1803         t->changes.map = db_open_rbt(t->mem);
1804         if (t->changes.map == NULL) {
1805                 TALLOC_FREE(t->mem);
1806                 *t = (struct descriptor_transaction) { .mem = NULL, };
1807                 return ldb_module_oom(module);
1808         }
1809         t->objects.map = db_open_rbt(t->mem);
1810         if (t->objects.map == NULL) {
1811                 TALLOC_FREE(t->mem);
1812                 *t = (struct descriptor_transaction) { .mem = NULL, };
1813                 return ldb_module_oom(module);
1814         }
1815
1816         return ldb_next_start_trans(module);
1817 }
1818
1819 static int descriptor_prepare_commit(struct ldb_module *module)
1820 {
1821         struct descriptor_data *descriptor_private =
1822                 talloc_get_type_abort(ldb_module_get_private(module),
1823                 struct descriptor_data);
1824         struct descriptor_transaction *t = &descriptor_private->transaction;
1825         struct ldb_context *ldb = ldb_module_get_ctx(module);
1826         struct descriptor_changes *c, *n;
1827         int ret;
1828
1829         DBG_NOTICE("changes: num_registrations=%zu\n",
1830                    t->changes.num_registrations);
1831         DBG_NOTICE("changes: num_registered=%zu\n",
1832                    t->changes.num_registered);
1833
1834         /*
1835          * The security descriptor propagation
1836          * needs to apply the inheritance from
1837          * an object to itself and/or all it's
1838          * children.
1839          *
1840          * In the initial replication during
1841          * a join, we have every object in our
1842          * list.
1843          *
1844          * In order to avoid useless work it's
1845          * better to start with toplevel objects and
1846          * move down to the leaf object from there.
1847          *
1848          * So if the parent_guid is also in our list,
1849          * we better move the object behind its parent.
1850          *
1851          * It allows that the recursive processing of
1852          * the parent already does the work needed
1853          * for the child.
1854          *
1855          * If we have a list for this directory tree:
1856          *
1857          *  A
1858          *    -> B
1859          *        -> C
1860          *            -> D
1861          *                -> E
1862          *
1863          * The initial list would have the order D, E, B, A, C
1864          *
1865          * By still processing from the front, we ensure that,
1866          * when D is found to be below C, that E follows because
1867          * we keep peeling items off the front for checking and
1868          * move them behind their parent.
1869          *
1870          * So we would go:
1871          *
1872          * E B A C D
1873          *
1874          * B A C D E
1875          *
1876          * A B C D E
1877          */
1878         for (c = t->changes.list; c; c = n) {
1879                 struct descriptor_changes *pc = NULL;
1880                 n = c->next;
1881
1882                 if (c->sort_count >= t->changes.num_registered) {
1883                         /*
1884                          * This should never happen, but it's
1885                          * a sanity check in order to avoid
1886                          * endless loops. Just stop sorting.
1887                          */
1888                         break;
1889                 }
1890
1891                 /*
1892                  * Check if we have the parent also in the list.
1893                  */
1894                 if (!GUID_all_zero((const void*)&c->parent_guid)) {
1895                         TDB_DATA pkey;
1896                         NTSTATUS status;
1897
1898                         pkey = make_tdb_data((const void*)&c->parent_guid,
1899                                              sizeof(c->parent_guid));
1900
1901                         status = dbwrap_parse_record(t->changes.map, pkey,
1902                                                      descriptor_changes_parser, &pc);
1903                         if (NT_STATUS_EQUAL(status, NT_STATUS_NOT_FOUND)) {
1904                                 pc = NULL;
1905                                 status = NT_STATUS_OK;
1906                         }
1907                         if (!NT_STATUS_IS_OK(status)) {
1908                                 ldb_debug(ldb, LDB_DEBUG_FATAL,
1909                                           "dbwrap_parse_record() - %s\n",
1910                                           nt_errstr(status));
1911                                 return ldb_module_operr(module);
1912                         }
1913                 }
1914
1915                 if (pc == NULL) {
1916                         /*
1917                          * There is no parent in the list
1918                          */
1919                         t->changes.num_toplevel += 1;
1920                         continue;
1921                 }
1922
1923                 /*
1924                  * Move the child after the parent
1925                  *
1926                  * Note that we do that multiple times
1927                  * in case the parent already moved itself.
1928                  *
1929                  * See the comment above the loop.
1930                  */
1931                 DLIST_REMOVE(t->changes.list, c);
1932                 DLIST_ADD_AFTER(t->changes.list, c, pc);
1933
1934                 /*
1935                  * Remember how often we moved the object
1936                  * in order to avoid endless loops.
1937                  */
1938                 c->sort_count += 1;
1939         }
1940
1941         DBG_NOTICE("changes: num_toplevel=%zu\n", t->changes.num_toplevel);
1942
1943         while (t->changes.list != NULL) {
1944                 c = t->changes.list;
1945
1946                 DLIST_REMOVE(t->changes.list, c);
1947
1948                 /*
1949                  * Note that descriptor_sd_propagation_recursive()
1950                  * may also remove other elements of the list,
1951                  * so we can't use a next pointer
1952                  */
1953                 ret = descriptor_sd_propagation_recursive(module, c);
1954                 if (ret == LDB_ERR_NO_SUCH_OBJECT) {
1955                         continue;
1956                 }
1957                 if (ret != LDB_SUCCESS) {
1958                         return ret;
1959                 }
1960         }
1961
1962         DBG_NOTICE("changes: num_processed=%zu\n", t->changes.num_processed);
1963         DBG_NOTICE("objects: num_processed=%zu\n", t->objects.num_processed);
1964         DBG_NOTICE("objects: num_skipped=%zu\n", t->objects.num_skipped);
1965
1966         return ldb_next_prepare_commit(module);
1967 }
1968
1969 static int descriptor_end_transaction(struct ldb_module *module)
1970 {
1971         struct descriptor_data *descriptor_private =
1972                 talloc_get_type_abort(ldb_module_get_private(module),
1973                 struct descriptor_data);
1974         struct descriptor_transaction *t = &descriptor_private->transaction;
1975
1976         TALLOC_FREE(t->mem);
1977         *t = (struct descriptor_transaction) { .mem = NULL, };
1978
1979         return ldb_next_end_trans(module);
1980 }
1981
1982 static int descriptor_del_transaction(struct ldb_module *module)
1983 {
1984         struct descriptor_data *descriptor_private =
1985                 talloc_get_type_abort(ldb_module_get_private(module),
1986                 struct descriptor_data);
1987         struct descriptor_transaction *t = &descriptor_private->transaction;
1988
1989         TALLOC_FREE(t->mem);
1990         *t = (struct descriptor_transaction) { .mem = NULL, };
1991
1992         return ldb_next_del_trans(module);
1993 }
1994
1995 static const struct ldb_module_ops ldb_descriptor_module_ops = {
1996         .name              = "descriptor",
1997         .search            = descriptor_search,
1998         .add               = descriptor_add,
1999         .modify            = descriptor_modify,
2000         .rename            = descriptor_rename,
2001         .init_context      = descriptor_init,
2002         .extended          = descriptor_extended,
2003         .start_transaction = descriptor_start_transaction,
2004         .prepare_commit    = descriptor_prepare_commit,
2005         .end_transaction   = descriptor_end_transaction,
2006         .del_transaction   = descriptor_del_transaction,
2007 };
2008
2009 int ldb_descriptor_module_init(const char *version)
2010 {
2011         LDB_MODULE_CHECK_VERSION(version);
2012         return ldb_register_module(&ldb_descriptor_module_ops);
2013 }