source4/libnet/libnet_become_dc.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3
   4    Copyright (C) Stefan Metzmacher <metze@samba.org> 2006
   5
   6    This program is free software; you can redistribute it and/or modify
   7    it under the terms of the GNU General Public License as published by
   8    the Free Software Foundation; either version 3 of the License, or
   9    (at your option) any later version.
  10
  11    This program is distributed in the hope that it will be useful,
  12    but WITHOUT ANY WARRANTY; without even the implied warranty of
  13    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  14    GNU General Public License for more details.
  15
  16    You should have received a copy of the GNU General Public License
  17    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  18 */
  19
  20 #include "includes.h"
  21 #include "libnet/libnet.h"
  22 #include "libcli/composite/composite.h"
  23 #include "libcli/cldap/cldap.h"
  24 #include "lib/ldb/include/ldb.h"
  25 #include "lib/ldb/include/ldb_errors.h"
  26 #include "lib/ldb_wrap.h"
  27 #include "dsdb/samdb/samdb.h"
  28 #include "../libds/common/flags.h"
  29 #include "librpc/gen_ndr/ndr_drsuapi_c.h"
  30 #include "libcli/security/security.h"
  31 #include "librpc/gen_ndr/ndr_misc.h"
  32 #include "librpc/gen_ndr/ndr_security.h"
  33 #include "librpc/gen_ndr/ndr_nbt.h"
  34 #include "librpc/gen_ndr/ndr_drsuapi.h"
  35 #include "auth/gensec/gensec.h"
  36 #include "param/param.h"
  37 #include "lib/tsocket/tsocket.h"
  38
  39 /*****************************************************************************
  40  * Windows 2003 (w2k3) does the following steps when changing the server role
  41  * from domain member to domain controller
  42  *
  43  * We mostly do the same.
  44  *****************************************************************************/
  45
  46 /*
  47  * lookup DC:
  48  * - using nbt name<1C> request and a samlogon mailslot request
  49  * or
  50  * - using a DNS SRV _ldap._tcp.dc._msdcs. request and a CLDAP netlogon request
  51  *
  52  * see: becomeDC_recv_cldap() and becomeDC_send_cldap()
  53  */
  54
  55 /*
  56  * Open 1st LDAP connection to the DC using admin credentials
  57  *
  58  * see: becomeDC_connect_ldap1() and becomeDC_ldap_connect()
  59  */
  60
  61 /*
  62  * LDAP search 1st LDAP connection:
  63  *
  64  * see: becomeDC_ldap1_rootdse()
  65  *
  66  * Request:
  67  *      basedn: ""
  68  *      scope:  base
  69  *      filter: (objectClass=*)
  70  *      attrs:  *
  71  * Result:
  72  *      ""
  73  *              currentTime:            20061202155100.0Z
  74  *              subschemaSubentry:      CN=Aggregate,CN=Schema,CN=Configuration,<domain_partition>
  75  *              dsServiceName:          CN=<netbios_name>,CN=Servers,CN=<site_name>,CN=Sites,CN=Configuration,<domain_partition>
  76  *              namingContexts:         <domain_partition>
  77  *                                      CN=Configuration,<domain_partition>
  78  *                                      CN=Schema,CN=Configuration,<domain_partition>
  79  *              defaultNamingContext:   <domain_partition>
  80  *              schemaNamingContext:    CN=Schema,CN=Configuration,<domain_partition>
  81  *              configurationNamingContext:CN=Configuration,<domain_partition>
  82  *              rootDomainNamingContext:<domain_partition>
  83  *              supportedControl:       ...
  84  *              supportedLDAPVersion:   3
  85  *                                      2
  86  *              supportedLDAPPolicies:  ...
  87  *              highestCommitedUSN:     ...
  88  *              supportedSASLMechanisms:GSSAPI
  89  *                                      GSS-SPNEGO
  90  *                                      EXTERNAL
  91  *                                      DIGEST-MD5
  92  *              dnsHostName:            <dns_host_name>
  93  *              ldapServiceName:        <domain_dns_name>:<netbios_name>$@<REALM>
  94  *              serverName:             CN=Servers,CN=<site_name>,CN=Sites,CN=Configuration,<domain_partition>
  95  *              supportedCapabilities:  ...
  96  *              isSyncronized:          TRUE
  97  *              isGlobalCatalogReady:   TRUE
  98  *              domainFunctionality:    0
  99  *              forestFunctionality:    0
 100  *              domainControllerFunctionality: 2
 101  */
 102
 103 /*
 104  * LDAP search 1st LDAP connection:
 105  *
 106  * see: becomeDC_ldap1_crossref_behavior_version()
 107  *
 108  * Request:
 109  *      basedn: CN=Configuration,<domain_partition>
 110  *      scope:  one
 111  *      filter: (cn=Partitions)
 112  *      attrs:  msDS-Behavior-Version
 113  * Result:
 114  *      CN=Partitions,CN=Configuration,<domain_partition>
 115  *              msDS-Behavior-Version:  0
 116  */
 117
 118 /*
 119  * LDAP search 1st LDAP connection:
 120  *
 121  * NOTE: this seems to be a bug! as the messageID of the LDAP message is corrupted!
 122  *
 123  * not implemented here
 124  *
 125  * Request:
 126  *      basedn: CN=Schema,CN=Configuration,<domain_partition>
 127  *      scope:  one
 128  *      filter: (cn=Partitions)
 129  *      attrs:  msDS-Behavior-Version
 130  * Result:
 131  *      <none>
 132  *
 133  */
 134
 135 /*
 136  * LDAP search 1st LDAP connection:
 137  *
 138  * see: becomeDC_ldap1_domain_behavior_version()
 139  *
 140  * Request:
 141  *      basedn: <domain_partition>
 142  *      scope:  base
 143  *      filter: (objectClass=*)
 144  *      attrs:  msDS-Behavior-Version
 145  * Result:
 146  *      <domain_partition>
 147  *              msDS-Behavior-Version:  0
 148  */
 149
 150 /*
 151  * LDAP search 1st LDAP connection:
 152  *
 153  * see: becomeDC_ldap1_schema_object_version()
 154  *
 155  * Request:
 156  *      basedn: CN=Schema,CN=Configuration,<domain_partition>
 157  *      scope:  base
 158  *      filter: (objectClass=*)
 159  *      attrs:  objectVersion
 160  * Result:
 161  *      CN=Schema,CN=Configuration,<domain_partition>
 162  *              objectVersion:  30
 163  */
 164
 165 /*
 166  * LDAP search 1st LDAP connection:
 167  *
 168  * not implemented, because the information is already there
 169  *
 170  * Request:
 171  *      basedn: ""
 172  *      scope:  base
 173  *      filter: (objectClass=*)
 174  *      attrs:  defaultNamingContext
 175  *              dnsHostName
 176  * Result:
 177  *      ""
 178  *              defaultNamingContext:   <domain_partition>
 179  *              dnsHostName:            <dns_host_name>
 180  */
 181
 182 /*
 183  * LDAP search 1st LDAP connection:
 184  *
 185  * see: becomeDC_ldap1_infrastructure_fsmo()
 186  *
 187  * Request:
 188  *      basedn: <WKGUID=2fbac1870ade11d297c400c04fd8d5cd,domain_partition>
 189  *      scope:  base
 190  *      filter: (objectClass=*)
 191  *      attrs:  1.1
 192  * Result:
 193  *      CN=Infrastructure,<domain_partition>
 194  */
 195
 196 /*
 197  * LDAP search 1st LDAP connection:
 198  *
 199  * see: becomeDC_ldap1_w2k3_update_revision()
 200  *
 201  * Request:
 202  *      basedn: CN=Windows2003Update,CN=DomainUpdates,CN=System,<domain_partition>
 203  *      scope:  base
 204  *      filter: (objectClass=*)
 205  *      attrs:  revision
 206  * Result:
 207  *      CN=Windows2003Update,CN=DomainUpdates,CN=System,<domain_partition>
 208  *              revision:       8
 209  */
 210
 211 /*
 212  * LDAP search 1st LDAP connection:
 213  *
 214  * see: becomeDC_ldap1_infrastructure_fsmo()
 215  *
 216  * Request:
 217  *      basedn: CN=Infrastructure,<domain_partition>
 218  *      scope:  base
 219  *      filter: (objectClass=*)
 220  *      attrs:  fSMORoleOwner
 221  * Result:
 222  *      CN=Infrastructure,<domain_partition>
 223  *              fSMORoleOwner:  CN=NTDS Settings,<infrastructure_fsmo_server_object>
 224  */
 225
 226 /*
 227  * LDAP search 1st LDAP connection:
 228  *
 229  * see: becomeDC_ldap1_infrastructure_fsmo()
 230  *
 231  * Request:
 232  *      basedn: <infrastructure_fsmo_server_object>
 233  *      scope:  base
 234  *      filter: (objectClass=*)
 235  *      attrs:  dnsHostName
 236  * Result:
 237  *      <infrastructure_fsmo_server_object>
 238  *              dnsHostName:    <dns_host_name>
 239  */
 240
 241 /*
 242  * LDAP search 1st LDAP connection:
 243  *
 244  * see: becomeDC_ldap1_infrastructure_fsmo()
 245  *
 246  * Request:
 247  *      basedn: CN=NTDS Settings,<infrastructure_fsmo_server_object>
 248  *      scope:  base
 249  *      filter: (objectClass=*)
 250  *      attrs:  objectGUID
 251  * Result:
 252  *      CN=NTDS Settings,<infrastructure_fsmo_server_object>
 253  *              objectGUID:     <object_guid>
 254  */
 255
 256 /*
 257  * LDAP search 1st LDAP connection:
 258  *
 259  * see: becomeDC_ldap1_rid_manager_fsmo()
 260  *
 261  * Request:
 262  *      basedn: <domain_partition>
 263  *      scope:  base
 264  *      filter: (objectClass=*)
 265  *      attrs:  rIDManagerReference
 266  * Result:
 267  *      <domain_partition>
 268  *              rIDManagerReference:    CN=RID Manager$,CN=System,<domain_partition>
 269  */
 270
 271 /*
 272  * LDAP search 1st LDAP connection:
 273  *
 274  * see: becomeDC_ldap1_rid_manager_fsmo()
 275  *
 276  * Request:
 277  *      basedn: CN=RID Manager$,CN=System,<domain_partition>
 278  *      scope:  base
 279  *      filter: (objectClass=*)
 280  *      attrs:  fSMORoleOwner
 281  * Result:
 282  *      CN=Infrastructure,<domain_partition>
 283  *              fSMORoleOwner:  CN=NTDS Settings,<rid_manager_fsmo_server_object>
 284  */
 285
 286 /*
 287  * LDAP search 1st LDAP connection:
 288  *
 289  * see: becomeDC_ldap1_rid_manager_fsmo()
 290  *
 291  * Request:
 292  *      basedn: <rid_manager_fsmo_server_object>
 293  *      scope:  base
 294  *      filter: (objectClass=*)
 295  *      attrs:  dnsHostName
 296  * Result:
 297  *      <rid_manager_fsmo_server_object>
 298  *              dnsHostName:    <dns_host_name>
 299  */
 300
 301 /*
 302  * LDAP search 1st LDAP connection:
 303  *
 304  * see: becomeDC_ldap1_rid_manager_fsmo()
 305  *
 306  * Request:
 307  *      basedn: CN=NTDS Settings,<rid_manager_fsmo_server_object>
 308  *      scope:  base
 309  *      filter: (objectClass=*)
 310  *      attrs:  msDs-ReplicationEpoch
 311  * Result:
 312  *      CN=NTDS Settings,<rid_manager_fsmo_server_object>
 313  */
 314
 315 /*
 316  * LDAP search 1st LDAP connection:
 317  *
 318  * see: becomeDC_ldap1_site_object()
 319  *
 320  * Request:
 321  *      basedn: CN=<new_dc_site_name>,CN=Sites,CN=Configuration,<domain_partition>
 322  *      scope:  base
 323  *      filter: (objectClass=*)
 324  *      attrs:
 325  * Result:
 326  *      CN=<new_dc_site_name>,CN=Sites,CN=Configuration,<domain_partition>
 327  *              objectClass:    top
 328  *                              site
 329  *              cn:             <new_dc_site_name>
 330  *              distinguishedName:CN=<new_dc_site_name>,CN=Sites,CN=Configuration,<domain_partition>
 331  *              instanceType:   4
 332  *              whenCreated:    ...
 333  *              whenChanged:    ...
 334  *              uSNCreated:     ...
 335  *              uSNChanged:     ...
 336  *              showInAdvancedViewOnly: TRUE
 337  *              name:           <new_dc_site_name>
 338  *              objectGUID:     <object_guid>
 339  *              systemFlags:    1107296256 <0x42000000>
 340  *              objectCategory: CN=Site,CN=Schema,CN=Configuration,<domain_partition>
 341  */
 342
 343 /***************************************************************
 344  * Add this stage we call the check_options() callback function
 345  * of the caller, to see if he wants us to continue
 346  *
 347  * see: becomeDC_check_options()
 348  ***************************************************************/
 349
 350 /*
 351  * LDAP search 1st LDAP connection:
 352  *
 353  * see: becomeDC_ldap1_computer_object()
 354  *
 355  * Request:
 356  *      basedn: <domain_partition>
 357  *      scope:  sub
 358  *      filter: (&(|(objectClass=user)(objectClass=computer))(sAMAccountName=<new_dc_account_name>))
 359  *      attrs:  distinguishedName
 360  *              userAccountControl
 361  * Result:
 362  *      CN=<new_dc_netbios_name>,CN=Computers,<domain_partition>
 363  *              distinguishedName:      CN=<new_dc_netbios_name>,CN=Computers,<domain_partition>
 364  *              userAccoountControl:    4096 <0x1000>
 365  */
 366
 367 /*
 368  * LDAP search 1st LDAP connection:
 369  *
 370  * see: becomeDC_ldap1_server_object_1()
 371  *
 372  * Request:
 373  *      basedn: CN=<new_dc_netbios_name>,CN=Servers,CN=<new_dc_site_name>,CN=Sites,CN=Configuration,<domain_partition>
 374  *      scope:  base
 375  *      filter: (objectClass=*)
 376  *      attrs:
 377  * Result:
 378  *      <noSuchObject>
 379  *      <matchedDN:CN=Servers,CN=<new_dc_site_name>,CN=Sites,CN=Configuration,<domain_partition>>
 380  */
 381
 382 /*
 383  * LDAP search 1st LDAP connection:
 384  *
 385  * see: becomeDC_ldap1_server_object_2()
 386  *
 387  * Request:
 388  *      basedn: CN=<new_dc_netbios_name>,CN=Computers,<domain_partition>
 389  *      scope:  base
 390  *      filter: (objectClass=*)
 391  *      attrs:  serverReferenceBL
 392  *      typesOnly: TRUE!!!
 393  * Result:
 394  *      CN=<new_dc_netbios_name>,CN=Computers,<domain_partition>
 395  */
 396
 397 /*
 398  * LDAP add 1st LDAP connection:
 399  *
 400  * see: becomeDC_ldap1_server_object_add()
 401  *
 402  * Request:
 403  *      CN=<new_dc_netbios_name>,CN=Computers,<domain_partition>
 404  *      objectClass:    server
 405  *      systemFlags:    50000000 <0x2FAF080>
 406  *      serverReference:CN=<new_dc_netbios_name>,CN=Computers,<domain_partition>
 407  * Result:
 408  *      <success>
 409  */
 410
 411 /*
 412  * LDAP search 1st LDAP connection:
 413  *
 414  * not implemented, maybe we can add that later
 415  *
 416  * Request:
 417  *      basedn: CN=NTDS Settings,CN=<new_dc_netbios_name>,CN=Servers,CN=<new_dc_site_name>,CN=Sites,CN=Configuration,<domain_partition>
 418  *      scope:  base
 419  *      filter: (objectClass=*)
 420  *      attrs:
 421  * Result:
 422  *      <noSuchObject>
 423  *      <matchedDN:CN=<new_dc_netbios_name>,CN=Servers,CN=<new_dc_site_name>,CN=Sites,CN=Configuration,<domain_partition>>
 424  */
 425
 426 /*
 427  * LDAP search 1st LDAP connection:
 428  *
 429  * not implemented because it gives no new information
 430  *
 431  * Request:
 432  *      basedn: CN=Partitions,CN=Configuration,<domain_partition>
 433  *      scope:  sub
 434  *      filter: (nCName=<domain_partition>)
 435  *      attrs:  nCName
 436  *              dnsRoot
 437  *      controls: LDAP_SERVER_EXTENDED_DN_OID:critical=false
 438  * Result:
 439  *      <GUID=<hex_guid>>;CN=<domain_netbios_name>,CN=Partitions,<domain_partition>>
 440  *              nCName:         <GUID=<hex_guid>>;<SID=<hex_sid>>;<domain_partition>>
 441  *              dnsRoot:        <domain_dns_name>
 442  */
 443
 444 /*
 445  * LDAP modify 1st LDAP connection:
 446  *
 447  * see: becomeDC_ldap1_server_object_modify()
 448  *
 449  * Request (add):
 450  *      CN=<new_dc_netbios_name>,CN=Servers,CN=<new_dc_site_name>,CN=Sites,CN=Configuration,<domain_partition>>
 451  *      serverReference:CN=<new_dc_netbios_name>,CN=Computers,<domain_partition>
 452  * Result:
 453  *      <attributeOrValueExist>
 454  */
 455
 456 /*
 457  * LDAP modify 1st LDAP connection:
 458  *
 459  * see: becomeDC_ldap1_server_object_modify()
 460  *
 461  * Request (replace):
 462  *      CN=<new_dc_netbios_name>,CN=Servers,CN=<new_dc_site_name>,CN=Sites,CN=Configuration,<domain_partition>>
 463  *      serverReference:CN=<new_dc_netbios_name>,CN=Computers,<domain_partition>
 464  * Result:
 465  *      <success>
 466  */
 467
 468 /*
 469  * Open 1st DRSUAPI connection to the DC using admin credentials
 470  * DsBind with DRSUAPI_DS_BIND_GUID_W2K3 ("6afab99c-6e26-464a-975f-f58f105218bc")
 471  * (w2k3 does 2 DsBind() calls here..., where is first is unused and contains garbage at the end)
 472  *
 473  * see: becomeDC_drsuapi_connect_send(), becomeDC_drsuapi1_connect_recv(),
 474  *      becomeDC_drsuapi_bind_send(), becomeDC_drsuapi_bind_recv() and becomeDC_drsuapi1_bind_recv()
 475  */
 476
 477 /*
 478  * DsAddEntry to create the CN=NTDS Settings,CN=<machine_name>,CN=Servers,CN=Default-First-Site-Name, ...
 479  * on the 1st DRSUAPI connection
 480  *
 481  * see: becomeDC_drsuapi1_add_entry_send() and becomeDC_drsuapi1_add_entry_recv()
 482  */
 483
 484 /***************************************************************
 485  * Add this stage we call the prepare_db() callback function
 486  * of the caller, to see if he wants us to continue
 487  *
 488  * see: becomeDC_prepare_db()
 489  ***************************************************************/
 490
 491 /*
 492  * Open 2nd and 3rd DRSUAPI connection to the DC using admin credentials
 493  * - a DsBind with DRSUAPI_DS_BIND_GUID_W2K3 ("6afab99c-6e26-464a-975f-f58f105218bc")
 494  *   on the 2nd connection
 495  *
 496  * see: becomeDC_drsuapi_connect_send(), becomeDC_drsuapi2_connect_recv(),
 497  *      becomeDC_drsuapi_bind_send(), becomeDC_drsuapi_bind_recv(), becomeDC_drsuapi2_bind_recv()
 498  *      and becomeDC_drsuapi3_connect_recv()
 499  */
 500
 501 /*
 502  * replicate CN=Schema,CN=Configuration,...
 503  * on the 3rd DRSUAPI connection and the bind_handle from the 2nd connection
 504  *
 505  * see: becomeDC_drsuapi_pull_partition_send(), becomeDC_drsuapi_pull_partition_recv(),
 506  *      becomeDC_drsuapi3_pull_schema_send() and becomeDC_drsuapi3_pull_schema_recv()
 507  *
 508  ***************************************************************
 509  * Add this stage we call the schema_chunk() callback function
 510  * for each replication message
 511  ***************************************************************/
 512
 513 /*
 514  * replicate CN=Configuration,...
 515  * on the 3rd DRSUAPI connection and the bind_handle from the 2nd connection
 516  *
 517  * see: becomeDC_drsuapi_pull_partition_send(), becomeDC_drsuapi_pull_partition_recv(),
 518  *      becomeDC_drsuapi3_pull_config_send() and becomeDC_drsuapi3_pull_config_recv()
 519  *
 520  ***************************************************************
 521  * Add this stage we call the config_chunk() callback function
 522  * for each replication message
 523  ***************************************************************/
 524
 525 /*
 526  * LDAP unbind on the 1st LDAP connection
 527  *
 528  * not implemented, because it's not needed...
 529  */
 530
 531 /*
 532  * Open 2nd LDAP connection to the DC using admin credentials
 533  *
 534  * see: becomeDC_connect_ldap2() and becomeDC_ldap_connect()
 535  */
 536
 537 /*
 538  * LDAP search 2nd LDAP connection:
 539  *
 540  * not implemented because it gives no new information
 541  * same as becomeDC_ldap1_computer_object()
 542  *
 543  * Request:
 544  *      basedn: <domain_partition>
 545  *      scope:  sub
 546  *      filter: (&(|(objectClass=user)(objectClass=computer))(sAMAccountName=<new_dc_account_name>))
 547  *      attrs:  distinguishedName
 548  *              userAccountControl
 549  * Result:
 550  *      CN=<new_dc_netbios_name>,CN=Computers,<domain_partition>
 551  *              distinguishedName:      CN=<new_dc_netbios_name>,CN=Computers,<domain_partition>
 552  *              userAccoountControl:    4096 <0x00001000>
 553  */
 554
 555 /*
 556  * LDAP search 2nd LDAP connection:
 557  *
 558  * not implemented because it gives no new information
 559  * same as becomeDC_ldap1_computer_object()
 560  *
 561  * Request:
 562  *      basedn: CN=<new_dc_netbios_name>,CN=Computers,<domain_partition>
 563  *      scope:  base
 564  *      filter: (objectClass=*)
 565  *      attrs:  userAccountControl
 566  * Result:
 567  *      CN=<new_dc_netbios_name>,CN=Computers,<domain_partition>
 568  *              userAccoountControl:    4096 <0x00001000>
 569  */
 570
 571 /*
 572  * LDAP modify 2nd LDAP connection:
 573  *
 574  * see: becomeDC_ldap2_modify_computer()
 575  *
 576  * Request (replace):
 577  *      CN=<new_dc_netbios_name>,CN=Computers,<domain_partition>
 578  *      userAccoountControl:    532480 <0x82000>
 579  * Result:
 580  *      <success>
 581  */
 582
 583 /*
 584  * LDAP search 2nd LDAP connection:
 585  *
 586  * see: becomeDC_ldap2_move_computer()
 587  *
 588  * Request:
 589  *      basedn: <WKGUID=2fbac1870ade11d297c400c04fd8d5cd,<domain_partition>>
 590  *      scope:  base
 591  *      filter: (objectClass=*)
 592  *      attrs:  1.1
 593  * Result:
 594  *      CN=Domain Controllers,<domain_partition>
 595  */
 596
 597 /*
 598  * LDAP search 2nd LDAP connection:
 599  *
 600  * not implemented because it gives no new information
 601  *
 602  * Request:
 603  *      basedn: CN=Domain Controllers,<domain_partition>
 604  *      scope:  base
 605  *      filter: (objectClass=*)
 606  *      attrs:  distinguishedName
 607  * Result:
 608  *      CN=Domain Controller,<domain_partition>
 609  *              distinguishedName:      CN=Domain Controllers,<domain_partition>
 610  */
 611
 612 /*
 613  * LDAP modifyRDN 2nd LDAP connection:
 614  *
 615  * see: becomeDC_ldap2_move_computer()
 616  *
 617  * Request:
 618  *      entry:          CN=<new_dc_netbios_name>,CN=Computers,<domain_partition>
 619  *      newrdn:         CN=<new_dc_netbios_name>
 620  *      deleteoldrdn:   TRUE
 621  *      newparent:      CN=Domain Controllers,<domain_partition>
 622  * Result:
 623  *      <success>
 624  */
 625
 626 /*
 627  * LDAP unbind on the 2nd LDAP connection
 628  *
 629  * not implemented, because it's not needed...
 630  */
 631
 632 /*
 633  * replicate Domain Partition
 634  * on the 3rd DRSUAPI connection and the bind_handle from the 2nd connection
 635  *
 636  * see: becomeDC_drsuapi_pull_partition_send(), becomeDC_drsuapi_pull_partition_recv(),
 637  *      becomeDC_drsuapi3_pull_domain_send() and becomeDC_drsuapi3_pull_domain_recv()
 638  *
 639  ***************************************************************
 640  * Add this stage we call the domain_chunk() callback function
 641  * for each replication message
 642  ***************************************************************/
 643
 644 /* call DsReplicaUpdateRefs() for all partitions like this:
 645  *     req1: struct drsuapi_DsReplicaUpdateRefsRequest1
 646  *
 647  *                 naming_context: struct drsuapi_DsReplicaObjectIdentifier
 648  *                     __ndr_size               : 0x000000ae (174)
 649  *                     __ndr_size_sid           : 0x00000000 (0)
 650  *                     guid                     : 00000000-0000-0000-0000-000000000000
 651  *                     sid                      : S-0-0
 652  *                     dn                       : 'CN=Schema,CN=Configuration,DC=w2k3,DC=vmnet1,DC=vm,DC=base'
 653  *
 654  *                 dest_dsa_dns_name        : '4a0df188-a0b8-47ea-bbe5-e614723f16dd._msdcs.w2k3.vmnet1.vm.base'
 655  *           dest_dsa_guid            : 4a0df188-a0b8-47ea-bbe5-e614723f16dd
 656  *           options                  : 0x0000001c (28)
 657  *                 0: DRSUAPI_DS_REPLICA_UPDATE_ASYNCHRONOUS_OPERATION
 658  *                 0: DRSUAPI_DS_REPLICA_UPDATE_WRITEABLE
 659  *                 1: DRSUAPI_DS_REPLICA_UPDATE_ADD_REFERENCE
 660  *                 1: DRSUAPI_DS_REPLICA_UPDATE_DELETE_REFERENCE
 661  *                 1: DRSUAPI_DS_REPLICA_UPDATE_0x00000010
 662  *
 663  * 4a0df188-a0b8-47ea-bbe5-e614723f16dd is the objectGUID the DsAddEntry() returned for the
 664  * CN=NTDS Settings,CN=<machine_name>,CN=Servers,CN=Default-First-Site-Name, ...
 665  * on the 2nd!!! DRSUAPI connection
 666  *
 667  * see: becomeDC_drsuapi_update_refs_send(), becomeDC_drsuapi2_update_refs_schema_recv(),
 668  *      becomeDC_drsuapi2_update_refs_config_recv() and becomeDC_drsuapi2_update_refs_domain_recv()
 669  */
 670
 671 /*
 672  * Windows does opens the 4th and 5th DRSUAPI connection...
 673  * and does a DsBind() with the objectGUID from DsAddEntry() as bind_guid
 674  * on the 4th connection
 675  *
 676  * and then 2 full replications of the domain partition on the 5th connection
 677  * with the bind_handle from the 4th connection
 678  *
 679  * not implemented because it gives no new information
 680  */
 681
 682 struct libnet_BecomeDC_state {
 683         struct composite_context *creq;
 684
 685         struct libnet_context *libnet;
 686
 687         struct dom_sid zero_sid;
 688
 689         struct {
 690                 struct cldap_socket *sock;
 691                 struct cldap_netlogon io;
 692                 struct NETLOGON_SAM_LOGON_RESPONSE_EX netlogon;
 693         } cldap;
 694
 695         struct becomeDC_ldap {
 696                 struct ldb_context *ldb;
 697                 const struct ldb_message *rootdse;
 698         } ldap1, ldap2;
 699
 700         struct becomeDC_drsuapi {
 701                 struct libnet_BecomeDC_state *s;
 702                 struct dcerpc_binding *binding;
 703                 struct dcerpc_pipe *pipe;
 704                 struct dcerpc_binding_handle *drsuapi_handle;
 705                 DATA_BLOB gensec_skey;
 706                 struct drsuapi_DsBind bind_r;
 707                 struct GUID bind_guid;
 708                 struct drsuapi_DsBindInfoCtr bind_info_ctr;
 709                 struct drsuapi_DsBindInfo28 local_info28;
 710                 struct drsuapi_DsBindInfo28 remote_info28;
 711                 struct policy_handle bind_handle;
 712         } drsuapi1, drsuapi2, drsuapi3;
 713
 714         void *ndr_struct_ptr;
 715
 716         struct libnet_BecomeDC_Domain domain;
 717         struct libnet_BecomeDC_Forest forest;
 718         struct libnet_BecomeDC_SourceDSA source_dsa;
 719         struct libnet_BecomeDC_DestDSA dest_dsa;
 720
 721         struct libnet_BecomeDC_Partition schema_part, config_part, domain_part;
 722
 723         struct becomeDC_fsmo {
 724                 const char *dns_name;
 725                 const char *server_dn_str;
 726                 const char *ntds_dn_str;
 727                 struct GUID ntds_guid;
 728         } infrastructure_fsmo;
 729
 730         struct becomeDC_fsmo rid_manager_fsmo;
 731
 732         struct libnet_BecomeDC_CheckOptions _co;
 733         struct libnet_BecomeDC_PrepareDB _pp;
 734         struct libnet_BecomeDC_StoreChunk _sc;
 735         struct libnet_BecomeDC_Callbacks callbacks;
 736
 737         bool rodc_join;
 738 };
 739
 740 static int32_t get_dc_function_level(struct loadparm_context *lp_ctx)
 741 {
 742         /* per default we are (Windows) 2008 compatible */
 743         return lp_parm_int(lp_ctx, NULL, "ads", "dc function level",
 744                 DS_DC_FUNCTION_2008);
 745 }
 746
 747 static int32_t get_min_function_level(struct loadparm_context *lp_ctx)
 748 {
 749         /* per default it is (Windows) 2003 Native compatible */
 750         return lp_parm_int(lp_ctx, NULL, "ads", "min function level",
 751                 DS_DOMAIN_FUNCTION_2003);
 752 }
 753
 754 static void becomeDC_recv_cldap(struct tevent_req *req);
 755
 756 static void becomeDC_send_cldap(struct libnet_BecomeDC_state *s)
 757 {
 758         struct composite_context *c = s->creq;
 759         struct tevent_req *req;
 760         struct tsocket_address *dest_address;
 761         int ret;
 762
 763         s->cldap.io.in.dest_address     = NULL;
 764         s->cldap.io.in.dest_port        = 0;
 765         s->cldap.io.in.realm            = s->domain.dns_name;
 766         s->cldap.io.in.host             = s->dest_dsa.netbios_name;
 767         s->cldap.io.in.user             = NULL;
 768         s->cldap.io.in.domain_guid      = NULL;
 769         s->cldap.io.in.domain_sid       = NULL;
 770         s->cldap.io.in.acct_control     = -1;
 771         s->cldap.io.in.version          = NETLOGON_NT_VERSION_5 | NETLOGON_NT_VERSION_5EX;
 772         s->cldap.io.in.map_response     = true;
 773
 774         ret = tsocket_address_inet_from_strings(s, "ip",
 775                                                 s->source_dsa.address,
 776                                                 lp_cldap_port(s->libnet->lp_ctx),
 777                                                 &dest_address);
 778         if (ret != 0) {
 779                 c->status = map_nt_error_from_unix(errno);
 780                 if (!composite_is_ok(c)) return;
 781         }
 782
 783         c->status = cldap_socket_init(s, s->libnet->event_ctx,
 784                                       NULL, dest_address, &s->cldap.sock);
 785         if (!composite_is_ok(c)) return;
 786
 787         req = cldap_netlogon_send(s, s->cldap.sock, &s->cldap.io);
 788         if (composite_nomem(req, c)) return;
 789         tevent_req_set_callback(req, becomeDC_recv_cldap, s);
 790 }
 791
 792 static void becomeDC_connect_ldap1(struct libnet_BecomeDC_state *s);
 793
 794 static void becomeDC_recv_cldap(struct tevent_req *req)
 795 {
 796         struct libnet_BecomeDC_state *s = tevent_req_callback_data(req,
 797                                           struct libnet_BecomeDC_state);
 798         struct composite_context *c = s->creq;
 799
 800         c->status = cldap_netlogon_recv(req,
 801                                         lp_iconv_convenience(s->libnet->lp_ctx),
 802                                         s, &s->cldap.io);
 803         talloc_free(req);
 804         if (!composite_is_ok(c)) {
 805                 DEBUG(0,("Failed to send, receive or parse CLDAP reply from server %s for our host %s: %s\n",
 806                          s->cldap.io.in.dest_address,
 807                          s->cldap.io.in.host,
 808                          nt_errstr(c->status)));
 809                 return;
 810         }
 811         s->cldap.netlogon = s->cldap.io.out.netlogon.data.nt5_ex;
 812
 813         s->domain.dns_name              = s->cldap.netlogon.dns_domain;
 814         s->domain.netbios_name          = s->cldap.netlogon.domain;
 815         s->domain.guid                  = s->cldap.netlogon.domain_uuid;
 816
 817         s->forest.dns_name              = s->cldap.netlogon.forest;
 818
 819         s->source_dsa.dns_name          = s->cldap.netlogon.pdc_dns_name;
 820         s->source_dsa.netbios_name      = s->cldap.netlogon.pdc_name;
 821         s->source_dsa.site_name         = s->cldap.netlogon.server_site;
 822
 823         s->dest_dsa.site_name           = s->cldap.netlogon.client_site;
 824
 825         becomeDC_connect_ldap1(s);
 826 }
 827
 828 static NTSTATUS becomeDC_ldap_connect(struct libnet_BecomeDC_state *s,
 829                                       struct becomeDC_ldap *ldap)
 830 {
 831         char *url;
 832
 833         url = talloc_asprintf(s, "ldap://%s/", s->source_dsa.dns_name);
 834         NT_STATUS_HAVE_NO_MEMORY(url);
 835
 836         ldap->ldb = ldb_wrap_connect(s, s->libnet->event_ctx, s->libnet->lp_ctx, url,
 837                                      NULL,
 838                                      s->libnet->cred,
 839                                      0);
 840         talloc_free(url);
 841         if (ldap->ldb == NULL) {
 842                 return NT_STATUS_UNEXPECTED_NETWORK_ERROR;
 843         }
 844
 845         return NT_STATUS_OK;
 846 }
 847
 848 static NTSTATUS becomeDC_ldap1_rootdse(struct libnet_BecomeDC_state *s)
 849 {
 850         int ret;
 851         struct ldb_result *r;
 852         struct ldb_dn *basedn;
 853         static const char *attrs[] = {
 854                 "*",
 855                 NULL
 856         };
 857
 858         basedn = ldb_dn_new(s, s->ldap1.ldb, NULL);
 859         NT_STATUS_HAVE_NO_MEMORY(basedn);
 860
 861         ret = ldb_search(s->ldap1.ldb, s, &r, basedn, LDB_SCOPE_BASE, attrs,
 862                          "(objectClass=*)");
 863         talloc_free(basedn);
 864         if (ret != LDB_SUCCESS) {
 865                 return NT_STATUS_LDAP(ret);
 866         } else if (r->count != 1) {
 867                 talloc_free(r);
 868                 return NT_STATUS_INVALID_NETWORK_RESPONSE;
 869         }
 870
 871         s->ldap1.rootdse = r->msgs[0];
 872
 873         s->domain.dn_str        = ldb_msg_find_attr_as_string(s->ldap1.rootdse, "defaultNamingContext", NULL);
 874         if (!s->domain.dn_str) return NT_STATUS_INVALID_NETWORK_RESPONSE;
 875
 876         s->forest.root_dn_str   = ldb_msg_find_attr_as_string(s->ldap1.rootdse, "rootDomainNamingContext", NULL);
 877         if (!s->forest.root_dn_str) return NT_STATUS_INVALID_NETWORK_RESPONSE;
 878         s->forest.config_dn_str = ldb_msg_find_attr_as_string(s->ldap1.rootdse, "configurationNamingContext", NULL);
 879         if (!s->forest.config_dn_str) return NT_STATUS_INVALID_NETWORK_RESPONSE;
 880         s->forest.schema_dn_str = ldb_msg_find_attr_as_string(s->ldap1.rootdse, "schemaNamingContext", NULL);
 881         if (!s->forest.schema_dn_str) return NT_STATUS_INVALID_NETWORK_RESPONSE;
 882
 883         s->source_dsa.server_dn_str     = ldb_msg_find_attr_as_string(s->ldap1.rootdse, "serverName", NULL);
 884         if (!s->source_dsa.server_dn_str) return NT_STATUS_INVALID_NETWORK_RESPONSE;
 885         s->source_dsa.ntds_dn_str       = ldb_msg_find_attr_as_string(s->ldap1.rootdse, "dsServiceName", NULL);
 886         if (!s->source_dsa.ntds_dn_str) return NT_STATUS_INVALID_NETWORK_RESPONSE;
 887
 888         return NT_STATUS_OK;
 889 }
 890
 891 static NTSTATUS becomeDC_ldap1_crossref_behavior_version(struct libnet_BecomeDC_state *s)
 892 {
 893         int ret;
 894         struct ldb_result *r;
 895         struct ldb_dn *basedn;
 896         static const char *attrs[] = {
 897                 "msDs-Behavior-Version",
 898                 NULL
 899         };
 900
 901         basedn = ldb_dn_new(s, s->ldap1.ldb, s->forest.config_dn_str);
 902         NT_STATUS_HAVE_NO_MEMORY(basedn);
 903
 904         ret = ldb_search(s->ldap1.ldb, s, &r, basedn, LDB_SCOPE_ONELEVEL, attrs,
 905                          "(cn=Partitions)");
 906         talloc_free(basedn);
 907         if (ret != LDB_SUCCESS) {
 908                 return NT_STATUS_LDAP(ret);
 909         } else if (r->count != 1) {
 910                 talloc_free(r);
 911                 return NT_STATUS_INVALID_NETWORK_RESPONSE;
 912         }
 913
 914         s->forest.crossref_behavior_version = ldb_msg_find_attr_as_uint(r->msgs[0], "msDs-Behavior-Version", 0);
 915         if (s->forest.crossref_behavior_version <
 916                          get_min_function_level(s->libnet->lp_ctx)) {
 917                 talloc_free(r);
 918                 DEBUG(0,("The servers function level %u is below 'ads:min function level' of %u\n",
 919                          s->forest.crossref_behavior_version,
 920                          get_min_function_level(s->libnet->lp_ctx)));
 921                 return NT_STATUS_NOT_SUPPORTED;
 922         }
 923         if (s->forest.crossref_behavior_version >
 924                         get_dc_function_level(s->libnet->lp_ctx)) {
 925                 talloc_free(r);
 926                 DEBUG(0,("The servers function level %u is above 'ads:dc function level' of %u\n",
 927                          s->forest.crossref_behavior_version,
 928                          get_dc_function_level(s->libnet->lp_ctx)));
 929                 return NT_STATUS_NOT_SUPPORTED;
 930         }
 931
 932         talloc_free(r);
 933         return NT_STATUS_OK;
 934 }
 935
 936 static NTSTATUS becomeDC_ldap1_domain_behavior_version(struct libnet_BecomeDC_state *s)
 937 {
 938         int ret;
 939         struct ldb_result *r;
 940         struct ldb_dn *basedn;
 941         static const char *attrs[] = {
 942                 "msDs-Behavior-Version",
 943                 NULL
 944         };
 945
 946         basedn = ldb_dn_new(s, s->ldap1.ldb, s->domain.dn_str);
 947         NT_STATUS_HAVE_NO_MEMORY(basedn);
 948
 949         ret = ldb_search(s->ldap1.ldb, s, &r, basedn, LDB_SCOPE_BASE, attrs,
 950                          "(objectClass=*)");
 951         talloc_free(basedn);
 952         if (ret != LDB_SUCCESS) {
 953                 return NT_STATUS_LDAP(ret);
 954         } else if (r->count != 1) {
 955                 talloc_free(r);
 956                 return NT_STATUS_INVALID_NETWORK_RESPONSE;
 957         }
 958
 959         s->domain.behavior_version = ldb_msg_find_attr_as_uint(r->msgs[0], "msDs-Behavior-Version", 0);
 960         if (s->domain.behavior_version <
 961                         get_min_function_level(s->libnet->lp_ctx)) {
 962                 talloc_free(r);
 963                 DEBUG(0,("The servers function level %u is below 'ads:min function level' of %u\n",
 964                          s->forest.crossref_behavior_version,
 965                          get_min_function_level(s->libnet->lp_ctx)));
 966                 return NT_STATUS_NOT_SUPPORTED;
 967         }
 968         if (s->domain.behavior_version >
 969                         get_dc_function_level(s->libnet->lp_ctx)) {
 970                 talloc_free(r);
 971                 DEBUG(0,("The servers function level %u is above 'ads:dc function level' of %u\n",
 972                          s->forest.crossref_behavior_version,
 973                          get_dc_function_level(s->libnet->lp_ctx)));
 974                 return NT_STATUS_NOT_SUPPORTED;
 975         }
 976
 977         talloc_free(r);
 978         return NT_STATUS_OK;
 979 }
 980
 981 static NTSTATUS becomeDC_ldap1_schema_object_version(struct libnet_BecomeDC_state *s)
 982 {
 983         int ret;
 984         struct ldb_result *r;
 985         struct ldb_dn *basedn;
 986         static const char *attrs[] = {
 987                 "objectVersion",
 988                 NULL
 989         };
 990
 991         basedn = ldb_dn_new(s, s->ldap1.ldb, s->forest.schema_dn_str);
 992         NT_STATUS_HAVE_NO_MEMORY(basedn);
 993
 994         ret = ldb_search(s->ldap1.ldb, s, &r, basedn, LDB_SCOPE_BASE, attrs,
 995                          "(objectClass=*)");
 996         talloc_free(basedn);
 997         if (ret != LDB_SUCCESS) {
 998                 return NT_STATUS_LDAP(ret);
 999         } else if (r->count != 1) {
1000                 talloc_free(r);
1001                 return NT_STATUS_INVALID_NETWORK_RESPONSE;
1002         }
1003
1004         s->forest.schema_object_version = ldb_msg_find_attr_as_uint(r->msgs[0], "objectVersion", 0);
1005
1006         talloc_free(r);
1007         return NT_STATUS_OK;
1008 }
1009
1010 static NTSTATUS becomeDC_ldap1_w2k3_update_revision(struct libnet_BecomeDC_state *s)
1011 {
1012         int ret;
1013         struct ldb_result *r;
1014         struct ldb_dn *basedn;
1015         static const char *attrs[] = {
1016                 "revision",
1017                 NULL
1018         };
1019
1020         basedn = ldb_dn_new_fmt(s, s->ldap1.ldb, "CN=Windows2003Update,CN=DomainUpdates,CN=System,%s",
1021                                 s->domain.dn_str);
1022         NT_STATUS_HAVE_NO_MEMORY(basedn);
1023
1024         ret = ldb_search(s->ldap1.ldb, s, &r, basedn, LDB_SCOPE_BASE, attrs,
1025                          "(objectClass=*)");
1026         talloc_free(basedn);
1027         if (ret == LDB_ERR_NO_SUCH_OBJECT) {
1028                 /* w2k doesn't have this object */
1029                 s->domain.w2k3_update_revision = 0;
1030                 return NT_STATUS_OK;
1031         } else if (ret != LDB_SUCCESS) {
1032                 return NT_STATUS_LDAP(ret);
1033         } else if (r->count != 1) {
1034                 talloc_free(r);
1035                 return NT_STATUS_INVALID_NETWORK_RESPONSE;
1036         }
1037
1038         s->domain.w2k3_update_revision = ldb_msg_find_attr_as_uint(r->msgs[0], "revision", 0);
1039
1040         talloc_free(r);
1041         return NT_STATUS_OK;
1042 }
1043
1044 static NTSTATUS becomeDC_ldap1_infrastructure_fsmo(struct libnet_BecomeDC_state *s)
1045 {
1046         int ret;
1047         struct ldb_result *r;
1048         struct ldb_dn *basedn;
1049         struct ldb_dn *ntds_dn;
1050         struct ldb_dn *server_dn;
1051         static const char *dns_attrs[] = {
1052                 "dnsHostName",
1053                 NULL
1054         };
1055         static const char *guid_attrs[] = {
1056                 "objectGUID",
1057                 NULL
1058         };
1059
1060         ret = dsdb_wellknown_dn(s->ldap1.ldb, s, samdb_base_dn(s->ldap1.ldb),
1061                                 DS_GUID_INFRASTRUCTURE_CONTAINER,
1062                                 &basedn);
1063         if (ret != LDB_SUCCESS) {
1064                 return NT_STATUS_LDAP(ret);
1065         }
1066
1067         ret = samdb_reference_dn(s->ldap1.ldb, s, basedn, "fSMORoleOwner", &ntds_dn);
1068         if (ret != LDB_SUCCESS) {
1069                 talloc_free(basedn);
1070                 return NT_STATUS_LDAP(ret);
1071         }
1072
1073         s->infrastructure_fsmo.ntds_dn_str = ldb_dn_get_linearized(ntds_dn);
1074         NT_STATUS_HAVE_NO_MEMORY(s->infrastructure_fsmo.ntds_dn_str);
1075
1076         server_dn = ldb_dn_get_parent(s, ntds_dn);
1077         NT_STATUS_HAVE_NO_MEMORY(server_dn);
1078
1079         s->infrastructure_fsmo.server_dn_str = ldb_dn_alloc_linearized(s, server_dn);
1080         NT_STATUS_HAVE_NO_MEMORY(s->infrastructure_fsmo.server_dn_str);
1081
1082         ret = ldb_search(s->ldap1.ldb, s, &r, server_dn, LDB_SCOPE_BASE,
1083                          dns_attrs, "(objectClass=*)");
1084         if (ret != LDB_SUCCESS) {
1085                 return NT_STATUS_LDAP(ret);
1086         } else if (r->count != 1) {
1087                 talloc_free(r);
1088                 return NT_STATUS_INVALID_NETWORK_RESPONSE;
1089         }
1090
1091         s->infrastructure_fsmo.dns_name = samdb_result_string(r->msgs[0], "dnsHostName", NULL);
1092         if (!s->infrastructure_fsmo.dns_name) return NT_STATUS_INVALID_NETWORK_RESPONSE;
1093         talloc_steal(s, s->infrastructure_fsmo.dns_name);
1094
1095         talloc_free(r);
1096
1097         ret = ldb_search(s->ldap1.ldb, s, &r, ntds_dn, LDB_SCOPE_BASE,
1098                          guid_attrs, "(objectClass=*)");
1099         if (ret != LDB_SUCCESS) {
1100                 return NT_STATUS_LDAP(ret);
1101         } else if (r->count != 1) {
1102                 talloc_free(r);
1103                 return NT_STATUS_INVALID_NETWORK_RESPONSE;
1104         }
1105
1106         s->infrastructure_fsmo.ntds_guid = samdb_result_guid(r->msgs[0], "objectGUID");
1107
1108         talloc_free(r);
1109
1110         return NT_STATUS_OK;
1111 }
1112
1113 static NTSTATUS becomeDC_ldap1_rid_manager_fsmo(struct libnet_BecomeDC_state *s)
1114 {
1115         int ret;
1116         struct ldb_result *r;
1117         struct ldb_dn *basedn;
1118         const char *reference_dn_str;
1119         struct ldb_dn *ntds_dn;
1120         struct ldb_dn *server_dn;
1121         static const char *rid_attrs[] = {
1122                 "rIDManagerReference",
1123                 NULL
1124         };
1125         static const char *fsmo_attrs[] = {
1126                 "fSMORoleOwner",
1127                 NULL
1128         };
1129         static const char *dns_attrs[] = {
1130                 "dnsHostName",
1131                 NULL
1132         };
1133         static const char *guid_attrs[] = {
1134                 "objectGUID",
1135                 NULL
1136         };
1137
1138         basedn = ldb_dn_new(s, s->ldap1.ldb, s->domain.dn_str);
1139         NT_STATUS_HAVE_NO_MEMORY(basedn);
1140
1141         ret = ldb_search(s->ldap1.ldb, s, &r, basedn, LDB_SCOPE_BASE,
1142                          rid_attrs, "(objectClass=*)");
1143         talloc_free(basedn);
1144         if (ret != LDB_SUCCESS) {
1145                 return NT_STATUS_LDAP(ret);
1146         } else if (r->count != 1) {
1147                 talloc_free(r);
1148                 return NT_STATUS_INVALID_NETWORK_RESPONSE;
1149         }
1150
1151         reference_dn_str        = samdb_result_string(r->msgs[0], "rIDManagerReference", NULL);
1152         if (!reference_dn_str) return NT_STATUS_INVALID_NETWORK_RESPONSE;
1153
1154         basedn = ldb_dn_new(s, s->ldap1.ldb, reference_dn_str);
1155         NT_STATUS_HAVE_NO_MEMORY(basedn);
1156
1157         talloc_free(r);
1158
1159         ret = ldb_search(s->ldap1.ldb, s, &r, basedn, LDB_SCOPE_BASE,
1160                          fsmo_attrs, "(objectClass=*)");
1161         talloc_free(basedn);
1162         if (ret != LDB_SUCCESS) {
1163                 return NT_STATUS_LDAP(ret);
1164         } else if (r->count != 1) {
1165                 talloc_free(r);
1166                 return NT_STATUS_INVALID_NETWORK_RESPONSE;
1167         }
1168
1169         s->rid_manager_fsmo.ntds_dn_str = samdb_result_string(r->msgs[0], "fSMORoleOwner", NULL);
1170         if (!s->rid_manager_fsmo.ntds_dn_str) return NT_STATUS_INVALID_NETWORK_RESPONSE;
1171         talloc_steal(s, s->rid_manager_fsmo.ntds_dn_str);
1172
1173         talloc_free(r);
1174
1175         ntds_dn = ldb_dn_new(s, s->ldap1.ldb, s->rid_manager_fsmo.ntds_dn_str);
1176         NT_STATUS_HAVE_NO_MEMORY(ntds_dn);
1177
1178         server_dn = ldb_dn_get_parent(s, ntds_dn);
1179         NT_STATUS_HAVE_NO_MEMORY(server_dn);
1180
1181         s->rid_manager_fsmo.server_dn_str = ldb_dn_alloc_linearized(s, server_dn);
1182         NT_STATUS_HAVE_NO_MEMORY(s->rid_manager_fsmo.server_dn_str);
1183
1184         ret = ldb_search(s->ldap1.ldb, s, &r, server_dn, LDB_SCOPE_BASE,
1185                          dns_attrs, "(objectClass=*)");
1186         if (ret != LDB_SUCCESS) {
1187                 return NT_STATUS_LDAP(ret);
1188         } else if (r->count != 1) {
1189                 talloc_free(r);
1190                 return NT_STATUS_INVALID_NETWORK_RESPONSE;
1191         }
1192
1193         s->rid_manager_fsmo.dns_name    = samdb_result_string(r->msgs[0], "dnsHostName", NULL);
1194         if (!s->rid_manager_fsmo.dns_name) return NT_STATUS_INVALID_NETWORK_RESPONSE;
1195         talloc_steal(s, s->rid_manager_fsmo.dns_name);
1196
1197         talloc_free(r);
1198
1199         ret = ldb_search(s->ldap1.ldb, s, &r, ntds_dn, LDB_SCOPE_BASE,
1200                          guid_attrs, "(objectClass=*)");
1201         if (ret != LDB_SUCCESS) {
1202                 return NT_STATUS_LDAP(ret);
1203         } else if (r->count != 1) {
1204                 talloc_free(r);
1205                 return NT_STATUS_INVALID_NETWORK_RESPONSE;
1206         }
1207
1208         s->rid_manager_fsmo.ntds_guid = samdb_result_guid(r->msgs[0], "objectGUID");
1209
1210         talloc_free(r);
1211
1212         return NT_STATUS_OK;
1213 }
1214
1215 static NTSTATUS becomeDC_ldap1_site_object(struct libnet_BecomeDC_state *s)
1216 {
1217         int ret;
1218         struct ldb_result *r;
1219         struct ldb_dn *basedn;
1220
1221         basedn = ldb_dn_new_fmt(s, s->ldap1.ldb, "CN=%s,CN=Sites,%s",
1222                                 s->dest_dsa.site_name,
1223                                 s->forest.config_dn_str);
1224         NT_STATUS_HAVE_NO_MEMORY(basedn);
1225
1226         ret = ldb_search(s->ldap1.ldb, s, &r, basedn, LDB_SCOPE_BASE,
1227                          NULL, "(objectClass=*)");
1228         talloc_free(basedn);
1229         if (ret != LDB_SUCCESS) {
1230                 return NT_STATUS_LDAP(ret);
1231         } else if (r->count != 1) {
1232                 talloc_free(r);
1233                 return NT_STATUS_INVALID_NETWORK_RESPONSE;
1234         }
1235
1236         s->dest_dsa.site_guid = samdb_result_guid(r->msgs[0], "objectGUID");
1237
1238         talloc_free(r);
1239         return NT_STATUS_OK;
1240 }
1241
1242 static NTSTATUS becomeDC_check_options(struct libnet_BecomeDC_state *s)
1243 {
1244         if (!s->callbacks.check_options) return NT_STATUS_OK;
1245
1246         s->_co.domain           = &s->domain;
1247         s->_co.forest           = &s->forest;
1248         s->_co.source_dsa       = &s->source_dsa;
1249
1250         return s->callbacks.check_options(s->callbacks.private_data, &s->_co);
1251 }
1252
1253 static NTSTATUS becomeDC_ldap1_computer_object(struct libnet_BecomeDC_state *s)
1254 {
1255         int ret;
1256         struct ldb_result *r;
1257         struct ldb_dn *basedn;
1258         static const char *attrs[] = {
1259                 "distinguishedName",
1260                 "userAccountControl",
1261                 NULL
1262         };
1263
1264         basedn = ldb_dn_new(s, s->ldap1.ldb, s->domain.dn_str);
1265         NT_STATUS_HAVE_NO_MEMORY(basedn);
1266
1267         ret = ldb_search(s->ldap1.ldb, s, &r, basedn, LDB_SCOPE_SUBTREE, attrs,
1268                          "(&(|(objectClass=user)(objectClass=computer))(sAMAccountName=%s$))",
1269                          s->dest_dsa.netbios_name);
1270         talloc_free(basedn);
1271         if (ret != LDB_SUCCESS) {
1272                 return NT_STATUS_LDAP(ret);
1273         } else if (r->count != 1) {
1274                 talloc_free(r);
1275                 return NT_STATUS_INVALID_NETWORK_RESPONSE;
1276         }
1277
1278         s->dest_dsa.computer_dn_str     = samdb_result_string(r->msgs[0], "distinguishedName", NULL);
1279         if (!s->dest_dsa.computer_dn_str) return NT_STATUS_INVALID_NETWORK_RESPONSE;
1280         talloc_steal(s, s->dest_dsa.computer_dn_str);
1281
1282         s->dest_dsa.user_account_control = samdb_result_uint(r->msgs[0], "userAccountControl", 0);
1283
1284         talloc_free(r);
1285         return NT_STATUS_OK;
1286 }
1287
1288 static NTSTATUS becomeDC_ldap1_server_object_1(struct libnet_BecomeDC_state *s)
1289 {
1290         int ret;
1291         struct ldb_result *r;
1292         struct ldb_dn *basedn;
1293         const char *server_reference_dn_str;
1294         struct ldb_dn *server_reference_dn;
1295         struct ldb_dn *computer_dn;
1296
1297         basedn = ldb_dn_new_fmt(s, s->ldap1.ldb, "CN=%s,CN=Servers,CN=%s,CN=Sites,%s",
1298                                 s->dest_dsa.netbios_name,
1299                                 s->dest_dsa.site_name,
1300                                 s->forest.config_dn_str);
1301         NT_STATUS_HAVE_NO_MEMORY(basedn);
1302
1303         ret = ldb_search(s->ldap1.ldb, s, &r, basedn, LDB_SCOPE_BASE,
1304                          NULL, "(objectClass=*)");
1305         talloc_free(basedn);
1306         if (ret == LDB_ERR_NO_SUCH_OBJECT) {
1307                 /* if the object doesn't exist, we'll create it later */
1308                 return NT_STATUS_OK;
1309         } else if (ret != LDB_SUCCESS) {
1310                 return NT_STATUS_LDAP(ret);
1311         } else if (r->count != 1) {
1312                 talloc_free(r);
1313                 return NT_STATUS_INVALID_NETWORK_RESPONSE;
1314         }
1315
1316         server_reference_dn_str = samdb_result_string(r->msgs[0], "serverReference", NULL);
1317         if (server_reference_dn_str) {
1318                 server_reference_dn     = ldb_dn_new(r, s->ldap1.ldb, server_reference_dn_str);
1319                 NT_STATUS_HAVE_NO_MEMORY(server_reference_dn);
1320
1321                 computer_dn             = ldb_dn_new(r, s->ldap1.ldb, s->dest_dsa.computer_dn_str);
1322                 NT_STATUS_HAVE_NO_MEMORY(computer_dn);
1323
1324                 /*
1325                  * if the server object belongs to another DC in another domain
1326                  * in the forest, we should not touch this object!
1327                  */
1328                 if (ldb_dn_compare(computer_dn, server_reference_dn) != 0) {
1329                         talloc_free(r);
1330                         return NT_STATUS_OBJECT_NAME_COLLISION;
1331                 }
1332         }
1333
1334         /* if the server object is already for the dest_dsa, then we don't need to create it */
1335         s->dest_dsa.server_dn_str       = samdb_result_string(r->msgs[0], "distinguishedName", NULL);
1336         if (!s->dest_dsa.server_dn_str) return NT_STATUS_INVALID_NETWORK_RESPONSE;
1337         talloc_steal(s, s->dest_dsa.server_dn_str);
1338
1339         talloc_free(r);
1340         return NT_STATUS_OK;
1341 }
1342
1343 static NTSTATUS becomeDC_ldap1_server_object_2(struct libnet_BecomeDC_state *s)
1344 {
1345         int ret;
1346         struct ldb_result *r;
1347         struct ldb_dn *basedn;
1348         const char *server_reference_bl_dn_str;
1349         static const char *attrs[] = {
1350                 "serverReferenceBL",
1351                 NULL
1352         };
1353
1354         /* if the server_dn_str has a valid value, we skip this lookup */
1355         if (s->dest_dsa.server_dn_str) return NT_STATUS_OK;
1356
1357         basedn = ldb_dn_new(s, s->ldap1.ldb, s->dest_dsa.computer_dn_str);
1358         NT_STATUS_HAVE_NO_MEMORY(basedn);
1359
1360         ret = ldb_search(s->ldap1.ldb, s, &r, basedn, LDB_SCOPE_BASE,
1361                          attrs, "(objectClass=*)");
1362         talloc_free(basedn);
1363         if (ret != LDB_SUCCESS) {
1364                 return NT_STATUS_LDAP(ret);
1365         } else if (r->count != 1) {
1366                 talloc_free(r);
1367                 return NT_STATUS_INVALID_NETWORK_RESPONSE;
1368         }
1369
1370         server_reference_bl_dn_str = samdb_result_string(r->msgs[0], "serverReferenceBL", NULL);
1371         if (!server_reference_bl_dn_str) {
1372                 /* if no back link is present, we're done for this function */
1373                 talloc_free(r);
1374                 return NT_STATUS_OK;
1375         }
1376
1377         /* if the server object is already for the dest_dsa, then we don't need to create it */
1378         s->dest_dsa.server_dn_str       = samdb_result_string(r->msgs[0], "serverReferenceBL", NULL);
1379         if (s->dest_dsa.server_dn_str) {
1380                 /* if a back link is present, we know that the server object is present */
1381                 talloc_steal(s, s->dest_dsa.server_dn_str);
1382         }
1383
1384         talloc_free(r);
1385         return NT_STATUS_OK;
1386 }
1387
1388 static NTSTATUS becomeDC_ldap1_server_object_add(struct libnet_BecomeDC_state *s)
1389 {
1390         int ret;
1391         struct ldb_message *msg;
1392         char *server_dn_str;
1393
1394         /* if the server_dn_str has a valid value, we skip this lookup */
1395         if (s->dest_dsa.server_dn_str) return NT_STATUS_OK;
1396
1397         msg = ldb_msg_new(s);
1398         NT_STATUS_HAVE_NO_MEMORY(msg);
1399
1400         msg->dn = ldb_dn_new_fmt(msg, s->ldap1.ldb, "CN=%s,CN=Servers,CN=%s,CN=Sites,%s",
1401                                  s->dest_dsa.netbios_name,
1402                                  s->dest_dsa.site_name,
1403                                  s->forest.config_dn_str);
1404         NT_STATUS_HAVE_NO_MEMORY(msg->dn);
1405
1406         ret = ldb_msg_add_string(msg, "objectClass", "server");
1407         if (ret != 0) {
1408                 talloc_free(msg);
1409                 return NT_STATUS_NO_MEMORY;
1410         }
1411         ret = ldb_msg_add_string(msg, "systemFlags", "50000000");
1412         if (ret != 0) {
1413                 talloc_free(msg);
1414                 return NT_STATUS_NO_MEMORY;
1415         }
1416         ret = ldb_msg_add_string(msg, "serverReference", s->dest_dsa.computer_dn_str);
1417         if (ret != 0) {
1418                 talloc_free(msg);
1419                 return NT_STATUS_NO_MEMORY;
1420         }
1421
1422         server_dn_str = ldb_dn_alloc_linearized(s, msg->dn);
1423         NT_STATUS_HAVE_NO_MEMORY(server_dn_str);
1424
1425         ret = ldb_add(s->ldap1.ldb, msg);
1426         talloc_free(msg);
1427         if (ret != LDB_SUCCESS) {
1428                 talloc_free(server_dn_str);
1429                 return NT_STATUS_LDAP(ret);
1430         }
1431
1432         s->dest_dsa.server_dn_str = server_dn_str;
1433
1434         return NT_STATUS_OK;
1435 }
1436
1437 static NTSTATUS becomeDC_ldap1_server_object_modify(struct libnet_BecomeDC_state *s)
1438 {
1439         int ret;
1440         struct ldb_message *msg;
1441         unsigned int i;
1442
1443         /* make a 'modify' msg, and only for serverReference */
1444         msg = ldb_msg_new(s);
1445         NT_STATUS_HAVE_NO_MEMORY(msg);
1446         msg->dn = ldb_dn_new(msg, s->ldap1.ldb, s->dest_dsa.server_dn_str);
1447         NT_STATUS_HAVE_NO_MEMORY(msg->dn);
1448
1449         ret = ldb_msg_add_string(msg, "serverReference", s->dest_dsa.computer_dn_str);
1450         if (ret != 0) {
1451                 talloc_free(msg);
1452                 return NT_STATUS_NO_MEMORY;
1453         }
1454
1455         /* mark all the message elements (should be just one)
1456            as LDB_FLAG_MOD_ADD */
1457         for (i=0;i<msg->num_elements;i++) {
1458                 msg->elements[i].flags = LDB_FLAG_MOD_ADD;
1459         }
1460
1461         ret = ldb_modify(s->ldap1.ldb, msg);
1462         if (ret == LDB_SUCCESS) {
1463                 talloc_free(msg);
1464                 return NT_STATUS_OK;
1465         } else if (ret == LDB_ERR_ATTRIBUTE_OR_VALUE_EXISTS) {
1466                 /* retry with LDB_FLAG_MOD_REPLACE */
1467         } else {
1468                 talloc_free(msg);
1469                 return NT_STATUS_LDAP(ret);
1470         }
1471
1472         /* mark all the message elements (should be just one)
1473            as LDB_FLAG_MOD_REPLACE */
1474         for (i=0;i<msg->num_elements;i++) {
1475                 msg->elements[i].flags = LDB_FLAG_MOD_REPLACE;
1476         }
1477
1478         ret = ldb_modify(s->ldap1.ldb, msg);
1479         talloc_free(msg);
1480         if (ret != LDB_SUCCESS) {
1481                 return NT_STATUS_LDAP(ret);
1482         }
1483
1484         return NT_STATUS_OK;
1485 }
1486
1487 static void becomeDC_drsuapi_connect_send(struct libnet_BecomeDC_state *s,
1488                                           struct becomeDC_drsuapi *drsuapi,
1489                                           void (*recv_fn)(struct composite_context *req));
1490 static void becomeDC_drsuapi1_connect_recv(struct composite_context *req);
1491 static void becomeDC_connect_ldap2(struct libnet_BecomeDC_state *s);
1492
1493 static void becomeDC_connect_ldap1(struct libnet_BecomeDC_state *s)
1494 {
1495         struct composite_context *c = s->creq;
1496
1497         c->status = becomeDC_ldap_connect(s, &s->ldap1);
1498         if (!composite_is_ok(c)) return;
1499
1500         c->status = becomeDC_ldap1_rootdse(s);
1501         if (!composite_is_ok(c)) return;
1502
1503         c->status = becomeDC_ldap1_crossref_behavior_version(s);
1504         if (!composite_is_ok(c)) return;
1505
1506         c->status = becomeDC_ldap1_domain_behavior_version(s);
1507         if (!composite_is_ok(c)) return;
1508
1509         c->status = becomeDC_ldap1_schema_object_version(s);
1510         if (!composite_is_ok(c)) return;
1511
1512         c->status = becomeDC_ldap1_w2k3_update_revision(s);
1513         if (!composite_is_ok(c)) return;
1514
1515         c->status = becomeDC_ldap1_infrastructure_fsmo(s);
1516         if (!composite_is_ok(c)) return;
1517
1518         c->status = becomeDC_ldap1_rid_manager_fsmo(s);
1519         if (!composite_is_ok(c)) return;
1520
1521         c->status = becomeDC_ldap1_site_object(s);
1522         if (!composite_is_ok(c)) return;
1523
1524         c->status = becomeDC_check_options(s);
1525         if (!composite_is_ok(c)) return;
1526
1527         c->status = becomeDC_ldap1_computer_object(s);
1528         if (!composite_is_ok(c)) return;
1529
1530         c->status = becomeDC_ldap1_server_object_1(s);
1531         if (!composite_is_ok(c)) return;
1532
1533         c->status = becomeDC_ldap1_server_object_2(s);
1534         if (!composite_is_ok(c)) return;
1535
1536         c->status = becomeDC_ldap1_server_object_add(s);
1537         if (!composite_is_ok(c)) return;
1538
1539         c->status = becomeDC_ldap1_server_object_modify(s);
1540         if (!composite_is_ok(c)) return;
1541
1542         becomeDC_drsuapi_connect_send(s, &s->drsuapi1, becomeDC_drsuapi1_connect_recv);
1543 }
1544
1545 static void becomeDC_drsuapi_connect_send(struct libnet_BecomeDC_state *s,
1546                                           struct becomeDC_drsuapi *drsuapi,
1547                                           void (*recv_fn)(struct composite_context *req))
1548 {
1549         struct composite_context *c = s->creq;
1550         struct composite_context *creq;
1551         char *binding_str;
1552
1553         drsuapi->s = s;
1554
1555         if (!drsuapi->binding) {
1556                 const char *krb5_str = "";
1557                 const char *print_str = "";
1558                 /*
1559                  * Note: Replication only works with Windows 2000 when 'krb5' is
1560                  *       passed as auth_type here. If NTLMSSP is used, Windows
1561                  *       2000 returns garbage in the DsGetNCChanges() response
1562                  *       if encrypted password attributes would be in the
1563                  *       response. That means the replication of the schema and
1564                  *       configuration partition works fine, but it fails for
1565                  *       the domain partition.
1566                  */
1567                 if (lp_parm_bool(s->libnet->lp_ctx, NULL, "become_dc",
1568                                  "force krb5", true))
1569                 {
1570                         krb5_str = "krb5,";
1571                 }
1572                 if (lp_parm_bool(s->libnet->lp_ctx, NULL, "become_dc",
1573                                  "print", false))
1574                 {
1575                         print_str = "print,";
1576                 }
1577                 binding_str = talloc_asprintf(s, "ncacn_ip_tcp:%s[%s%sseal]",
1578                                               s->source_dsa.dns_name,
1579                                               krb5_str, print_str);
1580                 if (composite_nomem(binding_str, c)) return;
1581                 c->status = dcerpc_parse_binding(s, binding_str, &drsuapi->binding);
1582                 talloc_free(binding_str);
1583                 if (!composite_is_ok(c)) return;
1584         }
1585
1586         creq = dcerpc_pipe_connect_b_send(s, drsuapi->binding, &ndr_table_drsuapi,
1587                                           s->libnet->cred, s->libnet->event_ctx,
1588                                           s->libnet->lp_ctx);
1589         composite_continue(c, creq, recv_fn, s);
1590 }
1591
1592 static void becomeDC_drsuapi_bind_send(struct libnet_BecomeDC_state *s,
1593                                        struct becomeDC_drsuapi *drsuapi,
1594                                        void (*recv_fn)(struct tevent_req *subreq));
1595 static void becomeDC_drsuapi1_bind_recv(struct tevent_req *subreq);
1596
1597 static void becomeDC_drsuapi1_connect_recv(struct composite_context *req)
1598 {
1599         struct libnet_BecomeDC_state *s = talloc_get_type(req->async.private_data,
1600                                           struct libnet_BecomeDC_state);
1601         struct composite_context *c = s->creq;
1602
1603         c->status = dcerpc_pipe_connect_b_recv(req, s, &s->drsuapi1.pipe);
1604         if (!composite_is_ok(c)) return;
1605
1606         s->drsuapi1.drsuapi_handle = s->drsuapi1.pipe->binding_handle;
1607
1608         c->status = gensec_session_key(s->drsuapi1.pipe->conn->security_state.generic_state,
1609                                        &s->drsuapi1.gensec_skey);
1610         if (!composite_is_ok(c)) return;
1611
1612         becomeDC_drsuapi_bind_send(s, &s->drsuapi1, becomeDC_drsuapi1_bind_recv);
1613 }
1614
1615 static void becomeDC_drsuapi_bind_send(struct libnet_BecomeDC_state *s,
1616                                        struct becomeDC_drsuapi *drsuapi,
1617                                        void (*recv_fn)(struct tevent_req *subreq))
1618 {
1619         struct composite_context *c = s->creq;
1620         struct drsuapi_DsBindInfo28 *bind_info28;
1621         struct tevent_req *subreq;
1622
1623         GUID_from_string(DRSUAPI_DS_BIND_GUID_W2K3, &drsuapi->bind_guid);
1624
1625         bind_info28                             = &drsuapi->local_info28;
1626         bind_info28->supported_extensions       |= DRSUAPI_SUPPORTED_EXTENSION_BASE;
1627         bind_info28->supported_extensions       |= DRSUAPI_SUPPORTED_EXTENSION_ASYNC_REPLICATION;
1628         bind_info28->supported_extensions       |= DRSUAPI_SUPPORTED_EXTENSION_REMOVEAPI;
1629         bind_info28->supported_extensions       |= DRSUAPI_SUPPORTED_EXTENSION_MOVEREQ_V2;
1630         bind_info28->supported_extensions       |= DRSUAPI_SUPPORTED_EXTENSION_GETCHG_COMPRESS;
1631         bind_info28->supported_extensions       |= DRSUAPI_SUPPORTED_EXTENSION_DCINFO_V1;
1632         bind_info28->supported_extensions       |= DRSUAPI_SUPPORTED_EXTENSION_RESTORE_USN_OPTIMIZATION;
1633         bind_info28->supported_extensions       |= DRSUAPI_SUPPORTED_EXTENSION_KCC_EXECUTE;
1634         bind_info28->supported_extensions       |= DRSUAPI_SUPPORTED_EXTENSION_ADDENTRY_V2;
1635         if (s->domain.behavior_version >= DS_DOMAIN_FUNCTION_2003) {
1636                 /* TODO: find out how this is really triggered! */
1637                 bind_info28->supported_extensions       |= DRSUAPI_SUPPORTED_EXTENSION_LINKED_VALUE_REPLICATION;
1638         }
1639         bind_info28->supported_extensions       |= DRSUAPI_SUPPORTED_EXTENSION_DCINFO_V2;
1640         bind_info28->supported_extensions       |= DRSUAPI_SUPPORTED_EXTENSION_INSTANCE_TYPE_NOT_REQ_ON_MOD;
1641         bind_info28->supported_extensions       |= DRSUAPI_SUPPORTED_EXTENSION_CRYPTO_BIND;
1642         bind_info28->supported_extensions       |= DRSUAPI_SUPPORTED_EXTENSION_GET_REPL_INFO;
1643         bind_info28->supported_extensions       |= DRSUAPI_SUPPORTED_EXTENSION_STRONG_ENCRYPTION;
1644         bind_info28->supported_extensions       |= DRSUAPI_SUPPORTED_EXTENSION_DCINFO_V01;
1645         bind_info28->supported_extensions       |= DRSUAPI_SUPPORTED_EXTENSION_TRANSITIVE_MEMBERSHIP;
1646         bind_info28->supported_extensions       |= DRSUAPI_SUPPORTED_EXTENSION_ADD_SID_HISTORY;
1647         bind_info28->supported_extensions       |= DRSUAPI_SUPPORTED_EXTENSION_POST_BETA3;
1648         bind_info28->supported_extensions       |= DRSUAPI_SUPPORTED_EXTENSION_GETCHGREQ_V5;
1649         bind_info28->supported_extensions       |= DRSUAPI_SUPPORTED_EXTENSION_GET_MEMBERSHIPS2;
1650         bind_info28->supported_extensions       |= DRSUAPI_SUPPORTED_EXTENSION_GETCHGREQ_V6;
1651         bind_info28->supported_extensions       |= DRSUAPI_SUPPORTED_EXTENSION_NONDOMAIN_NCS;
1652         bind_info28->supported_extensions       |= DRSUAPI_SUPPORTED_EXTENSION_GETCHGREQ_V8;
1653         bind_info28->supported_extensions       |= DRSUAPI_SUPPORTED_EXTENSION_GETCHGREPLY_V5;
1654         bind_info28->supported_extensions       |= DRSUAPI_SUPPORTED_EXTENSION_GETCHGREPLY_V6;
1655         bind_info28->supported_extensions       |= DRSUAPI_SUPPORTED_EXTENSION_ADDENTRYREPLY_V3;
1656         bind_info28->supported_extensions       |= DRSUAPI_SUPPORTED_EXTENSION_GETCHGREPLY_V7;
1657         bind_info28->supported_extensions       |= DRSUAPI_SUPPORTED_EXTENSION_VERIFY_OBJECT;
1658 #if 0 /* we don't support XPRESS compression yet */
1659         bind_info28->supported_extensions       |= DRSUAPI_SUPPORTED_EXTENSION_XPRESS_COMPRESS;
1660 #endif
1661         bind_info28->site_guid                  = s->dest_dsa.site_guid;
1662         bind_info28->pid                        = 0;
1663         bind_info28->repl_epoch                 = 0;
1664
1665         drsuapi->bind_info_ctr.length           = 28;
1666         drsuapi->bind_info_ctr.info.info28      = *bind_info28;
1667
1668         drsuapi->bind_r.in.bind_guid = &drsuapi->bind_guid;
1669         drsuapi->bind_r.in.bind_info = &drsuapi->bind_info_ctr;
1670         drsuapi->bind_r.out.bind_handle = &drsuapi->bind_handle;
1671
1672         subreq = dcerpc_drsuapi_DsBind_r_send(s, c->event_ctx,
1673                                               drsuapi->drsuapi_handle,
1674                                               &drsuapi->bind_r);
1675         if (composite_nomem(subreq, c)) return;
1676         tevent_req_set_callback(subreq, recv_fn, s);
1677 }
1678
1679 static WERROR becomeDC_drsuapi_bind_recv(struct libnet_BecomeDC_state *s,
1680                                          struct becomeDC_drsuapi *drsuapi)
1681 {
1682         if (!W_ERROR_IS_OK(drsuapi->bind_r.out.result)) {
1683                 return drsuapi->bind_r.out.result;
1684         }
1685
1686         ZERO_STRUCT(drsuapi->remote_info28);
1687         if (drsuapi->bind_r.out.bind_info) {
1688                 switch (drsuapi->bind_r.out.bind_info->length) {
1689                 case 24: {
1690                         struct drsuapi_DsBindInfo24 *info24;
1691                         info24 = &drsuapi->bind_r.out.bind_info->info.info24;
1692                         drsuapi->remote_info28.supported_extensions     = info24->supported_extensions;
1693                         drsuapi->remote_info28.site_guid                = info24->site_guid;
1694                         drsuapi->remote_info28.pid                      = info24->pid;
1695                         drsuapi->remote_info28.repl_epoch               = 0;
1696                         break;
1697                 }
1698                 case 48: {
1699                         struct drsuapi_DsBindInfo48 *info48;
1700                         info48 = &drsuapi->bind_r.out.bind_info->info.info48;
1701                         drsuapi->remote_info28.supported_extensions     = info48->supported_extensions;
1702                         drsuapi->remote_info28.site_guid                = info48->site_guid;
1703                         drsuapi->remote_info28.pid                      = info48->pid;
1704                         drsuapi->remote_info28.repl_epoch               = info48->repl_epoch;
1705                         break;
1706                 }
1707                 case 28:
1708                         drsuapi->remote_info28 = drsuapi->bind_r.out.bind_info->info.info28;
1709                         break;
1710                 }
1711         }
1712
1713         return WERR_OK;
1714 }
1715
1716 static void becomeDC_drsuapi1_add_entry_send(struct libnet_BecomeDC_state *s);
1717
1718 static void becomeDC_drsuapi1_bind_recv(struct tevent_req *subreq)
1719 {
1720         struct libnet_BecomeDC_state *s = tevent_req_callback_data(subreq,
1721                                           struct libnet_BecomeDC_state);
1722         struct composite_context *c = s->creq;
1723         WERROR status;
1724
1725         c->status = dcerpc_drsuapi_DsBind_r_recv(subreq, s);
1726         TALLOC_FREE(subreq);
1727         if (!composite_is_ok(c)) return;
1728
1729         status = becomeDC_drsuapi_bind_recv(s, &s->drsuapi1);
1730         if (!W_ERROR_IS_OK(status)) {
1731                 composite_error(c, werror_to_ntstatus(status));
1732                 return;
1733         }
1734
1735         becomeDC_drsuapi1_add_entry_send(s);
1736 }
1737
1738 static void becomeDC_drsuapi1_add_entry_recv(struct tevent_req *subreq);
1739
1740 static void becomeDC_drsuapi1_add_entry_send(struct libnet_BecomeDC_state *s)
1741 {
1742         struct composite_context *c = s->creq;
1743         struct drsuapi_DsAddEntry *r;
1744         struct drsuapi_DsReplicaObjectIdentifier *identifier;
1745         uint32_t num_attrs, i = 0;
1746         struct drsuapi_DsReplicaAttribute *attrs;
1747         struct smb_iconv_convenience *iconv_convenience = lp_iconv_convenience(s->libnet->lp_ctx);
1748         enum ndr_err_code ndr_err;
1749         bool w2k3;
1750         struct tevent_req *subreq;
1751
1752         /* choose a random invocationId */
1753         s->dest_dsa.invocation_id = GUID_random();
1754
1755         /*
1756          * if the schema version indicates w2k3, then also send some w2k3
1757          * specific attributes.
1758          */
1759         if (s->forest.schema_object_version >= 30) {
1760                 w2k3 = true;
1761         } else {
1762                 w2k3 = false;
1763         }
1764
1765         r = talloc_zero(s, struct drsuapi_DsAddEntry);
1766         if (composite_nomem(r, c)) return;
1767
1768         /* setup identifier */
1769         identifier              = talloc(r, struct drsuapi_DsReplicaObjectIdentifier);
1770         if (composite_nomem(identifier, c)) return;
1771         identifier->guid        = GUID_zero();
1772         identifier->sid         = s->zero_sid;
1773         identifier->dn          = talloc_asprintf(identifier, "CN=NTDS Settings,%s",
1774                                                   s->dest_dsa.server_dn_str);
1775         if (composite_nomem(identifier->dn, c)) return;
1776
1777         /* allocate attribute array */
1778         num_attrs       = 12;
1779         attrs           = talloc_array(r, struct drsuapi_DsReplicaAttribute, num_attrs);
1780         if (composite_nomem(attrs, c)) return;
1781
1782         /* ntSecurityDescriptor */
1783         {
1784                 struct drsuapi_DsAttributeValue *vs;
1785                 DATA_BLOB *vd;
1786                 struct security_descriptor *v;
1787                 struct dom_sid *domain_admins_sid;
1788                 const char *domain_admins_sid_str;
1789
1790                 vs = talloc_array(attrs, struct drsuapi_DsAttributeValue, 1);
1791                 if (composite_nomem(vs, c)) return;
1792
1793                 vd = talloc_array(vs, DATA_BLOB, 1);
1794                 if (composite_nomem(vd, c)) return;
1795
1796                 domain_admins_sid = dom_sid_add_rid(vs, s->domain.sid, DOMAIN_RID_ADMINS);
1797                 if (composite_nomem(domain_admins_sid, c)) return;
1798
1799                 domain_admins_sid_str = dom_sid_string(domain_admins_sid, domain_admins_sid);
1800                 if (composite_nomem(domain_admins_sid_str, c)) return;
1801
1802                 v = security_descriptor_dacl_create(vd,
1803                                                0,
1804                                                /* owner: domain admins */
1805                                                domain_admins_sid_str,
1806                                                /* owner group: domain admins */
1807                                                domain_admins_sid_str,
1808                                                /* authenticated users */
1809                                                SID_NT_AUTHENTICATED_USERS,
1810                                                SEC_ACE_TYPE_ACCESS_ALLOWED,
1811                                                SEC_STD_READ_CONTROL |
1812                                                SEC_ADS_LIST |
1813                                                SEC_ADS_READ_PROP |
1814                                                SEC_ADS_LIST_OBJECT,
1815                                                0,
1816                                                /* domain admins */
1817                                                domain_admins_sid_str,
1818                                                SEC_ACE_TYPE_ACCESS_ALLOWED,
1819                                                SEC_STD_REQUIRED |
1820                                                SEC_ADS_CREATE_CHILD |
1821                                                SEC_ADS_LIST |
1822                                                SEC_ADS_SELF_WRITE |
1823                                                SEC_ADS_READ_PROP |
1824                                                SEC_ADS_WRITE_PROP |
1825                                                SEC_ADS_DELETE_TREE |
1826                                                SEC_ADS_LIST_OBJECT |
1827                                                SEC_ADS_CONTROL_ACCESS,
1828                                                0,
1829                                                /* system */
1830                                                SID_NT_SYSTEM,
1831                                                SEC_ACE_TYPE_ACCESS_ALLOWED,
1832                                                SEC_STD_REQUIRED |
1833                                                SEC_ADS_CREATE_CHILD |
1834                                                SEC_ADS_DELETE_CHILD |
1835                                                SEC_ADS_LIST |
1836                                                SEC_ADS_SELF_WRITE |
1837                                                SEC_ADS_READ_PROP |
1838                                                SEC_ADS_WRITE_PROP |
1839                                                SEC_ADS_DELETE_TREE |
1840                                                SEC_ADS_LIST_OBJECT |
1841                                                SEC_ADS_CONTROL_ACCESS,
1842                                                0,
1843                                                /* end */
1844                                                NULL);
1845                 if (composite_nomem(v, c)) return;
1846
1847                 ndr_err = ndr_push_struct_blob(&vd[0], vd, iconv_convenience, v,(ndr_push_flags_fn_t)ndr_push_security_descriptor);
1848                 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
1849                         c->status = ndr_map_error2ntstatus(ndr_err);
1850                         if (!composite_is_ok(c)) return;
1851                 }
1852
1853                 vs[0].blob              = &vd[0];
1854
1855                 attrs[i].attid                  = DRSUAPI_ATTRIBUTE_ntSecurityDescriptor;
1856                 attrs[i].value_ctr.num_values   = 1;
1857                 attrs[i].value_ctr.values       = vs;
1858
1859                 i++;
1860         }
1861
1862         /* objectClass: nTDSDSA */
1863         {
1864                 struct drsuapi_DsAttributeValue *vs;
1865                 DATA_BLOB *vd;
1866
1867                 vs = talloc_array(attrs, struct drsuapi_DsAttributeValue, 1);
1868                 if (composite_nomem(vs, c)) return;
1869
1870                 vd = talloc_array(vs, DATA_BLOB, 1);
1871                 if (composite_nomem(vd, c)) return;
1872
1873                 vd[0] = data_blob_talloc(vd, NULL, 4);
1874                 if (composite_nomem(vd[0].data, c)) return;
1875
1876                 /* value for nTDSDSA */
1877                 SIVAL(vd[0].data, 0, 0x0017002F);
1878
1879                 vs[0].blob              = &vd[0];
1880
1881                 attrs[i].attid                  = DRSUAPI_ATTRIBUTE_objectClass;
1882                 attrs[i].value_ctr.num_values   = 1;
1883                 attrs[i].value_ctr.values       = vs;
1884
1885                 i++;
1886         }
1887
1888         /* objectCategory: CN=NTDS-DSA,CN=Schema,... or CN=NTDS-DSA-RO,CN=Schema,... */
1889         {
1890                 struct drsuapi_DsAttributeValue *vs;
1891                 DATA_BLOB *vd;
1892                 struct drsuapi_DsReplicaObjectIdentifier3 v[1];
1893
1894                 vs = talloc_array(attrs, struct drsuapi_DsAttributeValue, 1);
1895                 if (composite_nomem(vs, c)) return;
1896
1897                 vd = talloc_array(vs, DATA_BLOB, 1);
1898                 if (composite_nomem(vd, c)) return;
1899
1900                 v[0].guid               = GUID_zero();
1901                 v[0].sid                = s->zero_sid;
1902
1903                 if (s->rodc_join) {
1904                     v[0].dn             = talloc_asprintf(vd, "CN=NTDS-DSA-RO,%s",
1905                                                           s->forest.schema_dn_str);
1906                 } else {
1907                     v[0].dn             = talloc_asprintf(vd, "CN=NTDS-DSA,%s",
1908                                                           s->forest.schema_dn_str);
1909                 }
1910                 if (composite_nomem(v[0].dn, c)) return;
1911
1912                 ndr_err = ndr_push_struct_blob(&vd[0], vd, iconv_convenience, &v[0],
1913                                                (ndr_push_flags_fn_t)ndr_push_drsuapi_DsReplicaObjectIdentifier3);
1914                 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
1915                         c->status = ndr_map_error2ntstatus(ndr_err);
1916                         if (!composite_is_ok(c)) return;
1917                 }
1918
1919                 vs[0].blob              = &vd[0];
1920
1921                 attrs[i].attid                  = DRSUAPI_ATTRIBUTE_objectCategory;
1922                 attrs[i].value_ctr.num_values   = 1;
1923                 attrs[i].value_ctr.values       = vs;
1924
1925                 i++;
1926         }
1927
1928         /* invocationId: random guid */
1929         {
1930                 struct drsuapi_DsAttributeValue *vs;
1931                 DATA_BLOB *vd;
1932                 const struct GUID *v;
1933
1934                 vs = talloc_array(attrs, struct drsuapi_DsAttributeValue, 1);
1935                 if (composite_nomem(vs, c)) return;
1936
1937                 vd = talloc_array(vs, DATA_BLOB, 1);
1938                 if (composite_nomem(vd, c)) return;
1939
1940                 v = &s->dest_dsa.invocation_id;
1941
1942                 c->status = GUID_to_ndr_blob(v, vd, &vd[0]);
1943                 if (!composite_is_ok(c)) return;
1944
1945                 vs[0].blob              = &vd[0];
1946
1947                 attrs[i].attid                  = DRSUAPI_ATTRIBUTE_invocationId;
1948                 attrs[i].value_ctr.num_values   = 1;
1949                 attrs[i].value_ctr.values       = vs;
1950
1951                 i++;
1952         }
1953
1954         /* hasMasterNCs: ... */
1955         {
1956                 struct drsuapi_DsAttributeValue *vs;
1957                 DATA_BLOB *vd;
1958                 struct drsuapi_DsReplicaObjectIdentifier3 v[3];
1959
1960                 vs = talloc_array(attrs, struct drsuapi_DsAttributeValue, 3);
1961                 if (composite_nomem(vs, c)) return;
1962
1963                 vd = talloc_array(vs, DATA_BLOB, 3);
1964                 if (composite_nomem(vd, c)) return;
1965
1966                 v[0].guid               = GUID_zero();
1967                 v[0].sid                = s->zero_sid;
1968                 v[0].dn                 = s->forest.config_dn_str;
1969
1970                 v[1].guid               = GUID_zero();
1971                 v[1].sid                = s->zero_sid;
1972                 v[1].dn                 = s->domain.dn_str;
1973
1974                 v[2].guid               = GUID_zero();
1975                 v[2].sid                = s->zero_sid;
1976                 v[2].dn                 = s->forest.schema_dn_str;
1977
1978                 ndr_err = ndr_push_struct_blob(&vd[0], vd, iconv_convenience, &v[0],
1979                                                (ndr_push_flags_fn_t)ndr_push_drsuapi_DsReplicaObjectIdentifier3);
1980                 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
1981                         c->status = ndr_map_error2ntstatus(ndr_err);
1982                         if (!composite_is_ok(c)) return;
1983                 }
1984
1985                 ndr_err = ndr_push_struct_blob(&vd[1], vd, iconv_convenience, &v[1],
1986                                                (ndr_push_flags_fn_t)ndr_push_drsuapi_DsReplicaObjectIdentifier3);
1987                 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
1988                         c->status = ndr_map_error2ntstatus(ndr_err);
1989                         if (!composite_is_ok(c)) return;
1990                 }
1991
1992                 ndr_err = ndr_push_struct_blob(&vd[2], vd, iconv_convenience, &v[2],
1993                                                (ndr_push_flags_fn_t)ndr_push_drsuapi_DsReplicaObjectIdentifier3);
1994                 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
1995                         c->status = ndr_map_error2ntstatus(ndr_err);
1996                         if (!composite_is_ok(c)) return;
1997                 }
1998
1999                 vs[0].blob              = &vd[0];
2000                 vs[1].blob              = &vd[1];
2001                 vs[2].blob              = &vd[2];
2002
2003                 attrs[i].attid                  = DRSUAPI_ATTRIBUTE_hasMasterNCs;
2004                 attrs[i].value_ctr.num_values   = 3;
2005                 attrs[i].value_ctr.values       = vs;
2006
2007                 i++;
2008         }
2009
2010         /* msDS-hasMasterNCs: ... */
2011         if (w2k3) {
2012                 struct drsuapi_DsAttributeValue *vs;
2013                 DATA_BLOB *vd;
2014                 struct drsuapi_DsReplicaObjectIdentifier3 v[3];
2015
2016                 vs = talloc_array(attrs, struct drsuapi_DsAttributeValue, 3);
2017                 if (composite_nomem(vs, c)) return;
2018
2019                 vd = talloc_array(vs, DATA_BLOB, 3);
2020                 if (composite_nomem(vd, c)) return;
2021
2022                 v[0].guid               = GUID_zero();
2023                 v[0].sid                = s->zero_sid;
2024                 v[0].dn                 = s->forest.config_dn_str;
2025
2026                 v[1].guid               = GUID_zero();
2027                 v[1].sid                = s->zero_sid;
2028                 v[1].dn                 = s->domain.dn_str;
2029
2030                 v[2].guid               = GUID_zero();
2031                 v[2].sid                = s->zero_sid;
2032                 v[2].dn                 = s->forest.schema_dn_str;
2033
2034                 ndr_err = ndr_push_struct_blob(&vd[0], vd, iconv_convenience, &v[0],
2035                                                (ndr_push_flags_fn_t)ndr_push_drsuapi_DsReplicaObjectIdentifier3);
2036                 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
2037                         c->status = ndr_map_error2ntstatus(ndr_err);
2038                         if (!composite_is_ok(c)) return;
2039                 }
2040
2041                 ndr_err = ndr_push_struct_blob(&vd[1], vd, iconv_convenience, &v[1],
2042                                                (ndr_push_flags_fn_t)ndr_push_drsuapi_DsReplicaObjectIdentifier3);
2043                 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
2044                         c->status = ndr_map_error2ntstatus(ndr_err);
2045                         if (!composite_is_ok(c)) return;
2046                 }
2047
2048                 ndr_err = ndr_push_struct_blob(&vd[2], vd, iconv_convenience, &v[2],
2049                                                (ndr_push_flags_fn_t)ndr_push_drsuapi_DsReplicaObjectIdentifier3);
2050                 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
2051                         c->status = ndr_map_error2ntstatus(ndr_err);
2052                         if (!composite_is_ok(c)) return;
2053                 }
2054
2055                 vs[0].blob              = &vd[0];
2056                 vs[1].blob              = &vd[1];
2057                 vs[2].blob              = &vd[2];
2058
2059                 attrs[i].attid                  = DRSUAPI_ATTRIBUTE_msDS_hasMasterNCs;
2060                 attrs[i].value_ctr.num_values   = 3;
2061                 attrs[i].value_ctr.values       = vs;
2062
2063                 i++;
2064         }
2065
2066         /* dMDLocation: CN=Schema,... */
2067         {
2068                 struct drsuapi_DsAttributeValue *vs;
2069                 DATA_BLOB *vd;
2070                 struct drsuapi_DsReplicaObjectIdentifier3 v[1];
2071
2072                 vs = talloc_array(attrs, struct drsuapi_DsAttributeValue, 1);
2073                 if (composite_nomem(vs, c)) return;
2074
2075                 vd = talloc_array(vs, DATA_BLOB, 1);
2076                 if (composite_nomem(vd, c)) return;
2077
2078                 v[0].guid               = GUID_zero();
2079                 v[0].sid                = s->zero_sid;
2080                 v[0].dn                 = s->forest.schema_dn_str;
2081
2082                 ndr_err = ndr_push_struct_blob(&vd[0], vd, iconv_convenience, &v[0],
2083                                                (ndr_push_flags_fn_t)ndr_push_drsuapi_DsReplicaObjectIdentifier3);
2084                 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
2085                         c->status = ndr_map_error2ntstatus(ndr_err);
2086                         if (!composite_is_ok(c)) return;
2087                 }
2088
2089                 vs[0].blob              = &vd[0];
2090
2091                 attrs[i].attid                  = DRSUAPI_ATTRIBUTE_dMDLocation;
2092                 attrs[i].value_ctr.num_values   = 1;
2093                 attrs[i].value_ctr.values       = vs;
2094
2095                 i++;
2096         }
2097
2098         /* msDS-HasDomainNCs: <domain_partition> */
2099         if (w2k3) {
2100                 struct drsuapi_DsAttributeValue *vs;
2101                 DATA_BLOB *vd;
2102                 struct drsuapi_DsReplicaObjectIdentifier3 v[1];
2103
2104                 vs = talloc_array(attrs, struct drsuapi_DsAttributeValue, 1);
2105                 if (composite_nomem(vs, c)) return;
2106
2107                 vd = talloc_array(vs, DATA_BLOB, 1);
2108                 if (composite_nomem(vd, c)) return;
2109
2110                 v[0].guid               = GUID_zero();
2111                 v[0].sid                = s->zero_sid;
2112                 v[0].dn                 = s->domain.dn_str;
2113
2114                 ndr_err = ndr_push_struct_blob(&vd[0], vd, iconv_convenience, &v[0],
2115                                                (ndr_push_flags_fn_t)ndr_push_drsuapi_DsReplicaObjectIdentifier3);
2116                 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
2117                         c->status = ndr_map_error2ntstatus(ndr_err);
2118                         if (!composite_is_ok(c)) return;
2119                 }
2120
2121                 vs[0].blob              = &vd[0];
2122
2123                 attrs[i].attid                  = DRSUAPI_ATTRIBUTE_msDS_HasDomainNCs;
2124                 attrs[i].value_ctr.num_values   = 1;
2125                 attrs[i].value_ctr.values       = vs;
2126
2127                 i++;
2128         }
2129
2130         /* msDS-Behavior-Version */
2131         if (w2k3) {
2132                 struct drsuapi_DsAttributeValue *vs;
2133                 DATA_BLOB *vd;
2134
2135                 vs = talloc_array(attrs, struct drsuapi_DsAttributeValue, 1);
2136                 if (composite_nomem(vs, c)) return;
2137
2138                 vd = talloc_array(vs, DATA_BLOB, 1);
2139                 if (composite_nomem(vd, c)) return;
2140
2141                 vd[0] = data_blob_talloc(vd, NULL, 4);
2142                 if (composite_nomem(vd[0].data, c)) return;
2143
2144                 SIVAL(vd[0].data, 0, get_dc_function_level(s->libnet->lp_ctx));
2145
2146                 vs[0].blob              = &vd[0];
2147
2148                 attrs[i].attid                  = DRSUAPI_ATTRIBUTE_msDS_Behavior_Version;
2149                 attrs[i].value_ctr.num_values   = 1;
2150                 attrs[i].value_ctr.values       = vs;
2151
2152                 i++;
2153         }
2154
2155         /* systemFlags */
2156         {
2157                 struct drsuapi_DsAttributeValue *vs;
2158                 DATA_BLOB *vd;
2159
2160                 vs = talloc_array(attrs, struct drsuapi_DsAttributeValue, 1);
2161                 if (composite_nomem(vs, c)) return;
2162
2163                 vd = talloc_array(vs, DATA_BLOB, 1);
2164                 if (composite_nomem(vd, c)) return;
2165
2166                 vd[0] = data_blob_talloc(vd, NULL, 4);
2167                 if (composite_nomem(vd[0].data, c)) return;
2168
2169                 if (s->rodc_join) {
2170                     SIVAL(vd[0].data, 0, SYSTEM_FLAG_CONFIG_ALLOW_RENAME);
2171                 } else {
2172                     SIVAL(vd[0].data, 0, SYSTEM_FLAG_DISALLOW_MOVE_ON_DELETE);
2173                 }
2174
2175                 vs[0].blob              = &vd[0];
2176
2177                 attrs[i].attid                  = DRSUAPI_ATTRIBUTE_systemFlags;
2178                 attrs[i].value_ctr.num_values   = 1;
2179                 attrs[i].value_ctr.values       = vs;
2180
2181                 i++;
2182         }
2183
2184         /* serverReference: ... */
2185         {
2186                 struct drsuapi_DsAttributeValue *vs;
2187                 DATA_BLOB *vd;
2188                 struct drsuapi_DsReplicaObjectIdentifier3 v[1];
2189
2190                 vs = talloc_array(attrs, struct drsuapi_DsAttributeValue, 1);
2191                 if (composite_nomem(vs, c)) return;
2192
2193                 vd = talloc_array(vs, DATA_BLOB, 1);
2194                 if (composite_nomem(vd, c)) return;
2195
2196                 v[0].guid               = GUID_zero();
2197                 v[0].sid                = s->zero_sid;
2198                 v[0].dn                 = s->dest_dsa.computer_dn_str;
2199
2200                 ndr_err = ndr_push_struct_blob(&vd[0], vd, iconv_convenience, &v[0],
2201                                                (ndr_push_flags_fn_t)ndr_push_drsuapi_DsReplicaObjectIdentifier3);
2202                 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
2203                         c->status = ndr_map_error2ntstatus(ndr_err);
2204                         if (!composite_is_ok(c)) return;
2205                 }
2206
2207                 vs[0].blob              = &vd[0];
2208
2209                 attrs[i].attid                  = DRSUAPI_ATTRIBUTE_serverReference;
2210                 attrs[i].value_ctr.num_values   = 1;
2211                 attrs[i].value_ctr.values       = vs;
2212
2213                 i++;
2214         }
2215
2216         /* options:... */
2217         if (s->rodc_join) {
2218                 struct drsuapi_DsAttributeValue *vs;
2219                 DATA_BLOB *vd;
2220
2221                 vs = talloc_array(attrs, struct drsuapi_DsAttributeValue, 1);
2222                 if (composite_nomem(vs, c)) return;
2223
2224                 vd = talloc_array(vs, DATA_BLOB, 1);
2225                 if (composite_nomem(vd, c)) return;
2226
2227                 vd[0] = data_blob_talloc(vd, NULL, 4);
2228                 if (composite_nomem(vd[0].data, c)) return;
2229
2230                 SIVAL(vd[0].data, 0, DS_NTDSDSA_OPT_DISABLE_OUTBOUND_REPL);
2231
2232                 vs[0].blob              = &vd[0];
2233
2234                 attrs[i].attid                  = DRSUAPI_ATTRIBUTE_options;
2235                 attrs[i].value_ctr.num_values   = 1;
2236                 attrs[i].value_ctr.values       = vs;
2237
2238                 i++;
2239         }
2240
2241         /* truncate the attribute list to the attribute count we have filled in */
2242         num_attrs = i;
2243
2244         /* setup request structure */
2245         r->in.bind_handle                                               = &s->drsuapi1.bind_handle;
2246         r->in.level                                                     = 2;
2247         r->in.req                                                       = talloc(s, union drsuapi_DsAddEntryRequest);
2248         r->in.req->req2.first_object.next_object                        = NULL;
2249         r->in.req->req2.first_object.object.identifier                  = identifier;
2250         r->in.req->req2.first_object.object.flags                       = 0x00000000;
2251         r->in.req->req2.first_object.object.attribute_ctr.num_attributes= num_attrs;
2252         r->in.req->req2.first_object.object.attribute_ctr.attributes    = attrs;
2253
2254         r->out.level_out        = talloc(s, uint32_t);
2255         r->out.ctr              = talloc(s, union drsuapi_DsAddEntryCtr);
2256
2257         s->ndr_struct_ptr = r;
2258         subreq = dcerpc_drsuapi_DsAddEntry_r_send(s, c->event_ctx,
2259                                                   s->drsuapi1.drsuapi_handle, r);
2260         if (composite_nomem(subreq, c)) return;
2261         tevent_req_set_callback(subreq, becomeDC_drsuapi1_add_entry_recv, s);
2262 }
2263
2264 static void becomeDC_drsuapi2_connect_recv(struct composite_context *req);
2265 static NTSTATUS becomeDC_prepare_db(struct libnet_BecomeDC_state *s);
2266
2267 static void becomeDC_drsuapi1_add_entry_recv(struct tevent_req *subreq)
2268 {
2269         struct libnet_BecomeDC_state *s = tevent_req_callback_data(subreq,
2270                                           struct libnet_BecomeDC_state);
2271         struct composite_context *c = s->creq;
2272         struct drsuapi_DsAddEntry *r = talloc_get_type_abort(s->ndr_struct_ptr,
2273                                        struct drsuapi_DsAddEntry);
2274         char *binding_str;
2275
2276         s->ndr_struct_ptr = NULL;
2277
2278         c->status = dcerpc_drsuapi_DsAddEntry_r_recv(subreq, r);
2279         TALLOC_FREE(subreq);
2280         if (!composite_is_ok(c)) return;
2281
2282         if (!W_ERROR_IS_OK(r->out.result)) {
2283                 composite_error(c, werror_to_ntstatus(r->out.result));
2284                 return;
2285         }
2286
2287         if (*r->out.level_out == 3) {
2288                 if (r->out.ctr->ctr3.count != 1) {
2289                         WERROR status;
2290
2291                         if (r->out.ctr->ctr3.level != 1) {
2292                                 composite_error(c, NT_STATUS_INVALID_NETWORK_RESPONSE);
2293                                 return;
2294                         }
2295
2296                         if (!r->out.ctr->ctr3.error) {
2297                                 composite_error(c, NT_STATUS_INVALID_NETWORK_RESPONSE);
2298                                 return;
2299                         }
2300
2301                         status = r->out.ctr->ctr3.error->info1.status;
2302
2303                         if (!r->out.ctr->ctr3.error->info1.info) {
2304                                 composite_error(c, werror_to_ntstatus(status));
2305                                 return;
2306                         }
2307
2308                         /* see if we can get a more detailed error */
2309                         switch (r->out.ctr->ctr3.error->info1.level) {
2310                         case 1:
2311                                 status = r->out.ctr->ctr3.error->info1.info->error1.status;
2312                                 break;
2313                         case 4:
2314                         case 5:
2315                         case 6:
2316                         case 7:
2317                                 status = r->out.ctr->ctr3.error->info1.info->errorX.extended_err;
2318                                 break;
2319                         }
2320
2321                         composite_error(c, werror_to_ntstatus(status));
2322                         return;
2323                 }
2324
2325                 s->dest_dsa.ntds_guid   = r->out.ctr->ctr3.objects[0].guid;
2326         } else if (*r->out.level_out == 2) {
2327                 if (DRSUAPI_DIRERR_OK != r->out.ctr->ctr2.dir_err) {
2328                         DEBUG(0,("DsAddEntry failed with: dir_err = %d, extended_err = %s",
2329                                  r->out.ctr->ctr2.dir_err,
2330                                  win_errstr(r->out.ctr->ctr2.extended_err)));
2331                         composite_error(c, werror_to_ntstatus(r->out.ctr->ctr2.extended_err));
2332                         return;
2333                 }
2334
2335                 if (1 != r->out.ctr->ctr2.count) {
2336                         DEBUG(0,("DsAddEntry: something very wrong had happened - "
2337                                  "method succeeded but objects returned are %d (expected 1). "
2338                                  "Errors: dir_err = %d, extended_err = %s",
2339                                  r->out.ctr->ctr2.count,
2340                                  r->out.ctr->ctr2.dir_err,
2341                                  win_errstr(r->out.ctr->ctr2.extended_err)));
2342                         composite_error(c, NT_STATUS_INVALID_NETWORK_RESPONSE);
2343                 }
2344
2345                 s->dest_dsa.ntds_guid   = r->out.ctr->ctr2.objects[0].guid;
2346         } else {
2347                 composite_error(c, NT_STATUS_INVALID_NETWORK_RESPONSE);
2348                 return;
2349         }
2350
2351         talloc_free(r);
2352
2353         s->dest_dsa.ntds_dn_str = talloc_asprintf(s, "CN=NTDS Settings,%s",
2354                                                   s->dest_dsa.server_dn_str);
2355         if (composite_nomem(s->dest_dsa.ntds_dn_str, c)) return;
2356
2357         c->status = becomeDC_prepare_db(s);
2358         if (!composite_is_ok(c)) return;
2359
2360         /* this avoids the epmapper lookup on the 2nd connection */
2361         binding_str = dcerpc_binding_string(s, s->drsuapi1.binding);
2362         if (composite_nomem(binding_str, c)) return;
2363
2364         c->status = dcerpc_parse_binding(s, binding_str, &s->drsuapi2.binding);
2365         talloc_free(binding_str);
2366         if (!composite_is_ok(c)) return;
2367
2368         /* w2k3 uses the same assoc_group_id as on the first connection, so we do */
2369         s->drsuapi2.binding->assoc_group_id     = s->drsuapi1.pipe->assoc_group_id;
2370
2371         becomeDC_drsuapi_connect_send(s, &s->drsuapi2, becomeDC_drsuapi2_connect_recv);
2372 }
2373
2374 static NTSTATUS becomeDC_prepare_db(struct libnet_BecomeDC_state *s)
2375 {
2376         if (!s->callbacks.prepare_db) return NT_STATUS_OK;
2377
2378         s->_pp.domain           = &s->domain;
2379         s->_pp.forest           = &s->forest;
2380         s->_pp.source_dsa       = &s->source_dsa;
2381         s->_pp.dest_dsa         = &s->dest_dsa;
2382
2383         return s->callbacks.prepare_db(s->callbacks.private_data, &s->_pp);
2384 }
2385
2386 static void becomeDC_drsuapi2_bind_recv(struct tevent_req *subreq);
2387
2388 static void becomeDC_drsuapi2_connect_recv(struct composite_context *req)
2389 {
2390         struct libnet_BecomeDC_state *s = talloc_get_type(req->async.private_data,
2391                                           struct libnet_BecomeDC_state);
2392         struct composite_context *c = s->creq;
2393
2394         c->status = dcerpc_pipe_connect_b_recv(req, s, &s->drsuapi2.pipe);
2395         if (!composite_is_ok(c)) return;
2396
2397         s->drsuapi2.drsuapi_handle = s->drsuapi2.pipe->binding_handle;
2398
2399         c->status = gensec_session_key(s->drsuapi2.pipe->conn->security_state.generic_state,
2400                                        &s->drsuapi2.gensec_skey);
2401         if (!composite_is_ok(c)) return;
2402
2403         becomeDC_drsuapi_bind_send(s, &s->drsuapi2, becomeDC_drsuapi2_bind_recv);
2404 }
2405
2406 static void becomeDC_drsuapi3_connect_recv(struct composite_context *req);
2407
2408 static void becomeDC_drsuapi2_bind_recv(struct tevent_req *subreq)
2409 {
2410         struct libnet_BecomeDC_state *s = tevent_req_callback_data(subreq,
2411                                           struct libnet_BecomeDC_state);
2412         struct composite_context *c = s->creq;
2413         char *binding_str;
2414         WERROR status;
2415
2416         c->status = dcerpc_drsuapi_DsBind_r_recv(subreq, s);
2417         TALLOC_FREE(subreq);
2418         if (!composite_is_ok(c)) return;
2419
2420         status = becomeDC_drsuapi_bind_recv(s, &s->drsuapi2);
2421         if (!W_ERROR_IS_OK(status)) {
2422                 composite_error(c, werror_to_ntstatus(status));
2423                 return;
2424         }
2425
2426         /* this avoids the epmapper lookup on the 3rd connection */
2427         binding_str = dcerpc_binding_string(s, s->drsuapi1.binding);
2428         if (composite_nomem(binding_str, c)) return;
2429
2430         c->status = dcerpc_parse_binding(s, binding_str, &s->drsuapi3.binding);
2431         talloc_free(binding_str);
2432         if (!composite_is_ok(c)) return;
2433
2434         /* w2k3 uses the same assoc_group_id as on the first connection, so we do */
2435         s->drsuapi3.binding->assoc_group_id     = s->drsuapi1.pipe->assoc_group_id;
2436         /* w2k3 uses the concurrent multiplex feature on the 3rd connection, so we do */
2437         s->drsuapi3.binding->flags              |= DCERPC_CONCURRENT_MULTIPLEX;
2438
2439         becomeDC_drsuapi_connect_send(s, &s->drsuapi3, becomeDC_drsuapi3_connect_recv);
2440 }
2441
2442 static void becomeDC_drsuapi3_pull_schema_send(struct libnet_BecomeDC_state *s);
2443
2444 static void becomeDC_drsuapi3_connect_recv(struct composite_context *req)
2445 {
2446         struct libnet_BecomeDC_state *s = talloc_get_type(req->async.private_data,
2447                                           struct libnet_BecomeDC_state);
2448         struct composite_context *c = s->creq;
2449
2450         c->status = dcerpc_pipe_connect_b_recv(req, s, &s->drsuapi3.pipe);
2451         if (!composite_is_ok(c)) return;
2452
2453         s->drsuapi3.drsuapi_handle = s->drsuapi3.pipe->binding_handle;
2454
2455         c->status = gensec_session_key(s->drsuapi3.pipe->conn->security_state.generic_state,
2456                                        &s->drsuapi3.gensec_skey);
2457         if (!composite_is_ok(c)) return;
2458
2459         becomeDC_drsuapi3_pull_schema_send(s);
2460 }
2461
2462 static void becomeDC_drsuapi_pull_partition_send(struct libnet_BecomeDC_state *s,
2463                                                  struct becomeDC_drsuapi *drsuapi_h,
2464                                                  struct becomeDC_drsuapi *drsuapi_p,
2465                                                  struct libnet_BecomeDC_Partition *partition,
2466                                                  void (*recv_fn)(struct tevent_req *subreq))
2467 {
2468         struct composite_context *c = s->creq;
2469         struct drsuapi_DsGetNCChanges *r;
2470         struct tevent_req *subreq;
2471
2472         r = talloc(s, struct drsuapi_DsGetNCChanges);
2473         if (composite_nomem(r, c)) return;
2474
2475         r->out.level_out = talloc(r, uint32_t);
2476         if (composite_nomem(r->out.level_out, c)) return;
2477         r->in.req = talloc(r, union drsuapi_DsGetNCChangesRequest);
2478         if (composite_nomem(r->in.req, c)) return;
2479         r->out.ctr = talloc(r, union drsuapi_DsGetNCChangesCtr);
2480         if (composite_nomem(r->out.ctr, c)) return;
2481
2482         r->in.bind_handle       = &drsuapi_h->bind_handle;
2483         if (drsuapi_h->remote_info28.supported_extensions & DRSUAPI_SUPPORTED_EXTENSION_GETCHGREQ_V8) {
2484                 r->in.level                             = 8;
2485                 r->in.req->req8.destination_dsa_guid    = partition->destination_dsa_guid;
2486                 r->in.req->req8.source_dsa_invocation_id= partition->source_dsa_invocation_id;
2487                 r->in.req->req8.naming_context          = &partition->nc;
2488                 r->in.req->req8.highwatermark           = partition->highwatermark;
2489                 r->in.req->req8.uptodateness_vector     = NULL;
2490                 r->in.req->req8.replica_flags           = partition->replica_flags;
2491                 r->in.req->req8.max_object_count        = 133;
2492                 r->in.req->req8.max_ndr_size            = 1336811;
2493                 r->in.req->req8.extended_op             = DRSUAPI_EXOP_NONE;
2494                 r->in.req->req8.fsmo_info               = 0;
2495                 r->in.req->req8.partial_attribute_set   = NULL;
2496                 r->in.req->req8.partial_attribute_set_ex= NULL;
2497                 r->in.req->req8.mapping_ctr.num_mappings= 0;
2498                 r->in.req->req8.mapping_ctr.mappings    = NULL;
2499         } else {
2500                 r->in.level                             = 5;
2501                 r->in.req->req5.destination_dsa_guid    = partition->destination_dsa_guid;
2502                 r->in.req->req5.source_dsa_invocation_id= partition->source_dsa_invocation_id;
2503                 r->in.req->req5.naming_context          = &partition->nc;
2504                 r->in.req->req5.highwatermark           = partition->highwatermark;
2505                 r->in.req->req5.uptodateness_vector     = NULL;
2506                 r->in.req->req5.replica_flags           = partition->replica_flags;
2507                 r->in.req->req5.max_object_count        = 133;
2508                 r->in.req->req5.max_ndr_size            = 1336770;
2509                 r->in.req->req5.extended_op             = DRSUAPI_EXOP_NONE;
2510                 r->in.req->req5.fsmo_info               = 0;
2511         }
2512
2513         /*
2514          * we should try to use the drsuapi_p->pipe here, as w2k3 does
2515          * but it seems that some extra flags in the DCERPC Bind call
2516          * are needed for it. Or the same KRB5 TGS is needed on both
2517          * connections.
2518          */
2519         s->ndr_struct_ptr = r;
2520         subreq = dcerpc_drsuapi_DsGetNCChanges_r_send(s, c->event_ctx,
2521                                                       drsuapi_p->drsuapi_handle,
2522                                                       r);
2523         if (composite_nomem(subreq, c)) return;
2524         tevent_req_set_callback(subreq, recv_fn, s);
2525 }
2526
2527 static WERROR becomeDC_drsuapi_pull_partition_recv(struct libnet_BecomeDC_state *s,
2528                                                    struct becomeDC_drsuapi *drsuapi_h,
2529                                                    struct becomeDC_drsuapi *drsuapi_p,
2530                                                    struct libnet_BecomeDC_Partition *partition,
2531                                                    struct drsuapi_DsGetNCChanges *r)
2532 {
2533         uint32_t ctr_level = 0;
2534         struct drsuapi_DsGetNCChangesCtr1 *ctr1 = NULL;
2535         struct drsuapi_DsGetNCChangesCtr6 *ctr6 = NULL;
2536         struct GUID *source_dsa_guid = NULL;
2537         struct GUID *source_dsa_invocation_id = NULL;
2538         struct drsuapi_DsReplicaHighWaterMark *new_highwatermark = NULL;
2539         bool more_data = false;
2540         NTSTATUS nt_status;
2541
2542         if (!W_ERROR_IS_OK(r->out.result)) {
2543                 return r->out.result;
2544         }
2545
2546         if (*r->out.level_out == 1) {
2547                 ctr_level = 1;
2548                 ctr1 = &r->out.ctr->ctr1;
2549         } else if (*r->out.level_out == 2 &&
2550                    r->out.ctr->ctr2.mszip1.ts) {
2551                 ctr_level = 1;
2552                 ctr1 = &r->out.ctr->ctr2.mszip1.ts->ctr1;
2553         } else if (*r->out.level_out == 6) {
2554                 ctr_level = 6;
2555                 ctr6 = &r->out.ctr->ctr6;
2556         } else if (*r->out.level_out == 7 &&
2557                    r->out.ctr->ctr7.level == 6 &&
2558                    r->out.ctr->ctr7.type == DRSUAPI_COMPRESSION_TYPE_MSZIP &&
2559                    r->out.ctr->ctr7.ctr.mszip6.ts) {
2560                 ctr_level = 6;
2561                 ctr6 = &r->out.ctr->ctr7.ctr.mszip6.ts->ctr6;
2562         } else if (*r->out.level_out == 7 &&
2563                    r->out.ctr->ctr7.level == 6 &&
2564                    r->out.ctr->ctr7.type == DRSUAPI_COMPRESSION_TYPE_XPRESS &&
2565                    r->out.ctr->ctr7.ctr.xpress6.ts) {
2566                 ctr_level = 6;
2567                 ctr6 = &r->out.ctr->ctr7.ctr.xpress6.ts->ctr6;
2568         } else {
2569                 return WERR_BAD_NET_RESP;
2570         }
2571
2572         if (!ctr1 && ! ctr6) {
2573                 return WERR_BAD_NET_RESP;
2574         }
2575
2576         if (ctr_level == 6) {
2577                 if (!W_ERROR_IS_OK(ctr6->drs_error)) {
2578                         return ctr6->drs_error;
2579                 }
2580         }
2581
2582         switch (ctr_level) {
2583         case 1:
2584                 source_dsa_guid                 = &ctr1->source_dsa_guid;
2585                 source_dsa_invocation_id        = &ctr1->source_dsa_invocation_id;
2586                 new_highwatermark               = &ctr1->new_highwatermark;
2587                 more_data                       = ctr1->more_data;
2588                 break;
2589         case 6:
2590                 source_dsa_guid                 = &ctr6->source_dsa_guid;
2591                 source_dsa_invocation_id        = &ctr6->source_dsa_invocation_id;
2592                 new_highwatermark               = &ctr6->new_highwatermark;
2593                 more_data                       = ctr6->more_data;
2594                 break;
2595         }
2596
2597         partition->highwatermark                = *new_highwatermark;
2598         partition->source_dsa_guid              = *source_dsa_guid;
2599         partition->source_dsa_invocation_id     = *source_dsa_invocation_id;
2600         partition->more_data                    = more_data;
2601
2602         if (!partition->store_chunk) return WERR_OK;
2603
2604         s->_sc.domain           = &s->domain;
2605         s->_sc.forest           = &s->forest;
2606         s->_sc.source_dsa       = &s->source_dsa;
2607         s->_sc.dest_dsa         = &s->dest_dsa;
2608         s->_sc.partition        = partition;
2609         s->_sc.ctr_level        = ctr_level;
2610         s->_sc.ctr1             = ctr1;
2611         s->_sc.ctr6             = ctr6;
2612         /*
2613          * we need to use the drsuapi_p->gensec_skey here,
2614          * when we use drsuapi_p->pipe in the for this request
2615          */
2616         s->_sc.gensec_skey      = &drsuapi_p->gensec_skey;
2617
2618         nt_status = partition->store_chunk(s->callbacks.private_data, &s->_sc);
2619         if (!NT_STATUS_IS_OK(nt_status)) {
2620                 return ntstatus_to_werror(nt_status);
2621         }
2622
2623         return WERR_OK;
2624 }
2625
2626 static void becomeDC_drsuapi3_pull_schema_recv(struct tevent_req *subreq);
2627
2628 static void becomeDC_drsuapi3_pull_schema_send(struct libnet_BecomeDC_state *s)
2629 {
2630         s->schema_part.nc.guid  = GUID_zero();
2631         s->schema_part.nc.sid   = s->zero_sid;
2632         s->schema_part.nc.dn    = s->forest.schema_dn_str;
2633
2634         s->schema_part.destination_dsa_guid     = s->drsuapi2.bind_guid;
2635
2636         s->schema_part.replica_flags    = DRSUAPI_DRS_WRIT_REP
2637                                         | DRSUAPI_DRS_INIT_SYNC
2638                                         | DRSUAPI_DRS_PER_SYNC
2639                                         | DRSUAPI_DRS_FULL_SYNC_IN_PROGRESS
2640                                         | DRSUAPI_DRS_NEVER_SYNCED
2641                                         | DRSUAPI_DRS_USE_COMPRESSION;
2642         if (s->rodc_join) {
2643             s->schema_part.replica_flags &= ~DRSUAPI_DRS_WRIT_REP;
2644         }
2645
2646         s->schema_part.store_chunk      = s->callbacks.schema_chunk;
2647
2648         becomeDC_drsuapi_pull_partition_send(s, &s->drsuapi2, &s->drsuapi3, &s->schema_part,
2649                                              becomeDC_drsuapi3_pull_schema_recv);
2650 }
2651
2652 static void becomeDC_drsuapi3_pull_config_send(struct libnet_BecomeDC_state *s);
2653
2654 static void becomeDC_drsuapi3_pull_schema_recv(struct tevent_req *subreq)
2655 {
2656         struct libnet_BecomeDC_state *s = tevent_req_callback_data(subreq,
2657                                           struct libnet_BecomeDC_state);
2658         struct composite_context *c = s->creq;
2659         struct drsuapi_DsGetNCChanges *r = talloc_get_type_abort(s->ndr_struct_ptr,
2660                                            struct drsuapi_DsGetNCChanges);
2661         WERROR status;
2662
2663         s->ndr_struct_ptr = NULL;
2664
2665         c->status = dcerpc_drsuapi_DsGetNCChanges_r_recv(subreq, r);
2666         TALLOC_FREE(subreq);
2667         if (!composite_is_ok(c)) return;
2668
2669         status = becomeDC_drsuapi_pull_partition_recv(s, &s->drsuapi2, &s->drsuapi3, &s->schema_part, r);
2670         if (!W_ERROR_IS_OK(status)) {
2671                 composite_error(c, werror_to_ntstatus(status));
2672                 return;
2673         }
2674
2675         talloc_free(r);
2676
2677         if (s->schema_part.more_data) {
2678                 becomeDC_drsuapi_pull_partition_send(s, &s->drsuapi2, &s->drsuapi3, &s->schema_part,
2679                                                      becomeDC_drsuapi3_pull_schema_recv);
2680                 return;
2681         }
2682
2683         becomeDC_drsuapi3_pull_config_send(s);
2684 }
2685
2686 static void becomeDC_drsuapi3_pull_config_recv(struct tevent_req *subreq);
2687
2688 static void becomeDC_drsuapi3_pull_config_send(struct libnet_BecomeDC_state *s)
2689 {
2690         s->config_part.nc.guid  = GUID_zero();
2691         s->config_part.nc.sid   = s->zero_sid;
2692         s->config_part.nc.dn    = s->forest.config_dn_str;
2693
2694         s->config_part.destination_dsa_guid     = s->drsuapi2.bind_guid;
2695
2696         s->config_part.replica_flags    = DRSUAPI_DRS_WRIT_REP
2697                                         | DRSUAPI_DRS_INIT_SYNC
2698                                         | DRSUAPI_DRS_PER_SYNC
2699                                         | DRSUAPI_DRS_FULL_SYNC_IN_PROGRESS
2700                                         | DRSUAPI_DRS_NEVER_SYNCED
2701                                         | DRSUAPI_DRS_USE_COMPRESSION;
2702         if (s->rodc_join) {
2703             s->schema_part.replica_flags &= ~DRSUAPI_DRS_WRIT_REP;
2704         }
2705
2706         s->config_part.store_chunk      = s->callbacks.config_chunk;
2707
2708         becomeDC_drsuapi_pull_partition_send(s, &s->drsuapi2, &s->drsuapi3, &s->config_part,
2709                                              becomeDC_drsuapi3_pull_config_recv);
2710 }
2711
2712 static void becomeDC_drsuapi3_pull_config_recv(struct tevent_req *subreq)
2713 {
2714         struct libnet_BecomeDC_state *s = tevent_req_callback_data(subreq,
2715                                           struct libnet_BecomeDC_state);
2716         struct composite_context *c = s->creq;
2717         struct drsuapi_DsGetNCChanges *r = talloc_get_type_abort(s->ndr_struct_ptr,
2718                                            struct drsuapi_DsGetNCChanges);
2719         WERROR status;
2720
2721         s->ndr_struct_ptr = NULL;
2722
2723         c->status = dcerpc_drsuapi_DsGetNCChanges_r_recv(subreq, r);
2724         TALLOC_FREE(subreq);
2725         if (!composite_is_ok(c)) return;
2726
2727         status = becomeDC_drsuapi_pull_partition_recv(s, &s->drsuapi2, &s->drsuapi3, &s->config_part, r);
2728         if (!W_ERROR_IS_OK(status)) {
2729                 composite_error(c, werror_to_ntstatus(status));
2730                 return;
2731         }
2732
2733         talloc_free(r);
2734
2735         if (s->config_part.more_data) {
2736                 becomeDC_drsuapi_pull_partition_send(s, &s->drsuapi2, &s->drsuapi3, &s->config_part,
2737                                                      becomeDC_drsuapi3_pull_config_recv);
2738                 return;
2739         }
2740
2741         becomeDC_connect_ldap2(s);
2742 }
2743
2744 static void becomeDC_drsuapi3_pull_domain_recv(struct tevent_req *subreq);
2745
2746 static void becomeDC_drsuapi3_pull_domain_send(struct libnet_BecomeDC_state *s)
2747 {
2748         s->domain_part.nc.guid  = GUID_zero();
2749         s->domain_part.nc.sid   = s->zero_sid;
2750         s->domain_part.nc.dn    = s->domain.dn_str;
2751
2752         s->domain_part.destination_dsa_guid     = s->drsuapi2.bind_guid;
2753
2754         s->domain_part.replica_flags    = DRSUAPI_DRS_WRIT_REP
2755                                         | DRSUAPI_DRS_INIT_SYNC
2756                                         | DRSUAPI_DRS_PER_SYNC
2757                                         | DRSUAPI_DRS_FULL_SYNC_IN_PROGRESS
2758                                         | DRSUAPI_DRS_NEVER_SYNCED
2759                                         | DRSUAPI_DRS_USE_COMPRESSION;
2760         if (s->rodc_join) {
2761             s->schema_part.replica_flags &= ~DRSUAPI_DRS_WRIT_REP;
2762         }
2763
2764         s->domain_part.store_chunk      = s->callbacks.domain_chunk;
2765
2766         becomeDC_drsuapi_pull_partition_send(s, &s->drsuapi2, &s->drsuapi3, &s->domain_part,
2767                                              becomeDC_drsuapi3_pull_domain_recv);
2768 }
2769
2770 static void becomeDC_drsuapi_update_refs_send(struct libnet_BecomeDC_state *s,
2771                                               struct becomeDC_drsuapi *drsuapi,
2772                                               struct libnet_BecomeDC_Partition *partition,
2773                                               void (*recv_fn)(struct tevent_req *subreq));
2774 static void becomeDC_drsuapi2_update_refs_schema_recv(struct tevent_req *subreq);
2775
2776 static void becomeDC_drsuapi3_pull_domain_recv(struct tevent_req *subreq)
2777 {
2778         struct libnet_BecomeDC_state *s = tevent_req_callback_data(subreq,
2779                                           struct libnet_BecomeDC_state);
2780         struct composite_context *c = s->creq;
2781         struct drsuapi_DsGetNCChanges *r = talloc_get_type_abort(s->ndr_struct_ptr,
2782                                            struct drsuapi_DsGetNCChanges);
2783         WERROR status;
2784
2785         s->ndr_struct_ptr = NULL;
2786
2787         c->status = dcerpc_drsuapi_DsGetNCChanges_r_recv(subreq, r);
2788         TALLOC_FREE(subreq);
2789         if (!composite_is_ok(c)) return;
2790
2791         status = becomeDC_drsuapi_pull_partition_recv(s, &s->drsuapi2, &s->drsuapi3, &s->domain_part, r);
2792         if (!W_ERROR_IS_OK(status)) {
2793                 composite_error(c, werror_to_ntstatus(status));
2794                 return;
2795         }
2796
2797         talloc_free(r);
2798
2799         if (s->domain_part.more_data) {
2800                 becomeDC_drsuapi_pull_partition_send(s, &s->drsuapi2, &s->drsuapi3, &s->domain_part,
2801                                                      becomeDC_drsuapi3_pull_domain_recv);
2802                 return;
2803         }
2804
2805         becomeDC_drsuapi_update_refs_send(s, &s->drsuapi2, &s->schema_part,
2806                                           becomeDC_drsuapi2_update_refs_schema_recv);
2807 }
2808
2809 static void becomeDC_drsuapi_update_refs_send(struct libnet_BecomeDC_state *s,
2810                                               struct becomeDC_drsuapi *drsuapi,
2811                                               struct libnet_BecomeDC_Partition *partition,
2812                                               void (*recv_fn)(struct tevent_req *subreq))
2813 {
2814         struct composite_context *c = s->creq;
2815         struct drsuapi_DsReplicaUpdateRefs *r;
2816         const char *ntds_guid_str;
2817         const char *ntds_dns_name;
2818         struct tevent_req *subreq;
2819
2820         r = talloc(s, struct drsuapi_DsReplicaUpdateRefs);
2821         if (composite_nomem(r, c)) return;
2822
2823         ntds_guid_str = GUID_string(r, &s->dest_dsa.ntds_guid);
2824         if (composite_nomem(ntds_guid_str, c)) return;
2825
2826         ntds_dns_name = talloc_asprintf(r, "%s._msdcs.%s",
2827                                         ntds_guid_str,
2828                                         s->domain.dns_name);
2829         if (composite_nomem(ntds_dns_name, c)) return;
2830
2831         r->in.bind_handle               = &drsuapi->bind_handle;
2832         r->in.level                     = 1;
2833         r->in.req.req1.naming_context   = &partition->nc;
2834         r->in.req.req1.dest_dsa_dns_name= ntds_dns_name;
2835         r->in.req.req1.dest_dsa_guid    = s->dest_dsa.ntds_guid;
2836         r->in.req.req1.options          = DRSUAPI_DRS_ADD_REF | DRSUAPI_DRS_DEL_REF;
2837
2838         /* I think this is how we mark ourselves as a RODC */
2839         if (!lp_parm_bool(s->libnet->lp_ctx, NULL, "repl", "RODC", false)) {
2840                 r->in.req.req1.options |= DRSUAPI_DRS_WRIT_REP;
2841         }
2842
2843         s->ndr_struct_ptr = r;
2844         subreq = dcerpc_drsuapi_DsReplicaUpdateRefs_r_send(s, c->event_ctx,
2845                                                            drsuapi->drsuapi_handle,
2846                                                            r);
2847         if (composite_nomem(subreq, c)) return;
2848         tevent_req_set_callback(subreq, recv_fn, s);
2849 }
2850
2851 static void becomeDC_drsuapi2_update_refs_config_recv(struct tevent_req *subreq);
2852
2853 static void becomeDC_drsuapi2_update_refs_schema_recv(struct tevent_req *subreq)
2854 {
2855         struct libnet_BecomeDC_state *s = tevent_req_callback_data(subreq,
2856                                           struct libnet_BecomeDC_state);
2857         struct composite_context *c = s->creq;
2858         struct drsuapi_DsReplicaUpdateRefs *r = talloc_get_type_abort(s->ndr_struct_ptr,
2859                                            struct drsuapi_DsReplicaUpdateRefs);
2860
2861         s->ndr_struct_ptr = NULL;
2862
2863         c->status = dcerpc_drsuapi_DsReplicaUpdateRefs_r_recv(subreq, r);
2864         TALLOC_FREE(subreq);
2865         if (!composite_is_ok(c)) return;
2866
2867         if (!W_ERROR_IS_OK(r->out.result)) {
2868                 composite_error(c, werror_to_ntstatus(r->out.result));
2869                 return;
2870         }
2871
2872         talloc_free(r);
2873
2874         becomeDC_drsuapi_update_refs_send(s, &s->drsuapi2, &s->config_part,
2875                                           becomeDC_drsuapi2_update_refs_config_recv);
2876 }
2877
2878 static void becomeDC_drsuapi2_update_refs_domain_recv(struct tevent_req *subreq);
2879
2880 static void becomeDC_drsuapi2_update_refs_config_recv(struct tevent_req *subreq)
2881 {
2882         struct libnet_BecomeDC_state *s = tevent_req_callback_data(subreq,
2883                                           struct libnet_BecomeDC_state);
2884         struct composite_context *c = s->creq;
2885         struct drsuapi_DsReplicaUpdateRefs *r = talloc_get_type(s->ndr_struct_ptr,
2886                                            struct drsuapi_DsReplicaUpdateRefs);
2887
2888         s->ndr_struct_ptr = NULL;
2889
2890         c->status = dcerpc_drsuapi_DsReplicaUpdateRefs_r_recv(subreq, r);
2891         TALLOC_FREE(subreq);
2892         if (!composite_is_ok(c)) return;
2893
2894         if (!W_ERROR_IS_OK(r->out.result)) {
2895                 composite_error(c, werror_to_ntstatus(r->out.result));
2896                 return;
2897         }
2898
2899         talloc_free(r);
2900
2901         becomeDC_drsuapi_update_refs_send(s, &s->drsuapi2, &s->domain_part,
2902                                           becomeDC_drsuapi2_update_refs_domain_recv);
2903 }
2904
2905 static void becomeDC_drsuapi2_update_refs_domain_recv(struct tevent_req *subreq)
2906 {
2907         struct libnet_BecomeDC_state *s = tevent_req_callback_data(subreq,
2908                                           struct libnet_BecomeDC_state);
2909         struct composite_context *c = s->creq;
2910         struct drsuapi_DsReplicaUpdateRefs *r = talloc_get_type(s->ndr_struct_ptr,
2911                                            struct drsuapi_DsReplicaUpdateRefs);
2912
2913         s->ndr_struct_ptr = NULL;
2914
2915         c->status = dcerpc_drsuapi_DsReplicaUpdateRefs_r_recv(subreq, r);
2916         TALLOC_FREE(subreq);
2917         if (!composite_is_ok(c)) return;
2918
2919         if (!W_ERROR_IS_OK(r->out.result)) {
2920                 composite_error(c, werror_to_ntstatus(r->out.result));
2921                 return;
2922         }
2923
2924         talloc_free(r);
2925
2926         /* TODO: use DDNS updates and register dns names */
2927         composite_done(c);
2928 }
2929
2930 static NTSTATUS becomeDC_ldap2_modify_computer(struct libnet_BecomeDC_state *s)
2931 {
2932         int ret;
2933         struct ldb_message *msg;
2934         unsigned int i;
2935         uint32_t user_account_control = UF_SERVER_TRUST_ACCOUNT |
2936                                         UF_TRUSTED_FOR_DELEGATION;
2937
2938         /* as the value is already as we want it to be, we're done */
2939         if (s->dest_dsa.user_account_control == user_account_control) {
2940                 return NT_STATUS_OK;
2941         }
2942
2943         /* make a 'modify' msg, and only for serverReference */
2944         msg = ldb_msg_new(s);
2945         NT_STATUS_HAVE_NO_MEMORY(msg);
2946         msg->dn = ldb_dn_new(msg, s->ldap2.ldb, s->dest_dsa.computer_dn_str);
2947         NT_STATUS_HAVE_NO_MEMORY(msg->dn);
2948
2949         ret = ldb_msg_add_fmt(msg, "userAccountControl", "%u", user_account_control);
2950         if (ret != 0) {
2951                 talloc_free(msg);
2952                 return NT_STATUS_NO_MEMORY;
2953         }
2954
2955         /* mark all the message elements (should be just one)
2956            as LDB_FLAG_MOD_REPLACE */
2957         for (i=0;i<msg->num_elements;i++) {
2958                 msg->elements[i].flags = LDB_FLAG_MOD_REPLACE;
2959         }
2960
2961         ret = ldb_modify(s->ldap2.ldb, msg);
2962         talloc_free(msg);
2963         if (ret != LDB_SUCCESS) {
2964                 return NT_STATUS_LDAP(ret);
2965         }
2966
2967         s->dest_dsa.user_account_control = user_account_control;
2968
2969         return NT_STATUS_OK;
2970 }
2971
2972 static NTSTATUS becomeDC_ldap2_move_computer(struct libnet_BecomeDC_state *s)
2973 {
2974         int ret;
2975         struct ldb_dn *old_dn;
2976         struct ldb_dn *new_dn;
2977
2978         ret = dsdb_wellknown_dn(s->ldap2.ldb, s, samdb_base_dn(s->ldap2.ldb),
2979                                 DS_GUID_DOMAIN_CONTROLLERS_CONTAINER,
2980                                 &new_dn);
2981         if (ret != LDB_SUCCESS) {
2982                 return NT_STATUS_LDAP(ret);
2983         }
2984
2985         if (!ldb_dn_add_child_fmt(new_dn, "CN=%s", s->dest_dsa.netbios_name)) {
2986                 talloc_free(new_dn);
2987                 return NT_STATUS_NO_MEMORY;
2988         }
2989
2990         old_dn = ldb_dn_new(new_dn, s->ldap2.ldb, s->dest_dsa.computer_dn_str);
2991         NT_STATUS_HAVE_NO_MEMORY(old_dn);
2992
2993         if (ldb_dn_compare(old_dn, new_dn) == 0) {
2994                 /* we don't need to rename if the old and new dn match */
2995                 talloc_free(new_dn);
2996                 return NT_STATUS_OK;
2997         }
2998
2999         ret = ldb_rename(s->ldap2.ldb, old_dn, new_dn);
3000         if (ret != LDB_SUCCESS) {
3001                 talloc_free(new_dn);
3002                 return NT_STATUS_LDAP(ret);
3003         }
3004
3005         s->dest_dsa.computer_dn_str = ldb_dn_alloc_linearized(s, new_dn);
3006         NT_STATUS_HAVE_NO_MEMORY(s->dest_dsa.computer_dn_str);
3007
3008         talloc_free(new_dn);
3009
3010         return NT_STATUS_OK;
3011 }
3012
3013 static void becomeDC_connect_ldap2(struct libnet_BecomeDC_state *s)
3014 {
3015         struct composite_context *c = s->creq;
3016
3017         c->status = becomeDC_ldap_connect(s, &s->ldap2);
3018         if (!composite_is_ok(c)) return;
3019
3020         c->status = becomeDC_ldap2_modify_computer(s);
3021         if (!composite_is_ok(c)) return;
3022
3023         c->status = becomeDC_ldap2_move_computer(s);
3024         if (!composite_is_ok(c)) return;
3025
3026         becomeDC_drsuapi3_pull_domain_send(s);
3027 }
3028
3029 struct composite_context *libnet_BecomeDC_send(struct libnet_context *ctx, TALLOC_CTX *mem_ctx, struct libnet_BecomeDC *r)
3030 {
3031         struct composite_context *c;
3032         struct libnet_BecomeDC_state *s;
3033         char *tmp_name;
3034
3035         c = composite_create(mem_ctx, ctx->event_ctx);
3036         if (c == NULL) return NULL;
3037
3038         s = talloc_zero(c, struct libnet_BecomeDC_state);
3039         if (composite_nomem(s, c)) return c;
3040         c->private_data = s;
3041         s->creq         = c;
3042         s->libnet       = ctx;
3043
3044         /* Domain input */
3045         s->domain.dns_name      = talloc_strdup(s, r->in.domain_dns_name);
3046         if (composite_nomem(s->domain.dns_name, c)) return c;
3047         s->domain.netbios_name  = talloc_strdup(s, r->in.domain_netbios_name);
3048         if (composite_nomem(s->domain.netbios_name, c)) return c;
3049         s->domain.sid           = dom_sid_dup(s, r->in.domain_sid);
3050         if (composite_nomem(s->domain.sid, c)) return c;
3051
3052         /* Source DSA input */
3053         s->source_dsa.address   = talloc_strdup(s, r->in.source_dsa_address);
3054         if (composite_nomem(s->source_dsa.address, c)) return c;
3055
3056         /* Destination DSA input */
3057         s->dest_dsa.netbios_name= talloc_strdup(s, r->in.dest_dsa_netbios_name);
3058         if (composite_nomem(s->dest_dsa.netbios_name, c)) return c;
3059
3060         /* Destination DSA dns_name construction */
3061         tmp_name        = strlower_talloc(s, s->dest_dsa.netbios_name);
3062         if (composite_nomem(tmp_name, c)) return c;
3063         tmp_name        = talloc_asprintf_append_buffer(tmp_name, ".%s",s->domain.dns_name);
3064         if (composite_nomem(tmp_name, c)) return c;
3065         s->dest_dsa.dns_name    = tmp_name;
3066
3067         /* Callback function pointers */
3068         s->callbacks = r->in.callbacks;
3069
3070         /* RODC join*/
3071         s->rodc_join = r->in.rodc_join;
3072
3073         becomeDC_send_cldap(s);
3074         return c;
3075 }
3076
3077 NTSTATUS libnet_BecomeDC_recv(struct composite_context *c, TALLOC_CTX *mem_ctx, struct libnet_BecomeDC *r)
3078 {
3079         NTSTATUS status;
3080
3081         status = composite_wait(c);
3082
3083         ZERO_STRUCT(r->out);
3084
3085         talloc_free(c);
3086         return status;
3087 }
3088
3089 NTSTATUS libnet_BecomeDC(struct libnet_context *ctx, TALLOC_CTX *mem_ctx, struct libnet_BecomeDC *r)
3090 {
3091         NTSTATUS status;
3092         struct composite_context *c;
3093         c = libnet_BecomeDC_send(ctx, mem_ctx, r);
3094         status = libnet_BecomeDC_recv(c, mem_ctx, r);
3095         return status;
3096 }