source4/dsdb/pydsdb.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3    Copyright (C) Jelmer Vernooij <jelmer@samba.org> 2007-2010
   4    Copyright (C) Matthias Dieter Wallnöfer          2009
   5
   6    This program is free software; you can redistribute it and/or modify
   7    it under the terms of the GNU General Public License as published by
   8    the Free Software Foundation; either version 3 of the License, or
   9    (at your option) any later version.
  10
  11    This program is distributed in the hope that it will be useful,
  12    but WITHOUT ANY WARRANTY; without even the implied warranty of
  13    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  14    GNU General Public License for more details.
  15
  16    You should have received a copy of the GNU General Public License
  17    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  18 */
  19
  20 #include "lib/replace/system/python.h"
  21 #include "python/py3compat.h"
  22 #include "includes.h"
  23 #include <ldb.h>
  24 #include <pyldb.h>
  25 #include "dsdb/samdb/samdb.h"
  26 #include "libcli/security/security.h"
  27 #include "librpc/ndr/libndr.h"
  28 #include "system/kerberos.h"
  29 #include "auth/kerberos/kerberos.h"
  30 #include "librpc/rpc/pyrpc_util.h"
  31 #include "lib/policy/policy.h"
  32 #include "param/pyparam.h"
  33 #include "lib/util/dlinklist.h"
  34 #include "dsdb/kcc/garbage_collect_tombstones.h"
  35 #include "dsdb/kcc/scavenge_dns_records.h"
  36 #include "libds/common/flag_mapping.h"
  37
  38 #undef strcasecmp
  39
  40 /* FIXME: These should be in a header file somewhere */
  41 #define PyErr_LDB_OR_RAISE(py_ldb, ldb) \
  42         if (!py_check_dcerpc_type(py_ldb, "ldb", "Ldb")) { \
  43                 PyErr_SetString(PyExc_TypeError, "Ldb connection object required"); \
  44                 return NULL; \
  45         } \
  46         ldb = pyldb_Ldb_AS_LDBCONTEXT(py_ldb);
  47
  48 #define PyErr_LDB_DN_OR_RAISE(py_ldb_dn, dn) \
  49         if (!py_check_dcerpc_type(py_ldb_dn, "ldb", "Dn")) { \
  50                 PyErr_SetString(PyExc_TypeError, "ldb Dn object required"); \
  51                 return NULL; \
  52         } \
  53         dn = pyldb_Dn_AS_DN(py_ldb_dn);
  54
  55 static PyObject *py_ldb_get_exception(void)
  56 {
  57         PyObject *mod = PyImport_ImportModule("ldb");
  58         PyObject *result = NULL;
  59         if (mod == NULL)
  60                 return NULL;
  61
  62         result = PyObject_GetAttrString(mod, "LdbError");
  63         Py_CLEAR(mod);
  64         return result;
  65 }
  66
  67 static void PyErr_SetLdbError(PyObject *error, int ret, struct ldb_context *ldb_ctx)
  68 {
  69         if (ret == LDB_ERR_PYTHON_EXCEPTION)
  70                 return; /* Python exception should already be set, just keep that */
  71
  72         PyErr_SetObject(error,
  73                         Py_BuildValue(discard_const_p(char, "(i,s)"), ret,
  74                         ldb_ctx == NULL?ldb_strerror(ret):ldb_errstring(ldb_ctx)));
  75 }
  76
  77 static PyObject *py_samdb_server_site_name(PyObject *self, PyObject *args)
  78 {
  79         PyObject *py_ldb, *result;
  80         struct ldb_context *ldb;
  81         const char *site;
  82         TALLOC_CTX *mem_ctx;
  83
  84         if (!PyArg_ParseTuple(args, "O", &py_ldb))
  85                 return NULL;
  86
  87         PyErr_LDB_OR_RAISE(py_ldb, ldb);
  88
  89         mem_ctx = talloc_new(NULL);
  90         if (mem_ctx == NULL) {
  91                 PyErr_NoMemory();
  92                 return NULL;
  93         }
  94
  95         site = samdb_server_site_name(ldb, mem_ctx);
  96         if (site == NULL) {
  97                 PyErr_SetString(PyExc_RuntimeError, "Failed to find server site");
  98                 talloc_free(mem_ctx);
  99                 return NULL;
 100         }
 101
 102         result = PyUnicode_FromString(site);
 103         talloc_free(mem_ctx);
 104         return result;
 105 }
 106
 107 static PyObject *py_dsdb_convert_schema_to_openldap(PyObject *self,
 108                                                     PyObject *args)
 109 {
 110         char *target_str, *mapping;
 111         PyObject *py_ldb;
 112         struct ldb_context *ldb;
 113         PyObject *ret;
 114         char *retstr;
 115
 116         if (!PyArg_ParseTuple(args, "Oss", &py_ldb, &target_str, &mapping))
 117                 return NULL;
 118
 119         PyErr_LDB_OR_RAISE(py_ldb, ldb);
 120
 121         retstr = dsdb_convert_schema_to_openldap(ldb, target_str, mapping);
 122         if (retstr == NULL) {
 123                 PyErr_SetString(PyExc_RuntimeError,
 124                                                 "dsdb_convert_schema_to_openldap failed");
 125                 return NULL;
 126         }
 127
 128         ret = PyUnicode_FromString(retstr);
 129         talloc_free(retstr);
 130         return ret;
 131 }
 132
 133 static PyObject *py_samdb_set_domain_sid(PyLdbObject *self, PyObject *args)
 134 {
 135         PyObject *py_ldb, *py_sid;
 136         struct ldb_context *ldb;
 137         struct dom_sid *sid;
 138         bool ret;
 139         const char *sid_str = NULL;
 140
 141         if (!PyArg_ParseTuple(args, "OO", &py_ldb, &py_sid))
 142                 return NULL;
 143
 144         PyErr_LDB_OR_RAISE(py_ldb, ldb);
 145
 146         sid_str = PyUnicode_AsUTF8(py_sid);
 147         if (sid_str == NULL) {
 148                 PyErr_NoMemory();
 149                 return NULL;
 150         }
 151
 152         sid = dom_sid_parse_talloc(NULL, sid_str);
 153         if (sid == NULL) {
 154                 PyErr_NoMemory();
 155                 return NULL;
 156         }
 157
 158         ret = samdb_set_domain_sid(ldb, sid);
 159         talloc_free(sid);
 160         if (!ret) {
 161                 PyErr_SetString(PyExc_RuntimeError, "set_domain_sid failed");
 162                 return NULL;
 163         }
 164         Py_RETURN_NONE;
 165 }
 166
 167 static PyObject *py_samdb_set_ntds_settings_dn(PyLdbObject *self, PyObject *args)
 168 {
 169         PyObject *py_ldb, *py_ntds_settings_dn;
 170         struct ldb_context *ldb;
 171         struct ldb_dn *ntds_settings_dn;
 172         TALLOC_CTX *tmp_ctx;
 173         bool ret;
 174
 175         if (!PyArg_ParseTuple(args, "OO", &py_ldb, &py_ntds_settings_dn))
 176                 return NULL;
 177
 178         PyErr_LDB_OR_RAISE(py_ldb, ldb);
 179
 180         tmp_ctx = talloc_new(NULL);
 181         if (tmp_ctx == NULL) {
 182                 PyErr_NoMemory();
 183                 return NULL;
 184         }
 185
 186         if (!pyldb_Object_AsDn(tmp_ctx, py_ntds_settings_dn, ldb, &ntds_settings_dn)) {
 187                 /* exception thrown by "pyldb_Object_AsDn" */
 188                 talloc_free(tmp_ctx);
 189                 return NULL;
 190         }
 191
 192         ret = samdb_set_ntds_settings_dn(ldb, ntds_settings_dn);
 193         talloc_free(tmp_ctx);
 194         if (!ret) {
 195                 PyErr_SetString(PyExc_RuntimeError, "set_ntds_settings_dn failed");
 196                 return NULL;
 197         }
 198         Py_RETURN_NONE;
 199 }
 200
 201 static PyObject *py_samdb_get_domain_sid(PyLdbObject *self, PyObject *args)
 202 {
 203         PyObject *py_ldb;
 204         struct ldb_context *ldb;
 205         const struct dom_sid *sid;
 206         struct dom_sid_buf buf;
 207         PyObject *ret;
 208
 209         if (!PyArg_ParseTuple(args, "O", &py_ldb))
 210                 return NULL;
 211
 212         PyErr_LDB_OR_RAISE(py_ldb, ldb);
 213
 214         sid = samdb_domain_sid(ldb);
 215         if (!sid) {
 216                 PyErr_SetString(PyExc_RuntimeError, "samdb_domain_sid failed");
 217                 return NULL;
 218         }
 219
 220         ret = PyUnicode_FromString(dom_sid_str_buf(sid, &buf));
 221         return ret;
 222 }
 223
 224 static PyObject *py_samdb_ntds_invocation_id(PyObject *self, PyObject *args)
 225 {
 226         PyObject *py_ldb, *result;
 227         struct ldb_context *ldb;
 228         const struct GUID *guid;
 229         char *retstr;
 230
 231         if (!PyArg_ParseTuple(args, "O", &py_ldb)) {
 232                 return NULL;
 233         }
 234
 235         PyErr_LDB_OR_RAISE(py_ldb, ldb);
 236
 237         guid = samdb_ntds_invocation_id(ldb);
 238         if (guid == NULL) {
 239                 PyErr_SetString(PyExc_RuntimeError,
 240                                                 "Failed to find NTDS invocation ID");
 241                 return NULL;
 242         }
 243
 244         retstr = GUID_string(NULL, guid);
 245         if (retstr == NULL) {
 246                 PyErr_NoMemory();
 247                 return NULL;
 248         }
 249         result = PyUnicode_FromString(retstr);
 250         talloc_free(retstr);
 251         return result;
 252 }
 253
 254 static PyObject *py_dsdb_get_oid_from_attid(PyObject *self, PyObject *args)
 255 {
 256         PyObject *py_ldb;
 257         struct ldb_context *ldb;
 258         uint32_t attid;
 259         struct dsdb_schema *schema;
 260         const char *oid;
 261         PyObject *ret;
 262         WERROR status;
 263         TALLOC_CTX *mem_ctx;
 264
 265         if (!PyArg_ParseTuple(args, "OI", &py_ldb, &attid))
 266                 return NULL;
 267
 268         PyErr_LDB_OR_RAISE(py_ldb, ldb);
 269
 270         mem_ctx = talloc_new(NULL);
 271         if (!mem_ctx) {
 272                 PyErr_NoMemory();
 273                 return NULL;
 274         }
 275
 276         schema = dsdb_get_schema(ldb, mem_ctx);
 277         if (!schema) {
 278                 PyErr_SetString(PyExc_RuntimeError, "Failed to find a schema from ldb \n");
 279                 talloc_free(mem_ctx);
 280                 return NULL;
 281         }
 282
 283         status = dsdb_schema_pfm_oid_from_attid(schema->prefixmap, attid,
 284                                                 mem_ctx, &oid);
 285         if (!W_ERROR_IS_OK(status)) {
 286                 PyErr_SetWERROR(status);
 287                 talloc_free(mem_ctx);
 288                 return NULL;
 289         }
 290
 291         ret = PyUnicode_FromString(oid);
 292
 293         talloc_free(mem_ctx);
 294
 295         return ret;
 296 }
 297
 298
 299 static PyObject *py_dsdb_get_attid_from_lDAPDisplayName(PyObject *self, PyObject *args)
 300 {
 301         PyObject *py_ldb, *is_schema_nc;
 302         struct ldb_context *ldb;
 303         struct dsdb_schema *schema;
 304         const char *ldap_display_name;
 305         bool schema_nc = false;
 306         const struct dsdb_attribute *a;
 307         uint32_t attid;
 308
 309         if (!PyArg_ParseTuple(args, "OsO", &py_ldb, &ldap_display_name, &is_schema_nc))
 310                 return NULL;
 311
 312         PyErr_LDB_OR_RAISE(py_ldb, ldb);
 313
 314         if (is_schema_nc) {
 315                 if (!PyBool_Check(is_schema_nc)) {
 316                         PyErr_SetString(PyExc_TypeError, "Expected boolean is_schema_nc");
 317                         return NULL;
 318                 }
 319                 if (is_schema_nc == Py_True) {
 320                         schema_nc = true;
 321                 }
 322         }
 323
 324         schema = dsdb_get_schema(ldb, NULL);
 325
 326         if (!schema) {
 327                 PyErr_SetString(PyExc_RuntimeError, "Failed to find a schema from ldb");
 328                 return NULL;
 329         }
 330
 331         a = dsdb_attribute_by_lDAPDisplayName(schema, ldap_display_name);
 332         if (a == NULL) {
 333                 PyErr_Format(PyExc_KeyError, "Failed to find attribute '%s'", ldap_display_name);
 334                 return NULL;
 335         }
 336
 337         attid = dsdb_attribute_get_attid(a, schema_nc);
 338
 339         return PyLong_FromUnsignedLong(attid);
 340 }
 341
 342 /*
 343   return the systemFlags as int from the attribute name
 344  */
 345 static PyObject *py_dsdb_get_systemFlags_from_lDAPDisplayName(PyObject *self, PyObject *args)
 346 {
 347         PyObject *py_ldb;
 348         struct ldb_context *ldb;
 349         struct dsdb_schema *schema;
 350         const char *ldap_display_name;
 351         const struct dsdb_attribute *attribute;
 352
 353         if (!PyArg_ParseTuple(args, "Os", &py_ldb, &ldap_display_name))
 354                 return NULL;
 355
 356         PyErr_LDB_OR_RAISE(py_ldb, ldb);
 357
 358         schema = dsdb_get_schema(ldb, NULL);
 359
 360         if (!schema) {
 361                 PyErr_SetString(PyExc_RuntimeError, "Failed to find a schema from ldb");
 362                 return NULL;
 363         }
 364
 365         attribute = dsdb_attribute_by_lDAPDisplayName(schema, ldap_display_name);
 366         if (attribute == NULL) {
 367                 PyErr_Format(PyExc_KeyError, "Failed to find attribute '%s'", ldap_display_name);
 368                 return NULL;
 369         }
 370
 371         return PyLong_FromLong(attribute->systemFlags);
 372 }
 373
 374 /*
 375   return the linkID from the attribute name
 376  */
 377 static PyObject *py_dsdb_get_linkId_from_lDAPDisplayName(PyObject *self, PyObject *args)
 378 {
 379         PyObject *py_ldb;
 380         struct ldb_context *ldb;
 381         struct dsdb_schema *schema;
 382         const char *ldap_display_name;
 383         const struct dsdb_attribute *attribute;
 384
 385         if (!PyArg_ParseTuple(args, "Os", &py_ldb, &ldap_display_name))
 386                 return NULL;
 387
 388         PyErr_LDB_OR_RAISE(py_ldb, ldb);
 389
 390         schema = dsdb_get_schema(ldb, NULL);
 391
 392         if (!schema) {
 393                 PyErr_SetString(PyExc_RuntimeError, "Failed to find a schema from ldb");
 394                 return NULL;
 395         }
 396
 397         attribute = dsdb_attribute_by_lDAPDisplayName(schema, ldap_display_name);
 398         if (attribute == NULL) {
 399                 PyErr_Format(PyExc_KeyError, "Failed to find attribute '%s'", ldap_display_name);
 400                 return NULL;
 401         }
 402
 403         return PyLong_FromLong(attribute->linkID);
 404 }
 405
 406 /*
 407   return the backlink attribute name (if any) for an attribute
 408  */
 409 static PyObject *py_dsdb_get_backlink_from_lDAPDisplayName(PyObject *self, PyObject *args)
 410 {
 411         PyObject *py_ldb;
 412         struct ldb_context *ldb;
 413         struct dsdb_schema *schema;
 414         const char *ldap_display_name;
 415         const struct dsdb_attribute *attribute, *target_attr;
 416
 417         if (!PyArg_ParseTuple(args, "Os", &py_ldb, &ldap_display_name))
 418                 return NULL;
 419
 420         PyErr_LDB_OR_RAISE(py_ldb, ldb);
 421
 422         schema = dsdb_get_schema(ldb, NULL);
 423
 424         if (!schema) {
 425                 PyErr_SetString(PyExc_RuntimeError, "Failed to find a schema from ldb");
 426                 return NULL;
 427         }
 428
 429         attribute = dsdb_attribute_by_lDAPDisplayName(schema, ldap_display_name);
 430         if (attribute == NULL) {
 431                 PyErr_Format(PyExc_KeyError, "Failed to find attribute '%s'", ldap_display_name);
 432                 return NULL;
 433         }
 434
 435         if (attribute->linkID == 0) {
 436                 Py_RETURN_NONE;
 437         }
 438
 439         target_attr = dsdb_attribute_by_linkID(schema, attribute->linkID ^ 1);
 440         if (target_attr == NULL) {
 441                 /* when we add pseudo-backlinks we'll need to handle
 442                    them here */
 443                 Py_RETURN_NONE;
 444         }
 445
 446         return PyUnicode_FromString(target_attr->lDAPDisplayName);
 447 }
 448
 449
 450 static PyObject *py_dsdb_get_lDAPDisplayName_by_attid(PyObject *self, PyObject *args)
 451 {
 452         PyObject *py_ldb;
 453         struct ldb_context *ldb;
 454         struct dsdb_schema *schema;
 455         const struct dsdb_attribute *a;
 456         uint32_t attid;
 457
 458         if (!PyArg_ParseTuple(args, "OI", &py_ldb, &attid))
 459                 return NULL;
 460
 461         PyErr_LDB_OR_RAISE(py_ldb, ldb);
 462
 463         schema = dsdb_get_schema(ldb, NULL);
 464
 465         if (!schema) {
 466                 PyErr_SetString(PyExc_RuntimeError, "Failed to find a schema from ldb");
 467                 return NULL;
 468         }
 469
 470         a = dsdb_attribute_by_attributeID_id(schema, attid);
 471         if (a == NULL) {
 472                 PyErr_Format(PyExc_KeyError, "Failed to find attribute '0x%08x'", attid);
 473                 return NULL;
 474         }
 475
 476         return PyUnicode_FromString(a->lDAPDisplayName);
 477 }
 478
 479
 480 /*
 481   return the attribute syntax oid as a string from the attribute name
 482  */
 483 static PyObject *py_dsdb_get_syntax_oid_from_lDAPDisplayName(PyObject *self, PyObject *args)
 484 {
 485         PyObject *py_ldb;
 486         struct ldb_context *ldb;
 487         struct dsdb_schema *schema;
 488         const char *ldap_display_name;
 489         const struct dsdb_attribute *attribute;
 490
 491         if (!PyArg_ParseTuple(args, "Os", &py_ldb, &ldap_display_name))
 492                 return NULL;
 493
 494         PyErr_LDB_OR_RAISE(py_ldb, ldb);
 495
 496         schema = dsdb_get_schema(ldb, NULL);
 497
 498         if (!schema) {
 499                 PyErr_SetString(PyExc_RuntimeError, "Failed to find a schema from ldb");
 500                 return NULL;
 501         }
 502
 503         attribute = dsdb_attribute_by_lDAPDisplayName(schema, ldap_display_name);
 504         if (attribute == NULL) {
 505                 PyErr_Format(PyExc_KeyError, "Failed to find attribute '%s'", ldap_display_name);
 506                 return NULL;
 507         }
 508
 509         return PyUnicode_FromString(attribute->syntax->ldap_oid);
 510 }
 511
 512 /*
 513   convert a python string to a DRSUAPI drsuapi_DsReplicaAttribute attribute
 514  */
 515 static PyObject *py_dsdb_DsReplicaAttribute(PyObject *self, PyObject *args)
 516 {
 517         PyObject *py_ldb, *el_list, *ret;
 518         struct ldb_context *ldb;
 519         char *ldap_display_name;
 520         const struct dsdb_attribute *a;
 521         struct dsdb_schema *schema;
 522         struct dsdb_syntax_ctx syntax_ctx;
 523         struct ldb_message_element *el;
 524         struct drsuapi_DsReplicaAttribute *attr;
 525         TALLOC_CTX *tmp_ctx;
 526         WERROR werr;
 527         Py_ssize_t i;
 528
 529         if (!PyArg_ParseTuple(args, "OsO", &py_ldb, &ldap_display_name, &el_list)) {
 530                 return NULL;
 531         }
 532
 533         PyErr_LDB_OR_RAISE(py_ldb, ldb);
 534
 535         schema = dsdb_get_schema(ldb, NULL);
 536         if (!schema) {
 537                 PyErr_SetString(PyExc_RuntimeError, "Failed to find a schema from ldb");
 538                 return NULL;
 539         }
 540
 541         a = dsdb_attribute_by_lDAPDisplayName(schema, ldap_display_name);
 542         if (a == NULL) {
 543                 PyErr_Format(PyExc_KeyError, "Failed to find attribute '%s'", ldap_display_name);
 544                 return NULL;
 545         }
 546
 547         dsdb_syntax_ctx_init(&syntax_ctx, ldb, schema);
 548         syntax_ctx.is_schema_nc = false;
 549
 550         tmp_ctx = talloc_new(ldb);
 551         if (tmp_ctx == NULL) {
 552                 PyErr_NoMemory();
 553                 return NULL;
 554         }
 555
 556         /* If we were not given an LdbMessageElement */
 557         if (!PyList_Check(el_list)) {
 558                 if (!py_check_dcerpc_type(el_list, "ldb", "MessageElement")) {
 559                         PyErr_SetString(py_ldb_get_exception(),
 560                                         "list of strings or ldb MessageElement object required");
 561                         return NULL;
 562                 }
 563                 /*
 564                  * NOTE:
 565                  * el may not be a valid talloc context, it
 566                  * could be part of an array
 567                  */
 568                 el = pyldb_MessageElement_AsMessageElement(el_list);
 569         } else {
 570                 el = talloc_zero(tmp_ctx, struct ldb_message_element);
 571                 if (el == NULL) {
 572                         PyErr_NoMemory();
 573                         talloc_free(tmp_ctx);
 574                         return NULL;
 575                 }
 576
 577                 el->name = ldap_display_name;
 578                 el->num_values = PyList_Size(el_list);
 579
 580                 el->values = talloc_array(el, struct ldb_val, el->num_values);
 581                 if (el->values == NULL) {
 582                         PyErr_NoMemory();
 583                         talloc_free(tmp_ctx);
 584                         return NULL;
 585                 }
 586
 587                 for (i = 0; i < el->num_values; i++) {
 588                         PyObject *item = PyList_GetItem(el_list, i);
 589                         if (!(PyBytes_Check(item))) {
 590                                 PyErr_Format(PyExc_TypeError,
 591                                              "ldif_element type should be bytes"
 592                                              );
 593                                 talloc_free(tmp_ctx);
 594                                 return NULL;
 595                         }
 596                         el->values[i].data =
 597                                 (uint8_t *)PyBytes_AsString(item);
 598                         el->values[i].length = PyBytes_Size(item);
 599                 }
 600         }
 601
 602         attr = talloc_zero(tmp_ctx, struct drsuapi_DsReplicaAttribute);
 603         if (attr == NULL) {
 604                 PyErr_NoMemory();
 605                 talloc_free(tmp_ctx);
 606                 return NULL;
 607         }
 608
 609         werr = a->syntax->ldb_to_drsuapi(&syntax_ctx, a, el, attr, attr);
 610         PyErr_WERROR_NOT_OK_RAISE(werr);
 611
 612         ret = py_return_ndr_struct("samba.dcerpc.drsuapi", "DsReplicaAttribute", attr, attr);
 613
 614         talloc_free(tmp_ctx);
 615
 616         return ret;
 617 }
 618
 619
 620 /*
 621   normalise a ldb attribute list
 622  */
 623 static PyObject *py_dsdb_normalise_attributes(PyObject *self, PyObject *args)
 624 {
 625         PyObject *py_ldb, *el_list, *py_ret;
 626         struct ldb_context *ldb;
 627         char *ldap_display_name;
 628         const struct dsdb_attribute *a;
 629         struct dsdb_schema *schema;
 630         struct dsdb_syntax_ctx syntax_ctx;
 631         struct ldb_message_element *el, *new_el;
 632         struct drsuapi_DsReplicaAttribute *attr;
 633         PyLdbMessageElementObject *ret;
 634         TALLOC_CTX *tmp_ctx;
 635         WERROR werr;
 636         Py_ssize_t i;
 637         PyTypeObject *py_type = NULL;
 638         PyObject *module = NULL;
 639
 640         if (!PyArg_ParseTuple(args, "OsO", &py_ldb, &ldap_display_name, &el_list)) {
 641                 return NULL;
 642         }
 643
 644         PyErr_LDB_OR_RAISE(py_ldb, ldb);
 645
 646         schema = dsdb_get_schema(ldb, NULL);
 647         if (!schema) {
 648                 PyErr_SetString(PyExc_RuntimeError, "Failed to find a schema from ldb");
 649                 return NULL;
 650         }
 651
 652         a = dsdb_attribute_by_lDAPDisplayName(schema, ldap_display_name);
 653         if (a == NULL) {
 654                 PyErr_Format(PyExc_KeyError, "Failed to find attribute '%s'", ldap_display_name);
 655                 return NULL;
 656         }
 657
 658         dsdb_syntax_ctx_init(&syntax_ctx, ldb, schema);
 659         syntax_ctx.is_schema_nc = false;
 660
 661         tmp_ctx = talloc_new(ldb);
 662         if (tmp_ctx == NULL) {
 663                 PyErr_NoMemory();
 664                 return NULL;
 665         }
 666
 667         if (!PyList_Check(el_list)) {
 668                 if (!py_check_dcerpc_type(el_list, "ldb", "MessageElement")) {
 669                         PyErr_SetString(py_ldb_get_exception(),
 670                                         "list of strings or ldb MessageElement object required");
 671                         return NULL;
 672                 }
 673                 /*
 674                  * NOTE:
 675                  * el may not be a valid talloc context, it
 676                  * could be part of an array
 677                  */
 678                 el = pyldb_MessageElement_AsMessageElement(el_list);
 679         } else {
 680                 el = talloc_zero(tmp_ctx, struct ldb_message_element);
 681                 if (el == NULL) {
 682                         PyErr_NoMemory();
 683                         talloc_free(tmp_ctx);
 684                         return NULL;
 685                 }
 686
 687                 el->name = ldap_display_name;
 688                 el->num_values = PyList_Size(el_list);
 689
 690                 el->values = talloc_array(el, struct ldb_val, el->num_values);
 691                 if (el->values == NULL) {
 692                         PyErr_NoMemory();
 693                         talloc_free(tmp_ctx);
 694                         return NULL;
 695                 }
 696
 697                 for (i = 0; i < el->num_values; i++) {
 698                         PyObject *item = PyList_GetItem(el_list, i);
 699                         if (!PyBytes_Check(item)) {
 700                                 PyErr_Format(PyExc_TypeError,
 701                                              "ldif_element type should be bytes"
 702                                              );
 703                                 talloc_free(tmp_ctx);
 704                                 return NULL;
 705                         }
 706                         el->values[i].data = (uint8_t *)PyBytes_AsString(item);
 707                         el->values[i].length = PyBytes_Size(item);
 708                 }
 709         }
 710
 711         new_el = talloc_zero(tmp_ctx, struct ldb_message_element);
 712         if (new_el == NULL) {
 713                 PyErr_NoMemory();
 714                 talloc_free(tmp_ctx);
 715                 return NULL;
 716         }
 717
 718         /* Normalise "objectClass" attribute if needed */
 719         if (ldb_attr_cmp(a->lDAPDisplayName, "objectClass") == 0) {
 720                 int iret;
 721                 iret = dsdb_sort_objectClass_attr(ldb, schema, el, new_el, new_el);
 722                 if (iret != LDB_SUCCESS) {
 723                         PyErr_SetString(PyExc_RuntimeError, ldb_errstring(ldb));
 724                         talloc_free(tmp_ctx);
 725                         return NULL;
 726                 }
 727         }
 728
 729         /* first run ldb_to_drsuapi, then convert back again. This has
 730          * the effect of normalising the attributes
 731          */
 732
 733         attr = talloc_zero(tmp_ctx, struct drsuapi_DsReplicaAttribute);
 734         if (attr == NULL) {
 735                 PyErr_NoMemory();
 736                 talloc_free(tmp_ctx);
 737                 return NULL;
 738         }
 739
 740         werr = a->syntax->ldb_to_drsuapi(&syntax_ctx, a, el, attr, attr);
 741         PyErr_WERROR_NOT_OK_RAISE(werr);
 742
 743         /* now convert back again */
 744         werr = a->syntax->drsuapi_to_ldb(&syntax_ctx, a, attr, new_el, new_el);
 745         PyErr_WERROR_NOT_OK_RAISE(werr);
 746
 747         module = PyImport_ImportModule("ldb");
 748         if (module == NULL) {
 749                 return NULL;
 750         }
 751
 752         py_type = (PyTypeObject *)PyObject_GetAttrString(module, "MessageElement");
 753         if (py_type == NULL) {
 754                 Py_DECREF(module);
 755                 return NULL;
 756         }
 757
 758         Py_CLEAR(module);
 759
 760         py_ret = py_type->tp_alloc(py_type, 0);
 761         Py_CLEAR(py_type);
 762         if (py_ret == NULL) {
 763                 PyErr_NoMemory();
 764                 return NULL;
 765         }
 766         ret = (PyLdbMessageElementObject *)py_ret;
 767
 768         ret->mem_ctx = talloc_new(NULL);
 769         if (talloc_reference(ret->mem_ctx, new_el) == NULL) {
 770                 Py_CLEAR(py_ret);
 771                 PyErr_NoMemory();
 772                 return NULL;
 773         }
 774         ret->el = new_el;
 775
 776         talloc_free(tmp_ctx);
 777
 778         return py_ret;
 779 }
 780
 781
 782 static PyObject *py_dsdb_set_ntds_invocation_id(PyObject *self, PyObject *args)
 783 {
 784         PyObject *py_ldb, *py_guid;
 785         bool ret;
 786         struct GUID guid;
 787         struct ldb_context *ldb;
 788         if (!PyArg_ParseTuple(args, "OO", &py_ldb, &py_guid))
 789                 return NULL;
 790
 791         PyErr_LDB_OR_RAISE(py_ldb, ldb);
 792         GUID_from_string(PyUnicode_AsUTF8(py_guid), &guid);
 793
 794         if (GUID_all_zero(&guid)) {
 795                 PyErr_SetString(PyExc_RuntimeError, "set_ntds_invocation_id rejected due to all-zero invocation ID");
 796                 return NULL;
 797         }
 798
 799         ret = samdb_set_ntds_invocation_id(ldb, &guid);
 800         if (!ret) {
 801                 PyErr_SetString(PyExc_RuntimeError, "set_ntds_invocation_id failed");
 802                 return NULL;
 803         }
 804         Py_RETURN_NONE;
 805 }
 806
 807 static PyObject *py_samdb_ntds_objectGUID(PyObject *self, PyObject *args)
 808 {
 809         PyObject *py_ldb, *result;
 810         struct ldb_context *ldb;
 811         const struct GUID *guid;
 812         char *retstr;
 813
 814         if (!PyArg_ParseTuple(args, "O", &py_ldb)) {
 815                 return NULL;
 816         }
 817
 818         PyErr_LDB_OR_RAISE(py_ldb, ldb);
 819
 820         guid = samdb_ntds_objectGUID(ldb);
 821         if (guid == NULL) {
 822                 PyErr_SetString(PyExc_RuntimeError, "Failed to find NTDS GUID");
 823                 return NULL;
 824         }
 825
 826         retstr = GUID_string(NULL, guid);
 827         if (retstr == NULL) {
 828                 PyErr_NoMemory();
 829                 return NULL;
 830         }
 831         result = PyUnicode_FromString(retstr);
 832         talloc_free(retstr);
 833         return result;
 834 }
 835
 836 static PyObject *py_dsdb_set_global_schema(PyObject *self, PyObject *args)
 837 {
 838         PyObject *py_ldb;
 839         struct ldb_context *ldb;
 840         int ret;
 841         if (!PyArg_ParseTuple(args, "O", &py_ldb))
 842                 return NULL;
 843
 844         PyErr_LDB_OR_RAISE(py_ldb, ldb);
 845
 846         ret = dsdb_set_global_schema(ldb);
 847         PyErr_LDB_ERROR_IS_ERR_RAISE(py_ldb_get_exception(), ret, ldb);
 848
 849         Py_RETURN_NONE;
 850 }
 851
 852 static PyObject *py_dsdb_load_partition_usn(PyObject *self, PyObject *args)
 853 {
 854         PyObject *py_dn, *py_ldb, *result;
 855         struct ldb_dn *dn;
 856         uint64_t highest_uSN, urgent_uSN;
 857         struct ldb_context *ldb;
 858         TALLOC_CTX *mem_ctx;
 859         int ret;
 860
 861         if (!PyArg_ParseTuple(args, "OO", &py_ldb, &py_dn)) {
 862                 return NULL;
 863         }
 864
 865         PyErr_LDB_OR_RAISE(py_ldb, ldb);
 866
 867         mem_ctx = talloc_new(NULL);
 868         if (mem_ctx == NULL) {
 869                 PyErr_NoMemory();
 870                 return NULL;
 871         }
 872
 873         if (!pyldb_Object_AsDn(mem_ctx, py_dn, ldb, &dn)) {
 874                 talloc_free(mem_ctx);
 875                 return NULL;
 876         }
 877
 878         ret = dsdb_load_partition_usn(ldb, dn, &highest_uSN, &urgent_uSN);
 879         if (ret != LDB_SUCCESS) {
 880            PyErr_Format(PyExc_RuntimeError,
 881                         "Failed to load partition [%s] uSN - %s",
 882                         ldb_dn_get_linearized(dn),
 883                         ldb_errstring(ldb));
 884            talloc_free(mem_ctx);
 885            return NULL;
 886         }
 887
 888         talloc_free(mem_ctx);
 889
 890         result = Py_BuildValue(
 891                         "{s:l, s:l}",
 892                         "uSNHighest", (uint64_t)highest_uSN,
 893                         "uSNUrgent", (uint64_t)urgent_uSN);
 894
 895         return result;
 896 }
 897
 898 static PyObject *py_dsdb_set_am_rodc(PyObject *self, PyObject *args)
 899 {
 900         PyObject *py_ldb;
 901         bool ret;
 902         struct ldb_context *ldb;
 903         int py_val;
 904
 905         if (!PyArg_ParseTuple(args, "Oi", &py_ldb, &py_val))
 906                 return NULL;
 907
 908         PyErr_LDB_OR_RAISE(py_ldb, ldb);
 909         ret = samdb_set_am_rodc(ldb, (bool)py_val);
 910         if (!ret) {
 911                 PyErr_SetString(PyExc_RuntimeError, "set_am_rodc failed");
 912                 return NULL;
 913         }
 914         Py_RETURN_NONE;
 915 }
 916
 917 static PyObject *py_dsdb_set_schema_from_ldif(PyObject *self, PyObject *args)
 918 {
 919         WERROR result;
 920         char *pf, *df, *dn;
 921         PyObject *py_ldb;
 922         struct ldb_context *ldb;
 923
 924         if (!PyArg_ParseTuple(args, "Osss", &py_ldb, &pf, &df, &dn))
 925                 return NULL;
 926
 927         PyErr_LDB_OR_RAISE(py_ldb, ldb);
 928
 929         result = dsdb_set_schema_from_ldif(ldb, pf, df, dn);
 930         PyErr_WERROR_NOT_OK_RAISE(result);
 931
 932         Py_RETURN_NONE;
 933 }
 934
 935 static PyObject *py_dsdb_set_schema_from_ldb(PyObject *self, PyObject *args)
 936 {
 937         PyObject *py_ldb;
 938         struct ldb_context *ldb;
 939         PyObject *py_from_ldb;
 940         struct ldb_context *from_ldb;
 941         struct dsdb_schema *schema;
 942         int ret;
 943         char write_indices_and_attributes = SCHEMA_WRITE;
 944         if (!PyArg_ParseTuple(args, "OO|b",
 945                               &py_ldb, &py_from_ldb, &write_indices_and_attributes))
 946                 return NULL;
 947
 948         PyErr_LDB_OR_RAISE(py_ldb, ldb);
 949
 950         PyErr_LDB_OR_RAISE(py_from_ldb, from_ldb);
 951
 952         schema = dsdb_get_schema(from_ldb, NULL);
 953         if (!schema) {
 954                 PyErr_SetString(PyExc_RuntimeError, "Failed to set find a schema on 'from' ldb!\n");
 955                 return NULL;
 956         }
 957
 958         ret = dsdb_reference_schema(ldb, schema, write_indices_and_attributes);
 959         PyErr_LDB_ERROR_IS_ERR_RAISE(py_ldb_get_exception(), ret, ldb);
 960
 961         Py_RETURN_NONE;
 962 }
 963
 964 static PyObject *py_dsdb_write_prefixes_from_schema_to_ldb(PyObject *self, PyObject *args)
 965 {
 966         PyObject *py_ldb;
 967         struct ldb_context *ldb;
 968         WERROR result;
 969         struct dsdb_schema *schema;
 970
 971         if (!PyArg_ParseTuple(args, "O", &py_ldb))
 972                 return NULL;
 973
 974         PyErr_LDB_OR_RAISE(py_ldb, ldb);
 975
 976         schema = dsdb_get_schema(ldb, NULL);
 977         if (!schema) {
 978                 PyErr_SetString(PyExc_RuntimeError, "Failed to set find a schema on ldb!\n");
 979                 return NULL;
 980         }
 981
 982         result = dsdb_write_prefixes_from_schema_to_ldb(NULL, ldb, schema);
 983         PyErr_WERROR_NOT_OK_RAISE(result);
 984
 985         Py_RETURN_NONE;
 986 }
 987
 988
 989 static PyObject *py_dsdb_get_partitions_dn(PyObject *self, PyObject *args)
 990 {
 991         struct ldb_context *ldb;
 992         struct ldb_dn *dn;
 993         PyObject *py_ldb, *ret;
 994
 995         if (!PyArg_ParseTuple(args, "O", &py_ldb))
 996                 return NULL;
 997
 998         PyErr_LDB_OR_RAISE(py_ldb, ldb);
 999
1000         dn = samdb_partitions_dn(ldb, NULL);
1001         if (dn == NULL) {
1002                 PyErr_NoMemory();
1003                 return NULL;
1004         }
1005         ret = pyldb_Dn_FromDn(dn);
1006         talloc_free(dn);
1007         return ret;
1008 }
1009
1010
1011 static PyObject *py_dsdb_get_nc_root(PyObject *self, PyObject *args)
1012 {
1013         struct ldb_context *ldb;
1014         struct ldb_dn *dn, *nc_root;
1015         PyObject *py_ldb, *py_ldb_dn, *py_nc_root;
1016         int ret;
1017
1018         if (!PyArg_ParseTuple(args, "OO", &py_ldb, &py_ldb_dn))
1019                 return NULL;
1020
1021         PyErr_LDB_OR_RAISE(py_ldb, ldb);
1022         PyErr_LDB_DN_OR_RAISE(py_ldb_dn, dn);
1023
1024         ret = dsdb_find_nc_root(ldb, ldb, dn, &nc_root);
1025         PyErr_LDB_ERROR_IS_ERR_RAISE(py_ldb_get_exception(), ret, ldb);
1026
1027         py_nc_root = pyldb_Dn_FromDn(nc_root);
1028         talloc_unlink(ldb, nc_root);
1029         return py_nc_root;
1030 }
1031
1032 static PyObject *py_dsdb_get_wellknown_dn(PyObject *self, PyObject *args)
1033 {
1034         struct ldb_context *ldb;
1035         struct ldb_dn *nc_dn, *wk_dn;
1036         char *wkguid;
1037         PyObject *py_ldb, *py_nc_dn, *py_wk_dn;
1038         int ret;
1039
1040         if (!PyArg_ParseTuple(args, "OOs", &py_ldb, &py_nc_dn, &wkguid))
1041                 return NULL;
1042
1043         PyErr_LDB_OR_RAISE(py_ldb, ldb);
1044         PyErr_LDB_DN_OR_RAISE(py_nc_dn, nc_dn);
1045
1046         ret = dsdb_wellknown_dn(ldb, ldb, nc_dn, wkguid, &wk_dn);
1047         if (ret == LDB_ERR_NO_SUCH_OBJECT) {
1048                 PyErr_Format(PyExc_KeyError, "Failed to find well known DN for GUID %s", wkguid);
1049                 return NULL;
1050         }
1051
1052         PyErr_LDB_ERROR_IS_ERR_RAISE(py_ldb_get_exception(), ret, ldb);
1053
1054         py_wk_dn = pyldb_Dn_FromDn(wk_dn);
1055         talloc_unlink(ldb, wk_dn);
1056         return py_wk_dn;
1057 }
1058
1059
1060 /*
1061   call into samdb_rodc()
1062  */
1063 static PyObject *py_dsdb_am_rodc(PyObject *self, PyObject *args)
1064 {
1065         PyObject *py_ldb;
1066         struct ldb_context *ldb;
1067         int ret;
1068         bool am_rodc;
1069
1070         if (!PyArg_ParseTuple(args, "O", &py_ldb))
1071                 return NULL;
1072
1073         PyErr_LDB_OR_RAISE(py_ldb, ldb);
1074
1075         ret = samdb_rodc(ldb, &am_rodc);
1076         if (ret != LDB_SUCCESS) {
1077                 PyErr_SetString(PyExc_RuntimeError, ldb_errstring(ldb));
1078                 return NULL;
1079         }
1080
1081         return PyBool_FromLong(am_rodc);
1082 }
1083
1084 /*
1085   call into samdb_is_pdc()
1086  */
1087 static PyObject *py_dsdb_am_pdc(PyObject *self, PyObject *args)
1088 {
1089         PyObject *py_ldb;
1090         struct ldb_context *ldb;
1091         bool am_pdc;
1092
1093         if (!PyArg_ParseTuple(args, "O", &py_ldb))
1094                 return NULL;
1095
1096         PyErr_LDB_OR_RAISE(py_ldb, ldb);
1097
1098         am_pdc = samdb_is_pdc(ldb);
1099         return PyBool_FromLong(am_pdc);
1100 }
1101
1102 /*
1103   call DSDB_EXTENDED_CREATE_OWN_RID_SET to get a new RID set for this server
1104  */
1105 static PyObject *py_dsdb_create_own_rid_set(PyObject *self, PyObject *args)
1106 {
1107         PyObject *py_ldb;
1108         struct ldb_context *ldb;
1109         int ret;
1110         struct ldb_result *ext_res;
1111
1112         if (!PyArg_ParseTuple(args, "O", &py_ldb))
1113                 return NULL;
1114
1115         PyErr_LDB_OR_RAISE(py_ldb, ldb);
1116
1117         /*
1118          * Run DSDB_EXTENDED_CREATE_OWN_RID_SET to get a RID set
1119          */
1120
1121         ret = ldb_extended(ldb, DSDB_EXTENDED_CREATE_OWN_RID_SET, NULL, &ext_res);
1122
1123         PyErr_LDB_ERROR_IS_ERR_RAISE(py_ldb_get_exception(), ret, ldb);
1124
1125         TALLOC_FREE(ext_res);
1126
1127         Py_RETURN_NONE;
1128 }
1129
1130 /*
1131   call DSDB_EXTENDED_ALLOCATE_RID to get a new RID set for this server
1132  */
1133 static PyObject *py_dsdb_allocate_rid(PyObject *self, PyObject *args)
1134 {
1135         PyObject *py_ldb;
1136         struct ldb_context *ldb;
1137         int ret;
1138         uint32_t rid;
1139         struct ldb_result *ext_res = NULL;
1140         struct dsdb_extended_allocate_rid *rid_return = NULL;
1141         if (!PyArg_ParseTuple(args, "O", &py_ldb)) {
1142                 return NULL;
1143         }
1144
1145         PyErr_LDB_OR_RAISE(py_ldb, ldb);
1146
1147         rid_return = talloc_zero(ldb, struct dsdb_extended_allocate_rid);
1148         if (rid_return == NULL) {
1149                 return PyErr_NoMemory();
1150         }
1151
1152         /*
1153          * Run DSDB_EXTENDED_ALLOCATE_RID to get a new RID
1154          */
1155
1156         ret = ldb_extended(ldb, DSDB_EXTENDED_ALLOCATE_RID, rid_return, &ext_res);
1157         if (ret != LDB_SUCCESS) {
1158                 TALLOC_FREE(rid_return);
1159                 TALLOC_FREE(ext_res);
1160                 PyErr_LDB_ERROR_IS_ERR_RAISE(py_ldb_get_exception(), ret, ldb);
1161         }
1162
1163         rid = rid_return->rid;
1164         TALLOC_FREE(rid_return);
1165         TALLOC_FREE(ext_res);
1166
1167         return PyLong_FromLong(rid);
1168 }
1169
1170 #ifdef AD_DC_BUILD_IS_ENABLED
1171 /*
1172  * These functions will not work correctly on non-AD_DC builds.
1173  *
1174  * The only real principal in deciding whether to put something within
1175  * these guards is whether it will compile and work when
1176  * bld.AD_DC_BUILD_IS_ENABLED() says no.
1177  *
1178  * Most of DSDB is built and samba-tool will work fine with remote
1179  * servers (using -H ldap://), but some DNS and periodic service
1180  * functions are not built.
1181  */
1182
1183 static PyObject *py_dns_delete_tombstones(PyObject *self, PyObject *args)
1184 {
1185         PyObject *py_ldb;
1186         NTSTATUS status;
1187         struct ldb_context *ldb = NULL;
1188         TALLOC_CTX *mem_ctx = NULL;
1189         char *error_string = NULL;
1190
1191         if (!PyArg_ParseTuple(args, "O", &py_ldb)) {
1192                 return NULL;
1193         }
1194         PyErr_LDB_OR_RAISE(py_ldb, ldb);
1195
1196         mem_ctx = talloc_new(ldb);
1197         if (mem_ctx == NULL) {
1198                 return PyErr_NoMemory();
1199         }
1200
1201         status = dns_delete_tombstones(mem_ctx, ldb, &error_string);
1202
1203         if (!NT_STATUS_IS_OK(status)) {
1204                 if (error_string) {
1205                         PyErr_Format(PyExc_RuntimeError, "%s", error_string);
1206                 } else {
1207                         PyErr_SetNTSTATUS(status);
1208                 }
1209                 TALLOC_FREE(mem_ctx);
1210                 return NULL;
1211         }
1212
1213         TALLOC_FREE(mem_ctx);
1214         Py_RETURN_NONE;
1215 }
1216
1217 static PyObject *py_scavenge_dns_records(PyObject *self, PyObject *args)
1218 {
1219         PyObject *py_ldb;
1220         NTSTATUS status;
1221         struct ldb_context *ldb = NULL;
1222         TALLOC_CTX *mem_ctx = NULL;
1223         char *error_string = NULL;
1224
1225         if (!PyArg_ParseTuple(args, "O", &py_ldb)) {
1226                 return NULL;
1227         }
1228         PyErr_LDB_OR_RAISE(py_ldb, ldb);
1229
1230         mem_ctx = talloc_new(ldb);
1231         if (mem_ctx == NULL) {
1232                 return PyErr_NoMemory();
1233         }
1234
1235         status = dns_tombstone_records(mem_ctx, ldb, &error_string);
1236
1237         if (!NT_STATUS_IS_OK(status)) {
1238                 if (error_string) {
1239                         PyErr_Format(PyExc_RuntimeError, "%s", error_string);
1240                 } else {
1241                         PyErr_SetNTSTATUS(status);
1242                 }
1243                 TALLOC_FREE(mem_ctx);
1244                 return NULL;
1245         }
1246
1247         TALLOC_FREE(mem_ctx);
1248         Py_RETURN_NONE;
1249 }
1250
1251 static PyObject *py_dsdb_garbage_collect_tombstones(PyObject *self, PyObject *args)
1252 {
1253         PyObject *py_ldb, *py_list_dn;
1254         struct ldb_context *ldb = NULL;
1255         Py_ssize_t i;
1256         Py_ssize_t length;
1257         long long _current_time, _tombstone_lifetime = LLONG_MAX;
1258         uint32_t tombstone_lifetime32;
1259         struct dsdb_ldb_dn_list_node *part = NULL;
1260         time_t current_time, tombstone_lifetime;
1261         TALLOC_CTX *mem_ctx = NULL;
1262         NTSTATUS status;
1263         unsigned int num_objects_removed = 0;
1264         unsigned int num_links_removed = 0;
1265         char *error_string = NULL;
1266
1267         if (!PyArg_ParseTuple(args, "OOL|L", &py_ldb,
1268                               &py_list_dn, &_current_time, &_tombstone_lifetime)) {
1269                 return NULL;
1270         }
1271
1272
1273         PyErr_LDB_OR_RAISE(py_ldb, ldb);
1274
1275         mem_ctx = talloc_new(ldb);
1276         if (mem_ctx == NULL) {
1277                 return PyErr_NoMemory();
1278         }
1279
1280         current_time = _current_time;
1281
1282         if (_tombstone_lifetime == LLONG_MAX) {
1283                 int ret = dsdb_tombstone_lifetime(ldb, &tombstone_lifetime32);
1284                 if (ret != LDB_SUCCESS) {
1285                         PyErr_Format(PyExc_RuntimeError,
1286                                      "Failed to get tombstone lifetime: %s",
1287                                      ldb_errstring(ldb));
1288                         TALLOC_FREE(mem_ctx);
1289                         return NULL;
1290                 }
1291                 tombstone_lifetime = tombstone_lifetime32;
1292         } else {
1293                 tombstone_lifetime = _tombstone_lifetime;
1294         }
1295
1296         if (!PyList_Check(py_list_dn)) {
1297                 PyErr_SetString(PyExc_TypeError, "A list of DNs were expected");
1298                 TALLOC_FREE(mem_ctx);
1299                 return NULL;
1300         }
1301
1302         length = PyList_GET_SIZE(py_list_dn);
1303
1304         for (i = 0; i < length; i++) {
1305                 const char *part_str = PyUnicode_AsUTF8(PyList_GetItem(py_list_dn, i));
1306                 struct ldb_dn *p;
1307                 struct dsdb_ldb_dn_list_node *node;
1308
1309                 if (part_str == NULL) {
1310                         TALLOC_FREE(mem_ctx);
1311                         return PyErr_NoMemory();
1312                 }
1313
1314                 p = ldb_dn_new(mem_ctx, ldb, part_str);
1315                 if (p == NULL) {
1316                         PyErr_Format(PyExc_RuntimeError, "Failed to parse DN %s", part_str);
1317                         TALLOC_FREE(mem_ctx);
1318                         return NULL;
1319                 }
1320                 node = talloc_zero(mem_ctx, struct dsdb_ldb_dn_list_node);
1321                 node->dn = p;
1322
1323                 DLIST_ADD_END(part, node);
1324         }
1325
1326         status = dsdb_garbage_collect_tombstones(mem_ctx, ldb,
1327                                                  part, current_time,
1328                                                  tombstone_lifetime,
1329                                                  &num_objects_removed,
1330                                                  &num_links_removed,
1331                                                  &error_string);
1332
1333         if (!NT_STATUS_IS_OK(status)) {
1334                 if (error_string) {
1335                         PyErr_Format(PyExc_RuntimeError, "%s", error_string);
1336                 } else {
1337                         PyErr_SetNTSTATUS(status);
1338                 }
1339                 TALLOC_FREE(mem_ctx);
1340                 return NULL;
1341         }
1342
1343         TALLOC_FREE(mem_ctx);
1344
1345         return Py_BuildValue("(II)", num_objects_removed,
1346                             num_links_removed);
1347 }
1348
1349 #else
1350
1351 static PyObject *py_dsdb_not_implemented(PyObject *self, PyObject *args)
1352 {
1353         PyErr_SetString(PyExc_NotImplementedError,
1354                         "Library built without AD DC support");
1355         return NULL;
1356 }
1357
1358 #endif /* AD_DC_BUILD_IS_ENABLED */
1359
1360
1361 static PyObject *py_dsdb_create_gkdi_root_key(PyObject *self, PyObject *args, PyObject *kwargs)
1362 {
1363         int ret;
1364         PyObject *py_ldb = NULL;
1365         PyObject *py_dn = NULL;
1366         struct ldb_context *samdb;
1367         /* long long time for Python conversions, NTTIME for Samba libs */
1368         unsigned long long ll_current_time = 0;
1369         unsigned long long ll_use_start_time = 0;
1370         NTTIME current_time, use_start_time;
1371         struct GUID root_key_id = {0};
1372         const struct ldb_message * root_key_msg = NULL;
1373
1374         TALLOC_CTX *tmp_ctx = NULL;
1375         const char * const kwnames[] = {
1376                 "ldb",
1377                 "current_time",
1378                 "use_start_time",
1379                 NULL
1380         };
1381
1382         if (!PyArg_ParseTupleAndKeywords(args, kwargs, "O|KK",
1383                                          discard_const_p(char *, kwnames),
1384                                          &py_ldb,
1385                                          &ll_current_time,
1386                                          &ll_use_start_time)) {
1387                 return NULL;
1388         }
1389
1390         PyErr_LDB_OR_RAISE(py_ldb, samdb);
1391
1392         current_time = ll_current_time;
1393         use_start_time = ll_use_start_time;
1394         /*
1395          * If current_time or use_start_time are not provided, we use
1396          * now. FIXME? should use_start_time be +10 hours or something?
1397          */
1398         if (current_time == 0 || use_start_time == 0) {
1399                 struct timeval now = timeval_current();
1400                 NTTIME nt_now = timeval_to_nttime(&now);
1401                 if (current_time == 0) {
1402                         current_time = nt_now;
1403                 }
1404                 if (use_start_time == 0) {
1405                         use_start_time = nt_now;
1406                 }
1407         }
1408
1409         tmp_ctx = talloc_new(samdb);
1410         if (tmp_ctx == NULL) {
1411                 return PyErr_NoMemory();
1412         }
1413         ret = gkdi_new_root_key(tmp_ctx,
1414                                 samdb,
1415                                 current_time,
1416                                 use_start_time,
1417                                 &root_key_id,
1418                                 &root_key_msg);
1419
1420         PyErr_LDB_ERROR_IS_ERR_RAISE_FREE(py_ldb_get_exception(), ret,
1421                                           samdb, tmp_ctx);
1422
1423
1424         py_dn = pyldb_Dn_FromDn(root_key_msg->dn);
1425         if (py_dn == NULL) {
1426                 PyErr_LDB_ERROR_IS_ERR_RAISE_FREE(py_ldb_get_exception(),
1427                                                   LDB_ERR_OPERATIONS_ERROR,
1428                                                   samdb, tmp_ctx);
1429         }
1430
1431         /*
1432          * py_dn keeps a talloc_reference to it's own dn, and the
1433          * root_key is in the database.
1434          */
1435         TALLOC_FREE(tmp_ctx);
1436         return py_dn;
1437 }
1438
1439
1440 static PyObject *py_dsdb_load_udv_v2(PyObject *self, PyObject *args)
1441 {
1442         uint32_t count;
1443         int ret, i;
1444         bool ok;
1445         PyObject *py_ldb = NULL, *py_dn = NULL, *pylist = NULL;
1446         struct ldb_context *samdb = NULL;
1447         struct ldb_dn *dn = NULL;
1448         struct drsuapi_DsReplicaCursor2 *cursors = NULL;
1449         TALLOC_CTX *tmp_ctx = NULL;
1450
1451         if (!PyArg_ParseTuple(args, "OO", &py_ldb, &py_dn)) {
1452                 return NULL;
1453         }
1454
1455         PyErr_LDB_OR_RAISE(py_ldb, samdb);
1456
1457         tmp_ctx = talloc_new(samdb);
1458         if (tmp_ctx == NULL) {
1459                 return PyErr_NoMemory();
1460         }
1461
1462         ok = pyldb_Object_AsDn(tmp_ctx, py_dn, samdb, &dn);
1463         if (!ok) {
1464                 TALLOC_FREE(tmp_ctx);
1465                 return NULL;
1466         }
1467
1468         ret = dsdb_load_udv_v2(samdb, dn, tmp_ctx, &cursors, &count);
1469         if (ret != LDB_SUCCESS) {
1470                 TALLOC_FREE(tmp_ctx);
1471                 PyErr_SetString(PyExc_RuntimeError,
1472                                 "Failed to load udv from ldb");
1473                 return NULL;
1474         }
1475
1476         pylist = PyList_New(count);
1477         if (pylist == NULL) {
1478                 TALLOC_FREE(tmp_ctx);
1479                 return PyErr_NoMemory();
1480         }
1481
1482         for (i = 0; i < count; i++) {
1483                 PyObject *py_cursor;
1484                 struct drsuapi_DsReplicaCursor2 *cursor;
1485                 cursor = talloc(tmp_ctx, struct drsuapi_DsReplicaCursor2);
1486                 if (cursor == NULL) {
1487                         TALLOC_FREE(tmp_ctx);
1488                         return PyErr_NoMemory();
1489                 }
1490                 *cursor = cursors[i];
1491
1492                 py_cursor = py_return_ndr_struct("samba.dcerpc.drsuapi",
1493                                                  "DsReplicaCursor2",
1494                                                  cursor, cursor);
1495                 if (py_cursor == NULL) {
1496                         TALLOC_FREE(tmp_ctx);
1497                         return PyErr_NoMemory();
1498                 }
1499
1500                 PyList_SetItem(pylist, i, py_cursor);
1501         }
1502
1503         TALLOC_FREE(tmp_ctx);
1504         return pylist;
1505 }
1506
1507 static PyObject *py_dsdb_user_account_control_flag_bit_to_string(PyObject *self, PyObject *args)
1508 {
1509         const char *str;
1510         long long uf;
1511         if (!PyArg_ParseTuple(args, "L", &uf)) {
1512                 return NULL;
1513         }
1514
1515         if (uf > UINT32_MAX) {
1516                 return PyErr_Format(PyExc_OverflowError, "No UF_ flags are over UINT32_MAX");
1517         }
1518         if (uf < 0) {
1519                 return PyErr_Format(PyExc_KeyError, "No UF_ flags are less then zero");
1520         }
1521
1522         str = dsdb_user_account_control_flag_bit_to_string(uf);
1523         if (str == NULL) {
1524                 return PyErr_Format(PyExc_KeyError,
1525                                     "No such UF_ flag 0x%08x",
1526                                     (unsigned int)uf);
1527         }
1528         return PyUnicode_FromString(str);
1529 }
1530
1531 static PyObject *py_dsdb_check_and_update_fl(PyObject *self, PyObject *args)
1532 {
1533         TALLOC_CTX *frame = NULL;
1534
1535         PyObject *py_ldb = NULL, *py_lp = NULL;
1536         struct ldb_context *ldb = NULL;
1537         struct loadparm_context *lp_ctx = NULL;
1538
1539         int ret;
1540
1541         if (!PyArg_ParseTuple(args, "OO", &py_ldb, &py_lp)) {
1542                 return NULL;
1543         }
1544
1545         PyErr_LDB_OR_RAISE(py_ldb, ldb);
1546
1547         frame = talloc_stackframe();
1548
1549         lp_ctx = lpcfg_from_py_object(frame, py_lp);
1550         if (lp_ctx == NULL) {
1551                 TALLOC_FREE(frame);
1552                 return NULL;
1553         }
1554
1555         ret = dsdb_check_and_update_fl(ldb, lp_ctx);
1556         TALLOC_FREE(frame);
1557
1558         PyErr_LDB_ERROR_IS_ERR_RAISE(py_ldb_get_exception(), ret, ldb);
1559
1560         Py_RETURN_NONE;
1561 }
1562
1563 static PyObject *py_dsdb_dc_operatingSystemVersion(PyObject *self, PyObject *args)
1564 {
1565         const char *str = NULL;
1566         int dc_level = 0;
1567
1568         if (!PyArg_ParseTuple(args, "i", &dc_level)) {
1569                 return NULL;
1570         }
1571
1572         str = dsdb_dc_operatingSystemVersion(dc_level);
1573         if (str == NULL) {
1574                 return PyErr_Format(PyExc_KeyError,
1575                                     "dsdb_dc_operatingSystemVersion(%d) failed",
1576                                     dc_level);
1577         }
1578
1579         return PyUnicode_FromString(str);
1580 }
1581
1582 static PyMethodDef py_dsdb_methods[] = {
1583         { "_samdb_server_site_name", (PyCFunction)py_samdb_server_site_name,
1584                 METH_VARARGS, "Get the server site name as a string"},
1585         { "_dsdb_convert_schema_to_openldap",
1586                 (PyCFunction)py_dsdb_convert_schema_to_openldap, METH_VARARGS,
1587                 "dsdb_convert_schema_to_openldap(ldb, target_str, mapping) -> str\n"
1588                 "Create an OpenLDAP schema from a schema." },
1589         { "_samdb_set_domain_sid", (PyCFunction)py_samdb_set_domain_sid,
1590                 METH_VARARGS,
1591                 "samdb_set_domain_sid(samdb, sid)\n"
1592                 "Set SID of domain to use." },
1593         { "_samdb_get_domain_sid", (PyCFunction)py_samdb_get_domain_sid,
1594                 METH_VARARGS,
1595                 "samdb_get_domain_sid(samdb)\n"
1596                 "Get SID of domain in use." },
1597         { "_samdb_ntds_invocation_id", (PyCFunction)py_samdb_ntds_invocation_id,
1598                 METH_VARARGS, "get the NTDS invocation ID GUID as a string"},
1599         { "_samdb_set_ntds_settings_dn", (PyCFunction)py_samdb_set_ntds_settings_dn,
1600                 METH_VARARGS,
1601                 "samdb_set_ntds_settings_dn(samdb, ntds_settings_dn)\n"
1602                 "Set NTDS Settings DN for this LDB (allows it to be set before the DB fully exists)." },
1603         { "_dsdb_get_oid_from_attid", (PyCFunction)py_dsdb_get_oid_from_attid,
1604                 METH_VARARGS, NULL },
1605         { "_dsdb_get_attid_from_lDAPDisplayName", (PyCFunction)py_dsdb_get_attid_from_lDAPDisplayName,
1606                 METH_VARARGS, NULL },
1607         { "_dsdb_get_syntax_oid_from_lDAPDisplayName", (PyCFunction)py_dsdb_get_syntax_oid_from_lDAPDisplayName,
1608                 METH_VARARGS, NULL },
1609         { "_dsdb_get_systemFlags_from_lDAPDisplayName", (PyCFunction)py_dsdb_get_systemFlags_from_lDAPDisplayName,
1610                 METH_VARARGS, NULL },
1611         { "_dsdb_get_linkId_from_lDAPDisplayName", (PyCFunction)py_dsdb_get_linkId_from_lDAPDisplayName,
1612                 METH_VARARGS, NULL },
1613         { "_dsdb_get_lDAPDisplayName_by_attid", (PyCFunction)py_dsdb_get_lDAPDisplayName_by_attid,
1614                 METH_VARARGS, NULL },
1615         { "_dsdb_get_backlink_from_lDAPDisplayName", (PyCFunction)py_dsdb_get_backlink_from_lDAPDisplayName,
1616                 METH_VARARGS, NULL },
1617         { "_dsdb_set_ntds_invocation_id",
1618                 (PyCFunction)py_dsdb_set_ntds_invocation_id, METH_VARARGS,
1619                 NULL },
1620         { "_samdb_ntds_objectGUID", (PyCFunction)py_samdb_ntds_objectGUID,
1621                 METH_VARARGS, "get the NTDS objectGUID as a string"},
1622         { "_dsdb_set_global_schema", (PyCFunction)py_dsdb_set_global_schema,
1623                 METH_VARARGS, NULL },
1624         { "_dsdb_load_partition_usn", (PyCFunction)py_dsdb_load_partition_usn,
1625                 METH_VARARGS,
1626                 "get uSNHighest and uSNUrgent from the partition @REPLCHANGED"},
1627         { "_dsdb_set_am_rodc",
1628                 (PyCFunction)py_dsdb_set_am_rodc, METH_VARARGS,
1629                 NULL },
1630         { "_am_rodc",
1631                 (PyCFunction)py_dsdb_am_rodc, METH_VARARGS,
1632                 NULL },
1633         { "_am_pdc",
1634                 (PyCFunction)py_dsdb_am_pdc, METH_VARARGS,
1635                 NULL },
1636         { "_dsdb_set_schema_from_ldif", (PyCFunction)py_dsdb_set_schema_from_ldif, METH_VARARGS,
1637                 NULL },
1638         { "_dsdb_set_schema_from_ldb", (PyCFunction)py_dsdb_set_schema_from_ldb, METH_VARARGS,
1639                 NULL },
1640         { "_dsdb_write_prefixes_from_schema_to_ldb", (PyCFunction)py_dsdb_write_prefixes_from_schema_to_ldb, METH_VARARGS,
1641                 NULL },
1642         { "_dsdb_get_partitions_dn", (PyCFunction)py_dsdb_get_partitions_dn, METH_VARARGS, NULL },
1643         { "_dsdb_get_nc_root", (PyCFunction)py_dsdb_get_nc_root, METH_VARARGS, NULL },
1644         { "_dsdb_get_wellknown_dn", (PyCFunction)py_dsdb_get_wellknown_dn, METH_VARARGS, NULL },
1645         { "_dsdb_DsReplicaAttribute", (PyCFunction)py_dsdb_DsReplicaAttribute, METH_VARARGS, NULL },
1646         { "_dsdb_normalise_attributes", (PyCFunction)py_dsdb_normalise_attributes, METH_VARARGS, NULL },
1647 #ifdef AD_DC_BUILD_IS_ENABLED
1648         { "_dsdb_garbage_collect_tombstones", (PyCFunction)py_dsdb_garbage_collect_tombstones, METH_VARARGS,
1649                 "_dsdb_kcc_check_deleted(samdb, [dn], current_time, tombstone_lifetime)"
1650                 " -> (num_objects_expunged, num_links_expunged)" },
1651         { "_scavenge_dns_records", (PyCFunction)py_scavenge_dns_records,
1652                 METH_VARARGS, NULL},
1653         { "_dns_delete_tombstones", (PyCFunction)py_dns_delete_tombstones,
1654                 METH_VARARGS, NULL},
1655 #else
1656         { "_dsdb_garbage_collect_tombstones", (PyCFunction)py_dsdb_not_implemented,
1657                 METH_VARARGS, NULL},
1658         { "_scavenge_dns_records", (PyCFunction)py_dsdb_not_implemented,
1659                 METH_VARARGS, NULL},
1660         { "_dns_delete_tombstones", (PyCFunction)py_dsdb_not_implemented,
1661                 METH_VARARGS, NULL},
1662 #endif
1663         { "_dsdb_create_gkdi_root_key",
1664           (PyCFunction)py_dsdb_create_gkdi_root_key,
1665           METH_VARARGS | METH_KEYWORDS,
1666           PyDoc_STR("_dsdb_create_gkdi_root_key(samdb)"
1667                     " -> Dn of the new root key") },
1668         { "_dsdb_create_own_rid_set", (PyCFunction)py_dsdb_create_own_rid_set, METH_VARARGS,
1669                 "_dsdb_create_own_rid_set(samdb)"
1670                 " -> None" },
1671         { "_dsdb_allocate_rid", (PyCFunction)py_dsdb_allocate_rid, METH_VARARGS,
1672                 "_dsdb_allocate_rid(samdb)"
1673                 " -> RID" },
1674         { "_dsdb_load_udv_v2", (PyCFunction)py_dsdb_load_udv_v2, METH_VARARGS, NULL },
1675         { "user_account_control_flag_bit_to_string",
1676                 (PyCFunction)py_dsdb_user_account_control_flag_bit_to_string,
1677                 METH_VARARGS,
1678                 "user_account_control_flag_bit_to_string(bit)"
1679                 " -> string name" },
1680         { "check_and_update_fl",
1681                 (PyCFunction)py_dsdb_check_and_update_fl,
1682                 METH_VARARGS,
1683                 "check_and_update_fl(ldb, lp) -> None\n"
1684           "Hook to run in testing the code run on samba server startup "
1685           "to validate and update DC functional levels"},
1686         { "dc_operatingSystemVersion",
1687                 (PyCFunction)py_dsdb_dc_operatingSystemVersion,
1688                 METH_VARARGS,
1689                 "dsdb_dc_operatingSystemVersion(dc_level)"
1690                 " -> string name" },
1691         {0}
1692 };
1693
1694 static struct PyModuleDef moduledef = {
1695     PyModuleDef_HEAD_INIT,
1696     .m_name = "dsdb",
1697     .m_doc = "Python bindings for the directory service databases.",
1698     .m_size = -1,
1699     .m_methods = py_dsdb_methods,
1700 };
1701
1702 MODULE_INIT_FUNC(dsdb)
1703 {
1704         PyObject *m;
1705
1706         m = PyModule_Create(&moduledef);
1707
1708         if (m == NULL)
1709                 return NULL;
1710
1711 #define ADD_DSDB_FLAG(val)  PyModule_AddObject(m, #val, PyLong_FromLong(val))
1712
1713         /* "userAccountControl" flags */
1714         ADD_DSDB_FLAG(UF_NORMAL_ACCOUNT);
1715         ADD_DSDB_FLAG(UF_TEMP_DUPLICATE_ACCOUNT);
1716         ADD_DSDB_FLAG(UF_SERVER_TRUST_ACCOUNT);
1717         ADD_DSDB_FLAG(UF_WORKSTATION_TRUST_ACCOUNT);
1718         ADD_DSDB_FLAG(UF_INTERDOMAIN_TRUST_ACCOUNT);
1719         ADD_DSDB_FLAG(UF_PASSWD_NOTREQD);
1720         ADD_DSDB_FLAG(UF_ACCOUNTDISABLE);
1721
1722         ADD_DSDB_FLAG(UF_SCRIPT);
1723         ADD_DSDB_FLAG(UF_ACCOUNTDISABLE);
1724         ADD_DSDB_FLAG(UF_00000004);
1725         ADD_DSDB_FLAG(UF_HOMEDIR_REQUIRED);
1726         ADD_DSDB_FLAG(UF_LOCKOUT);
1727         ADD_DSDB_FLAG(UF_PASSWD_NOTREQD);
1728         ADD_DSDB_FLAG(UF_PASSWD_CANT_CHANGE);
1729         ADD_DSDB_FLAG(UF_ENCRYPTED_TEXT_PASSWORD_ALLOWED);
1730         ADD_DSDB_FLAG(UF_TEMP_DUPLICATE_ACCOUNT);
1731         ADD_DSDB_FLAG(UF_NORMAL_ACCOUNT);
1732         ADD_DSDB_FLAG(UF_00000400);
1733         ADD_DSDB_FLAG(UF_INTERDOMAIN_TRUST_ACCOUNT);
1734         ADD_DSDB_FLAG(UF_WORKSTATION_TRUST_ACCOUNT);
1735         ADD_DSDB_FLAG(UF_SERVER_TRUST_ACCOUNT);
1736         ADD_DSDB_FLAG(UF_00004000);
1737         ADD_DSDB_FLAG(UF_00008000);
1738         ADD_DSDB_FLAG(UF_DONT_EXPIRE_PASSWD);
1739         ADD_DSDB_FLAG(UF_MNS_LOGON_ACCOUNT);
1740         ADD_DSDB_FLAG(UF_SMARTCARD_REQUIRED);
1741         ADD_DSDB_FLAG(UF_TRUSTED_FOR_DELEGATION);
1742         ADD_DSDB_FLAG(UF_NOT_DELEGATED);
1743         ADD_DSDB_FLAG(UF_USE_DES_KEY_ONLY);
1744         ADD_DSDB_FLAG(UF_DONT_REQUIRE_PREAUTH);
1745         ADD_DSDB_FLAG(UF_PASSWORD_EXPIRED);
1746         ADD_DSDB_FLAG(UF_TRUSTED_TO_AUTHENTICATE_FOR_DELEGATION);
1747         ADD_DSDB_FLAG(UF_NO_AUTH_DATA_REQUIRED);
1748         ADD_DSDB_FLAG(UF_PARTIAL_SECRETS_ACCOUNT);
1749         ADD_DSDB_FLAG(UF_USE_AES_KEYS);
1750
1751         /* groupType flags */
1752         ADD_DSDB_FLAG(GTYPE_SECURITY_BUILTIN_LOCAL_GROUP);
1753         ADD_DSDB_FLAG(GTYPE_SECURITY_GLOBAL_GROUP);
1754         ADD_DSDB_FLAG(GTYPE_SECURITY_DOMAIN_LOCAL_GROUP);
1755         ADD_DSDB_FLAG(GTYPE_SECURITY_UNIVERSAL_GROUP);
1756         ADD_DSDB_FLAG(GTYPE_DISTRIBUTION_GLOBAL_GROUP);
1757         ADD_DSDB_FLAG(GTYPE_DISTRIBUTION_DOMAIN_LOCAL_GROUP);
1758         ADD_DSDB_FLAG(GTYPE_DISTRIBUTION_UNIVERSAL_GROUP);
1759
1760         /* "sAMAccountType" flags */
1761         ADD_DSDB_FLAG(ATYPE_NORMAL_ACCOUNT);
1762         ADD_DSDB_FLAG(ATYPE_WORKSTATION_TRUST);
1763         ADD_DSDB_FLAG(ATYPE_INTERDOMAIN_TRUST);
1764         ADD_DSDB_FLAG(ATYPE_SECURITY_GLOBAL_GROUP);
1765         ADD_DSDB_FLAG(ATYPE_SECURITY_LOCAL_GROUP);
1766         ADD_DSDB_FLAG(ATYPE_SECURITY_UNIVERSAL_GROUP);
1767         ADD_DSDB_FLAG(ATYPE_DISTRIBUTION_GLOBAL_GROUP);
1768         ADD_DSDB_FLAG(ATYPE_DISTRIBUTION_LOCAL_GROUP);
1769         ADD_DSDB_FLAG(ATYPE_DISTRIBUTION_UNIVERSAL_GROUP);
1770
1771         /* "domainFunctionality", "forestFunctionality" flags in the rootDSE */
1772         ADD_DSDB_FLAG(DS_DOMAIN_FUNCTION_2000);
1773         ADD_DSDB_FLAG(DS_DOMAIN_FUNCTION_2003_MIXED);
1774         ADD_DSDB_FLAG(DS_DOMAIN_FUNCTION_2003);
1775         ADD_DSDB_FLAG(DS_DOMAIN_FUNCTION_2008);
1776         ADD_DSDB_FLAG(DS_DOMAIN_FUNCTION_2008_R2);
1777         ADD_DSDB_FLAG(DS_DOMAIN_FUNCTION_2012);
1778         ADD_DSDB_FLAG(DS_DOMAIN_FUNCTION_2012_R2);
1779         ADD_DSDB_FLAG(DS_DOMAIN_FUNCTION_2016);
1780
1781         /* nc replica flags */
1782         ADD_DSDB_FLAG(INSTANCE_TYPE_IS_NC_HEAD);
1783         ADD_DSDB_FLAG(INSTANCE_TYPE_UNINSTANT);
1784         ADD_DSDB_FLAG(INSTANCE_TYPE_WRITE);
1785         ADD_DSDB_FLAG(INSTANCE_TYPE_NC_ABOVE);
1786         ADD_DSDB_FLAG(INSTANCE_TYPE_NC_COMING);
1787         ADD_DSDB_FLAG(INSTANCE_TYPE_NC_GOING);
1788
1789         /* "systemFlags" */
1790         ADD_DSDB_FLAG(SYSTEM_FLAG_CR_NTDS_NC);
1791         ADD_DSDB_FLAG(SYSTEM_FLAG_CR_NTDS_DOMAIN);
1792         ADD_DSDB_FLAG(SYSTEM_FLAG_CR_NTDS_NOT_GC_REPLICATED);
1793         ADD_DSDB_FLAG(SYSTEM_FLAG_SCHEMA_BASE_OBJECT);
1794         ADD_DSDB_FLAG(SYSTEM_FLAG_ATTR_IS_RDN);
1795         ADD_DSDB_FLAG(SYSTEM_FLAG_DISALLOW_MOVE_ON_DELETE);
1796         ADD_DSDB_FLAG(SYSTEM_FLAG_DOMAIN_DISALLOW_MOVE);
1797         ADD_DSDB_FLAG(SYSTEM_FLAG_DOMAIN_DISALLOW_RENAME);
1798         ADD_DSDB_FLAG(SYSTEM_FLAG_CONFIG_ALLOW_LIMITED_MOVE);
1799         ADD_DSDB_FLAG(SYSTEM_FLAG_CONFIG_ALLOW_MOVE);
1800         ADD_DSDB_FLAG(SYSTEM_FLAG_CONFIG_ALLOW_RENAME);
1801         ADD_DSDB_FLAG(SYSTEM_FLAG_DISALLOW_DELETE);
1802
1803         /* Kerberos encryption type constants */
1804         ADD_DSDB_FLAG(ENC_ALL_TYPES);
1805         ADD_DSDB_FLAG(ENC_CRC32);
1806         ADD_DSDB_FLAG(ENC_RSA_MD5);
1807         ADD_DSDB_FLAG(ENC_RC4_HMAC_MD5);
1808         ADD_DSDB_FLAG(ENC_HMAC_SHA1_96_AES128);
1809         ADD_DSDB_FLAG(ENC_HMAC_SHA1_96_AES256);
1810         ADD_DSDB_FLAG(ENC_HMAC_SHA1_96_AES256_SK);
1811
1812         ADD_DSDB_FLAG(SEARCH_FLAG_ATTINDEX);
1813         ADD_DSDB_FLAG(SEARCH_FLAG_PDNTATTINDEX);
1814         ADD_DSDB_FLAG(SEARCH_FLAG_ANR);
1815         ADD_DSDB_FLAG(SEARCH_FLAG_PRESERVEONDELETE);
1816         ADD_DSDB_FLAG(SEARCH_FLAG_COPY);
1817         ADD_DSDB_FLAG(SEARCH_FLAG_TUPLEINDEX);
1818         ADD_DSDB_FLAG(SEARCH_FLAG_SUBTREEATTRINDEX);
1819         ADD_DSDB_FLAG(SEARCH_FLAG_CONFIDENTIAL);
1820         ADD_DSDB_FLAG(SEARCH_FLAG_NEVERVALUEAUDIT);
1821         ADD_DSDB_FLAG(SEARCH_FLAG_RODC_ATTRIBUTE);
1822
1823         ADD_DSDB_FLAG(DS_FLAG_ATTR_NOT_REPLICATED);
1824         ADD_DSDB_FLAG(DS_FLAG_ATTR_REQ_PARTIAL_SET_MEMBER);
1825         ADD_DSDB_FLAG(DS_FLAG_ATTR_IS_CONSTRUCTED);
1826
1827         ADD_DSDB_FLAG(DS_NTDSSETTINGS_OPT_IS_AUTO_TOPOLOGY_DISABLED);
1828         ADD_DSDB_FLAG(DS_NTDSSETTINGS_OPT_IS_TOPL_CLEANUP_DISABLED);
1829         ADD_DSDB_FLAG(DS_NTDSSETTINGS_OPT_IS_TOPL_MIN_HOPS_DISABLED);
1830         ADD_DSDB_FLAG(DS_NTDSSETTINGS_OPT_IS_TOPL_DETECT_STALE_DISABLED);
1831         ADD_DSDB_FLAG(DS_NTDSSETTINGS_OPT_IS_INTER_SITE_AUTO_TOPOLOGY_DISABLED);
1832         ADD_DSDB_FLAG(DS_NTDSSETTINGS_OPT_IS_GROUP_CACHING_ENABLED);
1833         ADD_DSDB_FLAG(DS_NTDSSETTINGS_OPT_FORCE_KCC_WHISTLER_BEHAVIOR);
1834         ADD_DSDB_FLAG(DS_NTDSSETTINGS_OPT_IS_RAND_BH_SELECTION_DISABLED);
1835         ADD_DSDB_FLAG(DS_NTDSSETTINGS_OPT_IS_SCHEDULE_HASHING_ENABLED);
1836         ADD_DSDB_FLAG(DS_NTDSSETTINGS_OPT_IS_REDUNDANT_SERVER_TOPOLOGY_ENABLED);
1837
1838         ADD_DSDB_FLAG(DS_NTDSDSA_OPT_IS_GC);
1839         ADD_DSDB_FLAG(DS_NTDSDSA_OPT_DISABLE_INBOUND_REPL);
1840         ADD_DSDB_FLAG(DS_NTDSDSA_OPT_DISABLE_OUTBOUND_REPL);
1841         ADD_DSDB_FLAG(DS_NTDSDSA_OPT_DISABLE_NTDSCONN_XLATE);
1842         ADD_DSDB_FLAG(DS_NTDSDSA_OPT_DISABLE_SPN_REGISTRATION);
1843
1844         /* dsHeuristics character indexes (see MS-ADTS 7.1.1.2.4.1.2) */
1845         ADD_DSDB_FLAG(DS_HR_SUPFIRSTLASTANR);
1846         ADD_DSDB_FLAG(DS_HR_SUPLASTFIRSTANR);
1847         ADD_DSDB_FLAG(DS_HR_DOLISTOBJECT);
1848         ADD_DSDB_FLAG(DS_HR_DONICKRES);
1849         ADD_DSDB_FLAG(DS_HR_LDAP_USEPERMMOD);
1850         ADD_DSDB_FLAG(DS_HR_HIDEDSID);
1851         ADD_DSDB_FLAG(DS_HR_BLOCK_ANONYMOUS_OPS);
1852         ADD_DSDB_FLAG(DS_HR_ALLOW_ANON_NSPI);
1853         ADD_DSDB_FLAG(DS_HR_USER_PASSWORD_SUPPORT);
1854         ADD_DSDB_FLAG(DS_HR_TENTH_CHAR);
1855         ADD_DSDB_FLAG(DS_HR_SPECIFY_GUID_ON_ADD);
1856         ADD_DSDB_FLAG(DS_HR_NO_STANDARD_SD);
1857         ADD_DSDB_FLAG(DS_HR_ALLOW_NONSECURE_PWD_OPS);
1858         ADD_DSDB_FLAG(DS_HR_NO_PROPAGATE_ON_NOCHANGE);
1859         ADD_DSDB_FLAG(DS_HR_COMPUTE_ANR_STATS);
1860         ADD_DSDB_FLAG(DS_HR_ADMINSDEXMASK);
1861         ADD_DSDB_FLAG(DS_HR_KVNOEMUW2K);
1862
1863         ADD_DSDB_FLAG(DS_HR_TWENTIETH_CHAR);
1864         ADD_DSDB_FLAG(DS_HR_ATTR_AUTHZ_ON_LDAP_ADD);
1865         ADD_DSDB_FLAG(DS_HR_BLOCK_OWNER_IMPLICIT_RIGHTS);
1866         ADD_DSDB_FLAG(DS_HR_THIRTIETH_CHAR);
1867         ADD_DSDB_FLAG(DS_HR_FOURTIETH_CHAR);
1868         ADD_DSDB_FLAG(DS_HR_FIFTIETH_CHAR);
1869         ADD_DSDB_FLAG(DS_HR_SIXTIETH_CHAR);
1870         ADD_DSDB_FLAG(DS_HR_SEVENTIETH_CHAR);
1871         ADD_DSDB_FLAG(DS_HR_EIGHTIETH_CHAR);
1872         ADD_DSDB_FLAG(DS_HR_NINETIETH_CHAR);
1873
1874         ADD_DSDB_FLAG(NTDSCONN_KCC_GC_TOPOLOGY);
1875         ADD_DSDB_FLAG(NTDSCONN_KCC_RING_TOPOLOGY);
1876         ADD_DSDB_FLAG(NTDSCONN_KCC_MINIMIZE_HOPS_TOPOLOGY);
1877         ADD_DSDB_FLAG(NTDSCONN_KCC_STALE_SERVERS_TOPOLOGY);
1878         ADD_DSDB_FLAG(NTDSCONN_KCC_OSCILLATING_CONNECTION_TOPOLOGY);
1879         ADD_DSDB_FLAG(NTDSCONN_KCC_INTERSITE_GC_TOPOLOGY);
1880         ADD_DSDB_FLAG(NTDSCONN_KCC_INTERSITE_TOPOLOGY);
1881         ADD_DSDB_FLAG(NTDSCONN_KCC_SERVER_FAILOVER_TOPOLOGY);
1882         ADD_DSDB_FLAG(NTDSCONN_KCC_SITE_FAILOVER_TOPOLOGY);
1883         ADD_DSDB_FLAG(NTDSCONN_KCC_REDUNDANT_SERVER_TOPOLOGY);
1884
1885         ADD_DSDB_FLAG(NTDSCONN_OPT_IS_GENERATED);
1886         ADD_DSDB_FLAG(NTDSCONN_OPT_TWOWAY_SYNC);
1887         ADD_DSDB_FLAG(NTDSCONN_OPT_OVERRIDE_NOTIFY_DEFAULT);
1888         ADD_DSDB_FLAG(NTDSCONN_OPT_USE_NOTIFY);
1889         ADD_DSDB_FLAG(NTDSCONN_OPT_DISABLE_INTERSITE_COMPRESSION);
1890         ADD_DSDB_FLAG(NTDSCONN_OPT_USER_OWNED_SCHEDULE);
1891         ADD_DSDB_FLAG(NTDSCONN_OPT_RODC_TOPOLOGY);
1892
1893         /* Site Link Object options */
1894         ADD_DSDB_FLAG(NTDSSITELINK_OPT_USE_NOTIFY);
1895         ADD_DSDB_FLAG(NTDSSITELINK_OPT_TWOWAY_SYNC);
1896         ADD_DSDB_FLAG(NTDSSITELINK_OPT_DISABLE_COMPRESSION);
1897
1898         /* GPO policy flags */
1899         ADD_DSDB_FLAG(GPLINK_OPT_DISABLE);
1900         ADD_DSDB_FLAG(GPLINK_OPT_ENFORCE);
1901         ADD_DSDB_FLAG(GPO_FLAG_USER_DISABLE);
1902         ADD_DSDB_FLAG(GPO_FLAG_MACHINE_DISABLE);
1903         ADD_DSDB_FLAG(GPO_INHERIT);
1904         ADD_DSDB_FLAG(GPO_BLOCK_INHERITANCE);
1905
1906 #define ADD_DSDB_STRING(val)  PyModule_AddObject(m, #val, PyUnicode_FromString(val))
1907
1908         ADD_DSDB_STRING(DSDB_SYNTAX_BINARY_DN);
1909         ADD_DSDB_STRING(DSDB_SYNTAX_STRING_DN);
1910         ADD_DSDB_STRING(DSDB_SYNTAX_OR_NAME);
1911         ADD_DSDB_STRING(DSDB_CONTROL_DBCHECK);
1912         ADD_DSDB_STRING(DSDB_CONTROL_DBCHECK_MODIFY_RO_REPLICA);
1913         ADD_DSDB_STRING(DSDB_CONTROL_DBCHECK_FIX_DUPLICATE_LINKS);
1914         ADD_DSDB_STRING(DSDB_CONTROL_DBCHECK_FIX_LINK_DN_NAME);
1915         ADD_DSDB_STRING(DSDB_CONTROL_DBCHECK_FIX_LINK_DN_SID);
1916         ADD_DSDB_STRING(DSDB_CONTROL_REPLMD_VANISH_LINKS);
1917         ADD_DSDB_STRING(DSDB_CONTROL_PERMIT_INTERDOMAIN_TRUST_UAC_OID);
1918         ADD_DSDB_STRING(DSDB_CONTROL_SKIP_DUPLICATES_CHECK_OID);
1919         ADD_DSDB_STRING(DSDB_CONTROL_BYPASS_PASSWORD_HASH_OID);
1920         ADD_DSDB_STRING(DSDB_CONTROL_INVALID_NOT_IMPLEMENTED);
1921
1922         ADD_DSDB_STRING(DS_GUID_COMPUTERS_CONTAINER);
1923         ADD_DSDB_STRING(DS_GUID_DELETED_OBJECTS_CONTAINER);
1924         ADD_DSDB_STRING(DS_GUID_DOMAIN_CONTROLLERS_CONTAINER);
1925         ADD_DSDB_STRING(DS_GUID_FOREIGNSECURITYPRINCIPALS_CONTAINER);
1926         ADD_DSDB_STRING(DS_GUID_INFRASTRUCTURE_CONTAINER);
1927         ADD_DSDB_STRING(DS_GUID_LOSTANDFOUND_CONTAINER);
1928         ADD_DSDB_STRING(DS_GUID_MICROSOFT_PROGRAM_DATA_CONTAINER);
1929         ADD_DSDB_STRING(DS_GUID_NTDS_QUOTAS_CONTAINER);
1930         ADD_DSDB_STRING(DS_GUID_PROGRAM_DATA_CONTAINER);
1931         ADD_DSDB_STRING(DS_GUID_SYSTEMS_CONTAINER);
1932         ADD_DSDB_STRING(DS_GUID_USERS_CONTAINER);
1933         ADD_DSDB_STRING(DS_GUID_MANAGED_SERVICE_ACCOUNTS_CONTAINER);
1934
1935         ADD_DSDB_STRING(DS_GUID_SCHEMA_ATTR_DEPARTMENT);
1936         ADD_DSDB_STRING(DS_GUID_SCHEMA_ATTR_DNS_HOST_NAME);
1937         ADD_DSDB_STRING(DS_GUID_SCHEMA_ATTR_INSTANCE_TYPE);
1938         ADD_DSDB_STRING(DS_GUID_SCHEMA_ATTR_MS_SFU_30);
1939         ADD_DSDB_STRING(DS_GUID_SCHEMA_ATTR_NT_SECURITY_DESCRIPTOR);
1940         ADD_DSDB_STRING(DS_GUID_SCHEMA_ATTR_PRIMARY_GROUP_ID);
1941         ADD_DSDB_STRING(DS_GUID_SCHEMA_ATTR_SERVICE_PRINCIPAL_NAME);
1942         ADD_DSDB_STRING(DS_GUID_SCHEMA_ATTR_USER_ACCOUNT_CONTROL);
1943         ADD_DSDB_STRING(DS_GUID_SCHEMA_ATTR_USER_PASSWORD);
1944         ADD_DSDB_STRING(DS_GUID_SCHEMA_CLASS_COMPUTER);
1945         ADD_DSDB_STRING(DS_GUID_SCHEMA_CLASS_MANAGED_SERVICE_ACCOUNT);
1946         ADD_DSDB_STRING(DS_GUID_SCHEMA_CLASS_USER);
1947
1948         ADD_DSDB_STRING(DSDB_FULL_JOIN_REPLICATION_COMPLETED_OPAQUE_NAME);
1949
1950         return m;
1951 }