idl: Use DRSUAPI_ATTID_ prefix instead of DRSUAPI_ATTRIBUTE_ for ATTID values
[kamenim/samba.git] / source4 / libnet / libnet_become_dc.c
1 /*
2    Unix SMB/CIFS implementation.
3
4    Copyright (C) Stefan Metzmacher <metze@samba.org> 2006
5
6    This program is free software; you can redistribute it and/or modify
7    it under the terms of the GNU General Public License as published by
8    the Free Software Foundation; either version 3 of the License, or
9    (at your option) any later version.
10
11    This program is distributed in the hope that it will be useful,
12    but WITHOUT ANY WARRANTY; without even the implied warranty of
13    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
14    GNU General Public License for more details.
15
16    You should have received a copy of the GNU General Public License
17    along with this program.  If not, see <http://www.gnu.org/licenses/>.
18 */
19
20 #include "includes.h"
21 #include "libnet/libnet.h"
22 #include "libcli/composite/composite.h"
23 #include "libcli/cldap/cldap.h"
24 #include "lib/ldb/include/ldb.h"
25 #include "lib/ldb/include/ldb_errors.h"
26 #include "ldb_wrap.h"
27 #include "dsdb/samdb/samdb.h"
28 #include "../libds/common/flags.h"
29 #include "librpc/gen_ndr/ndr_drsuapi_c.h"
30 #include "libcli/security/security.h"
31 #include "librpc/gen_ndr/ndr_misc.h"
32 #include "librpc/gen_ndr/ndr_security.h"
33 #include "librpc/gen_ndr/ndr_nbt.h"
34 #include "librpc/gen_ndr/ndr_drsuapi.h"
35 #include "auth/gensec/gensec.h"
36 #include "param/param.h"
37 #include "lib/tsocket/tsocket.h"
38
39 /*****************************************************************************
40  * Windows 2003 (w2k3) does the following steps when changing the server role
41  * from domain member to domain controller
42  *
43  * We mostly do the same.
44  *****************************************************************************/
45
46 /*
47  * lookup DC:
48  * - using nbt name<1C> request and a samlogon mailslot request
49  * or
50  * - using a DNS SRV _ldap._tcp.dc._msdcs. request and a CLDAP netlogon request
51  *
52  * see: becomeDC_recv_cldap() and becomeDC_send_cldap()
53  */
54
55 /*
56  * Open 1st LDAP connection to the DC using admin credentials
57  *
58  * see: becomeDC_connect_ldap1() and becomeDC_ldap_connect()
59  */
60
61 /*
62  * LDAP search 1st LDAP connection:
63  *
64  * see: becomeDC_ldap1_rootdse()
65  *
66  * Request:
67  *      basedn: ""
68  *      scope:  base
69  *      filter: (objectClass=*)
70  *      attrs:  *
71  * Result:
72  *      ""
73  *              currentTime:            20061202155100.0Z
74  *              subschemaSubentry:      CN=Aggregate,CN=Schema,CN=Configuration,<domain_partition>
75  *              dsServiceName:          CN=<netbios_name>,CN=Servers,CN=<site_name>,CN=Sites,CN=Configuration,<domain_partition>
76  *              namingContexts:         <domain_partition>
77  *                                      CN=Configuration,<domain_partition>
78  *                                      CN=Schema,CN=Configuration,<domain_partition>
79  *              defaultNamingContext:   <domain_partition>
80  *              schemaNamingContext:    CN=Schema,CN=Configuration,<domain_partition>
81  *              configurationNamingContext:CN=Configuration,<domain_partition>
82  *              rootDomainNamingContext:<domain_partition>
83  *              supportedControl:       ...
84  *              supportedLDAPVersion:   3
85  *                                      2
86  *              supportedLDAPPolicies:  ...
87  *              highestCommitedUSN:     ...
88  *              supportedSASLMechanisms:GSSAPI
89  *                                      GSS-SPNEGO
90  *                                      EXTERNAL
91  *                                      DIGEST-MD5
92  *              dnsHostName:            <dns_host_name>
93  *              ldapServiceName:        <domain_dns_name>:<netbios_name>$@<REALM>
94  *              serverName:             CN=Servers,CN=<site_name>,CN=Sites,CN=Configuration,<domain_partition>
95  *              supportedCapabilities:  ...
96  *              isSyncronized:          TRUE
97  *              isGlobalCatalogReady:   TRUE
98  *              domainFunctionality:    0
99  *              forestFunctionality:    0
100  *              domainControllerFunctionality: 2
101  */
102
103 /*
104  * LDAP search 1st LDAP connection:
105  *
106  * see: becomeDC_ldap1_crossref_behavior_version()
107  *
108  * Request:
109  *      basedn: CN=Configuration,<domain_partition>
110  *      scope:  one
111  *      filter: (cn=Partitions)
112  *      attrs:  msDS-Behavior-Version
113  * Result:
114  *      CN=Partitions,CN=Configuration,<domain_partition>
115  *              msDS-Behavior-Version:  0
116  */
117
118 /*
119  * LDAP search 1st LDAP connection:
120  *
121  * NOTE: this seems to be a bug! as the messageID of the LDAP message is corrupted!
122  *
123  * not implemented here
124  * 
125  * Request:
126  *      basedn: CN=Schema,CN=Configuration,<domain_partition>
127  *      scope:  one
128  *      filter: (cn=Partitions)
129  *      attrs:  msDS-Behavior-Version
130  * Result:
131  *      <none>
132  *
133  */
134
135 /*
136  * LDAP search 1st LDAP connection:
137  *
138  * see: becomeDC_ldap1_domain_behavior_version()
139  * 
140  * Request:
141  *      basedn: <domain_partition>
142  *      scope:  base
143  *      filter: (objectClass=*)
144  *      attrs:  msDS-Behavior-Version
145  * Result:
146  *      <domain_partition>
147  *              msDS-Behavior-Version:  0
148  */
149
150 /*
151  * LDAP search 1st LDAP connection:
152  * 
153  * see: becomeDC_ldap1_schema_object_version()
154  *
155  * Request:
156  *      basedn: CN=Schema,CN=Configuration,<domain_partition>
157  *      scope:  base
158  *      filter: (objectClass=*)
159  *      attrs:  objectVersion
160  * Result:
161  *      CN=Schema,CN=Configuration,<domain_partition>
162  *              objectVersion:  30
163  */
164
165 /*
166  * LDAP search 1st LDAP connection:
167  * 
168  * not implemented, because the information is already there
169  *
170  * Request:
171  *      basedn: ""
172  *      scope:  base
173  *      filter: (objectClass=*)
174  *      attrs:  defaultNamingContext
175  *              dnsHostName
176  * Result:
177  *      ""
178  *              defaultNamingContext:   <domain_partition>
179  *              dnsHostName:            <dns_host_name>
180  */
181
182 /*
183  * LDAP search 1st LDAP connection:
184  *
185  * see: becomeDC_ldap1_infrastructure_fsmo()
186  * 
187  * Request:
188  *      basedn: <WKGUID=2fbac1870ade11d297c400c04fd8d5cd,domain_partition>
189  *      scope:  base
190  *      filter: (objectClass=*)
191  *      attrs:  1.1
192  * Result:
193  *      CN=Infrastructure,<domain_partition>
194  */
195
196 /*
197  * LDAP search 1st LDAP connection:
198  *
199  * see: becomeDC_ldap1_w2k3_update_revision()
200  *
201  * Request:
202  *      basedn: CN=Windows2003Update,CN=DomainUpdates,CN=System,<domain_partition>
203  *      scope:  base
204  *      filter: (objectClass=*)
205  *      attrs:  revision
206  * Result:
207  *      CN=Windows2003Update,CN=DomainUpdates,CN=System,<domain_partition>
208  *              revision:       8
209  */
210
211 /*
212  * LDAP search 1st LDAP connection:
213  *
214  * see: becomeDC_ldap1_infrastructure_fsmo()
215  *
216  * Request:
217  *      basedn: CN=Infrastructure,<domain_partition>
218  *      scope:  base
219  *      filter: (objectClass=*)
220  *      attrs:  fSMORoleOwner
221  * Result:
222  *      CN=Infrastructure,<domain_partition>
223  *              fSMORoleOwner:  CN=NTDS Settings,<infrastructure_fsmo_server_object>
224  */
225
226 /*
227  * LDAP search 1st LDAP connection:
228  *
229  * see: becomeDC_ldap1_infrastructure_fsmo()
230  *
231  * Request:
232  *      basedn: <infrastructure_fsmo_server_object>
233  *      scope:  base
234  *      filter: (objectClass=*)
235  *      attrs:  dnsHostName
236  * Result:
237  *      <infrastructure_fsmo_server_object>
238  *              dnsHostName:    <dns_host_name>
239  */
240
241 /*
242  * LDAP search 1st LDAP connection:
243  *
244  * see: becomeDC_ldap1_infrastructure_fsmo()
245  *
246  * Request:
247  *      basedn: CN=NTDS Settings,<infrastructure_fsmo_server_object>
248  *      scope:  base
249  *      filter: (objectClass=*)
250  *      attrs:  objectGUID
251  * Result:
252  *      CN=NTDS Settings,<infrastructure_fsmo_server_object>
253  *              objectGUID:     <object_guid>
254  */
255
256 /*
257  * LDAP search 1st LDAP connection:
258  * 
259  * see: becomeDC_ldap1_rid_manager_fsmo()
260  *
261  * Request:
262  *      basedn: <domain_partition>
263  *      scope:  base
264  *      filter: (objectClass=*)
265  *      attrs:  rIDManagerReference
266  * Result:
267  *      <domain_partition>
268  *              rIDManagerReference:    CN=RID Manager$,CN=System,<domain_partition>
269  */
270
271 /*
272  * LDAP search 1st LDAP connection:
273  * 
274  * see: becomeDC_ldap1_rid_manager_fsmo()
275  *
276  * Request:
277  *      basedn: CN=RID Manager$,CN=System,<domain_partition>
278  *      scope:  base
279  *      filter: (objectClass=*)
280  *      attrs:  fSMORoleOwner
281  * Result:
282  *      CN=Infrastructure,<domain_partition>
283  *              fSMORoleOwner:  CN=NTDS Settings,<rid_manager_fsmo_server_object>
284  */
285
286 /*
287  * LDAP search 1st LDAP connection:
288  *
289  * see: becomeDC_ldap1_rid_manager_fsmo()
290  *
291  * Request:
292  *      basedn: <rid_manager_fsmo_server_object>
293  *      scope:  base
294  *      filter: (objectClass=*)
295  *      attrs:  dnsHostName
296  * Result:
297  *      <rid_manager_fsmo_server_object>
298  *              dnsHostName:    <dns_host_name>
299  */
300
301 /*
302  * LDAP search 1st LDAP connection:
303  *
304  * see: becomeDC_ldap1_rid_manager_fsmo()
305  *
306  * Request:
307  *      basedn: CN=NTDS Settings,<rid_manager_fsmo_server_object>
308  *      scope:  base
309  *      filter: (objectClass=*)
310  *      attrs:  msDs-ReplicationEpoch
311  * Result:
312  *      CN=NTDS Settings,<rid_manager_fsmo_server_object>
313  */
314
315 /*
316  * LDAP search 1st LDAP connection:
317  *
318  * see: becomeDC_ldap1_site_object()
319  *
320  * Request:
321  *      basedn: CN=<new_dc_site_name>,CN=Sites,CN=Configuration,<domain_partition>
322  *      scope:  base
323  *      filter: (objectClass=*)
324  *      attrs:
325  * Result:
326  *      CN=<new_dc_site_name>,CN=Sites,CN=Configuration,<domain_partition>
327  *              objectClass:    top
328  *                              site
329  *              cn:             <new_dc_site_name>
330  *              distinguishedName:CN=<new_dc_site_name>,CN=Sites,CN=Configuration,<domain_partition>
331  *              instanceType:   4
332  *              whenCreated:    ...
333  *              whenChanged:    ...
334  *              uSNCreated:     ...
335  *              uSNChanged:     ...
336  *              showInAdvancedViewOnly: TRUE
337  *              name:           <new_dc_site_name>
338  *              objectGUID:     <object_guid>
339  *              systemFlags:    1107296256 <0x42000000>
340  *              objectCategory: CN=Site,CN=Schema,CN=Configuration,<domain_partition>
341  */
342
343 /***************************************************************
344  * Add this stage we call the check_options() callback function
345  * of the caller, to see if he wants us to continue
346  *
347  * see: becomeDC_check_options()
348  ***************************************************************/
349
350 /*
351  * LDAP search 1st LDAP connection:
352  *
353  * see: becomeDC_ldap1_computer_object()
354  *
355  * Request:
356  *      basedn: <domain_partition>
357  *      scope:  sub
358  *      filter: (&(|(objectClass=user)(objectClass=computer))(sAMAccountName=<new_dc_account_name>))
359  *      attrs:  distinguishedName
360  *              userAccountControl
361  * Result:
362  *      CN=<new_dc_netbios_name>,CN=Computers,<domain_partition>
363  *              distinguishedName:      CN=<new_dc_netbios_name>,CN=Computers,<domain_partition>
364  *              userAccoountControl:    4096 <0x1000>
365  */
366
367 /*
368  * LDAP search 1st LDAP connection:
369  *
370  * see: becomeDC_ldap1_server_object_1()
371  *
372  * Request:
373  *      basedn: CN=<new_dc_netbios_name>,CN=Servers,CN=<new_dc_site_name>,CN=Sites,CN=Configuration,<domain_partition>
374  *      scope:  base
375  *      filter: (objectClass=*)
376  *      attrs:
377  * Result:
378  *      <noSuchObject>
379  *      <matchedDN:CN=Servers,CN=<new_dc_site_name>,CN=Sites,CN=Configuration,<domain_partition>>
380  */
381
382 /*
383  * LDAP search 1st LDAP connection:
384  *
385  * see: becomeDC_ldap1_server_object_2()
386  * 
387  * Request:
388  *      basedn: CN=<new_dc_netbios_name>,CN=Computers,<domain_partition>
389  *      scope:  base
390  *      filter: (objectClass=*)
391  *      attrs:  serverReferenceBL
392  *      typesOnly: TRUE!!!
393  * Result:
394  *      CN=<new_dc_netbios_name>,CN=Computers,<domain_partition>
395  */
396
397 /*
398  * LDAP add 1st LDAP connection:
399  * 
400  * see: becomeDC_ldap1_server_object_add()
401  *
402  * Request:
403  *      CN=<new_dc_netbios_name>,CN=Computers,<domain_partition>
404  *      objectClass:    server
405  *      systemFlags:    50000000 <0x2FAF080>
406  *      serverReference:CN=<new_dc_netbios_name>,CN=Computers,<domain_partition>
407  * Result:
408  *      <success>
409  */
410
411 /*
412  * LDAP search 1st LDAP connection:
413  *
414  * not implemented, maybe we can add that later
415  *
416  * Request:
417  *      basedn: CN=NTDS Settings,CN=<new_dc_netbios_name>,CN=Servers,CN=<new_dc_site_name>,CN=Sites,CN=Configuration,<domain_partition>
418  *      scope:  base
419  *      filter: (objectClass=*)
420  *      attrs:
421  * Result:
422  *      <noSuchObject>
423  *      <matchedDN:CN=<new_dc_netbios_name>,CN=Servers,CN=<new_dc_site_name>,CN=Sites,CN=Configuration,<domain_partition>>
424  */
425
426 /*
427  * LDAP search 1st LDAP connection:
428  *
429  * not implemented because it gives no new information
430  * 
431  * Request:
432  *      basedn: CN=Partitions,CN=Configuration,<domain_partition>
433  *      scope:  sub
434  *      filter: (nCName=<domain_partition>)
435  *      attrs:  nCName
436  *              dnsRoot
437  *      controls: LDAP_SERVER_EXTENDED_DN_OID:critical=false
438  * Result:
439  *      <GUID=<hex_guid>>;CN=<domain_netbios_name>,CN=Partitions,<domain_partition>>
440  *              nCName:         <GUID=<hex_guid>>;<SID=<hex_sid>>;<domain_partition>>
441  *              dnsRoot:        <domain_dns_name>
442  */
443
444 /*
445  * LDAP modify 1st LDAP connection:
446  *
447  * see: becomeDC_ldap1_server_object_modify()
448  * 
449  * Request (add):
450  *      CN=<new_dc_netbios_name>,CN=Servers,CN=<new_dc_site_name>,CN=Sites,CN=Configuration,<domain_partition>>
451  *      serverReference:CN=<new_dc_netbios_name>,CN=Computers,<domain_partition>
452  * Result:
453  *      <attributeOrValueExist>
454  */
455
456 /*
457  * LDAP modify 1st LDAP connection:
458  *
459  * see: becomeDC_ldap1_server_object_modify()
460  *
461  * Request (replace):
462  *      CN=<new_dc_netbios_name>,CN=Servers,CN=<new_dc_site_name>,CN=Sites,CN=Configuration,<domain_partition>>
463  *      serverReference:CN=<new_dc_netbios_name>,CN=Computers,<domain_partition>
464  * Result:
465  *      <success>
466  */
467
468 /*
469  * Open 1st DRSUAPI connection to the DC using admin credentials
470  * DsBind with DRSUAPI_DS_BIND_GUID_W2K3 ("6afab99c-6e26-464a-975f-f58f105218bc")
471  * (w2k3 does 2 DsBind() calls here..., where is first is unused and contains garbage at the end)
472  *
473  * see: becomeDC_drsuapi_connect_send(), becomeDC_drsuapi1_connect_recv(),
474  *      becomeDC_drsuapi_bind_send(), becomeDC_drsuapi_bind_recv() and becomeDC_drsuapi1_bind_recv()
475  */
476
477 /*
478  * DsAddEntry to create the CN=NTDS Settings,CN=<machine_name>,CN=Servers,CN=Default-First-Site-Name, ...
479  * on the 1st DRSUAPI connection
480  *
481  * see: becomeDC_drsuapi1_add_entry_send() and becomeDC_drsuapi1_add_entry_recv()
482  */
483
484 /***************************************************************
485  * Add this stage we call the prepare_db() callback function
486  * of the caller, to see if he wants us to continue
487  *
488  * see: becomeDC_prepare_db()
489  ***************************************************************/
490
491 /*
492  * Open 2nd and 3rd DRSUAPI connection to the DC using admin credentials
493  * - a DsBind with DRSUAPI_DS_BIND_GUID_W2K3 ("6afab99c-6e26-464a-975f-f58f105218bc")
494  *   on the 2nd connection
495  *
496  * see: becomeDC_drsuapi_connect_send(), becomeDC_drsuapi2_connect_recv(),
497  *      becomeDC_drsuapi_bind_send(), becomeDC_drsuapi_bind_recv(), becomeDC_drsuapi2_bind_recv()
498  *      and becomeDC_drsuapi3_connect_recv()
499  */
500
501 /*
502  * replicate CN=Schema,CN=Configuration,...
503  * on the 3rd DRSUAPI connection and the bind_handle from the 2nd connection
504  *
505  * see: becomeDC_drsuapi_pull_partition_send(), becomeDC_drsuapi_pull_partition_recv(),
506  *      becomeDC_drsuapi3_pull_schema_send() and becomeDC_drsuapi3_pull_schema_recv()
507  *
508  ***************************************************************
509  * Add this stage we call the schema_chunk() callback function
510  * for each replication message
511  ***************************************************************/
512
513 /*
514  * replicate CN=Configuration,...
515  * on the 3rd DRSUAPI connection and the bind_handle from the 2nd connection
516  *
517  * see: becomeDC_drsuapi_pull_partition_send(), becomeDC_drsuapi_pull_partition_recv(),
518  *      becomeDC_drsuapi3_pull_config_send() and becomeDC_drsuapi3_pull_config_recv()
519  *
520  ***************************************************************
521  * Add this stage we call the config_chunk() callback function
522  * for each replication message
523  ***************************************************************/
524
525 /*
526  * LDAP unbind on the 1st LDAP connection
527  *
528  * not implemented, because it's not needed...
529  */
530
531 /*
532  * Open 2nd LDAP connection to the DC using admin credentials
533  *
534  * see: becomeDC_connect_ldap2() and becomeDC_ldap_connect()
535  */
536
537 /*
538  * LDAP search 2nd LDAP connection:
539  * 
540  * not implemented because it gives no new information
541  * same as becomeDC_ldap1_computer_object()
542  *
543  * Request:
544  *      basedn: <domain_partition>
545  *      scope:  sub
546  *      filter: (&(|(objectClass=user)(objectClass=computer))(sAMAccountName=<new_dc_account_name>))
547  *      attrs:  distinguishedName
548  *              userAccountControl
549  * Result:
550  *      CN=<new_dc_netbios_name>,CN=Computers,<domain_partition>
551  *              distinguishedName:      CN=<new_dc_netbios_name>,CN=Computers,<domain_partition>
552  *              userAccoountControl:    4096 <0x00001000>
553  */
554
555 /*
556  * LDAP search 2nd LDAP connection:
557  * 
558  * not implemented because it gives no new information
559  * same as becomeDC_ldap1_computer_object()
560  *
561  * Request:
562  *      basedn: CN=<new_dc_netbios_name>,CN=Computers,<domain_partition>
563  *      scope:  base
564  *      filter: (objectClass=*)
565  *      attrs:  userAccountControl
566  * Result:
567  *      CN=<new_dc_netbios_name>,CN=Computers,<domain_partition>
568  *              userAccoountControl:    4096 <0x00001000>
569  */
570
571 /*
572  * LDAP modify 2nd LDAP connection:
573  *
574  * see: becomeDC_ldap2_modify_computer()
575  *
576  * Request (replace):
577  *      CN=<new_dc_netbios_name>,CN=Computers,<domain_partition>
578  *      userAccoountControl:    532480 <0x82000>
579  * Result:
580  *      <success>
581  */
582
583 /*
584  * LDAP search 2nd LDAP connection:
585  *
586  * see: becomeDC_ldap2_move_computer()
587  * 
588  * Request:
589  *      basedn: <WKGUID=2fbac1870ade11d297c400c04fd8d5cd,<domain_partition>>
590  *      scope:  base
591  *      filter: (objectClass=*)
592  *      attrs:  1.1
593  * Result:
594  *      CN=Domain Controllers,<domain_partition>
595  */
596
597 /*
598  * LDAP search 2nd LDAP connection:
599  *
600  * not implemented because it gives no new information
601  * 
602  * Request:
603  *      basedn: CN=Domain Controllers,<domain_partition>
604  *      scope:  base
605  *      filter: (objectClass=*)
606  *      attrs:  distinguishedName
607  * Result:
608  *      CN=Domain Controller,<domain_partition>
609  *              distinguishedName:      CN=Domain Controllers,<domain_partition>
610  */
611
612 /*
613  * LDAP modifyRDN 2nd LDAP connection:
614  *
615  * see: becomeDC_ldap2_move_computer()
616  * 
617  * Request:
618  *      entry:          CN=<new_dc_netbios_name>,CN=Computers,<domain_partition>
619  *      newrdn:         CN=<new_dc_netbios_name>
620  *      deleteoldrdn:   TRUE
621  *      newparent:      CN=Domain Controllers,<domain_partition>
622  * Result:
623  *      <success>
624  */
625
626 /*
627  * LDAP unbind on the 2nd LDAP connection
628  *
629  * not implemented, because it's not needed...
630  */
631
632 /*
633  * replicate Domain Partition
634  * on the 3rd DRSUAPI connection and the bind_handle from the 2nd connection
635  *
636  * see: becomeDC_drsuapi_pull_partition_send(), becomeDC_drsuapi_pull_partition_recv(),
637  *      becomeDC_drsuapi3_pull_domain_send() and becomeDC_drsuapi3_pull_domain_recv()
638  *
639  ***************************************************************
640  * Add this stage we call the domain_chunk() callback function
641  * for each replication message
642  ***************************************************************/
643
644 /* call DsReplicaUpdateRefs() for all partitions like this:
645  *     req1: struct drsuapi_DsReplicaUpdateRefsRequest1
646  *
647  *                 naming_context: struct drsuapi_DsReplicaObjectIdentifier
648  *                     __ndr_size               : 0x000000ae (174)
649  *                     __ndr_size_sid           : 0x00000000 (0)
650  *                     guid                     : 00000000-0000-0000-0000-000000000000
651  *                     sid                      : S-0-0
652  *                     dn                       : 'CN=Schema,CN=Configuration,DC=w2k3,DC=vmnet1,DC=vm,DC=base'
653  *
654  *                 dest_dsa_dns_name        : '4a0df188-a0b8-47ea-bbe5-e614723f16dd._msdcs.w2k3.vmnet1.vm.base'
655  *           dest_dsa_guid            : 4a0df188-a0b8-47ea-bbe5-e614723f16dd
656  *           options                  : 0x0000001c (28)
657  *                 0: DRSUAPI_DS_REPLICA_UPDATE_ASYNCHRONOUS_OPERATION
658  *                 0: DRSUAPI_DS_REPLICA_UPDATE_WRITEABLE
659  *                 1: DRSUAPI_DS_REPLICA_UPDATE_ADD_REFERENCE
660  *                 1: DRSUAPI_DS_REPLICA_UPDATE_DELETE_REFERENCE
661  *                 1: DRSUAPI_DS_REPLICA_UPDATE_0x00000010
662  *
663  * 4a0df188-a0b8-47ea-bbe5-e614723f16dd is the objectGUID the DsAddEntry() returned for the
664  * CN=NTDS Settings,CN=<machine_name>,CN=Servers,CN=Default-First-Site-Name, ...
665  * on the 2nd!!! DRSUAPI connection
666  *
667  * see: becomeDC_drsuapi_update_refs_send(), becomeDC_drsuapi2_update_refs_schema_recv(),
668  *      becomeDC_drsuapi2_update_refs_config_recv() and becomeDC_drsuapi2_update_refs_domain_recv()
669  */
670
671 /*
672  * Windows does opens the 4th and 5th DRSUAPI connection...
673  * and does a DsBind() with the objectGUID from DsAddEntry() as bind_guid
674  * on the 4th connection
675  *
676  * and then 2 full replications of the domain partition on the 5th connection
677  * with the bind_handle from the 4th connection
678  *
679  * not implemented because it gives no new information
680  */
681
682 struct libnet_BecomeDC_state {
683         struct composite_context *creq;
684
685         struct libnet_context *libnet;
686
687         struct dom_sid zero_sid;
688
689         struct {
690                 struct cldap_socket *sock;
691                 struct cldap_netlogon io;
692                 struct NETLOGON_SAM_LOGON_RESPONSE_EX netlogon;
693         } cldap;
694
695         struct becomeDC_ldap {
696                 struct ldb_context *ldb;
697                 const struct ldb_message *rootdse;
698         } ldap1, ldap2;
699
700         struct becomeDC_drsuapi {
701                 struct libnet_BecomeDC_state *s;
702                 struct dcerpc_binding *binding;
703                 struct dcerpc_pipe *pipe;
704                 struct dcerpc_binding_handle *drsuapi_handle;
705                 DATA_BLOB gensec_skey;
706                 struct drsuapi_DsBind bind_r;
707                 struct GUID bind_guid;
708                 struct drsuapi_DsBindInfoCtr bind_info_ctr;
709                 struct drsuapi_DsBindInfo28 local_info28;
710                 struct drsuapi_DsBindInfo28 remote_info28;
711                 struct policy_handle bind_handle;
712         } drsuapi1, drsuapi2, drsuapi3;
713
714         void *ndr_struct_ptr;
715
716         struct libnet_BecomeDC_Domain domain;
717         struct libnet_BecomeDC_Forest forest;
718         struct libnet_BecomeDC_SourceDSA source_dsa;
719         struct libnet_BecomeDC_DestDSA dest_dsa;
720
721         struct libnet_BecomeDC_Partition schema_part, config_part, domain_part;
722
723         struct becomeDC_fsmo {
724                 const char *dns_name;
725                 const char *server_dn_str;
726                 const char *ntds_dn_str;
727                 struct GUID ntds_guid;
728         } infrastructure_fsmo;
729
730         struct becomeDC_fsmo rid_manager_fsmo;
731
732         struct libnet_BecomeDC_CheckOptions _co;
733         struct libnet_BecomeDC_PrepareDB _pp;
734         struct libnet_BecomeDC_StoreChunk _sc;
735         struct libnet_BecomeDC_Callbacks callbacks;
736
737         bool rodc_join;
738 };
739
740 static int32_t get_dc_function_level(struct loadparm_context *lp_ctx)
741 {
742         /* per default we are (Windows) 2008 R2 compatible */
743         return lpcfg_parm_int(lp_ctx, NULL, "ads", "dc function level",
744                            DS_DOMAIN_FUNCTION_2008_R2);
745 }
746
747 static void becomeDC_recv_cldap(struct tevent_req *req);
748
749 static void becomeDC_send_cldap(struct libnet_BecomeDC_state *s)
750 {
751         struct composite_context *c = s->creq;
752         struct tevent_req *req;
753         struct tsocket_address *dest_address;
754         int ret;
755
756         s->cldap.io.in.dest_address     = NULL;
757         s->cldap.io.in.dest_port        = 0;
758         s->cldap.io.in.realm            = s->domain.dns_name;
759         s->cldap.io.in.host             = s->dest_dsa.netbios_name;
760         s->cldap.io.in.user             = NULL;
761         s->cldap.io.in.domain_guid      = NULL;
762         s->cldap.io.in.domain_sid       = NULL;
763         s->cldap.io.in.acct_control     = -1;
764         s->cldap.io.in.version          = NETLOGON_NT_VERSION_5 | NETLOGON_NT_VERSION_5EX;
765         s->cldap.io.in.map_response     = true;
766
767         ret = tsocket_address_inet_from_strings(s, "ip",
768                                                 s->source_dsa.address,
769                                                 lpcfg_cldap_port(s->libnet->lp_ctx),
770                                                 &dest_address);
771         if (ret != 0) {
772                 c->status = map_nt_error_from_unix(errno);
773                 if (!composite_is_ok(c)) return;
774         }
775
776         c->status = cldap_socket_init(s, s->libnet->event_ctx,
777                                       NULL, dest_address, &s->cldap.sock);
778         if (!composite_is_ok(c)) return;
779
780         req = cldap_netlogon_send(s, s->cldap.sock, &s->cldap.io);
781         if (composite_nomem(req, c)) return;
782         tevent_req_set_callback(req, becomeDC_recv_cldap, s);
783 }
784
785 static void becomeDC_connect_ldap1(struct libnet_BecomeDC_state *s);
786
787 static void becomeDC_recv_cldap(struct tevent_req *req)
788 {
789         struct libnet_BecomeDC_state *s = tevent_req_callback_data(req,
790                                           struct libnet_BecomeDC_state);
791         struct composite_context *c = s->creq;
792
793         c->status = cldap_netlogon_recv(req, s, &s->cldap.io);
794         talloc_free(req);
795         if (!composite_is_ok(c)) {
796                 DEBUG(0,("Failed to send, receive or parse CLDAP reply from server %s for our host %s: %s\n", 
797                          s->cldap.io.in.dest_address, 
798                          s->cldap.io.in.host, 
799                          nt_errstr(c->status)));
800                 return;
801         }
802         s->cldap.netlogon = s->cldap.io.out.netlogon.data.nt5_ex;
803
804         s->domain.dns_name              = s->cldap.netlogon.dns_domain;
805         s->domain.netbios_name          = s->cldap.netlogon.domain_name;
806         s->domain.guid                  = s->cldap.netlogon.domain_uuid;
807
808         s->forest.dns_name              = s->cldap.netlogon.forest;
809
810         s->source_dsa.dns_name          = s->cldap.netlogon.pdc_dns_name;
811         s->source_dsa.netbios_name      = s->cldap.netlogon.pdc_name;
812         s->source_dsa.site_name         = s->cldap.netlogon.server_site;
813
814         s->dest_dsa.site_name           = s->cldap.netlogon.client_site;
815
816         DEBUG(0,("CLDAP response: forest=%s dns=%s netbios=%s server_site=%s  client_site=%s\n",
817                  s->forest.dns_name, s->domain.dns_name, s->domain.netbios_name,
818                  s->source_dsa.site_name, s->dest_dsa.site_name));
819         if (!s->dest_dsa.site_name || strcmp(s->dest_dsa.site_name, "") == 0) {
820                 DEBUG(0,("Got empty client site - using server site name %s\n",
821                          s->source_dsa.site_name));
822                 s->dest_dsa.site_name = s->source_dsa.site_name;
823         }
824
825         becomeDC_connect_ldap1(s);
826 }
827
828 static NTSTATUS becomeDC_ldap_connect(struct libnet_BecomeDC_state *s, 
829                                       struct becomeDC_ldap *ldap)
830 {
831         char *url;
832
833         url = talloc_asprintf(s, "ldap://%s/", s->source_dsa.dns_name);
834         NT_STATUS_HAVE_NO_MEMORY(url);
835
836         ldap->ldb = ldb_wrap_connect(s, s->libnet->event_ctx, s->libnet->lp_ctx, url,
837                                      NULL,
838                                      s->libnet->cred,
839                                      0);
840         talloc_free(url);
841         if (ldap->ldb == NULL) {
842                 return NT_STATUS_UNEXPECTED_NETWORK_ERROR;
843         }
844
845         return NT_STATUS_OK;
846 }
847
848 static NTSTATUS becomeDC_ldap1_rootdse(struct libnet_BecomeDC_state *s)
849 {
850         int ret;
851         struct ldb_result *r;
852         struct ldb_dn *basedn;
853         static const char *attrs[] = {
854                 "*",
855                 NULL
856         };
857
858         basedn = ldb_dn_new(s, s->ldap1.ldb, NULL);
859         NT_STATUS_HAVE_NO_MEMORY(basedn);
860
861         ret = ldb_search(s->ldap1.ldb, s, &r, basedn, LDB_SCOPE_BASE, attrs,
862                          "(objectClass=*)");
863         talloc_free(basedn);
864         if (ret != LDB_SUCCESS) {
865                 return NT_STATUS_LDAP(ret);
866         } else if (r->count != 1) {
867                 talloc_free(r);
868                 return NT_STATUS_INVALID_NETWORK_RESPONSE;
869         }
870
871         s->ldap1.rootdse = r->msgs[0];
872
873         s->domain.dn_str        = ldb_msg_find_attr_as_string(s->ldap1.rootdse, "defaultNamingContext", NULL);
874         if (!s->domain.dn_str) return NT_STATUS_INVALID_NETWORK_RESPONSE;
875
876         s->forest.root_dn_str   = ldb_msg_find_attr_as_string(s->ldap1.rootdse, "rootDomainNamingContext", NULL);
877         if (!s->forest.root_dn_str) return NT_STATUS_INVALID_NETWORK_RESPONSE;
878         s->forest.config_dn_str = ldb_msg_find_attr_as_string(s->ldap1.rootdse, "configurationNamingContext", NULL);
879         if (!s->forest.config_dn_str) return NT_STATUS_INVALID_NETWORK_RESPONSE;
880         s->forest.schema_dn_str = ldb_msg_find_attr_as_string(s->ldap1.rootdse, "schemaNamingContext", NULL);
881         if (!s->forest.schema_dn_str) return NT_STATUS_INVALID_NETWORK_RESPONSE;
882
883         s->source_dsa.server_dn_str     = ldb_msg_find_attr_as_string(s->ldap1.rootdse, "serverName", NULL);
884         if (!s->source_dsa.server_dn_str) return NT_STATUS_INVALID_NETWORK_RESPONSE;
885         s->source_dsa.ntds_dn_str       = ldb_msg_find_attr_as_string(s->ldap1.rootdse, "dsServiceName", NULL);
886         if (!s->source_dsa.ntds_dn_str) return NT_STATUS_INVALID_NETWORK_RESPONSE;
887
888         return NT_STATUS_OK;
889 }
890
891 static NTSTATUS becomeDC_ldap1_crossref_behavior_version(struct libnet_BecomeDC_state *s)
892 {
893         int ret;
894         struct ldb_result *r;
895         struct ldb_dn *basedn;
896         static const char *attrs[] = {
897                 "msDs-Behavior-Version",
898                 NULL
899         };
900
901         basedn = ldb_dn_new(s, s->ldap1.ldb, s->forest.config_dn_str);
902         NT_STATUS_HAVE_NO_MEMORY(basedn);
903
904         ret = ldb_search(s->ldap1.ldb, s, &r, basedn, LDB_SCOPE_ONELEVEL, attrs,
905                          "(cn=Partitions)");
906         talloc_free(basedn);
907         if (ret != LDB_SUCCESS) {
908                 return NT_STATUS_LDAP(ret);
909         } else if (r->count != 1) {
910                 talloc_free(r);
911                 return NT_STATUS_INVALID_NETWORK_RESPONSE;
912         }
913
914         s->forest.crossref_behavior_version = ldb_msg_find_attr_as_uint(r->msgs[0], "msDs-Behavior-Version", 0);
915         if (s->forest.crossref_behavior_version >
916                         get_dc_function_level(s->libnet->lp_ctx)) {
917                 talloc_free(r);
918                 DEBUG(0,("The servers function level %u is above 'ads:dc function level' of %u\n", 
919                          s->forest.crossref_behavior_version, 
920                          get_dc_function_level(s->libnet->lp_ctx)));
921                 return NT_STATUS_NOT_SUPPORTED;
922         }
923
924         talloc_free(r);
925         return NT_STATUS_OK;
926 }
927
928 static NTSTATUS becomeDC_ldap1_domain_behavior_version(struct libnet_BecomeDC_state *s)
929 {
930         int ret;
931         struct ldb_result *r;
932         struct ldb_dn *basedn;
933         static const char *attrs[] = {
934                 "msDs-Behavior-Version",
935                 NULL
936         };
937
938         basedn = ldb_dn_new(s, s->ldap1.ldb, s->domain.dn_str);
939         NT_STATUS_HAVE_NO_MEMORY(basedn);
940
941         ret = ldb_search(s->ldap1.ldb, s, &r, basedn, LDB_SCOPE_BASE, attrs,
942                          "(objectClass=*)");
943         talloc_free(basedn);
944         if (ret != LDB_SUCCESS) {
945                 return NT_STATUS_LDAP(ret);
946         } else if (r->count != 1) {
947                 talloc_free(r);
948                 return NT_STATUS_INVALID_NETWORK_RESPONSE;
949         }
950
951         s->domain.behavior_version = ldb_msg_find_attr_as_uint(r->msgs[0], "msDs-Behavior-Version", 0);
952         if (s->domain.behavior_version >
953                         get_dc_function_level(s->libnet->lp_ctx)) {
954                 talloc_free(r);
955                 DEBUG(0,("The servers function level %u is above 'ads:dc function level' of %u\n", 
956                          s->forest.crossref_behavior_version, 
957                          get_dc_function_level(s->libnet->lp_ctx)));
958                 return NT_STATUS_NOT_SUPPORTED;
959         }
960
961         talloc_free(r);
962         return NT_STATUS_OK;
963 }
964
965 static NTSTATUS becomeDC_ldap1_schema_object_version(struct libnet_BecomeDC_state *s)
966 {
967         int ret;
968         struct ldb_result *r;
969         struct ldb_dn *basedn;
970         static const char *attrs[] = {
971                 "objectVersion",
972                 NULL
973         };
974
975         basedn = ldb_dn_new(s, s->ldap1.ldb, s->forest.schema_dn_str);
976         NT_STATUS_HAVE_NO_MEMORY(basedn);
977
978         ret = ldb_search(s->ldap1.ldb, s, &r, basedn, LDB_SCOPE_BASE, attrs,
979                          "(objectClass=*)");
980         talloc_free(basedn);
981         if (ret != LDB_SUCCESS) {
982                 return NT_STATUS_LDAP(ret);
983         } else if (r->count != 1) {
984                 talloc_free(r);
985                 return NT_STATUS_INVALID_NETWORK_RESPONSE;
986         }
987
988         s->forest.schema_object_version = ldb_msg_find_attr_as_uint(r->msgs[0], "objectVersion", 0);
989
990         talloc_free(r);
991         return NT_STATUS_OK;
992 }
993
994 static NTSTATUS becomeDC_ldap1_w2k3_update_revision(struct libnet_BecomeDC_state *s)
995 {
996         int ret;
997         struct ldb_result *r;
998         struct ldb_dn *basedn;
999         static const char *attrs[] = {
1000                 "revision",
1001                 NULL
1002         };
1003
1004         basedn = ldb_dn_new_fmt(s, s->ldap1.ldb, "CN=Windows2003Update,CN=DomainUpdates,CN=System,%s",
1005                                 s->domain.dn_str);
1006         NT_STATUS_HAVE_NO_MEMORY(basedn);
1007
1008         ret = ldb_search(s->ldap1.ldb, s, &r, basedn, LDB_SCOPE_BASE, attrs,
1009                          "(objectClass=*)");
1010         talloc_free(basedn);
1011         if (ret == LDB_ERR_NO_SUCH_OBJECT) {
1012                 /* w2k doesn't have this object */
1013                 s->domain.w2k3_update_revision = 0;
1014                 return NT_STATUS_OK;
1015         } else if (ret != LDB_SUCCESS) {
1016                 return NT_STATUS_LDAP(ret);
1017         } else if (r->count != 1) {
1018                 talloc_free(r);
1019                 return NT_STATUS_INVALID_NETWORK_RESPONSE;
1020         }
1021
1022         s->domain.w2k3_update_revision = ldb_msg_find_attr_as_uint(r->msgs[0], "revision", 0);
1023
1024         talloc_free(r);
1025         return NT_STATUS_OK;
1026 }
1027
1028 static NTSTATUS becomeDC_ldap1_infrastructure_fsmo(struct libnet_BecomeDC_state *s)
1029 {
1030         int ret;
1031         struct ldb_result *r;
1032         struct ldb_dn *basedn;
1033         struct ldb_dn *ntds_dn;
1034         struct ldb_dn *server_dn;
1035         static const char *dns_attrs[] = {
1036                 "dnsHostName",
1037                 NULL
1038         };
1039         static const char *guid_attrs[] = {
1040                 "objectGUID",
1041                 NULL
1042         };
1043
1044         ret = dsdb_wellknown_dn(s->ldap1.ldb, s,
1045                                 ldb_get_default_basedn(s->ldap1.ldb),
1046                                 DS_GUID_INFRASTRUCTURE_CONTAINER,
1047                                 &basedn);
1048         if (ret != LDB_SUCCESS) {
1049                 return NT_STATUS_LDAP(ret);
1050         }
1051
1052         ret = samdb_reference_dn(s->ldap1.ldb, s, basedn, "fSMORoleOwner", &ntds_dn);
1053         if (ret != LDB_SUCCESS) {
1054                 talloc_free(basedn);
1055                 return NT_STATUS_LDAP(ret);
1056         }
1057
1058         s->infrastructure_fsmo.ntds_dn_str = ldb_dn_get_linearized(ntds_dn);
1059         NT_STATUS_HAVE_NO_MEMORY(s->infrastructure_fsmo.ntds_dn_str);
1060
1061         server_dn = ldb_dn_get_parent(s, ntds_dn);
1062         NT_STATUS_HAVE_NO_MEMORY(server_dn);
1063
1064         s->infrastructure_fsmo.server_dn_str = ldb_dn_alloc_linearized(s, server_dn);
1065         NT_STATUS_HAVE_NO_MEMORY(s->infrastructure_fsmo.server_dn_str);
1066
1067         ret = ldb_search(s->ldap1.ldb, s, &r, server_dn, LDB_SCOPE_BASE,
1068                          dns_attrs, "(objectClass=*)");
1069         if (ret != LDB_SUCCESS) {
1070                 return NT_STATUS_LDAP(ret);
1071         } else if (r->count != 1) {
1072                 talloc_free(r);
1073                 return NT_STATUS_INVALID_NETWORK_RESPONSE;
1074         }
1075
1076         s->infrastructure_fsmo.dns_name = ldb_msg_find_attr_as_string(r->msgs[0], "dnsHostName", NULL);
1077         if (!s->infrastructure_fsmo.dns_name) return NT_STATUS_INVALID_NETWORK_RESPONSE;
1078         talloc_steal(s, s->infrastructure_fsmo.dns_name);
1079
1080         talloc_free(r);
1081
1082         ret = ldb_search(s->ldap1.ldb, s, &r, ntds_dn, LDB_SCOPE_BASE,
1083                          guid_attrs, "(objectClass=*)");
1084         if (ret != LDB_SUCCESS) {
1085                 return NT_STATUS_LDAP(ret);
1086         } else if (r->count != 1) {
1087                 talloc_free(r);
1088                 return NT_STATUS_INVALID_NETWORK_RESPONSE;
1089         }
1090
1091         s->infrastructure_fsmo.ntds_guid = samdb_result_guid(r->msgs[0], "objectGUID");
1092
1093         talloc_free(r);
1094
1095         return NT_STATUS_OK;
1096 }
1097
1098 static NTSTATUS becomeDC_ldap1_rid_manager_fsmo(struct libnet_BecomeDC_state *s)
1099 {
1100         int ret;
1101         struct ldb_result *r;
1102         struct ldb_dn *basedn;
1103         const char *reference_dn_str;
1104         struct ldb_dn *ntds_dn;
1105         struct ldb_dn *server_dn;
1106         static const char *rid_attrs[] = {
1107                 "rIDManagerReference",
1108                 NULL
1109         };
1110         static const char *fsmo_attrs[] = {
1111                 "fSMORoleOwner",
1112                 NULL
1113         };
1114         static const char *dns_attrs[] = {
1115                 "dnsHostName",
1116                 NULL
1117         };
1118         static const char *guid_attrs[] = {
1119                 "objectGUID",
1120                 NULL
1121         };
1122
1123         basedn = ldb_dn_new(s, s->ldap1.ldb, s->domain.dn_str);
1124         NT_STATUS_HAVE_NO_MEMORY(basedn);
1125
1126         ret = ldb_search(s->ldap1.ldb, s, &r, basedn, LDB_SCOPE_BASE,
1127                          rid_attrs, "(objectClass=*)");
1128         talloc_free(basedn);
1129         if (ret != LDB_SUCCESS) {
1130                 return NT_STATUS_LDAP(ret);
1131         } else if (r->count != 1) {
1132                 talloc_free(r);
1133                 return NT_STATUS_INVALID_NETWORK_RESPONSE;
1134         }
1135
1136         reference_dn_str        = ldb_msg_find_attr_as_string(r->msgs[0], "rIDManagerReference", NULL);
1137         if (!reference_dn_str) return NT_STATUS_INVALID_NETWORK_RESPONSE;
1138
1139         basedn = ldb_dn_new(s, s->ldap1.ldb, reference_dn_str);
1140         NT_STATUS_HAVE_NO_MEMORY(basedn);
1141
1142         talloc_free(r);
1143
1144         ret = ldb_search(s->ldap1.ldb, s, &r, basedn, LDB_SCOPE_BASE,
1145                          fsmo_attrs, "(objectClass=*)");
1146         talloc_free(basedn);
1147         if (ret != LDB_SUCCESS) {
1148                 return NT_STATUS_LDAP(ret);
1149         } else if (r->count != 1) {
1150                 talloc_free(r);
1151                 return NT_STATUS_INVALID_NETWORK_RESPONSE;
1152         }
1153
1154         s->rid_manager_fsmo.ntds_dn_str = ldb_msg_find_attr_as_string(r->msgs[0], "fSMORoleOwner", NULL);
1155         if (!s->rid_manager_fsmo.ntds_dn_str) return NT_STATUS_INVALID_NETWORK_RESPONSE;
1156         talloc_steal(s, s->rid_manager_fsmo.ntds_dn_str);
1157
1158         talloc_free(r);
1159
1160         ntds_dn = ldb_dn_new(s, s->ldap1.ldb, s->rid_manager_fsmo.ntds_dn_str);
1161         NT_STATUS_HAVE_NO_MEMORY(ntds_dn);
1162
1163         server_dn = ldb_dn_get_parent(s, ntds_dn);
1164         NT_STATUS_HAVE_NO_MEMORY(server_dn);
1165
1166         s->rid_manager_fsmo.server_dn_str = ldb_dn_alloc_linearized(s, server_dn);
1167         NT_STATUS_HAVE_NO_MEMORY(s->rid_manager_fsmo.server_dn_str);
1168
1169         ret = ldb_search(s->ldap1.ldb, s, &r, server_dn, LDB_SCOPE_BASE,
1170                          dns_attrs, "(objectClass=*)");
1171         if (ret != LDB_SUCCESS) {
1172                 return NT_STATUS_LDAP(ret);
1173         } else if (r->count != 1) {
1174                 talloc_free(r);
1175                 return NT_STATUS_INVALID_NETWORK_RESPONSE;
1176         }
1177
1178         s->rid_manager_fsmo.dns_name    = ldb_msg_find_attr_as_string(r->msgs[0], "dnsHostName", NULL);
1179         if (!s->rid_manager_fsmo.dns_name) return NT_STATUS_INVALID_NETWORK_RESPONSE;
1180         talloc_steal(s, s->rid_manager_fsmo.dns_name);
1181
1182         talloc_free(r);
1183
1184         ret = ldb_search(s->ldap1.ldb, s, &r, ntds_dn, LDB_SCOPE_BASE,
1185                          guid_attrs, "(objectClass=*)");
1186         if (ret != LDB_SUCCESS) {
1187                 return NT_STATUS_LDAP(ret);
1188         } else if (r->count != 1) {
1189                 talloc_free(r);
1190                 return NT_STATUS_INVALID_NETWORK_RESPONSE;
1191         }
1192
1193         s->rid_manager_fsmo.ntds_guid = samdb_result_guid(r->msgs[0], "objectGUID");
1194
1195         talloc_free(r);
1196
1197         return NT_STATUS_OK;
1198 }
1199
1200 static NTSTATUS becomeDC_ldap1_site_object(struct libnet_BecomeDC_state *s)
1201 {
1202         int ret;
1203         struct ldb_result *r;
1204         struct ldb_dn *basedn;
1205
1206         basedn = ldb_dn_new_fmt(s, s->ldap1.ldb, "CN=%s,CN=Sites,%s",
1207                                 s->dest_dsa.site_name,
1208                                 s->forest.config_dn_str);
1209         NT_STATUS_HAVE_NO_MEMORY(basedn);
1210
1211         ret = ldb_search(s->ldap1.ldb, s, &r, basedn, LDB_SCOPE_BASE,
1212                          NULL, "(objectClass=*)");
1213         talloc_free(basedn);
1214         if (ret != LDB_SUCCESS) {
1215                 return NT_STATUS_LDAP(ret);
1216         } else if (r->count != 1) {
1217                 talloc_free(r);
1218                 return NT_STATUS_INVALID_NETWORK_RESPONSE;
1219         }
1220
1221         s->dest_dsa.site_guid = samdb_result_guid(r->msgs[0], "objectGUID");
1222
1223         talloc_free(r);
1224         return NT_STATUS_OK;
1225 }
1226
1227 static NTSTATUS becomeDC_check_options(struct libnet_BecomeDC_state *s)
1228 {
1229         if (!s->callbacks.check_options) return NT_STATUS_OK;
1230
1231         s->_co.domain           = &s->domain;
1232         s->_co.forest           = &s->forest;
1233         s->_co.source_dsa       = &s->source_dsa;
1234
1235         return s->callbacks.check_options(s->callbacks.private_data, &s->_co);
1236 }
1237
1238 static NTSTATUS becomeDC_ldap1_computer_object(struct libnet_BecomeDC_state *s)
1239 {
1240         int ret;
1241         struct ldb_result *r;
1242         struct ldb_dn *basedn;
1243         static const char *attrs[] = {
1244                 "distinguishedName",
1245                 "userAccountControl",
1246                 NULL
1247         };
1248
1249         basedn = ldb_dn_new(s, s->ldap1.ldb, s->domain.dn_str);
1250         NT_STATUS_HAVE_NO_MEMORY(basedn);
1251
1252         ret = ldb_search(s->ldap1.ldb, s, &r, basedn, LDB_SCOPE_SUBTREE, attrs,
1253                          "(&(|(objectClass=user)(objectClass=computer))(sAMAccountName=%s$))",
1254                          s->dest_dsa.netbios_name);
1255         talloc_free(basedn);
1256         if (ret != LDB_SUCCESS) {
1257                 return NT_STATUS_LDAP(ret);
1258         } else if (r->count != 1) {
1259                 talloc_free(r);
1260                 return NT_STATUS_INVALID_NETWORK_RESPONSE;
1261         }
1262
1263         s->dest_dsa.computer_dn_str     = ldb_msg_find_attr_as_string(r->msgs[0], "distinguishedName", NULL);
1264         if (!s->dest_dsa.computer_dn_str) return NT_STATUS_INVALID_NETWORK_RESPONSE;
1265         talloc_steal(s, s->dest_dsa.computer_dn_str);
1266
1267         s->dest_dsa.user_account_control = ldb_msg_find_attr_as_uint(r->msgs[0], "userAccountControl", 0);
1268
1269         talloc_free(r);
1270         return NT_STATUS_OK;
1271 }
1272
1273 static NTSTATUS becomeDC_ldap1_server_object_1(struct libnet_BecomeDC_state *s)
1274 {
1275         int ret;
1276         struct ldb_result *r;
1277         struct ldb_dn *basedn;
1278         const char *server_reference_dn_str;
1279         struct ldb_dn *server_reference_dn;
1280         struct ldb_dn *computer_dn;
1281
1282         basedn = ldb_dn_new_fmt(s, s->ldap1.ldb, "CN=%s,CN=Servers,CN=%s,CN=Sites,%s",
1283                                 s->dest_dsa.netbios_name,
1284                                 s->dest_dsa.site_name,
1285                                 s->forest.config_dn_str);
1286         NT_STATUS_HAVE_NO_MEMORY(basedn);
1287
1288         ret = ldb_search(s->ldap1.ldb, s, &r, basedn, LDB_SCOPE_BASE,
1289                          NULL, "(objectClass=*)");
1290         talloc_free(basedn);
1291         if (ret == LDB_ERR_NO_SUCH_OBJECT) {
1292                 /* if the object doesn't exist, we'll create it later */
1293                 return NT_STATUS_OK;
1294         } else if (ret != LDB_SUCCESS) {
1295                 return NT_STATUS_LDAP(ret);
1296         } else if (r->count != 1) {
1297                 talloc_free(r);
1298                 return NT_STATUS_INVALID_NETWORK_RESPONSE;
1299         }
1300
1301         server_reference_dn_str = ldb_msg_find_attr_as_string(r->msgs[0], "serverReference", NULL);
1302         if (server_reference_dn_str) {
1303                 server_reference_dn     = ldb_dn_new(r, s->ldap1.ldb, server_reference_dn_str);
1304                 NT_STATUS_HAVE_NO_MEMORY(server_reference_dn);
1305
1306                 computer_dn             = ldb_dn_new(r, s->ldap1.ldb, s->dest_dsa.computer_dn_str);
1307                 NT_STATUS_HAVE_NO_MEMORY(computer_dn);
1308
1309                 /*
1310                  * if the server object belongs to another DC in another domain
1311                  * in the forest, we should not touch this object!
1312                  */
1313                 if (ldb_dn_compare(computer_dn, server_reference_dn) != 0) {
1314                         talloc_free(r);
1315                         return NT_STATUS_OBJECT_NAME_COLLISION;
1316                 }
1317         }
1318
1319         /* if the server object is already for the dest_dsa, then we don't need to create it */
1320         s->dest_dsa.server_dn_str       = ldb_msg_find_attr_as_string(r->msgs[0], "distinguishedName", NULL);
1321         if (!s->dest_dsa.server_dn_str) return NT_STATUS_INVALID_NETWORK_RESPONSE;
1322         talloc_steal(s, s->dest_dsa.server_dn_str);
1323
1324         talloc_free(r);
1325         return NT_STATUS_OK;
1326 }
1327
1328 static NTSTATUS becomeDC_ldap1_server_object_2(struct libnet_BecomeDC_state *s)
1329 {
1330         int ret;
1331         struct ldb_result *r;
1332         struct ldb_dn *basedn;
1333         const char *server_reference_bl_dn_str;
1334         static const char *attrs[] = {
1335                 "serverReferenceBL",
1336                 NULL
1337         };
1338
1339         /* if the server_dn_str has a valid value, we skip this lookup */
1340         if (s->dest_dsa.server_dn_str) return NT_STATUS_OK;
1341
1342         basedn = ldb_dn_new(s, s->ldap1.ldb, s->dest_dsa.computer_dn_str);
1343         NT_STATUS_HAVE_NO_MEMORY(basedn);
1344
1345         ret = ldb_search(s->ldap1.ldb, s, &r, basedn, LDB_SCOPE_BASE,
1346                          attrs, "(objectClass=*)");
1347         talloc_free(basedn);
1348         if (ret != LDB_SUCCESS) {
1349                 return NT_STATUS_LDAP(ret);
1350         } else if (r->count != 1) {
1351                 talloc_free(r);
1352                 return NT_STATUS_INVALID_NETWORK_RESPONSE;
1353         }
1354
1355         server_reference_bl_dn_str = ldb_msg_find_attr_as_string(r->msgs[0], "serverReferenceBL", NULL);
1356         if (!server_reference_bl_dn_str) {
1357                 /* if no back link is present, we're done for this function */
1358                 talloc_free(r);
1359                 return NT_STATUS_OK;
1360         }
1361
1362         /* if the server object is already for the dest_dsa, then we don't need to create it */
1363         s->dest_dsa.server_dn_str       = ldb_msg_find_attr_as_string(r->msgs[0], "serverReferenceBL", NULL);
1364         if (s->dest_dsa.server_dn_str) {
1365                 /* if a back link is present, we know that the server object is present */
1366                 talloc_steal(s, s->dest_dsa.server_dn_str);
1367         }
1368
1369         talloc_free(r);
1370         return NT_STATUS_OK;
1371 }
1372
1373 static NTSTATUS becomeDC_ldap1_server_object_add(struct libnet_BecomeDC_state *s)
1374 {
1375         int ret;
1376         struct ldb_message *msg;
1377         char *server_dn_str;
1378
1379         /* if the server_dn_str has a valid value, we skip this lookup */
1380         if (s->dest_dsa.server_dn_str) return NT_STATUS_OK;
1381
1382         msg = ldb_msg_new(s);
1383         NT_STATUS_HAVE_NO_MEMORY(msg);
1384
1385         msg->dn = ldb_dn_new_fmt(msg, s->ldap1.ldb, "CN=%s,CN=Servers,CN=%s,CN=Sites,%s",
1386                                  s->dest_dsa.netbios_name,
1387                                  s->dest_dsa.site_name,
1388                                  s->forest.config_dn_str);
1389         NT_STATUS_HAVE_NO_MEMORY(msg->dn);
1390
1391         ret = ldb_msg_add_string(msg, "objectClass", "server");
1392         if (ret != 0) {
1393                 talloc_free(msg);
1394                 return NT_STATUS_NO_MEMORY;
1395         }
1396         ret = ldb_msg_add_string(msg, "systemFlags", "50000000");
1397         if (ret != 0) {
1398                 talloc_free(msg);
1399                 return NT_STATUS_NO_MEMORY;
1400         }
1401         ret = ldb_msg_add_string(msg, "serverReference", s->dest_dsa.computer_dn_str);
1402         if (ret != 0) {
1403                 talloc_free(msg);
1404                 return NT_STATUS_NO_MEMORY;
1405         }
1406
1407         server_dn_str = ldb_dn_alloc_linearized(s, msg->dn);
1408         NT_STATUS_HAVE_NO_MEMORY(server_dn_str);
1409
1410         ret = ldb_add(s->ldap1.ldb, msg);
1411         talloc_free(msg);
1412         if (ret != LDB_SUCCESS) {
1413                 talloc_free(server_dn_str);
1414                 return NT_STATUS_LDAP(ret);
1415         }
1416
1417         s->dest_dsa.server_dn_str = server_dn_str;
1418
1419         return NT_STATUS_OK;
1420 }
1421
1422 static NTSTATUS becomeDC_ldap1_server_object_modify(struct libnet_BecomeDC_state *s)
1423 {
1424         int ret;
1425         struct ldb_message *msg;
1426         unsigned int i;
1427
1428         /* make a 'modify' msg, and only for serverReference */
1429         msg = ldb_msg_new(s);
1430         NT_STATUS_HAVE_NO_MEMORY(msg);
1431         msg->dn = ldb_dn_new(msg, s->ldap1.ldb, s->dest_dsa.server_dn_str);
1432         NT_STATUS_HAVE_NO_MEMORY(msg->dn);
1433
1434         ret = ldb_msg_add_string(msg, "serverReference", s->dest_dsa.computer_dn_str);
1435         if (ret != 0) {
1436                 talloc_free(msg);
1437                 return NT_STATUS_NO_MEMORY;
1438         }
1439
1440         /* mark all the message elements (should be just one)
1441            as LDB_FLAG_MOD_ADD */
1442         for (i=0;i<msg->num_elements;i++) {
1443                 msg->elements[i].flags = LDB_FLAG_MOD_ADD;
1444         }
1445
1446         ret = ldb_modify(s->ldap1.ldb, msg);
1447         if (ret == LDB_SUCCESS) {
1448                 talloc_free(msg);
1449                 return NT_STATUS_OK;
1450         } else if (ret == LDB_ERR_ATTRIBUTE_OR_VALUE_EXISTS) {
1451                 /* retry with LDB_FLAG_MOD_REPLACE */
1452         } else {
1453                 talloc_free(msg);
1454                 return NT_STATUS_LDAP(ret);
1455         }
1456
1457         /* mark all the message elements (should be just one)
1458            as LDB_FLAG_MOD_REPLACE */
1459         for (i=0;i<msg->num_elements;i++) {
1460                 msg->elements[i].flags = LDB_FLAG_MOD_REPLACE;
1461         }
1462
1463         ret = ldb_modify(s->ldap1.ldb, msg);
1464         talloc_free(msg);
1465         if (ret != LDB_SUCCESS) {
1466                 return NT_STATUS_LDAP(ret);
1467         }
1468
1469         return NT_STATUS_OK;
1470 }
1471
1472 static void becomeDC_drsuapi_connect_send(struct libnet_BecomeDC_state *s,
1473                                           struct becomeDC_drsuapi *drsuapi,
1474                                           void (*recv_fn)(struct composite_context *req));
1475 static void becomeDC_drsuapi1_connect_recv(struct composite_context *req);
1476 static void becomeDC_connect_ldap2(struct libnet_BecomeDC_state *s);
1477
1478 static void becomeDC_connect_ldap1(struct libnet_BecomeDC_state *s)
1479 {
1480         struct composite_context *c = s->creq;
1481
1482         c->status = becomeDC_ldap_connect(s, &s->ldap1);
1483         if (!composite_is_ok(c)) return;
1484
1485         c->status = becomeDC_ldap1_rootdse(s);
1486         if (!composite_is_ok(c)) return;
1487
1488         c->status = becomeDC_ldap1_crossref_behavior_version(s);
1489         if (!composite_is_ok(c)) return;
1490
1491         c->status = becomeDC_ldap1_domain_behavior_version(s);
1492         if (!composite_is_ok(c)) return;
1493
1494         c->status = becomeDC_ldap1_schema_object_version(s);
1495         if (!composite_is_ok(c)) return;
1496
1497         c->status = becomeDC_ldap1_w2k3_update_revision(s);
1498         if (!composite_is_ok(c)) return;
1499
1500         c->status = becomeDC_ldap1_infrastructure_fsmo(s);
1501         if (!composite_is_ok(c)) return;
1502
1503         c->status = becomeDC_ldap1_rid_manager_fsmo(s);
1504         if (!composite_is_ok(c)) return;
1505
1506         c->status = becomeDC_ldap1_site_object(s);
1507         if (!composite_is_ok(c)) return;
1508
1509         c->status = becomeDC_check_options(s);
1510         if (!composite_is_ok(c)) return;
1511
1512         c->status = becomeDC_ldap1_computer_object(s);
1513         if (!composite_is_ok(c)) return;
1514
1515         c->status = becomeDC_ldap1_server_object_1(s);
1516         if (!composite_is_ok(c)) return;
1517
1518         c->status = becomeDC_ldap1_server_object_2(s);
1519         if (!composite_is_ok(c)) return;
1520
1521         c->status = becomeDC_ldap1_server_object_add(s);
1522         if (!composite_is_ok(c)) return;
1523
1524         c->status = becomeDC_ldap1_server_object_modify(s);
1525         if (!composite_is_ok(c)) return;
1526
1527         becomeDC_drsuapi_connect_send(s, &s->drsuapi1, becomeDC_drsuapi1_connect_recv);
1528 }
1529
1530 static void becomeDC_drsuapi_connect_send(struct libnet_BecomeDC_state *s,
1531                                           struct becomeDC_drsuapi *drsuapi,
1532                                           void (*recv_fn)(struct composite_context *req))
1533 {
1534         struct composite_context *c = s->creq;
1535         struct composite_context *creq;
1536         char *binding_str;
1537
1538         drsuapi->s = s;
1539
1540         if (!drsuapi->binding) {
1541                 const char *krb5_str = "";
1542                 const char *print_str = "";
1543                 /*
1544                  * Note: Replication only works with Windows 2000 when 'krb5' is
1545                  *       passed as auth_type here. If NTLMSSP is used, Windows
1546                  *       2000 returns garbage in the DsGetNCChanges() response
1547                  *       if encrypted password attributes would be in the
1548                  *       response. That means the replication of the schema and
1549                  *       configuration partition works fine, but it fails for
1550                  *       the domain partition.
1551                  */
1552                 if (lpcfg_parm_bool(s->libnet->lp_ctx, NULL, "become_dc",
1553                                  "force krb5", true))
1554                 {
1555                         krb5_str = "krb5,";
1556                 }
1557                 if (lpcfg_parm_bool(s->libnet->lp_ctx, NULL, "become_dc",
1558                                  "print", false))
1559                 {
1560                         print_str = "print,";
1561                 }
1562                 binding_str = talloc_asprintf(s, "ncacn_ip_tcp:%s[%s%sseal]",
1563                                               s->source_dsa.dns_name,
1564                                               krb5_str, print_str);
1565                 if (composite_nomem(binding_str, c)) return;
1566                 c->status = dcerpc_parse_binding(s, binding_str, &drsuapi->binding);
1567                 talloc_free(binding_str);
1568                 if (!composite_is_ok(c)) return;
1569         }
1570
1571         creq = dcerpc_pipe_connect_b_send(s, drsuapi->binding, &ndr_table_drsuapi,
1572                                           s->libnet->cred, s->libnet->event_ctx,
1573                                           s->libnet->lp_ctx);
1574         composite_continue(c, creq, recv_fn, s);
1575 }
1576
1577 static void becomeDC_drsuapi_bind_send(struct libnet_BecomeDC_state *s,
1578                                        struct becomeDC_drsuapi *drsuapi,
1579                                        void (*recv_fn)(struct tevent_req *subreq));
1580 static void becomeDC_drsuapi1_bind_recv(struct tevent_req *subreq);
1581
1582 static void becomeDC_drsuapi1_connect_recv(struct composite_context *req)
1583 {
1584         struct libnet_BecomeDC_state *s = talloc_get_type(req->async.private_data,
1585                                           struct libnet_BecomeDC_state);
1586         struct composite_context *c = s->creq;
1587
1588         c->status = dcerpc_pipe_connect_b_recv(req, s, &s->drsuapi1.pipe);
1589         if (!composite_is_ok(c)) return;
1590
1591         s->drsuapi1.drsuapi_handle = s->drsuapi1.pipe->binding_handle;
1592
1593         c->status = gensec_session_key(s->drsuapi1.pipe->conn->security_state.generic_state,
1594                                        &s->drsuapi1.gensec_skey);
1595         if (!composite_is_ok(c)) return;
1596
1597         becomeDC_drsuapi_bind_send(s, &s->drsuapi1, becomeDC_drsuapi1_bind_recv);
1598 }
1599
1600 static void becomeDC_drsuapi_bind_send(struct libnet_BecomeDC_state *s,
1601                                        struct becomeDC_drsuapi *drsuapi,
1602                                        void (*recv_fn)(struct tevent_req *subreq))
1603 {
1604         struct composite_context *c = s->creq;
1605         struct drsuapi_DsBindInfo28 *bind_info28;
1606         struct tevent_req *subreq;
1607
1608         GUID_from_string(DRSUAPI_DS_BIND_GUID_W2K3, &drsuapi->bind_guid);
1609
1610         bind_info28                             = &drsuapi->local_info28;
1611         bind_info28->supported_extensions       |= DRSUAPI_SUPPORTED_EXTENSION_BASE;
1612         bind_info28->supported_extensions       |= DRSUAPI_SUPPORTED_EXTENSION_ASYNC_REPLICATION;
1613         bind_info28->supported_extensions       |= DRSUAPI_SUPPORTED_EXTENSION_REMOVEAPI;
1614         bind_info28->supported_extensions       |= DRSUAPI_SUPPORTED_EXTENSION_MOVEREQ_V2;
1615         bind_info28->supported_extensions       |= DRSUAPI_SUPPORTED_EXTENSION_GETCHG_COMPRESS;
1616         bind_info28->supported_extensions       |= DRSUAPI_SUPPORTED_EXTENSION_DCINFO_V1;
1617         bind_info28->supported_extensions       |= DRSUAPI_SUPPORTED_EXTENSION_RESTORE_USN_OPTIMIZATION;
1618         bind_info28->supported_extensions       |= DRSUAPI_SUPPORTED_EXTENSION_KCC_EXECUTE;
1619         bind_info28->supported_extensions       |= DRSUAPI_SUPPORTED_EXTENSION_ADDENTRY_V2;
1620         if (s->domain.behavior_version >= DS_DOMAIN_FUNCTION_2003) {
1621                 /* TODO: find out how this is really triggered! */
1622                 bind_info28->supported_extensions       |= DRSUAPI_SUPPORTED_EXTENSION_LINKED_VALUE_REPLICATION;
1623         }
1624         bind_info28->supported_extensions       |= DRSUAPI_SUPPORTED_EXTENSION_DCINFO_V2;
1625         bind_info28->supported_extensions       |= DRSUAPI_SUPPORTED_EXTENSION_INSTANCE_TYPE_NOT_REQ_ON_MOD;
1626         bind_info28->supported_extensions       |= DRSUAPI_SUPPORTED_EXTENSION_CRYPTO_BIND;
1627         bind_info28->supported_extensions       |= DRSUAPI_SUPPORTED_EXTENSION_GET_REPL_INFO;
1628         bind_info28->supported_extensions       |= DRSUAPI_SUPPORTED_EXTENSION_STRONG_ENCRYPTION;
1629         bind_info28->supported_extensions       |= DRSUAPI_SUPPORTED_EXTENSION_DCINFO_V01;
1630         bind_info28->supported_extensions       |= DRSUAPI_SUPPORTED_EXTENSION_TRANSITIVE_MEMBERSHIP;
1631         bind_info28->supported_extensions       |= DRSUAPI_SUPPORTED_EXTENSION_ADD_SID_HISTORY;
1632         bind_info28->supported_extensions       |= DRSUAPI_SUPPORTED_EXTENSION_POST_BETA3;
1633         bind_info28->supported_extensions       |= DRSUAPI_SUPPORTED_EXTENSION_GETCHGREQ_V5;
1634         bind_info28->supported_extensions       |= DRSUAPI_SUPPORTED_EXTENSION_GET_MEMBERSHIPS2;
1635         bind_info28->supported_extensions       |= DRSUAPI_SUPPORTED_EXTENSION_GETCHGREQ_V6;
1636         bind_info28->supported_extensions       |= DRSUAPI_SUPPORTED_EXTENSION_NONDOMAIN_NCS;
1637         bind_info28->supported_extensions       |= DRSUAPI_SUPPORTED_EXTENSION_GETCHGREQ_V8;
1638         bind_info28->supported_extensions       |= DRSUAPI_SUPPORTED_EXTENSION_GETCHGREPLY_V5;
1639         bind_info28->supported_extensions       |= DRSUAPI_SUPPORTED_EXTENSION_GETCHGREPLY_V6;
1640         bind_info28->supported_extensions       |= DRSUAPI_SUPPORTED_EXTENSION_ADDENTRYREPLY_V3;
1641         bind_info28->supported_extensions       |= DRSUAPI_SUPPORTED_EXTENSION_GETCHGREPLY_V7;
1642         bind_info28->supported_extensions       |= DRSUAPI_SUPPORTED_EXTENSION_VERIFY_OBJECT;
1643 #if 0 /* we don't support XPRESS compression yet */
1644         bind_info28->supported_extensions       |= DRSUAPI_SUPPORTED_EXTENSION_XPRESS_COMPRESS;
1645 #endif
1646         bind_info28->site_guid                  = s->dest_dsa.site_guid;
1647         bind_info28->pid                        = 0;
1648         bind_info28->repl_epoch                 = 0;
1649
1650         drsuapi->bind_info_ctr.length           = 28;
1651         drsuapi->bind_info_ctr.info.info28      = *bind_info28;
1652
1653         drsuapi->bind_r.in.bind_guid = &drsuapi->bind_guid;
1654         drsuapi->bind_r.in.bind_info = &drsuapi->bind_info_ctr;
1655         drsuapi->bind_r.out.bind_handle = &drsuapi->bind_handle;
1656
1657         subreq = dcerpc_drsuapi_DsBind_r_send(s, c->event_ctx,
1658                                               drsuapi->drsuapi_handle,
1659                                               &drsuapi->bind_r);
1660         if (composite_nomem(subreq, c)) return;
1661         tevent_req_set_callback(subreq, recv_fn, s);
1662 }
1663
1664 static WERROR becomeDC_drsuapi_bind_recv(struct libnet_BecomeDC_state *s,
1665                                          struct becomeDC_drsuapi *drsuapi)
1666 {
1667         if (!W_ERROR_IS_OK(drsuapi->bind_r.out.result)) {
1668                 return drsuapi->bind_r.out.result;
1669         }
1670
1671         ZERO_STRUCT(drsuapi->remote_info28);
1672         if (drsuapi->bind_r.out.bind_info) {
1673                 switch (drsuapi->bind_r.out.bind_info->length) {
1674                 case 24: {
1675                         struct drsuapi_DsBindInfo24 *info24;
1676                         info24 = &drsuapi->bind_r.out.bind_info->info.info24;
1677                         drsuapi->remote_info28.supported_extensions     = info24->supported_extensions;
1678                         drsuapi->remote_info28.site_guid                = info24->site_guid;
1679                         drsuapi->remote_info28.pid                      = info24->pid;
1680                         drsuapi->remote_info28.repl_epoch               = 0;
1681                         break;
1682                 }
1683                 case 48: {
1684                         struct drsuapi_DsBindInfo48 *info48;
1685                         info48 = &drsuapi->bind_r.out.bind_info->info.info48;
1686                         drsuapi->remote_info28.supported_extensions     = info48->supported_extensions;
1687                         drsuapi->remote_info28.site_guid                = info48->site_guid;
1688                         drsuapi->remote_info28.pid                      = info48->pid;
1689                         drsuapi->remote_info28.repl_epoch               = info48->repl_epoch;
1690                         break;
1691                 }
1692                 case 28:
1693                         drsuapi->remote_info28 = drsuapi->bind_r.out.bind_info->info.info28;
1694                         break;
1695                 }
1696         }
1697
1698         return WERR_OK;
1699 }
1700
1701 static void becomeDC_drsuapi1_add_entry_send(struct libnet_BecomeDC_state *s);
1702
1703 static void becomeDC_drsuapi1_bind_recv(struct tevent_req *subreq)
1704 {
1705         struct libnet_BecomeDC_state *s = tevent_req_callback_data(subreq,
1706                                           struct libnet_BecomeDC_state);
1707         struct composite_context *c = s->creq;
1708         WERROR status;
1709
1710         c->status = dcerpc_drsuapi_DsBind_r_recv(subreq, s);
1711         TALLOC_FREE(subreq);
1712         if (!composite_is_ok(c)) return;
1713
1714         status = becomeDC_drsuapi_bind_recv(s, &s->drsuapi1);
1715         if (!W_ERROR_IS_OK(status)) {
1716                 composite_error(c, werror_to_ntstatus(status));
1717                 return;
1718         }
1719
1720         becomeDC_drsuapi1_add_entry_send(s);
1721 }
1722
1723 static void becomeDC_drsuapi1_add_entry_recv(struct tevent_req *subreq);
1724
1725 static void becomeDC_drsuapi1_add_entry_send(struct libnet_BecomeDC_state *s)
1726 {
1727         struct composite_context *c = s->creq;
1728         struct drsuapi_DsAddEntry *r;
1729         struct drsuapi_DsReplicaObjectIdentifier *identifier;
1730         uint32_t num_attrs, i = 0;
1731         struct drsuapi_DsReplicaAttribute *attrs;
1732         enum ndr_err_code ndr_err;
1733         bool w2k3;
1734         struct tevent_req *subreq;
1735
1736         /* choose a random invocationId */
1737         s->dest_dsa.invocation_id = GUID_random();
1738
1739         /*
1740          * if the schema version indicates w2k3, then also send some w2k3
1741          * specific attributes.
1742          */
1743         if (s->forest.schema_object_version >= 30) {
1744                 w2k3 = true;
1745         } else {
1746                 w2k3 = false;
1747         }
1748
1749         r = talloc_zero(s, struct drsuapi_DsAddEntry);
1750         if (composite_nomem(r, c)) return;
1751
1752         /* setup identifier */
1753         identifier              = talloc(r, struct drsuapi_DsReplicaObjectIdentifier);
1754         if (composite_nomem(identifier, c)) return;
1755         identifier->guid        = GUID_zero();
1756         identifier->sid         = s->zero_sid;
1757         identifier->dn          = talloc_asprintf(identifier, "CN=NTDS Settings,%s",
1758                                                   s->dest_dsa.server_dn_str);
1759         if (composite_nomem(identifier->dn, c)) return;
1760
1761         /* allocate attribute array */
1762         num_attrs       = 12;
1763         attrs           = talloc_array(r, struct drsuapi_DsReplicaAttribute, num_attrs);
1764         if (composite_nomem(attrs, c)) return;
1765
1766         /* ntSecurityDescriptor */
1767         {
1768                 struct drsuapi_DsAttributeValue *vs;
1769                 DATA_BLOB *vd;
1770                 struct security_descriptor *v;
1771                 struct dom_sid *domain_admins_sid;
1772                 const char *domain_admins_sid_str;
1773
1774                 vs = talloc_array(attrs, struct drsuapi_DsAttributeValue, 1);
1775                 if (composite_nomem(vs, c)) return;
1776
1777                 vd = talloc_array(vs, DATA_BLOB, 1);
1778                 if (composite_nomem(vd, c)) return;
1779
1780                 domain_admins_sid = dom_sid_add_rid(vs, s->domain.sid, DOMAIN_RID_ADMINS);
1781                 if (composite_nomem(domain_admins_sid, c)) return;
1782
1783                 domain_admins_sid_str = dom_sid_string(domain_admins_sid, domain_admins_sid);
1784                 if (composite_nomem(domain_admins_sid_str, c)) return;
1785
1786                 v = security_descriptor_dacl_create(vd,
1787                                                0,
1788                                                /* owner: domain admins */
1789                                                domain_admins_sid_str,
1790                                                /* owner group: domain admins */
1791                                                domain_admins_sid_str,
1792                                                /* authenticated users */
1793                                                SID_NT_AUTHENTICATED_USERS,
1794                                                SEC_ACE_TYPE_ACCESS_ALLOWED,
1795                                                SEC_STD_READ_CONTROL |
1796                                                SEC_ADS_LIST |
1797                                                SEC_ADS_READ_PROP |
1798                                                SEC_ADS_LIST_OBJECT,
1799                                                0,
1800                                                /* domain admins */
1801                                                domain_admins_sid_str,
1802                                                SEC_ACE_TYPE_ACCESS_ALLOWED,
1803                                                SEC_STD_REQUIRED |
1804                                                SEC_ADS_CREATE_CHILD |
1805                                                SEC_ADS_LIST |
1806                                                SEC_ADS_SELF_WRITE |
1807                                                SEC_ADS_READ_PROP |
1808                                                SEC_ADS_WRITE_PROP |
1809                                                SEC_ADS_DELETE_TREE |
1810                                                SEC_ADS_LIST_OBJECT |
1811                                                SEC_ADS_CONTROL_ACCESS,
1812                                                0,
1813                                                /* system */
1814                                                SID_NT_SYSTEM,
1815                                                SEC_ACE_TYPE_ACCESS_ALLOWED,
1816                                                SEC_STD_REQUIRED |
1817                                                SEC_ADS_CREATE_CHILD |
1818                                                SEC_ADS_DELETE_CHILD |
1819                                                SEC_ADS_LIST |
1820                                                SEC_ADS_SELF_WRITE |
1821                                                SEC_ADS_READ_PROP |
1822                                                SEC_ADS_WRITE_PROP |
1823                                                SEC_ADS_DELETE_TREE |
1824                                                SEC_ADS_LIST_OBJECT |
1825                                                SEC_ADS_CONTROL_ACCESS,
1826                                                0,
1827                                                /* end */
1828                                                NULL);
1829                 if (composite_nomem(v, c)) return;
1830
1831                 ndr_err = ndr_push_struct_blob(&vd[0], vd, v,
1832                 (ndr_push_flags_fn_t)ndr_push_security_descriptor);
1833                 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
1834                         c->status = ndr_map_error2ntstatus(ndr_err);
1835                         if (!composite_is_ok(c)) return;
1836                 }
1837
1838                 vs[0].blob              = &vd[0];
1839
1840                 attrs[i].attid                  = DRSUAPI_ATTID_ntSecurityDescriptor;
1841                 attrs[i].value_ctr.num_values   = 1;
1842                 attrs[i].value_ctr.values       = vs;
1843
1844                 i++;
1845         }
1846
1847         /* objectClass: nTDSDSA */
1848         {
1849                 struct drsuapi_DsAttributeValue *vs;
1850                 DATA_BLOB *vd;
1851
1852                 vs = talloc_array(attrs, struct drsuapi_DsAttributeValue, 1);
1853                 if (composite_nomem(vs, c)) return;
1854
1855                 vd = talloc_array(vs, DATA_BLOB, 1);
1856                 if (composite_nomem(vd, c)) return;
1857
1858                 vd[0] = data_blob_talloc(vd, NULL, 4);
1859                 if (composite_nomem(vd[0].data, c)) return;
1860
1861                 /* value for nTDSDSA */
1862                 SIVAL(vd[0].data, 0, 0x0017002F);
1863
1864                 vs[0].blob              = &vd[0];
1865
1866                 attrs[i].attid                  = DRSUAPI_ATTID_objectClass;
1867                 attrs[i].value_ctr.num_values   = 1;
1868                 attrs[i].value_ctr.values       = vs;
1869
1870                 i++;
1871         }
1872
1873         /* objectCategory: CN=NTDS-DSA,CN=Schema,... or CN=NTDS-DSA-RO,CN=Schema,... */
1874         {
1875                 struct drsuapi_DsAttributeValue *vs;
1876                 DATA_BLOB *vd;
1877                 struct drsuapi_DsReplicaObjectIdentifier3 v[1];
1878
1879                 vs = talloc_array(attrs, struct drsuapi_DsAttributeValue, 1);
1880                 if (composite_nomem(vs, c)) return;
1881
1882                 vd = talloc_array(vs, DATA_BLOB, 1);
1883                 if (composite_nomem(vd, c)) return;
1884
1885                 v[0].guid               = GUID_zero();
1886                 v[0].sid                = s->zero_sid;
1887
1888                 if (s->rodc_join) {
1889                     v[0].dn             = talloc_asprintf(vd, "CN=NTDS-DSA-RO,%s",
1890                                                           s->forest.schema_dn_str);
1891                 } else {
1892                     v[0].dn             = talloc_asprintf(vd, "CN=NTDS-DSA,%s",
1893                                                           s->forest.schema_dn_str);
1894                 }
1895                 if (composite_nomem(v[0].dn, c)) return;
1896
1897                 ndr_err = ndr_push_struct_blob(&vd[0], vd, &v[0], 
1898                         (ndr_push_flags_fn_t)ndr_push_drsuapi_DsReplicaObjectIdentifier3);
1899                 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
1900                         c->status = ndr_map_error2ntstatus(ndr_err);
1901                         if (!composite_is_ok(c)) return;
1902                 }
1903
1904                 vs[0].blob              = &vd[0];
1905
1906                 attrs[i].attid                  = DRSUAPI_ATTID_objectCategory;
1907                 attrs[i].value_ctr.num_values   = 1;
1908                 attrs[i].value_ctr.values       = vs;
1909
1910                 i++;
1911         }
1912
1913         /* invocationId: random guid */
1914         {
1915                 struct drsuapi_DsAttributeValue *vs;
1916                 DATA_BLOB *vd;
1917                 const struct GUID *v;
1918
1919                 vs = talloc_array(attrs, struct drsuapi_DsAttributeValue, 1);
1920                 if (composite_nomem(vs, c)) return;
1921
1922                 vd = talloc_array(vs, DATA_BLOB, 1);
1923                 if (composite_nomem(vd, c)) return;
1924
1925                 v = &s->dest_dsa.invocation_id;
1926
1927                 c->status = GUID_to_ndr_blob(v, vd, &vd[0]);
1928                 if (!composite_is_ok(c)) return;
1929
1930                 vs[0].blob              = &vd[0];
1931
1932                 attrs[i].attid                  = DRSUAPI_ATTID_invocationId;
1933                 attrs[i].value_ctr.num_values   = 1;
1934                 attrs[i].value_ctr.values       = vs;
1935
1936                 i++;
1937         }
1938
1939         /* hasMasterNCs: ... */
1940         {
1941                 struct drsuapi_DsAttributeValue *vs;
1942                 DATA_BLOB *vd;
1943                 struct drsuapi_DsReplicaObjectIdentifier3 v[3];
1944
1945                 vs = talloc_array(attrs, struct drsuapi_DsAttributeValue, 3);
1946                 if (composite_nomem(vs, c)) return;
1947
1948                 vd = talloc_array(vs, DATA_BLOB, 3);
1949                 if (composite_nomem(vd, c)) return;
1950
1951                 v[0].guid               = GUID_zero();
1952                 v[0].sid                = s->zero_sid;
1953                 v[0].dn                 = s->forest.config_dn_str;
1954
1955                 v[1].guid               = GUID_zero();
1956                 v[1].sid                = s->zero_sid;
1957                 v[1].dn                 = s->domain.dn_str;
1958
1959                 v[2].guid               = GUID_zero();
1960                 v[2].sid                = s->zero_sid;
1961                 v[2].dn                 = s->forest.schema_dn_str;
1962
1963                 ndr_err = ndr_push_struct_blob(&vd[0], vd, &v[0],
1964                         (ndr_push_flags_fn_t)ndr_push_drsuapi_DsReplicaObjectIdentifier3);
1965                 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
1966                         c->status = ndr_map_error2ntstatus(ndr_err);
1967                         if (!composite_is_ok(c)) return;
1968                 }
1969
1970                 ndr_err = ndr_push_struct_blob(&vd[1], vd, &v[1],
1971                 (ndr_push_flags_fn_t)ndr_push_drsuapi_DsReplicaObjectIdentifier3);
1972                 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
1973                         c->status = ndr_map_error2ntstatus(ndr_err);
1974                         if (!composite_is_ok(c)) return;
1975                 }
1976
1977                 ndr_err = ndr_push_struct_blob(&vd[2], vd, &v[2],
1978                    (ndr_push_flags_fn_t)ndr_push_drsuapi_DsReplicaObjectIdentifier3);
1979                 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
1980                         c->status = ndr_map_error2ntstatus(ndr_err);
1981                         if (!composite_is_ok(c)) return;
1982                 }
1983
1984                 vs[0].blob              = &vd[0];
1985                 vs[1].blob              = &vd[1];
1986                 vs[2].blob              = &vd[2];
1987
1988                 attrs[i].attid                  = DRSUAPI_ATTID_hasMasterNCs;
1989                 attrs[i].value_ctr.num_values   = 3;
1990                 attrs[i].value_ctr.values       = vs;
1991
1992                 i++;
1993         }
1994
1995         /* msDS-hasMasterNCs: ... */
1996         if (w2k3) {
1997                 struct drsuapi_DsAttributeValue *vs;
1998                 DATA_BLOB *vd;
1999                 struct drsuapi_DsReplicaObjectIdentifier3 v[3];
2000
2001                 vs = talloc_array(attrs, struct drsuapi_DsAttributeValue, 3);
2002                 if (composite_nomem(vs, c)) return;
2003
2004                 vd = talloc_array(vs, DATA_BLOB, 3);
2005                 if (composite_nomem(vd, c)) return;
2006
2007                 v[0].guid               = GUID_zero();
2008                 v[0].sid                = s->zero_sid;
2009                 v[0].dn                 = s->forest.config_dn_str;
2010
2011                 v[1].guid               = GUID_zero();
2012                 v[1].sid                = s->zero_sid;
2013                 v[1].dn                 = s->domain.dn_str;
2014
2015                 v[2].guid               = GUID_zero();
2016                 v[2].sid                = s->zero_sid;
2017                 v[2].dn                 = s->forest.schema_dn_str;
2018
2019                 ndr_err = ndr_push_struct_blob(&vd[0], vd, &v[0],
2020                         (ndr_push_flags_fn_t)ndr_push_drsuapi_DsReplicaObjectIdentifier3);
2021                 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
2022                         c->status = ndr_map_error2ntstatus(ndr_err);
2023                         if (!composite_is_ok(c)) return;
2024                 }
2025
2026                 ndr_err = ndr_push_struct_blob(&vd[1], vd, &v[1],
2027                         (ndr_push_flags_fn_t)ndr_push_drsuapi_DsReplicaObjectIdentifier3);
2028                 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
2029                         c->status = ndr_map_error2ntstatus(ndr_err);
2030                         if (!composite_is_ok(c)) return;
2031                 }
2032
2033                 ndr_err = ndr_push_struct_blob(&vd[2], vd, &v[2],
2034                         (ndr_push_flags_fn_t)ndr_push_drsuapi_DsReplicaObjectIdentifier3);
2035                 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
2036                         c->status = ndr_map_error2ntstatus(ndr_err);
2037                         if (!composite_is_ok(c)) return;
2038                 }
2039
2040                 vs[0].blob              = &vd[0];
2041                 vs[1].blob              = &vd[1];
2042                 vs[2].blob              = &vd[2];
2043
2044                 attrs[i].attid                  = DRSUAPI_ATTID_msDS_hasMasterNCs;
2045                 attrs[i].value_ctr.num_values   = 3;
2046                 attrs[i].value_ctr.values       = vs;
2047
2048                 i++;
2049         }
2050
2051         /* dMDLocation: CN=Schema,... */
2052         {
2053                 struct drsuapi_DsAttributeValue *vs;
2054                 DATA_BLOB *vd;
2055                 struct drsuapi_DsReplicaObjectIdentifier3 v[1];
2056
2057                 vs = talloc_array(attrs, struct drsuapi_DsAttributeValue, 1);
2058                 if (composite_nomem(vs, c)) return;
2059
2060                 vd = talloc_array(vs, DATA_BLOB, 1);
2061                 if (composite_nomem(vd, c)) return;
2062
2063                 v[0].guid               = GUID_zero();
2064                 v[0].sid                = s->zero_sid;
2065                 v[0].dn                 = s->forest.schema_dn_str;
2066
2067                 ndr_err = ndr_push_struct_blob(&vd[0], vd, &v[0],
2068                         (ndr_push_flags_fn_t)ndr_push_drsuapi_DsReplicaObjectIdentifier3);
2069                 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
2070                         c->status = ndr_map_error2ntstatus(ndr_err);
2071                         if (!composite_is_ok(c)) return;
2072                 }
2073
2074                 vs[0].blob              = &vd[0];
2075
2076                 attrs[i].attid                  = DRSUAPI_ATTID_dMDLocation;
2077                 attrs[i].value_ctr.num_values   = 1;
2078                 attrs[i].value_ctr.values       = vs;
2079
2080                 i++;
2081         }
2082
2083         /* msDS-HasDomainNCs: <domain_partition> */
2084         if (w2k3) {
2085                 struct drsuapi_DsAttributeValue *vs;
2086                 DATA_BLOB *vd;
2087                 struct drsuapi_DsReplicaObjectIdentifier3 v[1];
2088
2089                 vs = talloc_array(attrs, struct drsuapi_DsAttributeValue, 1);
2090                 if (composite_nomem(vs, c)) return;
2091
2092                 vd = talloc_array(vs, DATA_BLOB, 1);
2093                 if (composite_nomem(vd, c)) return;
2094
2095                 v[0].guid               = GUID_zero();
2096                 v[0].sid                = s->zero_sid;
2097                 v[0].dn                 = s->domain.dn_str;
2098
2099                 ndr_err = ndr_push_struct_blob(&vd[0], vd, &v[0],
2100                         (ndr_push_flags_fn_t)ndr_push_drsuapi_DsReplicaObjectIdentifier3);
2101                 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
2102                         c->status = ndr_map_error2ntstatus(ndr_err);
2103                         if (!composite_is_ok(c)) return;
2104                 }
2105
2106                 vs[0].blob              = &vd[0];
2107
2108                 attrs[i].attid                  = DRSUAPI_ATTID_msDS_HasDomainNCs;
2109                 attrs[i].value_ctr.num_values   = 1;
2110                 attrs[i].value_ctr.values       = vs;
2111
2112                 i++;
2113         }
2114
2115         /* msDS-Behavior-Version */
2116         if (w2k3) {
2117                 struct drsuapi_DsAttributeValue *vs;
2118                 DATA_BLOB *vd;
2119
2120                 vs = talloc_array(attrs, struct drsuapi_DsAttributeValue, 1);
2121                 if (composite_nomem(vs, c)) return;
2122
2123                 vd = talloc_array(vs, DATA_BLOB, 1);
2124                 if (composite_nomem(vd, c)) return;
2125
2126                 vd[0] = data_blob_talloc(vd, NULL, 4);
2127                 if (composite_nomem(vd[0].data, c)) return;
2128
2129                 SIVAL(vd[0].data, 0, get_dc_function_level(s->libnet->lp_ctx));
2130
2131                 vs[0].blob              = &vd[0];
2132
2133                 attrs[i].attid                  = DRSUAPI_ATTID_msDS_Behavior_Version;
2134                 attrs[i].value_ctr.num_values   = 1;
2135                 attrs[i].value_ctr.values       = vs;
2136
2137                 i++;
2138         }
2139
2140         /* systemFlags */
2141         {
2142                 struct drsuapi_DsAttributeValue *vs;
2143                 DATA_BLOB *vd;
2144
2145                 vs = talloc_array(attrs, struct drsuapi_DsAttributeValue, 1);
2146                 if (composite_nomem(vs, c)) return;
2147
2148                 vd = talloc_array(vs, DATA_BLOB, 1);
2149                 if (composite_nomem(vd, c)) return;
2150
2151                 vd[0] = data_blob_talloc(vd, NULL, 4);
2152                 if (composite_nomem(vd[0].data, c)) return;
2153
2154                 if (s->rodc_join) {
2155                     SIVAL(vd[0].data, 0, SYSTEM_FLAG_CONFIG_ALLOW_RENAME);
2156                 } else {
2157                     SIVAL(vd[0].data, 0, SYSTEM_FLAG_DISALLOW_MOVE_ON_DELETE);
2158                 }
2159
2160                 vs[0].blob              = &vd[0];
2161
2162                 attrs[i].attid                  = DRSUAPI_ATTID_systemFlags;
2163                 attrs[i].value_ctr.num_values   = 1;
2164                 attrs[i].value_ctr.values       = vs;
2165
2166                 i++;
2167         }
2168
2169         /* serverReference: ... */
2170         {
2171                 struct drsuapi_DsAttributeValue *vs;
2172                 DATA_BLOB *vd;
2173                 struct drsuapi_DsReplicaObjectIdentifier3 v[1];
2174
2175                 vs = talloc_array(attrs, struct drsuapi_DsAttributeValue, 1);
2176                 if (composite_nomem(vs, c)) return;
2177
2178                 vd = talloc_array(vs, DATA_BLOB, 1);
2179                 if (composite_nomem(vd, c)) return;
2180
2181                 v[0].guid               = GUID_zero();
2182                 v[0].sid                = s->zero_sid;
2183                 v[0].dn                 = s->dest_dsa.computer_dn_str;
2184
2185                 ndr_err = ndr_push_struct_blob(&vd[0], vd, &v[0],
2186                         (ndr_push_flags_fn_t)ndr_push_drsuapi_DsReplicaObjectIdentifier3);
2187                 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
2188                         c->status = ndr_map_error2ntstatus(ndr_err);
2189                         if (!composite_is_ok(c)) return;
2190                 }
2191
2192                 vs[0].blob              = &vd[0];
2193
2194                 attrs[i].attid                  = DRSUAPI_ATTID_serverReference;
2195                 attrs[i].value_ctr.num_values   = 1;
2196                 attrs[i].value_ctr.values       = vs;
2197
2198                 i++;
2199         }
2200
2201         /* options:... */
2202         if (s->rodc_join) {
2203                 struct drsuapi_DsAttributeValue *vs;
2204                 DATA_BLOB *vd;
2205
2206                 vs = talloc_array(attrs, struct drsuapi_DsAttributeValue, 1);
2207                 if (composite_nomem(vs, c)) return;
2208
2209                 vd = talloc_array(vs, DATA_BLOB, 1);
2210                 if (composite_nomem(vd, c)) return;
2211
2212                 vd[0] = data_blob_talloc(vd, NULL, 4);
2213                 if (composite_nomem(vd[0].data, c)) return;
2214
2215                 SIVAL(vd[0].data, 0, DS_NTDSDSA_OPT_DISABLE_OUTBOUND_REPL);
2216
2217                 vs[0].blob              = &vd[0];
2218
2219                 attrs[i].attid                  = DRSUAPI_ATTID_options;
2220                 attrs[i].value_ctr.num_values   = 1;
2221                 attrs[i].value_ctr.values       = vs;
2222
2223                 i++;
2224         }
2225
2226         /* truncate the attribute list to the attribute count we have filled in */
2227         num_attrs = i;
2228
2229         /* setup request structure */
2230         r->in.bind_handle                                               = &s->drsuapi1.bind_handle;
2231         r->in.level                                                     = 2;
2232         r->in.req                                                       = talloc(s, union drsuapi_DsAddEntryRequest);
2233         r->in.req->req2.first_object.next_object                        = NULL;
2234         r->in.req->req2.first_object.object.identifier                  = identifier;
2235         r->in.req->req2.first_object.object.flags                       = 0x00000000;
2236         r->in.req->req2.first_object.object.attribute_ctr.num_attributes= num_attrs;
2237         r->in.req->req2.first_object.object.attribute_ctr.attributes    = attrs;
2238
2239         r->out.level_out        = talloc(s, uint32_t);
2240         r->out.ctr              = talloc(s, union drsuapi_DsAddEntryCtr);
2241
2242         s->ndr_struct_ptr = r;
2243         subreq = dcerpc_drsuapi_DsAddEntry_r_send(s, c->event_ctx,
2244                                                   s->drsuapi1.drsuapi_handle, r);
2245         if (composite_nomem(subreq, c)) return;
2246         tevent_req_set_callback(subreq, becomeDC_drsuapi1_add_entry_recv, s);
2247 }
2248
2249 static void becomeDC_drsuapi2_connect_recv(struct composite_context *req);
2250 static NTSTATUS becomeDC_prepare_db(struct libnet_BecomeDC_state *s);
2251
2252 static void becomeDC_drsuapi1_add_entry_recv(struct tevent_req *subreq)
2253 {
2254         struct libnet_BecomeDC_state *s = tevent_req_callback_data(subreq,
2255                                           struct libnet_BecomeDC_state);
2256         struct composite_context *c = s->creq;
2257         struct drsuapi_DsAddEntry *r = talloc_get_type_abort(s->ndr_struct_ptr,
2258                                        struct drsuapi_DsAddEntry);
2259         char *binding_str;
2260
2261         s->ndr_struct_ptr = NULL;
2262
2263         c->status = dcerpc_drsuapi_DsAddEntry_r_recv(subreq, r);
2264         TALLOC_FREE(subreq);
2265         if (!composite_is_ok(c)) return;
2266
2267         if (!W_ERROR_IS_OK(r->out.result)) {
2268                 composite_error(c, werror_to_ntstatus(r->out.result));
2269                 return;
2270         }
2271
2272         if (*r->out.level_out == 3) {
2273                 WERROR status;
2274                 union drsuapi_DsAddEntry_ErrData *err_data = r->out.ctr->ctr3.err_data;
2275
2276                 /* check for errors */
2277                 status = err_data ? err_data->v1.status : WERR_OK;
2278                 if (!W_ERROR_IS_OK(status)) {
2279                         struct drsuapi_DsAddEntryErrorInfo_Attr_V1 *attr_err;
2280                         struct drsuapi_DsAddEntry_AttrErrListItem_V1 *attr_err_li;
2281                         struct drsuapi_DsAddEntryErrorInfo_Name_V1 *name_err;
2282                         struct drsuapi_DsAddEntryErrorInfo_Referr_V1 *ref_err;
2283                         struct drsuapi_DsAddEntry_RefErrListItem_V1 *ref_li;
2284
2285                         if (r->out.ctr->ctr3.err_ver != 1) {
2286                                 composite_error(c, NT_STATUS_INVALID_NETWORK_RESPONSE);
2287                                 return;
2288                         }
2289
2290                         DEBUG(0,("DsAddEntry (R3) of '%s' failed: "
2291                                  "Errors: dir_err = %d, status = %s;\n",
2292                                  r->in.req->req3.first_object.object.identifier->dn,
2293                                  err_data->v1.dir_err,
2294                                  win_errstr(err_data->v1.status)));
2295
2296                         if (!err_data->v1.info) {
2297                                 DEBUG(0, ("DsAddEntry (R3): no error info returned!\n"));
2298                                 composite_error(c, werror_to_ntstatus(status));
2299                                 return;
2300                         }
2301
2302                         /* dump more detailed error */
2303                         switch (err_data->v1.dir_err) {
2304                         case DRSUAPI_DIRERR_ATTRIBUTE:
2305                                 /* Dump attribute errors */
2306                                 attr_err = &err_data->v1.info->attr_err;
2307                                 DEBUGADD(0,(" Attribute Error: object = %s, count = %d;\n",
2308                                             attr_err->id->dn,
2309                                             attr_err->count));
2310                                 attr_err_li = &attr_err->first;
2311                                 for (; attr_err_li; attr_err_li = attr_err_li->next) {
2312                                         struct drsuapi_DsAddEntry_AttrErr_V1 *err = &attr_err_li->err_data;
2313                                         DEBUGADD(0,(" Error: err = %s, problem = 0x%08X, attid = 0x%08X;\n",
2314                                                     win_errstr(err->extended_err),
2315                                                     err->problem,
2316                                                     err->attid));
2317                                         /* TODO: should we print attribute value here? */
2318                                 }
2319                                 break;
2320                         case DRSUAPI_DIRERR_NAME:
2321                                 /* Dump Name resolution error */
2322                                 name_err = &err_data->v1.info->name_err;
2323                                 DEBUGADD(0,(" Name Error: err = %s, problem = 0x%08X, id_matched = %s;\n",
2324                                             win_errstr(name_err->extended_err),
2325                                             name_err->problem,
2326                                             name_err->id_matched->dn));
2327                                 break;
2328                         case DRSUAPI_DIRERR_REFERRAL:
2329                                 /* Dump Referral errors */
2330                                 ref_err = &err_data->v1.info->referral_err;
2331                                 DEBUGADD(0,(" Referral Error: extended_err = %s\n",
2332                                             win_errstr(ref_err->extended_err)));
2333                                 ref_li = &ref_err->refer;
2334                                 for (; ref_li; ref_li = ref_li->next) {
2335                                         struct drsuapi_DsaAddressListItem_V1 *addr;
2336                                         DEBUGADD(0,(" Referral: id_target = %s, ref_type = 0x%04X,",
2337                                                     ref_li->id_target->dn,
2338                                                     ref_li->ref_type));
2339                                         if (ref_li->is_choice_set) {
2340                                                 DEBUGADD(0,(" choice = 0x%02X, ",
2341                                                             ref_li->choice));
2342                                         }
2343                                         DEBUGADD(0,(" add_list ("));
2344                                         for (addr = ref_li->addr_list; addr; addr = addr->next) {
2345                                                 DEBUGADD(0,("%s", addr->address->string));
2346                                                 if (addr->next) {
2347                                                         DEBUGADD(0,(", "));
2348                                                 }
2349                                         }
2350                                         DEBUGADD(0,(");\n"));
2351                                 }
2352                                 break;
2353                         case DRSUAPI_DIRERR_SECURITY:
2354                                 /* Dump Security error. */
2355                                 DEBUGADD(0,(" Security Error: extended_err = %s, problem = 0x%08X\n",
2356                                             win_errstr(err_data->v1.info->security_err.extended_err),
2357                                             err_data->v1.info->security_err.problem));
2358                                 break;
2359                         case DRSUAPI_DIRERR_SERVICE:
2360                                 /* Dump Service error. */
2361                                 DEBUGADD(0,(" Service Error: extended_err = %s, problem = 0x%08X\n",
2362                                             win_errstr(err_data->v1.info->service_err.extended_err),
2363                                             err_data->v1.info->service_err.problem));
2364                                 break;
2365                         case DRSUAPI_DIRERR_UPDATE:
2366                                 /* Dump Update error. */
2367                                 DEBUGADD(0,(" Update Error: extended_err = %s, problem = 0x%08X\n",
2368                                             win_errstr(err_data->v1.info->update_err.extended_err),
2369                                             err_data->v1.info->update_err.problem));
2370                                 break;
2371                         case DRSUAPI_DIRERR_SYSTEM:
2372                                 /* System error. */
2373                                 DEBUGADD(0,(" System Error: extended_err = %s, problem = 0x%08X\n",
2374                                             win_errstr(err_data->v1.info->system_err.extended_err),
2375                                             err_data->v1.info->system_err.problem));
2376                                 break;
2377                         case DRSUAPI_DIRERR_OK: /* mute compiler warnings */
2378                         default:
2379                                 DEBUGADD(0,(" Unknown DIRERR error class returned!\n"));
2380                                 break;
2381                         }
2382
2383                         composite_error(c, werror_to_ntstatus(status));
2384                         return;
2385                 }
2386
2387                 if (1 != r->out.ctr->ctr3.count) {
2388                         DEBUG(0,("DsAddEntry - Ctr3: something very wrong had happened - "
2389                                  "method succeeded but objects returned are %d (expected 1).\n",
2390                                  r->out.ctr->ctr3.count));
2391                         composite_error(c, NT_STATUS_INVALID_NETWORK_RESPONSE);
2392                 }
2393
2394                 s->dest_dsa.ntds_guid   = r->out.ctr->ctr3.objects[0].guid;
2395
2396         } else if (*r->out.level_out == 2) {
2397                 if (DRSUAPI_DIRERR_OK != r->out.ctr->ctr2.dir_err) {
2398                         DEBUG(0,("DsAddEntry failed with: dir_err = %d, extended_err = %s\n",
2399                                  r->out.ctr->ctr2.dir_err,
2400                                  win_errstr(r->out.ctr->ctr2.extended_err)));
2401                         composite_error(c, werror_to_ntstatus(r->out.ctr->ctr2.extended_err));
2402                         return;
2403                 }
2404
2405                 if (1 != r->out.ctr->ctr2.count) {
2406                         DEBUG(0,("DsAddEntry: something very wrong had happened - "
2407                                  "method succeeded but objects returned are %d (expected 1). "
2408                                  "Errors: dir_err = %d, extended_err = %s\n",
2409                                  r->out.ctr->ctr2.count,
2410                                  r->out.ctr->ctr2.dir_err,
2411                                  win_errstr(r->out.ctr->ctr2.extended_err)));
2412                         composite_error(c, NT_STATUS_INVALID_NETWORK_RESPONSE);
2413                 }
2414
2415                 s->dest_dsa.ntds_guid   = r->out.ctr->ctr2.objects[0].guid;
2416         } else {
2417                 composite_error(c, NT_STATUS_INVALID_NETWORK_RESPONSE);
2418                 return;
2419         }
2420
2421         talloc_free(r);
2422
2423         s->dest_dsa.ntds_dn_str = talloc_asprintf(s, "CN=NTDS Settings,%s",
2424                                                   s->dest_dsa.server_dn_str);
2425         if (composite_nomem(s->dest_dsa.ntds_dn_str, c)) return;
2426
2427         c->status = becomeDC_prepare_db(s);
2428         if (!composite_is_ok(c)) return;
2429
2430         /* this avoids the epmapper lookup on the 2nd connection */
2431         binding_str = dcerpc_binding_string(s, s->drsuapi1.binding);
2432         if (composite_nomem(binding_str, c)) return;
2433
2434         c->status = dcerpc_parse_binding(s, binding_str, &s->drsuapi2.binding);
2435         talloc_free(binding_str);
2436         if (!composite_is_ok(c)) return;
2437
2438         /* w2k3 uses the same assoc_group_id as on the first connection, so we do */
2439         s->drsuapi2.binding->assoc_group_id     = s->drsuapi1.pipe->assoc_group_id;
2440
2441         becomeDC_drsuapi_connect_send(s, &s->drsuapi2, becomeDC_drsuapi2_connect_recv);
2442 }
2443
2444 static NTSTATUS becomeDC_prepare_db(struct libnet_BecomeDC_state *s)
2445 {
2446         if (!s->callbacks.prepare_db) return NT_STATUS_OK;
2447
2448         s->_pp.domain           = &s->domain;
2449         s->_pp.forest           = &s->forest;
2450         s->_pp.source_dsa       = &s->source_dsa;
2451         s->_pp.dest_dsa         = &s->dest_dsa;
2452
2453         return s->callbacks.prepare_db(s->callbacks.private_data, &s->_pp);
2454 }
2455
2456 static void becomeDC_drsuapi2_bind_recv(struct tevent_req *subreq);
2457
2458 static void becomeDC_drsuapi2_connect_recv(struct composite_context *req)
2459 {
2460         struct libnet_BecomeDC_state *s = talloc_get_type(req->async.private_data,
2461                                           struct libnet_BecomeDC_state);
2462         struct composite_context *c = s->creq;
2463
2464         c->status = dcerpc_pipe_connect_b_recv(req, s, &s->drsuapi2.pipe);
2465         if (!composite_is_ok(c)) return;
2466
2467         s->drsuapi2.drsuapi_handle = s->drsuapi2.pipe->binding_handle;
2468
2469         c->status = gensec_session_key(s->drsuapi2.pipe->conn->security_state.generic_state,
2470                                        &s->drsuapi2.gensec_skey);
2471         if (!composite_is_ok(c)) return;
2472
2473         becomeDC_drsuapi_bind_send(s, &s->drsuapi2, becomeDC_drsuapi2_bind_recv);
2474 }
2475
2476 static void becomeDC_drsuapi3_connect_recv(struct composite_context *req);
2477
2478 static void becomeDC_drsuapi2_bind_recv(struct tevent_req *subreq)
2479 {
2480         struct libnet_BecomeDC_state *s = tevent_req_callback_data(subreq,
2481                                           struct libnet_BecomeDC_state);
2482         struct composite_context *c = s->creq;
2483         char *binding_str;
2484         WERROR status;
2485
2486         c->status = dcerpc_drsuapi_DsBind_r_recv(subreq, s);
2487         TALLOC_FREE(subreq);
2488         if (!composite_is_ok(c)) return;
2489
2490         status = becomeDC_drsuapi_bind_recv(s, &s->drsuapi2);
2491         if (!W_ERROR_IS_OK(status)) {
2492                 composite_error(c, werror_to_ntstatus(status));
2493                 return;
2494         }
2495
2496         /* this avoids the epmapper lookup on the 3rd connection */
2497         binding_str = dcerpc_binding_string(s, s->drsuapi1.binding);
2498         if (composite_nomem(binding_str, c)) return;
2499
2500         c->status = dcerpc_parse_binding(s, binding_str, &s->drsuapi3.binding);
2501         talloc_free(binding_str);
2502         if (!composite_is_ok(c)) return;
2503
2504         /* w2k3 uses the same assoc_group_id as on the first connection, so we do */
2505         s->drsuapi3.binding->assoc_group_id     = s->drsuapi1.pipe->assoc_group_id;
2506         /* w2k3 uses the concurrent multiplex feature on the 3rd connection, so we do */
2507         s->drsuapi3.binding->flags              |= DCERPC_CONCURRENT_MULTIPLEX;
2508
2509         becomeDC_drsuapi_connect_send(s, &s->drsuapi3, becomeDC_drsuapi3_connect_recv);
2510 }
2511
2512 static void becomeDC_drsuapi3_pull_schema_send(struct libnet_BecomeDC_state *s);
2513
2514 static void becomeDC_drsuapi3_connect_recv(struct composite_context *req)
2515 {
2516         struct libnet_BecomeDC_state *s = talloc_get_type(req->async.private_data,
2517                                           struct libnet_BecomeDC_state);
2518         struct composite_context *c = s->creq;
2519
2520         c->status = dcerpc_pipe_connect_b_recv(req, s, &s->drsuapi3.pipe);
2521         if (!composite_is_ok(c)) return;
2522
2523         s->drsuapi3.drsuapi_handle = s->drsuapi3.pipe->binding_handle;
2524
2525         c->status = gensec_session_key(s->drsuapi3.pipe->conn->security_state.generic_state,
2526                                        &s->drsuapi3.gensec_skey);
2527         if (!composite_is_ok(c)) return;
2528
2529         becomeDC_drsuapi3_pull_schema_send(s);
2530 }
2531
2532 static void becomeDC_drsuapi_pull_partition_send(struct libnet_BecomeDC_state *s,
2533                                                  struct becomeDC_drsuapi *drsuapi_h,
2534                                                  struct becomeDC_drsuapi *drsuapi_p,
2535                                                  struct libnet_BecomeDC_Partition *partition,
2536                                                  void (*recv_fn)(struct tevent_req *subreq))
2537 {
2538         struct composite_context *c = s->creq;
2539         struct drsuapi_DsGetNCChanges *r;
2540         struct tevent_req *subreq;
2541
2542         r = talloc(s, struct drsuapi_DsGetNCChanges);
2543         if (composite_nomem(r, c)) return;
2544
2545         r->out.level_out = talloc(r, uint32_t);
2546         if (composite_nomem(r->out.level_out, c)) return;
2547         r->in.req = talloc(r, union drsuapi_DsGetNCChangesRequest);
2548         if (composite_nomem(r->in.req, c)) return;
2549         r->out.ctr = talloc(r, union drsuapi_DsGetNCChangesCtr);
2550         if (composite_nomem(r->out.ctr, c)) return;
2551
2552         r->in.bind_handle       = &drsuapi_h->bind_handle;
2553         if (drsuapi_h->remote_info28.supported_extensions & DRSUAPI_SUPPORTED_EXTENSION_GETCHGREQ_V8) {
2554                 r->in.level                             = 8;
2555                 r->in.req->req8.destination_dsa_guid    = partition->destination_dsa_guid;
2556                 r->in.req->req8.source_dsa_invocation_id= partition->source_dsa_invocation_id;
2557                 r->in.req->req8.naming_context          = &partition->nc;
2558                 r->in.req->req8.highwatermark           = partition->highwatermark;
2559                 r->in.req->req8.uptodateness_vector     = NULL;
2560                 r->in.req->req8.replica_flags           = partition->replica_flags;
2561                 r->in.req->req8.max_object_count        = 133;
2562                 r->in.req->req8.max_ndr_size            = 1336811;
2563                 r->in.req->req8.extended_op             = DRSUAPI_EXOP_NONE;
2564                 r->in.req->req8.fsmo_info               = 0;
2565                 r->in.req->req8.partial_attribute_set   = NULL;
2566                 r->in.req->req8.partial_attribute_set_ex= NULL;
2567                 r->in.req->req8.mapping_ctr.num_mappings= 0;
2568                 r->in.req->req8.mapping_ctr.mappings    = NULL;
2569         } else {
2570                 r->in.level                             = 5;
2571                 r->in.req->req5.destination_dsa_guid    = partition->destination_dsa_guid;
2572                 r->in.req->req5.source_dsa_invocation_id= partition->source_dsa_invocation_id;
2573                 r->in.req->req5.naming_context          = &partition->nc;
2574                 r->in.req->req5.highwatermark           = partition->highwatermark;
2575                 r->in.req->req5.uptodateness_vector     = NULL;
2576                 r->in.req->req5.replica_flags           = partition->replica_flags;
2577                 r->in.req->req5.max_object_count        = 133;
2578                 r->in.req->req5.max_ndr_size            = 1336770;
2579                 r->in.req->req5.extended_op             = DRSUAPI_EXOP_NONE;
2580                 r->in.req->req5.fsmo_info               = 0;
2581         }
2582
2583         /* 
2584          * we should try to use the drsuapi_p->pipe here, as w2k3 does
2585          * but it seems that some extra flags in the DCERPC Bind call
2586          * are needed for it. Or the same KRB5 TGS is needed on both
2587          * connections.
2588          */
2589         s->ndr_struct_ptr = r;
2590         subreq = dcerpc_drsuapi_DsGetNCChanges_r_send(s, c->event_ctx,
2591                                                       drsuapi_p->drsuapi_handle,
2592                                                       r);
2593         if (composite_nomem(subreq, c)) return;
2594         tevent_req_set_callback(subreq, recv_fn, s);
2595 }
2596
2597 static WERROR becomeDC_drsuapi_pull_partition_recv(struct libnet_BecomeDC_state *s,
2598                                                    struct becomeDC_drsuapi *drsuapi_h,
2599                                                    struct becomeDC_drsuapi *drsuapi_p,
2600                                                    struct libnet_BecomeDC_Partition *partition,
2601                                                    struct drsuapi_DsGetNCChanges *r)
2602 {
2603         uint32_t ctr_level = 0;
2604         struct drsuapi_DsGetNCChangesCtr1 *ctr1 = NULL;
2605         struct drsuapi_DsGetNCChangesCtr6 *ctr6 = NULL;
2606         struct GUID *source_dsa_guid = NULL;
2607         struct GUID *source_dsa_invocation_id = NULL;
2608         struct drsuapi_DsReplicaHighWaterMark *new_highwatermark = NULL;
2609         bool more_data = false;
2610         NTSTATUS nt_status;
2611
2612         if (!W_ERROR_IS_OK(r->out.result)) {
2613                 return r->out.result;
2614         }
2615
2616         if (*r->out.level_out == 1) {
2617                 ctr_level = 1;
2618                 ctr1 = &r->out.ctr->ctr1;
2619         } else if (*r->out.level_out == 2 &&
2620                    r->out.ctr->ctr2.mszip1.ts) {
2621                 ctr_level = 1;
2622                 ctr1 = &r->out.ctr->ctr2.mszip1.ts->ctr1;
2623         } else if (*r->out.level_out == 6) {
2624                 ctr_level = 6;
2625                 ctr6 = &r->out.ctr->ctr6;
2626         } else if (*r->out.level_out == 7 &&
2627                    r->out.ctr->ctr7.level == 6 &&
2628                    r->out.ctr->ctr7.type == DRSUAPI_COMPRESSION_TYPE_MSZIP &&
2629                    r->out.ctr->ctr7.ctr.mszip6.ts) {
2630                 ctr_level = 6;
2631                 ctr6 = &r->out.ctr->ctr7.ctr.mszip6.ts->ctr6;
2632         } else if (*r->out.level_out == 7 &&
2633                    r->out.ctr->ctr7.level == 6 &&
2634                    r->out.ctr->ctr7.type == DRSUAPI_COMPRESSION_TYPE_XPRESS &&
2635                    r->out.ctr->ctr7.ctr.xpress6.ts) {
2636                 ctr_level = 6;
2637                 ctr6 = &r->out.ctr->ctr7.ctr.xpress6.ts->ctr6;
2638         } else {
2639                 return WERR_BAD_NET_RESP;
2640         }
2641
2642         if (!ctr1 && ! ctr6) {
2643                 return WERR_BAD_NET_RESP;
2644         }
2645
2646         if (ctr_level == 6) {
2647                 if (!W_ERROR_IS_OK(ctr6->drs_error)) {
2648                         return ctr6->drs_error;
2649                 }
2650         }
2651
2652         switch (ctr_level) {
2653         case 1:
2654                 source_dsa_guid                 = &ctr1->source_dsa_guid;
2655                 source_dsa_invocation_id        = &ctr1->source_dsa_invocation_id;
2656                 new_highwatermark               = &ctr1->new_highwatermark;
2657                 more_data                       = ctr1->more_data;
2658                 break;
2659         case 6:
2660                 source_dsa_guid                 = &ctr6->source_dsa_guid;
2661                 source_dsa_invocation_id        = &ctr6->source_dsa_invocation_id;
2662                 new_highwatermark               = &ctr6->new_highwatermark;
2663                 more_data                       = ctr6->more_data;
2664                 break;
2665         }
2666
2667         partition->highwatermark                = *new_highwatermark;
2668         partition->source_dsa_guid              = *source_dsa_guid;
2669         partition->source_dsa_invocation_id     = *source_dsa_invocation_id;
2670         partition->more_data                    = more_data;
2671
2672         if (!partition->store_chunk) return WERR_OK;
2673
2674         s->_sc.domain           = &s->domain;
2675         s->_sc.forest           = &s->forest;
2676         s->_sc.source_dsa       = &s->source_dsa;
2677         s->_sc.dest_dsa         = &s->dest_dsa;
2678         s->_sc.partition        = partition;
2679         s->_sc.ctr_level        = ctr_level;
2680         s->_sc.ctr1             = ctr1;
2681         s->_sc.ctr6             = ctr6;
2682         /* 
2683          * we need to use the drsuapi_p->gensec_skey here,
2684          * when we use drsuapi_p->pipe in the for this request
2685          */
2686         s->_sc.gensec_skey      = &drsuapi_p->gensec_skey;
2687
2688         nt_status = partition->store_chunk(s->callbacks.private_data, &s->_sc);
2689         if (!NT_STATUS_IS_OK(nt_status)) {
2690                 return ntstatus_to_werror(nt_status);
2691         }
2692
2693         return WERR_OK;
2694 }
2695
2696 static void becomeDC_drsuapi3_pull_schema_recv(struct tevent_req *subreq);
2697
2698 static void becomeDC_drsuapi3_pull_schema_send(struct libnet_BecomeDC_state *s)
2699 {
2700         s->schema_part.nc.guid  = GUID_zero();
2701         s->schema_part.nc.sid   = s->zero_sid;
2702         s->schema_part.nc.dn    = s->forest.schema_dn_str;
2703
2704         s->schema_part.destination_dsa_guid     = s->drsuapi2.bind_guid;
2705
2706         s->schema_part.replica_flags    = DRSUAPI_DRS_WRIT_REP
2707                                         | DRSUAPI_DRS_INIT_SYNC
2708                                         | DRSUAPI_DRS_PER_SYNC
2709                                         | DRSUAPI_DRS_FULL_SYNC_IN_PROGRESS
2710                                         | DRSUAPI_DRS_NEVER_SYNCED
2711                                         | DRSUAPI_DRS_USE_COMPRESSION;
2712         if (s->rodc_join) {
2713             s->schema_part.replica_flags &= ~DRSUAPI_DRS_WRIT_REP;
2714         }
2715
2716         s->schema_part.store_chunk      = s->callbacks.schema_chunk;
2717
2718         becomeDC_drsuapi_pull_partition_send(s, &s->drsuapi2, &s->drsuapi3, &s->schema_part,
2719                                              becomeDC_drsuapi3_pull_schema_recv);
2720 }
2721
2722 static void becomeDC_drsuapi3_pull_config_send(struct libnet_BecomeDC_state *s);
2723
2724 static void becomeDC_drsuapi3_pull_schema_recv(struct tevent_req *subreq)
2725 {
2726         struct libnet_BecomeDC_state *s = tevent_req_callback_data(subreq,
2727                                           struct libnet_BecomeDC_state);
2728         struct composite_context *c = s->creq;
2729         struct drsuapi_DsGetNCChanges *r = talloc_get_type_abort(s->ndr_struct_ptr,
2730                                            struct drsuapi_DsGetNCChanges);
2731         WERROR status;
2732
2733         s->ndr_struct_ptr = NULL;
2734
2735         c->status = dcerpc_drsuapi_DsGetNCChanges_r_recv(subreq, r);
2736         TALLOC_FREE(subreq);
2737         if (!composite_is_ok(c)) return;
2738
2739         status = becomeDC_drsuapi_pull_partition_recv(s, &s->drsuapi2, &s->drsuapi3, &s->schema_part, r);
2740         if (!W_ERROR_IS_OK(status)) {
2741                 composite_error(c, werror_to_ntstatus(status));
2742                 return;
2743         }
2744
2745         talloc_free(r);
2746
2747         if (s->schema_part.more_data) {
2748                 becomeDC_drsuapi_pull_partition_send(s, &s->drsuapi2, &s->drsuapi3, &s->schema_part,
2749                                                      becomeDC_drsuapi3_pull_schema_recv);
2750                 return;
2751         }
2752
2753         becomeDC_drsuapi3_pull_config_send(s);
2754 }
2755
2756 static void becomeDC_drsuapi3_pull_config_recv(struct tevent_req *subreq);
2757
2758 static void becomeDC_drsuapi3_pull_config_send(struct libnet_BecomeDC_state *s)
2759 {
2760         s->config_part.nc.guid  = GUID_zero();
2761         s->config_part.nc.sid   = s->zero_sid;
2762         s->config_part.nc.dn    = s->forest.config_dn_str;
2763
2764         s->config_part.destination_dsa_guid     = s->drsuapi2.bind_guid;
2765
2766         s->config_part.replica_flags    = DRSUAPI_DRS_WRIT_REP
2767                                         | DRSUAPI_DRS_INIT_SYNC
2768                                         | DRSUAPI_DRS_PER_SYNC
2769                                         | DRSUAPI_DRS_FULL_SYNC_IN_PROGRESS
2770                                         | DRSUAPI_DRS_NEVER_SYNCED
2771                                         | DRSUAPI_DRS_USE_COMPRESSION;
2772         if (s->rodc_join) {
2773             s->schema_part.replica_flags &= ~DRSUAPI_DRS_WRIT_REP;
2774         }
2775
2776         s->config_part.store_chunk      = s->callbacks.config_chunk;
2777
2778         becomeDC_drsuapi_pull_partition_send(s, &s->drsuapi2, &s->drsuapi3, &s->config_part,
2779                                              becomeDC_drsuapi3_pull_config_recv);
2780 }
2781
2782 static void becomeDC_drsuapi3_pull_config_recv(struct tevent_req *subreq)
2783 {
2784         struct libnet_BecomeDC_state *s = tevent_req_callback_data(subreq,
2785                                           struct libnet_BecomeDC_state);
2786         struct composite_context *c = s->creq;
2787         struct drsuapi_DsGetNCChanges *r = talloc_get_type_abort(s->ndr_struct_ptr,
2788                                            struct drsuapi_DsGetNCChanges);
2789         WERROR status;
2790
2791         s->ndr_struct_ptr = NULL;
2792
2793         c->status = dcerpc_drsuapi_DsGetNCChanges_r_recv(subreq, r);
2794         TALLOC_FREE(subreq);
2795         if (!composite_is_ok(c)) return;
2796
2797         status = becomeDC_drsuapi_pull_partition_recv(s, &s->drsuapi2, &s->drsuapi3, &s->config_part, r);
2798         if (!W_ERROR_IS_OK(status)) {
2799                 composite_error(c, werror_to_ntstatus(status));
2800                 return;
2801         }
2802
2803         talloc_free(r);
2804
2805         if (s->config_part.more_data) {
2806                 becomeDC_drsuapi_pull_partition_send(s, &s->drsuapi2, &s->drsuapi3, &s->config_part,
2807                                                      becomeDC_drsuapi3_pull_config_recv);
2808                 return;
2809         }
2810
2811         becomeDC_connect_ldap2(s);
2812 }
2813
2814 static void becomeDC_drsuapi3_pull_domain_recv(struct tevent_req *subreq);
2815
2816 static void becomeDC_drsuapi3_pull_domain_send(struct libnet_BecomeDC_state *s)
2817 {
2818         s->domain_part.nc.guid  = GUID_zero();
2819         s->domain_part.nc.sid   = s->zero_sid;
2820         s->domain_part.nc.dn    = s->domain.dn_str;
2821
2822         s->domain_part.destination_dsa_guid     = s->drsuapi2.bind_guid;
2823
2824         s->domain_part.replica_flags    = DRSUAPI_DRS_WRIT_REP
2825                                         | DRSUAPI_DRS_INIT_SYNC
2826                                         | DRSUAPI_DRS_PER_SYNC
2827                                         | DRSUAPI_DRS_FULL_SYNC_IN_PROGRESS
2828                                         | DRSUAPI_DRS_NEVER_SYNCED
2829                                         | DRSUAPI_DRS_USE_COMPRESSION;
2830         if (s->rodc_join) {
2831             s->schema_part.replica_flags &= ~DRSUAPI_DRS_WRIT_REP;
2832         }
2833
2834         s->domain_part.store_chunk      = s->callbacks.domain_chunk;
2835
2836         becomeDC_drsuapi_pull_partition_send(s, &s->drsuapi2, &s->drsuapi3, &s->domain_part,
2837                                              becomeDC_drsuapi3_pull_domain_recv);
2838 }
2839
2840 static void becomeDC_drsuapi_update_refs_send(struct libnet_BecomeDC_state *s,
2841                                               struct becomeDC_drsuapi *drsuapi,
2842                                               struct libnet_BecomeDC_Partition *partition,
2843                                               void (*recv_fn)(struct tevent_req *subreq));
2844 static void becomeDC_drsuapi2_update_refs_schema_recv(struct tevent_req *subreq);
2845
2846 static void becomeDC_drsuapi3_pull_domain_recv(struct tevent_req *subreq)
2847 {
2848         struct libnet_BecomeDC_state *s = tevent_req_callback_data(subreq,
2849                                           struct libnet_BecomeDC_state);
2850         struct composite_context *c = s->creq;
2851         struct drsuapi_DsGetNCChanges *r = talloc_get_type_abort(s->ndr_struct_ptr,
2852                                            struct drsuapi_DsGetNCChanges);
2853         WERROR status;
2854
2855         s->ndr_struct_ptr = NULL;
2856
2857         c->status = dcerpc_drsuapi_DsGetNCChanges_r_recv(subreq, r);
2858         TALLOC_FREE(subreq);
2859         if (!composite_is_ok(c)) return;
2860
2861         status = becomeDC_drsuapi_pull_partition_recv(s, &s->drsuapi2, &s->drsuapi3, &s->domain_part, r);
2862         if (!W_ERROR_IS_OK(status)) {
2863                 composite_error(c, werror_to_ntstatus(status));
2864                 return;
2865         }
2866
2867         talloc_free(r);
2868
2869         if (s->domain_part.more_data) {
2870                 becomeDC_drsuapi_pull_partition_send(s, &s->drsuapi2, &s->drsuapi3, &s->domain_part,
2871                                                      becomeDC_drsuapi3_pull_domain_recv);
2872                 return;
2873         }
2874
2875         becomeDC_drsuapi_update_refs_send(s, &s->drsuapi2, &s->schema_part,
2876                                           becomeDC_drsuapi2_update_refs_schema_recv);
2877 }
2878
2879 static void becomeDC_drsuapi_update_refs_send(struct libnet_BecomeDC_state *s,
2880                                               struct becomeDC_drsuapi *drsuapi,
2881                                               struct libnet_BecomeDC_Partition *partition,
2882                                               void (*recv_fn)(struct tevent_req *subreq))
2883 {
2884         struct composite_context *c = s->creq;
2885         struct drsuapi_DsReplicaUpdateRefs *r;
2886         const char *ntds_guid_str;
2887         const char *ntds_dns_name;
2888         struct tevent_req *subreq;
2889
2890         r = talloc(s, struct drsuapi_DsReplicaUpdateRefs);
2891         if (composite_nomem(r, c)) return;
2892
2893         ntds_guid_str = GUID_string(r, &s->dest_dsa.ntds_guid);
2894         if (composite_nomem(ntds_guid_str, c)) return;
2895
2896         ntds_dns_name = talloc_asprintf(r, "%s._msdcs.%s",
2897                                         ntds_guid_str,
2898                                         s->domain.dns_name);
2899         if (composite_nomem(ntds_dns_name, c)) return;
2900
2901         r->in.bind_handle               = &drsuapi->bind_handle;
2902         r->in.level                     = 1;
2903         r->in.req.req1.naming_context   = &partition->nc;
2904         r->in.req.req1.dest_dsa_dns_name= ntds_dns_name;
2905         r->in.req.req1.dest_dsa_guid    = s->dest_dsa.ntds_guid;
2906         r->in.req.req1.options          = DRSUAPI_DRS_ADD_REF | DRSUAPI_DRS_DEL_REF;
2907
2908         /* I think this is how we mark ourselves as a RODC */
2909         if (!lpcfg_parm_bool(s->libnet->lp_ctx, NULL, "repl", "RODC", false)) {
2910                 r->in.req.req1.options |= DRSUAPI_DRS_WRIT_REP;
2911         }
2912
2913         s->ndr_struct_ptr = r;
2914         subreq = dcerpc_drsuapi_DsReplicaUpdateRefs_r_send(s, c->event_ctx,
2915                                                            drsuapi->drsuapi_handle,
2916                                                            r);
2917         if (composite_nomem(subreq, c)) return;
2918         tevent_req_set_callback(subreq, recv_fn, s);
2919 }
2920
2921 static void becomeDC_drsuapi2_update_refs_config_recv(struct tevent_req *subreq);
2922
2923 static void becomeDC_drsuapi2_update_refs_schema_recv(struct tevent_req *subreq)
2924 {
2925         struct libnet_BecomeDC_state *s = tevent_req_callback_data(subreq,
2926                                           struct libnet_BecomeDC_state);
2927         struct composite_context *c = s->creq;
2928         struct drsuapi_DsReplicaUpdateRefs *r = talloc_get_type_abort(s->ndr_struct_ptr,
2929                                            struct drsuapi_DsReplicaUpdateRefs);
2930
2931         s->ndr_struct_ptr = NULL;
2932
2933         c->status = dcerpc_drsuapi_DsReplicaUpdateRefs_r_recv(subreq, r);
2934         TALLOC_FREE(subreq);
2935         if (!composite_is_ok(c)) return;
2936
2937         if (!W_ERROR_IS_OK(r->out.result)) {
2938                 composite_error(c, werror_to_ntstatus(r->out.result));
2939                 return;
2940         }
2941
2942         talloc_free(r);
2943
2944         becomeDC_drsuapi_update_refs_send(s, &s->drsuapi2, &s->config_part,
2945                                           becomeDC_drsuapi2_update_refs_config_recv);
2946 }
2947
2948 static void becomeDC_drsuapi2_update_refs_domain_recv(struct tevent_req *subreq);
2949
2950 static void becomeDC_drsuapi2_update_refs_config_recv(struct tevent_req *subreq)
2951 {
2952         struct libnet_BecomeDC_state *s = tevent_req_callback_data(subreq,
2953                                           struct libnet_BecomeDC_state);
2954         struct composite_context *c = s->creq;
2955         struct drsuapi_DsReplicaUpdateRefs *r = talloc_get_type(s->ndr_struct_ptr,
2956                                            struct drsuapi_DsReplicaUpdateRefs);
2957
2958         s->ndr_struct_ptr = NULL;
2959
2960         c->status = dcerpc_drsuapi_DsReplicaUpdateRefs_r_recv(subreq, r);
2961         TALLOC_FREE(subreq);
2962         if (!composite_is_ok(c)) return;
2963
2964         if (!W_ERROR_IS_OK(r->out.result)) {
2965                 composite_error(c, werror_to_ntstatus(r->out.result));
2966                 return;
2967         }
2968
2969         talloc_free(r);
2970
2971         becomeDC_drsuapi_update_refs_send(s, &s->drsuapi2, &s->domain_part,
2972                                           becomeDC_drsuapi2_update_refs_domain_recv);
2973 }
2974
2975 static void becomeDC_drsuapi2_update_refs_domain_recv(struct tevent_req *subreq)
2976 {
2977         struct libnet_BecomeDC_state *s = tevent_req_callback_data(subreq,
2978                                           struct libnet_BecomeDC_state);
2979         struct composite_context *c = s->creq;
2980         struct drsuapi_DsReplicaUpdateRefs *r = talloc_get_type(s->ndr_struct_ptr,
2981                                            struct drsuapi_DsReplicaUpdateRefs);
2982
2983         s->ndr_struct_ptr = NULL;
2984
2985         c->status = dcerpc_drsuapi_DsReplicaUpdateRefs_r_recv(subreq, r);
2986         TALLOC_FREE(subreq);
2987         if (!composite_is_ok(c)) return;
2988
2989         if (!W_ERROR_IS_OK(r->out.result)) {
2990                 composite_error(c, werror_to_ntstatus(r->out.result));
2991                 return;
2992         }
2993
2994         talloc_free(r);
2995
2996         /* TODO: use DDNS updates and register dns names */
2997         composite_done(c);
2998 }
2999
3000 static NTSTATUS becomeDC_ldap2_modify_computer(struct libnet_BecomeDC_state *s)
3001 {
3002         int ret;
3003         struct ldb_message *msg;
3004         unsigned int i;
3005         uint32_t user_account_control = UF_SERVER_TRUST_ACCOUNT |
3006                                         UF_TRUSTED_FOR_DELEGATION;
3007
3008         /* as the value is already as we want it to be, we're done */
3009         if (s->dest_dsa.user_account_control == user_account_control) {
3010                 return NT_STATUS_OK;
3011         }
3012
3013         /* make a 'modify' msg, and only for serverReference */
3014         msg = ldb_msg_new(s);
3015         NT_STATUS_HAVE_NO_MEMORY(msg);
3016         msg->dn = ldb_dn_new(msg, s->ldap2.ldb, s->dest_dsa.computer_dn_str);
3017         NT_STATUS_HAVE_NO_MEMORY(msg->dn);
3018
3019         ret = samdb_msg_add_uint(s->ldap2.ldb, msg, msg, "userAccountControl",
3020                                  user_account_control);
3021         if (ret != LDB_SUCCESS) {
3022                 talloc_free(msg);
3023                 return NT_STATUS_NO_MEMORY;
3024         }
3025
3026         /* mark all the message elements (should be just one)
3027            as LDB_FLAG_MOD_REPLACE */
3028         for (i=0;i<msg->num_elements;i++) {
3029                 msg->elements[i].flags = LDB_FLAG_MOD_REPLACE;
3030         }
3031
3032         ret = ldb_modify(s->ldap2.ldb, msg);
3033         talloc_free(msg);
3034         if (ret != LDB_SUCCESS) {
3035                 return NT_STATUS_LDAP(ret);
3036         }
3037
3038         s->dest_dsa.user_account_control = user_account_control;
3039
3040         return NT_STATUS_OK;
3041 }
3042
3043 static NTSTATUS becomeDC_ldap2_move_computer(struct libnet_BecomeDC_state *s)
3044 {
3045         int ret;
3046         struct ldb_dn *old_dn;
3047         struct ldb_dn *new_dn;
3048
3049         ret = dsdb_wellknown_dn(s->ldap2.ldb, s,
3050                                 ldb_get_default_basedn(s->ldap2.ldb),
3051                                 DS_GUID_DOMAIN_CONTROLLERS_CONTAINER,
3052                                 &new_dn);
3053         if (ret != LDB_SUCCESS) {
3054                 return NT_STATUS_LDAP(ret);
3055         }
3056
3057         if (!ldb_dn_add_child_fmt(new_dn, "CN=%s", s->dest_dsa.netbios_name)) {
3058                 talloc_free(new_dn);
3059                 return NT_STATUS_NO_MEMORY;
3060         }
3061
3062         old_dn = ldb_dn_new(new_dn, s->ldap2.ldb, s->dest_dsa.computer_dn_str);
3063         NT_STATUS_HAVE_NO_MEMORY(old_dn);
3064
3065         if (ldb_dn_compare(old_dn, new_dn) == 0) {
3066                 /* we don't need to rename if the old and new dn match */
3067                 talloc_free(new_dn);
3068                 return NT_STATUS_OK;
3069         }
3070
3071         ret = ldb_rename(s->ldap2.ldb, old_dn, new_dn);
3072         if (ret != LDB_SUCCESS) {
3073                 talloc_free(new_dn);
3074                 return NT_STATUS_LDAP(ret);
3075         }
3076
3077         s->dest_dsa.computer_dn_str = ldb_dn_alloc_linearized(s, new_dn);
3078         NT_STATUS_HAVE_NO_MEMORY(s->dest_dsa.computer_dn_str);
3079
3080         talloc_free(new_dn);
3081
3082         return NT_STATUS_OK;
3083 }
3084
3085 static void becomeDC_connect_ldap2(struct libnet_BecomeDC_state *s)
3086 {
3087         struct composite_context *c = s->creq;
3088
3089         c->status = becomeDC_ldap_connect(s, &s->ldap2);
3090         if (!composite_is_ok(c)) return;
3091
3092         c->status = becomeDC_ldap2_modify_computer(s);
3093         if (!composite_is_ok(c)) return;
3094
3095         c->status = becomeDC_ldap2_move_computer(s);
3096         if (!composite_is_ok(c)) return;
3097
3098         becomeDC_drsuapi3_pull_domain_send(s);
3099 }
3100
3101 struct composite_context *libnet_BecomeDC_send(struct libnet_context *ctx, TALLOC_CTX *mem_ctx, struct libnet_BecomeDC *r)
3102 {
3103         struct composite_context *c;
3104         struct libnet_BecomeDC_state *s;
3105         char *tmp_name;
3106
3107         c = composite_create(mem_ctx, ctx->event_ctx);
3108         if (c == NULL) return NULL;
3109
3110         s = talloc_zero(c, struct libnet_BecomeDC_state);
3111         if (composite_nomem(s, c)) return c;
3112         c->private_data = s;
3113         s->creq         = c;
3114         s->libnet       = ctx;
3115
3116         /* Domain input */
3117         s->domain.dns_name      = talloc_strdup(s, r->in.domain_dns_name);
3118         if (composite_nomem(s->domain.dns_name, c)) return c;
3119         s->domain.netbios_name  = talloc_strdup(s, r->in.domain_netbios_name);
3120         if (composite_nomem(s->domain.netbios_name, c)) return c;
3121         s->domain.sid           = dom_sid_dup(s, r->in.domain_sid);
3122         if (composite_nomem(s->domain.sid, c)) return c;
3123
3124         /* Source DSA input */
3125         s->source_dsa.address   = talloc_strdup(s, r->in.source_dsa_address);
3126         if (composite_nomem(s->source_dsa.address, c)) return c;
3127
3128         /* Destination DSA input */
3129         s->dest_dsa.netbios_name= talloc_strdup(s, r->in.dest_dsa_netbios_name);
3130         if (composite_nomem(s->dest_dsa.netbios_name, c)) return c;
3131
3132         /* Destination DSA dns_name construction */
3133         tmp_name        = strlower_talloc(s, s->dest_dsa.netbios_name);
3134         if (composite_nomem(tmp_name, c)) return c;
3135         tmp_name        = talloc_asprintf_append_buffer(tmp_name, ".%s",s->domain.dns_name);
3136         if (composite_nomem(tmp_name, c)) return c;
3137         s->dest_dsa.dns_name    = tmp_name;
3138
3139         /* Callback function pointers */
3140         s->callbacks = r->in.callbacks;
3141
3142         /* RODC join*/
3143         s->rodc_join = r->in.rodc_join;
3144
3145         becomeDC_send_cldap(s);
3146         return c;
3147 }
3148
3149 NTSTATUS libnet_BecomeDC_recv(struct composite_context *c, TALLOC_CTX *mem_ctx, struct libnet_BecomeDC *r)
3150 {
3151         NTSTATUS status;
3152
3153         status = composite_wait(c);
3154
3155         ZERO_STRUCT(r->out);
3156
3157         talloc_free(c);
3158         return status;
3159 }
3160
3161 NTSTATUS libnet_BecomeDC(struct&n