source4/dsdb/samdb/ldb_modules/rootdse.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3
   4    rootDSE ldb module
   5
   6    Copyright (C) Andrew Tridgell 2005
   7    Copyright (C) Simo Sorce 2005-2008
   8
   9    This program is free software; you can redistribute it and/or modify
  10    it under the terms of the GNU General Public License as published by
  11    the Free Software Foundation; either version 3 of the License, or
  12    (at your option) any later version.
  13
  14    This program is distributed in the hope that it will be useful,
  15    but WITHOUT ANY WARRANTY; without even the implied warranty of
  16    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  17    GNU General Public License for more details.
  18
  19    You should have received a copy of the GNU General Public License
  20    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  21 */
  22
  23 #include "includes.h"
  24 #include "lib/ldb/include/ldb.h"
  25 #include "lib/ldb/include/ldb_module.h"
  26 #include "system/time.h"
  27 #include "dsdb/samdb/samdb.h"
  28 #include "version.h"
  29 #include "dsdb/samdb/ldb_modules/util.h"
  30 #include "libcli/security/security.h"
  31 #include "librpc/ndr/libndr.h"
  32 #include "auth/auth.h"
  33 #include "param/param.h"
  34 #include "lib/messaging/irpc.h"
  35 #include "librpc/gen_ndr/ndr_irpc_c.h"
  36
  37 struct private_data {
  38         unsigned int num_controls;
  39         char **controls;
  40         unsigned int num_partitions;
  41         struct ldb_dn **partitions;
  42 };
  43
  44 /*
  45   return 1 if a specific attribute has been requested
  46 */
  47 static int do_attribute(const char * const *attrs, const char *name)
  48 {
  49         return attrs == NULL ||
  50                 ldb_attr_in_list(attrs, name) ||
  51                 ldb_attr_in_list(attrs, "*");
  52 }
  53
  54 static int do_attribute_explicit(const char * const *attrs, const char *name)
  55 {
  56         return attrs != NULL && ldb_attr_in_list(attrs, name);
  57 }
  58
  59
  60 /*
  61   expand a DN attribute to include extended DN information if requested
  62  */
  63 static int expand_dn_in_message(struct ldb_module *module, struct ldb_message *msg,
  64                                 const char *attrname, struct ldb_control *edn_control,
  65                                 struct ldb_request *req)
  66 {
  67         struct ldb_dn *dn, *dn2;
  68         struct ldb_val *v;
  69         int ret;
  70         struct ldb_request *req2;
  71         char *dn_string;
  72         const char *no_attrs[] = { NULL };
  73         struct ldb_result *res;
  74         struct ldb_extended_dn_control *edn;
  75         TALLOC_CTX *tmp_ctx = talloc_new(req);
  76         struct ldb_context *ldb;
  77         int edn_type = 0;
  78
  79         ldb = ldb_module_get_ctx(module);
  80
  81         edn = talloc_get_type(edn_control->data, struct ldb_extended_dn_control);
  82         if (edn) {
  83                 edn_type = edn->type;
  84         }
  85
  86         v = discard_const_p(struct ldb_val, ldb_msg_find_ldb_val(msg, attrname));
  87         if (v == NULL) {
  88                 talloc_free(tmp_ctx);
  89                 return LDB_SUCCESS;
  90         }
  91
  92         dn_string = talloc_strndup(tmp_ctx, (const char *)v->data, v->length);
  93         if (dn_string == NULL) {
  94                 talloc_free(tmp_ctx);
  95                 return ldb_operr(ldb);
  96         }
  97
  98         res = talloc_zero(tmp_ctx, struct ldb_result);
  99         if (res == NULL) {
 100                 talloc_free(tmp_ctx);
 101                 return ldb_operr(ldb);
 102         }
 103
 104         dn = ldb_dn_new(tmp_ctx, ldb, dn_string);
 105         if (!ldb_dn_validate(dn)) {
 106                 talloc_free(tmp_ctx);
 107                 return ldb_operr(ldb);
 108         }
 109
 110         ret = ldb_build_search_req(&req2, ldb, tmp_ctx,
 111                                    dn,
 112                                    LDB_SCOPE_BASE,
 113                                    NULL,
 114                                    no_attrs,
 115                                    NULL,
 116                                    res, ldb_search_default_callback,
 117                                    req);
 118         if (ret != LDB_SUCCESS) {
 119                 talloc_free(tmp_ctx);
 120                 return ret;
 121         }
 122
 123
 124         ret = ldb_request_add_control(req2,
 125                                       LDB_CONTROL_EXTENDED_DN_OID,
 126                                       edn_control->critical, edn);
 127         if (ret != LDB_SUCCESS) {
 128                 talloc_free(tmp_ctx);
 129                 return ret;
 130         }
 131
 132         ret = ldb_next_request(module, req2);
 133         if (ret == LDB_SUCCESS) {
 134                 ret = ldb_wait(req2->handle, LDB_WAIT_ALL);
 135         }
 136         if (ret != LDB_SUCCESS) {
 137                 talloc_free(tmp_ctx);
 138                 return ret;
 139         }
 140
 141         if (!res || res->count != 1) {
 142                 talloc_free(tmp_ctx);
 143                 return ldb_operr(ldb);
 144         }
 145
 146         dn2 = res->msgs[0]->dn;
 147
 148         v->data = (uint8_t *)ldb_dn_get_extended_linearized(msg->elements, dn2, edn_type);
 149         v->length = strlen((char *)v->data);
 150
 151         if (v->data == NULL) {
 152                 talloc_free(tmp_ctx);
 153                 return ldb_operr(ldb);
 154         }
 155
 156         talloc_free(tmp_ctx);
 157
 158         return LDB_SUCCESS;
 159 }
 160
 161
 162 /*
 163   add dynamically generated attributes to rootDSE result
 164 */
 165 static int rootdse_add_dynamic(struct ldb_module *module, struct ldb_message *msg,
 166                                const char * const *attrs, struct ldb_request *req)
 167 {
 168         struct ldb_context *ldb;
 169         struct private_data *priv = talloc_get_type(ldb_module_get_private(module), struct private_data);
 170         char **server_sasl;
 171         const struct dsdb_schema *schema;
 172         int *val;
 173         struct ldb_control *edn_control;
 174         const char *dn_attrs[] = {
 175                 "configurationNamingContext",
 176                 "defaultNamingContext",
 177                 "dsServiceName",
 178                 "rootDomainNamingContext",
 179                 "schemaNamingContext",
 180                 "serverName",
 181                 NULL
 182         };
 183
 184         ldb = ldb_module_get_ctx(module);
 185         schema = dsdb_get_schema(ldb, NULL);
 186
 187         msg->dn = ldb_dn_new(msg, ldb, NULL);
 188
 189         /* don't return the distinduishedName, cn and name attributes */
 190         ldb_msg_remove_attr(msg, "distinguishedName");
 191         ldb_msg_remove_attr(msg, "cn");
 192         ldb_msg_remove_attr(msg, "name");
 193
 194         if (do_attribute(attrs, "currentTime")) {
 195                 if (ldb_msg_add_steal_string(msg, "currentTime",
 196                                              ldb_timestring(msg, time(NULL))) != 0) {
 197                         goto failed;
 198                 }
 199         }
 200
 201         if (priv && do_attribute(attrs, "supportedControl")) {
 202                 unsigned int i;
 203                 for (i = 0; i < priv->num_controls; i++) {
 204                         char *control = talloc_strdup(msg, priv->controls[i]);
 205                         if (!control) {
 206                                 goto failed;
 207                         }
 208                         if (ldb_msg_add_steal_string(msg, "supportedControl",
 209                                                      control) != 0) {
 210                                 goto failed;
 211                         }
 212                 }
 213         }
 214
 215         if (priv && do_attribute(attrs, "namingContexts")) {
 216                 unsigned int i;
 217                 for (i = 0; i < priv->num_partitions; i++) {
 218                         struct ldb_dn *dn = priv->partitions[i];
 219                         if (ldb_msg_add_steal_string(msg, "namingContexts",
 220                                                      ldb_dn_alloc_linearized(msg, dn)) != 0) {
 221                                 goto failed;
 222                         }
 223                 }
 224         }
 225
 226         server_sasl = talloc_get_type(ldb_get_opaque(ldb, "supportedSASLMechanisms"),
 227                                        char *);
 228         if (server_sasl && do_attribute(attrs, "supportedSASLMechanisms")) {
 229                 unsigned int i;
 230                 for (i = 0; server_sasl && server_sasl[i]; i++) {
 231                         char *sasl_name = talloc_strdup(msg, server_sasl[i]);
 232                         if (!sasl_name) {
 233                                 goto failed;
 234                         }
 235                         if (ldb_msg_add_steal_string(msg, "supportedSASLMechanisms",
 236                                                      sasl_name) != 0) {
 237                                 goto failed;
 238                         }
 239                 }
 240         }
 241
 242         if (do_attribute(attrs, "highestCommittedUSN")) {
 243                 uint64_t seq_num;
 244                 int ret = ldb_sequence_number(ldb, LDB_SEQ_HIGHEST_SEQ, &seq_num);
 245                 if (ret == LDB_SUCCESS) {
 246                         if (ldb_msg_add_fmt(msg, "highestCommittedUSN",
 247                                             "%llu", (unsigned long long)seq_num) != 0) {
 248                                 goto failed;
 249                         }
 250                 }
 251         }
 252
 253         if (schema && do_attribute_explicit(attrs, "dsSchemaAttrCount")) {
 254                 struct dsdb_attribute *cur;
 255                 unsigned int n = 0;
 256
 257                 for (cur = schema->attributes; cur; cur = cur->next) {
 258                         n++;
 259                 }
 260
 261                 if (ldb_msg_add_fmt(msg, "dsSchemaAttrCount",
 262                                     "%u", n) != 0) {
 263                         goto failed;
 264                 }
 265         }
 266
 267         if (schema && do_attribute_explicit(attrs, "dsSchemaClassCount")) {
 268                 struct dsdb_class *cur;
 269                 unsigned int n = 0;
 270
 271                 for (cur = schema->classes; cur; cur = cur->next) {
 272                         n++;
 273                 }
 274
 275                 if (ldb_msg_add_fmt(msg, "dsSchemaClassCount",
 276                                     "%u", n) != 0) {
 277                         goto failed;
 278                 }
 279         }
 280
 281         if (schema && do_attribute_explicit(attrs, "dsSchemaPrefixCount")) {
 282                 if (ldb_msg_add_fmt(msg, "dsSchemaPrefixCount",
 283                                     "%u", schema->prefixmap->length) != 0) {
 284                         goto failed;
 285                 }
 286         }
 287
 288         if (do_attribute_explicit(attrs, "validFSMOs")) {
 289                 const struct dsdb_naming_fsmo *naming_fsmo;
 290                 const struct dsdb_pdc_fsmo *pdc_fsmo;
 291                 const char *dn_str;
 292
 293                 if (schema && schema->fsmo.we_are_master) {
 294                         dn_str = ldb_dn_get_linearized(ldb_get_schema_basedn(ldb));
 295                         if (dn_str && dn_str[0]) {
 296                                 if (ldb_msg_add_fmt(msg, "validFSMOs", "%s", dn_str) != 0) {
 297                                         goto failed;
 298                                 }
 299                         }
 300                 }
 301
 302                 naming_fsmo = talloc_get_type(ldb_get_opaque(ldb, "dsdb_naming_fsmo"),
 303                                               struct dsdb_naming_fsmo);
 304                 if (naming_fsmo && naming_fsmo->we_are_master) {
 305                         dn_str = ldb_dn_get_linearized(samdb_partitions_dn(ldb, msg));
 306                         if (dn_str && dn_str[0]) {
 307                                 if (ldb_msg_add_fmt(msg, "validFSMOs", "%s", dn_str) != 0) {
 308                                         goto failed;
 309                                 }
 310                         }
 311                 }
 312
 313                 pdc_fsmo = talloc_get_type(ldb_get_opaque(ldb, "dsdb_pdc_fsmo"),
 314                                            struct dsdb_pdc_fsmo);
 315                 if (pdc_fsmo && pdc_fsmo->we_are_master) {
 316                         dn_str = ldb_dn_get_linearized(ldb_get_default_basedn(ldb));
 317                         if (dn_str && dn_str[0]) {
 318                                 if (ldb_msg_add_fmt(msg, "validFSMOs", "%s", dn_str) != 0) {
 319                                         goto failed;
 320                                 }
 321                         }
 322                 }
 323         }
 324
 325         if (do_attribute_explicit(attrs, "vendorVersion")) {
 326                 if (ldb_msg_add_fmt(msg, "vendorVersion",
 327                                     "%s", SAMBA_VERSION_STRING) != 0) {
 328                         goto failed;
 329                 }
 330         }
 331
 332         if (priv && do_attribute(attrs, "domainFunctionality")) {
 333                 if (ldb_msg_add_fmt(msg, "domainFunctionality",
 334                                     "%d", dsdb_functional_level(ldb)) != 0) {
 335                         goto failed;
 336                 }
 337         }
 338
 339         if (priv && do_attribute(attrs, "forestFunctionality")
 340             && (val = talloc_get_type(ldb_get_opaque(ldb, "forestFunctionality"), int))) {
 341                 if (ldb_msg_add_fmt(msg, "forestFunctionality",
 342                                     "%d", *val) != 0) {
 343                         goto failed;
 344                 }
 345         }
 346
 347         if (priv && do_attribute(attrs, "domainControllerFunctionality")
 348             && (val = talloc_get_type(ldb_get_opaque(ldb, "domainControllerFunctionality"), int))) {
 349                 if (ldb_msg_add_fmt(msg, "domainControllerFunctionality",
 350                                     "%d", *val) != 0) {
 351                         goto failed;
 352                 }
 353         }
 354
 355         edn_control = ldb_request_get_control(req, LDB_CONTROL_EXTENDED_DN_OID);
 356
 357         /* if the client sent us the EXTENDED_DN control then we need
 358            to expand the DNs to have GUID and SID. W2K8 join relies on
 359            this */
 360         if (edn_control) {
 361                 unsigned int i;
 362                 int ret;
 363                 for (i=0; dn_attrs[i]; i++) {
 364                         if (!do_attribute(attrs, dn_attrs[i])) continue;
 365                         ret = expand_dn_in_message(module, msg, dn_attrs[i],
 366                                                    edn_control, req);
 367                         if (ret != LDB_SUCCESS) {
 368                                 DEBUG(0,(__location__ ": Failed to expand DN in rootDSE for %s\n",
 369                                          dn_attrs[i]));
 370                                 goto failed;
 371                         }
 372                 }
 373         }
 374
 375         if (do_attribute(attrs, "isGlobalCatalogReady")) {
 376                 /* MS-ADTS 3.1.1.3.2.10
 377                    Note, we should only return true here is we have
 378                    completed at least one synchronisation. As both
 379                    provision and vampire do a full sync, this means we
 380                    can return true is the gc bit is set in the NTDSDSA
 381                    options */
 382                 if (ldb_msg_add_fmt(msg, "isGlobalCatalogReady",
 383                                     "%s", samdb_is_gc(ldb)?"TRUE":"FALSE") != 0) {
 384                         goto failed;
 385                 }
 386         }
 387
 388         if (do_attribute_explicit(attrs, "tokenGroups")) {
 389                 unsigned int i;
 390                 /* Obtain the user's session_info */
 391                 struct auth_session_info *session_info
 392                         = (struct auth_session_info *)ldb_get_opaque(ldb, "sessionInfo");
 393                 if (session_info && session_info->security_token) {
 394                         /* The list of groups this user is in */
 395                         for (i = 0; i < session_info->security_token->num_sids; i++) {
 396                                 if (samdb_msg_add_dom_sid(ldb, msg, msg,
 397                                                           "tokenGroups",
 398                                                           &session_info->security_token->sids[i]) != 0) {
 399                                         goto failed;
 400                                 }
 401                         }
 402                 }
 403         }
 404
 405         /* TODO: lots more dynamic attributes should be added here */
 406
 407         return LDB_SUCCESS;
 408
 409 failed:
 410         return ldb_operr(ldb);
 411 }
 412
 413 /*
 414   handle search requests
 415 */
 416
 417 struct rootdse_context {
 418         struct ldb_module *module;
 419         struct ldb_request *req;
 420 };
 421
 422 static struct rootdse_context *rootdse_init_context(struct ldb_module *module,
 423                                                     struct ldb_request *req)
 424 {
 425         struct ldb_context *ldb;
 426         struct rootdse_context *ac;
 427
 428         ldb = ldb_module_get_ctx(module);
 429
 430         ac = talloc_zero(req, struct rootdse_context);
 431         if (ac == NULL) {
 432                 ldb_set_errstring(ldb, "Out of Memory");
 433                 return NULL;
 434         }
 435
 436         ac->module = module;
 437         ac->req = req;
 438
 439         return ac;
 440 }
 441
 442 static int rootdse_callback(struct ldb_request *req, struct ldb_reply *ares)
 443 {
 444         struct rootdse_context *ac;
 445         int ret;
 446
 447         ac = talloc_get_type(req->context, struct rootdse_context);
 448
 449         if (!ares) {
 450                 return ldb_module_done(ac->req, NULL, NULL,
 451                                         LDB_ERR_OPERATIONS_ERROR);
 452         }
 453         if (ares->error != LDB_SUCCESS) {
 454                 return ldb_module_done(ac->req, ares->controls,
 455                                         ares->response, ares->error);
 456         }
 457
 458         switch (ares->type) {
 459         case LDB_REPLY_ENTRY:
 460                 /*
 461                  * if the client explicit asks for the 'netlogon' attribute
 462                  * the reply_entry needs to be skipped
 463                  */
 464                 if (ac->req->op.search.attrs &&
 465                     ldb_attr_in_list(ac->req->op.search.attrs, "netlogon")) {
 466                         talloc_free(ares);
 467                         return LDB_SUCCESS;
 468                 }
 469
 470                 /* for each record returned post-process to add any dynamic
 471                    attributes that have been asked for */
 472                 ret = rootdse_add_dynamic(ac->module, ares->message,
 473                                           ac->req->op.search.attrs, ac->req);
 474                 if (ret != LDB_SUCCESS) {
 475                         talloc_free(ares);
 476                         return ldb_module_done(ac->req, NULL, NULL, ret);
 477                 }
 478
 479                 return ldb_module_send_entry(ac->req, ares->message, ares->controls);
 480
 481         case LDB_REPLY_REFERRAL:
 482                 /* should we allow the backend to return referrals in this case
 483                  * ?? */
 484                 break;
 485
 486         case LDB_REPLY_DONE:
 487                 return ldb_module_done(ac->req, ares->controls,
 488                                         ares->response, ares->error);
 489         }
 490
 491         talloc_free(ares);
 492         return LDB_SUCCESS;
 493 }
 494
 495 static int rootdse_search(struct ldb_module *module, struct ldb_request *req)
 496 {
 497         struct ldb_context *ldb;
 498         struct rootdse_context *ac;
 499         struct ldb_request *down_req;
 500         int ret;
 501
 502         ldb = ldb_module_get_ctx(module);
 503
 504         /* see if its for the rootDSE - only a base search on the "" DN qualifies */
 505         if (!(req->op.search.scope == LDB_SCOPE_BASE && ldb_dn_is_null(req->op.search.base))) {
 506                 /* Otherwise, pass down to the rest of the stack */
 507                 return ldb_next_request(module, req);
 508         }
 509
 510         ac = rootdse_init_context(module, req);
 511         if (ac == NULL) {
 512                 return ldb_operr(ldb);
 513         }
 514
 515         /* in our db we store the rootDSE with a DN of @ROOTDSE */
 516         ret = ldb_build_search_req(&down_req, ldb, ac,
 517                                         ldb_dn_new(ac, ldb, "@ROOTDSE"),
 518                                         LDB_SCOPE_BASE,
 519                                         NULL,
 520                                         req->op.search.attrs,
 521                                         NULL,/* for now skip the controls from the client */
 522                                         ac, rootdse_callback,
 523                                         req);
 524         if (ret != LDB_SUCCESS) {
 525                 return ret;
 526         }
 527
 528         return ldb_next_request(module, down_req);
 529 }
 530
 531 static int rootdse_register_control(struct ldb_module *module, struct ldb_request *req)
 532 {
 533         struct private_data *priv = talloc_get_type(ldb_module_get_private(module), struct private_data);
 534         char **list;
 535
 536         list = talloc_realloc(priv, priv->controls, char *, priv->num_controls + 1);
 537         if (!list) {
 538                 return ldb_oom(ldb_module_get_ctx(module));
 539         }
 540
 541         list[priv->num_controls] = talloc_strdup(list, req->op.reg_control.oid);
 542         if (!list[priv->num_controls]) {
 543                 return ldb_oom(ldb_module_get_ctx(module));
 544         }
 545
 546         priv->num_controls += 1;
 547         priv->controls = list;
 548
 549         return ldb_module_done(req, NULL, NULL, LDB_SUCCESS);
 550 }
 551
 552 static int rootdse_register_partition(struct ldb_module *module, struct ldb_request *req)
 553 {
 554         struct private_data *priv = talloc_get_type(ldb_module_get_private(module), struct private_data);
 555         struct ldb_dn **list;
 556
 557         list = talloc_realloc(priv, priv->partitions, struct ldb_dn *, priv->num_partitions + 1);
 558         if (!list) {
 559                 return ldb_oom(ldb_module_get_ctx(module));
 560         }
 561
 562         list[priv->num_partitions] = ldb_dn_copy(list, req->op.reg_partition.dn);
 563         if (!list[priv->num_partitions]) {
 564                 return ldb_operr(ldb_module_get_ctx(module));
 565         }
 566
 567         priv->num_partitions += 1;
 568         priv->partitions = list;
 569
 570         return ldb_module_done(req, NULL, NULL, LDB_SUCCESS);
 571 }
 572
 573
 574 static int rootdse_request(struct ldb_module *module, struct ldb_request *req)
 575 {
 576         switch (req->operation) {
 577
 578         case LDB_REQ_REGISTER_CONTROL:
 579                 return rootdse_register_control(module, req);
 580         case LDB_REQ_REGISTER_PARTITION:
 581                 return rootdse_register_partition(module, req);
 582
 583         default:
 584                 break;
 585         }
 586         return ldb_next_request(module, req);
 587 }
 588
 589 static int rootdse_init(struct ldb_module *module)
 590 {
 591         int ret;
 592         struct ldb_context *ldb;
 593         struct ldb_result *res;
 594         struct private_data *data;
 595         const char *attrs[] = { "msDS-Behavior-Version", NULL };
 596         const char *ds_attrs[] = { "dsServiceName", NULL };
 597         TALLOC_CTX *mem_ctx;
 598
 599         ldb = ldb_module_get_ctx(module);
 600
 601         data = talloc_zero(module, struct private_data);
 602         if (data == NULL) {
 603                 return ldb_oom(ldb);
 604         }
 605
 606         data->num_controls = 0;
 607         data->controls = NULL;
 608         data->num_partitions = 0;
 609         data->partitions = NULL;
 610         ldb_module_set_private(module, data);
 611
 612         ldb_set_default_dns(ldb);
 613
 614         ret = ldb_next_init(module);
 615
 616         if (ret != LDB_SUCCESS) {
 617                 return ret;
 618         }
 619
 620         mem_ctx = talloc_new(data);
 621         if (!mem_ctx) {
 622                 return ldb_oom(ldb);
 623         }
 624
 625         /* Now that the partitions are set up, do a search for:
 626            - domainControllerFunctionality
 627            - domainFunctionality
 628            - forestFunctionality
 629
 630            Then stuff these values into an opaque
 631         */
 632         ret = ldb_search(ldb, mem_ctx, &res,
 633                          ldb_get_default_basedn(ldb),
 634                          LDB_SCOPE_BASE, attrs, NULL);
 635         if (ret == LDB_SUCCESS && res->count == 1) {
 636                 int domain_behaviour_version
 637                         = ldb_msg_find_attr_as_int(res->msgs[0],
 638                                                    "msDS-Behavior-Version", -1);
 639                 if (domain_behaviour_version != -1) {
 640                         int *val = talloc(ldb, int);
 641                         if (!val) {
 642                                 talloc_free(mem_ctx);
 643                                 return ldb_oom(ldb);
 644                         }
 645                         *val = domain_behaviour_version;
 646                         ret = ldb_set_opaque(ldb, "domainFunctionality", val);
 647                         if (ret != LDB_SUCCESS) {
 648                                 talloc_free(mem_ctx);
 649                                 return ret;
 650                         }
 651                 }
 652         }
 653
 654         ret = ldb_search(ldb, mem_ctx, &res,
 655                          samdb_partitions_dn(ldb, mem_ctx),
 656                          LDB_SCOPE_BASE, attrs, NULL);
 657         if (ret == LDB_SUCCESS && res->count == 1) {
 658                 int forest_behaviour_version
 659                         = ldb_msg_find_attr_as_int(res->msgs[0],
 660                                                    "msDS-Behavior-Version", -1);
 661                 if (forest_behaviour_version != -1) {
 662                         int *val = talloc(ldb, int);
 663                         if (!val) {
 664                                 talloc_free(mem_ctx);
 665                                 return ldb_oom(ldb);
 666                         }
 667                         *val = forest_behaviour_version;
 668                         ret = ldb_set_opaque(ldb, "forestFunctionality", val);
 669                         if (ret != LDB_SUCCESS) {
 670                                 talloc_free(mem_ctx);
 671                                 return ret;
 672                         }
 673                 }
 674         }
 675
 676         ret = ldb_search(ldb, mem_ctx, &res,
 677                          ldb_dn_new(mem_ctx, ldb, ""),
 678                          LDB_SCOPE_BASE, ds_attrs, NULL);
 679         if (ret == LDB_SUCCESS && res->count == 1) {
 680                 struct ldb_dn *ds_dn
 681                         = ldb_msg_find_attr_as_dn(ldb, mem_ctx, res->msgs[0],
 682                                                   "dsServiceName");
 683                 if (ds_dn) {
 684                         ret = ldb_search(ldb, mem_ctx, &res, ds_dn,
 685                                          LDB_SCOPE_BASE, attrs, NULL);
 686                         if (ret == LDB_SUCCESS && res->count == 1) {
 687                                 int domain_controller_behaviour_version
 688                                         = ldb_msg_find_attr_as_int(res->msgs[0],
 689                                                                    "msDS-Behavior-Version", -1);
 690                                 if (domain_controller_behaviour_version != -1) {
 691                                         int *val = talloc(ldb, int);
 692                                         if (!val) {
 693                                                 talloc_free(mem_ctx);
 694                                                 return ldb_oom(ldb);
 695                                         }
 696                                         *val = domain_controller_behaviour_version;
 697                                         ret = ldb_set_opaque(ldb,
 698                                                              "domainControllerFunctionality", val);
 699                                         if (ret != LDB_SUCCESS) {
 700                                                 talloc_free(mem_ctx);
 701                                                 return ret;
 702                                         }
 703                                 }
 704                         }
 705                 }
 706         }
 707
 708         talloc_free(mem_ctx);
 709
 710         return LDB_SUCCESS;
 711 }
 712
 713 /*
 714  * This function gets the string SCOPE_DN:OPTIONAL_FEATURE_GUID and parse it
 715  * to a DN and a GUID object
 716  */
 717 static int get_optional_feature_dn_guid(struct ldb_request *req, struct ldb_context *ldb,
 718                                                 TALLOC_CTX *mem_ctx,
 719                                                 struct ldb_dn **op_feature_scope_dn,
 720                                                 struct GUID *op_feature_guid)
 721 {
 722         const struct ldb_message *msg = req->op.mod.message;
 723         const char *ldb_val_str;
 724         char *dn, *guid;
 725         TALLOC_CTX *tmp_ctx = talloc_new(mem_ctx);
 726         NTSTATUS status;
 727
 728         ldb_val_str = ldb_msg_find_attr_as_string(msg, "enableOptionalFeature", NULL);
 729         if (!ldb_val_str) {
 730                 ldb_set_errstring(ldb,
 731                                   "rootdse: unable to find 'enableOptionalFeature'!");
 732                 return LDB_ERR_UNWILLING_TO_PERFORM;
 733         }
 734
 735         guid = strchr(ldb_val_str, ':');
 736         if (!guid) {
 737                 ldb_set_errstring(ldb,
 738                                   "rootdse: unable to find GUID in 'enableOptionalFeature'!");
 739                 return LDB_ERR_UNWILLING_TO_PERFORM;
 740         }
 741         status = GUID_from_string(guid+1, op_feature_guid);
 742         if (!NT_STATUS_IS_OK(status)) {
 743                 ldb_set_errstring(ldb,
 744                                   "rootdse: bad GUID in 'enableOptionalFeature'!");
 745                 return LDB_ERR_UNWILLING_TO_PERFORM;
 746         }
 747
 748         dn = talloc_strndup(tmp_ctx, ldb_val_str, guid-ldb_val_str);
 749         if (!dn) {
 750                 ldb_set_errstring(ldb,
 751                                   "rootdse: bad DN in 'enableOptionalFeature'!");
 752                 return LDB_ERR_UNWILLING_TO_PERFORM;
 753         }
 754
 755         *op_feature_scope_dn = ldb_dn_new(mem_ctx, ldb, dn);
 756
 757         talloc_free(tmp_ctx);
 758         return LDB_SUCCESS;
 759 }
 760
 761 /*
 762  * This function gets the OPTIONAL_FEATURE_GUID and looks for the optional feature
 763  * ldb_message object.
 764  */
 765 static int dsdb_find_optional_feature(struct ldb_module *module, struct ldb_context *ldb,
 766                                 TALLOC_CTX *mem_ctx, struct GUID op_feature_guid, struct ldb_message **msg)
 767 {
 768         struct ldb_result *res;
 769         TALLOC_CTX *tmp_ctx = talloc_new(mem_ctx);
 770         int ret;
 771
 772         ret = dsdb_module_search(module, tmp_ctx, &res, NULL, LDB_SCOPE_SUBTREE,
 773                                 NULL,
 774                                 DSDB_FLAG_NEXT_MODULE |
 775                                 DSDB_SEARCH_SEARCH_ALL_PARTITIONS,
 776                                  "(&(objectClass=msDS-OptionalFeature)"
 777                                  "(msDS-OptionalFeatureGUID=%s))",GUID_string(tmp_ctx, &op_feature_guid));
 778
 779         if (ret != LDB_SUCCESS) {
 780                 talloc_free(tmp_ctx);
 781                 return ret;
 782         }
 783         if (res->count == 0) {
 784                 talloc_free(tmp_ctx);
 785                 return LDB_ERR_NO_SUCH_OBJECT;
 786         }
 787         if (res->count != 1) {
 788                 ldb_asprintf_errstring(ldb,
 789                                        "More than one object found matching optional feature GUID %s\n",
 790                                        GUID_string(tmp_ctx, &op_feature_guid));
 791                 talloc_free(tmp_ctx);
 792                 return LDB_ERR_OPERATIONS_ERROR;
 793         }
 794
 795         *msg = talloc_steal(mem_ctx, res->msgs[0]);
 796
 797         talloc_free(tmp_ctx);
 798         return LDB_SUCCESS;
 799 }
 800
 801 static int rootdse_enable_recycle_bin(struct ldb_module *module,struct ldb_context *ldb,
 802                         TALLOC_CTX *mem_ctx, struct ldb_dn *op_feature_scope_dn,
 803                         struct ldb_message *op_feature_msg)
 804 {
 805         int ret;
 806         const int domain_func_level = dsdb_functional_level(ldb);
 807         struct ldb_dn *ntds_settings_dn;
 808         TALLOC_CTX *tmp_ctx;
 809         unsigned int el_count = 0;
 810         struct ldb_message *msg;
 811
 812         ret = ldb_msg_find_attr_as_int(op_feature_msg, "msDS-RequiredForestBehaviorVersion", 0);
 813         if (domain_func_level < ret){
 814                 ldb_asprintf_errstring(ldb,
 815                                        "rootdse_enable_recycle_bin: Domain functional level must be at least %d\n",
 816                                        ret);
 817                 return LDB_ERR_UNWILLING_TO_PERFORM;
 818         }
 819
 820         tmp_ctx = talloc_new(mem_ctx);
 821         ntds_settings_dn = samdb_ntds_settings_dn(ldb);
 822         if (!ntds_settings_dn) {
 823                 DEBUG(0, (__location__ ": Failed to find NTDS settings DN\n"));
 824                 ret = LDB_ERR_OPERATIONS_ERROR;
 825                 talloc_free(tmp_ctx);
 826                 return ret;
 827         }
 828
 829         ntds_settings_dn = ldb_dn_copy(tmp_ctx, ntds_settings_dn);
 830         if (!ntds_settings_dn) {
 831                 DEBUG(0, (__location__ ": Failed to copy NTDS settings DN\n"));
 832                 ret = LDB_ERR_OPERATIONS_ERROR;
 833                 talloc_free(tmp_ctx);
 834                 return ret;
 835         }
 836
 837         msg = ldb_msg_new(tmp_ctx);
 838         msg->dn = ntds_settings_dn;
 839
 840         ldb_msg_add_linearized_dn(msg, "msDS-EnabledFeature", op_feature_msg->dn);
 841         msg->elements[el_count++].flags = LDB_FLAG_MOD_ADD;
 842
 843         ret = dsdb_module_modify(module, msg, DSDB_FLAG_NEXT_MODULE);
 844         if (ret != LDB_SUCCESS) {
 845                 ldb_asprintf_errstring(ldb,
 846                                        "rootdse_enable_recycle_bin: Failed to modify object %s - %s",
 847                                        ldb_dn_get_linearized(ntds_settings_dn),
 848                                        ldb_errstring(ldb));
 849                 talloc_free(tmp_ctx);
 850                 return ret;
 851         }
 852
 853         msg->dn = op_feature_scope_dn;
 854         ret = dsdb_module_modify(module, msg, DSDB_FLAG_NEXT_MODULE);
 855         if (ret != LDB_SUCCESS) {
 856                 ldb_asprintf_errstring(ldb,
 857                                        "rootdse_enable_recycle_bin: Failed to modify object %s - %s",
 858                                        ldb_dn_get_linearized(op_feature_scope_dn),
 859                                        ldb_errstring(ldb));
 860                 talloc_free(tmp_ctx);
 861                 return ret;
 862         }
 863
 864         return LDB_SUCCESS;
 865 }
 866
 867 static int rootdse_enableoptionalfeature(struct ldb_module *module, struct ldb_request *req)
 868 {
 869         /*
 870           steps:
 871                - check for system (only system can enable features)
 872                - extract GUID from the request
 873                - find the feature object
 874                - check functional level, must be at least msDS-RequiredForestBehaviorVersion
 875                - check if it is already enabled (if enabled return LDAP_ATTRIBUTE_OR_VALUE_EXISTS) - probably not needed, just return error from the add/modify
 876                - add/modify objects (see ntdsconnection code for an example)
 877          */
 878
 879         struct ldb_context *ldb = ldb_module_get_ctx(module);
 880         struct GUID op_feature_guid;
 881         struct ldb_dn *op_feature_scope_dn;
 882         struct ldb_message *op_feature_msg;
 883         struct auth_session_info *session_info =
 884                                 (struct auth_session_info *)ldb_get_opaque(ldb, "sessionInfo");
 885         TALLOC_CTX *tmp_ctx = talloc_new(ldb);
 886         int ret;
 887         const char *guid_string;
 888
 889         if (security_session_user_level(session_info, NULL) != SECURITY_SYSTEM) {
 890                 ldb_set_errstring(ldb, "rootdse: Insufficient rights for enableoptionalfeature");
 891                 return LDB_ERR_UNWILLING_TO_PERFORM;
 892         }
 893
 894         ret = get_optional_feature_dn_guid(req, ldb, tmp_ctx, &op_feature_scope_dn, &op_feature_guid);
 895         if (ret != LDB_SUCCESS) {
 896                 talloc_free(tmp_ctx);
 897                 return ret;
 898         }
 899
 900         guid_string = GUID_string(tmp_ctx, &op_feature_guid);
 901         if (!guid_string) {
 902                 ldb_set_errstring(ldb, "rootdse: bad optional feature GUID");
 903                 return LDB_ERR_UNWILLING_TO_PERFORM;
 904         }
 905
 906         ret = dsdb_find_optional_feature(module, ldb, tmp_ctx, op_feature_guid, &op_feature_msg);
 907         if (ret != LDB_SUCCESS) {
 908                 ldb_asprintf_errstring(ldb,
 909                                        "rootdse: unable to find optional feature for %s - %s",
 910                                        guid_string, ldb_errstring(ldb));
 911                 talloc_free(tmp_ctx);
 912                 return ret;
 913         }
 914
 915         if (strcasecmp(DS_GUID_FEATURE_RECYCLE_BIN, guid_string) == 0) {
 916                         ret = rootdse_enable_recycle_bin(module, ldb,
 917                                                          tmp_ctx, op_feature_scope_dn,
 918                                                          op_feature_msg);
 919         } else {
 920                 ldb_asprintf_errstring(ldb,
 921                                        "rootdse: unknown optional feature %s",
 922                                        guid_string);
 923                 talloc_free(tmp_ctx);
 924                 return LDB_ERR_UNWILLING_TO_PERFORM;
 925         }
 926         if (ret != LDB_SUCCESS) {
 927                 ldb_asprintf_errstring(ldb,
 928                                        "rootdse: failed to set optional feature for %s - %s",
 929                                        guid_string, ldb_errstring(ldb));
 930                 talloc_free(tmp_ctx);
 931                 return ret;
 932         }
 933
 934         talloc_free(tmp_ctx);
 935         return ldb_module_done(req, NULL, NULL, LDB_SUCCESS);;
 936 }
 937
 938 static int rootdse_schemaupdatenow(struct ldb_module *module, struct ldb_request *req)
 939 {
 940         struct ldb_context *ldb = ldb_module_get_ctx(module);
 941         struct ldb_result *ext_res;
 942         int ret;
 943         struct ldb_dn *schema_dn;
 944
 945         schema_dn = ldb_get_schema_basedn(ldb);
 946         if (!schema_dn) {
 947                 ldb_reset_err_string(ldb);
 948                 ldb_debug(ldb, LDB_DEBUG_WARNING,
 949                           "rootdse_modify: no schema dn present: (skip ldb_extended call)\n");
 950                 return ldb_next_request(module, req);
 951         }
 952
 953         ret = ldb_extended(ldb, DSDB_EXTENDED_SCHEMA_UPDATE_NOW_OID, schema_dn, &ext_res);
 954         if (ret != LDB_SUCCESS) {
 955                 return ldb_operr(ldb);
 956         }
 957
 958         talloc_free(ext_res);
 959         return ldb_module_done(req, NULL, NULL, ret);
 960 }
 961
 962 static int rootdse_add(struct ldb_module *module, struct ldb_request *req)
 963 {
 964         struct ldb_context *ldb = ldb_module_get_ctx(module);
 965
 966         /*
 967                 If dn is not "" we should let it pass through
 968         */
 969         if (!ldb_dn_is_null(req->op.add.message->dn)) {
 970                 return ldb_next_request(module, req);
 971         }
 972
 973         ldb_set_errstring(ldb, "rootdse_add: you cannot add a new rootdse entry!");
 974         return LDB_ERR_NAMING_VIOLATION;
 975 }
 976
 977 static int rootdse_become_master(struct ldb_module *module,
 978                                  struct ldb_request *req,
 979                                  uint32_t role)
 980 {
 981         struct drepl_takeFSMORole r;
 982         struct messaging_context *msg;
 983         struct ldb_context *ldb = ldb_module_get_ctx(module);
 984         TALLOC_CTX *tmp_ctx = talloc_new(req);
 985         struct loadparm_context *lp_ctx = ldb_get_opaque(ldb, "loadparm");
 986         NTSTATUS status_call;
 987         WERROR status_fn;
 988         struct dcerpc_binding_handle *irpc_handle;
 989
 990         msg = messaging_client_init(tmp_ctx, lpcfg_messaging_path(tmp_ctx, lp_ctx),
 991                                     ldb_get_event_context(ldb));
 992
 993         irpc_handle = irpc_binding_handle_by_name(tmp_ctx, msg,
 994                                                   "dreplsrv",
 995                                                   &ndr_table_irpc);
 996         if (irpc_handle == NULL) {
 997                 return ldb_oom(ldb);
 998         }
 999         r.in.role = role;
1000
1001         status_call = dcerpc_drepl_takeFSMORole_r(irpc_handle, tmp_ctx, &r);
1002         if (!NT_STATUS_IS_OK(status_call)) {
1003                 return LDB_ERR_OPERATIONS_ERROR;
1004         }
1005         status_fn = r.out.result;
1006         if (!W_ERROR_IS_OK(status_fn)) {
1007                 return LDB_ERR_OPERATIONS_ERROR;
1008         }
1009         return ldb_module_done(req, NULL, NULL, LDB_SUCCESS);
1010 }
1011
1012 static int rootdse_modify(struct ldb_module *module, struct ldb_request *req)
1013 {
1014         struct ldb_context *ldb = ldb_module_get_ctx(module);
1015
1016         /*
1017                 If dn is not "" we should let it pass through
1018         */
1019         if (!ldb_dn_is_null(req->op.mod.message->dn)) {
1020                 return ldb_next_request(module, req);
1021         }
1022
1023         /*
1024                 dn is empty so check for schemaUpdateNow attribute
1025                 "The type of modification and values specified in the LDAP modify operation do not matter." MSDN
1026         */
1027         if (ldb_msg_find_element(req->op.mod.message, "schemaUpdateNow")) {
1028                 return rootdse_schemaupdatenow(module, req);
1029         }
1030         if (ldb_msg_find_element(req->op.mod.message, "becomeDomainMaster")) {
1031                 return rootdse_become_master(module, req, DREPL_NAMING_MASTER);
1032         }
1033         if (ldb_msg_find_element(req->op.mod.message, "becomeInfrastructureMaster")) {
1034                 return rootdse_become_master(module, req, DREPL_INFRASTRUCTURE_MASTER);
1035         }
1036         if (ldb_msg_find_element(req->op.mod.message, "becomeRidMaster")) {
1037                 return rootdse_become_master(module, req, DREPL_RID_MASTER);
1038         }
1039         if (ldb_msg_find_element(req->op.mod.message, "becomeSchemaMaster")) {
1040                 return rootdse_become_master(module, req, DREPL_SCHEMA_MASTER);
1041         }
1042         if (ldb_msg_find_element(req->op.mod.message, "becomePdc")) {
1043                 return rootdse_become_master(module, req, DREPL_PDC_MASTER);
1044         }
1045         if (ldb_msg_find_element(req->op.mod.message, "enableOptionalFeature")) {
1046                 return rootdse_enableoptionalfeature(module, req);
1047         }
1048
1049         ldb_set_errstring(ldb, "rootdse_modify: unknown attribute to change!");
1050         return LDB_ERR_UNWILLING_TO_PERFORM;
1051 }
1052
1053 static int rootdse_delete(struct ldb_module *module, struct ldb_request *req)
1054 {
1055         struct ldb_context *ldb = ldb_module_get_ctx(module);
1056
1057         /*
1058                 If dn is not "" we should let it pass through
1059         */
1060         if (!ldb_dn_is_null(req->op.del.dn)) {
1061                 return ldb_next_request(module, req);
1062         }
1063
1064         ldb_set_errstring(ldb, "rootdse_remove: you cannot delete the rootdse entry!");
1065         return LDB_ERR_NO_SUCH_OBJECT;
1066 }
1067
1068 _PUBLIC_ const struct ldb_module_ops ldb_rootdse_module_ops = {
1069         .name           = "rootdse",
1070         .init_context   = rootdse_init,
1071         .search         = rootdse_search,
1072         .request        = rootdse_request,
1073         .add            = rootdse_add,
1074         .modify         = rootdse_modify,
1075         .del            = rootdse_delete
1076 };