source4/libnet/libnet_become_dc.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3
   4    Copyright (C) Stefan Metzmacher <metze@samba.org> 2006
   5
   6    This program is free software; you can redistribute it and/or modify
   7    it under the terms of the GNU General Public License as published by
   8    the Free Software Foundation; either version 3 of the License, or
   9    (at your option) any later version.
  10
  11    This program is distributed in the hope that it will be useful,
  12    but WITHOUT ANY WARRANTY; without even the implied warranty of
  13    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  14    GNU General Public License for more details.
  15
  16    You should have received a copy of the GNU General Public License
  17    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  18 */
  19
  20 #include "includes.h"
  21 #include "libnet/libnet.h"
  22 #include "libcli/composite/composite.h"
  23 #include "libcli/cldap/cldap.h"
  24 #include "lib/ldb/include/ldb.h"
  25 #include "lib/ldb/include/ldb_errors.h"
  26 #include "lib/ldb_wrap.h"
  27 #include "dsdb/samdb/samdb.h"
  28 #include "../libds/common/flags.h"
  29 #include "librpc/gen_ndr/ndr_drsuapi_c.h"
  30 #include "libcli/security/security.h"
  31 #include "librpc/gen_ndr/ndr_misc.h"
  32 #include "librpc/gen_ndr/ndr_security.h"
  33 #include "librpc/gen_ndr/ndr_nbt.h"
  34 #include "librpc/gen_ndr/ndr_drsuapi.h"
  35 #include "auth/gensec/gensec.h"
  36 #include "param/param.h"
  37 #include "lib/tsocket/tsocket.h"
  38
  39 /*****************************************************************************
  40  * Windows 2003 (w2k3) does the following steps when changing the server role
  41  * from domain member to domain controller
  42  *
  43  * We mostly do the same.
  44  *****************************************************************************/
  45
  46 /*
  47  * lookup DC:
  48  * - using nbt name<1C> request and a samlogon mailslot request
  49  * or
  50  * - using a DNS SRV _ldap._tcp.dc._msdcs. request and a CLDAP netlogon request
  51  *
  52  * see: becomeDC_recv_cldap() and becomeDC_send_cldap()
  53  */
  54
  55 /*
  56  * Open 1st LDAP connection to the DC using admin credentials
  57  *
  58  * see: becomeDC_connect_ldap1() and becomeDC_ldap_connect()
  59  */
  60
  61 /*
  62  * LDAP search 1st LDAP connection:
  63  *
  64  * see: becomeDC_ldap1_rootdse()
  65  *
  66  * Request:
  67  *      basedn: ""
  68  *      scope:  base
  69  *      filter: (objectClass=*)
  70  *      attrs:  *
  71  * Result:
  72  *      ""
  73  *              currentTime:            20061202155100.0Z
  74  *              subschemaSubentry:      CN=Aggregate,CN=Schema,CN=Configuration,<domain_partition>
  75  *              dsServiceName:          CN=<netbios_name>,CN=Servers,CN=<site_name>,CN=Sites,CN=Configuration,<domain_partition>
  76  *              namingContexts:         <domain_partition>
  77  *                                      CN=Configuration,<domain_partition>
  78  *                                      CN=Schema,CN=Configuration,<domain_partition>
  79  *              defaultNamingContext:   <domain_partition>
  80  *              schemaNamingContext:    CN=Schema,CN=Configuration,<domain_partition>
  81  *              configurationNamingContext:CN=Configuration,<domain_partition>
  82  *              rootDomainNamingContext:<domain_partition>
  83  *              supportedControl:       ...
  84  *              supportedLDAPVersion:   3
  85  *                                      2
  86  *              supportedLDAPPolicies:  ...
  87  *              highestCommitedUSN:     ...
  88  *              supportedSASLMechanisms:GSSAPI
  89  *                                      GSS-SPNEGO
  90  *                                      EXTERNAL
  91  *                                      DIGEST-MD5
  92  *              dnsHostName:            <dns_host_name>
  93  *              ldapServiceName:        <domain_dns_name>:<netbios_name>$@<REALM>
  94  *              serverName:             CN=Servers,CN=<site_name>,CN=Sites,CN=Configuration,<domain_partition>
  95  *              supportedCapabilities:  ...
  96  *              isSyncronized:          TRUE
  97  *              isGlobalCatalogReady:   TRUE
  98  *              domainFunctionality:    0
  99  *              forestFunctionality:    0
 100  *              domainControllerFunctionality: 2
 101  */
 102
 103 /*
 104  * LDAP search 1st LDAP connection:
 105  *
 106  * see: becomeDC_ldap1_crossref_behavior_version()
 107  *
 108  * Request:
 109  *      basedn: CN=Configuration,<domain_partition>
 110  *      scope:  one
 111  *      filter: (cn=Partitions)
 112  *      attrs:  msDS-Behavior-Version
 113  * Result:
 114  *      CN=Partitions,CN=Configuration,<domain_partition>
 115  *              msDS-Behavior-Version:  0
 116  */
 117
 118 /*
 119  * LDAP search 1st LDAP connection:
 120  *
 121  * NOTE: this seems to be a bug! as the messageID of the LDAP message is corrupted!
 122  *
 123  * not implemented here
 124  *
 125  * Request:
 126  *      basedn: CN=Schema,CN=Configuration,<domain_partition>
 127  *      scope:  one
 128  *      filter: (cn=Partitions)
 129  *      attrs:  msDS-Behavior-Version
 130  * Result:
 131  *      <none>
 132  *
 133  */
 134
 135 /*
 136  * LDAP search 1st LDAP connection:
 137  *
 138  * see: becomeDC_ldap1_domain_behavior_version()
 139  *
 140  * Request:
 141  *      basedn: <domain_partition>
 142  *      scope:  base
 143  *      filter: (objectClass=*)
 144  *      attrs:  msDS-Behavior-Version
 145  * Result:
 146  *      <domain_partition>
 147  *              msDS-Behavior-Version:  0
 148  */
 149
 150 /*
 151  * LDAP search 1st LDAP connection:
 152  *
 153  * see: becomeDC_ldap1_schema_object_version()
 154  *
 155  * Request:
 156  *      basedn: CN=Schema,CN=Configuration,<domain_partition>
 157  *      scope:  base
 158  *      filter: (objectClass=*)
 159  *      attrs:  objectVersion
 160  * Result:
 161  *      CN=Schema,CN=Configuration,<domain_partition>
 162  *              objectVersion:  30
 163  */
 164
 165 /*
 166  * LDAP search 1st LDAP connection:
 167  *
 168  * not implemented, because the information is already there
 169  *
 170  * Request:
 171  *      basedn: ""
 172  *      scope:  base
 173  *      filter: (objectClass=*)
 174  *      attrs:  defaultNamingContext
 175  *              dnsHostName
 176  * Result:
 177  *      ""
 178  *              defaultNamingContext:   <domain_partition>
 179  *              dnsHostName:            <dns_host_name>
 180  */
 181
 182 /*
 183  * LDAP search 1st LDAP connection:
 184  *
 185  * see: becomeDC_ldap1_infrastructure_fsmo()
 186  *
 187  * Request:
 188  *      basedn: <WKGUID=2fbac1870ade11d297c400c04fd8d5cd,domain_partition>
 189  *      scope:  base
 190  *      filter: (objectClass=*)
 191  *      attrs:  1.1
 192  * Result:
 193  *      CN=Infrastructure,<domain_partition>
 194  */
 195
 196 /*
 197  * LDAP search 1st LDAP connection:
 198  *
 199  * see: becomeDC_ldap1_w2k3_update_revision()
 200  *
 201  * Request:
 202  *      basedn: CN=Windows2003Update,CN=DomainUpdates,CN=System,<domain_partition>
 203  *      scope:  base
 204  *      filter: (objectClass=*)
 205  *      attrs:  revision
 206  * Result:
 207  *      CN=Windows2003Update,CN=DomainUpdates,CN=System,<domain_partition>
 208  *              revision:       8
 209  */
 210
 211 /*
 212  * LDAP search 1st LDAP connection:
 213  *
 214  * see: becomeDC_ldap1_infrastructure_fsmo()
 215  *
 216  * Request:
 217  *      basedn: CN=Infrastructure,<domain_partition>
 218  *      scope:  base
 219  *      filter: (objectClass=*)
 220  *      attrs:  fSMORoleOwner
 221  * Result:
 222  *      CN=Infrastructure,<domain_partition>
 223  *              fSMORoleOwner:  CN=NTDS Settings,<infrastructure_fsmo_server_object>
 224  */
 225
 226 /*
 227  * LDAP search 1st LDAP connection:
 228  *
 229  * see: becomeDC_ldap1_infrastructure_fsmo()
 230  *
 231  * Request:
 232  *      basedn: <infrastructure_fsmo_server_object>
 233  *      scope:  base
 234  *      filter: (objectClass=*)
 235  *      attrs:  dnsHostName
 236  * Result:
 237  *      <infrastructure_fsmo_server_object>
 238  *              dnsHostName:    <dns_host_name>
 239  */
 240
 241 /*
 242  * LDAP search 1st LDAP connection:
 243  *
 244  * see: becomeDC_ldap1_infrastructure_fsmo()
 245  *
 246  * Request:
 247  *      basedn: CN=NTDS Settings,<infrastructure_fsmo_server_object>
 248  *      scope:  base
 249  *      filter: (objectClass=*)
 250  *      attrs:  objectGUID
 251  * Result:
 252  *      CN=NTDS Settings,<infrastructure_fsmo_server_object>
 253  *              objectGUID:     <object_guid>
 254  */
 255
 256 /*
 257  * LDAP search 1st LDAP connection:
 258  *
 259  * see: becomeDC_ldap1_rid_manager_fsmo()
 260  *
 261  * Request:
 262  *      basedn: <domain_partition>
 263  *      scope:  base
 264  *      filter: (objectClass=*)
 265  *      attrs:  rIDManagerReference
 266  * Result:
 267  *      <domain_partition>
 268  *              rIDManagerReference:    CN=RID Manager$,CN=System,<domain_partition>
 269  */
 270
 271 /*
 272  * LDAP search 1st LDAP connection:
 273  *
 274  * see: becomeDC_ldap1_rid_manager_fsmo()
 275  *
 276  * Request:
 277  *      basedn: CN=RID Manager$,CN=System,<domain_partition>
 278  *      scope:  base
 279  *      filter: (objectClass=*)
 280  *      attrs:  fSMORoleOwner
 281  * Result:
 282  *      CN=Infrastructure,<domain_partition>
 283  *              fSMORoleOwner:  CN=NTDS Settings,<rid_manager_fsmo_server_object>
 284  */
 285
 286 /*
 287  * LDAP search 1st LDAP connection:
 288  *
 289  * see: becomeDC_ldap1_rid_manager_fsmo()
 290  *
 291  * Request:
 292  *      basedn: <rid_manager_fsmo_server_object>
 293  *      scope:  base
 294  *      filter: (objectClass=*)
 295  *      attrs:  dnsHostName
 296  * Result:
 297  *      <rid_manager_fsmo_server_object>
 298  *              dnsHostName:    <dns_host_name>
 299  */
 300
 301 /*
 302  * LDAP search 1st LDAP connection:
 303  *
 304  * see: becomeDC_ldap1_rid_manager_fsmo()
 305  *
 306  * Request:
 307  *      basedn: CN=NTDS Settings,<rid_manager_fsmo_server_object>
 308  *      scope:  base
 309  *      filter: (objectClass=*)
 310  *      attrs:  msDs-ReplicationEpoch
 311  * Result:
 312  *      CN=NTDS Settings,<rid_manager_fsmo_server_object>
 313  */
 314
 315 /*
 316  * LDAP search 1st LDAP connection:
 317  *
 318  * see: becomeDC_ldap1_site_object()
 319  *
 320  * Request:
 321  *      basedn: CN=<new_dc_site_name>,CN=Sites,CN=Configuration,<domain_partition>
 322  *      scope:  base
 323  *      filter: (objectClass=*)
 324  *      attrs:
 325  * Result:
 326  *      CN=<new_dc_site_name>,CN=Sites,CN=Configuration,<domain_partition>
 327  *              objectClass:    top
 328  *                              site
 329  *              cn:             <new_dc_site_name>
 330  *              distinguishedName:CN=<new_dc_site_name>,CN=Sites,CN=Configuration,<domain_partition>
 331  *              instanceType:   4
 332  *              whenCreated:    ...
 333  *              whenChanged:    ...
 334  *              uSNCreated:     ...
 335  *              uSNChanged:     ...
 336  *              showInAdvancedViewOnly: TRUE
 337  *              name:           <new_dc_site_name>
 338  *              objectGUID:     <object_guid>
 339  *              systemFlags:    1107296256 <0x42000000>
 340  *              objectCategory: CN=Site,CN=Schema,CN=Configuration,<domain_partition>
 341  */
 342
 343 /***************************************************************
 344  * Add this stage we call the check_options() callback function
 345  * of the caller, to see if he wants us to continue
 346  *
 347  * see: becomeDC_check_options()
 348  ***************************************************************/
 349
 350 /*
 351  * LDAP search 1st LDAP connection:
 352  *
 353  * see: becomeDC_ldap1_computer_object()
 354  *
 355  * Request:
 356  *      basedn: <domain_partition>
 357  *      scope:  sub
 358  *      filter: (&(|(objectClass=user)(objectClass=computer))(sAMAccountName=<new_dc_account_name>))
 359  *      attrs:  distinguishedName
 360  *              userAccountControl
 361  * Result:
 362  *      CN=<new_dc_netbios_name>,CN=Computers,<domain_partition>
 363  *              distinguishedName:      CN=<new_dc_netbios_name>,CN=Computers,<domain_partition>
 364  *              userAccoountControl:    4096 <0x1000>
 365  */
 366
 367 /*
 368  * LDAP search 1st LDAP connection:
 369  *
 370  * see: becomeDC_ldap1_server_object_1()
 371  *
 372  * Request:
 373  *      basedn: CN=<new_dc_netbios_name>,CN=Servers,CN=<new_dc_site_name>,CN=Sites,CN=Configuration,<domain_partition>
 374  *      scope:  base
 375  *      filter: (objectClass=*)
 376  *      attrs:
 377  * Result:
 378  *      <noSuchObject>
 379  *      <matchedDN:CN=Servers,CN=<new_dc_site_name>,CN=Sites,CN=Configuration,<domain_partition>>
 380  */
 381
 382 /*
 383  * LDAP search 1st LDAP connection:
 384  *
 385  * see: becomeDC_ldap1_server_object_2()
 386  *
 387  * Request:
 388  *      basedn: CN=<new_dc_netbios_name>,CN=Computers,<domain_partition>
 389  *      scope:  base
 390  *      filter: (objectClass=*)
 391  *      attrs:  serverReferenceBL
 392  *      typesOnly: TRUE!!!
 393  * Result:
 394  *      CN=<new_dc_netbios_name>,CN=Computers,<domain_partition>
 395  */
 396
 397 /*
 398  * LDAP add 1st LDAP connection:
 399  *
 400  * see: becomeDC_ldap1_server_object_add()
 401  *
 402  * Request:
 403  *      CN=<new_dc_netbios_name>,CN=Computers,<domain_partition>
 404  *      objectClass:    server
 405  *      systemFlags:    50000000 <0x2FAF080>
 406  *      serverReference:CN=<new_dc_netbios_name>,CN=Computers,<domain_partition>
 407  * Result:
 408  *      <success>
 409  */
 410
 411 /*
 412  * LDAP search 1st LDAP connection:
 413  *
 414  * not implemented, maybe we can add that later
 415  *
 416  * Request:
 417  *      basedn: CN=NTDS Settings,CN=<new_dc_netbios_name>,CN=Servers,CN=<new_dc_site_name>,CN=Sites,CN=Configuration,<domain_partition>
 418  *      scope:  base
 419  *      filter: (objectClass=*)
 420  *      attrs:
 421  * Result:
 422  *      <noSuchObject>
 423  *      <matchedDN:CN=<new_dc_netbios_name>,CN=Servers,CN=<new_dc_site_name>,CN=Sites,CN=Configuration,<domain_partition>>
 424  */
 425
 426 /*
 427  * LDAP search 1st LDAP connection:
 428  *
 429  * not implemented because it gives no new information
 430  *
 431  * Request:
 432  *      basedn: CN=Partitions,CN=Configuration,<domain_partition>
 433  *      scope:  sub
 434  *      filter: (nCName=<domain_partition>)
 435  *      attrs:  nCName
 436  *              dnsRoot
 437  *      controls: LDAP_SERVER_EXTENDED_DN_OID:critical=false
 438  * Result:
 439  *      <GUID=<hex_guid>>;CN=<domain_netbios_name>,CN=Partitions,<domain_partition>>
 440  *              nCName:         <GUID=<hex_guid>>;<SID=<hex_sid>>;<domain_partition>>
 441  *              dnsRoot:        <domain_dns_name>
 442  */
 443
 444 /*
 445  * LDAP modify 1st LDAP connection:
 446  *
 447  * see: becomeDC_ldap1_server_object_modify()
 448  *
 449  * Request (add):
 450  *      CN=<new_dc_netbios_name>,CN=Servers,CN=<new_dc_site_name>,CN=Sites,CN=Configuration,<domain_partition>>
 451  *      serverReference:CN=<new_dc_netbios_name>,CN=Computers,<domain_partition>
 452  * Result:
 453  *      <attributeOrValueExist>
 454  */
 455
 456 /*
 457  * LDAP modify 1st LDAP connection:
 458  *
 459  * see: becomeDC_ldap1_server_object_modify()
 460  *
 461  * Request (replace):
 462  *      CN=<new_dc_netbios_name>,CN=Servers,CN=<new_dc_site_name>,CN=Sites,CN=Configuration,<domain_partition>>
 463  *      serverReference:CN=<new_dc_netbios_name>,CN=Computers,<domain_partition>
 464  * Result:
 465  *      <success>
 466  */
 467
 468 /*
 469  * Open 1st DRSUAPI connection to the DC using admin credentials
 470  * DsBind with DRSUAPI_DS_BIND_GUID_W2K3 ("6afab99c-6e26-464a-975f-f58f105218bc")
 471  * (w2k3 does 2 DsBind() calls here..., where is first is unused and contains garbage at the end)
 472  *
 473  * see: becomeDC_drsuapi_connect_send(), becomeDC_drsuapi1_connect_recv(),
 474  *      becomeDC_drsuapi_bind_send(), becomeDC_drsuapi_bind_recv() and becomeDC_drsuapi1_bind_recv()
 475  */
 476
 477 /*
 478  * DsAddEntry to create the CN=NTDS Settings,CN=<machine_name>,CN=Servers,CN=Default-First-Site-Name, ...
 479  * on the 1st DRSUAPI connection
 480  *
 481  * see: becomeDC_drsuapi1_add_entry_send() and becomeDC_drsuapi1_add_entry_recv()
 482  */
 483
 484 /***************************************************************
 485  * Add this stage we call the prepare_db() callback function
 486  * of the caller, to see if he wants us to continue
 487  *
 488  * see: becomeDC_prepare_db()
 489  ***************************************************************/
 490
 491 /*
 492  * Open 2nd and 3rd DRSUAPI connection to the DC using admin credentials
 493  * - a DsBind with DRSUAPI_DS_BIND_GUID_W2K3 ("6afab99c-6e26-464a-975f-f58f105218bc")
 494  *   on the 2nd connection
 495  *
 496  * see: becomeDC_drsuapi_connect_send(), becomeDC_drsuapi2_connect_recv(),
 497  *      becomeDC_drsuapi_bind_send(), becomeDC_drsuapi_bind_recv(), becomeDC_drsuapi2_bind_recv()
 498  *      and becomeDC_drsuapi3_connect_recv()
 499  */
 500
 501 /*
 502  * replicate CN=Schema,CN=Configuration,...
 503  * on the 3rd DRSUAPI connection and the bind_handle from the 2nd connection
 504  *
 505  * see: becomeDC_drsuapi_pull_partition_send(), becomeDC_drsuapi_pull_partition_recv(),
 506  *      becomeDC_drsuapi3_pull_schema_send() and becomeDC_drsuapi3_pull_schema_recv()
 507  *
 508  ***************************************************************
 509  * Add this stage we call the schema_chunk() callback function
 510  * for each replication message
 511  ***************************************************************/
 512
 513 /*
 514  * replicate CN=Configuration,...
 515  * on the 3rd DRSUAPI connection and the bind_handle from the 2nd connection
 516  *
 517  * see: becomeDC_drsuapi_pull_partition_send(), becomeDC_drsuapi_pull_partition_recv(),
 518  *      becomeDC_drsuapi3_pull_config_send() and becomeDC_drsuapi3_pull_config_recv()
 519  *
 520  ***************************************************************
 521  * Add this stage we call the config_chunk() callback function
 522  * for each replication message
 523  ***************************************************************/
 524
 525 /*
 526  * LDAP unbind on the 1st LDAP connection
 527  *
 528  * not implemented, because it's not needed...
 529  */
 530
 531 /*
 532  * Open 2nd LDAP connection to the DC using admin credentials
 533  *
 534  * see: becomeDC_connect_ldap2() and becomeDC_ldap_connect()
 535  */
 536
 537 /*
 538  * LDAP search 2nd LDAP connection:
 539  *
 540  * not implemented because it gives no new information
 541  * same as becomeDC_ldap1_computer_object()
 542  *
 543  * Request:
 544  *      basedn: <domain_partition>
 545  *      scope:  sub
 546  *      filter: (&(|(objectClass=user)(objectClass=computer))(sAMAccountName=<new_dc_account_name>))
 547  *      attrs:  distinguishedName
 548  *              userAccountControl
 549  * Result:
 550  *      CN=<new_dc_netbios_name>,CN=Computers,<domain_partition>
 551  *              distinguishedName:      CN=<new_dc_netbios_name>,CN=Computers,<domain_partition>
 552  *              userAccoountControl:    4096 <0x00001000>
 553  */
 554
 555 /*
 556  * LDAP search 2nd LDAP connection:
 557  *
 558  * not implemented because it gives no new information
 559  * same as becomeDC_ldap1_computer_object()
 560  *
 561  * Request:
 562  *      basedn: CN=<new_dc_netbios_name>,CN=Computers,<domain_partition>
 563  *      scope:  base
 564  *      filter: (objectClass=*)
 565  *      attrs:  userAccountControl
 566  * Result:
 567  *      CN=<new_dc_netbios_name>,CN=Computers,<domain_partition>
 568  *              userAccoountControl:    4096 <0x00001000>
 569  */
 570
 571 /*
 572  * LDAP modify 2nd LDAP connection:
 573  *
 574  * see: becomeDC_ldap2_modify_computer()
 575  *
 576  * Request (replace):
 577  *      CN=<new_dc_netbios_name>,CN=Computers,<domain_partition>
 578  *      userAccoountControl:    532480 <0x82000>
 579  * Result:
 580  *      <success>
 581  */
 582
 583 /*
 584  * LDAP search 2nd LDAP connection:
 585  *
 586  * see: becomeDC_ldap2_move_computer()
 587  *
 588  * Request:
 589  *      basedn: <WKGUID=2fbac1870ade11d297c400c04fd8d5cd,<domain_partition>>
 590  *      scope:  base
 591  *      filter: (objectClass=*)
 592  *      attrs:  1.1
 593  * Result:
 594  *      CN=Domain Controllers,<domain_partition>
 595  */
 596
 597 /*
 598  * LDAP search 2nd LDAP connection:
 599  *
 600  * not implemented because it gives no new information
 601  *
 602  * Request:
 603  *      basedn: CN=Domain Controllers,<domain_partition>
 604  *      scope:  base
 605  *      filter: (objectClass=*)
 606  *      attrs:  distinguishedName
 607  * Result:
 608  *      CN=Domain Controller,<domain_partition>
 609  *              distinguishedName:      CN=Domain Controllers,<domain_partition>
 610  */
 611
 612 /*
 613  * LDAP modifyRDN 2nd LDAP connection:
 614  *
 615  * see: becomeDC_ldap2_move_computer()
 616  *
 617  * Request:
 618  *      entry:          CN=<new_dc_netbios_name>,CN=Computers,<domain_partition>
 619  *      newrdn:         CN=<new_dc_netbios_name>
 620  *      deleteoldrdn:   TRUE
 621  *      newparent:      CN=Domain Controllers,<domain_partition>
 622  * Result:
 623  *      <success>
 624  */
 625
 626 /*
 627  * LDAP unbind on the 2nd LDAP connection
 628  *
 629  * not implemented, because it's not needed...
 630  */
 631
 632 /*
 633  * replicate Domain Partition
 634  * on the 3rd DRSUAPI connection and the bind_handle from the 2nd connection
 635  *
 636  * see: becomeDC_drsuapi_pull_partition_send(), becomeDC_drsuapi_pull_partition_recv(),
 637  *      becomeDC_drsuapi3_pull_domain_send() and becomeDC_drsuapi3_pull_domain_recv()
 638  *
 639  ***************************************************************
 640  * Add this stage we call the domain_chunk() callback function
 641  * for each replication message
 642  ***************************************************************/
 643
 644 /* call DsReplicaUpdateRefs() for all partitions like this:
 645  *     req1: struct drsuapi_DsReplicaUpdateRefsRequest1
 646  *
 647  *                 naming_context: struct drsuapi_DsReplicaObjectIdentifier
 648  *                     __ndr_size               : 0x000000ae (174)
 649  *                     __ndr_size_sid           : 0x00000000 (0)
 650  *                     guid                     : 00000000-0000-0000-0000-000000000000
 651  *                     sid                      : S-0-0
 652  *                     dn                       : 'CN=Schema,CN=Configuration,DC=w2k3,DC=vmnet1,DC=vm,DC=base'
 653  *
 654  *                 dest_dsa_dns_name        : '4a0df188-a0b8-47ea-bbe5-e614723f16dd._msdcs.w2k3.vmnet1.vm.base'
 655  *           dest_dsa_guid            : 4a0df188-a0b8-47ea-bbe5-e614723f16dd
 656  *           options                  : 0x0000001c (28)
 657  *                 0: DRSUAPI_DS_REPLICA_UPDATE_ASYNCHRONOUS_OPERATION
 658  *                 0: DRSUAPI_DS_REPLICA_UPDATE_WRITEABLE
 659  *                 1: DRSUAPI_DS_REPLICA_UPDATE_ADD_REFERENCE
 660  *                 1: DRSUAPI_DS_REPLICA_UPDATE_DELETE_REFERENCE
 661  *                 1: DRSUAPI_DS_REPLICA_UPDATE_0x00000010
 662  *
 663  * 4a0df188-a0b8-47ea-bbe5-e614723f16dd is the objectGUID the DsAddEntry() returned for the
 664  * CN=NTDS Settings,CN=<machine_name>,CN=Servers,CN=Default-First-Site-Name, ...
 665  * on the 2nd!!! DRSUAPI connection
 666  *
 667  * see: becomeDC_drsuapi_update_refs_send(), becomeDC_drsuapi2_update_refs_schema_recv(),
 668  *      becomeDC_drsuapi2_update_refs_config_recv() and becomeDC_drsuapi2_update_refs_domain_recv()
 669  */
 670
 671 /*
 672  * Windows does opens the 4th and 5th DRSUAPI connection...
 673  * and does a DsBind() with the objectGUID from DsAddEntry() as bind_guid
 674  * on the 4th connection
 675  *
 676  * and then 2 full replications of the domain partition on the 5th connection
 677  * with the bind_handle from the 4th connection
 678  *
 679  * not implemented because it gives no new information
 680  */
 681
 682 struct libnet_BecomeDC_state {
 683         struct composite_context *creq;
 684
 685         struct libnet_context *libnet;
 686
 687         struct dom_sid zero_sid;
 688
 689         struct {
 690                 struct cldap_socket *sock;
 691                 struct cldap_netlogon io;
 692                 struct NETLOGON_SAM_LOGON_RESPONSE_EX netlogon;
 693         } cldap;
 694
 695         struct becomeDC_ldap {
 696                 struct ldb_context *ldb;
 697                 const struct ldb_message *rootdse;
 698         } ldap1, ldap2;
 699
 700         struct becomeDC_drsuapi {
 701                 struct libnet_BecomeDC_state *s;
 702                 struct dcerpc_binding *binding;
 703                 struct dcerpc_pipe *pipe;
 704                 DATA_BLOB gensec_skey;
 705                 struct drsuapi_DsBind bind_r;
 706                 struct GUID bind_guid;
 707                 struct drsuapi_DsBindInfoCtr bind_info_ctr;
 708                 struct drsuapi_DsBindInfo28 local_info28;
 709                 struct drsuapi_DsBindInfo28 remote_info28;
 710                 struct policy_handle bind_handle;
 711         } drsuapi1, drsuapi2, drsuapi3;
 712
 713         void *ndr_struct_ptr;
 714
 715         struct libnet_BecomeDC_Domain domain;
 716         struct libnet_BecomeDC_Forest forest;
 717         struct libnet_BecomeDC_SourceDSA source_dsa;
 718         struct libnet_BecomeDC_DestDSA dest_dsa;
 719
 720         struct libnet_BecomeDC_Partition schema_part, config_part, domain_part;
 721
 722         struct becomeDC_fsmo {
 723                 const char *dns_name;
 724                 const char *server_dn_str;
 725                 const char *ntds_dn_str;
 726                 struct GUID ntds_guid;
 727         } infrastructure_fsmo;
 728
 729         struct becomeDC_fsmo rid_manager_fsmo;
 730
 731         struct libnet_BecomeDC_CheckOptions _co;
 732         struct libnet_BecomeDC_PrepareDB _pp;
 733         struct libnet_BecomeDC_StoreChunk _sc;
 734         struct libnet_BecomeDC_Callbacks callbacks;
 735
 736         bool rodc_join;
 737 };
 738
 739 static int32_t get_dc_function_level(struct loadparm_context *lp_ctx)
 740 {
 741         /* per default we are (Windows) 2008 compatible */
 742         return lp_parm_int(lp_ctx, NULL, "ads", "dc function level",
 743                 DS_DC_FUNCTION_2008);
 744 }
 745
 746 static int32_t get_min_function_level(struct loadparm_context *lp_ctx)
 747 {
 748         /* per default it is (Windows) 2003 Native compatible */
 749         return lp_parm_int(lp_ctx, NULL, "ads", "min function level",
 750                 DS_DOMAIN_FUNCTION_2003);
 751 }
 752
 753 static void becomeDC_recv_cldap(struct tevent_req *req);
 754
 755 static void becomeDC_send_cldap(struct libnet_BecomeDC_state *s)
 756 {
 757         struct composite_context *c = s->creq;
 758         struct tevent_req *req;
 759         struct tsocket_address *dest_address;
 760         int ret;
 761
 762         s->cldap.io.in.dest_address     = NULL;
 763         s->cldap.io.in.dest_port        = 0;
 764         s->cldap.io.in.realm            = s->domain.dns_name;
 765         s->cldap.io.in.host             = s->dest_dsa.netbios_name;
 766         s->cldap.io.in.user             = NULL;
 767         s->cldap.io.in.domain_guid      = NULL;
 768         s->cldap.io.in.domain_sid       = NULL;
 769         s->cldap.io.in.acct_control     = -1;
 770         s->cldap.io.in.version          = NETLOGON_NT_VERSION_5 | NETLOGON_NT_VERSION_5EX;
 771         s->cldap.io.in.map_response     = true;
 772
 773         ret = tsocket_address_inet_from_strings(s, "ip",
 774                                                 s->source_dsa.address,
 775                                                 lp_cldap_port(s->libnet->lp_ctx),
 776                                                 &dest_address);
 777         if (ret != 0) {
 778                 c->status = map_nt_error_from_unix(errno);
 779                 if (!composite_is_ok(c)) return;
 780         }
 781
 782         c->status = cldap_socket_init(s, s->libnet->event_ctx,
 783                                       NULL, dest_address, &s->cldap.sock);
 784         if (!composite_is_ok(c)) return;
 785
 786         req = cldap_netlogon_send(s, s->cldap.sock, &s->cldap.io);
 787         if (composite_nomem(req, c)) return;
 788         tevent_req_set_callback(req, becomeDC_recv_cldap, s);
 789 }
 790
 791 static void becomeDC_connect_ldap1(struct libnet_BecomeDC_state *s);
 792
 793 static void becomeDC_recv_cldap(struct tevent_req *req)
 794 {
 795         struct libnet_BecomeDC_state *s = tevent_req_callback_data(req,
 796                                           struct libnet_BecomeDC_state);
 797         struct composite_context *c = s->creq;
 798
 799         c->status = cldap_netlogon_recv(req,
 800                                         lp_iconv_convenience(s->libnet->lp_ctx),
 801                                         s, &s->cldap.io);
 802         talloc_free(req);
 803         if (!composite_is_ok(c)) {
 804                 DEBUG(0,("Failed to send, receive or parse CLDAP reply from server %s for our host %s: %s\n",
 805                          s->cldap.io.in.dest_address,
 806                          s->cldap.io.in.host,
 807                          nt_errstr(c->status)));
 808                 return;
 809         }
 810         s->cldap.netlogon = s->cldap.io.out.netlogon.data.nt5_ex;
 811
 812         s->domain.dns_name              = s->cldap.netlogon.dns_domain;
 813         s->domain.netbios_name          = s->cldap.netlogon.domain;
 814         s->domain.guid                  = s->cldap.netlogon.domain_uuid;
 815
 816         s->forest.dns_name              = s->cldap.netlogon.forest;
 817
 818         s->source_dsa.dns_name          = s->cldap.netlogon.pdc_dns_name;
 819         s->source_dsa.netbios_name      = s->cldap.netlogon.pdc_name;
 820         s->source_dsa.site_name         = s->cldap.netlogon.server_site;
 821
 822         s->dest_dsa.site_name           = s->cldap.netlogon.client_site;
 823
 824         becomeDC_connect_ldap1(s);
 825 }
 826
 827 static NTSTATUS becomeDC_ldap_connect(struct libnet_BecomeDC_state *s,
 828                                       struct becomeDC_ldap *ldap)
 829 {
 830         char *url;
 831
 832         url = talloc_asprintf(s, "ldap://%s/", s->source_dsa.dns_name);
 833         NT_STATUS_HAVE_NO_MEMORY(url);
 834
 835         ldap->ldb = ldb_wrap_connect(s, s->libnet->event_ctx, s->libnet->lp_ctx, url,
 836                                      NULL,
 837                                      s->libnet->cred,
 838                                      0);
 839         talloc_free(url);
 840         if (ldap->ldb == NULL) {
 841                 return NT_STATUS_UNEXPECTED_NETWORK_ERROR;
 842         }
 843
 844         return NT_STATUS_OK;
 845 }
 846
 847 static NTSTATUS becomeDC_ldap1_rootdse(struct libnet_BecomeDC_state *s)
 848 {
 849         int ret;
 850         struct ldb_result *r;
 851         struct ldb_dn *basedn;
 852         static const char *attrs[] = {
 853                 "*",
 854                 NULL
 855         };
 856
 857         basedn = ldb_dn_new(s, s->ldap1.ldb, NULL);
 858         NT_STATUS_HAVE_NO_MEMORY(basedn);
 859
 860         ret = ldb_search(s->ldap1.ldb, s, &r, basedn, LDB_SCOPE_BASE, attrs,
 861                          "(objectClass=*)");
 862         talloc_free(basedn);
 863         if (ret != LDB_SUCCESS) {
 864                 return NT_STATUS_LDAP(ret);
 865         } else if (r->count != 1) {
 866                 talloc_free(r);
 867                 return NT_STATUS_INVALID_NETWORK_RESPONSE;
 868         }
 869
 870         s->ldap1.rootdse = r->msgs[0];
 871
 872         s->domain.dn_str        = ldb_msg_find_attr_as_string(s->ldap1.rootdse, "defaultNamingContext", NULL);
 873         if (!s->domain.dn_str) return NT_STATUS_INVALID_NETWORK_RESPONSE;
 874
 875         s->forest.root_dn_str   = ldb_msg_find_attr_as_string(s->ldap1.rootdse, "rootDomainNamingContext", NULL);
 876         if (!s->forest.root_dn_str) return NT_STATUS_INVALID_NETWORK_RESPONSE;
 877         s->forest.config_dn_str = ldb_msg_find_attr_as_string(s->ldap1.rootdse, "configurationNamingContext", NULL);
 878         if (!s->forest.config_dn_str) return NT_STATUS_INVALID_NETWORK_RESPONSE;
 879         s->forest.schema_dn_str = ldb_msg_find_attr_as_string(s->ldap1.rootdse, "schemaNamingContext", NULL);
 880         if (!s->forest.schema_dn_str) return NT_STATUS_INVALID_NETWORK_RESPONSE;
 881
 882         s->source_dsa.server_dn_str     = ldb_msg_find_attr_as_string(s->ldap1.rootdse, "serverName", NULL);
 883         if (!s->source_dsa.server_dn_str) return NT_STATUS_INVALID_NETWORK_RESPONSE;
 884         s->source_dsa.ntds_dn_str       = ldb_msg_find_attr_as_string(s->ldap1.rootdse, "dsServiceName", NULL);
 885         if (!s->source_dsa.ntds_dn_str) return NT_STATUS_INVALID_NETWORK_RESPONSE;
 886
 887         return NT_STATUS_OK;
 888 }
 889
 890 static NTSTATUS becomeDC_ldap1_crossref_behavior_version(struct libnet_BecomeDC_state *s)
 891 {
 892         int ret;
 893         struct ldb_result *r;
 894         struct ldb_dn *basedn;
 895         static const char *attrs[] = {
 896                 "msDs-Behavior-Version",
 897                 NULL
 898         };
 899
 900         basedn = ldb_dn_new(s, s->ldap1.ldb, s->forest.config_dn_str);
 901         NT_STATUS_HAVE_NO_MEMORY(basedn);
 902
 903         ret = ldb_search(s->ldap1.ldb, s, &r, basedn, LDB_SCOPE_ONELEVEL, attrs,
 904                          "(cn=Partitions)");
 905         talloc_free(basedn);
 906         if (ret != LDB_SUCCESS) {
 907                 return NT_STATUS_LDAP(ret);
 908         } else if (r->count != 1) {
 909                 talloc_free(r);
 910                 return NT_STATUS_INVALID_NETWORK_RESPONSE;
 911         }
 912
 913         s->forest.crossref_behavior_version = ldb_msg_find_attr_as_uint(r->msgs[0], "msDs-Behavior-Version", 0);
 914         if (s->forest.crossref_behavior_version <
 915                          get_min_function_level(s->libnet->lp_ctx)) {
 916                 talloc_free(r);
 917                 DEBUG(0,("The servers function level %u is below 'ads:min function level' of %u\n",
 918                          s->forest.crossref_behavior_version,
 919                          get_min_function_level(s->libnet->lp_ctx)));
 920                 return NT_STATUS_NOT_SUPPORTED;
 921         }
 922         if (s->forest.crossref_behavior_version >
 923                         get_dc_function_level(s->libnet->lp_ctx)) {
 924                 talloc_free(r);
 925                 DEBUG(0,("The servers function level %u is above 'ads:dc function level' of %u\n",
 926                          s->forest.crossref_behavior_version,
 927                          get_dc_function_level(s->libnet->lp_ctx)));
 928                 return NT_STATUS_NOT_SUPPORTED;
 929         }
 930
 931         talloc_free(r);
 932         return NT_STATUS_OK;
 933 }
 934
 935 static NTSTATUS becomeDC_ldap1_domain_behavior_version(struct libnet_BecomeDC_state *s)
 936 {
 937         int ret;
 938         struct ldb_result *r;
 939         struct ldb_dn *basedn;
 940         static const char *attrs[] = {
 941                 "msDs-Behavior-Version",
 942                 NULL
 943         };
 944
 945         basedn = ldb_dn_new(s, s->ldap1.ldb, s->domain.dn_str);
 946         NT_STATUS_HAVE_NO_MEMORY(basedn);
 947
 948         ret = ldb_search(s->ldap1.ldb, s, &r, basedn, LDB_SCOPE_BASE, attrs,
 949                          "(objectClass=*)");
 950         talloc_free(basedn);
 951         if (ret != LDB_SUCCESS) {
 952                 return NT_STATUS_LDAP(ret);
 953         } else if (r->count != 1) {
 954                 talloc_free(r);
 955                 return NT_STATUS_INVALID_NETWORK_RESPONSE;
 956         }
 957
 958         s->domain.behavior_version = ldb_msg_find_attr_as_uint(r->msgs[0], "msDs-Behavior-Version", 0);
 959         if (s->domain.behavior_version <
 960                         get_min_function_level(s->libnet->lp_ctx)) {
 961                 talloc_free(r);
 962                 DEBUG(0,("The servers function level %u is below 'ads:min function level' of %u\n",
 963                          s->forest.crossref_behavior_version,
 964                          get_min_function_level(s->libnet->lp_ctx)));
 965                 return NT_STATUS_NOT_SUPPORTED;
 966         }
 967         if (s->domain.behavior_version >
 968                         get_dc_function_level(s->libnet->lp_ctx)) {
 969                 talloc_free(r);
 970                 DEBUG(0,("The servers function level %u is above 'ads:dc function level' of %u\n",
 971                          s->forest.crossref_behavior_version,
 972                          get_dc_function_level(s->libnet->lp_ctx)));
 973                 return NT_STATUS_NOT_SUPPORTED;
 974         }
 975
 976         talloc_free(r);
 977         return NT_STATUS_OK;
 978 }
 979
 980 static NTSTATUS becomeDC_ldap1_schema_object_version(struct libnet_BecomeDC_state *s)
 981 {
 982         int ret;
 983         struct ldb_result *r;
 984         struct ldb_dn *basedn;
 985         static const char *attrs[] = {
 986                 "objectVersion",
 987                 NULL
 988         };
 989
 990         basedn = ldb_dn_new(s, s->ldap1.ldb, s->forest.schema_dn_str);
 991         NT_STATUS_HAVE_NO_MEMORY(basedn);
 992
 993         ret = ldb_search(s->ldap1.ldb, s, &r, basedn, LDB_SCOPE_BASE, attrs,
 994                          "(objectClass=*)");
 995         talloc_free(basedn);
 996         if (ret != LDB_SUCCESS) {
 997                 return NT_STATUS_LDAP(ret);
 998         } else if (r->count != 1) {
 999                 talloc_free(r);
1000                 return NT_STATUS_INVALID_NETWORK_RESPONSE;
1001         }
1002
1003         s->forest.schema_object_version = ldb_msg_find_attr_as_uint(r->msgs[0], "objectVersion", 0);
1004
1005         talloc_free(r);
1006         return NT_STATUS_OK;
1007 }
1008
1009 static NTSTATUS becomeDC_ldap1_w2k3_update_revision(struct libnet_BecomeDC_state *s)
1010 {
1011         int ret;
1012         struct ldb_result *r;
1013         struct ldb_dn *basedn;
1014         static const char *attrs[] = {
1015                 "revision",
1016                 NULL
1017         };
1018
1019         basedn = ldb_dn_new_fmt(s, s->ldap1.ldb, "CN=Windows2003Update,CN=DomainUpdates,CN=System,%s",
1020                                 s->domain.dn_str);
1021         NT_STATUS_HAVE_NO_MEMORY(basedn);
1022
1023         ret = ldb_search(s->ldap1.ldb, s, &r, basedn, LDB_SCOPE_BASE, attrs,
1024                          "(objectClass=*)");
1025         talloc_free(basedn);
1026         if (ret == LDB_ERR_NO_SUCH_OBJECT) {
1027                 /* w2k doesn't have this object */
1028                 s->domain.w2k3_update_revision = 0;
1029                 return NT_STATUS_OK;
1030         } else if (ret != LDB_SUCCESS) {
1031                 return NT_STATUS_LDAP(ret);
1032         } else if (r->count != 1) {
1033                 talloc_free(r);
1034                 return NT_STATUS_INVALID_NETWORK_RESPONSE;
1035         }
1036
1037         s->domain.w2k3_update_revision = ldb_msg_find_attr_as_uint(r->msgs[0], "revision", 0);
1038
1039         talloc_free(r);
1040         return NT_STATUS_OK;
1041 }
1042
1043 static NTSTATUS becomeDC_ldap1_infrastructure_fsmo(struct libnet_BecomeDC_state *s)
1044 {
1045         int ret;
1046         struct ldb_result *r;
1047         struct ldb_dn *basedn;
1048         struct ldb_dn *ntds_dn;
1049         struct ldb_dn *server_dn;
1050         static const char *dns_attrs[] = {
1051                 "dnsHostName",
1052                 NULL
1053         };
1054         static const char *guid_attrs[] = {
1055                 "objectGUID",
1056                 NULL
1057         };
1058
1059         ret = dsdb_wellknown_dn(s->ldap1.ldb, s, samdb_base_dn(s->ldap1.ldb),
1060                                 DS_GUID_INFRASTRUCTURE_CONTAINER,
1061                                 &basedn);
1062         if (ret != LDB_SUCCESS) {
1063                 return NT_STATUS_LDAP(ret);
1064         }
1065
1066         ret = samdb_reference_dn(s->ldap1.ldb, s, basedn, "fSMORoleOwner", &ntds_dn);
1067         if (ret != LDB_SUCCESS) {
1068                 talloc_free(basedn);
1069                 return NT_STATUS_LDAP(ret);
1070         }
1071
1072         s->infrastructure_fsmo.ntds_dn_str = ldb_dn_get_linearized(ntds_dn);
1073         NT_STATUS_HAVE_NO_MEMORY(s->infrastructure_fsmo.ntds_dn_str);
1074
1075         server_dn = ldb_dn_get_parent(s, ntds_dn);
1076         NT_STATUS_HAVE_NO_MEMORY(server_dn);
1077
1078         s->infrastructure_fsmo.server_dn_str = ldb_dn_alloc_linearized(s, server_dn);
1079         NT_STATUS_HAVE_NO_MEMORY(s->infrastructure_fsmo.server_dn_str);
1080
1081         ret = ldb_search(s->ldap1.ldb, s, &r, server_dn, LDB_SCOPE_BASE,
1082                          dns_attrs, "(objectClass=*)");
1083         if (ret != LDB_SUCCESS) {
1084                 return NT_STATUS_LDAP(ret);
1085         } else if (r->count != 1) {
1086                 talloc_free(r);
1087                 return NT_STATUS_INVALID_NETWORK_RESPONSE;
1088         }
1089
1090         s->infrastructure_fsmo.dns_name = samdb_result_string(r->msgs[0], "dnsHostName", NULL);
1091         if (!s->infrastructure_fsmo.dns_name) return NT_STATUS_INVALID_NETWORK_RESPONSE;
1092         talloc_steal(s, s->infrastructure_fsmo.dns_name);
1093
1094         talloc_free(r);
1095
1096         ret = ldb_search(s->ldap1.ldb, s, &r, ntds_dn, LDB_SCOPE_BASE,
1097                          guid_attrs, "(objectClass=*)");
1098         if (ret != LDB_SUCCESS) {
1099                 return NT_STATUS_LDAP(ret);
1100         } else if (r->count != 1) {
1101                 talloc_free(r);
1102                 return NT_STATUS_INVALID_NETWORK_RESPONSE;
1103         }
1104
1105         s->infrastructure_fsmo.ntds_guid = samdb_result_guid(r->msgs[0], "objectGUID");
1106
1107         talloc_free(r);
1108
1109         return NT_STATUS_OK;
1110 }
1111
1112 static NTSTATUS becomeDC_ldap1_rid_manager_fsmo(struct libnet_BecomeDC_state *s)
1113 {
1114         int ret;
1115         struct ldb_result *r;
1116         struct ldb_dn *basedn;
1117         const char *reference_dn_str;
1118         struct ldb_dn *ntds_dn;
1119         struct ldb_dn *server_dn;
1120         static const char *rid_attrs[] = {
1121                 "rIDManagerReference",
1122                 NULL
1123         };
1124         static const char *fsmo_attrs[] = {
1125                 "fSMORoleOwner",
1126                 NULL
1127         };
1128         static const char *dns_attrs[] = {
1129                 "dnsHostName",
1130                 NULL
1131         };
1132         static const char *guid_attrs[] = {
1133                 "objectGUID",
1134                 NULL
1135         };
1136
1137         basedn = ldb_dn_new(s, s->ldap1.ldb, s->domain.dn_str);
1138         NT_STATUS_HAVE_NO_MEMORY(basedn);
1139
1140         ret = ldb_search(s->ldap1.ldb, s, &r, basedn, LDB_SCOPE_BASE,
1141                          rid_attrs, "(objectClass=*)");
1142         talloc_free(basedn);
1143         if (ret != LDB_SUCCESS) {
1144                 return NT_STATUS_LDAP(ret);
1145         } else if (r->count != 1) {
1146                 talloc_free(r);
1147                 return NT_STATUS_INVALID_NETWORK_RESPONSE;
1148         }
1149
1150         reference_dn_str        = samdb_result_string(r->msgs[0], "rIDManagerReference", NULL);
1151         if (!reference_dn_str) return NT_STATUS_INVALID_NETWORK_RESPONSE;
1152
1153         basedn = ldb_dn_new(s, s->ldap1.ldb, reference_dn_str);
1154         NT_STATUS_HAVE_NO_MEMORY(basedn);
1155
1156         talloc_free(r);
1157
1158         ret = ldb_search(s->ldap1.ldb, s, &r, basedn, LDB_SCOPE_BASE,
1159                          fsmo_attrs, "(objectClass=*)");
1160         talloc_free(basedn);
1161         if (ret != LDB_SUCCESS) {
1162                 return NT_STATUS_LDAP(ret);
1163         } else if (r->count != 1) {
1164                 talloc_free(r);
1165                 return NT_STATUS_INVALID_NETWORK_RESPONSE;
1166         }
1167
1168         s->rid_manager_fsmo.ntds_dn_str = samdb_result_string(r->msgs[0], "fSMORoleOwner", NULL);
1169         if (!s->rid_manager_fsmo.ntds_dn_str) return NT_STATUS_INVALID_NETWORK_RESPONSE;
1170         talloc_steal(s, s->rid_manager_fsmo.ntds_dn_str);
1171
1172         talloc_free(r);
1173
1174         ntds_dn = ldb_dn_new(s, s->ldap1.ldb, s->rid_manager_fsmo.ntds_dn_str);
1175         NT_STATUS_HAVE_NO_MEMORY(ntds_dn);
1176
1177         server_dn = ldb_dn_get_parent(s, ntds_dn);
1178         NT_STATUS_HAVE_NO_MEMORY(server_dn);
1179
1180         s->rid_manager_fsmo.server_dn_str = ldb_dn_alloc_linearized(s, server_dn);
1181         NT_STATUS_HAVE_NO_MEMORY(s->rid_manager_fsmo.server_dn_str);
1182
1183         ret = ldb_search(s->ldap1.ldb, s, &r, server_dn, LDB_SCOPE_BASE,
1184                          dns_attrs, "(objectClass=*)");
1185         if (ret != LDB_SUCCESS) {
1186                 return NT_STATUS_LDAP(ret);
1187         } else if (r->count != 1) {
1188                 talloc_free(r);
1189                 return NT_STATUS_INVALID_NETWORK_RESPONSE;
1190         }
1191
1192         s->rid_manager_fsmo.dns_name    = samdb_result_string(r->msgs[0], "dnsHostName", NULL);
1193         if (!s->rid_manager_fsmo.dns_name) return NT_STATUS_INVALID_NETWORK_RESPONSE;
1194         talloc_steal(s, s->rid_manager_fsmo.dns_name);
1195
1196         talloc_free(r);
1197
1198         ret = ldb_search(s->ldap1.ldb, s, &r, ntds_dn, LDB_SCOPE_BASE,
1199                          guid_attrs, "(objectClass=*)");
1200         if (ret != LDB_SUCCESS) {
1201                 return NT_STATUS_LDAP(ret);
1202         } else if (r->count != 1) {
1203                 talloc_free(r);
1204                 return NT_STATUS_INVALID_NETWORK_RESPONSE;
1205         }
1206
1207         s->rid_manager_fsmo.ntds_guid = samdb_result_guid(r->msgs[0], "objectGUID");
1208
1209         talloc_free(r);
1210
1211         return NT_STATUS_OK;
1212 }
1213
1214 static NTSTATUS becomeDC_ldap1_site_object(struct libnet_BecomeDC_state *s)
1215 {
1216         int ret;
1217         struct ldb_result *r;
1218         struct ldb_dn *basedn;
1219
1220         basedn = ldb_dn_new_fmt(s, s->ldap1.ldb, "CN=%s,CN=Sites,%s",
1221                                 s->dest_dsa.site_name,
1222                                 s->forest.config_dn_str);
1223         NT_STATUS_HAVE_NO_MEMORY(basedn);
1224
1225         ret = ldb_search(s->ldap1.ldb, s, &r, basedn, LDB_SCOPE_BASE,
1226                          NULL, "(objectClass=*)");
1227         talloc_free(basedn);
1228         if (ret != LDB_SUCCESS) {
1229                 return NT_STATUS_LDAP(ret);
1230         } else if (r->count != 1) {
1231                 talloc_free(r);
1232                 return NT_STATUS_INVALID_NETWORK_RESPONSE;
1233         }
1234
1235         s->dest_dsa.site_guid = samdb_result_guid(r->msgs[0], "objectGUID");
1236
1237         talloc_free(r);
1238         return NT_STATUS_OK;
1239 }
1240
1241 static NTSTATUS becomeDC_check_options(struct libnet_BecomeDC_state *s)
1242 {
1243         if (!s->callbacks.check_options) return NT_STATUS_OK;
1244
1245         s->_co.domain           = &s->domain;
1246         s->_co.forest           = &s->forest;
1247         s->_co.source_dsa       = &s->source_dsa;
1248
1249         return s->callbacks.check_options(s->callbacks.private_data, &s->_co);
1250 }
1251
1252 static NTSTATUS becomeDC_ldap1_computer_object(struct libnet_BecomeDC_state *s)
1253 {
1254         int ret;
1255         struct ldb_result *r;
1256         struct ldb_dn *basedn;
1257         static const char *attrs[] = {
1258                 "distinguishedName",
1259                 "userAccountControl",
1260                 NULL
1261         };
1262
1263         basedn = ldb_dn_new(s, s->ldap1.ldb, s->domain.dn_str);
1264         NT_STATUS_HAVE_NO_MEMORY(basedn);
1265
1266         ret = ldb_search(s->ldap1.ldb, s, &r, basedn, LDB_SCOPE_SUBTREE, attrs,
1267                          "(&(|(objectClass=user)(objectClass=computer))(sAMAccountName=%s$))",
1268                          s->dest_dsa.netbios_name);
1269         talloc_free(basedn);
1270         if (ret != LDB_SUCCESS) {
1271                 return NT_STATUS_LDAP(ret);
1272         } else if (r->count != 1) {
1273                 talloc_free(r);
1274                 return NT_STATUS_INVALID_NETWORK_RESPONSE;
1275         }
1276
1277         s->dest_dsa.computer_dn_str     = samdb_result_string(r->msgs[0], "distinguishedName", NULL);
1278         if (!s->dest_dsa.computer_dn_str) return NT_STATUS_INVALID_NETWORK_RESPONSE;
1279         talloc_steal(s, s->dest_dsa.computer_dn_str);
1280
1281         s->dest_dsa.user_account_control = samdb_result_uint(r->msgs[0], "userAccountControl", 0);
1282
1283         talloc_free(r);
1284         return NT_STATUS_OK;
1285 }
1286
1287 static NTSTATUS becomeDC_ldap1_server_object_1(struct libnet_BecomeDC_state *s)
1288 {
1289         int ret;
1290         struct ldb_result *r;
1291         struct ldb_dn *basedn;
1292         const char *server_reference_dn_str;
1293         struct ldb_dn *server_reference_dn;
1294         struct ldb_dn *computer_dn;
1295
1296         basedn = ldb_dn_new_fmt(s, s->ldap1.ldb, "CN=%s,CN=Servers,CN=%s,CN=Sites,%s",
1297                                 s->dest_dsa.netbios_name,
1298                                 s->dest_dsa.site_name,
1299                                 s->forest.config_dn_str);
1300         NT_STATUS_HAVE_NO_MEMORY(basedn);
1301
1302         ret = ldb_search(s->ldap1.ldb, s, &r, basedn, LDB_SCOPE_BASE,
1303                          NULL, "(objectClass=*)");
1304         talloc_free(basedn);
1305         if (ret == LDB_ERR_NO_SUCH_OBJECT) {
1306                 /* if the object doesn't exist, we'll create it later */
1307                 return NT_STATUS_OK;
1308         } else if (ret != LDB_SUCCESS) {
1309                 return NT_STATUS_LDAP(ret);
1310         } else if (r->count != 1) {
1311                 talloc_free(r);
1312                 return NT_STATUS_INVALID_NETWORK_RESPONSE;
1313         }
1314
1315         server_reference_dn_str = samdb_result_string(r->msgs[0], "serverReference", NULL);
1316         if (server_reference_dn_str) {
1317                 server_reference_dn     = ldb_dn_new(r, s->ldap1.ldb, server_reference_dn_str);
1318                 NT_STATUS_HAVE_NO_MEMORY(server_reference_dn);
1319
1320                 computer_dn             = ldb_dn_new(r, s->ldap1.ldb, s->dest_dsa.computer_dn_str);
1321                 NT_STATUS_HAVE_NO_MEMORY(computer_dn);
1322
1323                 /*
1324                  * if the server object belongs to another DC in another domain
1325                  * in the forest, we should not touch this object!
1326                  */
1327                 if (ldb_dn_compare(computer_dn, server_reference_dn) != 0) {
1328                         talloc_free(r);
1329                         return NT_STATUS_OBJECT_NAME_COLLISION;
1330                 }
1331         }
1332
1333         /* if the server object is already for the dest_dsa, then we don't need to create it */
1334         s->dest_dsa.server_dn_str       = samdb_result_string(r->msgs[0], "distinguishedName", NULL);
1335         if (!s->dest_dsa.server_dn_str) return NT_STATUS_INVALID_NETWORK_RESPONSE;
1336         talloc_steal(s, s->dest_dsa.server_dn_str);
1337
1338         talloc_free(r);
1339         return NT_STATUS_OK;
1340 }
1341
1342 static NTSTATUS becomeDC_ldap1_server_object_2(struct libnet_BecomeDC_state *s)
1343 {
1344         int ret;
1345         struct ldb_result *r;
1346         struct ldb_dn *basedn;
1347         const char *server_reference_bl_dn_str;
1348         static const char *attrs[] = {
1349                 "serverReferenceBL",
1350                 NULL
1351         };
1352
1353         /* if the server_dn_str has a valid value, we skip this lookup */
1354         if (s->dest_dsa.server_dn_str) return NT_STATUS_OK;
1355
1356         basedn = ldb_dn_new(s, s->ldap1.ldb, s->dest_dsa.computer_dn_str);
1357         NT_STATUS_HAVE_NO_MEMORY(basedn);
1358
1359         ret = ldb_search(s->ldap1.ldb, s, &r, basedn, LDB_SCOPE_BASE,
1360                          attrs, "(objectClass=*)");
1361         talloc_free(basedn);
1362         if (ret != LDB_SUCCESS) {
1363                 return NT_STATUS_LDAP(ret);
1364         } else if (r->count != 1) {
1365                 talloc_free(r);
1366                 return NT_STATUS_INVALID_NETWORK_RESPONSE;
1367         }
1368
1369         server_reference_bl_dn_str = samdb_result_string(r->msgs[0], "serverReferenceBL", NULL);
1370         if (!server_reference_bl_dn_str) {
1371                 /* if no back link is present, we're done for this function */
1372                 talloc_free(r);
1373                 return NT_STATUS_OK;
1374         }
1375
1376         /* if the server object is already for the dest_dsa, then we don't need to create it */
1377         s->dest_dsa.server_dn_str       = samdb_result_string(r->msgs[0], "serverReferenceBL", NULL);
1378         if (s->dest_dsa.server_dn_str) {
1379                 /* if a back link is present, we know that the server object is present */
1380                 talloc_steal(s, s->dest_dsa.server_dn_str);
1381         }
1382
1383         talloc_free(r);
1384         return NT_STATUS_OK;
1385 }
1386
1387 static NTSTATUS becomeDC_ldap1_server_object_add(struct libnet_BecomeDC_state *s)
1388 {
1389         int ret;
1390         struct ldb_message *msg;
1391         char *server_dn_str;
1392
1393         /* if the server_dn_str has a valid value, we skip this lookup */
1394         if (s->dest_dsa.server_dn_str) return NT_STATUS_OK;
1395
1396         msg = ldb_msg_new(s);
1397         NT_STATUS_HAVE_NO_MEMORY(msg);
1398
1399         msg->dn = ldb_dn_new_fmt(msg, s->ldap1.ldb, "CN=%s,CN=Servers,CN=%s,CN=Sites,%s",
1400                                  s->dest_dsa.netbios_name,
1401                                  s->dest_dsa.site_name,
1402                                  s->forest.config_dn_str);
1403         NT_STATUS_HAVE_NO_MEMORY(msg->dn);
1404
1405         ret = ldb_msg_add_string(msg, "objectClass", "server");
1406         if (ret != 0) {
1407                 talloc_free(msg);
1408                 return NT_STATUS_NO_MEMORY;
1409         }
1410         ret = ldb_msg_add_string(msg, "systemFlags", "50000000");
1411         if (ret != 0) {
1412                 talloc_free(msg);
1413                 return NT_STATUS_NO_MEMORY;
1414         }
1415         ret = ldb_msg_add_string(msg, "serverReference", s->dest_dsa.computer_dn_str);
1416         if (ret != 0) {
1417                 talloc_free(msg);
1418                 return NT_STATUS_NO_MEMORY;
1419         }
1420
1421         server_dn_str = ldb_dn_alloc_linearized(s, msg->dn);
1422         NT_STATUS_HAVE_NO_MEMORY(server_dn_str);
1423
1424         ret = ldb_add(s->ldap1.ldb, msg);
1425         talloc_free(msg);
1426         if (ret != LDB_SUCCESS) {
1427                 talloc_free(server_dn_str);
1428                 return NT_STATUS_LDAP(ret);
1429         }
1430
1431         s->dest_dsa.server_dn_str = server_dn_str;
1432
1433         return NT_STATUS_OK;
1434 }
1435
1436 static NTSTATUS becomeDC_ldap1_server_object_modify(struct libnet_BecomeDC_state *s)
1437 {
1438         int ret;
1439         struct ldb_message *msg;
1440         uint32_t i;
1441
1442         /* make a 'modify' msg, and only for serverReference */
1443         msg = ldb_msg_new(s);
1444         NT_STATUS_HAVE_NO_MEMORY(msg);
1445         msg->dn = ldb_dn_new(msg, s->ldap1.ldb, s->dest_dsa.server_dn_str);
1446         NT_STATUS_HAVE_NO_MEMORY(msg->dn);
1447
1448         ret = ldb_msg_add_string(msg, "serverReference", s->dest_dsa.computer_dn_str);
1449         if (ret != 0) {
1450                 talloc_free(msg);
1451                 return NT_STATUS_NO_MEMORY;
1452         }
1453
1454         /* mark all the message elements (should be just one)
1455            as LDB_FLAG_MOD_ADD */
1456         for (i=0;i<msg->num_elements;i++) {
1457                 msg->elements[i].flags = LDB_FLAG_MOD_ADD;
1458         }
1459
1460         ret = ldb_modify(s->ldap1.ldb, msg);
1461         if (ret == LDB_SUCCESS) {
1462                 talloc_free(msg);
1463                 return NT_STATUS_OK;
1464         } else if (ret == LDB_ERR_ATTRIBUTE_OR_VALUE_EXISTS) {
1465                 /* retry with LDB_FLAG_MOD_REPLACE */
1466         } else {
1467                 talloc_free(msg);
1468                 return NT_STATUS_LDAP(ret);
1469         }
1470
1471         /* mark all the message elements (should be just one)
1472            as LDB_FLAG_MOD_REPLACE */
1473         for (i=0;i<msg->num_elements;i++) {
1474                 msg->elements[i].flags = LDB_FLAG_MOD_REPLACE;
1475         }
1476
1477         ret = ldb_modify(s->ldap1.ldb, msg);
1478         talloc_free(msg);
1479         if (ret != LDB_SUCCESS) {
1480                 return NT_STATUS_LDAP(ret);
1481         }
1482
1483         return NT_STATUS_OK;
1484 }
1485
1486 static void becomeDC_drsuapi_connect_send(struct libnet_BecomeDC_state *s,
1487                                           struct becomeDC_drsuapi *drsuapi,
1488                                           void (*recv_fn)(struct composite_context *req));
1489 static void becomeDC_drsuapi1_connect_recv(struct composite_context *req);
1490 static void becomeDC_connect_ldap2(struct libnet_BecomeDC_state *s);
1491
1492 static void becomeDC_connect_ldap1(struct libnet_BecomeDC_state *s)
1493 {
1494         struct composite_context *c = s->creq;
1495
1496         c->status = becomeDC_ldap_connect(s, &s->ldap1);
1497         if (!composite_is_ok(c)) return;
1498
1499         c->status = becomeDC_ldap1_rootdse(s);
1500         if (!composite_is_ok(c)) return;
1501
1502         c->status = becomeDC_ldap1_crossref_behavior_version(s);
1503         if (!composite_is_ok(c)) return;
1504
1505         c->status = becomeDC_ldap1_domain_behavior_version(s);
1506         if (!composite_is_ok(c)) return;
1507
1508         c->status = becomeDC_ldap1_schema_object_version(s);
1509         if (!composite_is_ok(c)) return;
1510
1511         c->status = becomeDC_ldap1_w2k3_update_revision(s);
1512         if (!composite_is_ok(c)) return;
1513
1514         c->status = becomeDC_ldap1_infrastructure_fsmo(s);
1515         if (!composite_is_ok(c)) return;
1516
1517         c->status = becomeDC_ldap1_rid_manager_fsmo(s);
1518         if (!composite_is_ok(c)) return;
1519
1520         c->status = becomeDC_ldap1_site_object(s);
1521         if (!composite_is_ok(c)) return;
1522
1523         c->status = becomeDC_check_options(s);
1524         if (!composite_is_ok(c)) return;
1525
1526         c->status = becomeDC_ldap1_computer_object(s);
1527         if (!composite_is_ok(c)) return;
1528
1529         c->status = becomeDC_ldap1_server_object_1(s);
1530         if (!composite_is_ok(c)) return;
1531
1532         c->status = becomeDC_ldap1_server_object_2(s);
1533         if (!composite_is_ok(c)) return;
1534
1535         c->status = becomeDC_ldap1_server_object_add(s);
1536         if (!composite_is_ok(c)) return;
1537
1538         c->status = becomeDC_ldap1_server_object_modify(s);
1539         if (!composite_is_ok(c)) return;
1540
1541         becomeDC_drsuapi_connect_send(s, &s->drsuapi1, becomeDC_drsuapi1_connect_recv);
1542 }
1543
1544 static void becomeDC_drsuapi_connect_send(struct libnet_BecomeDC_state *s,
1545                                           struct becomeDC_drsuapi *drsuapi,
1546                                           void (*recv_fn)(struct composite_context *req))
1547 {
1548         struct composite_context *c = s->creq;
1549         struct composite_context *creq;
1550         char *binding_str;
1551
1552         drsuapi->s = s;
1553
1554         if (!drsuapi->binding) {
1555                 const char *krb5_str = "";
1556                 const char *print_str = "";
1557                 /*
1558                  * Note: Replication only works with Windows 2000 when 'krb5' is
1559                  *       passed as auth_type here. If NTLMSSP is used, Windows
1560                  *       2000 returns garbage in the DsGetNCChanges() response
1561                  *       if encrypted password attributes would be in the
1562                  *       response. That means the replication of the schema and
1563                  *       configuration partition works fine, but it fails for
1564                  *       the domain partition.
1565                  */
1566                 if (lp_parm_bool(s->libnet->lp_ctx, NULL, "become_dc",
1567                                  "force krb5", true))
1568                 {
1569                         krb5_str = "krb5,";
1570                 }
1571                 if (lp_parm_bool(s->libnet->lp_ctx, NULL, "become_dc",
1572                                  "print", false))
1573                 {
1574                         print_str = "print,";
1575                 }
1576                 binding_str = talloc_asprintf(s, "ncacn_ip_tcp:%s[%s%sseal]",
1577                                               s->source_dsa.dns_name,
1578                                               krb5_str, print_str);
1579                 if (composite_nomem(binding_str, c)) return;
1580                 c->status = dcerpc_parse_binding(s, binding_str, &drsuapi->binding);
1581                 talloc_free(binding_str);
1582                 if (!composite_is_ok(c)) return;
1583         }
1584
1585         creq = dcerpc_pipe_connect_b_send(s, drsuapi->binding, &ndr_table_drsuapi,
1586                                           s->libnet->cred, s->libnet->event_ctx,
1587                                           s->libnet->lp_ctx);
1588         composite_continue(c, creq, recv_fn, s);
1589 }
1590
1591 static void becomeDC_drsuapi_bind_send(struct libnet_BecomeDC_state *s,
1592                                        struct becomeDC_drsuapi *drsuapi,
1593                                        void (*recv_fn)(struct rpc_request *req));
1594 static void becomeDC_drsuapi1_bind_recv(struct rpc_request *req);
1595
1596 static void becomeDC_drsuapi1_connect_recv(struct composite_context *req)
1597 {
1598         struct libnet_BecomeDC_state *s = talloc_get_type(req->async.private_data,
1599                                           struct libnet_BecomeDC_state);
1600         struct composite_context *c = s->creq;
1601
1602         c->status = dcerpc_pipe_connect_b_recv(req, s, &s->drsuapi1.pipe);
1603         if (!composite_is_ok(c)) return;
1604
1605         c->status = gensec_session_key(s->drsuapi1.pipe->conn->security_state.generic_state,
1606                                        &s->drsuapi1.gensec_skey);
1607         if (!composite_is_ok(c)) return;
1608
1609         becomeDC_drsuapi_bind_send(s, &s->drsuapi1, becomeDC_drsuapi1_bind_recv);
1610 }
1611
1612 static void becomeDC_drsuapi_bind_send(struct libnet_BecomeDC_state *s,
1613                                        struct becomeDC_drsuapi *drsuapi,
1614                                        void (*recv_fn)(struct rpc_request *req))
1615 {
1616         struct composite_context *c = s->creq;
1617         struct rpc_request *req;
1618         struct drsuapi_DsBindInfo28 *bind_info28;
1619
1620         GUID_from_string(DRSUAPI_DS_BIND_GUID_W2K3, &drsuapi->bind_guid);
1621
1622         bind_info28                             = &drsuapi->local_info28;
1623         bind_info28->supported_extensions       |= DRSUAPI_SUPPORTED_EXTENSION_BASE;
1624         bind_info28->supported_extensions       |= DRSUAPI_SUPPORTED_EXTENSION_ASYNC_REPLICATION;
1625         bind_info28->supported_extensions       |= DRSUAPI_SUPPORTED_EXTENSION_REMOVEAPI;
1626         bind_info28->supported_extensions       |= DRSUAPI_SUPPORTED_EXTENSION_MOVEREQ_V2;
1627         bind_info28->supported_extensions       |= DRSUAPI_SUPPORTED_EXTENSION_GETCHG_COMPRESS;
1628         bind_info28->supported_extensions       |= DRSUAPI_SUPPORTED_EXTENSION_DCINFO_V1;
1629         bind_info28->supported_extensions       |= DRSUAPI_SUPPORTED_EXTENSION_RESTORE_USN_OPTIMIZATION;
1630         bind_info28->supported_extensions       |= DRSUAPI_SUPPORTED_EXTENSION_KCC_EXECUTE;
1631         bind_info28->supported_extensions       |= DRSUAPI_SUPPORTED_EXTENSION_ADDENTRY_V2;
1632         if (s->domain.behavior_version >= DS_DOMAIN_FUNCTION_2003) {
1633                 /* TODO: find out how this is really triggered! */
1634                 bind_info28->supported_extensions       |= DRSUAPI_SUPPORTED_EXTENSION_LINKED_VALUE_REPLICATION;
1635         }
1636         bind_info28->supported_extensions       |= DRSUAPI_SUPPORTED_EXTENSION_DCINFO_V2;
1637         bind_info28->supported_extensions       |= DRSUAPI_SUPPORTED_EXTENSION_INSTANCE_TYPE_NOT_REQ_ON_MOD;
1638         bind_info28->supported_extensions       |= DRSUAPI_SUPPORTED_EXTENSION_CRYPTO_BIND;
1639         bind_info28->supported_extensions       |= DRSUAPI_SUPPORTED_EXTENSION_GET_REPL_INFO;
1640         bind_info28->supported_extensions       |= DRSUAPI_SUPPORTED_EXTENSION_STRONG_ENCRYPTION;
1641         bind_info28->supported_extensions       |= DRSUAPI_SUPPORTED_EXTENSION_DCINFO_V01;
1642         bind_info28->supported_extensions       |= DRSUAPI_SUPPORTED_EXTENSION_TRANSITIVE_MEMBERSHIP;
1643         bind_info28->supported_extensions       |= DRSUAPI_SUPPORTED_EXTENSION_ADD_SID_HISTORY;
1644         bind_info28->supported_extensions       |= DRSUAPI_SUPPORTED_EXTENSION_POST_BETA3;
1645         bind_info28->supported_extensions       |= DRSUAPI_SUPPORTED_EXTENSION_GETCHGREQ_V5;
1646         bind_info28->supported_extensions       |= DRSUAPI_SUPPORTED_EXTENSION_GET_MEMBERSHIPS2;
1647         bind_info28->supported_extensions       |= DRSUAPI_SUPPORTED_EXTENSION_GETCHGREQ_V6;
1648         bind_info28->supported_extensions       |= DRSUAPI_SUPPORTED_EXTENSION_NONDOMAIN_NCS;
1649         bind_info28->supported_extensions       |= DRSUAPI_SUPPORTED_EXTENSION_GETCHGREQ_V8;
1650         bind_info28->supported_extensions       |= DRSUAPI_SUPPORTED_EXTENSION_GETCHGREPLY_V5;
1651         bind_info28->supported_extensions       |= DRSUAPI_SUPPORTED_EXTENSION_GETCHGREPLY_V6;
1652         bind_info28->supported_extensions       |= DRSUAPI_SUPPORTED_EXTENSION_ADDENTRYREPLY_V3;
1653         bind_info28->supported_extensions       |= DRSUAPI_SUPPORTED_EXTENSION_GETCHGREPLY_V7;
1654         bind_info28->supported_extensions       |= DRSUAPI_SUPPORTED_EXTENSION_VERIFY_OBJECT;
1655 #if 0 /* we don't support XPRESS compression yet */
1656         bind_info28->supported_extensions       |= DRSUAPI_SUPPORTED_EXTENSION_XPRESS_COMPRESS;
1657 #endif
1658         bind_info28->site_guid                  = s->dest_dsa.site_guid;
1659         bind_info28->pid                        = 0;
1660         bind_info28->repl_epoch                 = 0;
1661
1662         drsuapi->bind_info_ctr.length           = 28;
1663         drsuapi->bind_info_ctr.info.info28      = *bind_info28;
1664
1665         drsuapi->bind_r.in.bind_guid = &drsuapi->bind_guid;
1666         drsuapi->bind_r.in.bind_info = &drsuapi->bind_info_ctr;
1667         drsuapi->bind_r.out.bind_handle = &drsuapi->bind_handle;
1668
1669         req = dcerpc_drsuapi_DsBind_send(drsuapi->pipe, s, &drsuapi->bind_r);
1670         composite_continue_rpc(c, req, recv_fn, s);
1671 }
1672
1673 static WERROR becomeDC_drsuapi_bind_recv(struct libnet_BecomeDC_state *s,
1674                                          struct becomeDC_drsuapi *drsuapi)
1675 {
1676         if (!W_ERROR_IS_OK(drsuapi->bind_r.out.result)) {
1677                 return drsuapi->bind_r.out.result;
1678         }
1679
1680         ZERO_STRUCT(drsuapi->remote_info28);
1681         if (drsuapi->bind_r.out.bind_info) {
1682                 switch (drsuapi->bind_r.out.bind_info->length) {
1683                 case 24: {
1684                         struct drsuapi_DsBindInfo24 *info24;
1685                         info24 = &drsuapi->bind_r.out.bind_info->info.info24;
1686                         drsuapi->remote_info28.supported_extensions     = info24->supported_extensions;
1687                         drsuapi->remote_info28.site_guid                = info24->site_guid;
1688                         drsuapi->remote_info28.pid                      = info24->pid;
1689                         drsuapi->remote_info28.repl_epoch               = 0;
1690                         break;
1691                 }
1692                 case 48: {
1693                         struct drsuapi_DsBindInfo48 *info48;
1694                         info48 = &drsuapi->bind_r.out.bind_info->info.info48;
1695                         drsuapi->remote_info28.supported_extensions     = info48->supported_extensions;
1696                         drsuapi->remote_info28.site_guid                = info48->site_guid;
1697                         drsuapi->remote_info28.pid                      = info48->pid;
1698                         drsuapi->remote_info28.repl_epoch               = info48->repl_epoch;
1699                         break;
1700                 }
1701                 case 28:
1702                         drsuapi->remote_info28 = drsuapi->bind_r.out.bind_info->info.info28;
1703                         break;
1704                 }
1705         }
1706
1707         return WERR_OK;
1708 }
1709
1710 static void becomeDC_drsuapi1_add_entry_send(struct libnet_BecomeDC_state *s);
1711
1712 static void becomeDC_drsuapi1_bind_recv(struct rpc_request *req)
1713 {
1714         struct libnet_BecomeDC_state *s = talloc_get_type(req->async.private_data,
1715                                           struct libnet_BecomeDC_state);
1716         struct composite_context *c = s->creq;
1717         WERROR status;
1718
1719         c->status = dcerpc_drsuapi_DsBind_recv(req);
1720         if (!composite_is_ok(c)) return;
1721
1722         status = becomeDC_drsuapi_bind_recv(s, &s->drsuapi1);
1723         if (!W_ERROR_IS_OK(status)) {
1724                 composite_error(c, werror_to_ntstatus(status));
1725                 return;
1726         }
1727
1728         becomeDC_drsuapi1_add_entry_send(s);
1729 }
1730
1731 static void becomeDC_drsuapi1_add_entry_recv(struct rpc_request *req);
1732
1733 static void becomeDC_drsuapi1_add_entry_send(struct libnet_BecomeDC_state *s)
1734 {
1735         struct composite_context *c = s->creq;
1736         struct rpc_request *req;
1737         struct drsuapi_DsAddEntry *r;
1738         struct drsuapi_DsReplicaObjectIdentifier *identifier;
1739         uint32_t num_attrs, i = 0;
1740         struct drsuapi_DsReplicaAttribute *attrs;
1741         struct smb_iconv_convenience *iconv_convenience = lp_iconv_convenience(s->libnet->lp_ctx);
1742         enum ndr_err_code ndr_err;
1743         bool w2k3;
1744
1745         /* choose a random invocationId */
1746         s->dest_dsa.invocation_id = GUID_random();
1747
1748         /*
1749          * if the schema version indicates w2k3, then also send some w2k3
1750          * specific attributes.
1751          */
1752         if (s->forest.schema_object_version >= 30) {
1753                 w2k3 = true;
1754         } else {
1755                 w2k3 = false;
1756         }
1757
1758         r = talloc_zero(s, struct drsuapi_DsAddEntry);
1759         if (composite_nomem(r, c)) return;
1760
1761         /* setup identifier */
1762         identifier              = talloc(r, struct drsuapi_DsReplicaObjectIdentifier);
1763         if (composite_nomem(identifier, c)) return;
1764         identifier->guid        = GUID_zero();
1765         identifier->sid         = s->zero_sid;
1766         identifier->dn          = talloc_asprintf(identifier, "CN=NTDS Settings,%s",
1767                                                   s->dest_dsa.server_dn_str);
1768         if (composite_nomem(identifier->dn, c)) return;
1769
1770         /* allocate attribute array */
1771         num_attrs       = 12;
1772         attrs           = talloc_array(r, struct drsuapi_DsReplicaAttribute, num_attrs);
1773         if (composite_nomem(attrs, c)) return;
1774
1775         /* ntSecurityDescriptor */
1776         {
1777                 struct drsuapi_DsAttributeValue *vs;
1778                 DATA_BLOB *vd;
1779                 struct security_descriptor *v;
1780                 struct dom_sid *domain_admins_sid;
1781                 const char *domain_admins_sid_str;
1782
1783                 vs = talloc_array(attrs, struct drsuapi_DsAttributeValue, 1);
1784                 if (composite_nomem(vs, c)) return;
1785
1786                 vd = talloc_array(vs, DATA_BLOB, 1);
1787                 if (composite_nomem(vd, c)) return;
1788
1789                 domain_admins_sid = dom_sid_add_rid(vs, s->domain.sid, DOMAIN_RID_ADMINS);
1790                 if (composite_nomem(domain_admins_sid, c)) return;
1791
1792                 domain_admins_sid_str = dom_sid_string(domain_admins_sid, domain_admins_sid);
1793                 if (composite_nomem(domain_admins_sid_str, c)) return;
1794
1795                 v = security_descriptor_dacl_create(vd,
1796                                                0,
1797                                                /* owner: domain admins */
1798                                                domain_admins_sid_str,
1799                                                /* owner group: domain admins */
1800                                                domain_admins_sid_str,
1801                                                /* authenticated users */
1802                                                SID_NT_AUTHENTICATED_USERS,
1803                                                SEC_ACE_TYPE_ACCESS_ALLOWED,
1804                                                SEC_STD_READ_CONTROL |
1805                                                SEC_ADS_LIST |
1806                                                SEC_ADS_READ_PROP |
1807                                                SEC_ADS_LIST_OBJECT,
1808                                                0,
1809                                                /* domain admins */
1810                                                domain_admins_sid_str,
1811                                                SEC_ACE_TYPE_ACCESS_ALLOWED,
1812                                                SEC_STD_REQUIRED |
1813                                                SEC_ADS_CREATE_CHILD |
1814                                                SEC_ADS_LIST |
1815                                                SEC_ADS_SELF_WRITE |
1816                                                SEC_ADS_READ_PROP |
1817                                                SEC_ADS_WRITE_PROP |
1818                                                SEC_ADS_DELETE_TREE |
1819                                                SEC_ADS_LIST_OBJECT |
1820                                                SEC_ADS_CONTROL_ACCESS,
1821                                                0,
1822                                                /* system */
1823                                                SID_NT_SYSTEM,
1824                                                SEC_ACE_TYPE_ACCESS_ALLOWED,
1825                                                SEC_STD_REQUIRED |
1826                                                SEC_ADS_CREATE_CHILD |
1827                                                SEC_ADS_DELETE_CHILD |
1828                                                SEC_ADS_LIST |
1829                                                SEC_ADS_SELF_WRITE |
1830                                                SEC_ADS_READ_PROP |
1831                                                SEC_ADS_WRITE_PROP |
1832                                                SEC_ADS_DELETE_TREE |
1833                                                SEC_ADS_LIST_OBJECT |
1834                                                SEC_ADS_CONTROL_ACCESS,
1835                                                0,
1836                                                /* end */
1837                                                NULL);
1838                 if (composite_nomem(v, c)) return;
1839
1840                 ndr_err = ndr_push_struct_blob(&vd[0], vd, iconv_convenience, v,(ndr_push_flags_fn_t)ndr_push_security_descriptor);
1841                 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
1842                         c->status = ndr_map_error2ntstatus(ndr_err);
1843                         if (!composite_is_ok(c)) return;
1844                 }
1845
1846                 vs[0].blob              = &vd[0];
1847
1848                 attrs[i].attid                  = DRSUAPI_ATTRIBUTE_ntSecurityDescriptor;
1849                 attrs[i].value_ctr.num_values   = 1;
1850                 attrs[i].value_ctr.values       = vs;
1851
1852                 i++;
1853         }
1854
1855         /* objectClass: nTDSDSA */
1856         {
1857                 struct drsuapi_DsAttributeValue *vs;
1858                 DATA_BLOB *vd;
1859
1860                 vs = talloc_array(attrs, struct drsuapi_DsAttributeValue, 1);
1861                 if (composite_nomem(vs, c)) return;
1862
1863                 vd = talloc_array(vs, DATA_BLOB, 1);
1864                 if (composite_nomem(vd, c)) return;
1865
1866                 vd[0] = data_blob_talloc(vd, NULL, 4);
1867                 if (composite_nomem(vd[0].data, c)) return;
1868
1869                 /* value for nTDSDSA */
1870                 SIVAL(vd[0].data, 0, 0x0017002F);
1871
1872                 vs[0].blob              = &vd[0];
1873
1874                 attrs[i].attid                  = DRSUAPI_ATTRIBUTE_objectClass;
1875                 attrs[i].value_ctr.num_values   = 1;
1876                 attrs[i].value_ctr.values       = vs;
1877
1878                 i++;
1879         }
1880
1881         /* objectCategory: CN=NTDS-DSA,CN=Schema,... or CN=NTDS-DSA-RO,CN=Schema,... */
1882         {
1883                 struct drsuapi_DsAttributeValue *vs;
1884                 DATA_BLOB *vd;
1885                 struct drsuapi_DsReplicaObjectIdentifier3 v[1];
1886
1887                 vs = talloc_array(attrs, struct drsuapi_DsAttributeValue, 1);
1888                 if (composite_nomem(vs, c)) return;
1889
1890                 vd = talloc_array(vs, DATA_BLOB, 1);
1891                 if (composite_nomem(vd, c)) return;
1892
1893                 v[0].guid               = GUID_zero();
1894                 v[0].sid                = s->zero_sid;
1895
1896                 if (s->rodc_join) {
1897                     v[0].dn             = talloc_asprintf(vd, "CN=NTDS-DSA-RO,%s",
1898                                                           s->forest.schema_dn_str);
1899                 } else {
1900                     v[0].dn             = talloc_asprintf(vd, "CN=NTDS-DSA,%s",
1901                                                           s->forest.schema_dn_str);
1902                 }
1903                 if (composite_nomem(v[0].dn, c)) return;
1904
1905                 ndr_err = ndr_push_struct_blob(&vd[0], vd, iconv_convenience, &v[0],
1906                                                (ndr_push_flags_fn_t)ndr_push_drsuapi_DsReplicaObjectIdentifier3);
1907                 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
1908                         c->status = ndr_map_error2ntstatus(ndr_err);
1909                         if (!composite_is_ok(c)) return;
1910                 }
1911
1912                 vs[0].blob              = &vd[0];
1913
1914                 attrs[i].attid                  = DRSUAPI_ATTRIBUTE_objectCategory;
1915                 attrs[i].value_ctr.num_values   = 1;
1916                 attrs[i].value_ctr.values       = vs;
1917
1918                 i++;
1919         }
1920
1921         /* invocationId: random guid */
1922         {
1923                 struct drsuapi_DsAttributeValue *vs;
1924                 DATA_BLOB *vd;
1925                 const struct GUID *v;
1926
1927                 vs = talloc_array(attrs, struct drsuapi_DsAttributeValue, 1);
1928                 if (composite_nomem(vs, c)) return;
1929
1930                 vd = talloc_array(vs, DATA_BLOB, 1);
1931                 if (composite_nomem(vd, c)) return;
1932
1933                 v = &s->dest_dsa.invocation_id;
1934
1935                 c->status = GUID_to_ndr_blob(v, vd, &vd[0]);
1936                 if (!composite_is_ok(c)) return;
1937
1938                 vs[0].blob              = &vd[0];
1939
1940                 attrs[i].attid                  = DRSUAPI_ATTRIBUTE_invocationId;
1941                 attrs[i].value_ctr.num_values   = 1;
1942                 attrs[i].value_ctr.values       = vs;
1943
1944                 i++;
1945         }
1946
1947         /* hasMasterNCs: ... */
1948         {
1949                 struct drsuapi_DsAttributeValue *vs;
1950                 DATA_BLOB *vd;
1951                 struct drsuapi_DsReplicaObjectIdentifier3 v[3];
1952
1953                 vs = talloc_array(attrs, struct drsuapi_DsAttributeValue, 3);
1954                 if (composite_nomem(vs, c)) return;
1955
1956                 vd = talloc_array(vs, DATA_BLOB, 3);
1957                 if (composite_nomem(vd, c)) return;
1958
1959                 v[0].guid               = GUID_zero();
1960                 v[0].sid                = s->zero_sid;
1961                 v[0].dn                 = s->forest.config_dn_str;
1962
1963                 v[1].guid               = GUID_zero();
1964                 v[1].sid                = s->zero_sid;
1965                 v[1].dn                 = s->domain.dn_str;
1966
1967                 v[2].guid               = GUID_zero();
1968                 v[2].sid                = s->zero_sid;
1969                 v[2].dn                 = s->forest.schema_dn_str;
1970
1971                 ndr_err = ndr_push_struct_blob(&vd[0], vd, iconv_convenience, &v[0],
1972                                                (ndr_push_flags_fn_t)ndr_push_drsuapi_DsReplicaObjectIdentifier3);
1973                 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
1974                         c->status = ndr_map_error2ntstatus(ndr_err);
1975                         if (!composite_is_ok(c)) return;
1976                 }
1977
1978                 ndr_err = ndr_push_struct_blob(&vd[1], vd, iconv_convenience, &v[1],
1979                                                (ndr_push_flags_fn_t)ndr_push_drsuapi_DsReplicaObjectIdentifier3);
1980                 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
1981                         c->status = ndr_map_error2ntstatus(ndr_err);
1982                         if (!composite_is_ok(c)) return;
1983                 }
1984
1985                 ndr_err = ndr_push_struct_blob(&vd[2], vd, iconv_convenience, &v[2],
1986                                                (ndr_push_flags_fn_t)ndr_push_drsuapi_DsReplicaObjectIdentifier3);
1987                 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
1988                         c->status = ndr_map_error2ntstatus(ndr_err);
1989                         if (!composite_is_ok(c)) return;
1990                 }
1991
1992                 vs[0].blob              = &vd[0];
1993                 vs[1].blob              = &vd[1];
1994                 vs[2].blob              = &vd[2];
1995
1996                 attrs[i].attid                  = DRSUAPI_ATTRIBUTE_hasMasterNCs;
1997                 attrs[i].value_ctr.num_values   = 3;
1998                 attrs[i].value_ctr.values       = vs;
1999
2000                 i++;
2001         }
2002
2003         /* msDS-hasMasterNCs: ... */
2004         if (w2k3) {
2005                 struct drsuapi_DsAttributeValue *vs;
2006                 DATA_BLOB *vd;
2007                 struct drsuapi_DsReplicaObjectIdentifier3 v[3];
2008
2009                 vs = talloc_array(attrs, struct drsuapi_DsAttributeValue, 3);
2010                 if (composite_nomem(vs, c)) return;
2011
2012                 vd = talloc_array(vs, DATA_BLOB, 3);
2013                 if (composite_nomem(vd, c)) return;
2014
2015                 v[0].guid               = GUID_zero();
2016                 v[0].sid                = s->zero_sid;
2017                 v[0].dn                 = s->forest.config_dn_str;
2018
2019                 v[1].guid               = GUID_zero();
2020                 v[1].sid                = s->zero_sid;
2021                 v[1].dn                 = s->domain.dn_str;
2022
2023                 v[2].guid               = GUID_zero();
2024                 v[2].sid                = s->zero_sid;
2025                 v[2].dn                 = s->forest.schema_dn_str;
2026
2027                 ndr_err = ndr_push_struct_blob(&vd[0], vd, iconv_convenience, &v[0],
2028                                                (ndr_push_flags_fn_t)ndr_push_drsuapi_DsReplicaObjectIdentifier3);
2029                 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
2030                         c->status = ndr_map_error2ntstatus(ndr_err);
2031                         if (!composite_is_ok(c)) return;
2032                 }
2033
2034                 ndr_err = ndr_push_struct_blob(&vd[1], vd, iconv_convenience, &v[1],
2035                                                (ndr_push_flags_fn_t)ndr_push_drsuapi_DsReplicaObjectIdentifier3);
2036                 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
2037                         c->status = ndr_map_error2ntstatus(ndr_err);
2038                         if (!composite_is_ok(c)) return;
2039                 }
2040
2041                 ndr_err = ndr_push_struct_blob(&vd[2], vd, iconv_convenience, &v[2],
2042                                                (ndr_push_flags_fn_t)ndr_push_drsuapi_DsReplicaObjectIdentifier3);
2043                 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
2044                         c->status = ndr_map_error2ntstatus(ndr_err);
2045                         if (!composite_is_ok(c)) return;
2046                 }
2047
2048                 vs[0].blob              = &vd[0];
2049                 vs[1].blob              = &vd[1];
2050                 vs[2].blob              = &vd[2];
2051
2052                 attrs[i].attid                  = DRSUAPI_ATTRIBUTE_msDS_hasMasterNCs;
2053                 attrs[i].value_ctr.num_values   = 3;
2054                 attrs[i].value_ctr.values       = vs;
2055
2056                 i++;
2057         }
2058
2059         /* dMDLocation: CN=Schema,... */
2060         {
2061                 struct drsuapi_DsAttributeValue *vs;
2062                 DATA_BLOB *vd;
2063                 struct drsuapi_DsReplicaObjectIdentifier3 v[1];
2064
2065                 vs = talloc_array(attrs, struct drsuapi_DsAttributeValue, 1);
2066                 if (composite_nomem(vs, c)) return;
2067
2068                 vd = talloc_array(vs, DATA_BLOB, 1);
2069                 if (composite_nomem(vd, c)) return;
2070
2071                 v[0].guid               = GUID_zero();
2072                 v[0].sid                = s->zero_sid;
2073                 v[0].dn                 = s->forest.schema_dn_str;
2074
2075                 ndr_err = ndr_push_struct_blob(&vd[0], vd, iconv_convenience, &v[0],
2076                                                (ndr_push_flags_fn_t)ndr_push_drsuapi_DsReplicaObjectIdentifier3);
2077                 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
2078                         c->status = ndr_map_error2ntstatus(ndr_err);
2079                         if (!composite_is_ok(c)) return;
2080                 }
2081
2082                 vs[0].blob              = &vd[0];
2083
2084                 attrs[i].attid                  = DRSUAPI_ATTRIBUTE_dMDLocation;
2085                 attrs[i].value_ctr.num_values   = 1;
2086                 attrs[i].value_ctr.values       = vs;
2087
2088                 i++;
2089         }
2090
2091         /* msDS-HasDomainNCs: <domain_partition> */
2092         if (w2k3) {
2093                 struct drsuapi_DsAttributeValue *vs;
2094                 DATA_BLOB *vd;
2095                 struct drsuapi_DsReplicaObjectIdentifier3 v[1];
2096
2097                 vs = talloc_array(attrs, struct drsuapi_DsAttributeValue, 1);
2098                 if (composite_nomem(vs, c)) return;
2099
2100                 vd = talloc_array(vs, DATA_BLOB, 1);
2101                 if (composite_nomem(vd, c)) return;
2102
2103                 v[0].guid               = GUID_zero();
2104                 v[0].sid                = s->zero_sid;
2105                 v[0].dn                 = s->domain.dn_str;
2106
2107                 ndr_err = ndr_push_struct_blob(&vd[0], vd, iconv_convenience, &v[0],
2108                                                (ndr_push_flags_fn_t)ndr_push_drsuapi_DsReplicaObjectIdentifier3);
2109                 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
2110                         c->status = ndr_map_error2ntstatus(ndr_err);
2111                         if (!composite_is_ok(c)) return;
2112                 }
2113
2114                 vs[0].blob              = &vd[0];
2115
2116                 attrs[i].attid                  = DRSUAPI_ATTRIBUTE_msDS_HasDomainNCs;
2117                 attrs[i].value_ctr.num_values   = 1;
2118                 attrs[i].value_ctr.values       = vs;
2119
2120                 i++;
2121         }
2122
2123         /* msDS-Behavior-Version */
2124         if (w2k3) {
2125                 struct drsuapi_DsAttributeValue *vs;
2126                 DATA_BLOB *vd;
2127
2128                 vs = talloc_array(attrs, struct drsuapi_DsAttributeValue, 1);
2129                 if (composite_nomem(vs, c)) return;
2130
2131                 vd = talloc_array(vs, DATA_BLOB, 1);
2132                 if (composite_nomem(vd, c)) return;
2133
2134                 vd[0] = data_blob_talloc(vd, NULL, 4);
2135                 if (composite_nomem(vd[0].data, c)) return;
2136
2137                 SIVAL(vd[0].data, 0, get_dc_function_level(s->libnet->lp_ctx));
2138
2139                 vs[0].blob              = &vd[0];
2140
2141                 attrs[i].attid                  = DRSUAPI_ATTRIBUTE_msDS_Behavior_Version;
2142                 attrs[i].value_ctr.num_values   = 1;
2143                 attrs[i].value_ctr.values       = vs;
2144
2145                 i++;
2146         }
2147
2148         /* systemFlags */
2149         {
2150                 struct drsuapi_DsAttributeValue *vs;
2151                 DATA_BLOB *vd;
2152
2153                 vs = talloc_array(attrs, struct drsuapi_DsAttributeValue, 1);
2154                 if (composite_nomem(vs, c)) return;
2155
2156                 vd = talloc_array(vs, DATA_BLOB, 1);
2157                 if (composite_nomem(vd, c)) return;
2158
2159                 vd[0] = data_blob_talloc(vd, NULL, 4);
2160                 if (composite_nomem(vd[0].data, c)) return;
2161
2162                 if (s->rodc_join) {
2163                     SIVAL(vd[0].data, 0, SYSTEM_FLAG_CONFIG_ALLOW_RENAME);
2164                 } else {
2165                     SIVAL(vd[0].data, 0, SYSTEM_FLAG_DISALLOW_MOVE_ON_DELETE);
2166                 }
2167
2168                 vs[0].blob              = &vd[0];
2169
2170                 attrs[i].attid                  = DRSUAPI_ATTRIBUTE_systemFlags;
2171                 attrs[i].value_ctr.num_values   = 1;
2172                 attrs[i].value_ctr.values       = vs;
2173
2174                 i++;
2175         }
2176
2177         /* serverReference: ... */
2178         {
2179                 struct drsuapi_DsAttributeValue *vs;
2180                 DATA_BLOB *vd;
2181                 struct drsuapi_DsReplicaObjectIdentifier3 v[1];
2182
2183                 vs = talloc_array(attrs, struct drsuapi_DsAttributeValue, 1);
2184                 if (composite_nomem(vs, c)) return;
2185
2186                 vd = talloc_array(vs, DATA_BLOB, 1);
2187                 if (composite_nomem(vd, c)) return;
2188
2189                 v[0].guid               = GUID_zero();
2190                 v[0].sid                = s->zero_sid;
2191                 v[0].dn                 = s->dest_dsa.computer_dn_str;
2192
2193                 ndr_err = ndr_push_struct_blob(&vd[0], vd, iconv_convenience, &v[0],
2194                                                (ndr_push_flags_fn_t)ndr_push_drsuapi_DsReplicaObjectIdentifier3);
2195                 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
2196                         c->status = ndr_map_error2ntstatus(ndr_err);
2197                         if (!composite_is_ok(c)) return;
2198                 }
2199
2200                 vs[0].blob              = &vd[0];
2201
2202                 attrs[i].attid                  = DRSUAPI_ATTRIBUTE_serverReference;
2203                 attrs[i].value_ctr.num_values   = 1;
2204                 attrs[i].value_ctr.values       = vs;
2205
2206                 i++;
2207         }
2208
2209         /* options:... */
2210         if (s->rodc_join) {
2211                 struct drsuapi_DsAttributeValue *vs;
2212                 DATA_BLOB *vd;
2213
2214                 vs = talloc_array(attrs, struct drsuapi_DsAttributeValue, 1);
2215                 if (composite_nomem(vs, c)) return;
2216
2217                 vd = talloc_array(vs, DATA_BLOB, 1);
2218                 if (composite_nomem(vd, c)) return;
2219
2220                 vd[0] = data_blob_talloc(vd, NULL, 4);
2221                 if (composite_nomem(vd[0].data, c)) return;
2222
2223                 SIVAL(vd[0].data, 0, DS_NTDSDSA_OPT_DISABLE_OUTBOUND_REPL);
2224
2225                 vs[0].blob              = &vd[0];
2226
2227                 attrs[i].attid                  = DRSUAPI_ATTRIBUTE_options;
2228                 attrs[i].value_ctr.num_values   = 1;
2229                 attrs[i].value_ctr.values       = vs;
2230
2231                 i++;
2232         }
2233
2234         /* truncate the attribute list to the attribute count we have filled in */
2235         num_attrs = i;
2236
2237         /* setup request structure */
2238         r->in.bind_handle                                               = &s->drsuapi1.bind_handle;
2239         r->in.level                                                     = 2;
2240         r->in.req                                                       = talloc(s, union drsuapi_DsAddEntryRequest);
2241         r->in.req->req2.first_object.next_object                        = NULL;
2242         r->in.req->req2.first_object.object.identifier                  = identifier;
2243         r->in.req->req2.first_object.object.flags                       = 0x00000000;
2244         r->in.req->req2.first_object.object.attribute_ctr.num_attributes= num_attrs;
2245         r->in.req->req2.first_object.object.attribute_ctr.attributes    = attrs;
2246
2247         r->out.level_out        = talloc(s, int32_t);
2248         r->out.ctr              = talloc(s, union drsuapi_DsAddEntryCtr);
2249
2250         s->ndr_struct_ptr = r;
2251         req = dcerpc_drsuapi_DsAddEntry_send(s->drsuapi1.pipe, r, r);
2252         composite_continue_rpc(c, req, becomeDC_drsuapi1_add_entry_recv, s);
2253 }
2254
2255 static void becomeDC_drsuapi2_connect_recv(struct composite_context *req);
2256 static NTSTATUS becomeDC_prepare_db(struct libnet_BecomeDC_state *s);
2257
2258 static void becomeDC_drsuapi1_add_entry_recv(struct rpc_request *req)
2259 {
2260         struct libnet_BecomeDC_state *s = talloc_get_type(req->async.private_data,
2261                                           struct libnet_BecomeDC_state);
2262         struct composite_context *c = s->creq;
2263         struct drsuapi_DsAddEntry *r = talloc_get_type_abort(s->ndr_struct_ptr,
2264                                        struct drsuapi_DsAddEntry);
2265         char *binding_str;
2266
2267         s->ndr_struct_ptr = NULL;
2268
2269         c->status = dcerpc_drsuapi_DsAddEntry_recv(req);
2270         if (!composite_is_ok(c)) return;
2271
2272         if (!W_ERROR_IS_OK(r->out.result)) {
2273                 composite_error(c, werror_to_ntstatus(r->out.result));
2274                 return;
2275         }
2276
2277         if (*r->out.level_out == 3) {
2278                 if (r->out.ctr->ctr3.count != 1) {
2279                         WERROR status;
2280
2281                         if (r->out.ctr->ctr3.level != 1) {
2282                                 composite_error(c, NT_STATUS_INVALID_NETWORK_RESPONSE);
2283                                 return;
2284                         }
2285
2286                         if (!r->out.ctr->ctr3.error) {
2287                                 composite_error(c, NT_STATUS_INVALID_NETWORK_RESPONSE);
2288                                 return;
2289                         }
2290
2291                         status = r->out.ctr->ctr3.error->info1.status;
2292
2293                         if (!r->out.ctr->ctr3.error->info1.info) {
2294                                 composite_error(c, werror_to_ntstatus(status));
2295                                 return;
2296                         }
2297
2298                         /* see if we can get a more detailed error */
2299                         switch (r->out.ctr->ctr3.error->info1.level) {
2300                         case 1:
2301                                 status = r->out.ctr->ctr3.error->info1.info->error1.status;
2302                                 break;
2303                         case 4:
2304                         case 5:
2305                         case 6:
2306                         case 7:
2307                                 status = r->out.ctr->ctr3.error->info1.info->errorX.status;
2308                                 break;
2309                         }
2310
2311                         composite_error(c, werror_to_ntstatus(status));
2312                         return;
2313                 }
2314
2315                 s->dest_dsa.ntds_guid   = r->out.ctr->ctr3.objects[0].guid;
2316         } else if (*r->out.level_out == 2) {
2317                 if (r->out.ctr->ctr2.count != 1) {
2318                         composite_error(c, werror_to_ntstatus(r->out.ctr->ctr2.error.status));
2319                         return;
2320                 }
2321
2322                 s->dest_dsa.ntds_guid   = r->out.ctr->ctr2.objects[0].guid;
2323         } else {
2324                 composite_error(c, NT_STATUS_INVALID_NETWORK_RESPONSE);
2325                 return;
2326         }
2327
2328         talloc_free(r);
2329
2330         s->dest_dsa.ntds_dn_str = talloc_asprintf(s, "CN=NTDS Settings,%s",
2331                                                   s->dest_dsa.server_dn_str);
2332         if (composite_nomem(s->dest_dsa.ntds_dn_str, c)) return;
2333
2334         c->status = becomeDC_prepare_db(s);
2335         if (!composite_is_ok(c)) return;
2336
2337         /* this avoids the epmapper lookup on the 2nd connection */
2338         binding_str = dcerpc_binding_string(s, s->drsuapi1.binding);
2339         if (composite_nomem(binding_str, c)) return;
2340
2341         c->status = dcerpc_parse_binding(s, binding_str, &s->drsuapi2.binding);
2342         talloc_free(binding_str);
2343         if (!composite_is_ok(c)) return;
2344
2345         /* w2k3 uses the same assoc_group_id as on the first connection, so we do */
2346         s->drsuapi2.binding->assoc_group_id     = s->drsuapi1.pipe->assoc_group_id;
2347
2348         becomeDC_drsuapi_connect_send(s, &s->drsuapi2, becomeDC_drsuapi2_connect_recv);
2349 }
2350
2351 static NTSTATUS becomeDC_prepare_db(struct libnet_BecomeDC_state *s)
2352 {
2353         if (!s->callbacks.prepare_db) return NT_STATUS_OK;
2354
2355         s->_pp.domain           = &s->domain;
2356         s->_pp.forest           = &s->forest;
2357         s->_pp.source_dsa       = &s->source_dsa;
2358         s->_pp.dest_dsa         = &s->dest_dsa;
2359
2360         return s->callbacks.prepare_db(s->callbacks.private_data, &s->_pp);
2361 }
2362
2363 static void becomeDC_drsuapi2_bind_recv(struct rpc_request *req);
2364
2365 static void becomeDC_drsuapi2_connect_recv(struct composite_context *req)
2366 {
2367         struct libnet_BecomeDC_state *s = talloc_get_type(req->async.private_data,
2368                                           struct libnet_BecomeDC_state);
2369         struct composite_context *c = s->creq;
2370
2371         c->status = dcerpc_pipe_connect_b_recv(req, s, &s->drsuapi2.pipe);
2372         if (!composite_is_ok(c)) return;
2373
2374         c->status = gensec_session_key(s->drsuapi2.pipe->conn->security_state.generic_state,
2375                                        &s->drsuapi2.gensec_skey);
2376         if (!composite_is_ok(c)) return;
2377
2378         becomeDC_drsuapi_bind_send(s, &s->drsuapi2, becomeDC_drsuapi2_bind_recv);
2379 }
2380
2381 static void becomeDC_drsuapi3_connect_recv(struct composite_context *req);
2382
2383 static void becomeDC_drsuapi2_bind_recv(struct rpc_request *req)
2384 {
2385         struct libnet_BecomeDC_state *s = talloc_get_type(req->async.private_data,
2386                                           struct libnet_BecomeDC_state);
2387         struct composite_context *c = s->creq;
2388         char *binding_str;
2389         WERROR status;
2390
2391         c->status = dcerpc_drsuapi_DsBind_recv(req);
2392         if (!composite_is_ok(c)) return;
2393
2394         status = becomeDC_drsuapi_bind_recv(s, &s->drsuapi2);
2395         if (!W_ERROR_IS_OK(status)) {
2396                 composite_error(c, werror_to_ntstatus(status));
2397                 return;
2398         }
2399
2400         /* this avoids the epmapper lookup on the 3rd connection */
2401         binding_str = dcerpc_binding_string(s, s->drsuapi1.binding);
2402         if (composite_nomem(binding_str, c)) return;
2403
2404         c->status = dcerpc_parse_binding(s, binding_str, &s->drsuapi3.binding);
2405         talloc_free(binding_str);
2406         if (!composite_is_ok(c)) return;
2407
2408         /* w2k3 uses the same assoc_group_id as on the first connection, so we do */
2409         s->drsuapi3.binding->assoc_group_id     = s->drsuapi1.pipe->assoc_group_id;
2410         /* w2k3 uses the concurrent multiplex feature on the 3rd connection, so we do */
2411         s->drsuapi3.binding->flags              |= DCERPC_CONCURRENT_MULTIPLEX;
2412
2413         becomeDC_drsuapi_connect_send(s, &s->drsuapi3, becomeDC_drsuapi3_connect_recv);
2414 }
2415
2416 static void becomeDC_drsuapi3_pull_schema_send(struct libnet_BecomeDC_state *s);
2417
2418 static void becomeDC_drsuapi3_connect_recv(struct composite_context *req)
2419 {
2420         struct libnet_BecomeDC_state *s = talloc_get_type(req->async.private_data,
2421                                           struct libnet_BecomeDC_state);
2422         struct composite_context *c = s->creq;
2423
2424         c->status = dcerpc_pipe_connect_b_recv(req, s, &s->drsuapi3.pipe);
2425         if (!composite_is_ok(c)) return;
2426
2427         c->status = gensec_session_key(s->drsuapi3.pipe->conn->security_state.generic_state,
2428                                        &s->drsuapi3.gensec_skey);
2429         if (!composite_is_ok(c)) return;
2430
2431         becomeDC_drsuapi3_pull_schema_send(s);
2432 }
2433
2434 static void becomeDC_drsuapi_pull_partition_send(struct libnet_BecomeDC_state *s,
2435                                                  struct becomeDC_drsuapi *drsuapi_h,
2436                                                  struct becomeDC_drsuapi *drsuapi_p,
2437                                                  struct libnet_BecomeDC_Partition *partition,
2438                                                  void (*recv_fn)(struct rpc_request *req))
2439 {
2440         struct composite_context *c = s->creq;
2441         struct rpc_request *req;
2442         struct drsuapi_DsGetNCChanges *r;
2443
2444         r = talloc(s, struct drsuapi_DsGetNCChanges);
2445         if (composite_nomem(r, c)) return;
2446
2447         r->out.level_out = talloc(r, int32_t);
2448         if (composite_nomem(r->out.level_out, c)) return;
2449         r->in.req = talloc(r, union drsuapi_DsGetNCChangesRequest);
2450         if (composite_nomem(r->in.req, c)) return;
2451         r->out.ctr = talloc(r, union drsuapi_DsGetNCChangesCtr);
2452         if (composite_nomem(r->out.ctr, c)) return;
2453
2454         r->in.bind_handle       = &drsuapi_h->bind_handle;
2455         if (drsuapi_h->remote_info28.supported_extensions & DRSUAPI_SUPPORTED_EXTENSION_GETCHGREQ_V8) {
2456                 r->in.level                             = 8;
2457                 r->in.req->req8.destination_dsa_guid    = partition->destination_dsa_guid;
2458                 r->in.req->req8.source_dsa_invocation_id= partition->source_dsa_invocation_id;
2459                 r->in.req->req8.naming_context          = &partition->nc;
2460                 r->in.req->req8.highwatermark           = partition->highwatermark;
2461                 r->in.req->req8.uptodateness_vector     = NULL;
2462                 r->in.req->req8.replica_flags           = partition->replica_flags;
2463                 r->in.req->req8.max_object_count        = 133;
2464                 r->in.req->req8.max_ndr_size            = 1336811;
2465                 r->in.req->req8.extended_op             = DRSUAPI_EXOP_NONE;
2466                 r->in.req->req8.fsmo_info               = 0;
2467                 r->in.req->req8.partial_attribute_set   = NULL;
2468                 r->in.req->req8.partial_attribute_set_ex= NULL;
2469                 r->in.req->req8.mapping_ctr.num_mappings= 0;
2470                 r->in.req->req8.mapping_ctr.mappings    = NULL;
2471         } else {
2472                 r->in.level                             = 5;
2473                 r->in.req->req5.destination_dsa_guid    = partition->destination_dsa_guid;
2474                 r->in.req->req5.source_dsa_invocation_id= partition->source_dsa_invocation_id;
2475                 r->in.req->req5.naming_context          = &partition->nc;
2476                 r->in.req->req5.highwatermark           = partition->highwatermark;
2477                 r->in.req->req5.uptodateness_vector     = NULL;
2478                 r->in.req->req5.replica_flags           = partition->replica_flags;
2479                 r->in.req->req5.max_object_count        = 133;
2480                 r->in.req->req5.max_ndr_size            = 1336770;
2481                 r->in.req->req5.extended_op             = DRSUAPI_EXOP_NONE;
2482                 r->in.req->req5.fsmo_info               = 0;
2483         }
2484
2485         /*
2486          * we should try to use the drsuapi_p->pipe here, as w2k3 does
2487          * but it seems that some extra flags in the DCERPC Bind call
2488          * are needed for it. Or the same KRB5 TGS is needed on both
2489          * connections.
2490          */
2491         s->ndr_struct_ptr = r;
2492         req = dcerpc_drsuapi_DsGetNCChanges_send(drsuapi_p->pipe, r, r);
2493         composite_continue_rpc(c, req, recv_fn, s);
2494 }
2495
2496 static WERROR becomeDC_drsuapi_pull_partition_recv(struct libnet_BecomeDC_state *s,
2497                                                    struct becomeDC_drsuapi *drsuapi_h,
2498                                                    struct becomeDC_drsuapi *drsuapi_p,
2499                                                    struct libnet_BecomeDC_Partition *partition,
2500                                                    struct drsuapi_DsGetNCChanges *r)
2501 {
2502         uint32_t ctr_level = 0;
2503         struct drsuapi_DsGetNCChangesCtr1 *ctr1 = NULL;
2504         struct drsuapi_DsGetNCChangesCtr6 *ctr6 = NULL;
2505         struct GUID *source_dsa_guid = NULL;
2506         struct GUID *source_dsa_invocation_id = NULL;
2507         struct drsuapi_DsReplicaHighWaterMark *new_highwatermark = NULL;
2508         bool more_data = false;
2509         NTSTATUS nt_status;
2510
2511         if (!W_ERROR_IS_OK(r->out.result)) {
2512                 return r->out.result;
2513         }
2514
2515         if (*r->out.level_out == 1) {
2516                 ctr_level = 1;
2517                 ctr1 = &r->out.ctr->ctr1;
2518         } else if (*r->out.level_out == 2 &&
2519                    r->out.ctr->ctr2.mszip1.ts) {
2520                 ctr_level = 1;
2521                 ctr1 = &r->out.ctr->ctr2.mszip1.ts->ctr1;
2522         } else if (*r->out.level_out == 6) {
2523                 ctr_level = 6;
2524                 ctr6 = &r->out.ctr->ctr6;
2525         } else if (*r->out.level_out == 7 &&
2526                    r->out.ctr->ctr7.level == 6 &&
2527                    r->out.ctr->ctr7.type == DRSUAPI_COMPRESSION_TYPE_MSZIP &&
2528                    r->out.ctr->ctr7.ctr.mszip6.ts) {
2529                 ctr_level = 6;
2530                 ctr6 = &r->out.ctr->ctr7.ctr.mszip6.ts->ctr6;
2531         } else if (*r->out.level_out == 7 &&
2532                    r->out.ctr->ctr7.level == 6 &&
2533                    r->out.ctr->ctr7.type == DRSUAPI_COMPRESSION_TYPE_XPRESS &&
2534                    r->out.ctr->ctr7.ctr.xpress6.ts) {
2535                 ctr_level = 6;
2536                 ctr6 = &r->out.ctr->ctr7.ctr.xpress6.ts->ctr6;
2537         } else {
2538                 return WERR_BAD_NET_RESP;
2539         }
2540
2541         if (!ctr1 && ! ctr6) {
2542                 return WERR_BAD_NET_RESP;
2543         }
2544
2545         if (ctr_level == 6) {
2546                 if (!W_ERROR_IS_OK(ctr6->drs_error)) {
2547                         return ctr6->drs_error;
2548                 }
2549         }
2550
2551         switch (ctr_level) {
2552         case 1:
2553                 source_dsa_guid                 = &ctr1->source_dsa_guid;
2554                 source_dsa_invocation_id        = &ctr1->source_dsa_invocation_id;
2555                 new_highwatermark               = &ctr1->new_highwatermark;
2556                 more_data                       = ctr1->more_data;
2557                 break;
2558         case 6:
2559                 source_dsa_guid                 = &ctr6->source_dsa_guid;
2560                 source_dsa_invocation_id        = &ctr6->source_dsa_invocation_id;
2561                 new_highwatermark               = &ctr6->new_highwatermark;
2562                 more_data                       = ctr6->more_data;
2563                 break;
2564         }
2565
2566         partition->highwatermark                = *new_highwatermark;
2567         partition->source_dsa_guid              = *source_dsa_guid;
2568         partition->source_dsa_invocation_id     = *source_dsa_invocation_id;
2569         partition->more_data                    = more_data;
2570
2571         if (!partition->store_chunk) return WERR_OK;
2572
2573         s->_sc.domain           = &s->domain;
2574         s->_sc.forest           = &s->forest;
2575         s->_sc.source_dsa       = &s->source_dsa;
2576         s->_sc.dest_dsa         = &s->dest_dsa;
2577         s->_sc.partition        = partition;
2578         s->_sc.ctr_level        = ctr_level;
2579         s->_sc.ctr1             = ctr1;
2580         s->_sc.ctr6             = ctr6;
2581         /*
2582          * we need to use the drsuapi_p->gensec_skey here,
2583          * when we use drsuapi_p->pipe in the for this request
2584          */
2585         s->_sc.gensec_skey      = &drsuapi_p->gensec_skey;
2586
2587         nt_status = partition->store_chunk(s->callbacks.private_data, &s->_sc);
2588         if (!NT_STATUS_IS_OK(nt_status)) {
2589                 return ntstatus_to_werror(nt_status);
2590         }
2591
2592         return WERR_OK;
2593 }
2594
2595 static void becomeDC_drsuapi3_pull_schema_recv(struct rpc_request *req);
2596
2597 static void becomeDC_drsuapi3_pull_schema_send(struct libnet_BecomeDC_state *s)
2598 {
2599         s->schema_part.nc.guid  = GUID_zero();
2600         s->schema_part.nc.sid   = s->zero_sid;
2601         s->schema_part.nc.dn    = s->forest.schema_dn_str;
2602
2603         s->schema_part.destination_dsa_guid     = s->drsuapi2.bind_guid;
2604
2605         s->schema_part.replica_flags    = DRSUAPI_DRS_WRIT_REP
2606                                         | DRSUAPI_DRS_INIT_SYNC
2607                                         | DRSUAPI_DRS_PER_SYNC
2608                                         | DRSUAPI_DRS_FULL_SYNC_IN_PROGRESS
2609                                         | DRSUAPI_DRS_NEVER_SYNCED
2610                                         | DRSUAPI_DRS_USE_COMPRESSION;
2611         if (s->rodc_join) {
2612             s->schema_part.replica_flags &= ~DRSUAPI_DRS_WRIT_REP;
2613         }
2614
2615         s->schema_part.store_chunk      = s->callbacks.schema_chunk;
2616
2617         becomeDC_drsuapi_pull_partition_send(s, &s->drsuapi2, &s->drsuapi3, &s->schema_part,
2618                                              becomeDC_drsuapi3_pull_schema_recv);
2619 }
2620
2621 static void becomeDC_drsuapi3_pull_config_send(struct libnet_BecomeDC_state *s);
2622
2623 static void becomeDC_drsuapi3_pull_schema_recv(struct rpc_request *req)
2624 {
2625         struct libnet_BecomeDC_state *s = talloc_get_type(req->async.private_data,
2626                                           struct libnet_BecomeDC_state);
2627         struct composite_context *c = s->creq;
2628         struct drsuapi_DsGetNCChanges *r = talloc_get_type_abort(s->ndr_struct_ptr,
2629                                            struct drsuapi_DsGetNCChanges);
2630         WERROR status;
2631
2632         s->ndr_struct_ptr = NULL;
2633
2634         c->status = dcerpc_drsuapi_DsGetNCChanges_recv(req);
2635         if (!composite_is_ok(c)) return;
2636
2637         status = becomeDC_drsuapi_pull_partition_recv(s, &s->drsuapi2, &s->drsuapi3, &s->schema_part, r);
2638         if (!W_ERROR_IS_OK(status)) {
2639                 composite_error(c, werror_to_ntstatus(status));
2640                 return;
2641         }
2642
2643         talloc_free(r);
2644
2645         if (s->schema_part.more_data) {
2646                 becomeDC_drsuapi_pull_partition_send(s, &s->drsuapi2, &s->drsuapi3, &s->schema_part,
2647                                                      becomeDC_drsuapi3_pull_schema_recv);
2648                 return;
2649         }
2650
2651         becomeDC_drsuapi3_pull_config_send(s);
2652 }
2653
2654 static void becomeDC_drsuapi3_pull_config_recv(struct rpc_request *req);
2655
2656 static void becomeDC_drsuapi3_pull_config_send(struct libnet_BecomeDC_state *s)
2657 {
2658         s->config_part.nc.guid  = GUID_zero();
2659         s->config_part.nc.sid   = s->zero_sid;
2660         s->config_part.nc.dn    = s->forest.config_dn_str;
2661
2662         s->config_part.destination_dsa_guid     = s->drsuapi2.bind_guid;
2663
2664         s->config_part.replica_flags    = DRSUAPI_DRS_WRIT_REP
2665                                         | DRSUAPI_DRS_INIT_SYNC
2666                                         | DRSUAPI_DRS_PER_SYNC
2667                                         | DRSUAPI_DRS_FULL_SYNC_IN_PROGRESS
2668                                         | DRSUAPI_DRS_NEVER_SYNCED
2669                                         | DRSUAPI_DRS_USE_COMPRESSION;
2670         if (s->rodc_join) {
2671             s->schema_part.replica_flags &= ~DRSUAPI_DRS_WRIT_REP;
2672         }
2673
2674         s->config_part.store_chunk      = s->callbacks.config_chunk;
2675
2676         becomeDC_drsuapi_pull_partition_send(s, &s->drsuapi2, &s->drsuapi3, &s->config_part,
2677                                              becomeDC_drsuapi3_pull_config_recv);
2678 }
2679
2680 static void becomeDC_drsuapi3_pull_config_recv(struct rpc_request *req)
2681 {
2682         struct libnet_BecomeDC_state *s = talloc_get_type(req->async.private_data,
2683                                           struct libnet_BecomeDC_state);
2684         struct composite_context *c = s->creq;
2685         struct drsuapi_DsGetNCChanges *r = talloc_get_type_abort(s->ndr_struct_ptr,
2686                                            struct drsuapi_DsGetNCChanges);
2687         WERROR status;
2688
2689         s->ndr_struct_ptr = NULL;
2690
2691         c->status = dcerpc_drsuapi_DsGetNCChanges_recv(req);
2692         if (!composite_is_ok(c)) return;
2693
2694         status = becomeDC_drsuapi_pull_partition_recv(s, &s->drsuapi2, &s->drsuapi3, &s->config_part, r);
2695         if (!W_ERROR_IS_OK(status)) {
2696                 composite_error(c, werror_to_ntstatus(status));
2697                 return;
2698         }
2699
2700         talloc_free(r);
2701
2702         if (s->config_part.more_data) {
2703                 becomeDC_drsuapi_pull_partition_send(s, &s->drsuapi2, &s->drsuapi3, &s->config_part,
2704                                                      becomeDC_drsuapi3_pull_config_recv);
2705                 return;
2706         }
2707
2708         becomeDC_connect_ldap2(s);
2709 }
2710
2711 static void becomeDC_drsuapi3_pull_domain_recv(struct rpc_request *req);
2712
2713 static void becomeDC_drsuapi3_pull_domain_send(struct libnet_BecomeDC_state *s)
2714 {
2715         s->domain_part.nc.guid  = GUID_zero();
2716         s->domain_part.nc.sid   = s->zero_sid;
2717         s->domain_part.nc.dn    = s->domain.dn_str;
2718
2719         s->domain_part.destination_dsa_guid     = s->drsuapi2.bind_guid;
2720
2721         s->domain_part.replica_flags    = DRSUAPI_DRS_WRIT_REP
2722                                         | DRSUAPI_DRS_INIT_SYNC
2723                                         | DRSUAPI_DRS_PER_SYNC
2724                                         | DRSUAPI_DRS_FULL_SYNC_IN_PROGRESS
2725                                         | DRSUAPI_DRS_NEVER_SYNCED
2726                                         | DRSUAPI_DRS_USE_COMPRESSION;
2727         if (s->rodc_join) {
2728             s->schema_part.replica_flags &= ~DRSUAPI_DRS_WRIT_REP;
2729         }
2730
2731         s->domain_part.store_chunk      = s->callbacks.domain_chunk;
2732
2733         becomeDC_drsuapi_pull_partition_send(s, &s->drsuapi2, &s->drsuapi3, &s->domain_part,
2734                                              becomeDC_drsuapi3_pull_domain_recv);
2735 }
2736
2737 static void becomeDC_drsuapi_update_refs_send(struct libnet_BecomeDC_state *s,
2738                                               struct becomeDC_drsuapi *drsuapi,
2739                                               struct libnet_BecomeDC_Partition *partition,
2740                                               void (*recv_fn)(struct rpc_request *req));
2741 static void becomeDC_drsuapi2_update_refs_schema_recv(struct rpc_request *req);
2742
2743 static void becomeDC_drsuapi3_pull_domain_recv(struct rpc_request *req)
2744 {
2745         struct libnet_BecomeDC_state *s = talloc_get_type(req->async.private_data,
2746                                           struct libnet_BecomeDC_state);
2747         struct composite_context *c = s->creq;
2748         struct drsuapi_DsGetNCChanges *r = talloc_get_type_abort(s->ndr_struct_ptr,
2749                                            struct drsuapi_DsGetNCChanges);
2750         WERROR status;
2751
2752         s->ndr_struct_ptr = NULL;
2753
2754         c->status = dcerpc_drsuapi_DsGetNCChanges_recv(req);
2755         if (!composite_is_ok(c)) return;
2756
2757         status = becomeDC_drsuapi_pull_partition_recv(s, &s->drsuapi2, &s->drsuapi3, &s->domain_part, r);
2758         if (!W_ERROR_IS_OK(status)) {
2759                 composite_error(c, werror_to_ntstatus(status));
2760                 return;
2761         }
2762
2763         talloc_free(r);
2764
2765         if (s->domain_part.more_data) {
2766                 becomeDC_drsuapi_pull_partition_send(s, &s->drsuapi2, &s->drsuapi3, &s->domain_part,
2767                                                      becomeDC_drsuapi3_pull_domain_recv);
2768                 return;
2769         }
2770
2771         becomeDC_drsuapi_update_refs_send(s, &s->drsuapi2, &s->schema_part,
2772                                           becomeDC_drsuapi2_update_refs_schema_recv);
2773 }
2774
2775 static void becomeDC_drsuapi_update_refs_send(struct libnet_BecomeDC_state *s,
2776                                               struct becomeDC_drsuapi *drsuapi,
2777                                               struct libnet_BecomeDC_Partition *partition,
2778                                               void (*recv_fn)(struct rpc_request *req))
2779 {
2780         struct composite_context *c = s->creq;
2781         struct rpc_request *req;
2782         struct drsuapi_DsReplicaUpdateRefs *r;
2783         const char *ntds_guid_str;
2784         const char *ntds_dns_name;
2785
2786         r = talloc(s, struct drsuapi_DsReplicaUpdateRefs);
2787         if (composite_nomem(r, c)) return;
2788
2789         ntds_guid_str = GUID_string(r, &s->dest_dsa.ntds_guid);
2790         if (composite_nomem(ntds_guid_str, c)) return;
2791
2792         ntds_dns_name = talloc_asprintf(r, "%s._msdcs.%s",
2793                                         ntds_guid_str,
2794                                         s->domain.dns_name);
2795         if (composite_nomem(ntds_dns_name, c)) return;
2796
2797         r->in.bind_handle               = &drsuapi->bind_handle;
2798         r->in.level                     = 1;
2799         r->in.req.req1.naming_context   = &partition->nc;
2800         r->in.req.req1.dest_dsa_dns_name= ntds_dns_name;
2801         r->in.req.req1.dest_dsa_guid    = s->dest_dsa.ntds_guid;
2802         r->in.req.req1.options          = DRSUAPI_DRS_ADD_REF | DRSUAPI_DRS_DEL_REF;
2803
2804         /* I think this is how we mark ourselves as a RODC */
2805         if (!lp_parm_bool(s->libnet->lp_ctx, NULL, "repl", "RODC", false)) {
2806                 r->in.req.req1.options |= DRSUAPI_DRS_WRIT_REP;
2807         }
2808
2809         s->ndr_struct_ptr = r;
2810         req = dcerpc_drsuapi_DsReplicaUpdateRefs_send(drsuapi->pipe, r, r);
2811         composite_continue_rpc(c, req, recv_fn, s);
2812 }
2813
2814 static void becomeDC_drsuapi2_update_refs_config_recv(struct rpc_request *req);
2815
2816 static void becomeDC_drsuapi2_update_refs_schema_recv(struct rpc_request *req)
2817 {
2818         struct libnet_BecomeDC_state *s = talloc_get_type(req->async.private_data,
2819                                           struct libnet_BecomeDC_state);
2820         struct composite_context *c = s->creq;
2821         struct drsuapi_DsReplicaUpdateRefs *r = talloc_get_type_abort(s->ndr_struct_ptr,
2822                                            struct drsuapi_DsReplicaUpdateRefs);
2823
2824         s->ndr_struct_ptr = NULL;
2825
2826         c->status = dcerpc_drsuapi_DsReplicaUpdateRefs_recv(req);
2827         if (!composite_is_ok(c)) return;
2828
2829         if (!W_ERROR_IS_OK(r->out.result)) {
2830                 composite_error(c, werror_to_ntstatus(r->out.result));
2831                 return;
2832         }
2833
2834         talloc_free(r);
2835
2836         becomeDC_drsuapi_update_refs_send(s, &s->drsuapi2, &s->config_part,
2837                                           becomeDC_drsuapi2_update_refs_config_recv);
2838 }
2839
2840 static void becomeDC_drsuapi2_update_refs_domain_recv(struct rpc_request *req);
2841
2842 static void becomeDC_drsuapi2_update_refs_config_recv(struct rpc_request *req)
2843 {
2844         struct libnet_BecomeDC_state *s = talloc_get_type(req->async.private_data,
2845                                           struct libnet_BecomeDC_state);
2846         struct composite_context *c = s->creq;
2847         struct drsuapi_DsReplicaUpdateRefs *r = talloc_get_type(s->ndr_struct_ptr,
2848                                            struct drsuapi_DsReplicaUpdateRefs);
2849
2850         s->ndr_struct_ptr = NULL;
2851
2852         c->status = dcerpc_drsuapi_DsReplicaUpdateRefs_recv(req);
2853         if (!composite_is_ok(c)) return;
2854
2855         if (!W_ERROR_IS_OK(r->out.result)) {
2856                 composite_error(c, werror_to_ntstatus(r->out.result));
2857                 return;
2858         }
2859
2860         talloc_free(r);
2861
2862         becomeDC_drsuapi_update_refs_send(s, &s->drsuapi2, &s->domain_part,
2863                                           becomeDC_drsuapi2_update_refs_domain_recv);
2864 }
2865
2866 static void becomeDC_drsuapi2_update_refs_domain_recv(struct rpc_request *req)
2867 {
2868         struct libnet_BecomeDC_state *s = talloc_get_type(req->async.private_data,
2869                                           struct libnet_BecomeDC_state);
2870         struct composite_context *c = s->creq;
2871         struct drsuapi_DsReplicaUpdateRefs *r = talloc_get_type(s->ndr_struct_ptr,
2872                                            struct drsuapi_DsReplicaUpdateRefs);
2873
2874         s->ndr_struct_ptr = NULL;
2875
2876         c->status = dcerpc_drsuapi_DsReplicaUpdateRefs_recv(req);
2877         if (!composite_is_ok(c)) return;
2878
2879         if (!W_ERROR_IS_OK(r->out.result)) {
2880                 composite_error(c, werror_to_ntstatus(r->out.result));
2881                 return;
2882         }
2883
2884         talloc_free(r);
2885
2886         /* TODO: use DDNS updates and register dns names */
2887         composite_done(c);
2888 }
2889
2890 static NTSTATUS becomeDC_ldap2_modify_computer(struct libnet_BecomeDC_state *s)
2891 {
2892         int ret;
2893         struct ldb_message *msg;
2894         uint32_t i;
2895         uint32_t user_account_control = UF_SERVER_TRUST_ACCOUNT |
2896                                         UF_TRUSTED_FOR_DELEGATION;
2897
2898         /* as the value is already as we want it to be, we're done */
2899         if (s->dest_dsa.user_account_control == user_account_control) {
2900                 return NT_STATUS_OK;
2901         }
2902
2903         /* make a 'modify' msg, and only for serverReference */
2904         msg = ldb_msg_new(s);
2905         NT_STATUS_HAVE_NO_MEMORY(msg);
2906         msg->dn = ldb_dn_new(msg, s->ldap2.ldb, s->dest_dsa.computer_dn_str);
2907         NT_STATUS_HAVE_NO_MEMORY(msg->dn);
2908
2909         ret = ldb_msg_add_fmt(msg, "userAccountControl", "%u", user_account_control);
2910         if (ret != 0) {
2911                 talloc_free(msg);
2912                 return NT_STATUS_NO_MEMORY;
2913         }
2914
2915         /* mark all the message elements (should be just one)
2916            as LDB_FLAG_MOD_REPLACE */
2917         for (i=0;i<msg->num_elements;i++) {
2918                 msg->elements[i].flags = LDB_FLAG_MOD_REPLACE;
2919         }
2920
2921         ret = ldb_modify(s->ldap2.ldb, msg);
2922         talloc_free(msg);
2923         if (ret != LDB_SUCCESS) {
2924                 return NT_STATUS_LDAP(ret);
2925         }
2926
2927         s->dest_dsa.user_account_control = user_account_control;
2928
2929         return NT_STATUS_OK;
2930 }
2931
2932 static NTSTATUS becomeDC_ldap2_move_computer(struct libnet_BecomeDC_state *s)
2933 {
2934         int ret;
2935         struct ldb_dn *old_dn;
2936         struct ldb_dn *new_dn;
2937
2938         ret = dsdb_wellknown_dn(s->ldap2.ldb, s, samdb_base_dn(s->ldap2.ldb),
2939                                 DS_GUID_DOMAIN_CONTROLLERS_CONTAINER,
2940                                 &new_dn);
2941         if (ret != LDB_SUCCESS) {
2942                 return NT_STATUS_LDAP(ret);
2943         }
2944
2945         if (!ldb_dn_add_child_fmt(new_dn, "CN=%s", s->dest_dsa.netbios_name)) {
2946                 talloc_free(new_dn);
2947                 return NT_STATUS_NO_MEMORY;
2948         }
2949
2950         old_dn = ldb_dn_new(new_dn, s->ldap2.ldb, s->dest_dsa.computer_dn_str);
2951         NT_STATUS_HAVE_NO_MEMORY(old_dn);
2952
2953         if (ldb_dn_compare(old_dn, new_dn) == 0) {
2954                 /* we don't need to rename if the old and new dn match */
2955                 talloc_free(new_dn);
2956                 return NT_STATUS_OK;
2957         }
2958
2959         ret = ldb_rename(s->ldap2.ldb, old_dn, new_dn);
2960         if (ret != LDB_SUCCESS) {
2961                 talloc_free(new_dn);
2962                 return NT_STATUS_LDAP(ret);
2963         }
2964
2965         s->dest_dsa.computer_dn_str = ldb_dn_alloc_linearized(s, new_dn);
2966         NT_STATUS_HAVE_NO_MEMORY(s->dest_dsa.computer_dn_str);
2967
2968         talloc_free(new_dn);
2969
2970         return NT_STATUS_OK;
2971 }
2972
2973 static void becomeDC_connect_ldap2(struct libnet_BecomeDC_state *s)
2974 {
2975         struct composite_context *c = s->creq;
2976
2977         c->status = becomeDC_ldap_connect(s, &s->ldap2);
2978         if (!composite_is_ok(c)) return;
2979
2980         c->status = becomeDC_ldap2_modify_computer(s);
2981         if (!composite_is_ok(c)) return;
2982
2983         c->status = becomeDC_ldap2_move_computer(s);
2984         if (!composite_is_ok(c)) return;
2985
2986         becomeDC_drsuapi3_pull_domain_send(s);
2987 }
2988
2989 struct composite_context *libnet_BecomeDC_send(struct libnet_context *ctx, TALLOC_CTX *mem_ctx, struct libnet_BecomeDC *r)
2990 {
2991         struct composite_context *c;
2992         struct libnet_BecomeDC_state *s;
2993         char *tmp_name;
2994
2995         c = composite_create(mem_ctx, ctx->event_ctx);
2996         if (c == NULL) return NULL;
2997
2998         s = talloc_zero(c, struct libnet_BecomeDC_state);
2999         if (composite_nomem(s, c)) return c;
3000         c->private_data = s;
3001         s->creq         = c;
3002         s->libnet       = ctx;
3003
3004         /* Domain input */
3005         s->domain.dns_name      = talloc_strdup(s, r->in.domain_dns_name);
3006         if (composite_nomem(s->domain.dns_name, c)) return c;
3007         s->domain.netbios_name  = talloc_strdup(s, r->in.domain_netbios_name);
3008         if (composite_nomem(s->domain.netbios_name, c)) return c;
3009         s->domain.sid           = dom_sid_dup(s, r->in.domain_sid);
3010         if (composite_nomem(s->domain.sid, c)) return c;
3011
3012         /* Source DSA input */
3013         s->source_dsa.address   = talloc_strdup(s, r->in.source_dsa_address);
3014         if (composite_nomem(s->source_dsa.address, c)) return c;
3015
3016         /* Destination DSA input */
3017         s->dest_dsa.netbios_name= talloc_strdup(s, r->in.dest_dsa_netbios_name);
3018         if (composite_nomem(s->dest_dsa.netbios_name, c)) return c;
3019
3020         /* Destination DSA dns_name construction */
3021         tmp_name        = strlower_talloc(s, s->dest_dsa.netbios_name);
3022         if (composite_nomem(tmp_name, c)) return c;
3023         tmp_name        = talloc_asprintf_append_buffer(tmp_name, ".%s",s->domain.dns_name);
3024         if (composite_nomem(tmp_name, c)) return c;
3025         s->dest_dsa.dns_name    = tmp_name;
3026
3027         /* Callback function pointers */
3028         s->callbacks = r->in.callbacks;
3029
3030         /* RODC join*/
3031         s->rodc_join = r->in.rodc_join;
3032
3033         becomeDC_send_cldap(s);
3034         return c;
3035 }
3036
3037 NTSTATUS libnet_BecomeDC_recv(struct composite_context *c, TALLOC_CTX *mem_ctx, struct libnet_BecomeDC *r)
3038 {
3039         NTSTATUS status;
3040
3041         status = composite_wait(c);
3042
3043         ZERO_STRUCT(r->out);
3044
3045         talloc_free(c);
3046         return status;
3047 }
3048
3049 NTSTATUS libnet_BecomeDC(struct libnet_context *ctx, TALLOC_CTX *mem_ctx, struct libnet_BecomeDC *r)
3050 {
3051         NTSTATUS status;
3052         struct composite_context *c;
3053         c = libnet_BecomeDC_send(ctx, mem_ctx, r);
3054         status = libnet_BecomeDC_recv(c, mem_ctx, r);
3055         return status;
3056 }